Improve Codex reliability, quota, and Windows pet behavior

[ziyuezhou1]

Problems addressed

1. Windows dragging and popup resizing could move the pet, especially near screen edges and with fractional display scaling.
2. Current Codex lifecycle state could be missed when relying on rollout files alone, and failed hook delivery could lose the first event during recovery.
3. Long-lived, resumed, and subagent sessions could lose or fragment state.
4. On Windows, Codex rollout activity could be missed when the file grew but LastWriteTime did not advance.
5. Weekly Codex quota could be misidentified when the seven-day bucket appeared as either the primary or secondary limit.

What changed

• Move drag ownership into the Electron main process and preserve one absolute cursor/window origin and logical size throughout a drag.
• Keep popup windows inside the work area while an internal content offset preserves the pet's visual position at both horizontal edges.
• Install merge-safe, self-healing Codex lifecycle hooks while preserving unrelated hooks; intentional Quit suppresses recovery.
• Persist and replay failed hook events only after the recovered server is listening.
• Retain rollout tracking as a read-only compatibility/metering fallback, recover older active rollouts, preserve EOF cursors, parse large metadata, and aggregate subagents into their parent session.
• Determine rollout activity primarily from file-size growth and the last event timestamp; Windows LastWriteTime is only a compatibility fallback.
• Read rate limits through Codex App Server with rollout fallback and identify the weekly bucket by duration.
• Keep Windows pet dragging responsive while terminal windows remain visible and focused.

The privileged Windows Terminal subsystem was removed from this PR and is now isolated in #16, targeting experimental/windows-terminal-focus. No release version bump is included.

Validation

• Full latest-main npm test suite passes on Windows, including the travel suite.
• Regression coverage includes first-event replay after recovery, intentional Quit, hook merge/uninstall behavior, long-session recovery, subagent aggregation, file growth with stale Windows LastWriteTime, last-event-time startup recovery, weekly-bucket detection, drag handling, and fully visible popup content at both screen edges.

[ziyuezhou1]

Follow-up fix in 866083e: packaged LLMPET now registers login startup, failed hook delivery rate-limits an automatic app restart, and the Windows installer explicitly runs the app after setup. Validation: the full npm test suite passed, and a Windows kill/recovery drill confirmed that the next Node hook launched LLMPET.exe --hook-recovery and restored the authenticated localhost IPC endpoint with HTTP 200.

[myunwang]

Thanks for the substantial contribution. The overall direction is valid: Codex hooks and account/rateLimits/read are documented interfaces, and I independently ran the PR's test suite successfully.

I'm requesting changes before merge because there are four blocking integration/reliability issues:

1. The hook event that triggers recovery is lost. When postState fails, the hook starts LLMPET and exits without queueing or replaying the current payload. If that event is the only Stop, the recovered app never receives the completion state—especially important on Codex builds where rollout JSONL is not a reliable fallback. Please persist/retry the event after the local server becomes healthy, and add a regression test that verifies delivery rather than only process spawning.

2. Packaged users cannot reliably keep LLMPET closed. Startup currently enables openAtLogin unconditionally, and any later Claude/Codex hook failure respawns the app. An intentional Quit therefore becomes non-sticky. Please gate startup/recovery behind an explicit persisted user setting and record intentional shutdown so hooks do not resurrect the app after Quit.

3. The branch must be rebased onto the latest main. GitHub currently reports the PR as conflicting. main recently gained the travel system and test/travel.js, while this branch's package.json test command does not run that suite. Core features have been moving quickly recently, so please rebase, preserve the travel implementation/tests, resolve the README/package conflicts, and run the complete current-main suite.

4. Popup resizing can move content off-screen. The new geometry deliberately avoids horizontal clamping. The test accepts x=1476, width=520 on a 1920px work area, leaving 76px outside the visible screen. Please keep the outer window inside the work area and preserve the pet's visual position using an internal pet/content offset; add left/right-edge coverage.

After these changes, please include evidence for:

• the first failed hook event being replayed after recovery;
• explicit Quit remaining closed;
• the full latest-main test suite including travel;
• popup content remaining fully visible at both horizontal screen edges.

The PR is worth continuing, so I am leaving it open for revision rather than closing it.

[myunwang]

Thank you for the substantial follow-up. I re-reviewed the updated branch and independently ran the complete current test suite; it passes on macOS. The four blockers from my previous review are now addressed at the code/test level:

• failed hook events are persisted and replayed after the recovered server is listening;
• startup/recovery is explicit opt-in and intentional Quit suppresses hook resurrection;
• the branch is based on current main and includes the travel suite;
• popup windows are clamped to the work area while a renderer-side offset preserves the pet position.

However, the later Windows Terminal work adds a separate privileged subsystem and has expanded this PR to 43 files / roughly 4,000 added lines. I do not want that security and installer surface coupled to the core reliability fixes.

I created an isolated integration branch for it:

experimental/windows-terminal-focus
https://github.com/myunwang/LLMPET/tree/experimental/windows-terminal-focus

Please split the work as follows:

1. Keep PR Improve Codex reliability, quota, and Windows pet behavior #15 focused on the Codex lifecycle/reliability work, hook recovery, quota display, drag handling, and popup anchoring.
2. Move the exact Windows Terminal tab capture/focus code, elevated broker, named-pipe channel, scheduled-task installer, and perMachine NSIS changes into a separate PR targeting experimental/windows-terminal-focus.
3. Remove the 1.1.8 version bump from the contribution branches. Release versions are assigned by the maintainer after integration and validation.

For the experimental Windows PR, please also cover these acceptance points:

• installing as a standard Windows user while UAC credentials belong to a different administrator must register/run the broker for the actual LLMPET user, not the administrator account;
• the privileged broker must be optional rather than forcing every Windows installation to become per-machine;
• tab capture must not cache whichever Windows Terminal tab happens to be foreground if it cannot be correlated with the hook's WT_SESSION;
• include Windows CI or reproducible logs for the installer, scheduled-task lifecycle, reconnect path, and exact-tab focus.

The earlier fixes are valuable and worth merging once the privileged Windows portion is separated. No direct repository write access is needed—please continue from your fork and target the experimental branch with the second PR.

[myunwang]

I also want to add a more personal thank-you.

You clearly put a great deal of time and care into this contribution. After the first review, you did not dismiss the concerns or make superficial changes—you worked through every blocker, rebased onto the moving main branch, preserved the newer travel work, expanded the regression coverage, and returned with concrete implementation and validation evidence. I genuinely appreciate that level of patience and responsibility.

My request to split the Windows Terminal broker is not a rejection of your work or a lack of trust in the effort behind it. It is a maintainer decision about keeping a privileged, installer-level subsystem reviewable and giving it the dedicated Windows validation it deserves. The core reliability improvements are valuable, and I want to make sure your contribution can enter the project in a form that is safe, maintainable, and properly credited.

Thank you again for continuing to improve the PR after detailed feedback and for being willing to work with a project whose core features have been changing quickly. Contributions with this much thought and follow-through are rare, and they are sincerely appreciated.