@bitkyc08/opencodex 2.7.41 → 2.7.42

package/src/providers/registry.ts

@@ -180,6 +180,19 @@ const THINKING_TOGGLE_MAP: Record<string, string> = {
 const OPENCODE_GO_THINKING_TOGGLE_MODELS = [
   "mimo-v2.5", "mimo-v2.5-pro", "mimo-v2-omni", "mimo-v2-pro", "glm-5", "glm-5.1",
 ];
+/**
+ * Zhipu's domestic BigModel platform. Text families first, then the vision member: modalities are
+ * declared per model because `noVisionModels` means the opposite of "text only" here — it routes
+ * images through the proxy's vision sidecar (src/codex/catalog/provider-fetch.ts), a claim nobody
+ * has verified for BigModel-hosted GLM.
+ */
+const ZHIPU_BIGMODEL_TEXT_MODELS = ["glm-4.6", "glm-4.7", "glm-4.7-flash", "glm-5", "glm-5.1"];
+const ZHIPU_BIGMODEL_MODELS = [...ZHIPU_BIGMODEL_TEXT_MODELS, "glm-4.6v"];
+const ZHIPU_BIGMODEL_INPUT_MODALITIES: Record<string, string[]> = {
+  ...Object.fromEntries(ZHIPU_BIGMODEL_TEXT_MODELS.map(id => [id, ["text"]])),
+  "glm-4.6v": ["text", "image"],
+};
+const ZHIPU_BIGMODEL_THINKING_TOGGLE_MODELS = ["glm-4.6", "glm-4.7", "glm-5", "glm-5.1"];
 const THINKING_BUDGET_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 const THINKING_BUDGET_MODELS = [
   "qwen3.5-397b", "qwen3.6-35b",
@@ -785,6 +798,45 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     modelReasoningEfforts: Object.fromEntries(ZAI_GLM_52_MODELS.map(id => [id, ZAI_GLM_52_REASONING_EFFORTS])),
     preserveReasoningContentModels: ZAI_GLM_52_MODELS,
   },
+  // Zhipu's domestic BigModel platform: OpenAI-compatible pay-as-you-go on open.bigmodel.cn — a
+  // different host and billing product from the `zai` coding-plan subscription above.
+  // The id is deliberately NOT `glm` or `glm-cn`: both are already bound in FREE_PROVIDER_DIRECTORY
+  // (to api.z.ai and to the BigModel *coding* path), and routedProviderConfig() canonicalizes a
+  // saved provider onto the registry baseUrl — reusing either id would silently retarget an
+  // existing config's endpoint and send its API key to another host.
+  // Evidence: docs.bigmodel.cn/api-reference (OpenAI-compatible chat completions),
+  // docs.bigmodel.cn/cn/guide/models/text/glm-4.6 (thinking: {type: enabled|disabled}).
+  // Originally proposed in #536 by @Lucinegogo.
+  {
+    id: "zhipu-bigmodel",
+    label: "Zhipu AI — BigModel",
+    baseUrl: "https://open.bigmodel.cn/api/paas/v4",
+    adapter: "openai-chat",
+    authKind: "key",
+    dashboardUrl: "https://bigmodel.cn/console/usercenter/apikeys",
+    defaultModel: "glm-4.6",
+    models: ZHIPU_BIGMODEL_MODELS,
+    // The GLM families here are the same ones the `zai` metadata bundle already describes, so the
+    // bundle owns context windows and modalities for the whole list instead of a hand-copied table.
+    jawcodeBundle: "zai",
+    // Declared explicitly for the default model so its window survives a bundle-lookup miss:
+    // without it, catalog normalization falls back to a generic 128k and compacts ~76,800 early.
+    modelContextWindows: { "glm-4.6": 204_800 },
+    modelInputModalities: ZHIPU_BIGMODEL_INPUT_MODALITIES,
+    // GLM exposes a binary thinking knob, not an effort ladder: the adapter emits
+    // `thinking: {type}` for these ids and would otherwise send a rejected reasoning_effort.
+    thinkingToggleModels: ZHIPU_BIGMODEL_THINKING_TOGGLE_MODELS,
+    modelReasoningEfforts: Object.fromEntries(
+      ZHIPU_BIGMODEL_THINKING_TOGGLE_MODELS.map(id => [id, THINKING_TOGGLE_EFFORTS]),
+    ),
+    modelReasoningEffortMap: Object.fromEntries(
+      ZHIPU_BIGMODEL_THINKING_TOGGLE_MODELS.map(id => [id, THINKING_TOGGLE_MAP]),
+    ),
+    preserveReasoningContentModels: ZHIPU_BIGMODEL_THINKING_TOGGLE_MODELS,
+    // No liveModels: GET /api/paas/v4/models has not been observed to answer on this host, and a
+    // false live claim yields an empty picker at runtime. Flip it on once someone verifies it.
+    note: "Domestic BigModel pay-as-you-go endpoint (open.bigmodel.cn)",
+  },
   { id: "nanogpt", label: "NanoGPT", baseUrl: "https://nano-gpt.com/api/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://nano-gpt.com/api" },
   { id: "synthetic", label: "Synthetic", baseUrl: "https://api.synthetic.new/openai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://synthetic.new" },
   // SiliconFlow publishes an OpenAI-compatible chat endpoint and a dynamic model catalog. Do not

package/src/server/auth-cors.ts

@@ -8,6 +8,7 @@ import {
   positiveIntegerRecordConfigError,
   providerBaseUrlConfigError,
   providerHeadersConfigError,
+  reasoningSummaryDeliveryRecordConfigError,
 } from "../config";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { getProviderRegistryEntry, providerCodexAccountMode } from "../providers/registry";
@@ -235,6 +236,11 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
   if (maxInputError) return `provider ${name} ${maxInputError}`;
   const reasoningSummariesError = booleanRecordConfigError(raw.modelSupportsReasoningSummaries, "modelSupportsReasoningSummaries");
   if (reasoningSummariesError) return `provider ${name} ${reasoningSummariesError}`;
+  const reasoningSummaryDeliveryError = reasoningSummaryDeliveryRecordConfigError(
+    raw.modelReasoningSummaryDelivery,
+    raw.modelSupportsReasoningSummaries,
+  );
+  if (reasoningSummaryDeliveryError) return `provider ${name} ${reasoningSummaryDeliveryError}`;
   const modelAdaptersError = modelAdapterRecordConfigError(raw.modelAdapters, "modelAdapters", name, typed);
   if (modelAdaptersError) return `provider ${name} ${modelAdaptersError}`;
   const defaultMaxOutputError = positiveIntegerConfigError(raw.defaultMaxOutputTokens, "defaultMaxOutputTokens");

package/src/server/chat-completions.ts

@@ -16,6 +16,7 @@ import {
 } from "../chat/outbound";
 import { classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
+import { resolveClientRetryAfter } from "../lib/retry-after";
 import { estimateTokens } from "../lib/token-estimate";
 import { routeModel } from "../router";
 import { resolveWireProtocolOverride } from "./adapter-resolve";
@@ -180,7 +181,11 @@ export async function handleChatCompletions(
         if (text) message = `upstream error (${upstream.status}): ${redactSecretString(text).slice(0, 400)}`;
       }
     } catch { /* keep fallback */ }
-    const retryAfter = upstream.headers.get("retry-after");
+    const retryAfter = resolveClientRetryAfter({
+      status: upstream.status,
+      message,
+      upstreamRetryAfter: upstream.headers.get("retry-after"),
+    });
     const classified = classifyError(
       upstream.status,
       upstreamType

package/src/server/claude-messages.ts

@@ -15,6 +15,7 @@ import { recordDesktopRequest } from "../claude/desktop-health";
 import { stripOneMillionMarker } from "../claude/context-windows";
 import { captureClaudeInbound } from "../claude/inbound-debug";
 import { isTransientUpstreamStatus } from "../lib/upstream-retry";
+import { resolveClientRetryAfter } from "../lib/retry-after";
 import {
   anthropicErrorBody,
   anthropicErrorResponse,
@@ -29,6 +30,7 @@ import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody } from "./request-decompress";
 import { addFinalRequestLog, httpStatusForTerminalStatus, recordFirstOutput, type RequestLogContext, type RequestLogEntry } from "./request-log";
+import { conversationIdFromClaudeMetadata } from "./request-log-conversation";
 import { responseWithDeferredRequestLog } from "./relay";
 import { handleResponses } from "./responses";
 
@@ -555,6 +557,13 @@ export async function handleClaudeMessages(
       logCtx.surface = "claude-desktop";
       recordDesktopRequest();
     }
+    // Correlate before native passthrough so Anthropic-credential turns still filter/total (#330 / #522).
+    if (isRec(anthropicBody)) {
+      const claudeConversationId = conversationIdFromClaudeMetadata(
+        isRec(anthropicBody.metadata) ? anthropicBody.metadata : undefined,
+      );
+      if (claudeConversationId) logCtx.conversationId = claudeConversationId;
+    }
     if (isRec(anthropicBody) && wantsNativePassthrough(req, config, anthropicBody.model)) {
       return await anthropicNativePassthrough(req, config, logCtx, logIds, anthropicBody, "/v1/messages");
     }
@@ -689,12 +698,22 @@ export async function handleClaudeMessages(
         if (text) message = `upstream error (${response.status}): ${text.slice(0, 400)}`;
       }
     } catch { /* keep fallback message */ }
-    const retryAfter = response.headers.get("retry-after");
+    const upstreamRetryAfter = response.headers.get("retry-after");
+    const retryAfter = resolveClientRetryAfter({
+      status: response.status,
+      message,
+      upstreamRetryAfter,
+    })
+      // Instant-retry "0" is a valid client directive but rejected by cooldown parsers.
+      // Preserve it so it still wins over the transient "2" fallback (claude-529 mapping).
+      ?? (upstreamRetryAfter?.trim() === "0" ? "0" : undefined);
     // Transient upstream 5xx (already retried pre-stream, 010): reclassify as Anthropic
     // 529 overloaded_error so the Claude Code client applies its built-in backoff retry
     // instead of dying on a fatal api_error (260716 sol-builder incident). The request
     // log keeps the upstream status (captured in the deferred-log closure before this
     // rewrite): log = upstream truth, client = retry signal.
+    // Retryable 429s also get Retry-After (#507) so Codex-shaped clients and Claude Code
+    // share a backoff hint when the upstream omitted the header.
     const transient = isTransientUpstreamStatus(response.status);
     const outStatus = transient ? 529 : response.status;
     const out = new Response(JSON.stringify(anthropicErrorBody(outStatus, message)), {

package/src/server/images.ts

@@ -7,7 +7,8 @@
  * without a route the tool died on the /v1/* JSON-404 guard. Only an OpenAI-family upstream
  * can serve these endpoints — routed providers (Cursor, Kiro, Gemini, …) have no image
  * generation surface — so the handler relays the body verbatim to the ChatGPT forward
- * provider (or an OpenAI API-key provider) and passes the response through untouched:
+ * provider, an OpenAI API-key provider, or an explicitly selected compatible custom provider and
+ * passes the response through untouched:
  * codex's images client parses `{created, data:[{b64_json}]}` strictly and Debug-prints
  * error bodies into the model-visible failure, so upstream errors must stay legible.
  */
@@ -23,7 +24,7 @@ import { formatCodexProviderForLog } from "../codex/routing";
 import { signalWithTimeout } from "../lib/abort";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import type { OcxConfig } from "../types";
-import { resolveFirstUsableOpenAiSidecar, selectOpenAiImagesProvider } from "../providers/openai-sidecar";
+import { resolveFirstUsableOpenAiSidecar, selectImagesProvider } from "../providers/openai-sidecar";
 import { readJsonRequestBody } from "./request-decompress";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import type { RequestLogContext } from "./request-log";
@@ -47,10 +48,17 @@ export async function handleImages(
   endpoint: ImagesEndpoint,
   logCtx: RequestLogContext,
 ): Promise<Response> {
-  try { validateForwardAdmissionCredential(req.headers, config); }
-  catch (err) {
-    if (err instanceof ForwardAdmissionCredentialError) return formatErrorResponse(401, "authentication_error", err.message);
-    throw err;
+  const candidates = selectImagesProvider(config);
+  if (candidates.error) {
+    return formatErrorResponse(400, "invalid_request_error", candidates.error);
+  }
+  const explicitKeyedProvider = config.images?.provider !== undefined && candidates.keyed !== undefined;
+  if (!explicitKeyedProvider) {
+    try { validateForwardAdmissionCredential(req.headers, config); }
+    catch (err) {
+      if (err instanceof ForwardAdmissionCredentialError) return formatErrorResponse(401, "authentication_error", err.message);
+      throw err;
+    }
   }
   let body: unknown;
   try {
@@ -61,7 +69,6 @@ export async function handleImages(
   const model = (body as { model?: unknown } | null)?.model;
   if (typeof model === "string" && model) logCtx.model = model;
 
-  const candidates = selectOpenAiImagesProvider(config);
   if (candidates.forwardCandidates.length === 0 && !candidates.keyed) {
     // 400, not 5xx: codex retries every 5xx up to 5 total attempts, and this is a permanent
     // configuration state that must surface on the first attempt.

package/src/server/management/agent-settings-routes.ts

@@ -33,7 +33,6 @@ import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
-import { scanStorage } from "../../storage/scanner";
 import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";
@@ -543,16 +542,22 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
       const { readFileSync: readFile, existsSync } = await import("node:fs");
       const { createHash } = await import("node:crypto");
       const { join } = await import("node:path");
-      const { homedir } = await import("node:os");
-      const libraryPath = process.env.OPENCODEX_CLAUDE_DESKTOP_CONFIG_DIR?.trim()
-        || join(homedir(), "Library", "Application Support", "Claude-3p", "configLibrary");
+      const { resolveDesktop3pConfigLibraryPath } = await import("../../claude/desktop-3p");
+      const libraryPath = resolveDesktop3pConfigLibraryPath();
       const metaPath = join(libraryPath, "_meta.json");
       let onDiskFingerprint: string | null = null;
       let configPath: string | null = null;
+      // Desktop serves ONLY the profile named by _meta.json's appliedId, so an
+      // opencodex entry that merely EXISTS does not mean Desktop is using it.
+      // null = undeterminable (no metadata / unreadable / no appliedId).
+      let activeProfile: boolean | null = null;
       if (existsSync(metaPath)) {
         try {
           const meta = JSON.parse(readFile(metaPath, "utf8"));
           const entry = Array.isArray(meta.entries) ? meta.entries.find((e: { name?: string }) => e?.name === "opencodex") : undefined;
+          const appliedId = typeof meta.appliedId === "string" ? meta.appliedId : null;
+          // A readable appliedId with no opencodex entry is a KNOWN false, not unknown.
+          activeProfile = appliedId === null ? null : (entry?.id ? appliedId === entry.id : false);
           if (entry?.id) {
             configPath = join(libraryPath, `${entry.id}.json`);
             if (existsSync(configPath)) {
@@ -574,6 +579,7 @@ export async function handleAgentSettingsRoutes(ctx: ManagementContext): Promise
         onDiskFingerprint,
         configPath,
         stale,
+        activeProfile,
         health,
       });
     } catch (error) {

package/src/server/management/combo-routes.ts

@@ -33,7 +33,6 @@ import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
-import { scanStorage } from "../../storage/scanner";
 import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";

package/src/server/management/config-routes.ts

@@ -34,7 +34,6 @@ import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
-import { scanStorage } from "../../storage/scanner";
 import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";

package/src/server/management/logs-usage-routes.ts

@@ -34,6 +34,7 @@ import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
 import { scanStorage } from "../../storage/scanner";
+import { executeArchivedCleanup, pickWireCleanupTestHooks, previewArchivedCleanup, type CleanupMode } from "../../storage/cleanup";
 import {
   currentUsageLogRevision,
   readUsageSnapshotForManagement,
@@ -232,5 +233,98 @@ export async function handleLogsUsageRoutes(ctx: ManagementContext): Promise<Res
       });
     }
   }
+
+  if (url.pathname === "/api/storage/cleanup/preview" && req.method === "POST") {
+    let body: { percent?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid_json" }, 400); }
+    const percent = typeof body?.percent === "number" ? body.percent : Number.NaN;
+    if (!Number.isFinite(percent) || percent < 0 || percent > 100) {
+      return jsonResponse({ error: "invalid_percent" }, 400);
+    }
+    const preview = previewArchivedCleanup(percent);
+    // Omit absolute host paths (codexHome / absPath) from the wire response.
+    return jsonResponse({
+      percent: preview.percent,
+      count: preview.count,
+      bytes: preview.bytes,
+      digest: preview.digest,
+      // Dashboard only lists a handful; count/bytes/digest already bind the full set.
+      candidates: preview.candidates.slice(0, 50).map(({ relPath, bytes, mtimeMs, physicalRelPaths }) => ({
+        relPath,
+        bytes,
+        mtimeMs,
+        physicalRelPaths,
+      })),
+    });
+  }
+
+  if (url.pathname === "/api/storage/cleanup" && req.method === "POST") {
+    let body: { percent?: unknown; mode?: unknown; digest?: unknown; _test?: unknown };
+    try { body = await req.json(); } catch { return jsonResponse({ error: "invalid_json" }, 400); }
+    const percent = typeof body?.percent === "number" ? body.percent : Number.NaN;
+    if (!Number.isFinite(percent) || percent < 0 || percent > 100) {
+      return jsonResponse({ error: "invalid_percent" }, 400);
+    }
+    const mode = body?.mode;
+    if (mode !== "quarantine" && mode !== "permanent") {
+      return jsonResponse({ error: "invalid_mode" }, 400);
+    }
+    const digest = typeof body?.digest === "string" ? body.digest : "";
+    const testHooks =
+      process.env.OPENCODEX_CLEANUP_TEST_HOOKS === "1" &&
+      body &&
+      typeof body === "object" &&
+      "_test" in body
+        ? pickWireCleanupTestHooks(body._test)
+        : undefined;
+    try {
+      const result = executeArchivedCleanup({
+        percent,
+        mode: mode as CleanupMode,
+        digest,
+        ...(testHooks ? { _test: testHooks } : {}),
+      });
+      if (!result.ok) {
+        const status =
+          result.error === "codex_busy" || result.error === "stale_preview" || result.error === "referenced_history"
+            ? 409
+            : result.error === "invalid_mode" || result.error === "invalid_digest"
+              ? 400
+              : 500;
+        const messages: Record<string, string> = {
+          codex_busy: "Codex is using state.sqlite — try again after quitting Codex.",
+          stale_preview: "Archived files changed since preview — run Preview again.",
+          referenced_history: "Selected archives are still referenced by forked or paginated history.",
+          invalid_digest: "Preview digest is missing or invalid.",
+          invalid_mode: "mode must be quarantine or permanent.",
+          fs_failed: "Filesystem cleanup failed. Some changes may already be applied — check CODEX_HOME/.trash and any recovery path in the response.",
+          db_reconcile_failed: "Could not update Codex state database.",
+          cleanup_failed: "Cleanup failed.",
+        };
+        return jsonResponse({
+          ok: false,
+          error: result.error ?? "cleanup_failed",
+          message: messages[result.error ?? ""] ?? messages.cleanup_failed,
+          ...(result.trashDir ? { trashDir: result.trashDir } : {}),
+        }, status);
+      }
+      return jsonResponse({
+        ok: true,
+        mode: result.mode,
+        percent: result.percent,
+        count: result.count,
+        bytes: result.bytes,
+        ...(result.trashDir ? { trashDir: result.trashDir } : {}),
+        removedPaths: result.removedPaths,
+      });
+    } catch {
+      return jsonResponse({
+        ok: false,
+        error: "cleanup_failed",
+        message: "Cleanup failed.",
+      }, 500);
+    }
+  }
+
   return null;
 }

package/src/server/management/model-routes.ts

@@ -35,7 +35,6 @@ import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
-import { scanStorage } from "../../storage/scanner";
 import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";

package/src/server/management/oauth-account-routes.ts

@@ -33,7 +33,6 @@ import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
-import { scanStorage } from "../../storage/scanner";
 import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";

package/src/server/management/provider-routes.ts

@@ -34,7 +34,6 @@ import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { getProviderDiscoveryStatus } from "../../codex/model-cache";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
-import { scanStorage } from "../../storage/scanner";
 import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";

package/src/server/management/shared.ts

@@ -33,7 +33,6 @@ import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../../providers/context-cap";
 import { resolveCodexHomeDir } from "../../codex/home";
-import { scanStorage } from "../../storage/scanner";
 import { readUsageEntries } from "../../usage/log";
 import { getUsageDebugLogEntries } from "../../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../../usage/summary";

package/src/server/management/system-routes.ts

@@ -7,15 +7,16 @@
  * unauthenticated /healthz surface.
  *
  * The payload is scalar-only (numbers, enum strings): no paths, no tokens, no
- * account identifiers. `jscHeap` (bun:jsc heapStats) is the js-vs-native
- * discriminator: a flat JS heap under a growing RSS points at native runtime
- * memory (the #314 shape), not an app-level JS leak. `responseState` attributes
- * JS-heap growth further: it is the proxy's previous_response_id continuation
- * store, so a growing responseState.totalBytes under a growing heap points the
- * finger at conversation retention rather than the runtime allocator.
+ * account identifiers. `external` and `arrayBuffers` keep Windows diagnostics
+ * honest when RSS/working-set counters under-report committed retention.
+ * `jscHeap` (bun:jsc heapStats) is useful context, but on Bun 1.3.14 it is not a
+ * standalone leak discriminator. `responseState` attributes growth further: it
+ * is the proxy's previous_response_id continuation store, so a growing
+ * responseState.totalBytes under rising observed memory points at conversation
+ * retention rather than the runtime allocator.
  */
 import { decideEagerRelay } from "../../lib/bun-stream-caps";
-import { getActiveMemoryWatchdog } from "../memory-watchdog";
+import { getActiveMemoryWatchdog, observedMemoryCounter } from "../memory-watchdog";
 import { responseStateMetrics } from "../../responses/state";
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
@@ -38,15 +39,22 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
     } catch {
       /* non-Bun tooling or unavailable introspection — omit the discriminator */
     }
-    const watchdogInstance = getActiveMemoryWatchdog();
+	    const watchdogInstance = getActiveMemoryWatchdog();
+	    const observed = observedMemoryCounter({
+	      rss: usage.rss,
+	      external: usage.external,
+	      arrayBuffers: usage.arrayBuffers,
+	    });
     const watchdog = watchdogInstance
       ? (() => {
         const snap = watchdogInstance.snapshot();
-        return {
-          warnThresholdBytes: snap.warnThresholdBytes,
-          lastWarnAt: snap.lastWarnAt,
-          samples: snap.samples.slice(-ENDPOINT_SAMPLE_LIMIT),
-        };
+	        return {
+	          warnThresholdBytes: snap.warnThresholdBytes,
+	          lastWarnAt: snap.lastWarnAt,
+	          observedBytes: snap.observedBytes,
+	          observedMetric: snap.observedMetric,
+	          samples: snap.samples.slice(-ENDPOINT_SAMPLE_LIMIT),
+	        };
       })()
       : null;
     const streamMode = config.streamMode ?? "auto";
@@ -58,8 +66,12 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
       uptimeSeconds: process.uptime(),
       rss: usage.rss,
       heapUsed: usage.heapUsed,
-      heapTotal: usage.heapTotal,
-      jscHeap,
+	      heapTotal: usage.heapTotal,
+	      external: usage.external,
+	      arrayBuffers: usage.arrayBuffers,
+	      observedBytes: observed.observedBytes,
+	      observedMetric: observed.observedMetric,
+	      jscHeap,
       responseState: responseStateMetrics(),
       streamMode,
       eagerRelay: process.platform === "win32" ? decideEagerRelay(streamMode) : null,

package/src/server/management-api.ts

@@ -33,7 +33,6 @@ import { clearThreadAccountMap } from "../codex/routing";
 import { primeCodexPoolQuotas } from "../codex/auth-api";
 import { DEFAULT_PROVIDER_CONTEXT_CAP, globalContextCapValue, providerContextCap, providerContextCaps, setAllProviderContextCaps, setGlobalContextCapValue, setProviderContextCap } from "../providers/context-cap";
 import { resolveCodexHomeDir } from "../codex/home";
-import { scanStorage } from "../storage/scanner";
 import { readUsageEntries } from "../usage/log";
 import { getUsageDebugLogEntries } from "../usage/debug";
 import { parseRange, parseUsageSurface, summarizeUsage } from "../usage/summary";

package/src/server/memory-watchdog.ts

@@ -1,9 +1,9 @@
 /**
- * RSS memory watchdog (#314 WP3) — warn-only observability for the Windows
+ * Memory watchdog (#314 WP3 / #509) — warn-only observability for the Windows
  * native-memory growth reported upstream (Bun fetch buffers / socket handles).
  *
  * Samples process.memoryUsage() on an unref'd interval into a bounded ring and
- * logs ONE rate-limited warning when RSS crosses the threshold. It never
+ * logs ONE rate-limited warning when observed memory crosses the threshold. It never
  * restarts anything (threshold auto-restart is deliberately deferred; the
  * service managers' crash-respawn already covers hard failures). The active
  * instance is a module-level singleton so the management API can expose the
@@ -13,7 +13,7 @@
  * paths, hostnames, or tokens.
  */
 
-export type MemorySample = {
+export type MemorySampleBase = {
   /** Epoch ms. */
   at: number;
   /** Resident set size in bytes. */
@@ -22,12 +22,27 @@ export type MemorySample = {
   heapUsed: number;
   /** JS heap total in bytes. */
   heapTotal: number;
+  /** External/native memory tracked by process.memoryUsage(). */
+  external: number;
+  /** ArrayBuffer memory tracked by process.memoryUsage(). */
+  arrayBuffers: number;
 };
 
+export type MemorySample = MemorySampleBase & {
+  /** Largest observed memory counter used for thresholding. */
+  observedBytes: number;
+  /** Counter that produced observedBytes. */
+  observedMetric: MemoryMetric;
+};
+
+export type MemoryMetric = "rss" | "external" | "arrayBuffers";
+
 export type MemoryWatchdogState = {
   samples: MemorySample[];
   warnThresholdBytes: number;
   lastWarnAt: number | null;
+  observedBytes: number;
+  observedMetric: MemoryMetric;
 };
 
 export type MemoryWatchdog = {
@@ -43,6 +58,19 @@ const DOCS_URL = "https://opencodex.me/troubleshooting/windows-memory/";
 
 let active: MemoryWatchdog | null = null;
 
+export function observedMemoryCounter(sample: Pick<MemorySampleBase, "rss" | "external" | "arrayBuffers">): {
+  observedBytes: number;
+  observedMetric: MemoryMetric;
+} {
+  const values: Array<{ metric: MemoryMetric; bytes: number }> = [
+    { metric: "rss", bytes: sample.rss },
+    { metric: "external", bytes: sample.external },
+    { metric: "arrayBuffers", bytes: sample.arrayBuffers },
+  ];
+  const best = values.reduce((current, next) => next.bytes > current.bytes ? next : current, values[0]);
+  return { observedBytes: best.bytes, observedMetric: best.metric };
+}
+
 /** The running watchdog, if any — read by /api/system/memory. */
 export function getActiveMemoryWatchdog(): MemoryWatchdog | null {
   return active;
@@ -50,7 +78,19 @@ export function getActiveMemoryWatchdog(): MemoryWatchdog | null {
 
 function defaultSample(now: () => number): MemorySample {
   const usage = process.memoryUsage();
-  return { at: now(), rss: usage.rss, heapUsed: usage.heapUsed, heapTotal: usage.heapTotal };
+  const base = {
+    at: now(),
+    rss: usage.rss,
+    heapUsed: usage.heapUsed,
+    heapTotal: usage.heapTotal,
+    external: usage.external,
+    arrayBuffers: usage.arrayBuffers,
+  };
+  return { ...base, ...observedMemoryCounter(base) };
+}
+
+function normalizeSample(sample: MemorySampleBase): MemorySample {
+  return { ...sample, ...observedMemoryCounter(sample) };
 }
 
 /**
@@ -64,7 +104,7 @@ export function startMemoryWatchdog(opts?: {
   warnThresholdBytes?: number;
   ringSize?: number;
   now?: () => number;
-  sample?: () => MemorySample;
+  sample?: () => MemorySampleBase;
   warn?: (msg: string) => void;
 }): MemoryWatchdog {
   active?.stop();
@@ -77,21 +117,25 @@ export function startMemoryWatchdog(opts?: {
 
   const samples: MemorySample[] = [];
   let lastWarnAt: number | null = null;
+  let observedBytes = 0;
+  let observedMetric: MemoryMetric = "rss";
 
   const tick = () => {
     let s: MemorySample;
     try {
-      s = sample();
+      s = normalizeSample(sample());
     } catch {
       return; // sampling must never break the server
     }
     samples.push(s);
     if (samples.length > ringSize) samples.splice(0, samples.length - ringSize);
-    if (s.rss >= warnThresholdBytes && (lastWarnAt === null || now() - lastWarnAt >= WARN_INTERVAL_MS)) {
+    observedBytes = s.observedBytes;
+    observedMetric = s.observedMetric;
+    if (s.observedBytes >= warnThresholdBytes && (lastWarnAt === null || now() - lastWarnAt >= WARN_INTERVAL_MS)) {
       lastWarnAt = now();
-      const rssMb = Math.round(s.rss / (1024 * 1024));
+      const observedMb = Math.round(s.observedBytes / (1024 * 1024));
       const thresholdMb = Math.round(warnThresholdBytes / (1024 * 1024));
-      warn(`⚠️  opencodex RSS ${rssMb}MB exceeds the ${thresholdMb}MB watch threshold. On Windows this is usually the upstream Bun runtime memory issue — see ${DOCS_URL}`);
+      warn(`⚠️  opencodex observed memory ${observedMb}MB (${s.observedMetric}) exceeds the ${thresholdMb}MB watch threshold. On Windows this is usually the upstream Bun runtime memory issue — see ${DOCS_URL}`);
     }
   };
 
@@ -104,7 +148,7 @@ export function startMemoryWatchdog(opts?: {
       if (active === instance) active = null;
     },
     snapshot() {
-      return { samples: [...samples], warnThresholdBytes, lastWarnAt };
+      return { samples: [...samples], warnThresholdBytes, lastWarnAt, observedBytes, observedMetric };
     },
   };
   active = instance;