codiedev 0.9.80 → 0.10.0-beta.10

package/dist/cliSession.js

@@ -1,27 +1,4 @@
 "use strict";
-// Browser sign-in for `codiedev connect`, and keeping its access token fresh.
-//
-// Sign-in is OAuth 2.1 authorization code + PKCE against the Codiedev
-// backend with a loopback redirect (RFC 8252): the CLI listens on
-// 127.0.0.1:<random port>, opens the portal's consent page, and exchanges the
-// returned code for a 24h access token (cdv_at_) and a 30-day refresh token
-// (cdv_rt_). No long-lived API key is saved.
-//
-// config.json keeps `token` = the current access token, so every existing
-// reader keeps working. Each process entry point (codiedev, codiedev-hook,
-// codie, the MCP server) calls ensureFreshToken() first; it refreshes when the
-// token is about to expire.
-//
-// Refresh tokens are single-use and the server treats reuse of a spent one as
-// theft (it revokes the whole sign-in). Many hooks run in parallel and share
-// config.json, so a refresh goes:
-//   1. read config, note the stale access token ("seen")
-//   2. take ~/.codiedev/refresh.lock
-//   3. re-read config; if the token is no longer "seen", another process
-//      already refreshed: use that, no network call
-//   4. else refresh, atomically replace config.json, release
-// specs/tla/CliSession.tla model-checks this: without step 2–3, two hooks can
-// both present the same refresh token and sign the user out.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -74,15 +51,11 @@ const http = __importStar(require("http"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
-/** Default: refresh when less than 10 minutes remain. */
 exports.DEFAULT_MIN_VALIDITY_MS = 10 * 60_000;
-/** A lock older than this was left by a crashed process. Refresh calls time
- * out well before it (REFRESH_TIMEOUT_MS), so a live holder never looks stale. */
 exports.LOCK_STALE_MS = 30_000;
 const LOCK_WAIT_MS = 20_000;
 const REFRESH_TIMEOUT_MS = 10_000;
 const LOGIN_TIMEOUT_MS = 10 * 60_000;
-// ─── config IO (atomic) ────────────────────────────────────────────────
 function readConfigAt(configPath) {
     try {
         return JSON.parse(fs.readFileSync(configPath, "utf8"));
@@ -91,15 +64,11 @@ function readConfigAt(configPath) {
         return null;
     }
 }
-// Windows refuses to replace a file another process holds without share-delete
-// (antivirus, the search indexer; Node's own readers do share). Those holds
-// last milliseconds, so retry like graceful-fs/write-file-atomic do.
 const RENAME_RETRY_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
 const RENAME_RETRY_MS = [10, 25, 50, 100, 200, 400, 800];
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
-/** rename(), retrying the transient Windows sharing errors. Exported for tests. */
 function renameWithRetry(from, to, rename = fs.renameSync, sleep = sleepSync) {
     for (let attempt = 0;; attempt++) {
         try {
@@ -114,11 +83,6 @@ function renameWithRetry(from, to, rename = fs.renameSync, sleep = sleepSync) {
         }
     }
 }
-/**
- * Write via temp file + rename so a concurrent reader never sees a torn file.
- * If the rename still fails after ~1.6s of retries (a handle held that long),
- * fall back to writing in place: a rare torn read beats failing `connect`.
- */
 function writeConfigAtomic(configPath, config) {
     const dir = path.dirname(configPath);
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -134,14 +98,13 @@ function writeConfigAtomic(configPath, config) {
         try {
             fs.unlinkSync(tmp);
         }
-        catch { /* already gone */ }
+        catch { }
         if (!RENAME_RETRY_CODES.has(err?.code ?? ""))
             throw err;
     }
     fs.writeFileSync(configPath, data, { encoding: "utf8", mode: 0o600 });
     fs.chmodSync(configPath, 0o600);
 }
-// ─── refresh lock ──────────────────────────────────────────────────────
 function lockPathFor(configPath) {
     return path.join(path.dirname(configPath), "refresh.lock");
 }
@@ -155,14 +118,12 @@ function tryLock(lockPath, now) {
     catch (err) {
         if (err?.code !== "EEXIST")
             throw err;
-        // Break a lock left by a crashed process.
         try {
             const age = now - fs.statSync(lockPath).mtimeMs;
             if (age > exports.LOCK_STALE_MS)
                 fs.unlinkSync(lockPath);
         }
         catch {
-            /* raced with its owner releasing it: retry */
         }
         return false;
     }
@@ -171,7 +132,7 @@ function unlock(lockPath) {
     try {
         fs.unlinkSync(lockPath);
     }
-    catch { /* already released */ }
+    catch { }
 }
 function needsRefresh(config, now, minValidityMs) {
     const auth = config.auth;
@@ -193,11 +154,6 @@ async function postForm(fetchImpl, url, form, timeoutMs) {
         clearTimeout(timer);
     }
 }
-/**
- * Make sure config.token is a usable access token for at least
- * `minValidityMs`. Never throws: auth problems surface as the next request's
- * 401, which every command already explains.
- */
 async function ensureFreshToken(deps, minValidityMs = exports.DEFAULT_MIN_VALIDITY_MS) {
     const now = deps.now ?? Date.now;
     const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
@@ -217,7 +173,6 @@ async function ensureFreshToken(deps, minValidityMs = exports.DEFAULT_MIN_VALIDI
                 return { status: "unavailable", config: first };
             await sleep(50 + Math.floor(Math.random() * 100));
         }
-        // Step 3: re-read under the lock.
         const current = readConfigAt(deps.configPath);
         if (!current?.auth)
             return { status: "none", config: current };
@@ -248,8 +203,6 @@ async function ensureFreshToken(deps, minValidityMs = exports.DEFAULT_MIN_VALIDI
             return { status: "refreshed", config: next };
         }
         if (res.status === 400 && res.body?.error === "invalid_grant") {
-            // Revoked in the portal, signed out elsewhere, expired, or reuse was
-            // detected. Forget the credentials but keep device settings.
             const out = { ...current, token: "" };
             delete out.auth;
             writeConfigAtomic(deps.configPath, out);
@@ -262,7 +215,6 @@ async function ensureFreshToken(deps, minValidityMs = exports.DEFAULT_MIN_VALIDI
             unlock(lockPath);
     }
 }
-// ─── browser sign-in ───────────────────────────────────────────────────
 function base64Url(buf) {
     return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -292,7 +244,6 @@ const DONE_PAGE = (ok, msg) => `<!doctype html><html><head><meta charset="utf-8"
 height:100vh;margin:0;background:#fbfbfa;color:#1f1f1f}main{max-width:28rem;text-align:center}
 h1{font-size:1.25rem}</style></head><body><main><h1>${ok ? "You're signed in" : "Sign-in didn't finish"}</h1>
 <p>${msg}</p></main></body></html>`;
-/** Parse `code`/`state` (or `error`) out of a loopback callback URL. */
 function parseCallback(input) {
     try {
         const u = new URL(input.trim());
@@ -399,13 +350,7 @@ async function browserLogin(opts) {
         server.close();
     }
 }
-// ─── device sign-in (SSH / headless) ──────────────────────────────────
 exports.DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-/**
- * True when a browser opened here can't reach the user: an SSH session, or a
- * Linux box with no display. Then `connect` uses the device flow (a code the
- * user approves on any device) instead of a loopback redirect, with no flag.
- */
 function isHeadless(env = process.env, platform = process.platform) {
     if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)
         return true;
@@ -458,7 +403,7 @@ async function deviceLogin(opts) {
             res = await postForm(fetchImpl, `${opts.backendUrl}/oauth/token`, { grant_type: exports.DEVICE_CODE_GRANT, device_code: auth.device_code, client_id: clientId }, REFRESH_TIMEOUT_MS);
         }
         catch {
-            continue; // network blip: keep polling until the code expires
+            continue;
         }
         const body = res.body;
         if (res.status === 200 && typeof body?.access_token === "string" && typeof body.refresh_token === "string") {
@@ -486,7 +431,6 @@ async function deviceLogin(opts) {
         }
     }
 }
-/** `codiedev logout`: end a browser sign-in server-side, forget it locally. */
 async function logout(deps) {
     const fetchImpl = deps.fetchImpl ?? fetch;
     const config = readConfigAt(deps.configPath);
@@ -503,7 +447,6 @@ async function logout(deps) {
             serverRevoked = res.ok && (await res.json().catch(() => null))?.revoked === true;
         }
         catch {
-            /* offline: still forget locally; the portal can revoke it */
         }
     }
     const out = { ...config, token: "" };

package/dist/codexHookTrust.js

@@ -70,9 +70,6 @@ const MATCHER_EVENTS = new Set([
     "SubagentStart",
     "SubagentStop",
 ]);
-/** Codex's fingerprint of an installed plugin bundle, byte-for-byte the
- * algorithm in codex-rs hooks/src/engine/plugin_fingerprint.rs. Codex skips a
- * plugin hook unless `trusted_content_hash` equals this (Codex 0.163+). */
 function codexPluginContentHash(root) {
     const hash = crypto.createHash("sha256");
     hash.update("codex-plugin-bundle-v1");
@@ -94,7 +91,6 @@ function codexPluginContentHash(root) {
         const stat = fs.lstatSync(current);
         if (stat.isDirectory()) {
             hash.update("directory");
-            // Rust sorts by OsString, i.e. bytewise; push reversed so the smallest pops first.
             const entries = fs.readdirSync(current).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
             for (const entry of entries.reverse())
                 pending.push(path.join(current, entry));
@@ -128,8 +124,6 @@ function normalizedTimeout(eventName, value) {
         return Math.min(3, Math.max(1, configured ?? 1));
     return Math.max(1, configured ?? 600);
 }
-/** Codex hashes a canonical, normalized hook identity before it will execute a
- * user hook. Keep this compatible with codex_config::version_for_toml. */
 function codexCommandHookHash(eventName, group, handler) {
     const normalizedHandler = {
         type: "command",
@@ -198,11 +192,6 @@ function codiedevCodexHookTrustEntries(hooksPath, hooksFile) {
     }
     return entries;
 }
-/** Remove our marker block, keeping any table that isn't a hook-trust entry.
- * Codex appends new tables (e.g. `[marketplaces.codiedev-packs]`,
- * `[plugins."<id>"]`) at the end of config.toml, which lands them before our
- * closing marker when our block is last. Dropping them with the block silently
- * unregistered the pack from Codex on every reinstall. */
 function stripBlockKeepingForeign(text, begin, end) {
     const foreign = [];
     const stripped = text.replace(new RegExp(`\\n?${begin}\\n([\\s\\S]*?)${end}\\n?`, "g"), (_match, body) => {
@@ -242,9 +231,6 @@ function removeTable(lines, header) {
     }
     return output;
 }
-/** `codiedev connect` is an explicit install action, so trust only the exact
- * Codiedev commands it just wrote. Any later command change produces a new
- * hash and Codex disables that hook until connect is run again. */
 function writeCodexHookTrust(configPath, hooksPath, hooksFile) {
     const entries = codiedevCodexHookTrustEntries(hooksPath, hooksFile);
     let existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
@@ -295,21 +281,12 @@ function inspectCodexHookTrust(configPath, hooksPath, hooksFile, requiredSubcomm
     }).length;
     return { ok: entries.length > 0 && trusted === entries.length, total: entries.length, trusted };
 }
-// ---------------------------------------------------------------------------
-// Starter-pack hook trust (SIG-113). `codiedev pack install` is an explicit
-// install action for admin-approved pack hooks, so it trusts every command
-// handler in the installed pack's hooks.json (not only Codiedev's own). These
-// live in their own managed block so `codiedev connect` and `pack install`
-// never clobber each other's entries.
 const PACK_TRUST_BEGIN = "# codiedev-pack-trust:begin";
 const PACK_TRUST_END = "# codiedev-pack-trust:end";
-/** Trust entries for every command handler in a pack's hooks.json. */
 function packCodexHookTrustEntries(hooksPath, hooksFile, plugin) {
     const events = hooksFile?.hooks;
     if (!events || typeof events !== "object")
         return [];
-    // Codex keys a plugin's hooks by "<plugin id>:<path inside the plugin>",
-    // not by the file's absolute path (codex-rs declarations::plugin_hook_key_source).
     const source = plugin
         ? `${plugin.id}:${path.relative(plugin.root, hooksPath).split(path.sep).join("/")}`
         : normalizedHooksPath(hooksPath);
@@ -339,15 +316,10 @@ function packCodexHookTrustEntries(hooksPath, hooksFile, plugin) {
     }
     return entries;
 }
-/** Regenerate the pack trust block from scratch with exactly `entries`.
- * Entries for packs that were removed or whose hooks changed disappear; the
- * `codiedev-hook-trust` block and all other config are left untouched. */
 function writeCodexPackHookTrust(configPath, entries) {
     let existing = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : "";
     existing = stripBlockKeepingForeign(existing, PACK_TRUST_BEGIN, PACK_TRUST_END);
     let lines = existing.split("\n");
-    // A stray table for the same key outside our block would make the TOML
-    // invalid (duplicate table) — drop it so ours is authoritative.
     for (const entry of entries)
         lines = removeTable(lines, tableHeader(entry.key));
     const base = lines.join("\n").trimEnd();

package/dist/codexLimitScan.js

@@ -41,28 +41,6 @@ exports.sessionIdFromRolloutPath = sessionIdFromRolloutPath;
 exports.codexSessionsDir = codexSessionsDir;
 exports.recordCodexLimitReported = recordCodexLimitReported;
 exports.sweepCodexLimits = sweepCodexLimits;
-// Reporting a Codex credit/rate-limit block.
-//
-// WHY THIS EXISTS: the `limit-codex` reporter is a Codex `Stop` hook, and
-// Codex does NOT run Stop hooks on the turn a block kills. Measured on real
-// rollouts: every normal `task_complete` pairs with a Stop-hook run within
-// ~200ms, and the blocked one never does (21 turns → 20 runs; 11 → 10, short
-// by exactly the blocked turn each time). Claude Code has a dedicated
-// StopFailure event with a `rate_limit` matcher, which is why it reports
-// correctly; Codex's HookEventName enum has no equivalent — there is no event
-// at all that fires at the block.
-//
-// So the block can only be reported LATER, from a hook that does run. This
-// module scans the rollout files Codex has already written and reports any
-// block that has not been reported yet. It is driven from UserPromptSubmit
-// (`discover-codex`), which fires on the developer's next prompt — in the
-// blocked session or in a new one — and from Stop, which still catches the
-// (rarer) case of a block followed by more turns.
-//
-// The scan reads BACKWARDS from end of file. The previous reader took a fixed
-// 512 KB tail, which silently lost the event whenever the session kept writing
-// after the block: in one real 44 MB rollout the marker sat 1.13 MB from the
-// end, outside the window, and the parse returned null.
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const limitEvent_1 = require("./limitEvent");
@@ -71,19 +49,9 @@ const harnessDirs_1 = require("./harnessDirs");
 const MARKER = Buffer.from("rate_limit_reached_type");
 const SPEND_MARKER = Buffer.from("spend_control_reached");
 const NEWLINE = 0x0a;
-// Read backwards in 256 KB chunks, and give up after 16 MB. Codex rollouts run
-// to tens of megabytes, but a block is always in the session's LAST turn — the
-// bytes after it are whatever the session did once the window reset. 16 MB
-// covers that comfortably without ever loading a whole rollout.
 const DEFAULT_CHUNK_SIZE = 256 * 1024;
 const DEFAULT_MAX_SCAN_BYTES = 16 * 1024 * 1024;
-// Tail shipped to the server so it can summarize what the developer was doing
-// when they got blocked. Matches the server-side cap in http.ts.
 const DEFAULT_TAIL_BYTES = 64 * 1024;
-/**
- * Find the LAST rate-limit/credit block recorded in a Codex rollout file.
- * Returns null when the session was never blocked.
- */
 function scanCodexRolloutForLimit(filePath, options = {}) {
     const chunkSize = options.chunkSize ?? DEFAULT_CHUNK_SIZE;
     const maxScanBytes = options.maxScanBytes ?? DEFAULT_MAX_SCAN_BYTES;
@@ -105,8 +73,6 @@ function scanCodexRolloutForLimit(filePath, options = {}) {
     }
     try {
         let pos = size;
-        // Bytes of the (earlier-read) chunk that belong to a line whose start we
-        // have not reached yet. Carried into the next, earlier chunk.
         let carry = Buffer.alloc(0);
         let scanned = 0;
         while (pos > 0 && scanned < maxScanBytes) {
@@ -118,15 +84,10 @@ function scanCodexRolloutForLimit(filePath, options = {}) {
             const read = fs.readSync(fd, chunk, 0, length, pos);
             scanned += read;
             const window = Buffer.concat([chunk.subarray(0, read), carry]);
-            // At pos > 0 the first line in the window is partial — its start lies in
-            // an earlier chunk — so hold it back rather than parse a torn line.
             let completeStart = 0;
             if (pos > 0) {
                 const firstNewline = window.indexOf(NEWLINE);
                 if (firstNewline < 0) {
-                    // The whole window is one unterminated line. A token_count record is
-                    // ~1 KB, so a line this long is never the one we want: drop it rather
-                    // than grow the carry without bound.
                     carry = window.length > maxScanBytes ? Buffer.alloc(0) : window;
                     continue;
                 }
@@ -139,8 +100,6 @@ function scanCodexRolloutForLimit(filePath, options = {}) {
             const region = window.subarray(completeStart);
             if (region.indexOf(MARKER) < 0 && region.indexOf(SPEND_MARKER) < 0)
                 continue;
-            // Walk this window's complete lines from the end backwards; the first
-            // match going backwards is the latest one in the file.
             const bounds = [];
             let lineStart = 0;
             for (let index = 0; index < region.length; index += 1) {
@@ -168,18 +127,10 @@ function scanCodexRolloutForLimit(filePath, options = {}) {
             fs.closeSync(fd);
         }
         catch {
-            /* best-effort */
         }
     }
 }
-/**
- * Read up to `maxBytes` of the rollout ENDING at `lineEnd` — the work the
- * developer was doing when the block hit, not whatever the session did after
- * the window reset. Resumes at a line boundary so every JSONL line parses.
- */
 function readTailEndingAt(filePath, lineEnd, maxBytes = DEFAULT_TAIL_BYTES) {
-    // Clamp to the file as it is NOW: the offset came from an earlier scan, and
-    // reading past EOF would return a short, garbled tail.
     let end = lineEnd;
     try {
         end = Math.min(lineEnd, fs.statSync(filePath).size);
@@ -215,13 +166,11 @@ function readTailEndingAt(filePath, lineEnd, maxBytes = DEFAULT_TAIL_BYTES) {
             fs.closeSync(fd);
         }
         catch {
-            /* best-effort */
         }
     }
 }
 const DEFAULT_WITHIN_MS = 24 * 3600_000;
 const DEFAULT_MAX_FILES = 12;
-/** Codex rollout files, newest first, limited by age and count. */
 function findRecentCodexRollouts(sessionsDir, options = {}) {
     const withinMs = options.withinMs ?? DEFAULT_WITHIN_MS;
     const maxFiles = options.maxFiles ?? DEFAULT_MAX_FILES;
@@ -252,7 +201,6 @@ function findRecentCodexRollouts(sessionsDir, options = {}) {
                 found.push({ file: full, mtime });
             }
             catch {
-                /* unreadable — skip */
             }
         }
     };
@@ -262,17 +210,14 @@ function findRecentCodexRollouts(sessionsDir, options = {}) {
         .slice(0, maxFiles)
         .map((entry) => entry.file);
 }
-/** Codex names rollouts `rollout-<ISO local time>-<session id>.jsonl`. */
 function sessionIdFromRolloutPath(filePath) {
     const match = path.basename(filePath).match(/^rollout-.*?T[\d-]+-(.+)\.jsonl$/);
     return match ? match[1] : undefined;
 }
-/** Where Codex writes its rollout JSONL files. */
 function codexSessionsDir() {
     return path.join((0, harnessDirs_1.codexHome)(), "sessions");
 }
 exports.CODEX_LIMIT_STATE_PATH = path.join((0, configDir_1.codiedevStateDir)(), "codex-limit-state.json");
-// Bounds the state file on a machine with a long Codex history.
 const MAX_STATE_ENTRIES = 500;
 function readSweepState(statePath) {
     let parsed;
@@ -297,10 +242,6 @@ function readSweepState(statePath) {
             };
         }
     }
-    // Migrate the 0.10.0-beta shape ({ reportedThrough, clean }). The old global
-    // watermark is DELIBERATELY dropped rather than carried over: it is exactly
-    // what could suppress an older block forever. Re-reporting is safe — the
-    // server deduplicates on (companyId, userId, at).
     const legacyClean = parsed.clean;
     if (legacyClean && typeof legacyClean === "object") {
         for (const [file, size] of Object.entries(legacyClean)) {
@@ -310,9 +251,6 @@ function readSweepState(statePath) {
     }
     return { seen };
 }
-// A record is dropped only once its file has been gone for a while. Pruning
-// the moment a path is missing would re-report an already-sent block after any
-// transient rename or move.
 const PRUNE_AFTER_MS = 7 * 24 * 3600_000;
 function pruneSweepState(state, now) {
     for (const [file, record] of Object.entries(state.seen)) {
@@ -329,11 +267,6 @@ function pruneSweepState(state, now) {
         .slice(MAX_STATE_ENTRIES)
         .forEach((file) => delete state.seen[file]);
 }
-/**
- * Merge our records into whatever is on disk NOW and write the result. Two
- * Codex sessions can submit a prompt at the same time; a plain
- * read-modify-write would silently drop the other process's records.
- */
 function commitSweepState(statePath, ours, now) {
     const current = readSweepState(statePath);
     for (const [file, record] of Object.entries(ours))
@@ -342,9 +275,6 @@ function commitSweepState(statePath, ours, now) {
     writeSweepState(statePath, current);
 }
 function writeSweepState(statePath, state) {
-    // Written through a temp file and renamed: Codex kills a hook that overruns
-    // its timeout, and a half-written state file would read as "nothing seen"
-    // and re-report every block in the window.
     const temp = `${statePath}.${process.pid}.tmp`;
     try {
         fs.mkdirSync(path.dirname(statePath), { recursive: true });
@@ -356,7 +286,6 @@ function writeSweepState(statePath, state) {
             fs.unlinkSync(temp);
         }
         catch {
-            /* best-effort */
         }
     }
 }
@@ -369,46 +298,15 @@ function fingerprint(filePath) {
         return null;
     }
 }
-/**
- * Record a block reported outside the sweep (the Stop path), so the next
- * prompt sweep neither re-scans the rollout nor re-posts the event.
- */
 function recordCodexLimitReported(filePath, at, statePath = exports.CODEX_LIMIT_STATE_PATH) {
     const print = fingerprint(filePath);
     if (!print)
         return;
     commitSweepState(statePath, { [filePath]: { ...print, at, t: Date.now() } }, Date.now());
 }
-// Candidates are listed generously and settled by one statSync each; only
-// files that actually changed cost a read. The budget therefore bounds work
-// without letting idle sessions bury an unreported block.
-//
-// The budget binds only on a COLD START, where nothing has been seen before,
-// so it must be big enough to finish that first pass. A budget of 8 silently
-// starved the older blocked rollouts on a real machine: 49 candidates in the
-// window, the newest 8 all unblocked, nothing reported. A full pass over
-// those 49 costs ~205ms — the backward scan stops at the marker rather than
-// reading each file to its cap — so the budget can afford to cover them.
 const DEFAULT_CANDIDATES = 200;
 const DEFAULT_MAX_SCANS = 64;
-// The budget bounds how MANY files are read; this bounds how LONG. A count is
-// not enough on a slow or network-mounted disk, and this runs on the user's
-// prompt clock. Whatever is not reached stays unrecorded, so the next prompt
-// picks it up rather than skipping it.
 const DEFAULT_DEADLINE_MS = 1_500;
-/**
- * Report every Codex block this machine has not reported yet. Returns how many
- * events were posted. Never throws — it runs inside a hook.
- *
- * State is kept PER FILE, not as one newest-wins timestamp. A single global
- * watermark loses data: rollouts are capped per sweep, so a block in a file
- * outside the cap can be older than one already reported and would then be
- * suppressed forever. A per-file record can only ever cause a re-report, which
- * the server deduplicates on (companyId, userId, at).
- *
- * A file is recorded only after its POST succeeds, so a failed send is retried
- * on the next prompt.
- */
 async function sweepCodexLimits(args) {
     const statePath = args.statePath ?? exports.CODEX_LIMIT_STATE_PATH;
     const state = readSweepState(statePath);
@@ -426,8 +324,6 @@ async function sweepCodexLimits(args) {
         if (!print)
             continue;
         const record = state.seen[file];
-        // Settled by the stat alone — it has not changed since the last scan, so
-        // it holds nothing new and does not spend the read budget.
         if (record && record.size === print.size && record.mtime === print.mtime)
             continue;
         if (budget <= 0 || Date.now() >= deadline)
@@ -439,14 +335,11 @@ async function sweepCodexLimits(args) {
             continue;
         }
         if (record && record.at === hit.event.at) {
-            // Same block, already reported; the file just grew.
             touched[file] = { ...print, at: record.at, t: now };
             continue;
         }
         pending.push({ file, print, hit });
     }
-    // Posted concurrently: each file is independent, and this runs on the
-    // prompt path where a serial chain of network timeouts would be felt.
     const results = await Promise.allSettled(pending.map(({ file, hit }) => args.post({
         source: "codex",
         ...hit.event,