unsnooze 1.19.0 → 1.19.2

package/src/watchers/codex.js

@@ -1,20 +1,39 @@
 // Codex rollout watcher: parses lines appended to session rollout files
 // (~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl) into limit-stop candidates.
 //
-// Codex never persists Error/StreamError events to rollouts (confirmed in
-// codex-rs/rollout policy), so the limit banner text is NOT in the file. What
-// IS persisted is a token_count event per turn carrying a rate_limits
-// snapshot — used_percent per window plus an exact resets_at epoch:
-//   {"type":"event_msg","payload":{"type":"token_count","rate_limits":{
-//     "primary":{"used_percent":100,"window_minutes":300,"resets_at":1778672230},
-//     "secondary":{"used_percent":1,"window_minutes":10080,"resets_at":...},
-//     "rate_limit_reached_type":null}}}
-// That epoch is more precise than any scraped banner, and rollouts are shared
-// by every Codex surface (CLI, IDE extension, desktop app).
+// Two signals are persisted, and either one is a stop:
+//
+// 1. A token_count event per turn carrying a rate_limits snapshot —
+//    used_percent per window plus an exact resets_at epoch:
+//      {"type":"event_msg","payload":{"type":"token_count","rate_limits":{
+//        "primary":{"used_percent":100,"window_minutes":300,"resets_at":1778672230},
+//        "secondary":{"used_percent":1,"window_minutes":10080,"resets_at":...},
+//        "rate_limit_reached_type":null}}}
+//    That epoch is more precise than any scraped banner, so it governs
+//    whenever it is present.
+//
+// 2. Since codex-cli 0.145 the failed turn's task_complete carries the
+//    error itself, with the same banner text the TUI renders:
+//      {"type":"event_msg","payload":{"type":"task_complete","error":{
+//        "message":"You've hit your usage limit. … try again at Jul 30th, 2026 10:33 AM.",
+//        "codex_error_info":"usage_limit_exceeded"}}}
+//    This is the ONLY signal when Codex runs behind an OpenAI-compatible
+//    proxy (model_providers.<x>.base_url): the proxy answers with its own
+//    response, the X-Codex-* rate-limit headers never reach Codex, and every
+//    snapshot arrives as {primary:null, secondary:null}. The message goes
+//    through the same time-parser as a scraped pane, so the reset lands on
+//    the banner's own clock time (or the probe fallback for "Try again later.").
+//
+// Rollouts are shared by every Codex surface (CLI, IDE extension, desktop app).
+// A bare 429 ("exceeded retry limit, last status: 429 Too Many Requests",
+// codex_error_info.response_too_many_failed_attempts) is NOT a stop here —
+// it carries no reset time, and the pane path files it under transient
+// overload for the same reason.
 
 import { openSync, readSync, closeSync } from 'node:fs';
 import { basename } from 'node:path';
-import { ROLLOUT_RE } from '../agents/codex.js';
+import { ROLLOUT_RE, patterns as codexPatterns } from '../agents/codex.js';
+import { detectLimit } from '../patterns.js';
 // Usage extractor lives in usage.js (shared cold path + daemon); re-exported
 // here so the plan's watcher surface is the documented import site.
 export { extractCodexUsage } from '../usage.js';
@@ -33,11 +52,84 @@ function rolloutSnapshot(line) {
   return entry;
 }
 
+// The failed turn's task_complete error, when it is a usage limit. The turn
+// also ends in task_complete for stream errors, retry exhaustion and
+// cancellations, so only the banner itself qualifies — not the structured
+// marker alone: codex-rs (protocol/src/error.rs, to_codex_protocol_error)
+// sends codex_error_info "usage_limit_exceeded" for "Quota exceeded. Check
+// your plan and billing details." and "To use Codex with your ChatGPT plan,
+// upgrade to Plus…" too, which no amount of waiting clears. Every real usage
+// limit it words ("You’ve hit your usage limit…", "Your workspace is out of
+// credits…", "You hit your spend cap…") carries a banner anchor.
+// codex-rs words the workspace walls (UsageLimitReachedError's Display):
+// "Your workspace is out of credits. …" and "You hit your spend cap set …".
+const WORKSPACE_WALL_BANNER = /Your workspace is out of credits|hit your spend cap/i;
+
+function rolloutLimitError(line) {
+  // Every line that is not a snapshot lands here, and rollout lines can be
+  // large (tool output): skip the second JSON.parse unless it can be a match.
+  if (!line || !line.includes('"task_complete"')) return null;
+  let entry;
+  try { entry = JSON.parse(line); } catch { return null; }
+  if (entry?.type !== 'event_msg' || entry.payload?.type !== 'task_complete') return null;
+  const error = entry.payload.error;
+  if (!error || typeof error !== 'object') return null;
+  const message = typeof error.message === 'string' ? error.message.trim() : '';
+  if (!message) return null;
+  // The message as pane text, with the same anchors and the same reset-line
+  // selection as the scraped TUI — so the two paths cannot disagree about a
+  // banner. All of it (tail 0): a message that wraps its reset time onto a
+  // second line must still be read whole.
+  const detected = detectLimit(message, 0, codexPatterns);
+  if (!detected.hit) return null;
+  const ts = entry.timestamp ? Date.parse(entry.timestamp) : NaN;
+  // A workspace wall says what it is in words, with no time to try again at.
+  // Behind a proxy no snapshot is there to classify it, so the banner files
+  // it the way parseSnapshot files a workspace reason with no spent window:
+  // a model limit — probed, then held for a human, never woken into.
+  const wall = WORKSPACE_WALL_BANNER.test(message);
+  return {
+    limitType: wall ? 'model' : detected.limitType,
+    resetAt: null,
+    resetLine: wall ? null : (detected.resetLine || message),
+    reachedType: null,
+    timestampMs: Number.isFinite(ts) ? ts : null,
+  };
+}
+
 function emptyPremium(rl) {
-  return rl.limit_id === 'premium' && rl.primary === null && rl.secondary === null
-    && rl.credits?.has_credits === false && rl.credits?.unlimited === false
-    && rl.credits?.balance != null && rl.credits.balance !== ''
-    && Number(rl.credits.balance) === 0;
+  if (!(rl.limit_id === 'premium' && rl.primary === null && rl.secondary === null
+    && rl.credits?.has_credits === false && rl.credits?.unlimited === false)) return false;
+  if (rl.credits?.balance != null && rl.credits.balance !== '') {
+    return Number(rl.credits.balance) === 0;
+  }
+  // Workspace plans (Business/Team) send the same empty bucket with no balance
+  // at all, and say why in rate_limit_reached_type instead.
+  return workspaceWall(rl.rate_limit_reached_type);
+}
+
+// rate_limit_reached_type names WHY the server refused, never a window. The
+// enum (codex-rs/protocol) is rate_limit_reached and four workspace_* values:
+// {owner,member}_credits_depleted and {owner,member}_usage_limit_reached. The
+// workspace ones are a wall that no window reset takes down by itself: Codex
+// words them "Your workspace is out of credits…" / "You hit your spend cap…",
+// with no time to try again at. A window that is spent as well is another
+// matter — its reset brings the plan's own allowance back (parseSnapshot).
+function workspaceWall(reachedType) {
+  return typeof reachedType === 'string' && reachedType.startsWith('workspace_');
+}
+
+// A window counts as spent from 99%: the server reports fractions, and #20's
+// real stop read 99.0 (the same line the empty-premium inference draws).
+const SPENT_PERCENT = 99;
+
+// The window a "limit reached" is about when none reads 100: the one nearest
+// exhaustion, primary on a tie. The server reports fractional percentages and
+// #20's real stop read 99.0, so ">= 100" alone is not the whole story. (The
+// previous rule took the window with the LATEST reset, which for any
+// rate_limit_reached under 100% was the weekly one — days out.)
+function nearestExhausted(windows) {
+  return windows.reduce((a, b) => ((b.used_percent ?? 0) > (a?.used_percent ?? -1) ? b : a), null);
 }
 
 // With several exhausted windows, the latest reset governs: resuming at an
@@ -46,19 +138,45 @@ function parseSnapshot(entry, previous = null) {
   if (!entry) return null;
   const rl = entry.payload.rate_limits;
   const ts = entry.timestamp ? Date.parse(entry.timestamp) : NaN;
+  const reachedType = rl.rate_limit_reached_type || null;
 
   const windows = ['primary', 'secondary']
     .map(k => rl[k])
     .filter(w => w && typeof w === 'object');
   let binding = null;
+  // The rate-limit bucket the binding window belongs to (Codex defaults a
+  // missing limit_id to "codex"). parseRolloutLines pairs errors by it.
+  let bucket = rl.limit_id ?? 'codex';
   const exhausted = windows.filter(w => (w.used_percent ?? 0) >= 100);
   if (exhausted.length > 0) {
     binding = exhausted.reduce((a, b) => ((b.resets_at || 0) > (a.resets_at || 0) ? b : a));
-  } else if (rl.rate_limit_reached_type) {
-    const named = rl[rl.rate_limit_reached_type];
-    binding = (named && typeof named === 'object')
-      ? named
-      : windows.reduce((a, b) => ((b.resets_at || 0) > (a?.resets_at || 0) ? b : a), null);
+  } else if (workspaceWall(reachedType) && windows.length > 0) {
+    const spent = windows.filter(w => (w.used_percent ?? 0) >= SPENT_PERCENT);
+    if (spent.length > 0) {
+      // The plan's window is spent too (99.x% is as spent as 100): its reset
+      // brings the allowance back, so it governs exactly like an exhausted
+      // one — otherwise the same stop reads as a waitable 5h stop at 100.0
+      // and as a wall to hold for a human at 99.9.
+      binding = spent.reduce((a, b) => ((b.resets_at || 0) > (a.resets_at || 0) ? b : a));
+    } else {
+      // Out of credits (or over the workspace cap) with no window spent:
+      // there is no reset to sleep until. Record it the way a model limit is
+      // recorded — no reset time, so the resumer probes and, at the ceiling,
+      // makes the stall visible with the adapter's remedy instead of waking
+      // into the same wall (#25 saw one of these scheduled as a 5h stop).
+      // Only from a snapshot that describes windows: a credits-only bucket
+      // (premium/null) carrying the reason must not re-file the 5h stop the
+      // account bucket recorded a moment earlier as a probe.
+      return {
+        limitType: 'model',
+        resetAt: null,
+        reachedType,
+        timestampMs: Number.isFinite(ts) ? ts : null,
+        bucket,
+      };
+    }
+  } else if (reachedType) {
+    binding = nearestExhausted(windows);
   }
   // #20: Codex can stop at a reported 99%, then emit an empty premium bucket
   // instead of a 100% snapshot. Infer a stop only for that transition,
@@ -73,6 +191,7 @@ function parseSnapshot(entry, previous = null) {
         && Number.isFinite(primary.used_percent) && primary.used_percent >= 99
         && Number.isFinite(primary.resets_at) && primary.resets_at * 1000 > ts) {
       binding = primary;
+      bucket = prior.limit_id;
       const secondary = prior.secondary;
       if (Number.isFinite(secondary?.used_percent) && secondary.used_percent >= 100
           && Number.isFinite(secondary.resets_at) && secondary.resets_at > binding.resets_at) {
@@ -85,13 +204,14 @@ function parseSnapshot(entry, previous = null) {
   return {
     limitType: labelWindow(binding.window_minutes),
     resetAt: binding.resets_at ? binding.resets_at * 1000 : null,
-    reachedType: rl.rate_limit_reached_type || null,
+    reachedType,
     timestampMs: Number.isFinite(ts) ? ts : null,
+    bucket,
   };
 }
 
 export function parseRolloutLine(line) {
-  return parseSnapshot(rolloutSnapshot(line));
+  return parseSnapshot(rolloutSnapshot(line)) || rolloutLimitError(line);
 }
 
 // Look immediately before the appended batch, not at the file's current EOF:
@@ -116,18 +236,72 @@ function previousSnapshot(path, offset) {
   return null;
 }
 
+// A snapshot stop and the task_complete error of the same turn describe one
+// event: keep the epoch (exact) and let the banner only fill in what the
+// snapshot lacks. Bound the pairing to the same batch and a short window so a
+// stale exhausted snapshot never lends its epoch to a later, unrelated stop —
+// and to a stop that still stands when the error is written: its epoch must
+// not have passed yet, and no later reading of the same bucket may show it
+// cleared. Only the same bucket: Codex writes one token_count line per
+// rate-limit bucket per response, so a healthy `codex_other` line right after
+// an exhausted account line says nothing about the account.
+const SNAPSHOT_PAIR_WINDOW_MS = 5 * 60_000;
+
+function describesWindows(rl) {
+  return ['primary', 'secondary'].some(k => rl[k] && typeof rl[k] === 'object');
+}
+
 export function parseRolloutLines(lines, { path, offset } = {}) {
   let previous;
+  let lastSnapshotHit = null;
   const hits = [];
   for (const line of lines) {
     const snapshot = rolloutSnapshot(line);
-    if (!snapshot) continue;
-    if (previous === undefined && emptyPremium(snapshot.payload.rate_limits)) {
-      previous = previousSnapshot(path, offset);
+    if (snapshot) {
+      if (previous === undefined && emptyPremium(snapshot.payload.rate_limits)) {
+        previous = previousSnapshot(path, offset);
+      }
+      const hit = parseSnapshot(snapshot, previous);
+      if (hit) {
+        hits.push(hit);
+        lastSnapshotHit = hit;
+      } else if (lastSnapshotHit) {
+        const rl = snapshot.payload.rate_limits;
+        if ((rl.limit_id ?? 'codex') === lastSnapshotHit.bucket && describesWindows(rl)) {
+          lastSnapshotHit = null;
+        }
+      }
+      previous = snapshot;
+      continue;
+    }
+    const error = rolloutLimitError(line);
+    if (!error) continue;
+    const stop = lastSnapshotHit;
+    const paired = stop
+      && Number.isFinite(error.timestampMs) && Number.isFinite(stop.timestampMs)
+      && error.timestampMs >= stop.timestampMs
+      && error.timestampMs - stop.timestampMs <= SNAPSHOT_PAIR_WINDOW_MS
+      // A workspace wall has no epoch to lend, and pairs anyway (below).
+      && (stop.resetAt ? stop.resetAt > error.timestampMs : stop.limitType === 'model');
+    if (paired) {
+      error.resetAt = stop.resetAt;
+      error.reachedType = stop.reachedType;
+      if (stop.limitType === 'model') {
+        // The snapshot already said what this is: a workspace wall (credits
+        // depleted, workspace cap) that no reset takes down. The banner must
+        // not turn it back into a waitable stop — probe, then hold for a
+        // human, exactly as parseSnapshot filed it.
+        error.limitType = 'model';
+        error.resetLine = null;
+      } else if (error.limitType === 'unknown'
+        // A workspace-wall banner over a spent window: the snapshot already
+        // weighed the reason against the window, and the window's reset
+        // brings the allowance back. Other model limits keep their label.
+        || (error.limitType === 'model' && workspaceWall(stop.reachedType))) {
+        error.limitType = stop.limitType;
+      }
     }
-    const hit = parseSnapshot(snapshot, previous);
-    if (hit) hits.push(hit);
-    previous = snapshot;
+    hits.push(error);
   }
   return hits;
 }

package/src/which.js

@@ -0,0 +1,63 @@
+// Where a bare command name would be found: the first PATH entry holding one
+// of `names`, as {dir, name, path}, or null. Path rules follow the platform
+// being resolved for, not the host: on Windows the delimiter is ';' and every
+// absolute entry contains a ':' (C:\...), so a ':' split shreds the list into
+// nonsense and always answers "not on PATH" there (#25).
+
+import { existsSync } from 'node:fs';
+import { win32, posix } from 'node:path';
+
+export function findOnPath(names, { env = process.env, exists = existsSync, platform = process.platform } = {}) {
+  const api = platform === 'win32' ? win32 : posix;
+  for (const entry of (env.PATH || '').split(api.delimiter)) {
+    // Windows PATH entries may be quoted ("C:\Program Files\x"); spawn's own
+    // search (libuv) strips the quotes, so this one must too.
+    const dir = platform === 'win32' ? entry.replace(/^(["'])(.*)\1$/, '$2') : entry;
+    if (!dir) continue;
+    for (const name of names) {
+      const path = api.join(dir, name);
+      try { if (exists(path)) return { dir, name, path }; } catch { /* unreadable entry */ }
+    }
+  }
+  return null;
+}
+
+// The spellings a bare name can take on this platform, launchable first.
+// Node's spawn resolves .exe/.com itself; .cmd/.bat need a shell it is not
+// given, so they are "found" in the sense that explains a failure.
+export function candidateNames(name, platform = process.platform) {
+  if (platform !== 'win32') return [name];
+  if (/\.(exe|com|cmd|bat)$/i.test(name)) return [name];
+  return [`${name}.exe`, `${name}.com`, `${name}.cmd`, `${name}.bat`];
+}
+
+// Resolve what spawn(bin) would actually run: an absolute or relative path is
+// checked as-is; a bare name is searched on PATH. Returns
+// { path, launchable } or null when nothing is found.
+export function resolveBin(bin, { env = process.env, exists = existsSync, platform = process.platform } = {}) {
+  if (typeof bin !== 'string' || bin === '') return null;
+  const shim = p => /\.(cmd|bat)$/i.test(p);
+  // Anything with a separator of either flavour is a path, checked as given —
+  // spawn does the same, and a Windows-shaped path handed to a POSIX lookup
+  // (doctor's own tests simulate one platform on another) must not be
+  // searched on PATH as if it were a bare name.
+  if (win32.isAbsolute(bin) || posix.isAbsolute(bin) || bin.includes('/') || bin.includes('\\')) {
+    // On Windows spawn tries an extensionless path as .com then .exe
+    // (UNSNOOZE_CODEX_BIN=C:\tools\codex runs C:\tools\codex.exe). The literal
+    // path stays the fallback, for a POSIX-shaped path checked under Windows
+    // rules (doctor's tests simulate one platform on the other).
+    if (platform === 'win32' && !win32.extname(bin)) {
+      const hit = [`${bin}.com`, `${bin}.exe`].find(p => exists(p));
+      if (hit) return { path: hit, launchable: true };
+    }
+    return exists(bin) ? { path: bin, launchable: !shim(bin) } : null;
+  }
+  // Two passes, because spawn never tries a .cmd/.bat (libuv only appends
+  // .com and .exe): an .exe anywhere on PATH is what runs, even behind a shim
+  // in an earlier directory — the npm shim a native install left behind.
+  // Only when nothing launchable exists is a shim the answer, as the reason.
+  const names = candidateNames(bin, platform);
+  const opts = { env, exists, platform };
+  const hit = findOnPath(names.filter(n => !shim(n)), opts) || findOnPath(names.filter(shim), opts);
+  return hit ? { path: hit.path, launchable: !shim(hit.path) } : null;
+}

package/src/wizard.js

@@ -77,14 +77,18 @@ export async function runWizard() {
   });
   if (p.isCancel(notifications)) return cancelled();
 
-  // GUI watching: only meaningful where an autostart daemon can run. Windows
-  // joined that list with the Task Scheduler unit — and needs it most, since
-  // headless has no pane monitor and the transcript watcher lives in the daemon.
+  // GUI watching: only meaningful where the daemon can run. Windows needs it
+  // most, since headless has no pane monitor and the transcript watcher lives
+  // in the daemon — and there it is started on demand, with nothing registered
+  // to run at sign-in (see DAEMON_ON_DEMAND in config.js).
   let guiWatch = false;
   if (['darwin', 'linux', 'win32'].includes(process.platform)) {
+    const how = process.platform === 'win32'
+      ? 'started on demand by your agents — nothing runs at sign-in'
+      : (process.platform === 'darwin' ? 'launchd' : 'systemd');
     const answer = await p.confirm({
       message: 'Also guard GUI sessions (Claude Code in VS Code/desktop, Codex app/IDE)?\n'
-        + '  Installs a small background daemon (launchd/systemd/Task Scheduler) that watches session\n'
+        + `  Runs a small background daemon (${how}) that watches session\n`
         + '  files for limit stops; revived sessions open in the configured multiplexer and stay visible in\n'
         + '  the GUI\'s own history.',
       initialValue: DEFAULTS.guiWatch,

package/src/workspace.js

@@ -7,9 +7,12 @@
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 
+// windowsHide: this runs in the daemon and the resumer, which have no console
+// on Windows, so git would otherwise flash a console window of its own at
+// every stop and every wake.
 function git(cwd, args) {
   return execFileSync('git', ['-C', cwd, ...args], {
-    stdio: ['ignore', 'pipe', 'ignore'], timeout: 1500,
+    stdio: ['ignore', 'pipe', 'ignore'], timeout: 1500, windowsHide: true,
   }).toString().trim();
 }