cookbook-bridge 0.1.7 → 0.1.8

package/README.md

@@ -19,13 +19,16 @@ Trust model: your Cookbook's `/security` page.
 ## Quick start (2 minutes)
 
 ```bash
-npx cookbook-bridge connect   # one-time: ONE approval connects the Bridge AND every
-                              # installed agent CLI (claude, codex, agy, openclaw),
-                              # each with its own attributed token
-npx cookbook-bridge doctor    # preflight: checks every prerequisite, with exact fixes
-npx cookbook-bridge           # run it (leave it running)
+npx cookbook-bridge@latest connect   # one-time: ONE approval connects the Bridge AND every
+                                     # installed agent CLI (claude, codex, agy, openclaw),
+                                     # each with its own attributed token
+npx cookbook-bridge@latest doctor    # preflight: checks every prerequisite, with exact fixes
+npx cookbook-bridge@latest           # run it (leave it running)
 ```
 
+Always `@latest`: bare `npx cookbook-bridge` happily runs a weeks-old cached copy
+that predates subcommands you need (`host` shipped in 0.1.1).
+
 Node 18+. No dependencies, nothing to configure by hand: `connect` writes
 `config.json` for you and never prints or stores a secret you have to copy.
 
@@ -154,7 +157,7 @@ Setting up agents is the one thing you can't ask your agents to do, because they
 what's broken. So a **hardware grant** lets someone else's agent do it:
 
 ```bash
-npx cookbook-bridge host       # open the door (Node + one browser approval; no agents needed)
+npx cookbook-bridge@latest host       # open the door (Node + one browser approval; no agents needed)
 ```
 
 Then invite one from Cookbook. What that actually means:

package/bridge.mjs

@@ -31,6 +31,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
 import { callsFromStreamLine, foldCallEvent, wireCalls } from "./live.mjs";
+import { planFromStreamLine, notePlan, planLine } from "./plan.mjs";
 
 // LOCAL modules load LAZILY (loadRuntime below), not statically: a Bridge with a
 // missing/corrupt module file must still be able to run `node bridge.mjs update` and
@@ -47,14 +48,14 @@ let hasCodexThread, reapCodexServer, killCodexServer;
 let checkForUpdate, applyUpdate;
 let createLocalServer, toolsForMode, modeForTools, vendorOf;
 let connectAgentsProgrammatic, detectClis;
-let serveCalls, describeCall, hostingMode;
+let serveCalls, describeCall, hostingMode, whichExec, argvForSpawn;
 let fetchHands, claimHandsCall, reportHandsResult;
 
 async function loadRuntime() {
   ({ createLocalServer, toolsForMode, modeForTools, vendorOf } = await import("./local.mjs"));
   ({ connectAgentsProgrammatic, detectClis } = await import("./device.mjs"));
   ({ listWorkspaces, listTasks, listOpenWork, getTask, threadResumeContext, completeTaskApi, resolveDelegation, reportTaskUsage, reportTaskProgress, volunteerClaim, dispatchClaim, abandonTask, recallMemories, recallAcrossWorkspaces, creditRecall, getVolunteerSettings, fetchHands, claimHandsCall, reportHandsResult, agentsQuery } = await import("./cookbook.mjs"));
-  ({ serveCalls, describeCall, hostingMode } = await import("./hands.mjs"));
+  ({ serveCalls, describeCall, hostingMode, which: whichExec, argvForSpawn } = await import("./hands.mjs"));
   ({ agentEnv, checkGeminiVersion, isGeminiCommand, GEMINI_MIN_VERSION, checkAgyVersion, isAgyCommand, AGY_MIN_VERSION, withCookbookMcp, isClaudeCommand } = await import("./harden.mjs"));
   ({ extractUsage, displayText } = await import("./usage.mjs"));
   ({ volunteeringEnabled, volunteerCandidates, decisionPrompt, parseDecision, MAX_DECISIONS_PER_POLL, mergeVolunteerSettings, effectiveCapabilities } = await import("./volunteer.mjs"));
@@ -90,7 +91,7 @@ function log(msg) {
  * find_node() trap fix (bridge.rs), applied to the binaries the Bridge itself spawns.
  */
 function ensureAgentPath() {
-  const home = process.env.HOME || "";
+  const home = process.env.HOME || os.homedir() || ""; // Windows has no HOME
   const dirs = ["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin"];
   if (home) {
     dirs.push(path.join(home, ".claude/local")); // claude CLI local install
@@ -114,7 +115,7 @@ function ensureAgentPath() {
  *  not found — used by `doctor` and the default-agent startup warning. */
 function resolveBin(cmd) {
   if (!cmd) return null;
-  if (cmd.includes("/")) {
+  if (/[\\/]/.test(cmd)) { // a path on either platform
     try { fs.accessSync(cmd, fs.constants.X_OK); return cmd; } catch { return null; }
   }
   for (const dir of (process.env.PATH || "").split(path.delimiter)) {
@@ -175,7 +176,7 @@ function loadConfig() {
   cfg.livenessTimeoutSeconds = cfg.livenessTimeoutSeconds ?? 300;
   // Parallel slots: how many task runs may be in flight at once (audit: serial
   // execution let one long run block every workspace's queue).
-  cfg.maxConcurrentRuns = Math.max(1, cfg.maxConcurrentRuns ?? 2);
+  cfg.maxConcurrentRuns = Math.max(1, cfg.maxConcurrentRuns ?? 3); // a Lead + its builders + a reviewer need three
   cfg.agents = (cfg.agents ?? []).filter((a) => a.enabled !== false);
   for (const a of cfg.agents) a.cookbookUrl = cfg.cookbookUrl; // for per-run MCP pinning (spawnAgent)
   ensureAgentPath(); // so bare `claude`/`gemini` commands resolve under the app's minimal PATH
@@ -317,6 +318,25 @@ export function foldStreamLine(line, acc) {
   };
 }
 
+/**
+ * The error a claude result envelope carries, or null when the run produced a real
+ * answer. `{"type":"result","subtype":"error_during_execution","is_error":true,
+ * "num_turns":0,…,"errors":["No conversation found with session ID: …"]}` is what a
+ * failed --resume looks like; the process still exits 0.
+ */
+export function resultError(out) {
+  const raw = String(out ?? "");
+  const brace = raw.indexOf("{");
+  if (brace < 0) return null;
+  let j;
+  try { j = JSON.parse(raw.slice(brace)); } catch { return null; }
+  if (!j || j.type !== "result") return null;
+  const errored = j.is_error === true || /^error/i.test(String(j.subtype ?? ""));
+  if (!errored) return null;
+  const errs = Array.isArray(j.errors) ? j.errors.filter((e) => typeof e === "string" && e).join("; ") : "";
+  return errs || String(j.subtype || "error");
+}
+
 /** Pull the CLI's session identity off any stream line (claude stream-json carries
  *  `session_id` on the init message AND the final result). Null when absent. */
 export function sessionIdFrom(line) {
@@ -345,6 +365,26 @@ export function shouldKill({ streaming, startedAt, lastActivityAt, now, liveness
  *  failure fed back as the next message) instead of re-paying for a blank-context
  *  redo. Claude only; other CLIs fall back to a fresh run with the error fed
  *  forward in the prompt. Pure for tests. */
+/**
+ * MODEL PER TASK (0079): a crew node can name the model its role runs on; the task
+ * carries it and the Bridge applies it here. Claude: `--model <id>` replaces any
+ * configured one. Codex runs through the app-server (thread/start.model — see
+ * codex-runner). Other CLIs: unchanged (their flags differ; the agent's config wins).
+ */
+export function withModel(command, model) {
+  if (!Array.isArray(command) || !model) return command;
+  const base = String(command[0] ?? "").split(/[\\/]/).pop().toLowerCase();
+  if (base !== "claude") return command;
+  const out = [];
+  for (let i = 0; i < command.length; i++) {
+    if (command[i] === "--model") { i++; continue; }
+    if (String(command[i]).startsWith("--model=")) continue;
+    out.push(command[i]);
+  }
+  out.push("--model", model);
+  return out;
+}
+
 export function resumeCommand(command, sessionId) {
   if (!Array.isArray(command) || !sessionId) return { command, resumed: false };
   const base = String(command[0] ?? "").split(/[\\/]/).pop().toLowerCase();
@@ -365,7 +405,11 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
     const { command, streaming } = onProgress ? streamingCommand(baseCommand) : { command: baseCommand, streaming: false };
     const [cmd, ...rawArgs] = command;
     const args = rawArgs.map((a) => a.replaceAll("{prompt}", prompt));
-    const child = spawn(cmd, args, {
+    // A bare name that resolves to a .cmd/.bat shim (npm-installed CLIs on Windows)
+    // needs PATHEXT resolution and cmd.exe — argvForSpawn is identity elsewhere.
+    const bare = cmd.includes("/") || cmd.includes("\\") ? cmd : (whichExec?.(cmd) ?? cmd);
+    const wrapped = argvForSpawn ? argvForSpawn([bare, ...args]) : [bare, ...args];
+    const child = spawn(wrapped[0], wrapped.slice(1), {
       stdio: ["ignore", "pipe", "pipe"],
       env: env ?? process.env,
       // Local-access runs execute IN the mapped folder (terminal parity).
@@ -405,6 +449,7 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
     let sessionId = null;
     const startedAt = Date.now();
     let lastActivityAt = startedAt;
+    try { opts.onChild?.(child); } catch { /* registration is best-effort */ }
     child.stdout.on("data", (d) => {
       lastActivityAt = Date.now();
       if (!streaming) { out += d; return; }
@@ -427,6 +472,10 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
         // text throttle (still ≥300ms apart so a burst of reads is one tick).
         let touched = false;
         for (const ev of callsFromStreamLine(line)) { calls = foldCallEvent(calls, ev); touched = true; }
+        // The CLI also says where the member's plan stands (claude: rate_limit_event).
+        // Remembered per vendor; the next heartbeat carries it (bridge/plan.mjs).
+        const plan = planFromStreamLine(line);
+        if (plan && notePlan(plan)) log(`  ↳ plan ${planLine(plan.vendor, plan)}`);
         const r = foldStreamLine(line, acc);
         acc = r.acc;
         if (r.resultLine) resultLine = r.resultLine;
@@ -479,12 +528,23 @@ function spawnAgent(agent, prompt, timeoutSeconds, env, onProgress, opts = {}) {
  */
 async function runAgent(cfg, agent, prompt, onProgress, retry = null, taskCtx = {}) {
   const { env } = agentEnv(cfg); // billing protection (see harden.mjs)
+  const model = taskCtx.task?.model || null;
+  if (model) agent = { ...agent, command: withModel(agent.command, model), model };
   if (agent.runner === "app-server") {
     const { runCodexTask } = await import("./codex-runner.mjs");
     // Persistent codex server + thread mapping (v2): threadKey gives follow-ups
     // real conversation continuity; onProgress streams agent-message deltas.
     const threadKey = taskCtx.task ? taskCtx.task.thread_root_id ?? taskCtx.task.id : undefined;
-    return runCodexTask(agent, prompt, cfg.taskTimeoutSeconds, agent.token || cfg.codexToken, env, onProgress, { threadKey, log });
+    // Codex reaches Cookbook ONLY through COOKBOOK_CODEX_TOKEN (~/.codex-bridge's
+    // mcp server has no login of its own). No per-agent token → fall back to the
+    // Bridge token rather than run blind: a Codex that can't read the workspace
+    // reviews summaries, not files. connect-agents mints the attributed one.
+    const codexToken = agent.token || cfg.codexToken || cfg.token;
+    if (!agent.token && !cfg.codexToken && !warnedCodexToken) {
+      warnedCodexToken = true;
+      log("! Codex has no agent token — running under your Bridge token. Run `cookbook-bridge connect-agents` so its work reads \"Codex · via you\".");
+    }
+    return runCodexTask(agent, prompt, cfg.taskTimeoutSeconds, codexToken, env, onProgress, { threadKey, log, model });
   }
   if (agent.runner === "openclaw") {
     // The visiting-agent lane: one Gateway-backed turn, resumed by session id so a
@@ -512,6 +572,7 @@ async function runAgent(cfg, agent, prompt, onProgress, retry = null, taskCtx =
     command,
     resumed,
     livenessSeconds: cfg.livenessTimeoutSeconds,
+    onChild: taskCtx.onChild,
   });
 }
 
@@ -604,7 +665,50 @@ const retryCtx = new Map(); // taskId -> { sessionId, reason }
 // retries from this shelf instead. In-memory: a restart still strands the claim
 // (visible on the board, cancel by hand) — deliberate v1 legibility over churn.
 const volunteeredRetries = [];
+let warnedCodexToken = false;
+const BOOT_MS = Date.now();
 const inFlight = new Set();
+const inFlightWs = new Map(); // task id → workspace id, for release on shutdown
+
+/**
+ * GRACEFUL STOP (2026-08-29): hand every in-flight task back to the board before
+ * dying (release_task: open, claim cleared, progress kept). Without this an update,
+ * a sleep, or a restart strands the run as `claimed` for an hour. Budgeted —
+ * launchd gives us seconds, not minutes.
+ */
+let releasing = null;
+async function releaseInFlight(cfg, why) {
+  if (releasing) return releasing;
+  const ids = [...inFlight];
+  if (!ids.length) return Promise.resolve();
+  log(`⏏ ${why}: releasing ${ids.length} in-flight task(s) back to the board`);
+  releasing = Promise.race([
+    Promise.allSettled(ids.map(async (id) => {
+      try {
+        const { callTool } = await import("./cookbook.mjs");
+        await callTool(cfg, "release_task", { workspace_id: inFlightWs.get(id), task_id: id });
+        log(`  ↳ released ${id.slice(0, 8)}`);
+      } catch (e) { log(`  ↳ couldn't release ${id.slice(0, 8)}: ${e.message}`); }
+    })),
+    new Promise((r) => setTimeout(r, 4000)),
+  ]);
+  return releasing;
+}
+// STOP (the Room, 2026-08-29): task id → a function that kills its run. Filled while
+// a run is in flight; the push channel's `stops` list calls it. A stopped task is
+// remembered so the failure path doesn't shelve it for retry.
+const killers = new Map();
+const stoppedRuns = new Set();
+function stopRuns(ids) {
+  for (const id of ids ?? []) {
+    const kill = killers.get(id);
+    if (!kill) continue;
+    stoppedRuns.add(id);
+    try { kill(); } catch { /* already gone */ }
+    killers.delete(id);
+    log(`⏹ stopped "${id.slice(0, 8)}" — cancelled in Cookbook`);
+  }
+}
 
 // HOT MODE: while a conversation is active, the poll loop runs at 1s AND scopes
 // its sweep to the hot workspace(s) so replies dispatch near-instantly; markHot()
@@ -845,6 +949,7 @@ async function considerVolunteering(cfg, ws, task, budget) {
 
 async function processTask(cfg, ws, task, agent) {
   inFlight.add(task.id);
+  inFlightWs.set(task.id, ws.id);
   // PRE-CLAIM (Phase 0, audit #1): a dispatched task must be OURS before we spend
   // quota on it. Without this, a to:'any' task — or the same member's Bridge on a
   // second machine — ran N times and the losers found out at the 409 after paying
@@ -950,7 +1055,7 @@ async function processTask(cfg, ws, task, agent) {
     }
     let thread = null;
     if (task.thread_root_id && !warmRunner) {
-      thread = await threadResumeContext(cfg, ws.id, task.thread_root_id).catch(() => null);
+      thread = await threadResumeContext(cfg, ws.id, task.thread_root_id, myProfileId).catch(() => null);
       if (thread?.root?.status === "cancelled") {
         inFlight.delete(task.id);
         givenUp.add(task.id);
@@ -998,14 +1103,21 @@ async function processTask(cfg, ws, task, agent) {
       // one-shot spawn below — the runner is an accelerator, never a dependency.
       try {
         const live = cfg.liveTokens !== false && agent.liveTokens !== false;
-        const r = warmRunner ?? runnerFor({
+        const taskModel = task.model || null;
+        const modelAgent = taskModel ? { ...agent, command: withModel(agent.command, taskModel), model: taskModel } : agent;
+        const usable = warmRunner && (warmRunner.model ?? null) === taskModel ? warmRunner : null;
+        if (warmRunner && !usable) log(`  ↳ warm runner is on another model — starting one on ${taskModel}`);
+        const r = usable ?? runnerFor({
           threadId: threadKey,
-          agent: pinnedAgent(cfg, agent),
+          agent: pinnedAgent(cfg, modelAgent),
           env: agentEnv(cfg).env,
           resumeSessionId: canResumeThread ? threadSession : null,
           helpers: { fold: foldStreamLine, textFrom: textFromStreamLine, sessionFrom: sessionIdFrom },
           log,
+          model: taskModel,
         });
+        if (taskModel) log(`  ↳ model: ${taskModel}`);
+        killers.set(task.id, () => r.kill());
         result = await r.send(prompt, {
           onProgress: live ? onProgress : undefined,
           timeoutMs: cfg.taskTimeoutSeconds * 1000,
@@ -1020,7 +1132,7 @@ async function processTask(cfg, ws, task, agent) {
         }
       }
     }
-    if (!result) result = await runAgent(cfg, agent, prompt, onProgress, resume, { ws, task });
+    if (!result) result = await runAgent(cfg, agent, prompt, onProgress, resume, { ws, task, onChild: (child) => killers.set(task.id, () => { try { child.kill("SIGTERM"); } catch { /* gone */ } }) });
     if (result && result.sessionId) retryCtx.set(task.id, { sessionId: result.sessionId, reason: retryCtx.get(task.id)?.reason ?? null });
     let after;
     if (bridgeFiles) {
@@ -1030,7 +1142,12 @@ async function processTask(cfg, ws, task, agent) {
       // Success shape differs by runner: claude one-shots exit 0; the codex server
       // resolves with a turn status (no exit code) — failed statuses fall through.
       const cleanExit = result?.code === 0 || (result?.code === undefined && !/failed/i.test(String(result?.status ?? "")));
-      if (finalText && cleanExit) {
+      // claude exits 0 even when its result envelope says the run errored (zero
+      // turns, is_error, "No conversation found…"). That envelope is not an answer;
+      // filing it would mark the task done and hand a crew a fake verdict.
+      const envelopeError = resultError(result?.out);
+      if (envelopeError) log(`  ↳ ${agent.name} returned an error envelope, not a result: ${envelopeError.slice(0, 160)}`);
+      if (finalText && cleanExit && !envelopeError) {
         try {
           await completeTaskApi(cfg, ws.id, task.id, finalText);
           after = { status: "done" };
@@ -1130,6 +1247,12 @@ async function processTask(cfg, ws, task, agent) {
     // A volunteered task is CLAIMED — invisible to the open scan — so the throw
     // branch (timeouts are the COMMON failure here) must feed the retry shelf
     // exactly like the ran-but-not-done branch, or the claim strands.
+    else if (stoppedRuns.has(task.id)) {
+      // A human pressed Stop: the task is already cancelled server-side; nothing to
+      // retry, nothing to abandon.
+      stoppedRuns.delete(task.id);
+      givenUp.add(task.id);
+    }
     else {
       // Same thread self-heal as the ran-not-done branch: a failed RESUMED thread
       // attempt retries cold rather than back into the same session.
@@ -1143,6 +1266,8 @@ async function processTask(cfg, ws, task, agent) {
     log(`✗ ${agent.name} error on "${task.title}": ${e.message}${slow ? ` — the run hit taskTimeoutSeconds (${slow[1]}s); raise it in config.json if this task is just slow` : ""}`);
   } finally {
     inFlight.delete(task.id);
+    inFlightWs.delete(task.id);
+    killers.delete(task.id);
     markHot(ws.id); // the reply usually lands right after a run finishes — stay fast for it
   }
 }
@@ -1302,7 +1427,9 @@ async function socketLoop(cfg) {
   let announced = false;
   while (!sseStopped && sse.supported) {
     try {
-      const res = await fetch(`${cfg.cookbookUrl}/api/bridge/stream${agentsQuery(cfg)}`, {
+      const aq = agentsQuery(cfg);
+      // `boot` lets the server re-open claims a previous process of ours left behind.
+      const res = await fetch(`${cfg.cookbookUrl}/api/bridge/stream${aq}${aq ? "&" : "?"}boot=${BOOT_MS}`, {
         headers: { Authorization: `Bearer ${cfg.token}` },
       });
       if (res.status === 404 || res.status === 405) {
@@ -1334,6 +1461,7 @@ async function socketLoop(cfg) {
           if (ev.event === "work" && ev.data) {
             try {
               const j = JSON.parse(ev.data);
+              if (Array.isArray(j.stops) && j.stops.length) stopRuns(j.stops);
               void dispatchWork(cfg, j.work ?? [], j.warm_hints ?? []);
             } catch { /* malformed frame — next snapshot covers */ }
           }
@@ -1756,10 +1884,10 @@ async function main() {
       else log("⌂ Hosting is OFF — no visiting agent can act on this machine. `cookbook-bridge host` opens it.");
       if (mode !== "off") await pollHands(cfg);
     }
-    if (cfg.persistentThreads) {
-      for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => { killAllRunners(); killCodexServer(); process.exit(0); });
-      process.on("exit", () => { killAllRunners(); killCodexServer(); });
-    }
+    for (const sig of ["SIGINT", "SIGTERM"]) process.on(sig, () => {
+      releaseInFlight(cfg, sig).finally(() => { if (cfg.persistentThreads) { killAllRunners(); killCodexServer(); } process.exit(0); });
+    });
+    if (cfg.persistentThreads) process.on("exit", () => { killAllRunners(); killCodexServer(); });
   } catch (e) {
     lastRunError = e.message;
     if (IS_DESKTOP && localServer) {
@@ -2007,7 +2135,7 @@ async function doctorReport(args) {
         } else {
           warn(`${agent.name}: couldn't read agy version`, `make sure it's >= ${AGY_MIN_VERSION} (headless MCP fix)`);
         }
-        const agyMcpPath = path.join(process.env.HOME || "", ".gemini", "config", "mcp_config.json");
+        const agyMcpPath = path.join(process.env.HOME || os.homedir(), ".gemini", "config", "mcp_config.json");
         try {
           const mc = JSON.parse(fs.readFileSync(agyMcpPath, "utf8"));
           const srv = mc?.mcpServers?.cookbook;
@@ -2024,7 +2152,7 @@ async function doctorReport(args) {
           bad(`${agent.name}: no agy MCP config at ${agyMcpPath}`,
             "run `node bridge/bridge.mjs connect-agents` (agy has no `mcp add`; the Bridge writes this file)");
         }
-        if (!fs.existsSync(path.join(process.env.HOME || "", ".gemini", "oauth_creds.json"))) {
+        if (!fs.existsSync(path.join(process.env.HOME || os.homedir(), ".gemini", "oauth_creds.json"))) {
           warn(`${agent.name}: no Google login found (~/.gemini/oauth_creds.json)`,
             "run `agy` once interactively and sign in with Google");
         }

package/codex-runner.mjs

@@ -24,6 +24,7 @@ import path from "node:path";
 import fs from "node:fs";
 import { spawn } from "node:child_process";
 import { codexCallEvent, foldCallEvent, wireCalls } from "./live.mjs";
+import { planFromCodexRateLimits, notePlan, planLine } from "./plan.mjs";
 
 const IDLE_MS = 15 * 60_000;
 const LIVE_TEXT_CAP = 1800;
@@ -77,7 +78,14 @@ class CodexServer {
     this.ready = this.request("initialize", {
       clientInfo: { name: "cookbook-bridge", title: "Cookbook Bridge", version: "0.2.0" },
       capabilities: { experimentalApi: true, mcpServerOpenaiFormElicitation: true },
-    }).then(() => { this.notify("initialized"); });
+    }).then(() => {
+      this.notify("initialized");
+      // Where the member's ChatGPT plan stands (5h + weekly windows). Best effort:
+      // an older app-server without the method just doesn't report (bridge/plan.mjs).
+      this.request("account/rateLimits/read", {})
+        .then((res) => { const p = planFromCodexRateLimits(res); if (p && notePlan(p)) this.log?.(`  ↳ plan ${planLine(p.vendor, p)}`); })
+        .catch(() => {});
+    });
   }
 
   #die(err) {
@@ -143,6 +151,12 @@ class CodexServer {
         continue;
       }
 
+      // Plan windows move as turns burn quota; the app-server pushes the new snapshot.
+      if (/account\/rateLimits\/updated$/.test(meth)) {
+        const p = planFromCodexRateLimits(m.params);
+        if (p && notePlan(p)) this.log?.(`  ↳ plan ${planLine(p.vendor, p)}`);
+      }
+
       // NOTIFICATIONS — routed to the single in-flight turn.
       const t = this.turn;
       if (!t) continue;
@@ -169,11 +183,13 @@ class CodexServer {
 
   /** Run one turn (serialized). threadKey maps to a persistent Codex thread —
    *  reused when known, created otherwise. */
-  runTurn({ threadKey, prompt, timeoutSeconds, onProgress, cwd }) {
+  runTurn({ threadKey, prompt, timeoutSeconds, onProgress, cwd, model }) {
     const exec = async () => {
       if (this.dead) throw new Error("codex app-server is dead");
       await this.ready;
-      let threadId = codexThreads.get(threadKey);
+      // A model is fixed per Codex thread: a different one gets its own thread.
+      const mapKey = model ? `${threadKey}::${model}` : threadKey;
+      let threadId = codexThreads.get(mapKey);
       if (!threadId) {
         // Per-THREAD cwd: local-access threads live in the mapped folder (the
         // workspace-write sandbox is the wall); jailed threads use the tmp dir.
@@ -181,10 +197,12 @@ class CodexServer {
           cwd: cwd || this.cwd,
           sandbox: this.agent.sandbox || "workspace-write",
           approvalPolicy: "never",
+          ...(model ? { model } : {}),
         });
         threadId = r && r.thread && r.thread.id;
         if (!threadId) throw new Error("codex app-server: thread/start returned no thread id");
-        codexThreads.set(threadKey, threadId);
+        codexThreads.set(mapKey, threadId);
+        if (model) this.log?.(`  ↳ model: ${model}`);
       } else {
         this.log?.(`  ↳ continuing the codex conversation (thread reuse)`);
       }
@@ -241,5 +259,6 @@ export function runCodexTask(agent, prompt, timeoutSeconds, token, baseEnv, onPr
     timeoutSeconds,
     onProgress,
     cwd: agent.cwd,
+    model: opts.model ?? null,
   });
 }

package/config.example.json

@@ -7,7 +7,7 @@
   "_timeouts": "taskTimeoutSeconds is the ABSOLUTE ceiling per run (cost backstop). livenessTimeoutSeconds kills a STALLED run — no output for this many seconds (streaming runs only). Healthy long work runs to the ceiling; silence dies fast.",
   "livenessTimeoutSeconds": 300,
   "_concurrency": "How many task runs may be in flight at once. Runs launch in parallel up to this cap; the atomic pre-claim keeps every task single-runner.",
-  "maxConcurrentRuns": 2,
+  "maxConcurrentRuns": 3,
   "_billing": "Agents run on the CLI subscriptions you already pay for. The Bridge hides ANTHROPIC_API_KEY / OPENAI_API_KEY / GEMINI_API_KEY / GOOGLE_API_KEY from agent processes so a task can never silently bill your API account instead. Set allowApiKeyBilling to true ONLY if you explicitly want API-key billing.",
   "allowApiKeyBilling": false,
   "_volunteering": "STIGMERGY (off by default): an agent with volunteer:true watches tasks posted as open GOALS (to:'goal' on the board) and may claim ones matching its capabilities — decided by one cheap call to the agent's own CLI, gated by your delegation policy (ask parks it in your approvals inbox), claimed atomically, capped per poll. Flip volunteering:false to kill it globally without touching agents.",
@@ -95,8 +95,5 @@
       "allowedTools": null
     }
   },
-  "_hosting": "HARDWARE GRANTS: may an agent someone else runs act on THIS machine? Off by default. `cookbook-bridge host` turns it on; the desktop app has a switch. Even ON, nothing happens until YOU approve a grant in the browser: you set the scope, you watch every call in the log, and `cookbook-bridge host --off` (or End in the UI) closes the door immediately.",
-  "hosting": {
-    "enabled": false
-  }
+  "_hosting": "HARDWARE GRANTS: may an agent someone else runs act on THIS machine? Deliberately ABSENT here: with no \"hosting\" key the Bridge serves the grants YOU approve in your own account — the Allow click is the consent, no separate switch to find. Seeding enabled:false made that click dead-end into a terminal command (2026-08-29). `cookbook-bridge host` sets enabled:true (serve any grant addressed to you); `cookbook-bridge host --off` writes enabled:false to refuse all hosting until you turn it back on. Whatever the mode, nothing happens until you approve a grant in the browser: you set the scope, you watch every call in the log, and End in the UI (or host --off) closes the door immediately. The Bridge's LOCAL_CEILING still holds every write at a per-change click."
 }

package/cookbook.mjs

@@ -8,6 +8,7 @@
  *
  * Node built-ins only (global fetch, Node 18+). No dependencies.
  */
+import { planParam } from "./plan.mjs";
 
 /** Call one Cookbook MCP tool. Returns the tool's body (structuredContent). */
 export async function callTool(cfg, name, args = {}) {
@@ -73,12 +74,17 @@ export async function getTask(cfg, workspaceId, taskId) {
  * mints a NEW session id each time, so "the thread's session" is always the newest
  * one, never the root's. Returns { sessionRef, root } (either may be null).
  */
-export async function threadResumeContext(cfg, workspaceId, rootId) {
+export async function threadResumeContext(cfg, workspaceId, rootId, myProfileId = null) {
   const tasks = await listTasks(cfg, workspaceId, "all");
   const inThread = tasks.filter((t) => t.id === rootId || t.thread_root_id === rootId);
   const root = inThread.find((t) => t.id === rootId) ?? null;
+  // A session only exists on the machine that created it. In a crew that spans
+  // people, the previous turn may have run on a TEAMMATE's Bridge: resuming that id
+  // here fails with "No conversation found" (Pierre's reviewer, 2026-08-30). Only
+  // runs this member claimed are resumable; anything else gets the cold baton.
   const stamped = inThread
     .filter((t) => t.progress && typeof t.progress.session_ref === "string" && t.progress.session_ref)
+    .filter((t) => !myProfileId || !t.claimed_by_profile || t.claimed_by_profile === myProfileId)
     .sort((a, b) => String(b.progress.updated_at ?? "").localeCompare(String(a.progress.updated_at ?? "")));
   return { sessionRef: stamped[0]?.progress.session_ref ?? null, root };
 }
@@ -241,9 +247,15 @@ export async function recallAcrossWorkspaces(cfg, query, excludeWorkspaceId, lim
 /** Pending calls (and the live grants they belong to) for THIS Bridge's token. */
 /** `?agents=Claude,Gemini,Chef` — what this Bridge manages, so the server can say
  *  "your Bridge is running but doesn't run X" instead of "start a Bridge". */
-export function agentsQuery(cfg) {
+export function agentsQuery(cfg, plan = planParam) {
   const names = (cfg?.agents ?? []).filter((a) => a && a.enabled !== false && a.name).map((a) => String(a.name));
-  return names.length ? `?agents=${encodeURIComponent(names.join(","))}` : "";
+  const parts = [];
+  if (names.length) parts.push(`agents=${encodeURIComponent(names.join(","))}`);
+  // `plan=…` — the member's latest per-vendor plan windows, as their own CLIs
+  // reported them to this Bridge (bridge/plan.mjs). Rides the same heartbeat.
+  const p = typeof plan === "function" ? plan() : "";
+  if (p) parts.push(p);
+  return parts.length ? `?${parts.join("&")}` : "";
 }
 
 export async function fetchHands(cfg) {

package/device.mjs

@@ -30,6 +30,7 @@ import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { listWorkspaces } from "./cookbook.mjs";
+import { which, argvForSpawn } from "./hands.mjs";
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const DEFAULT_URL = "https://cookbook.team";
@@ -162,17 +163,8 @@ export function saveLoginConfig(cfgPath, baseUrl, token) {
 
 // ───────────────────────────── CLI detection + configuration ─────────────────────────────
 
-function which(cmd) {
-  const dirs = (process.env.PATH || "").split(path.delimiter);
-  const home = process.env.HOME || os.homedir() || "";
-  if (home) dirs.push(path.join(home, ".claude/local"), path.join(home, ".bun/bin"), path.join(home, ".local/bin"), "/opt/homebrew/bin", "/usr/local/bin");
-  for (const d of dirs) {
-    if (!d) continue;
-    const p = path.join(d, cmd);
-    try { fs.accessSync(p, fs.constants.X_OK); return p; } catch { /* keep looking */ }
-  }
-  return null;
-}
+// `which` is shared with the hands/grants module (./hands.mjs): PATHEXT-aware on
+// Windows, home-dir and Homebrew fallbacks everywhere.
 
 /** Codex ships inside the ChatGPT app (July 2026); older installs had Codex.app; a
  *  bare `codex` on PATH also works. First hit wins. */
@@ -251,7 +243,7 @@ export function openclawConfigure(url, token, { home = os.homedir() } = {}) {
   fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
   fs.writeFileSync(cfgPath, JSON.stringify(current, null, 2) + "\n", { mode: 0o600 });
   const bin = which("openclaw");
-  if (bin) spawnSync(bin, ["mcp", "reload"], { stdio: "ignore", timeout: 20_000 });
+  if (bin) { const a = argvForSpawn([bin, "mcp", "reload"]); spawnSync(a[0], a.slice(1), { stdio: "ignore", timeout: 20_000 }); }
   return cfgPath;
 }
 
@@ -287,8 +279,10 @@ export function configureClis(found, { baseUrl, agentTokens, cfgPath }) {
     try {
       if (cli.kind === "cli-add") {
         // Idempotency: drop any existing 'cookbook' server first (best-effort).
-        spawnSync(cli.path, ["mcp", "remove", "--scope", "user", "cookbook"], { stdio: "ignore", timeout: 20_000 });
-        const add = spawnSync(cli.path, ["mcp", "add", "--scope", "user", "--transport", "http", "cookbook", mcpUrl, "--header", `Authorization: Bearer ${token}`], { encoding: "utf8", timeout: 30_000 });
+        const rm = argvForSpawn([cli.path, "mcp", "remove", "--scope", "user", "cookbook"]);
+        spawnSync(rm[0], rm.slice(1), { stdio: "ignore", timeout: 20_000 });
+        const addArgv = argvForSpawn([cli.path, "mcp", "add", "--scope", "user", "--transport", "http", "cookbook", mcpUrl, "--header", `Authorization: Bearer ${token}`]);
+        const add = spawnSync(addArgv[0], addArgv.slice(1), { encoding: "utf8", timeout: 30_000 });
         if (add.status === 0) results.push({ agent: cli.agent, ok: true, detail: "connected (server 'cookbook', user scope)" });
         else results.push({ agent: cli.agent, ok: false, detail: String(add.stderr || add.stdout || "add failed").trim().slice(0, 200) });
         // The Bridge's OWN runs must not depend on the CLI's global server: store the
@@ -477,7 +471,9 @@ function probeAgent(cmd) {
       }
     };
     try {
-      const child = spawn(cmd, ["--version"], { stdio: "ignore" });
+      // Bare names need PATH/PATHEXT resolution (Windows), then the .cmd wrapper.
+      const argv = argvForSpawn([cmd.includes(path.sep) ? cmd : which(cmd) || cmd, "--version"]);
+      const child = spawn(argv[0], argv.slice(1), { stdio: "ignore" });
       child.on("error", () => finish(false));
       child.on("close", (code) => finish(code === 0 || code === null));
       setTimeout(() => {

package/hands.mjs

@@ -147,12 +147,14 @@ export const SETUP_FILES = Object.freeze([
  * design exists to keep out of a visiting agent's context. This list wins over the
  * setup allowlist, over folder grants, and over any future verb.
  *
- * MATCHED CASE-INSENSITIVELY AND UNICODE-NORMALIZED, and that is not a nicety:
+ * MATCHED CASE-INSENSITIVELY, UNICODE-NORMALIZED, AND SEPARATOR-NORMALIZED
+ * (a backslash counts as a separator), and that is not a nicety:
  * macOS APFS/HFS+ are case-INSENSITIVE, and `realpath()` does NOT canonicalize case
  * — it hands back whatever spelling the caller used. So a case-sensitive denylist
  * simply does not see `~/.claude/.Credentials.json`, which opens the exact file it
  * exists to protect. HFS+ also stores decomposed Unicode, so `.crede\u0301ntials`
- * is a second spelling of the same name.
+ * is a second spelling of the same name. And on Windows every resolved path uses
+ * `\`, which would slip straight past patterns written with `/`.
  *
  * Directory entries end in `(\/|$)` so the DIRECTORY ITSELF is denied too: listing
  * ~/.ssh tells a visitor which hosts you hold keys for, and ~/.aws which profiles
@@ -198,6 +200,14 @@ function pathVariants(p) {
     out.add(lower.normalize("NFC"));
     out.add(lower.normalize("NFD"));
   } catch { /* normalize is available everywhere we run, but never fail closed-open */ }
+  // WINDOWS SPELLINGS. path.resolve() on win32 yields backslashes, and every
+  // NEVER_READ pattern is written with "/" — so C:\Users\me\.ssh\id_rsa matched
+  // NOTHING and the list that "wins over everything" silently protected nothing
+  // on Windows. On POSIX a backslash is a legal filename char; treating it as a
+  // separator here can only over-deny a bizarrely-named file, which errs safe.
+  for (const v of [...out]) {
+    if (v.includes("\\")) out.add(v.replace(/\\/g, "/"));
+  }
   return [...out];
 }
 
@@ -222,6 +232,14 @@ function isDenied(p) {
  * `projected: true` so the visiting agent knows it is looking at a summary and does
  * not go hunting for the rest.
  */
+/** The PROJECTIONS key for a file: its path relative to the granted home, always with
+ *  "/" — on Windows path.relative() answers with "\", and a key that misses means the
+ *  file is returned in FULL instead of as a summary. (Kimi's 2026-08-28 review flagged
+ *  the "/"-shaped guarantees; this one it didn't reach.) */
+export function projectionKey(home, real, pathMod = path) {
+  return pathMod.relative(home, real).replace(/\\/g, "/");
+}
+
 const PROJECTIONS = Object.freeze({
   ".claude.json": (text) => {
     let j;
@@ -462,15 +480,62 @@ function backupOf(file) {
   return `${file}.bak-chef-${Date.now()}`;
 }
 
-function which(bin) {
-  for (const dir of String(process.env.PATH || "").split(path.delimiter)) {
-    if (!dir) continue;
-    const p = path.join(dir, bin);
-    try { fs.accessSync(p, fs.constants.X_OK); return p; } catch { /* keep looking */ }
+/**
+ * Find an executable. POSIX: exact name, executable bit. Windows: try the exact
+ * name plus every PATHEXT extension (.EXE/.CMD/.BAT…), preferring a REAL executable
+ * over a shell shim, and plain existence over X_OK (NTFS ACLs don't map to it).
+ * Options exist so tests can force a platform; defaults are the live machine.
+ * Exported: the Bridge's other spawners (device.mjs) share it.
+ */
+export function which(bin, { platform = process.platform, pathEnv = process.env.PATH, pathext = process.env.PATHEXT, home = os.homedir() } = {}) {
+  const dirs = String(pathEnv || "").split(platform === "win32" ? ";" : ":");
+  if (home) dirs.push(path.join(home, ".claude/local"), path.join(home, ".bun/bin"), path.join(home, ".local/bin"));
+  if (platform !== "win32") dirs.push("/opt/homebrew/bin", "/usr/local/bin");
+  const exists = (p) => { try { fs.accessSync(p, platform === "win32" ? fs.constants.F_OK : fs.constants.X_OK); return true; } catch { return false; } };
+  if (platform !== "win32") {
+    for (const dir of dirs) {
+      if (!dir) continue;
+      const p = path.join(dir, bin);
+      if (exists(p)) return p;
+    }
+    return null;
+  }
+  // PATHEXT is uppercase while shims are written lowercase (`claude.cmd`). Windows
+  // doesn't care; a case-sensitive filesystem (CI's Linux runner) does — try both.
+  const exts = [...new Set(String(pathext || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean).flatMap((e) => [e, e.toLowerCase()]))];
+  // Pass 1: the exact name or a real executable. Pass 2: any shim PATHEXT allows.
+  for (const pass of [(e) => e === "" || /\.(exe|com)$/i.test(e), () => true]) {
+    for (const dir of dirs) {
+      if (!dir) continue;
+      const names = [bin, ...exts.map((e) => (bin.toLowerCase().endsWith(e.toLowerCase()) ? bin : `${bin}${e}`))];
+      for (const n of names) {
+        if (!pass(path.extname(n))) continue;
+        const p = path.join(dir, n);
+        if (exists(p)) return p;
+      }
+    }
   }
   return null;
 }
 
+/**
+ * WINDOWS EXECUTION. A `.cmd`/`.bat` shim cannot be spawned directly on modern Node
+ * (EINVAL since the CVE-2024-27980 fix): it has to go through cmd.exe. Compose the
+ * one command line here. Every argv a template produces is a constant or a resolved
+ * binary path — never visitor-controlled — so this quoting is about paths with
+ * spaces, not injection. (A `%` in a path would still expand under cmd.exe; noted,
+ * accepted — no template value contains one, and usernames essentially never do.)
+ * Identity everywhere else, so callers can wrap unconditionally.
+ */
+export function argvForSpawn(argv, platform = process.platform) {
+  if (platform !== "win32") return argv;
+  const exe = String(argv[0] ?? "");
+  if (!/\.(cmd|bat)$/i.test(exe)) return argv;
+  const quote = (s) => `"${String(s).replace(/"/g, '\\"').replace(/(\\+)$/, "$1$1")}"`;
+  const line = [exe, ...argv.slice(1)].map(quote).join(" ");
+  return [process.env.ComSpec || "cmd.exe", "/d", "/s", "/c", line];
+}
+
 /**
  * Each template returns { argv, timeoutMs }. Parameters are validated by the
  * template itself and only ever land in a dedicated argv slot. A template that
@@ -492,8 +557,9 @@ export const RUN_TEMPLATES = Object.freeze({
     return { local: () => ({
       clis: found.map(({ bin, path: p }) => {
         if (!p) return { cli: bin, installed: false };
-        const r = spawnSync(p, ["--version"], { encoding: "utf8", timeout: 12_000 });
-        return { cli: bin, installed: true, version: String(r.stdout || r.stderr || "").trim().split("\n")[0].slice(0, 80) };
+        const argv = argvForSpawn([p, "--version"]);
+        const r = spawnSync(argv[0], argv.slice(1), { encoding: "utf8", timeout: 12_000 });
+        return { cli: bin, installed: true, version: String(r.stdout || r.stderr || r.error?.message || "").trim().split("\n")[0].slice(0, 80) };
       }),
     }) };
   },
@@ -604,7 +670,8 @@ function runArgv(argv, timeoutMs) {
     let err = "";
     let child;
     try {
-      child = spawn(argv[0], argv.slice(1), { stdio: ["ignore", "pipe", "pipe"] });
+      const wrapped = argvForSpawn(argv); // .cmd/.bat need cmd.exe on Windows
+      child = spawn(wrapped[0], wrapped.slice(1), { stdio: ["ignore", "pipe", "pipe"] });
     } catch (e) {
       resolve({ exit_code: null, stdout: "", stderr: String(e.message) });
       return;
@@ -668,7 +735,7 @@ const VERBS = {
     let text;
     try { text = fs.readFileSync(r.real, "utf8"); } catch (e) { return { error: `can't read: ${e.code || e.message}` }; }
     // Some setup files are needed for their SHAPE, not their contents (see PROJECTIONS).
-    const rel = path.relative(ctx.home, r.path);
+    const rel = projectionKey(ctx.home, r.path);
     const project = PROJECTIONS[rel];
     if (project) return { path: args.path, exists: true, bytes: st.size, projected: true, summary: project(text) };
     return { path: args.path, exists: true, bytes: st.size, text: text.slice(0, MAX_OUTPUT_CHARS) };

package/local.mjs

@@ -348,8 +348,9 @@ export function createLocalServer(deps) {
     if (route === "GET /connect-agents") return json(res, 200, { ok: true, ...connect });
 
     // Open or close the door. Deliberately a Bridge Local route rather than a
-    // config edit: the desktop app flips it with a switch, and the running Bridge
-    // picks it up immediately (no restart, so a host can close the door NOW).
+    // config edit: the Chef widget flips it in place when the person agrees, and
+    // the running Bridge picks it up immediately (no restart, so a host can close
+    // the door NOW).
     if (route === "POST /hosting") {
       const body = (await readBody(req)) ?? {};
       // A security toggle whose default is OFF must not fail open: an empty or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cookbook-bridge",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Run your own Claude, Codex and Gemini subscriptions against your Cookbook workspaces. One approval connects every agent CLI on your machine, with a receipt for every run.",
   "type": "module",
   "bin": {
@@ -19,6 +19,7 @@
     "hands.mjs",
     "harden.mjs",
     "live.mjs",
+    "plan.mjs",
     "local.mjs",
     "openclaw-runner.mjs",
     "prompt.mjs",

package/plan.mjs

@@ -0,0 +1,125 @@
+/**
+ * PLAN WINDOWS — "how much of my subscription have I used?" (Diego, 2026-08-29).
+ *
+ * The vendors' own CLIs already tell the Bridge, on every run, where the member's
+ * plan stands — nobody was catching it:
+ *   - claude `-p --output-format stream-json --verbose` emits a `rate_limit_event`
+ *     with `unifiedWindows.five_hour / seven_day { utilization, resetsAt }`.
+ *   - codex app-server answers `account/rateLimits/read` (and pushes
+ *     `account/rateLimits/updated`) with `primary / secondary { usedPercent,
+ *     windowDurationMins, resetsAt }` + `planType`.
+ *   - gemini-cli / agy report nothing about quota (verified 2026-08-29): honest
+ *     absence, never a guess.
+ *
+ * This module is the one place that knows those shapes. It keeps the LATEST
+ * observation per vendor in memory and hands the Bridge a query fragment to ride
+ * on its heartbeat (`?plan=…`, next to `?agents=`). No credential leaves the
+ * machine — a window is two numbers the member's own CLI printed.
+ *
+ * Wire shape (compact, re-validated server-side in src/lib/bridge/plan.ts):
+ *   { claude: { five_hour: { u: 0.66, r: 1788044400 }, seven_day: { u: 0.49, r: … }, at: <epoch s>, plan: "max" | null } }
+ *   u = fraction used (0..1+), r = epoch SECONDS the window resets.
+ *
+ * Pure parsers + a tiny store, no network, no fs — testable from the outside.
+ */
+
+const VENDORS = new Set(["claude", "codex", "gemini", "openclaw"]);
+const latest = new Map(); // vendor -> { five_hour?, seven_day?, at, plan }
+
+function num(x) {
+  const n = Number(x);
+  return Number.isFinite(n) ? n : null;
+}
+
+/** A window from (fraction-or-percent, reset). Accepts 0..1 fractions or 0..100 percents. */
+function window(used, resetsAt, { percent = false } = {}) {
+  let u = num(used);
+  const r = num(resetsAt);
+  if (u === null) return null;
+  if (percent) u = u / 100;
+  if (u < 0) u = 0;
+  return { u: Math.round(u * 1000) / 1000, ...(r !== null && r > 0 ? { r: Math.round(r > 1e11 ? r / 1000 : r) } : {}) };
+}
+
+/**
+ * claude stream-json → observation, or null for every other line.
+ *   {"type":"rate_limit_event","rate_limit_info":{"unifiedWindows":{"five_hour":{"utilization":0.66,"resetsAt":1788044400},"seven_day":{…}}}}
+ */
+export function planFromStreamLine(line) {
+  let j;
+  try { j = typeof line === "string" ? JSON.parse(line) : line; } catch { return null; }
+  if (!j || typeof j !== "object" || j.type !== "rate_limit_event") return null;
+  const info = j.rate_limit_info;
+  const w = info && typeof info === "object" ? info.unifiedWindows : null;
+  if (!w || typeof w !== "object") return null;
+  const five = w.five_hour && typeof w.five_hour === "object" ? window(w.five_hour.utilization, w.five_hour.resetsAt) : null;
+  const seven = w.seven_day && typeof w.seven_day === "object" ? window(w.seven_day.utilization, w.seven_day.resetsAt) : null;
+  if (!five && !seven) return null;
+  return { vendor: "claude", ...(five ? { five_hour: five } : {}), ...(seven ? { seven_day: seven } : {}), plan: null };
+}
+
+/**
+ * codex app-server `account/rateLimits/read` result (or the `updated` notification's
+ * params) → observation. Windows are named by their length, not by position:
+ * primary is the short one only because that is how OpenAI orders them today.
+ */
+export function planFromCodexRateLimits(result) {
+  const rl = result && typeof result === "object" ? (result.rateLimits && typeof result.rateLimits === "object" ? result.rateLimits : result) : null;
+  if (!rl || typeof rl !== "object") return null;
+  const out = { vendor: "codex", plan: typeof rl.planType === "string" ? rl.planType : null };
+  let any = false;
+  for (const key of ["primary", "secondary"]) {
+    const w = rl[key];
+    if (!w || typeof w !== "object") continue;
+    const mins = num(w.windowDurationMins ?? w.window_minutes);
+    const win = window(w.usedPercent ?? w.used_percent, w.resetsAt ?? w.resets_at, { percent: true });
+    if (!win) continue;
+    const slot = mins !== null && mins > 600 ? "seven_day" : "five_hour";
+    if (!out[slot]) { out[slot] = win; any = true; }
+  }
+  return any ? out : null;
+}
+
+/** Record the newest observation for its vendor. Returns true when something changed. */
+export function notePlan(obs, now = Date.now()) {
+  if (!obs || typeof obs !== "object" || !VENDORS.has(obs.vendor)) return false;
+  const entry = {
+    ...(obs.five_hour ? { five_hour: obs.five_hour } : {}),
+    ...(obs.seven_day ? { seven_day: obs.seven_day } : {}),
+    at: Math.round(now / 1000),
+    plan: typeof obs.plan === "string" && obs.plan ? obs.plan.slice(0, 32) : null,
+  };
+  const prev = latest.get(obs.vendor);
+  latest.set(obs.vendor, entry);
+  const same = prev && JSON.stringify({ ...prev, at: 0 }) === JSON.stringify({ ...entry, at: 0 });
+  return !same;
+}
+
+/** Everything observed this process lifetime, keyed by vendor. */
+export function latestPlans() {
+  const out = {};
+  for (const [v, e] of latest) out[v] = e;
+  return out;
+}
+
+/** For tests. */
+export function resetPlans() {
+  latest.clear();
+}
+
+/** `plan=<json>` (no leading `?`/`&`), or "" when nothing has been observed. */
+export function planParam() {
+  if (!latest.size) return "";
+  return `plan=${encodeURIComponent(JSON.stringify(latestPlans()))}`;
+}
+
+/** One human line for the Bridge log: `claude 66% of 5h · 49% of week`. */
+export function planLine(vendor, entry) {
+  const pct = (w) => (w && typeof w.u === "number" ? `${Math.round(w.u * 100)}%` : null);
+  const parts = [];
+  const f = pct(entry?.five_hour);
+  const s = pct(entry?.seven_day);
+  if (f) parts.push(`${f} of 5h`);
+  if (s) parts.push(`${s} of week`);
+  return `${vendor}${entry?.plan ? ` (${entry.plan})` : ""}: ${parts.join(" · ") || "no windows"}`;
+}

package/thread-runner.mjs

@@ -19,6 +19,7 @@
  */
 import { spawn } from "node:child_process";
 import { callsFromStreamLine, foldCallEvent, wireCalls } from "./live.mjs";
+import { planFromStreamLine, notePlan, planLine } from "./plan.mjs";
 
 const IDLE_MS = 10 * 60_000;
 const runners = new Map(); // threadRootId -> Runner
@@ -43,7 +44,8 @@ export function persistentCommand(command, resumeSessionId) {
 }
 
 class Runner {
-  constructor({ threadId, agent, env, resumeSessionId, helpers, log }) {
+  constructor({ threadId, agent, env, resumeSessionId, helpers, log, model = null }) {
+    this.model = model ?? agent.model ?? null;
     this.threadId = threadId;
     this.agent = agent;
     this.helpers = helpers; // { fold, textFrom, sessionFrom }
@@ -94,6 +96,8 @@ class Runner {
       }
       let touched = false;
       for (const ev of callsFromStreamLine(line)) { t.calls = foldCallEvent(t.calls, ev); touched = true; }
+      const plan = planFromStreamLine(line);
+      if (plan && notePlan(plan)) this.log?.(`  ↳ plan ${planLine(plan.vendor, plan)}`);
       const r = this.helpers.fold(line, t.acc);
       t.acc = r.acc;
       if (r.resultLine) {
@@ -196,11 +200,19 @@ export function adoptRunner(fromKey, toKey) {
 
 /** Get the live runner for a thread, or create one (resuming a prior session when
  *  given). Throws when the agent isn't claude-shaped; callers fall back. */
-export function runnerFor({ threadId, agent, env, resumeSessionId, helpers, log }) {
+export function runnerFor({ threadId, agent, env, resumeSessionId, helpers, log, model = null }) {
   const existing = runners.get(threadId);
-  if (existing && !existing.dead) return existing;
+  const want = model ?? agent.model ?? null;
+  if (existing && !existing.dead && (existing.model ?? null) === want) return existing;
+  if (existing && !existing.dead) {
+    // Same conversation, different model: resume the session on the new one.
+    if (existing.busy) throw new Error("runner busy");
+    resumeSessionId = existing.sessionId ?? resumeSessionId;
+    existing.kill();
+    log(`  ↳ thread runner for ${threadId.slice(0, 8)} restarted on ${want ?? "the default model"}`);
+  }
   if (existing) runners.delete(threadId);
-  const r = new Runner({ threadId, agent, env, resumeSessionId, helpers, log });
+  const r = new Runner({ threadId, agent, env, resumeSessionId, helpers, log, model: want });
   runners.set(threadId, r);
   log(`  ↳ thread runner started for ${threadId.slice(0, 8)}${resumeSessionId ? " (resuming session)" : ""}`);
   return r;