[merefield]

Codex 0.163–0.164 changes response accounting, settings restoration and transport behavior. This PR keeps Codexometer's existing monitoring and session controls compatible, prevents incomplete background usage from producing misleading API-EQ capacity estimates, and preserves accounting when compressed histories are restored.

Scope

• Keep token and API-EQ accounting accurate, and identify telemetry gaps.
• Keep observing sessions when Codex compresses or restores their histories.
• Keep existing model, speed, permission, approval and queue controls reliable.
• Add negotiated compression to the existing daemon connection.

No new slash commands, workflow management or settings editors are introduced.

Changes

• Incomplete-response accounting: regression coverage proves persisted usage from failed/incomplete requests is counted once, independent of success or recomputed context totals. Missing usage remains missing, with response attribution; context corrections and reconnect replays do not manufacture spending.
• Compressed histories: stream .jsonl.zst into bounded baselines under the same logical identity as .jsonl. Retain decoded offsets and recent response IDs; verify the complete restored prefix before accounting for appended responses. Rewrites rebase, duplicate siblings do not count twice, and existing observed totals, per-session tokens, model calls and turn timings survive compression/restoration, including rewritten restores for the same thread. No decompressed transcript is written to disk.
• WebSocket compression: negotiate Codex's x-codex-app-server-compression: zstd-stream-v1 format, keeping persistent zstd history separately in each direction and resetting it on reconnect. Fall back to plain JSON when unacknowledged. Enforce message/window bounds and flush boundaries; reject malformed streams, unexpected message types and unknown acknowledgements. Dependencies remain pure Go.
• Background usage coverage: use the existing per-thread experimental-feature inventory to detect the async-compaction path that does not publish full foreground response usage. Pause quota learning, discard old capacity evidence, and show the existing terminal/browser diagnostic panel. Preserve known risks during disconnects, including inactive retained sessions and child sessions, and restart from a clean baseline after verified recovery. A coverage gap on either side of a quota read invalidates prior evidence even when another error or an active benchmark prevents using that observation. Include partial/unreadable compressed-history discovery, including compressed failures following an earlier plain-file error. Read-only local TOML checks conservatively flag configured risks when effective daemon state is unavailable.
• Settings and approvals: model and permission changes wait for authoritative running state instead of reporting queued acknowledgements as applied. Keep settings mutations tied to their original connection, preserve saved selections across resume/reconnect and multiple clients, and never retry uncertain mutations. Account changes invalidate cached catalogues without clearing conversation state. Approval resolution remains thread/request scoped, and event/queue/approval processing stays responsive during verification.

The fixes and compatibility changes are separated into individual commits. A separate maintenance commit updates the required Go patch to 1.27.3: the security check found the existing 1.27.2 toolchain affected by GO-2026-6809. No Go module vulnerabilities were reported. CI separately identified security advisories in the existing Vite 8.3.2 development tooling; another maintenance commit updates it to 8.3.5 and rebuilds the embedded frontend.

Evidence and limits

Audited the exact upstream rust-v0.162.0 and rust-v0.164.0 tags, including incomplete-response spending, background compaction, compression framing and persisted resume settings. Compression itself predates 0.164.0; this closes Codexometer's existing reader gap alongside the newer upstream compatibility changes.

Unavailable background response usage cannot be reconstructed or priced from budget hints. Local configuration checks cannot prove hidden CLI overrides, remote configuration or other-machine activity; enabled flags in potentially selected profiles deliberately produce a conservative warning. These checks do not alter Codex configuration or claim complete billing coverage. Compressed source/decoded histories are limited to 256 MiB each; oversized or unreadable histories qualify coverage rather than silently becoming zero usage.

Validation

• Go 1.27.3: full package race/coverage checks pass with go test -race -cover -skip '^TestLocalisedScreens$' -timeout 10m ./.... Exhaustive locale screens remain in CI's dedicated cross-platform step.
• go vet ./... passes; govulncheck v1.8.0 reports no vulnerabilities after the toolchain patch.
• All six standalone release targets build with CGO_ENABLED=0: Linux, macOS and Windows, each on amd64 and arm64.
• Terminal/browser diagnostic projection and estimator-recovery tests pass. This change reuses the existing browser diagnostic component; application frontend source is unchanged. Embedded assets are rebuilt with the patched Vite toolchain. Svelte/type/format checks, production build and npm audit pass with zero vulnerabilities. All 95 browser tests pass locally using installed Chrome through a temporary test configuration; the repository browser configuration is unchanged. The initial bundled Chromium launch was unavailable and its CDN download timed out. The full frontend build/browser CI job and frontend vulnerability CI job are now green.
• Targeted race tests pass for incomplete responses, context corrections, compressed-history restoration/rewrites, child/disconnected and inactive-session usage coverage, mixed discovery failures, rewritten-restore activity preservation, quota-read coverage gaps with errors or benchmark deferral, estimator recovery, two attached clients, settings confirmation and approval isolation.
• Native Codex 0.164.0 compressed-RPC smoke test passes in an isolated temporary home, with no credentials, thread creation or model requests. The opt-in test is included in the repository.
• Interoperability fixtures use native libzstd ZSTD_compressStream2(ZSTD_e_flush), independently of the Go codec; tests cover retained stream history, multi-block messages, fresh-connection resets, plain fallback, malformed/truncated frames, message types, size limits and decoder shutdown.

[Copilot]

🟡 Changes recommended

Coverage gaps can bypass estimator invalidation, and rewritten history restoration can discard previously observed session accounting.

4 open issues

• Record compressed-history failures despite earlier file errors · New
• Preserve observed session data when rebasing cursors · New
• Retain cached coverage risk for inactive sessions · New
• Propagate coverage issues from both quota reads · New

What changed in this PR

Updates Codexometer’s monitoring and session controls for Codex 0.164, covering compressed histories, incomplete usage telemetry and authoritative settings confirmation.

Changes:

• Adds compressed-history baselines and negotiated zstd WebSocket transport.
• Detects background usage gaps and pauses API-EQ capacity learning, with terminal/browser diagnostics.
• Verifies settings changes, expands compatibility tests and raises the required Go patch to 1.27.3.

File	Description
README.md	Documents compatibility behavior, limits and toolchain requirement.
internal/​web/​usage_diagnostics_test.go	Tests coverage diagnostic precedence and clearing.
internal/​web/​state.go	Projects coverage warnings into browser state.
internal/​ui/​quota_api_eq.go	Suspends estimates and resets evidence during coverage gaps.
internal/​ui/​quota_api_eq_test.go	Tests estimator invalidation and recovery.
internal/​ui/​model.go	Carries coverage warnings through quota observations.
internal/​codex/​usage_diagnostics.go	Adds incomplete-coverage diagnostic formatting.
internal/​codex/​usage_coverage.go	Tracks coverage risks and checks local configuration.
internal/​codex/​usage_coverage_unix.go	Queries effective per-thread feature state.
internal/​codex/​usage_coverage_unix_test.go	Tests feature inventory interpretation and validation.
internal/​codex/​usage_coverage_test.go	Tests local, child-session and disconnected coverage checks.
internal/​codex/​testdata/​zstd-stream-v1.json	Adds native zstd interoperability fixtures.
internal/​codex/​session_stream_test.go	Tests approval isolation and continued event processing.
internal/​codex/​session_settings_unix.go	Binds settings mutations to their original connection.
internal/​codex/​session_settings_unix_test.go	Extends daemon fixtures for compression and permissions.
internal/​codex/​session_permissions_unix.go	Verifies applied permission profiles.
internal/​codex/​session_compatibility_unix_test.go	Tests reconnects, multiple clients and queued settings.
internal/​codex/​session_commands_unix.go	Routes model and permission changes through verification.
internal/​codex/​live_usage.go	Integrates compressed histories and coverage status.
internal/​codex/​live_usage_exact_test.go	Tests incomplete-response accounting and replay deduplication.
internal/​codex/​live_usage_compressed.go	Adds bounded baselines and restored-prefix verification.
internal/​codex/​live_usage_compressed_test.go	Tests restoration, rewrites and corrupt histories.
internal/​codex/​daemon_wire.go	Implements bounded, negotiated zstd streaming.
internal/​codex/​daemon_wire_test.go	Tests negotiation, framing, limits and shutdown.
internal/​codex/​daemon_status.go	Adds coverage data to daemon snapshots.
internal/​codex/​daemon_status_unix.go	Integrates compression, coverage queries and account invalidation.
internal/​codex/​daemon_native_unix_test.go	Adds an opt-in native Codex compression smoke test.
go.sum	Records compression and TOML dependency checksums.
go.mod	Adds dependencies and requires Go 1.27.3.

_{Review effort: Balanced}