sprag-cli 3.55.0 → 3.57.0

package/src/codex-hooks.js

@@ -1,7 +1,8 @@
 import { createRequire } from 'node:module';
 import { spawn } from 'node:child_process';
-import { readFileSync, statSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { createHash } from 'node:crypto';
+import { mkdirSync, openSync, readFileSync, readSync, closeSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
 import { loadConfig, userLanguage } from './config.js';
 import { koreanStyleInjection, koreanStyleEnabled } from './korean-style.js';
 import { cohesionInjection } from './cohesion.js';
@@ -10,8 +11,11 @@ import { findProjectRoot } from './harness.js';
 import { runCodexBrief } from './codex-brief.js';
 import { codexDocumentTool, codexDocumentNote, convertCodexDocument } from './codex-doc2md.js';
 import { codexDelegationTool, codexRouteHint } from './codex-delegation.js';
+import { bindCodexSubagent, closeStaleCodexRoutes, unsettledCodexRoutes } from './codex-ledger.js';
 import { seedOfferBlock } from './seed-rules.js';
 import { readCodexRouteScan, openCodexCandidates, shouldRescanCodex } from './codex-route-scan.js';
+import { userDataDir } from './paths.js';
+import { debug } from './debug.js';
 
 const require = createRequire(import.meta.url);
 const lint = require('./korean-lint.cjs');
@@ -21,6 +25,80 @@ function context(event, text) {
   return text ? { hookSpecificOutput: { hookEventName: event, additionalContext: text } } : null;
 }
 
+/**
+ * Codex 0.159.2 keeps about 2,450 tokens of one hook's context and cuts the
+ * middle: a 4,500-token SessionStart kept its head and tail and dropped 2,042
+ * tokens, which was most of the Korean style guide, while the low-priority
+ * offers at the end survived. The budget leaves room for estimate error.
+ */
+export const CODEX_CONTEXT_TOKEN_BUDGET = 2000;
+
+/** Overestimates on purpose: ASCII at 3.5 chars a token, anything else at 1.3. */
+export function estimateCodexTokens(text) {
+  let ascii = 0, other = 0;
+  for (const ch of String(text ?? '')) { if (ch.codePointAt(0) < 128) ascii++; else other++; }
+  return Math.ceil(ascii / 3.5 + other / 1.3);
+}
+
+/**
+ * Fit context parts into the budget whole, never cut. Parts are tried by
+ * priority (lower first); a part that does not fit moves to `overflowFile`
+ * when `spill` is set and is dropped otherwise. A pointer to the file goes
+ * first, since the head of a context is what Codex always keeps.
+ */
+export function fitCodexContext(parts, { budget = CODEX_CONTEXT_TOKEN_BUDGET, overflowFile, write = writeOverflow } = {}) {
+  const items = parts.map((p, i) => ({ ...p, i, tokens: estimateCodexTokens(p.text) })).filter((p) => p.text);
+  const pointer = (file) => `[Sprag] Some Sprag instructions exceed Codex's hook context limit. Read ${JSON.stringify(file)} before starting work and follow it like the instructions below.`;
+  const reserve = overflowFile && items.some((p) => p.spill) ? estimateCodexTokens(pointer(overflowFile)) : 0;
+  let used = reserve;
+  const kept = new Set(), spilled = [];
+  for (const p of [...items].sort((a, b) => a.priority - b.priority || a.i - b.i)) {
+    if (used + p.tokens <= budget) { kept.add(p.i); used += p.tokens; }
+    else if (p.spill && overflowFile) spilled.push(p);
+  }
+  const out = items.filter((p) => kept.has(p.i)).map((p) => p.text);
+  if (spilled.length) {
+    try {
+      write(overflowFile, spilled.sort((a, b) => a.i - b.i).map((p) => p.text).join('\n\n') + '\n');
+      out.unshift(pointer(overflowFile));
+    } catch (e) { debug('codex:overflow', e); }
+  }
+  return out.join('\n\n');
+}
+
+function writeOverflow(file, text) {
+  mkdirSync(join(file, '..'), { recursive: true, mode: 0o700 });
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync(tmp, text, { mode: 0o600 });
+  renameSync(tmp, file);
+}
+
+function overflowFileFor(root) {
+  const key = createHash('sha256').update(resolve(root || '.')).digest('hex').slice(0, 16);
+  return join(userDataDir(), 'codex-context', `${key}.md`);
+}
+
+/**
+ * `codex exec` runs have no one to answer a question, yet their SessionStart
+ * payload says `source: "startup"` like an interactive one. The rollout's
+ * first record says who started it (`originator: "codex_exec"`).
+ */
+export function isCodexExecSession(transcriptPath) {
+  if (typeof transcriptPath !== 'string' || !transcriptPath) return false;
+  let fd;
+  try {
+    fd = openSync(transcriptPath, 'r');
+    const buffer = Buffer.alloc(64 * 1024);
+    const length = readSync(fd, buffer, 0, buffer.length, 0);
+    const first = JSON.parse(buffer.subarray(0, length).toString('utf8').split('\n')[0]);
+    const meta = first?.type === 'session_meta' ? first.payload : null;
+    return meta?.originator === 'codex_exec' || meta?.source === 'exec';
+  } catch (e) {
+    if (e?.code !== 'ENOENT') debug('codex:exec-detect', e);
+    return false;
+  } finally { if (fd !== undefined) closeSync(fd); }
+}
+
 /**
  * Project route candidates from the last scan. Never scans inline: session
  * start must stay fast, so a stale scan is refreshed in a detached process
@@ -42,6 +120,20 @@ function defaultRescan() {
     { detached: true, stdio: 'ignore', windowsHide: true }).unref();
 }
 
+/**
+ * Prices the delegated runs the ledger has not joined yet, in a detached
+ * process. The ledger was refreshed only by the route scan, which the rescan
+ * gate holds back for up to a day, so "Routing saved" showed a delegation that
+ * long after it happened. Claude's side has the same shortcut on its
+ * PostToolUse hook; Codex has no hook for a finished child, so the next prompt
+ * of the parent is the earliest point that knows one was spawned.
+ */
+function defaultLedgerRefresh() {
+  if (process.env.CTS_NO_ROUTE_SCAN === '1') return;
+  spawn(process.execPath, [process.argv[1], 'route-scan', 'savings', '--refresh', '--quiet', '--agent', 'codex'],
+    { detached: true, stdio: 'ignore', windowsHide: true }).unref();
+}
+
 export function lintCodexTool(payload, { scope = 'all' } = {}) {
   if (!payload || typeof payload !== 'object') return null;
   const input = payload.tool_input;
@@ -65,54 +157,71 @@ export function lintCodexTool(payload, { scope = 'all' } = {}) {
       if (lint.isHtmlFile(file)) text = lint.stripHtml(text);
       const findings = lint.lintKoreanText(text, { code: !lint.isProseFile(file) });
       if (findings.length) messages.push(lint.formatFindings(file, findings));
-    } catch { /* Deleted, moved, or unreadable files need no feedback. */ }
+    } catch (e) { if (e?.code !== 'ENOENT') debug('codex:lint', e); }
   }
   return messages.length ? messages.join('\n\n') : null;
 }
 
-export async function codexHookOutput(event, payload, { cfg = loadConfig() } = {}) {
+export async function codexHookOutput(event, payload, { cfg = loadConfig(), refreshLedger = defaultLedgerRefresh } = {}) {
   if (!payload || typeof payload !== 'object') return null;
   if (event === 'session-start' || event === 'subagent-start') {
     if (event === 'subagent-start' && cfg?.codex?.delegate !== true) return null;
+    if (event === 'subagent-start') {
+      try { bindCodexSubagent(payload); } catch (e) { debug('codex:bind', e); }
+    }
     const root = findProjectRoot(payload.cwd || process.cwd(), { agent: 'codex' });
     const parts = [];
     // Keep the preset file current with this version's wording before it is read.
     if (event === 'session-start') {
-      try { (await import('./preset-ratchet.js')).preparePresetRatchet({ agent: 'codex' }); } catch { /* Presets are optional. */ }
+      try { (await import('./preset-ratchet.js')).preparePresetRatchet({ agent: 'codex' }); } catch (e) { debug('codex:preset', e); }
     }
     const { presetRatchetPath } = await import('./preset-ratchet.js');
+    // Lower priority survives the budget first. Rules and style move to a file
+    // when they do not fit; offers and notices are simply left out.
     for (const [scope, ratchet] of [['global', codexHarnessPaths(root, 'global').ratchet],
       ['preset', presetRatchetPath({ agent: 'codex' })], ['project', codexHarnessPaths(root, 'project').ratchet]]) {
       try {
         if (statSync(ratchet).size > 32 * 1024) {
-          parts.push(`Read the ${scope} Sprag ratchet rules at ${JSON.stringify(ratchet)} before working; they exceed the automatic injection limit.`);
+          parts.push({ priority: 1, text: `Read the ${scope} Sprag ratchet rules at ${JSON.stringify(ratchet)} before working; they exceed the automatic injection limit.` });
         } else {
           const text = readFileSync(ratchet, 'utf8').trim();
           // An empty preset file is only its header; injecting it would spend
           // tokens every session on no rules.
-          if (text && (scope !== 'preset' || /^- /m.test(text))) parts.push(`[Sprag Codex ratchet: ${scope}]\n${text}`);
+          if (text && (scope !== 'preset' || /^- /m.test(text))) parts.push({ priority: 1, spill: true, text: `[Sprag Codex ratchet: ${scope}]\n${text}` });
         }
-      } catch { /* No rules registered in this scope. */ }
+      } catch (e) { if (e?.code !== 'ENOENT') debug('codex:ratchet', e); }
     }
-    parts.push(koreanStyleInjection({ cfg }), await cohesionInjection({ cfg }));
-    if (process.env.CTS_NO_DOC2MD !== '1' && cfg?.codex?.doc2md !== false) parts.push(codexDocumentNote());
-    if (event === 'session-start' && payload.source !== 'compact') {
-      try { parts.push(seedOfferBlock({ root, agent: 'codex' })); } catch { /* Offers are optional. */ }
-      try { parts.push(await routeNotice(root)); } catch { /* A missing scan only delays candidates. */ }
+    if (event === 'subagent-start') parts.push({ priority: 0, text:
+      '[Sprag Codex delegation]\nStay within the assigned task and any caller-provided budget. Return findings with file references and actual verification results; state unfinished work. Use only available Codex tools and configured roles. Do not infer a model tier or invent a tool-call budget.' });
+    parts.push({ priority: 2, spill: true, text: koreanStyleInjection({ cfg }) },
+      { priority: 3, spill: true, text: await cohesionInjection({ cfg }) });
+    if (process.env.CTS_NO_DOC2MD !== '1' && cfg?.codex?.doc2md !== false) parts.push({ priority: 4, spill: true, text: codexDocumentNote() });
+    // Offers ask the user a question; a `codex exec` run has no one to answer it.
+    if (event === 'session-start' && payload.source !== 'compact' && !isCodexExecSession(payload.transcript_path)) {
+      try { parts.push({ priority: 5, text: await routeNotice(root) }); } catch (e) { debug('codex:route-notice', e); }
+      try { parts.push({ priority: 6, text: seedOfferBlock({ root, agent: 'codex' }) }); } catch (e) { debug('codex:seed-offer', e); }
     }
-    if (event === 'subagent-start') parts.push(
-      '[Sprag Codex delegation]\nStay within the assigned task and any caller-provided budget. Return findings with file references and actual verification results; state unfinished work. Use only available Codex tools and configured roles. Do not infer a model tier or invent a tool-call budget.');
-    return context(event === 'subagent-start' ? 'SubagentStart' : 'SessionStart', parts.filter(Boolean).join('\n\n'));
+    return context(event === 'subagent-start' ? 'SubagentStart' : 'SessionStart',
+      fitCodexContext(parts, { overflowFile: overflowFileFor(root) }));
   }
   if (event === 'prompt') {
     const parts = [];
     if (cfg?.codex?.delegate === true) {
-      try { parts.push(codexRouteHint(payload, { root: findProjectRoot(payload.cwd || process.cwd(), { agent: 'codex' }) })); }
-      catch { /* Invalid routing state must not suppress briefing or conversion. */ }
+      // Before the hint for this prompt is recorded: a hint from an earlier turn
+      // that no child claimed is closed, and children that did run get priced.
+      try { closeStaleCodexRoutes(payload); } catch (e) { debug('codex:close-routes', e); }
+      try { if (unsettledCodexRoutes() > 0) refreshLedger(); } catch (e) { debug('codex:ledger-refresh', e); }
+      try {
+        parts.push(codexRouteHint(payload, { root: findProjectRoot(payload.cwd || process.cwd(), { agent: 'codex' }),
+          minContext: Number.isFinite(cfg?.codex?.delegateMinContext) ? cfg.codex.delegateMinContext : undefined }));
+      } catch (e) { debug('codex:route-hint', e); }
     }
     if (cfg?.codex?.brief !== false) {
-      try { parts.push(runCodexBrief({ sessionId: payload.session_id, transcriptPath: payload.transcript_path, cwd: payload.cwd })); }
-      catch { /* Local telemetry must not prevent document conversion. */ }
+      try {
+        parts.push(runCodexBrief({ sessionId: payload.session_id, transcriptPath: payload.transcript_path, cwd: payload.cwd,
+          root: findProjectRoot(payload.cwd || process.cwd(), { agent: 'codex' }) }));
+      }
+      catch (e) { debug('codex:brief', e); }
     }
     if (process.env.CTS_NO_DOC2MD !== '1' && cfg?.codex?.doc2md !== false) {
       parts.push(doc2md.contextForPrompt(payload, { lang: userLanguage(), agent: 'codex', convert: convertCodexDocument }));

package/src/codex-ledger.js

@@ -2,21 +2,30 @@ import { appendFileSync, mkdirSync, readFileSync, renameSync, writeFileSync } fr
 import { join } from 'node:path';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { userDataDir } from './paths.js';
+import { roundUsd } from './savings-ledger.js';
 import { discoverCodexSessionFiles, parseCodexTurns } from './codex-parser.js';
-import { codexRunCost, readCodexPrices } from './codex-cache-policy.js';
+import { codexRunCost, codexPriceBook, readCodexPrices } from './codex-cache-policy.js';
 
 /*
  * Codex routing savings, kept apart from Claude's delegation ledger.
  *
- * A child rollout only counts when Sprag itself routed it: the spawn rewrite
- * writes a random route id into the child's message and records the same id
- * here at that moment. The marker text alone proves nothing, since a model can
- * write it by hand; the pending record is what shows a rule existed at spawn time.
+ * A child rollout only counts when Sprag itself routed it: either path writes
+ * a random route id and records the same id here at that moment, so the
+ * pending record (not the marker text a model could write by hand) is what
+ * shows a rule existed before the child ran. Two ways an id reaches a child:
+ *   - the PreToolUse spawn rewrite (codexDelegationTool) writes it into the
+ *     spawned message, for Codex versions that route spawn_agent through hooks;
+ *   - on versions that don't (0.159.2), the prompt hint (codexRouteHint) can
+ *     only ask the model to include the line, so SubagentStart binds the id to
+ *     whichever spawned child matches the pending record (bindCodexSubagent),
+ *     and refreshCodexLedger falls back to that binding when no marker is found.
  */
 
 export const ROUTE_ID_RE = /<!-- sprag:codex:route id=([0-9a-f]{16}) -->/;
 const PENDING_TTL_MS = 7 * 86400000;
+const BIND_TTL_MS = 30 * 60000;
 const pendingFile = (dir) => join(dir, 'codex-delegations.jsonl');
+const bindsFile = (dir) => join(dir, 'codex-delegation-binds.jsonl');
 const ledgerFile = (dir) => join(dir, 'codex-delegation-ledger.json');
 
 export function newRouteId() {
@@ -31,6 +40,21 @@ export function recordCodexDelegation(entry, { dir = userDataDir() } = {}) {
   appendFileSync(pendingFile(dir), line + '\n', { mode: 0o600 });
 }
 
+/**
+ * The pending file is append-only, so it only shrinks here: records past the
+ * pending TTL can never bind or join a child again. Rewritten in place through
+ * a rename, and only when something is actually stale.
+ */
+export function pruneCodexDelegations({ dir = userDataDir(), now = Date.now() } = {}) {
+  const keep = readCodexDelegations({ dir }).filter((r) => now - r.at < PENDING_TTL_MS);
+  let all;
+  try { all = readFileSync(pendingFile(dir), 'utf8').split('\n').filter(Boolean).length; } catch { return; }
+  if (keep.length === all) return;
+  const file = pendingFile(dir), tmp = `${file}.${randomUUID()}.tmp`;
+  writeFileSync(tmp, keep.map((r) => JSON.stringify(r) + '\n').join(''), { mode: 0o600 });
+  renameSync(tmp, file);
+}
+
 export function readCodexDelegations({ dir = userDataDir() } = {}) {
   let text;
   try { text = readFileSync(pendingFile(dir), 'utf8'); } catch { return []; }
@@ -44,6 +68,99 @@ export function readCodexDelegations({ dir = userDataDir() } = {}) {
   return out;
 }
 
+/** One append per bind, mirroring recordCodexDelegation's append-only shape. */
+export function recordCodexBinding(entry, { dir = userDataDir() } = {}) {
+  mkdirSync(dir, { recursive: true });
+  appendFileSync(bindsFile(dir), JSON.stringify(entry) + '\n', { mode: 0o600 });
+}
+
+export function readCodexBindings({ dir = userDataDir() } = {}) {
+  let text;
+  try { text = readFileSync(bindsFile(dir), 'utf8'); } catch { return []; }
+  const out = [];
+  for (const line of text.split('\n')) {
+    try {
+      const b = JSON.parse(line);
+      if (b && /^[0-9a-f]{16}$/.test(b.id) && typeof b.childSessionId === 'string' && Number.isFinite(b.at)) out.push(b);
+    } catch { /* Partial trailing line. */ }
+  }
+  return out;
+}
+
+/** Route ids a later prompt closed before any child claimed them. Kept in the binds file as `{ id, closed: true }` lines. */
+function closedCodexRouteIds({ dir = userDataDir() } = {}) {
+  let text;
+  try { text = readFileSync(bindsFile(dir), 'utf8'); } catch { return new Set(); }
+  const out = new Set();
+  for (const line of text.split('\n')) {
+    try {
+      const b = JSON.parse(line);
+      if (b?.closed === true && /^[0-9a-f]{16}$/.test(b.id)) out.add(b.id);
+    } catch { /* Partial trailing line. */ }
+  }
+  return out;
+}
+
+/**
+ * Close the routes this parent was hinted in an earlier turn and never spawned.
+ *
+ * A hint asks for a spawn in the turn that carries it. Left open, its pending
+ * record kept matching for the whole bind window, so a child the parent spawned
+ * for an unrelated reason twenty minutes later, on the same model, was bound to
+ * it and its cost was booked as a routing saving. A new prompt from the user is
+ * what ends the hinted turn, so that is where the record is closed. Returns how
+ * many were closed; writes nothing when there are none.
+ */
+export function closeStaleCodexRoutes(payload, { dir = userDataDir(), now = Date.now() } = {}) {
+  if (typeof payload?.session_id !== 'string') return 0;
+  const sameTurn = (r) => typeof payload.turn_id === 'string' && r.turnId === payload.turn_id;
+  const open = readCodexDelegations({ dir }).filter((r) =>
+    r.via === 'prompt' && r.parentSessionId === payload.session_id && now - r.at < BIND_TTL_MS && !sameTurn(r));
+  if (!open.length) return 0;
+  const taken = new Set([...readCodexBindings({ dir }).map((b) => b.id), ...closedCodexRouteIds({ dir })]);
+  const stale = open.filter((r) => !taken.has(r.id));
+  for (const r of stale) appendFileSync(bindsFile(dir), JSON.stringify({ id: r.id, closed: true, at: now }) + '\n', { mode: 0o600 });
+  return stale.length;
+}
+
+/**
+ * Bind a just-spawned SubagentStart child to the pending route it most likely
+ * fulfills: same parent thread, same target model, recent enough, and not
+ * already claimed by another child or closed by a later prompt. When both the
+ * record and the payload name a turn, the turns must agree. Returns the bound
+ * route id, or null when nothing matches or this child is already bound.
+ */
+export function bindCodexSubagent(payload, { dir = userDataDir(), now = Date.now() } = {}) {
+  if (typeof payload?.agent_id !== 'string' || typeof payload?.session_id !== 'string' || typeof payload?.model !== 'string') return null;
+  const binds = readCodexBindings({ dir });
+  if (binds.some((b) => b.childSessionId === payload.agent_id)) return null;
+  const boundIds = new Set([...binds.map((b) => b.id), ...closedCodexRouteIds({ dir })]);
+  const otherTurn = (r) => typeof payload.turn_id === 'string' && typeof r.turnId === 'string' && r.turnId !== payload.turn_id;
+  const pending = readCodexDelegations({ dir }).filter((r) =>
+    r.parentSessionId === payload.session_id && r.to === payload.model && now - r.at < BIND_TTL_MS && !boundIds.has(r.id) && !otherTurn(r));
+  if (!pending.length) return null;
+  // Oldest first: spawns are recorded in order, so the earliest unbound record belongs to the earliest child.
+  const chosen = pending.reduce((a, b) => (b.at < a.at ? b : a));
+  recordCodexBinding({ id: chosen.id, childSessionId: payload.agent_id, at: now }, { dir });
+  return chosen.id;
+}
+
+/**
+ * How many bound routes the ledger has not finished pricing. A child was
+ * spawned for each, so its saving exists but is not in the ledger until the
+ * next refresh, and the route scan that refreshes it runs at most daily when
+ * little new data arrives. Callers use a non-zero count to refresh now. Bound
+ * within the bind window only: a child still running after that settles at the
+ * regular scan.
+ */
+export function unsettledCodexRoutes({ dir = userDataDir(), now = Date.now() } = {}) {
+  const recent = readCodexBindings({ dir }).filter((b) => now - b.at < BIND_TTL_MS);
+  if (!recent.length) return 0;
+  const pending = new Set(readCodexDelegations({ dir }).filter((r) => now - r.at < PENDING_TTL_MS).map((r) => r.id));
+  const events = loadCodexLedger({ dir }).events;
+  return recent.filter((b) => pending.has(b.id) && !(events[b.id]?.complete || events[b.id]?.aborted)).length;
+}
+
 export function loadCodexLedger({ dir = userDataDir() } = {}) {
   try {
     const data = JSON.parse(readFileSync(ledgerFile(dir), 'utf8'));
@@ -59,38 +176,50 @@ function saveLedger(data, dir) {
   renameSync(tmp, file);
 }
 
-/** The route id a child rollout carries, and its own tokens, or null. */
-async function childRun(path, cutoffMs) {
+/**
+ * The route id a child rollout carries, and its own tokens, or null. When no
+ * child turn carries the marker line (the prompt-hint path can only ask the
+ * model to write it, not guarantee it), `binds` — childSessionId -> id from
+ * SubagentStart — supplies the id instead.
+ */
+async function childRun(path, cutoffMs, binds) {
   const s = await parseCodexTurns(path, { cutoffMs });
   if (!s.isSubagent) return null;
   let id = null;
   const tokens = { input: 0, cached: 0, cacheWrite: 0, output: 0 };
-  let model = null, startedAt = null, endedAt = null, complete = false, usageKnown = false, mixedModels = false;
+  let calls = 0, toolErrors = 0;
+  let model = null, startedAt = null, endedAt = null, complete = false, aborted = false, usageKnown = false, mixedModels = false;
   for (const t of s.turns) {
     // Only the child's own first message may carry the id; copied history does not count.
     if (!id && t.text) { const m = ROUTE_ID_RE.exec(t.text); if (m) id = m[1]; }
     tokens.input += t.input; tokens.cached += t.cached; tokens.cacheWrite += t.cacheWrite; tokens.output += t.out;
+    calls += t.calls; toolErrors += t.errors;
     if (model && t.model && model !== t.model) mixedModels = true;
     model ??= t.model;
     usageKnown ||= t.usageKnown;
     if (Number.isFinite(t.startedAt)) startedAt = Math.min(startedAt ?? t.startedAt, t.startedAt);
-    if (Number.isFinite(t.endedAt)) { endedAt = Math.max(endedAt ?? t.endedAt, t.endedAt); complete = !t.aborted; }
+    if (Number.isFinite(t.endedAt)) { endedAt = Math.max(endedAt ?? t.endedAt, t.endedAt); complete = !t.aborted; aborted = !!t.aborted; }
   }
+  if (!id && binds) id = binds.get(s.sessionId) ?? null;
   return id ? { id, sessionId: s.sessionId, parentThreadId: s.parentThreadId, provider: s.provider,
-    model, tokens, startedAt, endedAt, complete, usageKnown: usageKnown && !mixedModels } : null;
+    model, tokens, calls, toolErrors, startedAt, endedAt, complete, aborted, usageKnown: usageKnown && !mixedModels } : null;
 }
 
 /**
  * Join child rollouts to pending routes and price them. Savings hold the
  * child's tokens constant and price them at the parent model, the same
  * approximation Claude's ledger states. A route to a pricier model is a loss,
- * shown as one rather than clamped away.
+ * shown as one rather than clamped away. A child that was interrupted before
+ * it finished replaced no parent work (the parent did the task itself), so its
+ * whole cost is booked as a loss.
  */
 export async function refreshCodexLedger({ dir = userDataDir(), home, now = Date.now(), prices = readCodexPrices({ now, home, dir }) } = {}) {
+  try { pruneCodexDelegations({ dir, now }); } catch { /* Pruning is housekeeping; the TTL filter below still holds. */ }
   const pending = readCodexDelegations({ dir }).filter((r) => now - r.at < PENDING_TTL_MS);
   const ledger = loadCodexLedger({ dir });
   if (!pending.length) return ledger;
   const byId = new Map(pending.map((r) => [r.id, r]));
+  const bindMap = new Map(readCodexBindings({ dir }).filter((b) => byId.has(b.id)).map((b) => [b.childSessionId, b.id]));
   const oldest = Math.min(...pending.map((r) => r.at));
   const files = await discoverCodexSessionFiles({ home, days: Math.max(1, (now - oldest) / 86400000 + 1) });
   let changed = false;
@@ -98,7 +227,7 @@ export async function refreshCodexLedger({ dir = userDataDir(), home, now = Date
   for (const f of files.slice().reverse()) {
     if (f.mtime < oldest) continue;
     let run;
-    try { run = await childRun(f.path, oldest - 60000); } catch { continue; }
+    try { run = await childRun(f.path, oldest - 60000, bindMap); } catch { continue; }
     const route = run && byId.get(run.id);
     // The id must come from a spawn this parent made, after the record was written.
     if (!route || (route.parentSessionId && run.parentThreadId && route.parentSessionId !== run.parentThreadId)) continue;
@@ -110,15 +239,20 @@ export async function refreshCodexLedger({ dir = userDataDir(), home, now = Date
     const previous = ledger.events[route.id];
     const provider = route.provider || run.provider;
     const sameRun = previous?.childSessionId === run.sessionId && previous.to === to && previous.from === route.from;
+    // Priced by the path the child took: OpenAI list for direct calls, the gateway's prices for LiteLLM.
+    const book = codexPriceBook(provider, prices, { home });
     const rates = sameRun && previous.rates ? previous.rates
-      : prices?.provider === provider ? { from: prices.prices[route.from], to: prices.prices[to], checkedAt: prices.checkedAt } : null;
+      : book ? { from: book.prices[route.from], to: book.prices[to], checkedAt: book.checkedAt } : null;
+    const priceSource = !rates ? null : sameRun && previous.rates ? previous.priceSource ?? null : book?.source ?? null;
     const actual = rates && run.usageKnown ? codexRunCost(run.tokens, rates.to) : null;
     const counterfactual = rates && run.usageKnown ? codexRunCost(run.tokens, rates.from) : null;
-    const usd = actual === null || counterfactual === null ? null : counterfactual - actual;
+    const usd = actual === null || counterfactual === null ? null : roundUsd(run.aborted ? -actual : counterfactual - actual);
     const event = { ts: run.endedAt ?? route.at, parentSessionId: route.parentSessionId || run.parentThreadId || null,
       childSessionId: run.sessionId, source: route.source, category: route.category ?? null, scope: route.scope ?? null,
-      from: route.from, to, provider, tokens: run.tokens, usd, rates: usd === null ? null : rates,
-      priceCheckedAt: rates?.checkedAt ?? null, complete: run.complete };
+      from: route.from, to, provider,
+      ...(route.targetRoot !== undefined ? { targetRoot: route.targetRoot } : {}),
+      ...(route.ruleCreatedAt !== undefined ? { ruleCreatedAt: route.ruleCreatedAt } : {}), tokens: run.tokens, calls: run.calls, toolErrors: run.toolErrors, usd, rates: usd === null ? null : rates,
+      priceCheckedAt: rates?.checkedAt ?? null, priceSource, complete: run.complete, ...(run.aborted ? { aborted: true } : {}) };
     // A transient price outage must not erase a completed, unchanged priced run.
     if (usd === null && sameRun && previous.complete && Number.isFinite(previous.usd) &&
         JSON.stringify(previous.tokens) === JSON.stringify(run.tokens)) continue;

package/src/codex-panel.js

@@ -1,4 +1,4 @@
-import { resolve, relative, isAbsolute } from 'node:path';
+import { resolve, relative, isAbsolute, basename } from 'node:path';
 import { realpathSync, statSync } from 'node:fs';
 import { stat } from 'node:fs/promises';
 import { readPanelBinding } from './codex-panel-session.js';
@@ -9,7 +9,7 @@ import { loadConfig, statuslineDefaults } from './config.js';
 import { glyphsFor } from './glyphs.js';
 import { gaugeBar, formatMoney } from './formatters/statusline.js';
 import { codexCacheTimer } from './codex-cache.js';
-import { readCodexCachePolicy, readCodexPrices } from './codex-cache-policy.js';
+import { readCodexCachePolicy, readCodexPrices, isDirectOpenAI } from './codex-cache-policy.js';
 import { codexIssues } from './codex-brief.js';
 import { labelForKey } from './window-labels.js';
 import { resolveLabelMode } from './statusline-mode.js';
@@ -17,7 +17,9 @@ import { formatResetIn } from './format-time.js';
 import { codexDocumentTotals } from './codex-doc2md-ledger.js';
 import { codexHookStatus } from './codex-installer.js';
 import { koreanStyleEnabled } from './korean-style.js';
-import { codexRoutingSavedTotals } from './codex-ledger.js';
+import { codexRoutingSavedTotals, loadCodexLedger } from './codex-ledger.js';
+import { loadCodexModelRules } from './codex-delegation.js';
+import { codexRulesInReview } from './codex-rule-health.js';
 import { readCodexRouteScan, openCodexCandidates } from './codex-route-scan.js';
 import { codexBudgetProvider } from './codex-budget.js';
 
@@ -28,20 +30,22 @@ export const CODEX_SEGMENT_ORDER = [
 
 // Only cache full-session parses. A moving time cutoff would make an unchanged
 // file's cached totals stale. The panel reports session totals, not window totals.
+// Matches the candidate TTL: older runs could not contribute a candidate anyway.
+const RATCHET_SIBLING_MS = 30 * 60000;
+
 export function createPanelReader({ root = process.cwd(), home, sessionId: pinnedId, sessionFile, days = 7, readBudget = () => null,
   readCachePolicy = (session) => readCodexCachePolicy(session, { home }), hasFlag = () => false } = {}) {
   if (pinnedId && sessionFile) throw new Error('Choose --session or --session-file, not both.');
   const cache = new Map();
   const ratchetCache = new Map();
-  const ratchetFor = (session) => {
+  const ratchetFor = (session, siblings = []) => {
     if (!session?.filePath) return [];
     try {
-      const s = statSync(session.filePath);
-      const key = `${s.mtimeMs}:${s.size}`;
+      const key = [session.filePath, ...siblings].map((file) => { const s = statSync(file); return `${file}:${s.mtimeMs}:${s.size}`; }).join('|');
       // Candidates expire by age, so a quiet file still needs a periodic re-read.
       const hit = ratchetCache.get(session.filePath);
       if (hit?.key === key && Date.now() - hit.at < 60000) return hit.value;
-      const value = codexRatchetCandidates(session.filePath);
+      const value = codexRatchetCandidates(session.filePath, { siblings });
       ratchetCache.clear();
       ratchetCache.set(session.filePath, { key, at: Date.now(), value });
       return value;
@@ -62,26 +66,41 @@ export function createPanelReader({ root = process.cwd(), home, sessionId: pinne
     files ??= sessionFile && !sessionId ? [] : await discoverCodexSessionFiles({ home, days: sessionId ? Infinity : days });
     const existing = new Set(files.map((f) => f.path));
     for (const path of cache.keys()) if (!existing.has(path)) cache.delete(path);
+    // A rollout is named after its session id. With an id to look for, the
+    // files carrying it are parsed first; without this the first frame of a
+    // pinned panel parsed every rollout Codex has ever written to find one
+    // session. The full search still runs when no file by that name holds the
+    // session (a renamed rollout).
+    const named = sessionId ? files.filter((f) => basename(f.path).includes(sessionId)) : [];
+    const passes = named.length && named.length < files.length ? [named, files] : [files];
     let selected = null;
     let matches = 0;
-    const seen = new Set();
-    for (const f of files.slice().reverse()) {
-      let entry = cache.get(f.path);
-      if (!entry || entry.mtime !== f.mtime || entry.size !== f.size) {
-        try {
-          entry = { ...f, session: await parseCodexSessionFile(f.path) };
-          cache.set(f.path, entry);
-        } catch { continue; }
+    // Recent rollouts of the same project, for repeats across `codex exec` runs.
+    let recent = [];
+    for (const pass of passes) {
+      if (selected) break;
+      matches = 0;
+      recent = [];
+      const seen = new Set();
+      for (const f of pass.slice().reverse()) {
+        let entry = cache.get(f.path);
+        if (!entry || entry.mtime !== f.mtime || entry.size !== f.size) {
+          try {
+            entry = { ...f, session: await parseCodexSessionFile(f.path) };
+            cache.set(f.path, entry);
+          } catch { continue; }
+        }
+        const s = entry.session;
+        if ((!sessionId || sessionFile) && s.isSubagent) continue;
+        if (sessionId ? s.sessionId !== sessionId : !insideProject(root, s.projectDir)) continue;
+        const key = s.sessionId || s.filePath;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        matches++;
+        if (!sessionId && Date.now() - f.mtime < RATCHET_SIBLING_MS) recent.push(s.filePath);
+        // Activity timestamps survive archive moves that update filesystem mtime.
+        if (!selected || (s.lastActivity?.getTime() || 0) > (selected.lastActivity?.getTime() || 0)) selected = s;
       }
-      const s = entry.session;
-      if ((!sessionId || sessionFile) && s.isSubagent) continue;
-      if (sessionId ? s.sessionId !== sessionId : !insideProject(root, s.projectDir)) continue;
-      const key = s.sessionId || s.filePath;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      matches++;
-      // Activity timestamps survive archive moves that update filesystem mtime.
-      if (!selected || (s.lastActivity?.getTime() || 0) > (selected.lastActivity?.getTime() || 0)) selected = s;
     }
     const project = selected?.projectDir ? findProjectRoot(selected.projectDir, { agent: 'codex' }) : root;
     const cfg = loadConfig();
@@ -97,11 +116,16 @@ export function createPanelReader({ root = process.cwd(), home, sessionId: pinne
     }
     let route = [];
     try { route = openCodexCandidates(readCodexRouteScan(), { root: project }); } catch { /* No scan yet. */ }
+    let ruleReview = [];
+    try {
+      const modelRules = loadCodexModelRules();
+      if (modelRules.length) ruleReview = codexRulesInReview({ root: project, rules: modelRules, events: Object.values(loadCodexLedger().events) }).map((r) => r.index);
+    } catch { /* Unreadable rules or ledger show no chip. */ }
     let routingSaved = null;
-    try { routingSaved = { ...codexRoutingSavedTotals(), pricesAvailable: !!readCodexPrices({ provider: codexBudgetProvider(home ? { home } : {}), ...(home ? { home } : {}) }) }; }
+    try { routingSaved = { ...codexRoutingSavedTotals(), pricesAvailable: isDirectOpenAI(selected?.provider, home ? { home } : {}) || !!readCodexPrices({ provider: codexBudgetProvider(home ? { home } : {}), ...(home ? { home } : {}) }) }; }
     catch { /* Unreadable ledger reads as n/a. */ }
     return { session: selected, matches, root, sessionId, selection, bindingPending: !!sessionFile && !sessionId, days, harness, rules,
-      ratchet: ratchetFor(selected), route, routingSaved,
+      ratchet: ratchetFor(selected, recent.filter((file) => file !== selected?.filePath)), route, ruleReview, routingSaved,
       labelMode: resolveLabelMode({ cfg: statuslineDefaults(), hasFlag }).mode,
       color: statuslineDefaults().color,
       timer: !hasFlag('--no-timer') && (hasFlag('--timer') || statuslineDefaults().timer),
@@ -261,6 +285,7 @@ function panelGroups(data, { now, version = '', full = false, mode = full ? 'tex
     chip(`Ratchet ${data.rules?.global ?? '?'}/${data.rules?.project ?? '?'}`),
     // A repeated failure outranks a delegation candidate, as in the Claude statusline.
     data.ratchet?.length ? chip(`ratchet? #${data.ratchet[0].id} x${data.ratchet[0].count}`, 33) : null,
+    data.ruleReview?.length ? chip(`rule-health #${data.ruleReview[0]}${data.ruleReview.length > 1 ? ` +${data.ruleReview.length - 1}` : ''}`, 33) : null,
     data.route?.length ? chip(`route? R${data.route[0].id} ${terminalText(data.route[0].category)}${data.route.length > 1 ? ` +${data.route.length - 1}` : ''}`, 33) : null,
   ]);
   register('korean', 'preferences', [