openmausbot 0.1.98 → 0.1.99

package/dist-server/server/activity.js

@@ -103,6 +103,8 @@ const OUTCOME_OF_DECISION = {
     "user-approved": "allowed",
     "review-would-approve": "allowed",
     "user-denied": "denied",
+    // A person reverted a change that had applied on its own.
+    "user-undone": "denied",
     "review-would-deny": "denied",
     "card-shown": "waiting",
 };

package/dist-server/server/checkpoints.js

@@ -246,33 +246,25 @@ function gitFailure(command, err, stderr, signal) {
 }
 /** Run one git command against the shadow repo. cwd is the WORK TREE — the
  * "." pathspec in add resolves relative to it. Every call carries the
- * GIT_TIMEOUT_MS hard timeout. */
-function runGit(args, cwd, env, signal) {
+ * GIT_TIMEOUT_MS hard timeout. `input` is written to git's stdin.
+ * Each call is a process start, which costs tens of milliseconds on Windows,
+ * and the turn waits for its snapshot — so a snapshot keeps its calls few
+ * (see commitAll). */
+function runGit(args, cwd, env, signal, input) {
     return new Promise((resolvePromise, rejectPromise) => {
         signal?.throwIfAborted();
-        execFile("git", args, { cwd, env, signal, windowsHide: true, encoding: "utf8", timeout: GIT_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+        const child = execFile("git", args, { cwd, env, signal, windowsHide: true, encoding: "utf8", timeout: GIT_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
             if (err)
                 rejectPromise(gitFailure(args[0], err, stderr, signal));
             else
                 resolvePromise(stdout);
         });
-    });
-}
-/** `git diff --cached --quiet`: is there anything staged beyond HEAD? Used
- * instead of `status --porcelain` emptiness on purpose — a nested repo with
- * a dirty work tree shows up in status forever while staging nothing, which
- * would either commit empty churn every turn or fail the commit outright. */
-function hasStagedChanges(cwd, env, signal) {
-    return new Promise((resolvePromise, rejectPromise) => {
-        signal?.throwIfAborted();
-        execFile("git", ["diff", "--cached", "--quiet", "--ignore-submodules=dirty"], { cwd, env, signal, windowsHide: true, encoding: "utf8", timeout: GIT_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 }, (err, _stdout, stderr) => {
-            if (err === null)
-                resolvePromise(false);
-            else if (err.code === 1)
-                resolvePromise(true);
-            else
-                rejectPromise(gitFailure("diff", err, stderr, signal));
-        });
+        if (input !== undefined) {
+            // A git that exits before reading reports through its exit status; a
+            // broken pipe here must not become an unhandled stream error.
+            child.stdin?.on("error", () => { });
+            child.stdin?.end(input);
+        }
     });
 }
 // One operation at a time per shadow repo: snapshots, diffs and pin releases
@@ -312,6 +304,20 @@ async function sweepLiveRefs(cwd, env, shadow, signal) {
         droppedPins.add(shadow);
     sweptShadows.add(shadow);
 }
+/** One git call, however long the history: HEAD and at most its parent. */
+async function readHead(cwd, env, signal) {
+    const out = await runGit(["log", "-2", "--format=%H %T %P", "HEAD"], cwd, env, signal);
+    const [head, parent] = out.split("\n").filter(Boolean).map((line) => line.trim().split(" "));
+    const [hash, tree, ...parents] = head ?? [];
+    if (!hash || !tree)
+        throw new Error(`git log: unexpected output ${JSON.stringify(out.slice(0, 200))}`);
+    let base = null;
+    if (parents.length === 0)
+        base = hash;
+    else if (parents.length === 1 && parent?.length === 2)
+        base = parents[0];
+    return { hash, tree, base };
+}
 /** Create the shadow repo on first use; self-heal its config files on every
  * use (they are tiny, and rewriting them lets exclude-list updates reach
  * shadows that already exist). The base commit is an EMPTY marker so HEAD
@@ -349,14 +355,17 @@ async function ensureShadow(cwd, env, shadow, signal) {
         }
     }
     writeFileSync(join(shadow, ".git", "info", "exclude"), EXCLUDES + [...cachePatterns].join("\n") + "\n");
+    let head;
     try {
-        await runGit(["rev-parse", "--verify", "HEAD"], cwd, env, signal);
+        head = await readHead(cwd, env, signal);
     }
     catch {
         // brand-new repo (or a crash between init and first commit)
         await runGit(["commit", "--no-verify", "--allow-empty", "-m", "checkpoint base"], cwd, env, signal);
+        head = await readHead(cwd, env, signal);
     }
     await sweepLiveRefs(cwd, env, shadow, signal);
+    return head;
 }
 /** Folder listings in flight at once (libuv's pool has four threads). */
 const LISTING_CONCURRENCY = 4;
@@ -469,9 +478,11 @@ async function stageWorkTree(cwd, env, signal) {
 }
 /** Capture fully before advancing HEAD: null when the add was partial, so a
  * partial capture never replaces the last usable checkpoint or authorizes
- * removal of its objects. */
-async function commitAll(cwd, env, label, signal) {
-    const previous = (await runGit(["rev-parse", "HEAD"], cwd, env, signal)).trim();
+ * removal of its objects. With `pin`, the turn's pin lands on the returned
+ * commit in the same ref transaction that moves HEAD.
+ * A changed folder costs the shadow `write-tree`, `commit-tree` and one
+ * `update-ref` past staging; an unchanged one, `write-tree` alone. */
+async function commitAll(cwd, env, head, label, pin, signal) {
     try {
         await stageWorkTree(cwd, env, signal);
     }
@@ -481,18 +492,25 @@ async function commitAll(cwd, env, label, signal) {
             throw e;
         return null;
     }
-    const changed = await hasStagedChanges(cwd, env, signal);
-    const base = (await runGit(["rev-list", "--max-parents=0", "HEAD"], cwd, env, signal)).trim();
-    const count = (await runGit(["rev-list", "--count", "HEAD"], cwd, env, signal)).trim();
-    if (!changed && Number(count) <= 2)
-        return { hash: previous, advanced: false, compacted: false };
+    // Is anything staged beyond HEAD? The staged tree is HEAD's tree exactly
+    // when nothing is. Only what is staged counts, never work-tree status: a
+    // nested repo with a dirty work tree stages nothing (its gitlink is
+    // unchanged), so it neither commits empty churn every turn nor fails.
     const tree = (await runGit(["write-tree"], cwd, env, signal)).trim();
-    const message = changed ? label : (await runGit(["show", "-s", "--format=%B", "HEAD"], cwd, env, signal)).trim();
-    // Parent only the empty marker, never the previous snapshot: keeping the
-    // previous commit as an ancestor would retain every old tree indefinitely.
-    const hash = (await runGit(["commit-tree", tree, "-p", base, "-m", message], cwd, env, signal)).trim();
-    await runGit(["update-ref", "HEAD", hash, previous], cwd, env, signal);
-    return { hash, advanced: true, compacted: Number(count) > 2 };
+    const changed = tree !== head.tree;
+    let hash = head.hash;
+    if (changed || head.base === null) {
+        const base = head.base ?? (await runGit(["rev-list", "--max-parents=0", "HEAD"], cwd, env, signal)).trim();
+        const message = changed ? label : (await runGit(["show", "-s", "--format=%B", "HEAD"], cwd, env, signal)).trim();
+        // Parent only the empty marker, never the previous snapshot: keeping the
+        // previous commit as an ancestor would retain every old tree indefinitely.
+        hash = (await runGit(["commit-tree", tree, "-p", base, "-m", message], cwd, env, signal)).trim();
+    }
+    const advanced = hash !== head.hash;
+    const updates = [advanced ? `update HEAD ${hash} ${head.hash}\n` : "", pin ? `update ${liveRef(pin)} ${hash}\n` : ""].join("");
+    if (updates !== "")
+        await runGit(["update-ref", "--stdin"], cwd, env, signal, updates);
+    return { hash, advanced, compacted: advanced && head.base === null };
 }
 /** HEAD-advancing snapshots per shadow since this process last collected. */
 const commitsSinceGc = new Map();
@@ -582,12 +600,10 @@ export async function snapshot(botId, cwd, label, signal, opts) {
         releaseCollection(shadow);
         return await serialize(shadow, async () => {
             const env = gitEnv(shadow, worktree);
-            await ensureShadow(worktree, env, shadow, signal);
-            const result = await commitAll(worktree, env, label, signal);
+            const head = await ensureShadow(worktree, env, shadow, signal);
+            const result = await commitAll(worktree, env, head, label, opts?.pin, signal);
             if (!result)
                 return null;
-            if (opts?.pin)
-                await runGit(["update-ref", liveRef(opts.pin), result.hash], worktree, env, signal);
             // Never awaited by the turn waiting on this snapshot, and held for that
             // turn's settled diff: diffWorkingTree queues it behind itself, so GC
             // never eats into the digest's capture window.

package/dist-server/server/direct-apply.js

@@ -0,0 +1,20 @@
+// Which of a bot's proposed changes apply without a person. One rule for
+// routines, skills, profile and default model, on the desktop, a server and
+// a Cloud home alike:
+// - Full access applies everything it always has, with no new limits;
+// - at any other level a bot's change to ITSELF applies directly (its own
+//   routines, skills, profile, model), and the person sees a one-line
+//   receipt with Undo. A change for another bot keeps its card.
+// The one exception is a Cloud home's guest-driven turn, which keeps today's
+// card for everything (`blocked`). Team setup and peer approvals are not
+// changes to the bot itself and stay Full access only.
+/** What Undo says, applying nothing, once the thing changed since. */
+export const UNDO_STALE = "Changed since, so it can't be undone here.";
+/** A bot applying its own routines directly keeps at most this many
+ * enabled; past it, a create or resume shows today's card instead. */
+export const SELF_ROUTINE_CAP = 20;
+export function directApply(args) {
+    if (args.fullAccess)
+        return "full-access";
+    return args.targetBotId === args.botId && !args.blocked ? "self" : null;
+}

package/dist-server/server/drivers/agents-call.js

@@ -1243,7 +1243,7 @@ export async function callTool(name, args, context) {
                 return `- ${row.action} ${row.name}`;
             }).join("\n")
             : "(none)";
-        return { text: `Imported skills:\n${live}\n\nStaged (waiting for the user to confirm):\n${pending}` };
+        return { text: `Imported skills:\n${live}\n\nStaged (waiting for the user's decision):\n${pending}` };
     }
     if (name === "skill_manage") {
         if (args.action !== "create" && args.action !== "update") {

package/dist-server/server/drivers/agents-catalog.js

@@ -86,7 +86,7 @@ const ROUTINE_SCHEDULE_SCHEMA = {
         },
         starts_at: {
             type: "string",
-            description: "Optional for type interval: RFC3339 date-time with an explicit timezone offset that anchors the cadence. Omit to start one interval after the routine is applied (immediately with granted Full Access, otherwise after confirmation).",
+            description: "Optional for type interval: RFC3339 date-time with an explicit timezone offset that anchors the cadence. Omit to start one interval after the routine is applied.",
         },
         window_start: {
             type: "string",
@@ -159,6 +159,9 @@ const ROUTINE_FIELDS_SCHEMA = {
 // Chief is not shown (catalogTools), along with the parameter itself.
 const CHIEF_PROFILE_TARGET = " A Chief of Staff may pass for_bot_id (from list_bots) for a requested change to another bot in its section.";
 const PROPOSAL_OUTCOME = " Read the result: granted Full Access may apply the change immediately. If applied, continue the requested work without another confirmation. Only a pending result requires ending the turn and waiting for the in-app decision. Never claim success from the permission mode alone; report failed or cancelled results honestly. This does not elevate another bot's execution permissions.";
+/** Routines, skills, profile and model: a bot's change to itself applies at
+ * any level (server/direct-apply.ts). */
+const SELF_CHANGE_OUTCOME = " Read the result: a change to your own routines, skills, profile or model applies immediately, and the person sees it with an Undo; a change for another bot may wait for the person's confirmation. If applied, continue the requested work without another confirmation. Only a pending result requires ending the turn and waiting for the in-app decision. Never claim success without an applied result; report failed or cancelled results honestly. This does not elevate another bot's execution permissions.";
 /** Every tool, in the order it is listed. Four peer tools are worded
  * differently for an external runtime, which may poll inside one process. */
 const toolDefinitions = (externalRuntime) => [
@@ -613,7 +616,7 @@ const toolDefinitions = (externalRuntime) => [
     },
     {
         name: "propose_routine",
-        description: "Prepare a new routine after the user explicitly asks to schedule recurring or future work. Call list_routines first for relative dates or times so you use its authoritative current time and timezone. Convert calendar requests (monthly dates, last days, nth weekdays) into a validated five-field cron schedule with an explicit IANA timeZone; keep elapsed every-N-minutes work as interval. Never approximate unsupported requests with a different weekly schedule or an AI date-check routine; explain the limitation instead. Resolve ambiguous dates, times, timezone, destination, or instructions with the user first, and always give one-time schedules an explicit RFC3339 offset. If the user asks for the routine to run as ANOTHER bot in your section, call list_bots and pass that bot's id as for_bot_id; each run retains that bot's own permissions." + PROPOSAL_OUTCOME,
+        description: "Prepare a new routine after the user explicitly asks to schedule recurring or future work. Call list_routines first for relative dates or times so you use its authoritative current time and timezone. Convert calendar requests (monthly dates, last days, nth weekdays) into a validated five-field cron schedule with an explicit IANA timeZone; keep elapsed every-N-minutes work as interval. Never approximate unsupported requests with a different weekly schedule or an AI date-check routine; explain the limitation instead. Resolve ambiguous dates, times, timezone, destination, or instructions with the user first, and always give one-time schedules an explicit RFC3339 offset. If the user asks for the routine to run as ANOTHER bot in your section, call list_bots and pass that bot's id as for_bot_id; each run retains that bot's own permissions." + SELF_CHANGE_OUTCOME,
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -629,7 +632,7 @@ const toolDefinitions = (externalRuntime) => [
     },
     {
         name: "propose_routine_action",
-        description: "Prepare a user-requested change to one of this bot's existing routines. Use list_routines first to get the routine id. If the user asks to change ANOTHER bot's routine and that bot is in your section, call list_bots and pass that bot's id as for_bot_id; the routine keeps its owner and every run keeps that bot's engine and permissions." + PROPOSAL_OUTCOME,
+        description: "Prepare a user-requested change to one of this bot's existing routines. Use list_routines first to get the routine id. If the user asks to change ANOTHER bot's routine and that bot is in your section, call list_bots and pass that bot's id as for_bot_id; the routine keeps its owner and every run keeps that bot's engine and permissions." + SELF_CHANGE_OUTCOME,
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -656,7 +659,7 @@ const toolDefinitions = (externalRuntime) => [
     },
     {
         name: "propose_profile",
-        description: "Submit user-requested changes to your own name, title, description, standing instructions (SOUL.md), working folder (cwd), or your alert and voice toggles (notifications, speakReplies). Keep SOUL.md short — who you are and the rules you never break; put step-by-step procedure into a skill instead." + CHIEF_PROFILE_TARGET + PROPOSAL_OUTCOME,
+        description: "Submit user-requested changes to your own name, title, description, standing instructions (SOUL.md), working folder (cwd), or your alert and voice toggles (notifications, speakReplies). Keep SOUL.md short — who you are and the rules you never break; put step-by-step procedure into a skill instead." + CHIEF_PROFILE_TARGET + SELF_CHANGE_OUTCOME,
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -668,7 +671,7 @@ const toolDefinitions = (externalRuntime) => [
                 cwd: {
                     type: "string",
                     maxLength: 1024,
-                    description: "Absolute path of the folder your tools read and write in (for example /Users/me/Projects/site). It must already exist. An empty string means your private workspace.",
+                    description: "Absolute path of the folder your tools read and write in (for example /Users/me/Projects/site). It must already exist. An empty string means your private workspace. A new folder waits for the person's confirmation unless this conversation has Full access.",
                 },
                 notifications: {
                     type: "boolean",
@@ -689,7 +692,7 @@ const toolDefinitions = (externalRuntime) => [
     },
     {
         name: "propose_model",
-        description: "Submit a user-requested switch of this bot's default engine and model. Use the exact instance and model ids the person named, or for a Chief the ids from the team-setup catalog. The card warns about capabilities the switch gains or loses; existing threads keep their current models." + PROPOSAL_OUTCOME,
+        description: "Submit a user-requested switch of this bot's default engine and model. Use the exact instance and model ids the person named, or for a Chief the ids from the team-setup catalog. The result warns about capabilities the switch gains or loses; existing threads keep their current models." + SELF_CHANGE_OUTCOME,
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -732,12 +735,12 @@ const toolDefinitions = (externalRuntime) => [
     },
     {
         name: "skills_list",
-        description: "List this bot's imported skills (enabled and disabled) and any staged skill writes waiting for the user to confirm. Use this before skill_manage to avoid duplicate names. Listing does not enable anything.",
+        description: "List this bot's imported skills (enabled and disabled) and any staged skill writes still waiting for the user's decision. Use this before skill_manage to avoid duplicate names. Listing does not enable anything.",
         inputSchema: { type: "object", additionalProperties: false, properties: {} },
     },
     {
         name: "skill_manage",
-        description: "Submit a new or updated reusable SKILL.md. Never update unless the user explicitly asked to revise that named skill. While review is pending, a create stays inactive and an update leaves the current version unchanged." + PROPOSAL_OUTCOME,
+        description: "Submit a new or updated reusable SKILL.md. Never update unless the user explicitly asked to revise that named skill. If the result is pending, a create stays inactive and an update leaves the current version unchanged." + SELF_CHANGE_OUTCOME,
         inputSchema: {
             type: "object",
             additionalProperties: false,

package/dist-server/server/drivers/codex.js

@@ -10,7 +10,7 @@ import { codexToolSurfaceArgs } from "./codex-tool-surface.js";
 //
 // resumeCursor is the codex thread id; a later turn tries thread/resume
 // and preserves that history or reports a failed resume.
-import { existsSync, mkdirSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -23,7 +23,7 @@ import { ChatGptPlanAuthController } from "./chatgpt-plan-auth.js";
 import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.js";
 import { isHarnessOwnedMcpEnvName } from "../mcp-registry.js";
 import { newEventId, newId } from "../contracts.js";
-import { decodeCodexSelection, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
+import { decodeCodexSelection, OFFICIAL_CODEX_PROVIDER, readCodexModelCatalog, STATIC_CODEX_MODELS } from "./codex-catalog.js";
 import { codexLocalProviderArgs } from "./local-inject.js";
 import { augmentedPath, splitCliString } from "../env-path.js";
 import { classifyError, computeBackoff, interruptibleDelay, RETRY_MAX_ATTEMPTS } from "./retry.js";
@@ -33,7 +33,8 @@ import { commandSummary, toolDetailPreview } from "../tool-summary.js";
 import { codexDeveloperInstructions, syncCodexInstructions } from "./codex-instructions.js";
 import { volatileContextNote, withContextNote } from "./prompt-split.js";
 import { CodexDeviceAuthController } from "./codex-device-auth.js";
-import { codexAccountEmail } from "./codex-identity.js";
+import { codexAccountEmail, codexHome } from "./codex-identity.js";
+import { keyRejected, noteKeyAccepted, noteKeyRejected } from "../key-rejections.js";
 import { classifyResumeFailure, mayReplay, recoveryPromptFor } from "../resume-recovery.js";
 import { extractMcpImages } from "../mcp-tool-images.js";
 import { parseProtocolAskQuestions, questionAnswersById, questionChoices } from "../../shared/ask-question.js";
@@ -54,6 +55,30 @@ export function codexUserError(value, chatgptPlan) {
     }
     return value.slice(0, 400);
 }
+// Codex's own words when OpenAI refuses its stored ChatGPT login (codex-cli
+// 0.160 login/src/auth: workspace routing, token refresh, auth storage).
+const CODEX_SIGN_IN_REFUSED = /workspace routing discovery unauthorized|access token could not be refreshed|authentication session could not be refreshed|ChatGPT login is required|auth data is not available|please (?:log out and )?sign in again/i;
+/** A turn error (TurnError: message, codexErrorInfo) that says Codex's own
+ * sign-in was refused: `unauthorized`, a 401 from the model backend, or one
+ * of Codex's sign-in messages. A 401 from an MCP server or a tool reaches the
+ * model as a tool result, never as a turn error, so it cannot land here. */
+export function codexSignInRefused(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const { message, codexErrorInfo: info } = error;
+    if (info === "unauthorized")
+        return true;
+    if (info && typeof info === "object" &&
+        Object.values(info).some((variant) => variant?.httpStatusCode === 401))
+        return true;
+    return typeof message === "string" && CODEX_SIGN_IN_REFUSED.test(message);
+}
+export const CODEX_SIGN_IN_EXPIRED = "Codex's ChatGPT sign-in has expired. Sign in again in Settings → Model providers → Codex.";
+/** The plain sentence first, so a peer bot's one-line report keeps it;
+ * Codex's own words follow as the detail. */
+export function codexSignInExpired(raw) {
+    return `${CODEX_SIGN_IN_EXPIRED} Codex said: ${raw.slice(0, 300)}`;
+}
 class CodexRpcError extends Error {
     code;
     constructor(error) {
@@ -605,10 +630,47 @@ export const CodexDriver = {
         }
         else
             await refreshModels();
+        // Codex's own ChatGPT login (not ChatGPT plan, whose tokens OpenMausBot
+        // holds, nor Company routing) can be refused by OpenAI while `codex login
+        // status` still reports it. A refusal marks it the way a rejected API key
+        // is marked (key-rejections.ts): its credential home, plus the stored
+        // auth file, so a sign-in made anywhere else starts over. A later turn
+        // that succeeds, a new sign-in and sign-out clear it. Only a stored
+        // ChatGPT login is marked: an API-key login (`codex login --with-api-key`)
+        // cannot be fixed by the ChatGPT sign-in Settings offers.
+        const ownLogin = !plan && !config.managed;
+        const loginMark = () => {
+            const home = ownLogin ? codexHome(childEnv()) : null;
+            if (!home)
+                return null;
+            let stored = "";
+            try {
+                stored = readFileSync(join(home, "auth.json"), "utf8");
+            }
+            catch {
+                return null; /* keyring, or none */
+            }
+            try {
+                const auth = JSON.parse(stored);
+                const chatgpt = typeof auth.auth_mode === "string" ? /chatgpt/i.test(auth.auth_mode) : Boolean(auth.tokens);
+                if (!chatgpt)
+                    return null;
+            }
+            catch {
+                return null;
+            }
+            return [`codex-login:${home}`, stored];
+        };
+        const loginRefused = () => { const mark = loginMark(); if (mark)
+            noteKeyRejected(...mark); };
+        const loginAccepted = (mark = loginMark()) => { if (mark)
+            noteKeyAccepted(...mark); };
+        const loginRejected = () => { const mark = loginMark(); return mark !== null && keyRejected(...mark); };
         const authentication = new CodexDeviceAuthController({
             cli: config.cli,
             environment: childEnv,
-            onAuthenticated: refreshModels,
+            signInRejected: loginRejected,
+            onAuthenticated: async () => { loginAccepted(); await refreshModels(); },
         });
         const listeners = new Set();
         const active = new Map();
@@ -690,6 +752,12 @@ export const CodexDriver = {
             // a retry relaunches the whole app-server; the backoff is scaled down in
             // tests so a fake's transient failures don't stall real seconds
             const retryScale = Number(process.env.FAKE_CODEX_RETRY_SCALE ?? "1");
+            // Only a turn on the official provider says anything about Codex's
+            // ChatGPT login: a custom provider's 401 is its own key's, and its
+            // success proves nothing about ChatGPT. No model means the catalog's
+            // default, which is provider-qualified when config.toml picks another.
+            const chatgptTurn = ownLogin &&
+                decodeCodexSelection(turn.model || models.default).modelProvider === OFFICIAL_CODEX_PROVIDER;
             const launchAttempt = async (attempt) => {
                 const env = childEnv();
                 if (planToken)
@@ -784,6 +852,13 @@ export const CodexDriver = {
                 const state = {
                     settled: false,
                     lastError: "",
+                    // whether lastError went out marked setup (a sign-in to fix)
+                    lastErrorSetup: false,
+                    // an error Codex said it would retry itself (willRetry), kept only
+                    // to explain a turn that then fails without words of its own
+                    retryError: "",
+                    // Codex started recovering its model provider's sign-in this turn
+                    authRecovery: false,
                     lastText: "",
                     sawStreamDelta: false,
                     // codex reports token usage as a running total for this app-server
@@ -1122,6 +1197,25 @@ export const CodexDriver = {
                         message: `Codex automatic review ${outcome}${target}. Action did not run. Retry stays ${retryMode}. Select Ask for human approval in approval settings.`,
                     });
                 };
+                // The turn's failure, said once. An error notification and the
+                // turn/completed after it usually carry the same words; the second
+                // only speaks again to deliver a sign-in flag the first lacked.
+                // Codex's own refused sign-in reads as one plain sentence and marks
+                // the login, so Settings asks for a new sign-in too.
+                const turnError = (error) => {
+                    const raw = String(error.message);
+                    const refused = chatgptTurn && loginMark() !== null && (codexSignInRefused(error) ||
+                        (state.authRecovery && !/\b403\b|forbidden/i.test(raw) && /\b401\b|unauthorized/i.test(raw)));
+                    if (refused)
+                        loginRefused();
+                    const message = refused ? codexSignInExpired(raw) : codexUserError(raw, plan);
+                    const setup = refused || classifyError({ text: message }).reason === "auth";
+                    if (message === state.lastError && (state.lastErrorSetup || !setup))
+                        return;
+                    state.lastError = message;
+                    state.lastErrorSetup ||= setup;
+                    emit({ ...base(threadId, turnId), type: "runtime.error", message, ...(setup ? { setup: true } : {}) });
+                };
                 const handleNotification = (msg) => {
                     const p = msg.params ?? {};
                     // An app-server also emits notifications for native helper threads.
@@ -1322,27 +1416,43 @@ export const CodexDriver = {
                             if (reviewWarning && !timedOutReview)
                                 reviewNotice("warning");
                             const t = p.turn ?? {};
-                            const message = typeof t.error?.message === "string" ? codexUserError(t.error.message, plan) : "";
-                            if (t.status !== "completed" && message && message !== state.lastError) {
-                                state.lastError = message;
-                                emit({ ...base(threadId, turnId), type: "runtime.error", message,
-                                    ...(classifyError({ text: message }).reason === "auth" ? { setup: true } : {}),
-                                });
+                            if (t.status === "completed") {
+                                if (chatgptTurn)
+                                    loginAccepted();
+                            }
+                            else if (typeof t.error?.message === "string") {
+                                turnError(t.error);
+                            }
+                            else if (t.status === "failed" && !state.lastError && state.retryError) {
+                                // Codex gave up retrying without a final word: its last one
+                                turnError({ message: state.retryError });
                             }
                             void settle(t.status === "completed", t.status === "completed" ? null :
-                                (classifyError({ text: message || state.lastError }).reason === "provider_safety" ? "provider_safety" : (message || t.status || "failed")));
+                                (classifyError({ text: state.lastError }).reason === "provider_safety" ? "provider_safety" : (state.lastError || t.status || "failed")));
                             break;
                         }
-                        case "error":
-                            // shape drift: 0.144 sends {message}, 0.139 nests it under
-                            // {error:{message}} — surface either (agentcal armor)
-                            {
-                                const message = p.message ?? p.error?.message;
-                                if (message) {
-                                    state.lastError = codexUserError(String(message), plan);
-                                    emit({ ...base(threadId, turnId), type: "runtime.error", message: state.lastError });
-                                }
+                        case "error": {
+                            // shape drift: 0.144 sends {message}, 0.139 and 0.160 nest it
+                            // under {error:{message, codexErrorInfo}} — surface either
+                            // (agentcal armor)
+                            const error = p.error && typeof p.error === "object" ? p.error : { message: p.message };
+                            if (!error.message)
+                                break;
+                            // 0.160 reports each of its own reconnects ("Reconnecting...
+                            // 1/5") with willRetry: true. Those are not the turn's failure;
+                            // the final error, or turn/completed, says how it ended.
+                            if (p.willRetry === true) {
+                                state.retryError = String(error.message);
+                                break;
                             }
+                            turnError(error);
+                            break;
+                        }
+                        case "modelProvider/authRecoveryStarted":
+                            state.authRecovery = true;
+                            break;
+                        case "modelProvider/authRecoveryCompleted":
+                            state.authRecovery = false;
                             break;
                     }
                 };
@@ -1732,8 +1842,10 @@ export const CodexDriver = {
                 }
                 catch (e) {
                     const failure = e instanceof Error ? e : { text: String(e) };
-                    const message = codexUserError(e instanceof Error ? e.message : String(e), plan);
-                    const needsAuth = /(?:\b401\b|unauthorized|missing bearer|authentication required)/i.test(message);
+                    const raw = e instanceof Error ? e.message : String(e);
+                    const refused = chatgptTurn && loginMark() !== null && codexSignInRefused({ message: raw });
+                    const message = refused ? codexSignInExpired(raw) : codexUserError(raw, plan);
+                    const needsAuth = refused || /(?:\b401\b|unauthorized|missing bearer|authentication required)/i.test(message);
                     const verdict = classifyError(failure);
                     // Three guards hold here: main's abandoned attempt never retries,
                     // neither does a Company session already recovered once from canonical
@@ -1767,6 +1879,8 @@ export const CodexDriver = {
                     // abandoned marks an attempt retired by a retry; its late rpc
                     // timeouts must neither report a spurious error nor relaunch again
                     if (!state.settled && !abandoned) {
+                        if (refused)
+                            loginRefused();
                         emit({
                             ...base(threadId, turnId),
                             type: "runtime.error",
@@ -1797,6 +1911,11 @@ export const CodexDriver = {
             const authenticated = await new Promise((resolve) => {
                 execCli(config.cli, ["login", "status"], { timeout: 8000, env }, (err, stdout, stderr) => resolve(!err && /^logged in\b/im.test(`${stdout}\n${stderr ?? ""}`)));
             });
+            // Signed in as far as the CLI knows, but OpenAI refused it on a real turn.
+            if (authenticated && loginRejected()) {
+                return { state: "available", version, authenticated: false, reason: CODEX_SIGN_IN_EXPIRED,
+                    update: await codexReleaseUpdate(version, config.cli), billing: "subscription" };
+            }
             // Display identity only, so Settings can say whose ChatGPT account the
             // bots run on; the status command above stays the authority on sign-in.
             const email = authenticated ? await codexAccountEmail(config.cli, env) : null;
@@ -1837,8 +1956,12 @@ export const CodexDriver = {
             },
             cancelAuthentication: () => (planAuth ?? authentication).cancel(),
             signOut: async () => {
-                if (!planAuth)
-                    return authentication.signOut();
+                if (!planAuth) {
+                    const mark = loginMark();
+                    await authentication.signOut();
+                    loginAccepted(mark);
+                    return;
+                }
                 planSigningOut = true;
                 planGeneration++;
                 try {

package/dist-server/server/drivers/device-auth.js

@@ -85,19 +85,20 @@ export class DeviceAuthController {
                 flow.startupTimer.unref();
                 this.confirm(flow, env, home, (signedIn) => this.finish(flow, signedIn ? "succeeded" : "failed", `${product} finished sign-in but did not confirm a ${account} account. Refresh Settings and try again.`));
             }, true);
-            // Never overwrite a working login just because Connect was clicked twice.
+            // Never overwrite a working login just because Connect was clicked
+            // twice. One the provider refused is not working, whatever status says.
             if (!status) {
                 login();
                 return;
             }
             this.run(flow, [...status.args], env, home, (code, output) => {
                 const state = status.read(code, output);
-                if (state === "signed-in")
+                if (state === "signed-in" && !this.options.signInRejected?.())
                     this.finish(flow, "succeeded");
+                else if (state === "signed-in" || state === "signed-out")
+                    login();
                 else if (state === "other")
                     this.finish(flow, "failed", `${product} already has a different sign-in method on this server. Ask the server administrator to review it before changing accounts.`);
-                else if (state === "signed-out")
-                    login();
                 else
                     this.finish(flow, "failed", `${product} could not confirm the existing sign-in on this server. Update ${product} and check its login status before trying again.`);
             });

package/dist-server/server/drivers/openai-chat.js

@@ -755,10 +755,11 @@ export function createOpenAIChatRuntime(options) {
                 if (failure && (!abort.signal.aborted || cleanupFailed)) {
                     emit({ ...base(turn.threadId, turnId), type: "runtime.error", message: failure, terminal: !abort.signal.aborted });
                 }
-                // Automatic continuity: a resumable terminal (budget cap or tool
-                // errors) persists a handoff and raises cap.exhausted so the harness
-                // can start a `Continue:` thread. Interruptions and provider config
-                // errors are excluded by classifyContinuable.
+                // Automatic continuity: a resumable terminal (the step or tool-call
+                // cap) persists a handoff and raises cap.exhausted so the harness
+                // can start a `Continue:` thread. Interruptions, tool errors and
+                // provider errors (a rate limit included) are excluded by
+                // classifyContinuable.
                 if (!ok && !abort.signal.aborted) {
                     const continuable = classifyContinuable(stopReason, failure);
                     if (continuable) {