fix: users never learned they were out of credits — 9 bugs, now covered on codex, claude code, cursor, hermes, pi and the CLI - #336

…nner

Two changes to the drain:

- Wire in pickLowBalanceNotice as its own source and drop appendBalance
  from primary-banner, so the warning no longer depends on whether a
  welcome banner happened to render. Proven with the shipped 0.7.145
  bundle against a stub serving a $1.37 balance: on source=resume it
  emits nothing at all; with this change it emits the warning.
- Sort the rendered block by severity. 'Credits exhausted - top up' was
  rendering under the welcome banner and the referral nudge, which is
  where a user has stopped reading.

CLI callers print this straight to the terminal, so 'Query failed: 402:
{"balance_cents":0,...}' read as an internal fault rather than 'your
account is out of credits'. That is exactly how the report came in:
`hivemind goal list` showed the raw body and the user had to dig to
work out what it meant.

Only the balance-exhausted 402 is reshaped; every other status keeps the
raw status+body the debugging paths expect.

…er shown

Codex never called the notifications framework. Notifications were
enqueued (balance-exhausted, from deeplake-api's 402 handler) and never
drained, so a Codex user whose org ran out of credits got no signal at
all: captures and recalls failed silently and no top-up CTA ever
appeared. That is the report from #platform on 2026-08-12.

Codex accepts exactly one JSON object on a hook's stdout and
session-start.js already owns it, so the hook drains with a deliver
override and merges the rendered channels into that object rather than
letting an adapter write a second one. The drain runs in parallel with
the skills auto-pull so it adds no wall time to a blocking hook.

Verified in the real Codex TUI (0.147.0) against a stub returning the
server's 402 body:

  - SessionStart (completed) says: warning about credits exhausted
    with the org-scoped billing link

… order

- codex-notifications-merge: the drain runs as agent 'codex', the CTA
  lands in systemMessage, and the hook still emits exactly ONE JSON
  object (a second write would fail codex's strict parse and silently
  drop everything - the failure mode being fixed).
- notifications-low-balance: the warning is pinned to the balance and
  nothing else - no session_id gate, reads fresh past the org-stats
  cache, silent at <=0 (that is the 402 path) and on an unknown header.
- notifications: warnings render above informational items.
- deeplake-api-balance-exhausted: the out-of-credits 402 now throws the
  human-readable message; a 402 without balance_cents keeps the raw
  shape. The dedup case needed a fresh Response per call - a Response
  body reads once, so the reused instance handed later queries an empty
  body.
- codex-session-start-hook: stub the drain and poll for output; the old
  single-tick wait leaked one test's stdout into the next test's capture
  once the hook grew an async step.

…of racing them

The integration suite executes the real bundles, which spawn a detached
setup worker. With HOME pointed at a temp dir that worker provisioned
tree-sitter deps into it, and afterAll's cleanup removed the directory
while the install was still writing: ENOTEMPTY in CI even though all
5834 tests passed.

Use the canonical opt-outs (HIVEMIND_GRAPH_ON_STOP=0,
HIVEMIND_AUTOPULL_DISABLED=1) so the worker has nothing to write, rather
than making the cleanup tolerate the race.

`hivemind goal list: fetch failed` is undici's bare TypeError; the real cause
sits in .cause and never reached the user. The usual cause is not a broken
network but an agent sandbox with outbound access disabled - verified with the
installed CLI against a real org: the same command prints 'fetch failed' under
Codex's default workspace-write sandbox and returns normally under
danger-full-access.

Now reports the host, the underlying code (e.g. EAI_AGAIN), and the sandbox
possibility.

Switching from a drained org to a funded one still showed the drained org's
'credits exhausted' banner, linking to ITS billing page - so a user with money
was told they had none, and the CTA pointed at an org they had left.

The live-supersedes rule added earlier cannot catch this: a healthy org
produces no live notice to supersede the queued one with. So the queued notice
now carries the org that produced it, and the drain drops any queued notice
whose org no longer matches the credentials in force.

Verified against the real setup that produced the report: on june16 with a
notice queued under mvincig11's org, the banner is gone; a notice queued under
june16 still renders.

…nnel

Cursor, Hermes and Pi users got no signal at all when their org ran out of
credits - capture and recall silently returned nothing. Cursor and Hermes are
now covered; Pi is not (see below).

Neither harness has a user-visible session-start channel, verified rather than
assumed:

- Cursor (cursor-agent 2026.08.11): a marker probe wired into
  ~/.cursor/hooks.json shows only top-level additional_context survives, and
  only into the MODEL. systemMessage, nested hookSpecificOutput and stderr are
  all dropped.
- Hermes: on_session_start's return is discarded upstream, and _parse_response
  in agent/shell_hooks.py honours {"context": ...} for pre_llm_call alone.
  Delivered from the already-registered pre_llm_call capture hook, so no
  config change and no re-consent prompt; a sentinel keeps it to once per
  session.

So on these agents the only route to the user runs through the model, which
forces a different rendering: billing notices go out as a statement of fact
('credits are exhausted; capture and recall are disabled'), never as the
imperative aimed at the user ('Top up at <url> to keep capturing') that
reviewers flag as a prompt-injection shape. Only our own statically-authored
billing copy is eligible - mined insights and backend pushes stay out.

Verified in real sessions of each harness. Pi is left alone: its installed
extension injects context only through a static ~/.pi/agent/AGENTS.md, so
there is no per-session channel to carry this.

CodeRabbit nitpick, and it matches the repo's test convention: the host, the
underlying cause and the sandbox guidance are one user-facing contract. A
substring match would still pass if the actionable half went missing - which
is the failure this message exists to prevent.

Pi turns out to have the best channel of any non-Claude-Code harness:
ctx.ui.notify(message, "info"|"warning"|"error"), fired from session_start.
Verified against the installed @mariozechner/pi-coding-agent typings
(dist/core/extensions/types.d.ts) and its docs/extensions.md.

I previously recorded pi as having no user-visible channel. That was wrong,
and wrong in an avoidable way: I inferred it from what our own extension
happened to do (inject context through a static ~/.pi/agent/AGENTS.md) instead
of reading pi's API. So unlike Cursor and Hermes, a pi user can simply be told
- no relaying through the model, no status-line rewrite.

The extension is raw TS with no non-builtin imports, so the drain runs in a
bundled worker (src/hooks/pi/notifications-worker.ts) whose stdout the
extension reads and feeds to notify(), one toast per notification with our
severity mapped onto pi's. Same spawn pattern as autopull.

Verified in a real pi TUI session:

  Warning: credits exhausted - top up to keep capturing
  Sessions are not being saved and memory recall is returning empty.
  Top up at https://deeplake.ai/<org>/workspace/default/billing ...

Also covers the hermes pre_llm_call delivery added in 9836401, which had no
tests, and drops a dead empty-guard in the pi adapter.

CodeRabbit was right: the summary still described Claude Code's behaviour as
if it applied to Codex. Two things were wrong.

The two fields do NOT carry identical text - userVisibleOnly notifications go
to systemMessage only, which is the whole point of the split. And Codex
renders them as 'warning:' and 'hook context:' inside its SessionStart history
cell, not as Claude Code's 'SessionStart:startup says:' line, with
additionalContext also user-visible there.

Also drops the stale line saying Cursor/Hermes/Pi are unwired; all three ship
in this PR.