sintbot 1.3.0 → 1.4.1

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "sintbot",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "private": false,
-  "description": "A built-in agent core for one Feishu group on macOS, powered by Codex.",
+  "description": "Drive your Mac projects from Feishu groups with Codex or Claude Code, using a built-in agent core.",
   "bin": {
     "sbot": "bin/sintbot-v2.js",
     "sintbot": "bin/sintbot-v2.js"
@@ -21,6 +21,22 @@
     "README.md",
     "README.zh-CN.md",
     "THIRD-PARTY-NOTICES.md",
+    "assets/design-styles/acid-pop.md",
+    "assets/design-styles/archive-index.md",
+    "assets/design-styles/art-deco.md",
+    "assets/design-styles/cinematic-noir.md",
+    "assets/design-styles/editorial.md",
+    "assets/design-styles/geometric-pop.md",
+    "assets/design-styles/hand-drawn.md",
+    "assets/design-styles/islamic-geometry.md",
+    "assets/design-styles/liquid-glass.md",
+    "assets/design-styles/neo-chinese.md",
+    "assets/design-styles/precision-mono.md",
+    "assets/design-styles/quiet-luxury.md",
+    "assets/design-styles/riso-print.md",
+    "assets/design-styles/soft-friendly.md",
+    "assets/design-styles/swiss-grid.md",
+    "assets/design-styles/tech-dark.md",
     "bin/sintbot-v2.js",
     "docs/AI-ASSISTED-INSTALL.md",
     "docs/install.md",
@@ -28,15 +44,26 @@
     "docs/zh-CN/install.md",
     "install.sh",
     "src/agent/claudecode.js",
+    "src/agent/claudemodels.js",
+    "src/agent/claudestatus.js",
+    "src/agent/claudeusage.js",
     "src/agent/codexapp.js",
     "src/agent/codexcode.js",
+    "src/agent/codexstatus.js",
     "src/agent/errtag.js",
     "src/agent/privatecore.js",
     "src/agent/privatecore.wasm",
     "src/agent/runner.js",
     "src/agent/visionproxy.js",
     "src/agent/winexec.js",
+    "src/c2configcontrol.js",
+    "src/c2console.js",
+    "src/c2incident.js",
     "src/c2install.js",
+    "src/c2migration.js",
+    "src/c2multigroupcapacity.js",
+    "src/c2multigroupservice.js",
+    "src/cdp.js",
     "src/config.js",
     "src/core/c2cardeffectbridge.js",
     "src/core/c2cardterminalpath.js",
@@ -45,6 +72,7 @@
     "src/core/c2durableruntime.js",
     "src/core/c2eventidentity.js",
     "src/core/c2globalfault.js",
+    "src/core/c2inputrejection.js",
     "src/core/c2localeffectexecutor.js",
     "src/core/c2payloadhandles.js",
     "src/core/c2persistrelation.js",
@@ -63,31 +91,57 @@
     "src/core/datadir.js",
     "src/core/enginecheckpoint.js",
     "src/core/engineeffectcursor.js",
+    "src/core/engineslotsadapter.js",
     "src/core/enginestepcoordinator.js",
     "src/core/instancelock.js",
+    "src/core/issues.js",
+    "src/core/ledger.js",
     "src/core/mdtable.js",
+    "src/core/proxy.js",
     "src/core/redact.js",
     "src/core/store.js",
     "src/core/time.js",
     "src/core/v2engine.js",
     "src/core/verify.js",
+    "src/design.js",
+    "src/gitrepo.js",
+    "src/leftover.js",
     "src/platform/board.js",
     "src/platform/feishu.js",
     "src/platform/multi.js",
+    "src/platform/slack.js",
+    "src/platform/wecom.js",
+    "src/platform/wecomcli.js",
+    "src/platform/wecomname.js",
+    "src/platform/wecompoll.js",
     "src/platform/wswatchdog.js",
     "src/plugins.js",
+    "src/preview.js",
+    "src/projectmemory.js",
     "src/projectsroot.js",
-    "src/setupmodels.js"
+    "src/setupmodels.js",
+    "src/ui/auth.js",
+    "src/ui/browser.html",
+    "src/ui/browserroutes.js",
+    "src/ui/console.html",
+    "src/ui/dashboard.js",
+    "src/ui/feishulogin.js",
+    "src/ui/serverbase.js",
+    "src/ui/sessions.js",
+    "src/ui/takeover.js",
+    "src/usage.js"
   ],
   "scripts": {
     "start": "node bin/sintbot-v2.js start"
   },
   "keywords": [
     "codex",
+    "claude-code",
     "feishu",
     "group-chat",
     "chatops",
-    "self-hosted"
+    "self-hosted",
+    "agent"
   ],
   "author": "WaterTian",
   "license": "SEE LICENSE IN LICENSE",
@@ -100,6 +154,7 @@
     "url": "https://github.com/sintlab/sintbot/issues"
   },
   "dependencies": {
-    "@larksuiteoapi/node-sdk": "^1.76.0"
+    "@larksuiteoapi/node-sdk": "^1.76.0",
+    "ws": "^8.21.3"
   }
 }

package/src/agent/claudecode.js

@@ -29,6 +29,26 @@ const { IS_WIN, resolveSpawn } = require('./winexec')
 const { tagError } = require('./errtag') // 出错原话 → quota / sessionMissing / transient 之一(优先级只在那一处定),与 codex runner 共用
 const closedRunnerResults = new WeakSet()
 const isClosedRunnerResult = result => !!result && typeof result === 'object' && closedRunnerResults.has(result)
+// A rejection raised from the child's own 'close' event: the process has
+// exited even though the turn has no result. It never proves the turn's outcome.
+const closedRunnerErrors = new WeakSet()
+const isClosedRunnerError = error => !!error && typeof error === 'object' && closedRunnerErrors.has(error)
+const closedError = error => { closedRunnerErrors.add(error); return error }
+const PRE_INIT_HOOK_EVENTS = new Set(['hook_started', 'hook_response'])
+const DURABLE_EVENT_TYPES = new Set(['system', 'assistant', 'user', 'result', 'tool_result'])
+// Tool output is completion evidence only, never answer text.
+function durableToolResults(ev) {
+  const results = Array.isArray(ev.results) ? ev.results : []
+  return results.filter(item => item && item.type === 'tool_result').map(item => {
+    const content = typeof item.content === 'string' ? item.content
+      : Array.isArray(item.content) ? item.content
+        .filter(part => part && part.type === 'text' && typeof part.text === 'string')
+        .map(part => part.text).join('\n')
+        : ''
+    return { type: 'tool_result', ...(ev.sessionId ? { sessionId: ev.sessionId } : {}),
+      results: [{ type: 'tool_result', content, is_error: item.is_error === true }] }
+  })
+}
 
 // Build the child env from a resolved provider. `baseUrlOverride` (when given)
 // replaces provider.baseUrl for ANTHROPIC_BASE_URL — used to point `claude` at
@@ -351,6 +371,9 @@ function runTurn({
           let raw
           try { raw = JSON.parse(line) } catch { continue } // skip non-JSON noise
           if (onTurnAccepted && !turnAccepted) {
+            // Locally configured session hooks report their own lifecycle before
+            // init. They are not model output; skip them and keep waiting.
+            if (raw.type === 'system' && PRE_INIT_HOOK_EVENTS.has(raw.subtype)) continue
             if (raw.type !== 'system' || raw.subtype !== 'init' || typeof raw.session_id !== 'string' || !raw.session_id) {
               failTurnAcceptance(new Error('Claude turn emitted an event before start confirmation'))
               return
@@ -400,7 +423,13 @@ function runTurn({
             const last = lastMsgUsage || (ev.usage && Array.isArray(ev.usage.iterations) ? ev.usage.iterations[ev.usage.iterations.length - 1] : null)
             if (last) ev.contextTokens = (last.input_tokens || 0) + (last.cache_read_input_tokens || 0) + (last.cache_creation_input_tokens || 0)
           }
-          if (onDurableEvent) await persistEvent(ev)
+          // Only transcript events reach the durable projection. Informational
+          // stream additions (for example rate_limit_event) carry no answer.
+          // Claude reports several tool results per event, with array content
+          // and an optional error flag; persist each in the shared shape.
+          if (onDurableEvent && ev.type === 'tool_result') {
+            for (const durable of durableToolResults(ev)) await persistEvent(durable)
+          } else if (onDurableEvent && DURABLE_EVENT_TYPES.has(ev.type)) await persistEvent(ev)
           if (ev.type === 'result') { lastResult = ev; armCloseGrace() } // answer in → bound the wait for 'close'
           if (onEvent) { try { onEvent(ev) } catch { /* renderer must not kill the turn */ } }
         }
@@ -427,7 +456,7 @@ function runTurn({
 
       const completeClose = (code) => finish(() => {
         if (code !== 0 && !lastResult && !aborted) {
-          return reject(new Error(`claude exited ${code}: ${stderr.trim().slice(0, 800) || '(no stderr)'}`))
+          return reject(closedError(new Error(`claude exited ${code}: ${stderr.trim().slice(0, 800) || '(no stderr)'}`)))
         }
         resolveRun({ sessionId: capturedSessionId, result: lastResult, code, aborted })
       })
@@ -500,4 +529,4 @@ function probeVersion(bin = 'claude') {
   })
 }
 
-module.exports = { runTurn, isClosedRunnerResult, buildEnv, normalizeEvent, probeVersion, supportsFlag, BASE_SKILL_ALLOWS }
+module.exports = { runTurn, isClosedRunnerResult, isClosedRunnerError, buildEnv, normalizeEvent, probeVersion, supportsFlag, BASE_SKILL_ALLOWS }

package/src/agent/claudemodels.js

@@ -0,0 +1,60 @@
+// Claude 模型清单(控制台「模型」下拉用)—— **只在已登录时给**,未登录不列任何型号。
+//
+// ⚠ 为什么不是「登录后拉官方实时清单」:查过了,三条路都不通(2026-08-03 实测):
+//   1. `GET /v1/models` + Claude Code 的登录态 token(Bearer + anthropic-beta: oauth-2025-04-20)
+//      —— curl 拿得到 200 与完整清单,但**同样的头从 Node 里发一律 403 `Request not allowed`**
+//      (node:https / fetch 都试过,补 accept、换 UA、换 HTTP/1.1 全无效)⇒ 这是按客户端指纹的
+//      门禁,不是缺哪个头。它拦的是「登录态 token 被别的程序拿去用」,shell 出 curl 去绕正是
+//      它要防的那件事,所以不做。
+//   2. `claude` 没有 models 子命令(只有 auth / mcp / plugin / doctor …)。
+//   3. `~/.claude.json` 的 `modelAccessCache` 实测是空数组、`orgModelDefaultCache` 是 null
+//      —— 不是清单来源。
+// 所以清单 = 内置候选 + 本机账号的**额外可选项**(`additionalModelOptionsCache`,CLI 登录后
+// 自己写的,合法本地读、best-effort),并在面板里说清「以 Claude Code 里 /model 为准」。
+// 想用清单外的型号:面板留了「自定义…」直接填,不受这里限制。
+
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+// 当前主力档 + 上一代 Opus。刻意不铺满历史版本 —— 它是挑选快捷方式,不是权威清单;
+// 4.8 留着是因为它仍在服务且额度池与 Opus 5 分开(operator 点名要能选,2026-08-05)。
+// ⚠ id 是不带日期后缀的固定串(`claude-opus-4-8`,不是 `claude-opus-4-8-2026xxxx`)。
+const BUILTIN = [
+  { id: '', name: '默认(跟随 Claude Code)', note: '推荐 · 不指定型号' },
+  { id: 'claude-opus-5', name: 'Claude Opus 5', note: '最强 · 复杂改码 / 长链路' },
+  { id: 'claude-opus-4-8', name: 'Claude Opus 4.8', note: '上一代 Opus · 额度池独立' },
+  { id: 'claude-sonnet-5', name: 'Claude Sonnet 5', note: '速度与智能平衡' },
+  { id: 'claude-haiku-4-5', name: 'Claude Haiku 4.5', note: '最快最省 · 简单任务' },
+]
+
+// CLI 登录后写在 ~/.claude.json 的账号额外可选模型(本机这台是 Fable 5)。
+// 私有字段,形状可能变 ⇒ 全程防御式读取,取不到就当没有。纯函数,便于单测。
+function parseExtraModels(rawJson) {
+  const arr = rawJson && Array.isArray(rawJson.additionalModelOptionsCache) ? rawJson.additionalModelOptionsCache : []
+  return arr
+    .filter((x) => x && typeof x.value === 'string' && x.value)
+    .map((x) => ({ id: x.value, name: x.label || x.value, note: String(x.description || '').slice(0, 60) }))
+}
+function readExtraModels(home) {
+  try { return parseExtraModels(JSON.parse(fs.readFileSync(path.join(home || os.homedir(), '.claude.json'), 'utf8'))) }
+  catch { return [] }
+}
+
+// 合并:内置在前,账号额外项去重后追加(同 id 不重复列)。
+function mergeModels(extra = []) {
+  const out = BUILTIN.slice()
+  const seen = new Set(out.map((m) => m.id))
+  for (const m of extra) if (m.id && !seen.has(m.id)) { seen.add(m.id); out.push({ ...m, extra: true }) }
+  return out
+}
+
+// { loggedIn, models, source }。未登录 ⇒ models 为空数组(面板据此整块不显示型号)。
+// source: 'account' = 含本机账号的额外可选项 · 'builtin' = 只有内置候选。
+function listModels({ loggedIn, home } = {}) {
+  if (!loggedIn) return { loggedIn: false, models: [], source: 'none' }
+  const extra = readExtraModels(home)
+  return { loggedIn: true, models: mergeModels(extra), source: extra.length ? 'account' : 'builtin' }
+}
+
+module.exports = { listModels, mergeModels, parseExtraModels, readExtraModels, BUILTIN }

package/src/agent/claudestatus.js

@@ -0,0 +1,74 @@
+// Claude 订阅登录态探测 —— 控制台 Claude 模型卡 + doctor 用。
+//
+// `claude auth status --json` 是**官方的非交互子命令**(0.2s、不联网收费、不吃订阅额度),
+// 返回 {loggedIn, authMethod, apiProvider, email, orgId, orgName, subscriptionType}。
+// 它是 Claude 这侧对应 `codex login status` 的那件东西 —— 在它之前,sbot 只能按
+// 「没填 baseUrl 就当成登录态」猜(卡片写「登录态·未验证」、doctor 写「Claude 登录态(未验证)」),
+// 真没登录时一样显示正常,要到群里跑一轮才炸。
+//
+// 一律 best-effort:失败不抛,调用方显示「未验证」而不是把整块健康检查拖垮。
+
+const { spawn } = require('node:child_process')
+const { resolveSpawn } = require('./winexec')
+
+// `claude auth status --json` 的 stdout → 归一化结果。纯函数,便于单测钉住字段映射。
+// 老版本 CLI 没有这个子命令(stderr 报 unknown command / 非 0 退出)⇒ ok:false,
+// 调用方据此显示「未验证」,**不能**当成「未登录」—— 二者要分开,同飞书应用描述那条教训。
+function parseAuthStatus(stdout, code) {
+  const text = String(stdout || '').trim()
+  let j = null
+  try { j = JSON.parse(text) } catch { /* 非 JSON:老版本或报错文本 */ }
+  if (!j || typeof j !== 'object') {
+    return { ok: false, error: text.slice(0, 200) || `exit ${code}`, loggedIn: false }
+  }
+  return {
+    ok: true,
+    loggedIn: !!j.loggedIn,
+    plan: j.subscriptionType || '',      // max / pro / team …(未订阅时为空)
+    email: j.email || '',
+    org: j.orgName || '',
+    method: j.authMethod || '',          // claude.ai = 订阅登录
+    apiProvider: j.apiProvider || '',    // firstParty / bedrock / vertex
+  }
+}
+
+function loginStatus(bin = 'claude', timeoutMs = 8000) {
+  return new Promise((resolve) => {
+    const { file, spawnArgs } = resolveSpawn(bin, ['auth', 'status', '--json'])
+    let out = '', err = '', settled = false
+    const done = (v) => { if (settled) return; settled = true; clearTimeout(timer); resolve(v) }
+    let child
+    try { child = spawn(file, spawnArgs, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true }) }
+    catch (e) { return resolve({ ok: false, error: e.message, loggedIn: false }) }
+    const timer = setTimeout(() => { try { child.kill() } catch {} done({ ok: false, error: 'timeout', loggedIn: false }) }, timeoutMs)
+    child.stdout.on('data', (c) => { out += c.toString('utf8') })
+    child.stderr.on('data', (c) => { err += c.toString('utf8') })
+    child.on('error', (e) => done({ ok: false, loggedIn: false, error: e.code === 'ENOENT' ? "'claude' 不在 PATH 上" : e.message }))
+    child.on('close', (code) => done(parseAuthStatus(out || err, code)))
+  })
+}
+
+// TTL 缓存:doctor 是一次性的,但控制台 /api/state 每次动作 + 60s 自动刷新都会重建健康行,
+// 每次都 spawn 一个进程没必要。登录态分钟级变化足够,取 60s。
+const CACHE = new Map() // bin -> { at, val }
+const TTL = 60_000
+async function cachedLoginStatus(bin = 'claude', ttl = TTL) {
+  const c = CACHE.get(bin)
+  if (c && Date.now() - c.at < ttl) return c.val
+  const val = await loginStatus(bin)
+  CACHE.set(bin, { at: Date.now(), val })
+  return val
+}
+function clearCache() { CACHE.clear() } // 「重新检测」按钮:绕过 TTL
+
+// 登录态 → 一行人话(卡片 chip / doctor 详情共用,措辞单一事实源)。
+function describeLogin(s) {
+  if (!s || !s.ok) return { level: 'warn', text: '未验证' + (s && s.error ? ' — ' + String(s.error).slice(0, 60) : '') }
+  if (!s.loggedIn) return { level: 'fail', text: '未登录 — 在这台机器上跑 claude auth login' }
+  const bits = ['订阅登录']
+  if (s.plan) bits.push(s.plan)          // max / pro
+  if (s.email) bits.push(s.email)
+  return { level: 'ok', text: bits.join(' · ') }
+}
+
+module.exports = { loginStatus, cachedLoginStatus, clearCache, parseAuthStatus, describeLogin }

package/src/agent/claudeusage.js

@@ -0,0 +1,200 @@
+// Claude 订阅额度(v0.11.3)—— 控制台 Claude 卡「订阅额度」行 + 群内 /hud 用。
+//
+// 通道与 cc-hud(operator 自家 statusline 项目)同源,2026-08-03 拍板采用:
+//   端点 = `https://api.anthropic.com/api/oauth/usage`(交互式 /usage 面板同一数据源),
+//   `Authorization: Bearer <claudeAiOauth.accessToken>` + `anthropic-beta: oauth-2025-04-20`。
+//   `limits[]` 三档(本机 2026-08-03 实测):kind=session(5h 窗口)/ weekly_all / weekly_scoped
+//   (带 scope.model.display_name,= 顶级模型周窗口,如 Fable);percent 为**已用**百分比。
+//
+// ⚠ 三条纪律(照 cc-hud 踩通的路,别走样):
+//   1. Cloudflare WAF 对 /api/oauth/* 按 **TLS 指纹** 403 —— Node 的 fetch **恒被拒**、curl 放行
+//      (与网络环境无关,换机器换代理都一样)。所以这条路只走 curl,native fetch 不再试
+//      (那一发必 403 还白占端点的限流计数);`fetchNative` 保留不删 —— 哪天官方放行,
+//      回接只是 fetchRaw 里加一行。curl 的 config 走 **stdin**,token 绝不进 argv(ps 可见)、
+//      绝不落日志。
+//   2. 凭据**只读不刷新**:accessToken 过期就当拿不到(返回 null 显示「未验证」),token 轮换
+//      是 Claude Code 自己的事 —— 代刷会跟它抢 refresh token,两边都掉登录。
+//   3. 端点又慢又娇:走本机代理的好路也要 1.1~2.7s,限流阈值低(十几分钟十几次就 429 且持续
+//      数分钟)。故超时给足 5s(调用方都是异步回复,多等两秒无感)、失败隔一下重试一次、
+//      失败**不长缓存**(见 fetchRaw)。
+//
+// 全程 best-effort:任何一步失败返回 null,调用方不显示额度行,绝不拖垮健康检查/卡片渲染。
+// 但**失败要留一行痕**:此前 curl 带 `--fail` 把状态码连同 body 一起吞掉,超时/429/500 在
+// 日志里长得一模一样(什么都没有),排查只能靠猜。
+
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const { execFile, execFileSync } = require('node:child_process')
+
+const USAGE_URL = 'https://api.anthropic.com/api/oauth/usage'
+const TIMEOUT_MS = 5000      // curl 预算(纪律 3);native fetch 已不走这条路
+const RETRY_WAIT_MS = 1500   // 失败后隔多久重试(一次为限)
+const FAIL_TTL_MS = 10_000   // 失败缓存窗口,见 fetchRaw
+
+// ~/.claude/.credentials.json(Windows / Linux)或 macOS Keychain 的 JSON → accessToken。
+// 过期 ⇒ null(纪律 2)。纯函数,单测钉住。
+function parseCredentials(raw, now = Date.now()) {
+  let j = null
+  try { j = JSON.parse(String(raw || '')) } catch { return null }
+  const o = j && j.claudeAiOauth
+  if (!o || typeof o.accessToken !== 'string' || !o.accessToken) return null
+  if (typeof o.expiresAt === 'number' && o.expiresAt <= now) return null
+  return o.accessToken
+}
+
+function readAccessToken(home = os.homedir()) {
+  // 凭据文件优先(win/linux;存在即终局 —— 文件过期意味着同账号同过期,不再翻 Keychain)
+  let raw = null
+  try { raw = fs.readFileSync(path.join(home, '.claude', '.credentials.json'), 'utf8') } catch { /* 无文件 */ }
+  if (raw !== null) return parseCredentials(raw)
+  if (process.platform === 'darwin') {
+    try {
+      const out = execFileSync('security', ['find-generic-password', '-s', 'Claude Code-credentials', '-w'],
+        { encoding: 'utf8', timeout: 1500, stdio: ['ignore', 'pipe', 'ignore'] })
+      return parseCredentials(out)
+    } catch { /* 无条目 / 拒绝访问 */ }
+  }
+  return null
+}
+
+// limits[] → [{kind, percent(已用), resetsAt(ms|null), scopeName}]。防御式:形状不对给 []。
+function parseLimits(data) {
+  const arr = data && Array.isArray(data.limits) ? data.limits : []
+  const out = []
+  for (const l of arr) {
+    if (!l || typeof l.kind !== 'string' || typeof l.percent !== 'number') continue
+    const t = Date.parse(l.resets_at || '')
+    out.push({
+      kind: l.kind,
+      percent: l.percent,
+      resetsAt: Number.isFinite(t) ? t : null,
+      scopeName: (l.scope && l.scope.model && typeof l.scope.model.display_name === 'string') ? l.scope.model.display_name : '',
+    })
+  }
+  return out
+}
+
+// 紧凑一行(v0.11.8 口径改版,operator 拍板):`5h:98% (1.8h) │ 7d:12% (6.1d) │ Fable:12%`
+// ⚠ **百分比是「已用」不是「剩余」** —— 与 v0.11.3~0.11.7 的「剩 x%」正好相反,四处落点
+// (本函数 / console 的 codex 卡 / usage.js 的 minimax 行 / 群内 /hud)必须同版改齐,
+// 否则同屏两种口径,「98%」会被读成还剩很多。窗口名前缀 + 括号内距重置,不留裸百分比。
+// 分隔符 │(U+2502),两侧空格。
+// 一位小数的紧凑时长(4.0h ⇒ 4h:整数不留尾零;≥10 直接取整,两位数带小数太挤)
+const fmtDurDecimal = (ms) => {
+  const trim = (v) => (v < 10 ? String(Number(v.toFixed(1))) : String(Math.round(v)))
+  const h = ms / 3600e3
+  if (h >= 24) return `${trim(h / 24)}d`
+  if (h >= 1) return `${trim(h)}h`
+  return `${Math.max(1, Math.round(ms / 60e3))}m`
+}
+const QUOTA_SEP = ' │ '
+
+function formatClaudeUsage(limits, now = Date.now()) {
+  if (!Array.isArray(limits) || !limits.length) return null
+  const reset = (l) => (l.resetsAt && l.resetsAt > now && l.resetsAt - now < 9 * 864e5) ? ` (${fmtDurDecimal(l.resetsAt - now)})` : ''
+  // 窗口名:session=5h(官方就是 5 小时滚动窗)· weekly_all=7d · weekly_scoped=该模型名
+  const label = (l) => l.kind === 'session' ? '5h' : l.kind === 'weekly_all' ? '7d' : l.kind === 'weekly_scoped' ? (l.scopeName || '顶级模型') : ''
+  const parts = []
+  for (const l of limits) {
+    const lb = label(l)
+    if (!lb) continue // 未知窗口类型不猜(官方加新档时宁缺毋滥)
+    parts.push(`${lb}:${Math.min(100, Math.max(0, Math.round(l.percent)))}%${reset(l)}`)
+  }
+  return parts.join(QUOTA_SEP) || null
+}
+
+// ⚠ 当前**不走**这条腿(纪律 1:Node 的 TLS 指纹被 Cloudflare 恒 403)。保留函数是为了
+// 哪天官方放行时回接成本近似为零 —— 别因为「没人调」把它删掉。
+async function fetchNative(token) {
+  const ac = new AbortController()
+  const timer = setTimeout(() => ac.abort(), TIMEOUT_MS)
+  try {
+    const r = await fetch(USAGE_URL, { headers: { Authorization: `Bearer ${token}`, 'anthropic-beta': 'oauth-2025-04-20' }, signal: ac.signal })
+    if (!r.ok) return null
+    return await r.json()
+  } catch { return null } finally { clearTimeout(timer) }
+}
+
+// curl 收尾判读(纯函数,单测钉死):(err, stdout) → { data, note }。
+// stdout 的**最后一行**是 `--write-out` 写的 HTTP 状态码 —— 不再用 `--fail`,它把状态码和 body
+// 一起吞了,超时/限流/服务端错在日志里长得一模一样。note = 该记的一行人话(成功给 null,
+// 成功不打日志);note 里只放状态码与本地错因,绝不带 token 或响应头。
+function readCurlResult(err, stdout) {
+  if (err) {
+    // 退出码 28 = 取数命令自己的 max-time 到点;killed/SIGTERM = 外层兜底超时掐的
+    const exit = typeof err.code === 'number' ? err.code : null
+    if (err.killed || err.signal === 'SIGTERM' || exit === 28 || String(err.code || '') === 'ETIMEDOUT')
+      return { data: null, note: `额度接口超时(${TIMEOUT_MS}ms 未返回)` }
+    const why = exit != null ? `退出码 ${exit}` : String((err.message || '').split('\n')[0] || '未知错误').slice(0, 120)
+    return { data: null, note: `额度接口调用失败(${why})` }
+  }
+  const raw = String(stdout == null ? '' : stdout)
+  const cut = raw.lastIndexOf('\n')
+  const status = Number((cut >= 0 ? raw.slice(cut + 1) : raw).trim())
+  const body = cut >= 0 ? raw.slice(0, cut) : ''
+  if (!Number.isFinite(status) || !status) return { data: null, note: '额度接口没给出状态码(响应形状不认识)' }
+  if (status === 429) return { data: null, note: '额度接口限流(429),等一会儿才会恢复' }
+  if (status !== 200) return { data: null, note: `额度接口返回 ${status}` }
+  try { return { data: JSON.parse(body), note: null } } catch { return { data: null, note: '额度接口返回的不是 JSON(解析失败)' } }
+}
+
+const warn = (m) => { try { process.stderr.write('· ' + m + '\n') } catch { /* stderr 关了也不能崩 */ } }
+
+// 唯一的取数腿:config 经 stdin(token 不进 argv);token 字符集先校验,防 config 注入。
+function fetchCurl(token, { log = warn, exec = execFile } = {}) {
+  if (!/^[\w.\-~+/=]+$/.test(token)) return Promise.resolve(null)
+  return new Promise((resolve) => {
+    try {
+      const child = exec('curl', ['--config', '-'], { timeout: TIMEOUT_MS + 1000, windowsHide: true }, (err, stdout) => {
+        const { data, note } = readCurlResult(err, stdout)
+        if (note) log(note)
+        resolve(data)
+      })
+      child.stdin.on('error', () => { /* curl 可能在 stdin 写完前退出 */ })
+      child.stdin.end([
+        `url = "${USAGE_URL}"`,
+        `header = "Authorization: Bearer ${token}"`,
+        'header = "anthropic-beta: oauth-2025-04-20"',
+        'silent', `max-time = ${Math.ceil(TIMEOUT_MS / 1000)}`,
+        'write-out = "\\n%{http_code}"', // 末行状态码:失败要留痕,见 readCurlResult
+      ].join('\n'))
+    } catch (e) { log('额度接口起不来:' + ((e && e.message) || '未知错误')); resolve(null) }
+  })
+}
+
+const sleepMs = (ms) => new Promise((r) => setTimeout(r, ms))
+
+// 原始额度 JSON。**缓存与 usageLine 共用同一份** —— 额度告警每轮结算都会问一次,不共用
+// 就是每轮多打一次接口(v0.11.8 新增,给 quotaalert 判定用)。
+// ⚠ **只有成功才缓存 60s;失败只压 10 秒**:失败也缓存一分钟,等于一次偶发超时就让整整一分钟
+// 里所有人都查不到额度(而这接口恰恰偶发超时/限流);完全不压又让连点几下就把限流捅穿。
+// 10 秒 = 人再问一次就真的重试,机器连点仍被挡住。
+const RAW = { at: 0, data: null }
+async function fetchRaw(token, { ttl = 60_000, now = Date.now, log = warn, curl = fetchCurl, sleep = sleepMs } = {}) {
+  if (RAW.at && now() - RAW.at < (RAW.data ? ttl : FAIL_TTL_MS)) return RAW.data
+  // 只走 curl(纪律 1);失败隔一下再问一次 —— 超时与短限流重试一次往往就通,再不通就认了。
+  let data = await curl(token, { log })
+  if (!data) { await sleep(RETRY_WAIT_MS); data = await curl(token, { log }) }
+  RAW.at = now(); RAW.data = data
+  return data
+}
+
+// 拉一次 → 一行人话;拿不到 null。走 fetchRaw ⇒ 与告警共享那份缓存。
+// 缓存口径与 fetchRaw 一致:成功 60s、失败 10s(两层都压死一分钟就白搭下层的重试了)。
+const CACHE = { at: 0, val: null }
+const TTL = 60_000
+async function usageLine({ ttl = TTL, now = Date.now, readToken = readAccessToken, ...io } = {}) {
+  if (CACHE.at && now() - CACHE.at < (CACHE.val ? ttl : FAIL_TTL_MS)) return CACHE.val
+  let val = null
+  const token = readToken()
+  if (token) {
+    const data = await fetchRaw(token, { ttl, now, ...io })
+    val = formatClaudeUsage(parseLimits(data), now())
+  }
+  CACHE.at = now(); CACHE.val = val
+  return val
+}
+function clearCache() { CACHE.at = 0; CACHE.val = null; RAW.at = 0; RAW.data = null }
+
+module.exports = { usageLine, fetchRaw, clearCache, parseCredentials, parseLimits, formatClaudeUsage, readAccessToken, fetchCurl, fetchNative, readCurlResult, fmtDurDecimal, QUOTA_SEP, TIMEOUT_MS, FAIL_TTL_MS, RETRY_WAIT_MS }

package/src/agent/codexapp.js

@@ -4,6 +4,11 @@
 const { spawn } = require('node:child_process')
 const closedRunnerResults = new WeakSet()
 const isClosedRunnerResult = result => !!result && typeof result === 'object' && closedRunnerResults.has(result)
+// A rejection raised from the child's own 'close' event: the process has
+// exited even though the turn has no result. It never proves the turn's outcome.
+const closedRunnerErrors = new WeakSet()
+const isClosedRunnerError = error => !!error && typeof error === 'object' && closedRunnerErrors.has(error)
+const closedError = error => { closedRunnerErrors.add(error); return error }
 const { IS_WIN, resolveSpawn } = require('./winexec')
 const { normalizeEvent, isEffortRejection } = require('./codexcode')
 const { coreFailedResult, isCoreFailure } = require('./errtag')
@@ -142,6 +147,18 @@ function runTurn(opts = {}) {
     })
     const deactivate = () => { activeTurnId = null } // 完成/中止后立即拒绝晚到的补充。
     const control = {
+      async steerDurable({ msgId, text }) {
+        const turnId = activeTurnId
+        if (!turnId || completed || aborted) return false
+        try {
+          await request('turn/steer', { threadId: capturedSessionId, expectedTurnId: turnId,
+            clientUserMessageId: msgId, input: [{ type: 'text', text }] })
+          return true
+        } catch (error) {
+          if (error?.codexRpcRejected === true) return false
+          throw error
+        }
+      },
       async steer({ msgId, text }) {
         const turnId = activeTurnId
         if (!turnId || completed || aborted) return false
@@ -321,7 +338,7 @@ function runTurn(opts = {}) {
       }
       if (raw.id != null) {
         const p = requests.get(raw.id)
-        if (p) { requests.delete(raw.id); raw.error ? p.fail(new Error(raw.error.message || 'Codex RPC error')) : p.ok(raw.result) }
+        if (p) { requests.delete(raw.id); raw.error ? p.fail(Object.assign(new Error(raw.error.message || 'Codex RPC error'), { codexRpcRejected: [-32600, -32601, -32602].includes(raw.error.code) })) : p.ok(raw.result) }
         return
       }
       if (onTurnAccepted && pendingTurnStart && !acceptedTurnId) {
@@ -348,7 +365,7 @@ function runTurn(opts = {}) {
         }
       } else if (action === 4) {
         const item = params.item
-        if (appLandedAction(item && item.type, raw.method === 'item/completed', !!(item && item.clientId), !!(item && landed.has(item.clientId)))) {
+        if (params.turnId === activeTurnId && params.threadId === capturedSessionId && appLandedAction(item && item.type, raw.method === 'item/completed', !!(item && item.clientId), !!(item && landed.has(item.clientId)))) {
           landed.add(item.clientId)
           if (onSteerLanded) { try { onSteerLanded(item.clientId) } catch {} }
         }
@@ -427,7 +444,7 @@ function runTurn(opts = {}) {
     })
     const completeClose = (code) => settle(() => {
       if (onDurableEvent && !completed && !aborted) {
-        reject(new Error(`codex app-server exited ${code} before a durable result`))
+        reject(closedError(new Error(`codex app-server exited ${code} before a durable result`)))
         return
       }
       if (!completed && !aborted) {
@@ -455,4 +472,4 @@ function runTurn(opts = {}) {
   })
 }
 
-module.exports = { runTurn, isClosedRunnerResult, usageFromTotal, itemEvent, failedTurnEvent }
+module.exports = { runTurn, isClosedRunnerResult, isClosedRunnerError, usageFromTotal, itemEvent, failedTurnEvent }

package/src/agent/codexcode.js

@@ -13,6 +13,11 @@
 const { spawn } = require('node:child_process')
 const closedRunnerResults = new WeakSet()
 const isClosedRunnerResult = result => !!result && typeof result === 'object' && closedRunnerResults.has(result)
+// A rejection raised from the child's own 'close' event: the process has
+// exited even though the turn has no result. It never proves the turn's outcome.
+const closedRunnerErrors = new WeakSet()
+const isClosedRunnerError = error => !!error && typeof error === 'object' && closedRunnerErrors.has(error)
+const closedError = error => { closedRunnerErrors.add(error); return error }
 const { StringDecoder } = require('node:string_decoder')
 const { IS_WIN, resolveSpawn } = require('./winexec')
 const { tagError } = require('./errtag') // 出错原话 → quota / sessionMissing / transient 之一(优先级只在那一处定),与 claude runner 共用
@@ -398,11 +403,11 @@ function runOnce(opts, effort) {
 
     const completeClose = (code) => {
       if (onDurableEvent && code !== 0 && !lastResult && !aborted) {
-        done(() => reject(new Error(`codex exited ${code} before a durable result`)))
+        done(() => reject(closedError(new Error(`codex exited ${code} before a durable result`))))
         return
       }
       if (durableStart && !acceptedStart && !aborted && !acceptanceFailed) {
-        done(() => reject(new Error('Codex exited before turn.started acceptance')))
+        done(() => reject(closedError(new Error('Codex exited before turn.started acceptance'))))
         return
       }
       // Watch the answer→close (rollout-flush) lag. Healthy = ~2–3s (real-machine verified),
@@ -450,4 +455,4 @@ function probeVersion(bin = 'codex') {
   })
 }
 
-module.exports = { runTurn, runOnce, isClosedRunnerResult, probeVersion, normalizeEvent, parseCodexError, isEffortRejection, sandboxMode, buildArgs, buildPrompt }
+module.exports = { runTurn, runOnce, isClosedRunnerResult, isClosedRunnerError, probeVersion, normalizeEvent, parseCodexError, isEffortRejection, sandboxMode, buildArgs, buildPrompt }