[merefield]

Why

Codexometer's last explicit native compatibility target was Codex 0.164.0. Reviewing the full 0.164.0 → 0.166.0 delta identified new failure codes, richer item lifecycle timestamps and thread-specific hook inventories. This PR adopts those small, useful additions without broadening write permissions or changing quota/token accounting. It also adds opt-in operational diagnostics so configuration-access failures behind incomplete-coverage warnings can be traced to the actual filesystem operation, path and OS error.

Changes

Clearer confirmed failures, shared by terminal and web

• Distinguish MODEL UNAVAILABLE (modelNotFound) and CAPACITY RESTRICTED (policyCapacityUnavailable) from ordinary MODEL BUSY and generic TURN FAILED.
• Accept camelCase app-server and snake_case rollout codes, including externally tagged variants; retain unknown-code fallbacks and the upstream explanation.
• Keep both new states in Errors and attention navigation. Browser failure detection follows an explicit shared-backend attention flag rather than display labels or saved error text. Inactive/idle/working sessions can retain historical errors without creating false alerts; stale refreshes clear current failure classification.
• Preserve retrying/current-turn safeguards: no automatic retry, model change or inference of quota exhaustion.
• Add the two terminal labels to all 17 language catalogues.

Recorded command timing

• Add elapsed/completed duration to working-command headings in terminal rows/full detail and web rows/full detail when valid timestamps are available.
• Prefer 0.166.0 item-level startedAtMs / completedAtMs; support older envelope fields and preserve a matching command's start when completion omits it.
• Do not invent timing for missing, future or inconsistent values. Parallel commands keep their own timing. Completed durations stop advancing; browser timing is calculated at the last successful snapshot and does not run on through a stale connection. Terminal compact, wide and full-detail views omit running elapsed time when telemetry is stale; recorded completed durations remain available.
• These are display-only timestamps: freshness and API-EQ/token totals remain unchanged.

Session-aware, read-only hook discovery

• Query hooks/list with the selected loaded threadId, allowing 0.166.0 to include that session's environment hooks and environment provenance.
• Retain directory discovery for older servers that reject the new field or ignore it and return their unrelated default directory.
• Do not conceal a real thread/permission/transport failure by silently substituting another inventory. Successful empty thread inventories remain empty without a directory fallback. Hook entries remain browse-only.

Opt-in operational diagnostics

• Add --error-log PATH and optional --verbose, backed by standard-library log/slog and shared by terminal/web modes. Logging remains off by default; -v retains its version meaning.
• Capture actionable configuration stat/open/read errors and safe telemetry/RPC/launch failures. Verbose context identifies local fallback versus effective daemon coverage.
• Bound the single JSON-lines file to 2 MiB (older entries discarded at the cap, including an oversized existing file at startup before any records are emitted), rate-limit identical events, restrict file permissions where supported and reject unavailable/symlink/non-regular destinations at startup. Runtime log-write errors are reported when the interface exits.
• Exclude raw API bodies/messages, prompts, replies, configuration contents, credentials and pairing URLs. Paths and short session IDs remain diagnostic metadata; users are advised to review logs before sharing.

Fix the configuration-coverage false positive identified by diagnostics

• Treat ENOTDIR during an optional config probe as absence, just like a missing file. A regular .codex entry in the working directory or an ancestor cannot contain config.toml; it no longer raises background usage configuration could not be read or blocks quota learning solely for that reason.
• Continue checking higher ancestors, and do not cache absence: a real config created later is still detected.
• Preserve coverage warnings for actual permission/I/O errors, symlink loops and malformed existing configs. Non-directory optional paths are normal debug events, not error-log failures. No user files are deleted or changed.
• Propagate configuration read/close failures without caching the failed check, so transient filesystem failures are retried even when the file's metadata is unchanged.
• Regression tests reproduced the reported warning before the fix and now cover working-directory and ancestor markers, higher real configs, file-to-directory transitions and retained genuine-error safeguards.

Compatibility coverage and documentation

• Regress error recovery, legacy timing, invalid/parallel timing, older-server hooks fallbacks and readonly behaviour.
• Lock down reviewer thread/turn isolation in benchmarks, and attached forks remaining independent rather than being grouped as spawned agents or recounting inherited exact response records.
• Generalise the optional native compressed-WebSocket test to target 0.164.0 or 0.166.0 explicitly, preserving the existing 0.164 environment flag.
• Update README and the maintained forum intro; regenerate embedded frontend assets.

Model/reasoning, permissions and Plan writes retain their current idle-state guards. This PR does not introduce memory inspection, enterprise billing displays, attached-fork management or workspace switching.

Validation

• go vet ./...
• Full core suite with -race -cover -timeout 10m, excluding the separately run locale matrix.
• All 17 localised terminal-screen variants with race/coverage instrumentation.
• Uncached compatibility regressions with race detection, including real Unix-socket fixture tests.
• Actual installed Codex 0.166.0: isolated, unauthenticated native compressed-WebSocket handshake and inventory/list RPCs (no user sessions, credentials or model requests).
• Native Windows execution of the new compatibility regressions and existing session-failure tests.
• Logging tests cover concurrency/race safety, repeat suppression, appending across runs, bounded-file wrap (including the Windows non-append-only handle requirement), privacy, invalid destinations and actual configuration-filesystem failures. Logger and coverage logging tests also pass natively on Windows.
• Svelte/TypeScript checks, frontend formatting and production build.
• All 96 browser tests.
• Local Linux binary rebuilt.

Authenticated real-world approvals/billing were not exercised by the isolated native check. Existing 0.164.0 compatibility is retained through fixtures and the optional checker; a second installed 0.164.0 binary was not used for this validation.

Upstream references

• Codex 0.165.0
• Codex 0.166.0
• Item lifecycle timestamps
• Policy-restricted capacity failures
• Thread/environment hook discovery

[Copilot]

🟡 Changes recommended

A critical formatting issue in internal/ui/monitor_working.go will cause the repository’s gofmt CI check to fail because the standard-library time import is grouped after third-party imports.

1 open issue

• Group standard-library imports before external imports · New

What changed in this PR

This pull request improves Codexometer compatibility with Codex 0.165–0.166 by adding clearer failure classifications, server-recorded command timing, and thread-aware hook discovery while preserving read-only behavior and existing accounting safeguards.

Changes:

• Adds MODEL UNAVAILABLE and CAPACITY RESTRICTED handling across terminal, web, and localized interfaces.
• Displays validated command durations using Codex lifecycle timestamps with legacy compatibility.
• Adds session-scoped hook discovery with controlled fallbacks, expands regression coverage, updates documentation, and regenerates frontend assets.

This pull request requires changes.

File	Summary
web/​tests/​browser.spec.ts	Updates browser coverage for command timing and new failure states.
web/​src/​state.svelte.ts	Adds the optional browser command-timing field.
web/​src/​Sessions.svelte	Classifies shared failure contexts and renders command timing.
README.md	Documents failure labels, timing, hooks, and compatibility checks. Nit (1 vote): a later summary still omits the new failure states.
intro-post.md	Updates the maintained introductory feature description.
internal/​web/​state.go	Projects command timing into web session snapshots.
internal/​web/​session_failure_test.go	Tests web classification of new failure codes.
internal/​web/​server_test.go	Tests timing projection and context cleanup.
internal/​web/​dist/​index.html	References the regenerated frontend bundle.
internal/​web/​dist/​assets/​index-Cq0BuLLm.js	Regenerated frontend bundle containing the new UI behavior.
internal/​ui/​monitor_working.go	Adds elapsed and completed timing to terminal command headings. Critical (1 vote): standard-library imports are not grouped correctly, causing the repository formatting check to fail.
internal/​ui/​monitor_working_test.go	Tests duration rendering and responsive terminal layout.
internal/​ui/​monitor_failure_test.go	Expands terminal failure coverage for the new classifications.
internal/​i18n/​locales/​zh-Hans.json	Adds Chinese translations for the new failure labels.
internal/​i18n/​locales/​tr.json	Adds Turkish translations for the new failure labels.
internal/​i18n/​locales/​sv.json	Adds Swedish translations for the new failure labels.
internal/​i18n/​locales/​ru.json	Adds Russian translations for the new failure labels.
internal/​i18n/​locales/​pt-PT.json	Adds European Portuguese translations for the new failure labels.
internal/​i18n/​locales/​pt-BR.json	Adds Brazilian Portuguese translations for the new failure labels.
internal/​i18n/​locales/​nl.json	Adds Dutch translations for the new failure labels.
internal/​i18n/​locales/​nb.json	Adds Norwegian translations for the new failure labels.
internal/​i18n/​locales/​ja.json	Adds Japanese translations for the new failure labels.
internal/​i18n/​locales/​it.json	Adds Italian translations for the new failure labels.
internal/​i18n/​locales/​fr.json	Adds French translations for the new failure labels.
internal/​i18n/​locales/​fi.json	Adds Finnish translations for the new failure labels.
internal/​i18n/​locales/​et.json	Adds Estonian translations for the new failure labels.
internal/​i18n/​locales/​es.json	Adds Spanish translations for the new failure labels.
internal/​i18n/​locales/​en-GB.json	Adds English catalogue entries for the new failure labels.
internal/​i18n/​locales/​de.json	Adds German translations for the new failure labels.
internal/​i18n/​locales/​da.json	Adds Danish translations for the new failure labels.
internal/​codex/​session_settings_unix_test.go	Extends the Unix daemon fixture for thread-scoped hook requests and failures.
internal/​codex/​session_hooks_unix.go	Implements thread-aware hook discovery with legacy fallback handling. Moderate (1 vote): successful empty thread inventories can incorrectly fall back to unrelated directory hooks.
internal/​codex/​session_hooks_unix_test.go	Tests thread-scoped inventories, fallbacks, errors, and read-only behavior.
internal/​codex/​session_failure.go	Normalizes and classifies new app-server and rollout failure codes.
internal/​codex/​session_context_daemon.go	Parses item and envelope lifecycle timestamps.
internal/​codex/​session_commands_unix.go	Routes hook catalogues through session-aware discovery and displays provenance.
internal/​codex/​session_activity.go	Stores command lifecycle timestamps and calculates validated durations.
internal/​codex/​session_166_test.go	Adds compatibility, timing, reviewer-isolation, and attached-fork regression coverage.
internal/​codex/​daemon_native_unix_test.go	Generalizes the optional native compatibility test to Codex 0.164.0 and 0.166.0.

_{Review effort: Lite}

[merefield]

Addressed all findings from the review, including the two summary-only observations, in 107cdd6:

• Import grouping: move the standard-library time import ahead of external imports in its own group. Both the old and new versions are gofmt-clean; the requested conventional grouping is now in place.
• Empty thread hooks: preserve a successful empty thread inventory instead of querying directory hooks. A new real Unix-socket regression reproduced the old incorrect fallback before the fix and passes afterward. Both data: [] and a matching cwd entry with hooks: [] assert no fallback; the existing ignored-selector, rejected-selector, populated-thread and real-thread-error scenarios still pass. Discovery remains read-only.
• README consistency: update the later web status summary to include MODEL UNAVAILABLE and CAPACITY RESTRICTED, and explicitly document authoritative empty hook inventories.

Validation: gofmt -l . (no output), git diff --check, go vet ./..., and race-enabled command discovery, plain/compressed settings compatibility, all six hook scenarios, terminal responsive timing and web timing-projection tests passed. Local Linux and Windows binaries rebuilt from the fix commit. GitHub CI reruns on the pushed commit.

[Copilot]

🟡 Changes recommended

Two moderate active issues remain: a filesystem close failure can be discarded and cached as success, and an oversized existing log file is not normalized until a later write.

1 open issue

• Truncate oversized existing logs when opening · New

1 previously missed issue

In code that hasn't changed since last review

Propagate close failures and avoid caching the result

internal/​codex/​usage_coverage.go:140

A close failure is logged here but then discarded, so the function can still return a clean coverage result and cache a configuration whose filesystem read was not fully successful. The PR promises that actual I/O errors retain the coverage warning; return the read/access failure (and avoid caching a successful check) when Close fails.

1 resolved since last review

• Group standard-library imports before external imports

_{Review effort: Lite}

[merefield]

Also addressed the summary-only finding Propagate close failures and avoid caching the result in 1031651.

Configuration read and close failures are now both logged and return the existing could-not-be-verified coverage warning before cache insertion. The file is closed even after a read error. A subsequent check retries unchanged file metadata instead of reusing a successful or failed cached read.

Fault-injection regressions cover read failure, close failure after a successful read, and both failures together. They assert the coverage warning, close attempt, both applicable log operations, absence of cached results and successful recovery on the same unchanged file. All pass with Linux race detection and on native Windows. Full Codex/diagnostics suites, go vet and formatting checks pass. Local Linux and Windows binaries rebuilt from the new commits.

[merefield]

Addressed both findings from the final independent review in 2f0acff:

• Historical errors are not current attention: browser error counts, warning styling and attention pills now use an explicit flag projected from the shared backend attention classification. Inactive, idle and working sessions can retain historical error context without generating false alerts. Failed refreshes clear the live failure flag, and successful refreshes restore the verified classification.
• Stale terminal timers: compact, wide and full-detail views omit running elapsed time when telemetry is unavailable or the monitor is not running. Recorded completed durations remain visible and unchanged.

Both regression scenarios failed before the fix. Validation: full core Go suite with race detection and coverage (locale matrix excluded), go vet, frontend type/format checks, all 96 browser tests, and native Windows execution of the new terminal/web projection regressions. Embedded frontend assets regenerated; clean local Linux and Windows builds updated to 0.24.1-7-g2f0acff.