instar 1.3.121 → 1.3.123

package/dist/messaging/relayContentDedup.d.ts

@@ -0,0 +1,51 @@
+/**
+ * relayContentDedup — content-hash dedup for the agent-to-agent `relay-agent`
+ * ingress path.
+ *
+ * The id-based dedup in MessageRouter.relay keys on `message.id`. That misses a
+ * specific failure mode observed 2026-05-30: a SENDER whose HTTP call blocks on
+ * the RECEIVER's session spawn (slow on a loaded box) times out, then RETRIES
+ * the same message with a FRESH `message.id`. The retry slips past the id-based
+ * dedup → the receiver spawns/resumes and replies twice (the duplicate-reply
+ * bug — saw 6 doubled replies in one evening).
+ *
+ * This layer recognizes the retry by the STABLE triple
+ * (senderAgent, threadId, normalized content) within a short window, regardless
+ * of the message id. It is a bounded, in-memory, fixed-window dedup:
+ *   - fresh (sender, thread, content) → process + record
+ *   - identical within `ttlMs` of first-seen → drop (duplicate retry)
+ *   - identical `ttlMs`+ after first-seen → process (plausibly a real re-send)
+ *
+ * Memory is bounded by `maxEntries` (oldest-evicted) plus a lazy sweep of
+ * expired keys on each call. The window is intentionally short so it only ever
+ * collapses true rapid retries, never two genuinely-distinct sends.
+ */
+export interface RelayContentDedupOpts {
+    /** Window from first-seen during which an identical inbound is a duplicate. */
+    ttlMs?: number;
+    /** Hard cap on retained keys (oldest evicted past this). */
+    maxEntries?: number;
+    /** Injectable clock for deterministic tests. */
+    now?: () => number;
+}
+export declare class RelayContentDedup {
+    private readonly ttlMs;
+    private readonly maxEntries;
+    private readonly now;
+    /** key -> firstSeen epoch ms (Map preserves insertion order for eviction). */
+    private readonly seen;
+    constructor(opts?: RelayContentDedupOpts);
+    /** Stable dedup key for an inbound relay message. */
+    static keyFor(senderAgent: string, threadId: string, content: string): string;
+    /**
+     * Returns true if this inbound should be processed (fresh, or the prior
+     * sighting has aged past the window); false if it is a duplicate retry seen
+     * within the window. Fresh keys are recorded. Safe to call on every inbound.
+     */
+    shouldProcess(senderAgent: string, threadId: string, content: string): boolean;
+    /** Number of retained keys (test/observability aid). */
+    size(): number;
+    private sweep;
+    private enforceCap;
+}
+//# sourceMappingURL=relayContentDedup.d.ts.map

package/dist/messaging/relayContentDedup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relayContentDedup.d.ts","sourceRoot":"","sources":["../../src/messaging/relayContentDedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;gBAEtC,IAAI,GAAE,qBAA0B;IAM5C,qDAAqD;IACrD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAU7E;;;;OAIG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;IAgB9E,wDAAwD;IACxD,IAAI,IAAI,MAAM;IAId,OAAO,CAAC,KAAK;IAOb,OAAO,CAAC,UAAU;CASnB"}

package/dist/messaging/relayContentDedup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relayContentDedup.js","sourceRoot":"","sources":["../../src/messaging/relayContentDedup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAWjC,MAAM,OAAO,iBAAiB;IACX,KAAK,CAAS;IACd,UAAU,CAAS;IACnB,GAAG,CAAe;IACnC,8EAA8E;IAC7D,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,YAAY,OAA8B,EAAE;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,qDAAqD;IACrD,MAAM,CAAC,MAAM,CAAC,WAAmB,EAAE,QAAgB,EAAE,OAAe;QAClE,oEAAoE;QACpE,8CAA8C;QAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,GAAG,WAAW,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;aAClD,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,WAAmB,EAAE,QAAgB,EAAE,OAAe;QAClE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,CAAS;QACrB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACjC,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,EAAE,CAAC,IAAI,QAAQ;gBAAE,MAAM;QAC7B,CAAC;IACH,CAAC;CACF"}

package/dist/monitoring/frameworkActivitySignals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frameworkActivitySignals.d.ts","sourceRoot":"","sources":["../../src/monitoring/frameworkActivitySignals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAEpF,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AA2CD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,qBAAqB,GAAG,SAAS,GAAG,IAAI,GAAG,uBAAuB,CAU9G;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,CAAC;IAAE,SAAS,EAAE,qBAAqB,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAK1H"}
+{"version":3,"file":"frameworkActivitySignals.d.ts","sourceRoot":"","sources":["../../src/monitoring/frameworkActivitySignals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAEpF,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAsDD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,qBAAqB,GAAG,SAAS,GAAG,IAAI,GAAG,uBAAuB,CAU9G;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,CAAC;IAAE,SAAS,EAAE,qBAAqB,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC,CAK1H"}

package/dist/monitoring/frameworkActivitySignals.js

@@ -43,7 +43,18 @@ const CODEX_CLI_SIGNAL = {
     // proxy default to "still working" forever (the 2026-05-23 stuck-session
     // incident). The placeholder prompt "Find and fix a bug in @filename" is
     // likewise an IDLE indicator, not work.
-    toolCallOrSpinner: /Working\s*\(\d+\s*s|•\s*Ran\b|exec\(|shell\(|apply_patch\(|⠋|⠙|⠹|⠸|⠼|⠴|⠦|⠧|⠇|⠏|\bgenerating\b/i,
+    //
+    // codex EXEC --json mode (jobs, autonomous spawns) emits a JSON EVENT STREAM,
+    // not the TUI status line: {"type":"thread.started"}, {"type":"turn.started"},
+    // {"type":"item.started"|"item.completed"|"item.updated"}, etc. None of the
+    // TUI patterns above match that, so a working `codex exec --json` session read
+    // as NOT active → marked paused → skipped by ActiveWorkSilenceSentinel. That
+    // hid a genuinely-wedged exec-json job (frozen mid-turn ~8.5h) from the
+    // silence watchdog. Match the event-stream namespaces so an exec-json session
+    // that streamed events THEN froze is silence-eligible (the OutputActivity-
+    // Tracker's observed-change requirement still gates "frozen before we watched").
+    // These are structured JSON markers, not idle status text.
+    toolCallOrSpinner: /Working\s*\(\d+\s*s|•\s*Ran\b|exec\(|shell\(|apply_patch\(|⠋|⠙|⠹|⠸|⠼|⠴|⠦|⠧|⠇|⠏|\bgenerating\b|"type":\s*"(thread|turn|item)\./i,
     // Codex shows a BARE "esc to interrupt" (no "press"/"hit" prefix) inside
     // its working status line, so the Claude-style prefixed pattern never
     // matched a real Codex pane. Match the bare form.

package/dist/monitoring/frameworkActivitySignals.js.map

@@ -1 +1 @@
-{"version":3,"file":"frameworkActivitySignals.js","sourceRoot":"","sources":["../../src/monitoring/frameworkActivitySignals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA+BH,MAAM,kBAAkB,GAA4B;IAClD,WAAW,EAAE,aAAa;IAC1B,kEAAkE;IAClE,wCAAwC;IACxC,iBAAiB,EAAE,uEAAuE;IAC1F,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,cAAc;IAChC,oBAAoB,EAClB,+JAA+J;CAClK,CAAC;AAEF,MAAM,gBAAgB,GAA4B;IAChD,WAAW,EAAE,WAAW;IACxB,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,oDAAoD;IACpD,EAAE;IACF,+DAA+D;IAC/D,gEAAgE;IAChE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,wCAAwC;IACxC,iBAAiB,EAAE,gGAAgG;IACnH,yEAAyE;IACzE,sEAAsE;IACtE,kDAAkD;IAClD,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,gEAAgE;IAClF,oBAAoB,EAClB,kRAAkR;CACrR,CAAC;AAEF,MAAM,gBAAgB,GAA2D;IAC/E,aAAa,EAAE,kBAAkB;IACjC,WAAW,EAAE,gBAAgB;CAC9B,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAmD;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,kBAAkB,CAAC;IAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,kEAAkE;IAClE,gEAAgE;IAChE,kEAAkE;IAClE,kEAAkE;IAClE,6CAA6C;IAC7C,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAQ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAA6B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClF,SAAS;QACT,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC;KACpC,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"frameworkActivitySignals.js","sourceRoot":"","sources":["../../src/monitoring/frameworkActivitySignals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA+BH,MAAM,kBAAkB,GAA4B;IAClD,WAAW,EAAE,aAAa;IAC1B,kEAAkE;IAClE,wCAAwC;IACxC,iBAAiB,EAAE,uEAAuE;IAC1F,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,cAAc;IAChC,oBAAoB,EAClB,+JAA+J;CAClK,CAAC;AAEF,MAAM,gBAAgB,GAA4B;IAChD,WAAW,EAAE,WAAW;IACxB,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,oDAAoD;IACpD,EAAE;IACF,+DAA+D;IAC/D,gEAAgE;IAChE,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,wCAAwC;IACxC,EAAE;IACF,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,iFAAiF;IACjF,2DAA2D;IAC3D,iBAAiB,EAAE,gIAAgI;IACnJ,yEAAyE;IACzE,sEAAsE;IACtE,kDAAkD;IAClD,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,gEAAgE;IAClF,oBAAoB,EAClB,kRAAkR;CACrR,CAAC;AAEF,MAAM,gBAAgB,GAA2D;IAC/E,aAAa,EAAE,kBAAkB;IACjC,WAAW,EAAE,gBAAgB;CAC9B,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAmD;IACnF,IAAI,CAAC,SAAS;QAAE,OAAO,kBAAkB,CAAC;IAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,kEAAkE;IAClE,gEAAgE;IAChE,kEAAkE;IAClE,kEAAkE;IAClE,6CAA6C;IAC7C,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAQ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAA6B,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClF,SAAS;QACT,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC;KACpC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/providers/adapters/openai-codex/observability/codexModelSwapPolicy.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Codex rate-limit model-swap policy.
+ *
+ * Justin's ask (2026-05-30): "swap to GPT-5.3-Codex-Spark when the other usage
+ * hits the limit." Codex's primary model (e.g. gpt-5.5) and a fallback like
+ * Codex-Spark draw on SEPARATE account quota buckets, so when the main model's
+ * weekly window is exhausted, launching the next session on the fallback keeps
+ * the agent working instead of stalling on a depleted window.
+ *
+ * This module is the DECISION; it holds no authority of its own. The pure
+ * `resolveCodexLaunchModel` takes a usage snapshot (from `readLatestCodexUsage`,
+ * the authoritative on-disk rate-limit reader) and the operator config and
+ * returns which model the NEXT codex session should launch with. A running
+ * session can't change model mid-turn, so the swap naturally applies at launch.
+ *
+ * Safe-by-default: ships DARK. With `enabled` false (the default) or no
+ * `fallbackModel` set, it is a no-op and adds zero overhead to the spawn path.
+ * The fallback model id is OPERATOR CONFIG — never hardcoded — because the exact
+ * Codex-Spark `--model` string + its subscription availability is the account
+ * owner's to confirm (it is not in instar's probed model list).
+ *
+ * RULE 3.1 RATIONALE
+ *   Criticality: medium (cost-routing; never blocks a launch)
+ *   Frequency:   per codex session launch, only when enabled
+ *   Stability:   stable (pure decision over a structured snapshot)
+ *   Fallback:    no swap (launch with the requested model) on any uncertainty
+ *   Verdict:     pure policy + best-effort usage read; unit-tested both sides
+ */
+import type { CodexUsageSnapshot } from './codexRateLimitReader.js';
+/** Operator config for the swap, read from `.instar/config.json` → codex.rateLimitModelSwap. */
+export interface CodexModelSwapConfig {
+    /** Master switch. Default false — the feature ships dark. */
+    enabled?: boolean;
+    /**
+     * The model to launch on when the main model's window is exhausted (e.g. the
+     * Codex-Spark model id). REQUIRED to swap — no default, because the exact id +
+     * subscription availability is the account owner's to confirm.
+     */
+    fallbackModel?: string;
+    /**
+     * Swap when the weekly (secondary) window's remaining percent is at or below
+     * this. Default 10. The authoritative `rate_limit_reached_type` flag also
+     * triggers a swap regardless of this threshold.
+     */
+    weeklyRemainingThreshold?: number;
+}
+export interface CodexModelSwapDecision {
+    /** The model the session should launch with (the request, unchanged, or the fallback). */
+    model: string | undefined;
+    /** True only when the policy actually substituted the fallback. */
+    swapped: boolean;
+    /** Human-readable reason when swapped, else null. */
+    reason: string | null;
+}
+export declare const DEFAULT_WEEKLY_REMAINING_THRESHOLD = 10;
+/**
+ * Pure decision: given the framework, the requested model, the operator config,
+ * and the current codex usage snapshot, return which model to launch with.
+ * Never throws. Returns the requested model unchanged on any reason not to swap.
+ */
+export declare function resolveCodexLaunchModel(params: {
+    framework: string;
+    requestedModel: string | undefined;
+    config: CodexModelSwapConfig | undefined;
+    usage: CodexUsageSnapshot | null;
+}): CodexModelSwapDecision;
+/**
+ * Best-effort async wrapper used on the spawn path. Reads the current codex
+ * usage (only when the feature is enabled — disabled = zero disk I/O) and
+ * applies {@link resolveCodexLaunchModel}. NEVER throws and NEVER blocks a
+ * launch: any read failure resolves to "no swap" (launch with the requested
+ * model). `readUsage` is injectable for tests.
+ */
+export declare function resolveCodexLaunchModelWithUsage(params: {
+    framework: string;
+    requestedModel: string | undefined;
+    config: CodexModelSwapConfig | undefined;
+    codexHome?: string;
+    readUsage?: (opts: {
+        codexHome?: string;
+    }) => Promise<CodexUsageSnapshot | null>;
+}): Promise<CodexModelSwapDecision>;
+//# sourceMappingURL=codexModelSwapPolicy.d.ts.map

package/dist/providers/adapters/openai-codex/observability/codexModelSwapPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codexModelSwapPolicy.d.ts","sourceRoot":"","sources":["../../../../../src/providers/adapters/openai-codex/observability/codexModelSwapPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,gGAAgG;AAChG,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,0FAA0F;IAC1F,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC;IACjB,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACzC,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAClC,GAAG,sBAAsB,CA2BzB;AAED;;;;;;GAMG;AACH,wBAAsB,gCAAgC,CAAC,MAAM,EAAE;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,MAAM,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CAClF,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAiBlC"}

package/dist/providers/adapters/openai-codex/observability/codexModelSwapPolicy.js

@@ -0,0 +1,93 @@
+/**
+ * Codex rate-limit model-swap policy.
+ *
+ * Justin's ask (2026-05-30): "swap to GPT-5.3-Codex-Spark when the other usage
+ * hits the limit." Codex's primary model (e.g. gpt-5.5) and a fallback like
+ * Codex-Spark draw on SEPARATE account quota buckets, so when the main model's
+ * weekly window is exhausted, launching the next session on the fallback keeps
+ * the agent working instead of stalling on a depleted window.
+ *
+ * This module is the DECISION; it holds no authority of its own. The pure
+ * `resolveCodexLaunchModel` takes a usage snapshot (from `readLatestCodexUsage`,
+ * the authoritative on-disk rate-limit reader) and the operator config and
+ * returns which model the NEXT codex session should launch with. A running
+ * session can't change model mid-turn, so the swap naturally applies at launch.
+ *
+ * Safe-by-default: ships DARK. With `enabled` false (the default) or no
+ * `fallbackModel` set, it is a no-op and adds zero overhead to the spawn path.
+ * The fallback model id is OPERATOR CONFIG — never hardcoded — because the exact
+ * Codex-Spark `--model` string + its subscription availability is the account
+ * owner's to confirm (it is not in instar's probed model list).
+ *
+ * RULE 3.1 RATIONALE
+ *   Criticality: medium (cost-routing; never blocks a launch)
+ *   Frequency:   per codex session launch, only when enabled
+ *   Stability:   stable (pure decision over a structured snapshot)
+ *   Fallback:    no swap (launch with the requested model) on any uncertainty
+ *   Verdict:     pure policy + best-effort usage read; unit-tested both sides
+ */
+import { readLatestCodexUsage } from './codexRateLimitReader.js';
+export const DEFAULT_WEEKLY_REMAINING_THRESHOLD = 10;
+/**
+ * Pure decision: given the framework, the requested model, the operator config,
+ * and the current codex usage snapshot, return which model to launch with.
+ * Never throws. Returns the requested model unchanged on any reason not to swap.
+ */
+export function resolveCodexLaunchModel(params) {
+    const { framework, requestedModel, config, usage } = params;
+    const noSwap = { model: requestedModel, swapped: false, reason: null };
+    if (framework !== 'codex-cli')
+        return noSwap;
+    if (!config?.enabled)
+        return noSwap;
+    const fallback = config.fallbackModel;
+    if (!fallback)
+        return noSwap; // nothing to swap to — operator hasn't set the id
+    // Already on the fallback → don't re-swap (no-op / avoids a confusing log).
+    if (requestedModel && requestedModel === fallback)
+        return noSwap;
+    if (!usage)
+        return noSwap; // couldn't read usage → conservative: launch as requested
+    const threshold = config.weeklyRemainingThreshold ?? DEFAULT_WEEKLY_REMAINING_THRESHOLD;
+    const reached = usage.rateLimitReachedType; // authoritative "a window is hit NOW"
+    const weeklyRemaining = usage.secondary?.remainingPercent;
+    const reachedHit = reached !== null && reached !== undefined;
+    const weeklyLow = typeof weeklyRemaining === 'number' && weeklyRemaining <= threshold;
+    if (!reachedHit && !weeklyLow)
+        return noSwap;
+    return {
+        model: fallback,
+        swapped: true,
+        reason: reachedHit
+            ? `codex rate_limit_reached_type=${reached}; swapping launch model to ${fallback}`
+            : `codex weekly window at ${weeklyRemaining}% remaining (<= ${threshold}%); swapping launch model to ${fallback}`,
+    };
+}
+/**
+ * Best-effort async wrapper used on the spawn path. Reads the current codex
+ * usage (only when the feature is enabled — disabled = zero disk I/O) and
+ * applies {@link resolveCodexLaunchModel}. NEVER throws and NEVER blocks a
+ * launch: any read failure resolves to "no swap" (launch with the requested
+ * model). `readUsage` is injectable for tests.
+ */
+export async function resolveCodexLaunchModelWithUsage(params) {
+    const { framework, requestedModel, config, codexHome } = params;
+    const noSwap = { model: requestedModel, swapped: false, reason: null };
+    // Fast paths that avoid any disk read when the feature can't act.
+    if (framework !== 'codex-cli')
+        return noSwap;
+    if (!config?.enabled || !config.fallbackModel)
+        return noSwap;
+    if (requestedModel && requestedModel === config.fallbackModel)
+        return noSwap;
+    const read = params.readUsage ?? readLatestCodexUsage;
+    let usage = null;
+    try {
+        usage = await read({ codexHome });
+    }
+    catch {
+        return noSwap; // best-effort: never block a launch on a usage read
+    }
+    return resolveCodexLaunchModel({ framework, requestedModel, config, usage });
+}
+//# sourceMappingURL=codexModelSwapPolicy.js.map

package/dist/providers/adapters/openai-codex/observability/codexModelSwapPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codexModelSwapPolicy.js","sourceRoot":"","sources":["../../../../../src/providers/adapters/openai-codex/observability/codexModelSwapPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AA6BjE,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAKvC;IACC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAC5D,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAE/F,IAAI,SAAS,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,MAAM,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,kDAAkD;IAChF,4EAA4E;IAC5E,IAAI,cAAc,IAAI,cAAc,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,CAAC,0DAA0D;IAErF,MAAM,SAAS,GAAG,MAAM,CAAC,wBAAwB,IAAI,kCAAkC,CAAC;IACxF,MAAM,OAAO,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC,sCAAsC;IAClF,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAE1D,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,IAAI,SAAS,CAAC;IACtF,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC;IAE7C,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,UAAU;YAChB,CAAC,CAAC,iCAAiC,OAAO,8BAA8B,QAAQ,EAAE;YAClF,CAAC,CAAC,0BAA0B,eAAe,mBAAmB,SAAS,gCAAgC,QAAQ,EAAE;KACpH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,MAMtD;IACC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAChE,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAE/F,kEAAkE;IAClE,IAAI,SAAS,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC;IAC7D,IAAI,cAAc,IAAI,cAAc,KAAK,MAAM,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC;IAE7E,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,oBAAoB,CAAC;IACtD,IAAI,KAAK,GAA8B,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,CAAC,oDAAoD;IACrE,CAAC;IACD,OAAO,uBAAuB,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/providers/adapters/openai-codex/observability/codexRateLimitReader.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Reads the codex CLI's `/status`-equivalent rate-limit usage from the
+ * on-disk rollout JSONL stream — WITHOUT the interactive TUI.
+ *
+ * Codex has no public usage endpoint (the UsageMeterProvider falls back to
+ * local token accounting and reports isAuthoritative()=false). But the codex
+ * CLI DOES persist the authoritative account rate-limit windows it gets back
+ * from OpenAI: every turn it appends a `token_count` event to the session
+ * rollout whose `payload.rate_limits` carries the same primary (5h) /
+ * secondary (weekly) windows the TUI's `/status` shows:
+ *
+ *   { "type": "event_msg",
+ *     "payload": {
+ *       "type": "token_count",
+ *       "rate_limits": {
+ *         "limit_id": "codex",
+ *         "primary":   { "used_percent": 13, "window_minutes": 300,   "resets_at": 1780171524 },
+ *         "secondary": { "used_percent": 93, "window_minutes": 10080, "resets_at": 1780174809 },
+ *         "plan_type": "prolite",
+ *         "rate_limit_reached_type": null } } }
+ *
+ * This reader finds the newest rollout(s), reads only the tail (rate-limit
+ * events are appended per-turn, so the freshest is near the end), and returns
+ * the most recent snapshot. It is read-only and never mutates any session
+ * state — the same discipline as the rest of the codex observability layer.
+ *
+ * RULE 3.1 RATIONALE
+ *   Criticality: high (cost-routing / model-swap input)
+ *   Frequency:   per-poll / on-demand (route hit)
+ *   Stability:   semi-stable (codex rollout layout changes occasionally —
+ *                shared with sessionPaths, covered by codexSessionLayoutCanary)
+ *   Fallback:    return null when no rollout / no token_count event is found
+ *   Verdict:     deterministic tail-scan; canary covers the layout
+ */
+/** A single rate-limit window (5h primary or weekly secondary). */
+export interface CodexRateWindow {
+    /** Percent of the window's budget consumed (0-100). */
+    usedPercent: number;
+    /** Convenience: 100 - usedPercent, clamped to [0, 100]. */
+    remainingPercent: number;
+    /** Window length in minutes (300 = 5h, 10080 = weekly). */
+    windowMinutes: number;
+    /** Absolute reset time, unix epoch seconds (as codex reports it). */
+    resetsAt: number;
+    /** Derived ISO-8601 of `resetsAt`, or null if `resetsAt` is missing/invalid. */
+    resetsAtIso: string | null;
+    /** Seconds until reset relative to the provided clock, or null when no clock. */
+    resetsInSeconds: number | null;
+}
+/** A point-in-time snapshot of codex account rate-limit usage. */
+export interface CodexUsageSnapshot {
+    source: 'codex-rollout';
+    /** The rollout file the snapshot was read from. */
+    rolloutPath: string;
+    /** Thread UUID parsed from the rollout filename, or null. */
+    threadId: string | null;
+    /** Timestamp of the token_count event the snapshot came from (ISO), or null. */
+    capturedAt: string | null;
+    /** Model in effect at capture (best-effort from the latest turn_context), or null. */
+    model: string | null;
+    /** Plan tier codex reports (e.g. "plus", "prolite"), or null. */
+    planType: string | null;
+    /**
+     * Which window (if any) is currently exhausted. codex sets this to e.g.
+     * "primary" / "secondary" when a limit is hit; null when usage is fine.
+     * This is the authoritative "we are rate-limited" signal.
+     */
+    rateLimitReachedType: string | null;
+    /** The 5h rolling window (window_minutes 300), or null if absent. */
+    primary: CodexRateWindow | null;
+    /** The weekly rolling window (window_minutes 10080), or null if absent. */
+    secondary: CodexRateWindow | null;
+}
+export interface ReadCodexUsageOptions {
+    /** Override $CODEX_HOME (defaults to ~/.codex). */
+    codexHome?: string;
+    /** Clock for deriving `resetsInSeconds` (defaults to Date.now()). */
+    nowMs?: number;
+    /** How many newest rollouts to scan for a token_count event (default 8). */
+    maxRolloutsScanned?: number;
+    /** Tail size to read from each rollout (default 512 KiB). */
+    tailBytes?: number;
+}
+/**
+ * Read the freshest codex rate-limit snapshot from disk. Returns null when
+ * there is no codex rollout with a rate-limit-bearing token_count event
+ * (e.g. a pure-Claude agent, or a session that has not completed a turn yet).
+ */
+export declare function readLatestCodexUsage(opts?: ReadCodexUsageOptions): Promise<CodexUsageSnapshot | null>;
+/**
+ * Parse the freshest rate-limit snapshot out of a rollout tail. Exported for
+ * unit tests so they can exercise the parser without touching disk.
+ */
+export declare function parseUsageFromTail(tail: string, rolloutPath: string, nowMs: number): CodexUsageSnapshot | null;
+//# sourceMappingURL=codexRateLimitReader.d.ts.map

package/dist/providers/adapters/openai-codex/observability/codexRateLimitReader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codexRateLimitReader.d.ts","sourceRoot":"","sources":["../../../../../src/providers/adapters/openai-codex/observability/codexRateLimitReader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAKH,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iFAAiF;IACjF,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gFAAgF;IAChF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sFAAsF;IACtF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qEAAqE;IACrE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAChC,2EAA2E;IAC3E,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAiBpC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,kBAAkB,GAAG,IAAI,CA8C3B"}

package/dist/providers/adapters/openai-codex/observability/codexRateLimitReader.js

@@ -0,0 +1,170 @@
+/**
+ * Reads the codex CLI's `/status`-equivalent rate-limit usage from the
+ * on-disk rollout JSONL stream — WITHOUT the interactive TUI.
+ *
+ * Codex has no public usage endpoint (the UsageMeterProvider falls back to
+ * local token accounting and reports isAuthoritative()=false). But the codex
+ * CLI DOES persist the authoritative account rate-limit windows it gets back
+ * from OpenAI: every turn it appends a `token_count` event to the session
+ * rollout whose `payload.rate_limits` carries the same primary (5h) /
+ * secondary (weekly) windows the TUI's `/status` shows:
+ *
+ *   { "type": "event_msg",
+ *     "payload": {
+ *       "type": "token_count",
+ *       "rate_limits": {
+ *         "limit_id": "codex",
+ *         "primary":   { "used_percent": 13, "window_minutes": 300,   "resets_at": 1780171524 },
+ *         "secondary": { "used_percent": 93, "window_minutes": 10080, "resets_at": 1780174809 },
+ *         "plan_type": "prolite",
+ *         "rate_limit_reached_type": null } } }
+ *
+ * This reader finds the newest rollout(s), reads only the tail (rate-limit
+ * events are appended per-turn, so the freshest is near the end), and returns
+ * the most recent snapshot. It is read-only and never mutates any session
+ * state — the same discipline as the rest of the codex observability layer.
+ *
+ * RULE 3.1 RATIONALE
+ *   Criticality: high (cost-routing / model-swap input)
+ *   Frequency:   per-poll / on-demand (route hit)
+ *   Stability:   semi-stable (codex rollout layout changes occasionally —
+ *                shared with sessionPaths, covered by codexSessionLayoutCanary)
+ *   Fallback:    return null when no rollout / no token_count event is found
+ *   Verdict:     deterministic tail-scan; canary covers the layout
+ */
+import { promises as fs } from 'node:fs';
+import { listAllRollouts } from './sessionPaths.js';
+const DEFAULT_TAIL_BYTES = 512 * 1024;
+const DEFAULT_MAX_ROLLOUTS = 8;
+const UUID_RE = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i;
+/**
+ * Read the freshest codex rate-limit snapshot from disk. Returns null when
+ * there is no codex rollout with a rate-limit-bearing token_count event
+ * (e.g. a pure-Claude agent, or a session that has not completed a turn yet).
+ */
+export async function readLatestCodexUsage(opts = {}) {
+    const nowMs = opts.nowMs ?? Date.now();
+    const tailBytes = opts.tailBytes ?? DEFAULT_TAIL_BYTES;
+    const maxRollouts = opts.maxRolloutsScanned ?? DEFAULT_MAX_ROLLOUTS;
+    const rollouts = await listAllRollouts(opts.codexHome, maxRollouts);
+    for (const { path: rolloutPath } of rollouts) {
+        let tail;
+        try {
+            tail = await readTail(rolloutPath, tailBytes);
+        }
+        catch {
+            continue;
+        }
+        const snapshot = parseUsageFromTail(tail, rolloutPath, nowMs);
+        if (snapshot)
+            return snapshot;
+    }
+    return null;
+}
+/**
+ * Parse the freshest rate-limit snapshot out of a rollout tail. Exported for
+ * unit tests so they can exercise the parser without touching disk.
+ */
+export function parseUsageFromTail(tail, rolloutPath, nowMs) {
+    const lines = tail.split('\n');
+    let rateLimits = null;
+    let capturedAt = null;
+    let model = null;
+    for (const line of lines) {
+        if (!line || line[0] !== '{')
+            continue;
+        // Cheap pre-filter before the JSON.parse cost.
+        const hasRate = line.includes('"rate_limits"');
+        const hasModel = line.includes('"turn_context"') && line.includes('"model"');
+        if (!hasRate && !hasModel)
+            continue;
+        let obj;
+        try {
+            obj = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const payload = obj.payload;
+        if (!payload)
+            continue;
+        if (payload.type === 'token_count' && payload.rate_limits) {
+            rateLimits = payload.rate_limits;
+            capturedAt = typeof obj.timestamp === 'string' ? obj.timestamp : capturedAt;
+        }
+        else if (payload.type === undefined && obj.type === 'turn_context') {
+            // turn_context nests its fields directly under payload.
+            const m = payload.model;
+            if (typeof m === 'string' && m)
+                model = m;
+        }
+    }
+    if (!rateLimits)
+        return null;
+    return {
+        source: 'codex-rollout',
+        rolloutPath,
+        threadId: parseThreadId(rolloutPath),
+        capturedAt,
+        model,
+        planType: typeof rateLimits.plan_type === 'string' ? rateLimits.plan_type : null,
+        rateLimitReachedType: typeof rateLimits.rate_limit_reached_type === 'string'
+            ? rateLimits.rate_limit_reached_type
+            : null,
+        primary: parseWindow(rateLimits.primary, nowMs),
+        secondary: parseWindow(rateLimits.secondary, nowMs),
+    };
+}
+function parseWindow(raw, nowMs) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const w = raw;
+    const usedPercent = typeof w.used_percent === 'number' ? w.used_percent : null;
+    const windowMinutes = typeof w.window_minutes === 'number' ? w.window_minutes : null;
+    const resetsAt = typeof w.resets_at === 'number' ? w.resets_at : null;
+    if (usedPercent === null || windowMinutes === null || resetsAt === null)
+        return null;
+    const validReset = Number.isFinite(resetsAt) && resetsAt > 0;
+    return {
+        usedPercent,
+        remainingPercent: clampPercent(100 - usedPercent),
+        windowMinutes,
+        resetsAt,
+        resetsAtIso: validReset ? new Date(resetsAt * 1000).toISOString() : null,
+        resetsInSeconds: validReset ? Math.round((resetsAt * 1000 - nowMs) / 1000) : null,
+    };
+}
+function clampPercent(n) {
+    if (n < 0)
+        return 0;
+    if (n > 100)
+        return 100;
+    return n;
+}
+function parseThreadId(rolloutPath) {
+    const m = UUID_RE.exec(rolloutPath);
+    return m ? m[1] : null;
+}
+async function readTail(filePath, maxBytes) {
+    const handle = await fs.open(filePath, 'r');
+    try {
+        const { size } = await handle.stat();
+        const start = size > maxBytes ? size - maxBytes : 0;
+        const length = size - start;
+        if (length <= 0)
+            return '';
+        const buf = Buffer.alloc(length);
+        await handle.read(buf, 0, length, start);
+        let text = buf.toString('utf8');
+        if (start > 0) {
+            // The first line is likely partial — drop up to the first newline.
+            const nl = text.indexOf('\n');
+            text = nl >= 0 ? text.slice(nl + 1) : '';
+        }
+        return text;
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=codexRateLimitReader.js.map

package/dist/providers/adapters/openai-codex/observability/codexRateLimitReader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codexRateLimitReader.js","sourceRoot":"","sources":["../../../../../src/providers/adapters/openai-codex/observability/codexRateLimitReader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAsDpD,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AACtC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,OAAO,GAAG,yEAAyE,CAAC;AAE1F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA8B,EAAE;IAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,IAAI,oBAAoB,CAAC;IAEpE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACpE,KAAK,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC7C,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,WAAmB,EACnB,KAAa;IAEb,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,UAAU,GAAmC,IAAI,CAAC;IACtD,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS;QACvC,+CAA+C;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;YAAE,SAAS;QACpC,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAA8C,CAAC;QACnE,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YAC1D,UAAU,GAAG,OAAO,CAAC,WAAsC,CAAC;YAC5D,UAAU,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9E,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrE,wDAAwD;YACxD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;gBAAE,KAAK,GAAG,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,WAAW;QACX,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC;QACpC,UAAU;QACV,KAAK;QACL,QAAQ,EAAE,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QAChF,oBAAoB,EAClB,OAAO,UAAU,CAAC,uBAAuB,KAAK,QAAQ;YACpD,CAAC,CAAC,UAAU,CAAC,uBAAuB;YACpC,CAAC,CAAC,IAAI;QACV,OAAO,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC;QAC/C,SAAS,EAAE,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,KAAa;IAC9C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,WAAW,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAC7D,OAAO;QACL,WAAW;QACX,gBAAgB,EAAE,YAAY,CAAC,GAAG,GAAG,WAAW,CAAC;QACjD,aAAa;QACb,QAAQ;QACR,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;QACxE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KAClF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC;IACxB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,QAAgB;IACxD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;QAC5B,IAAI,MAAM,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,mEAAmE;YACnE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/providers/adapters/openai-codex/observability/sessionPaths.d.ts

@@ -15,6 +15,16 @@
 export declare function codexHomeFromConfig(codexHome?: string): string;
 /** Find a rollout JSONL file by Codex thread UUID. Returns null on miss. */
 export declare function findRolloutFile(threadId: string, codexHome?: string): Promise<string | null>;
+/**
+ * Synchronous variant of {@link findRolloutFile}. Needed by callers that run on
+ * a sync code path and cannot await — notably the resume-map `jsonlExists`
+ * guards (ThreadResumeMap, TopicResumeMap), which previously checked only the
+ * Claude flat layout and so returned false for EVERY codex session (the
+ * codex-compat resume bug: every codex thread looked expired/missing). Returns
+ * the rollout path or null. A missing `$CODEX_HOME/sessions` (e.g. a pure
+ * Claude agent) returns null fast — `readdirSync` throws and is caught.
+ */
+export declare function findRolloutFileSync(threadId: string, codexHome?: string): string | null;
 /** List all rollout files under $CODEX_HOME/sessions, newest first. */
 export declare function listAllRollouts(codexHome?: string, limit?: number): Promise<ReadonlyArray<{
     path: string;

package/dist/providers/adapters/openai-codex/observability/sessionPaths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionPaths.d.ts","sourceRoot":"","sources":["../../../../../src/providers/adapters/openai-codex/observability/sessionPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AA2BD,uEAAuE;AACvE,wBAAsB,eAAe,CACnC,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,SAAM,GACV,OAAO,CAAC,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAMzD"}
+{"version":3,"file":"sessionPaths.d.ts","sourceRoot":"","sources":["../../../../../src/providers/adapters/openai-codex/observability/sessionPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIvF;AAoDD,uEAAuE;AACvE,wBAAsB,eAAe,CACnC,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,SAAM,GACV,OAAO,CAAC,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAMzD"}