@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/codex/auth-context.ts

@@ -1,9 +1,12 @@
 import {
   CodexCredentialGenerationConflictError,
   CodexCredentialRefreshLockTimeoutError,
+  CodexCredentialRefreshBusyError,
+  CodexCredentialRefreshStaleError,
   getValidCodexToken,
   isCodexAccountGenerationLive,
 } from "./account-store";
+import { ConfigMutationLockError } from "../config";
 import { markAccountNeedsReauth } from "./account-runtime-state";
 import { isCodexAccountUsable } from "./account-usability";
 import { reconcileMainCodexAccountRuntimeState } from "./account-lifecycle";
@@ -24,12 +27,14 @@ import { formatErrorResponse } from "../bridge";
 import { getAccountQuota } from "./quota";
 import type { CodexAccountMode, OcxConfig, OcxProviderConfig } from "../types";
 import { FORWARD_HEADERS } from "../adapters/openai-responses";
+import { captureConfigGeneration } from "../lib/state-store-sweeper";
 
 export type CodexAuthContext =
   | { kind: "main"; accountId: null }
   | {
       kind: "pool";
       accountId: string;
+      writerGeneration: number;
       generation: number;
       accessToken: string;
       chatgptAccountId: string;
@@ -49,6 +54,7 @@ export type CodexAuthContext =
       // (Option A). Distinct from "main" (passthrough fallback that forwards the client token).
       kind: "main-pool";
       accountId: string;
+      writerGeneration: number;
       accessToken: string;
       chatgptAccountId: string;
       /** See `pool.probeLeaseId`. */
@@ -180,7 +186,11 @@ export class CodexThreadAffinityExpiredError extends Error {
 }
 
 export function shouldMarkAccountNeedsReauthForCodexAuthFailure(cause: unknown): boolean {
-  return !(cause instanceof CodexCredentialGenerationConflictError) && !(cause instanceof CodexCredentialRefreshLockTimeoutError);
+  return !(cause instanceof CodexCredentialGenerationConflictError)
+    && !(cause instanceof CodexCredentialRefreshLockTimeoutError)
+    && !(cause instanceof CodexCredentialRefreshBusyError)
+    && !(cause instanceof CodexCredentialRefreshStaleError)
+    && !(cause instanceof ConfigMutationLockError);
 }
 
 export interface ResolveCodexAuthContextOptions {
@@ -195,6 +205,7 @@ export async function resolveCodexAuthContext(
   mode: CodexAccountMode,
   options: ResolveCodexAuthContextOptions = {},
 ): Promise<CodexAuthContext> {
+  const writerGeneration = captureConfigGeneration();
   if (mode === "direct") {
     if (!hasCallerCodexBearer(headers)) throw new CodexDirectAuthenticationError();
     return { kind: "main", accountId: null };
@@ -254,6 +265,7 @@ export async function resolveCodexAuthContext(
     return {
       kind: "main-pool",
       accountId,
+      writerGeneration,
       accessToken: token.accessToken,
       chatgptAccountId: token.chatgptAccountId,
       ...(quotaScope ? { quotaScope } : {}),
@@ -267,6 +279,7 @@ export async function resolveCodexAuthContext(
     return {
       kind: "pool",
       accountId,
+      writerGeneration,
       generation: token.generation,
       accessToken: token.accessToken,
       chatgptAccountId: token.chatgptAccountId,
@@ -278,7 +291,7 @@ export async function resolveCodexAuthContext(
     if (probeLeaseId && probeQuotaScope) releaseCodexQuotaScopeProbeLease(accountId, probeQuotaScope, probeLeaseId);
     else if (probeLeaseId) releaseCodexQuotaProbeLease(accountId, probeLeaseId);
     if (shouldMarkAccountNeedsReauthForCodexAuthFailure(cause)) {
-      markAccountNeedsReauth(accountId);
+      markAccountNeedsReauth(accountId, writerGeneration);
     }
     throw new CodexAuthContextError(accountId, cause);
   }

package/src/codex/catalog/aggregation.ts

@@ -281,6 +281,21 @@ export function resetOpenAiApiCatalogWarningStateForTests(): void {
 export const slugAliasCollisionWarnings = new Set<string>();
 
 export const comboMasqueradeCollisionWarnings = new Set<string>();
+let lastWarningReconciledGeneration = 0;
+
+export function reconcileCatalogWarningMemos(generation: number): number {
+  if (generation <= lastWarningReconciledGeneration) return 0;
+  const removed = openAiApiCollisionWarnings.size
+    + comboCatalogWarningSignatures.size
+    + slugAliasCollisionWarnings.size
+    + comboMasqueradeCollisionWarnings.size;
+  openAiApiCollisionWarnings.clear();
+  comboCatalogWarningSignatures.clear();
+  slugAliasCollisionWarnings.clear();
+  comboMasqueradeCollisionWarnings.clear();
+  lastWarningReconciledGeneration = generation;
+  return removed;
+}
 
 export function warnComboMasqueradeCollisionOnce(slug: string): void {
   if (comboMasqueradeCollisionWarnings.has(slug)) return;

package/src/codex/catalog/effort.ts

@@ -109,19 +109,29 @@ export function catalogEntryEfforts(entry: RawEntry): string[] {
 
 export const ROUTED_REASONING_LEVELS = [...CODEX_REASONING_LEVELS];
 
-export function applyCatalogModelMetadata(entry: RawEntry, model?: CatalogModel): void {
+export function applyCatalogModelMetadata(
+  entry: RawEntry,
+  model?: CatalogModel,
+  fallbackDisplayName?: string,
+): void {
   if (!model) return;
   // This marker survives strict catalog normalization and lets sync distinguish a stale
   // bare combo alias from a genuine native model row.
   if (model.provider === COMBO_NAMESPACE) entry.owned_by = model.owned_by ?? COMBO_NAMESPACE;
   // displayName is DISPLAY-ONLY: it relabels the picker row but never touches the routing
-  // slug, alias, or provider. deriveEntry already stamped the slug as display_name; a
-  // configured displayName overrides just the label. The `/` separator is rejected at every
-  // input boundary (CLI `ocx models add`, management API), so the catalog trusts its source.
-  // Combos carry no displayName, and natives never reach here (no CatalogModel), so genuine
-  // upstream marketing names and combo alias labels are preserved untouched.
+  // slug, alias, or provider. A configured displayName wins. Otherwise physical routed rows
+  // use the final segment of their native id, keeping provider/vendor namespaces out of the
+  // narrow picker label. buildCatalogEntries supplies a longer fallback only when that basename
+  // would collide with another visible row. Aliased combos keep their public alias. Natives never
+  // reach here (no CatalogModel), so genuine upstream marketing names are preserved untouched.
   const displayName = typeof model.displayName === "string" ? model.displayName.trim() : "";
   if (displayName) entry.display_name = displayName;
+  else if (!model.alias) {
+    const nativeId = model.id.trim();
+    const finalSegment = nativeId.slice(nativeId.lastIndexOf("/") + 1).trim();
+    const fallback = fallbackDisplayName?.trim() || finalSegment;
+    if (fallback) entry.display_name = fallback;
+  }
   if (typeof model.contextWindow === "number" && model.contextWindow > 0) {
     entry.context_window = model.contextWindow;
     entry.max_context_window = model.contextWindow;

package/src/codex/catalog/metadata.ts

@@ -123,6 +123,12 @@ export function visibleNativeSlugs(config: Pick<OcxConfig, "disabledModels">): s
   return nativeOpenAiSlugs().filter(slug => !disabled.has(slug));
 }
 
+/** Native slugs exposed to Claude Desktop show/export/apply (opt-out via claudeCode.desktopNativeModels). */
+export function desktopVisibleNativeSlugs(config: Pick<OcxConfig, "claudeCode" | "disabledModels">): string[] {
+  if (config.claudeCode?.desktopNativeModels === false) return [];
+  return visibleNativeSlugs(config);
+}
+
 export function nativeModelRows(config: Pick<OcxConfig, "disabledModels">): Array<{ slug: string; disabled: boolean; contextWindow?: number }> {
   const disabled = disabledNativeSlugs(config);
   return NATIVE_OPENAI_MODELS.map(slug => {

package/src/codex/catalog/parsing.ts

@@ -92,7 +92,9 @@ export interface CatalogModel {
   /**
    * Display-only Codex catalog `display_name` override. Relabels the picker row ONLY — it never
    * affects the routing slug, alias-collision order, native marketing-name precedence, or provider
-   * behavior. When unset, the entry falls back to its Codex-facing slug (the historical behavior).
+   * behavior. When unset, routed entries use the final segment of the native model id so the
+   * provider namespace does not crowd the picker; basename collisions retain enough route context
+   * to stay distinguishable, and aliased combo rows keep their public alias.
    * Native upstream entries (e.g. gpt-5.6-sol → "GPT-5.6-Sol") come from the pinned snapshot path
    * which carries no CatalogModel, so a configured displayName can never override a native name.
    */

package/src/codex/catalog/provider-fetch.ts

@@ -53,6 +53,7 @@ import {
   type ProviderModelsApiItem,
 } from "../../providers/model-discovery";
 import upstreamModelsSnapshot from "../data/upstream-models.json";
+import { createAdmissionGate, ResourceAdmissionError, type AdmissionMetrics } from "../../lib/admission";
 
 
 import { JAWCODE_CATALOG_AUGMENT_PROVIDERS, catalogModelSlug, shouldExposeRoutedModel } from "./parsing";
@@ -69,6 +70,21 @@ interface GatherFlightResult {
 }
 
 const gatherInflight = new Map<string, Promise<GatherFlightResult>>();
+const MAX_CONCURRENT_CATALOG_GATHERS = 8;
+const gatherGate = createAdmissionGate("catalog_gathers", MAX_CONCURRENT_CATALOG_GATHERS);
+
+export class CatalogGatherBusyError extends ResourceAdmissionError {
+  override readonly code = "catalog_busy";
+  readonly retryAfterSeconds = 1;
+  constructor() {
+    super("catalog_gathers", MAX_CONCURRENT_CATALOG_GATHERS);
+    this.name = "CatalogGatherBusyError";
+  }
+}
+
+export function catalogGatherAdmissionMetrics(): AdmissionMetrics {
+  return gatherGate.metrics();
+}
 
 function stableJson(value: unknown): string {
   return JSON.stringify(value, (_key, nested) => {
@@ -217,6 +233,15 @@ export function isDatedVariantId(liveId: string, configuredId: string): boolean
 }
 
 export const lastDropWarnSignature = new Map<string, string>();
+let lastWarningReconciledGeneration = 0;
+
+export function reconcileProviderFetchWarnings(generation: number): number {
+  if (generation <= lastWarningReconciledGeneration) return 0;
+  const removed = lastDropWarnSignature.size;
+  lastDropWarnSignature.clear();
+  lastWarningReconciledGeneration = generation;
+  return removed;
+}
 
 export const QUIET_AUTHORITATIVE_CATALOG_PROVIDERS = new Set(["kimi", "xai"]);
 
@@ -345,6 +370,7 @@ export function catalogHintsFromModelsApiItem(providerName: string, item: Provid
   const contextWindow =
     positiveSafeInteger(
       limits?.max_context_length,
+      metadata?.context_length,
       item.context_length,
       item.context_size,
       item.max_model_len,
@@ -648,10 +674,13 @@ export async function gatherRoutedModels(
   const key = gatherFlightKey(config);
   let promise = gatherInflight.get(key);
   if (!promise) {
+    const lease = gatherGate.tryAcquire();
+    if (!lease) throw new CatalogGatherBusyError();
     // Claim the slot synchronously before any await so same-key callers join this flight.
     // Distinct keys keep their own entries — a second config must not evict the first.
     const flight = gatherRoutedModelsUncached(config).finally(() => {
       if (gatherInflight.get(key) === flight) gatherInflight.delete(key);
+      lease.release();
     });
     gatherInflight.set(key, flight);
     promise = flight;

package/src/codex/catalog/sync.ts

@@ -166,6 +166,7 @@ export function deriveEntry(
   priority: number,
   model?: CatalogModel,
   exactComboSlugs: ReadonlySet<string> = new Set(),
+  fallbackDisplayName?: string,
 ): RawEntry {
   const preserveExact = isExactComboCatalogModel(model, exactComboSlugs);
   const isRouted = model !== undefined;
@@ -202,7 +203,7 @@ export function deriveEntry(
       applyReasoningLevels(e, model?.reasoningEfforts, model?.defaultReasoningEffort, preserveExact);
       normalizeRoutedCatalogEntry(e, model?.parallelToolCalls === true);
       if (model) applyJawcodeCatalogMetadata(e, model.provider, model.id, model.contextCap);
-      applyCatalogModelMetadata(e, model);
+      applyCatalogModelMetadata(e, model, fallbackDisplayName);
     } else {
       applyNativeOpenAiContextOverride(e);
       if (isGpt56NativeSlug(slug)) ensureGpt56ReasoningLevels(e);
@@ -239,7 +240,7 @@ export function deriveEntry(
     if (isGpt56NativeSlug(slug)) ensureGpt56ReasoningLevels(entry);
   }
   if (model && isRouted) applyJawcodeCatalogMetadata(entry, model.provider, model.id, model.contextCap);
-  applyCatalogModelMetadata(entry, model);
+  applyCatalogModelMetadata(entry, model, fallbackDisplayName);
   if (!isRouted) applyNativeOpenAiContextOverride(entry);
   return ensureStrictCatalogFields(normalizeServiceTiers(entry), {
     preserveExactInputModalities: preserveExact,
@@ -247,6 +248,50 @@ export function deriveEntry(
   });
 }
 
+function configuredDisplayName(model: CatalogModel): string {
+  return typeof model.displayName === "string" ? model.displayName.trim() : "";
+}
+
+function defaultPickerLabel(model: CatalogModel): string {
+  const nativeId = model.id.trim();
+  return nativeId.slice(nativeId.lastIndexOf("/") + 1).trim();
+}
+
+/**
+ * Keep the common picker path compact, but retain only as much route context as needed when two
+ * emitted rows would otherwise have the same label. Explicit display names and combo aliases are
+ * author-owned and never rewritten. If distinct native ids share a basename, the native id is
+ * enough; if the same native id is exposed by multiple providers, append the provider as well.
+ */
+function routedFallbackDisplayNames(models: readonly CatalogModel[]): Map<CatalogModel, string> {
+  const intendedLabel = (model: CatalogModel): string =>
+    configuredDisplayName(model) || model.alias?.trim() || defaultPickerLabel(model);
+  const labelCounts = new Map<string, number>();
+  const nativeIdCounts = new Map<string, number>();
+  for (const model of models) {
+    const label = intendedLabel(model);
+    if (!label) continue;
+    labelCounts.set(label, (labelCounts.get(label) ?? 0) + 1);
+    const nativeKey = `${label}\u0000${model.id.trim()}`;
+    nativeIdCounts.set(nativeKey, (nativeIdCounts.get(nativeKey) ?? 0) + 1);
+  }
+
+  const out = new Map<CatalogModel, string>();
+  for (const model of models) {
+    if (configuredDisplayName(model) || model.alias) continue;
+    const label = defaultPickerLabel(model);
+    if (!label) continue;
+    if ((labelCounts.get(label) ?? 0) <= 1) {
+      out.set(model, label);
+      continue;
+    }
+    const nativeId = model.id.trim();
+    const sameNativeIdCount = nativeIdCounts.get(`${label}\u0000${nativeId}`) ?? 0;
+    out.set(model, sameNativeIdCount > 1 ? `${nativeId} (${model.provider})` : nativeId);
+  }
+  return out;
+}
+
 export function buildCatalogEntries(
   template: RawEntry | null,
   gptSlugs: string[],
@@ -271,22 +316,28 @@ export function buildCatalogEntries(
     if (rank.has(slug)) e.priority = rank.get(slug)!;
     out.push(e);
   }
-  for (const m of goModels) {
-    if (collisionSkipped.has(m)) continue;
+  const routedModels = goModels.filter(m => {
+    if (collisionSkipped.has(m)) return false;
     const slug = catalogModelSlug(m);
     if (m.provider !== COMBO_NAMESPACE && comboPublicSlugs.has(slug)) {
       warnComboMasqueradeCollisionOnce(slug);
-      continue;
+      return false;
     }
+    return true;
+  });
+  const fallbackDisplayNames = routedFallbackDisplayNames(routedModels);
+  for (const m of routedModels) {
+    const slug = catalogModelSlug(m);
     // Provider rows use the one-slash slug codec; combo aliases intentionally override that
     // public slug and may be bare.
     const e = deriveEntry(
       template,
       slug,
-      `Routed via opencodex → ${m.provider} (${m.owned_by ?? m.provider}).`,
+      `Routed via opencodex → ${slug} (${m.owned_by ?? m.provider}).`,
       5,
       m,
       exactComboSlugs,
+      fallbackDisplayNames.get(m),
     );
     // Featured picks may be stored raw (legacy) or encoded — honor both.
     const rankHit = rank.get(slug) ?? rank.get(`${m.provider}/${m.id}`);
@@ -492,6 +543,12 @@ export async function syncCatalogModels(config: OcxConfig): Promise<{
   const catalog = loadCatalogForSync(catalogPath);
   if (!catalog) return { added: 0, path: catalogPath, catalogWritten: false, comboOmissions: [] };
 
+  // The bundled catalog is a reliable native template on the default path, but it is not the
+  // merge source. Preservation must inspect the file that this sync is about to overwrite;
+  // otherwise an empty/partial provider gather cannot see routed or user-native rows on disk.
+  const onDiskCatalog = readCatalog(catalogPath);
+  const catalogModelsForMerge = onDiskCatalog?.models ?? catalog.models ?? [];
+
   const template = findNativeTemplate(catalog);
 
   const comboOmissions: ComboCatalogOmission[] = [];
@@ -534,7 +591,7 @@ export async function syncCatalogModels(config: OcxConfig): Promise<{
   // bare gpt-* rows that hard-404 via NoEnabledOpenAiProviderError. Keep natives when no
   // providers are configured yet (fresh install / catalog bootstrap tests).
   const includeNativeOpenAi = enabledProviders.length === 0 || hasCanonicalOpenai;
-  catalog.models = mergeCatalogEntriesForSync(catalog.models ?? [], goEntries, baseline, featured, wsEnabled, goIds, template, disabledNativeSlugs(config), gatheredProviderNames, multiAgentMode, exactComboSlugs, hasPhysicalComboProvider, includeNativeOpenAi);
+  catalog.models = mergeCatalogEntriesForSync(catalogModelsForMerge, goEntries, baseline, featured, wsEnabled, goIds, template, disabledNativeSlugs(config), gatheredProviderNames, multiAgentMode, exactComboSlugs, hasPhysicalComboProvider, includeNativeOpenAi);
   clampCatalogModelsToCodexSupport(catalog.models);
 
   atomicWriteFile(catalogPath, JSON.stringify(catalog, null, 2) + "\n");

package/src/codex/catalog.ts

@@ -1,8 +1,8 @@
 // AUTO-SPLIT facade: original catalog.ts body moved into ./catalog/* modules.
 // Public surface preserved exactly; importers keep using "src/codex/catalog".
-export { isMediaGenerationModelId, shouldExposeRoutedModel, readCodexCatalogPath, normalizeRoutedCatalogEntry, catalogModelSlug, filterSupportedNativeSlugs, catalogModelSupportsReasoningSummaries } from "./catalog/parsing";
+export { isMediaGenerationModelId, shouldExposeRoutedModel, readCodexCatalogPath, readCatalog, normalizeRoutedCatalogEntry, catalogModelSlug, filterSupportedNativeSlugs, catalogModelSupportsReasoningSummaries } from "./catalog/parsing";
 export type { CatalogModel, MultiAgentMode } from "./catalog/parsing";
-export { NATIVE_OPENAI_MODELS, nativeOpenAiContextWindow, disabledNativeSlugs, visibleNativeSlugs, nativeModelRows, applyNativeVisibility, upstreamNativeEntry, nativeOpenAiSlugs, listCatalogNativeSlugs } from "./catalog/metadata";
+export { NATIVE_OPENAI_MODELS, nativeOpenAiContextWindow, disabledNativeSlugs, visibleNativeSlugs, desktopVisibleNativeSlugs, nativeModelRows, applyNativeVisibility, upstreamNativeEntry, nativeOpenAiSlugs, listCatalogNativeSlugs } from "./catalog/metadata";
 export { isSpawnableCodexCandidate, codexExecInvocation, loadBundledCodexCatalog, materializeBundledCodexCatalog, loadCatalogTemplate } from "./catalog/bundled";
 export { nativeEffortClamp, shouldApplyNativeEffortClamp, catalogModelEfforts, codexSupportedReasoningEfforts, clampedDefaultEffort, clampEntryToCodexSupportedEfforts, clampCatalogModelsToCodexSupport } from "./catalog/effort";
 export { applyProviderConfigHints, isDatedVariantId, filterCatalogVisibleModels, gatherRoutedModels, clearGatherRoutedModelsInflight, augmentRoutedModelsWithRegistryOpenAiApiRows, augmentRoutedModelsWithJawcodeMetadata } from "./catalog/provider-fetch";

package/src/codex/inject.ts

@@ -296,10 +296,10 @@ function stripExistingModelProvider(content: string): string {
 }
 
 /**
- * Drop ROOT-level `model_context_window` / `model_auto_compact_token_limit` overrides (keys before
- * the first table header). Codex treats these root keys as a global override that wins over the
- * per-model catalog values, so a stale `model_context_window = 1000000` makes every model (e.g.
- * gpt-5.5) report a 1M window. Stripping them on (re)injection lets the catalog drive context size.
+ * Drop ROOT-level `model_context_window` overrides (keys before the first table header). Codex
+ * treats this root key as a global override that wins over the per-model catalog values, so a stale
+ * `model_context_window = 1000000` makes every model (e.g. gpt-5.5) report a 1M window. User-owned
+ * compaction limits do not alter the advertised context window and must survive reinjection.
  */
 export function stripRootContextWindowOverrides(content: string): string {
   const lines = content.split("\n");
@@ -307,7 +307,7 @@ export function stripRootContextWindowOverrides(content: string): string {
   return lines
     .filter((line, i) => {
       const isRoot = firstTable === -1 || i < firstTable;
-      return !isRoot || !/^\s*model_(?:context_window|auto_compact_token_limit)\s*=/.test(line);
+      return !isRoot || !/^\s*model_context_window\s*=/.test(line);
     })
     .join("\n");
 }

package/src/codex/main-account-cache.ts

@@ -1,4 +1,7 @@
 import type { StoredAccountQuota } from "./quota";
+import { truncateRetainedUtf8 } from "../lib/admission";
+
+const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
 
 export interface MainAccountInfo {
   email: string | null;
@@ -17,7 +20,11 @@ export function getMainAccountInfoCache(): CachedMainAccountInfo | null {
 }
 
 export function setMainAccountInfoCache(value: CachedMainAccountInfo): void {
-  cachedMainAccountInfo = value;
+  cachedMainAccountInfo = {
+    ...value,
+    email: value.email === null ? null : truncateRetainedUtf8(value.email, MAX_DIAGNOSTIC_VALUE_BYTES),
+    plan: value.plan === null ? null : truncateRetainedUtf8(value.plan, MAX_DIAGNOSTIC_VALUE_BYTES),
+  };
 }
 
 export function clearMainAccountInfoCache(): void {

package/src/codex/model-cache.ts

@@ -8,6 +8,8 @@
  * restarts, so an in-memory cache is sufficient here (no SQLite layer needed).
  */
 import type { CatalogModel } from "./catalog";
+import type { GenerationContext } from "../lib/state-store-sweeper";
+import { enforceAppOwnedMemoryBudget, type RetainedStoreSnapshot } from "../lib/app-owned-memory";
 
 /** Default freshness window. Matches Codex's own 5-min models cache so the two stay in step. */
 export const DEFAULT_MODEL_CACHE_TTL_MS = 5 * 60 * 1000;
@@ -15,6 +17,7 @@ export const DEFAULT_MODEL_CACHE_TTL_MS = 5 * 60 * 1000;
 interface CacheEntry {
   models: CatalogModel[];
   fetchedAt: number;
+  sizeBytes: number;
 }
 
 export type ProviderModelDiscoveryFailureReason =
@@ -40,6 +43,29 @@ export type ProviderModelDiscoveryFailure = ProviderModelDiscoveryStatus extends
   : never;
 
 const cache = new Map<string, CacheEntry>();
+let cacheBytes = 0;
+let oldestCachedProvider: string | undefined;
+let oldestCachedAt: number | null = null;
+const modelCacheEncoder = new TextEncoder();
+
+function recomputeOldestCachedProvider(): void {
+  oldestCachedProvider = undefined;
+  oldestCachedAt = null;
+  for (const [provider, entry] of cache) {
+    if (oldestCachedAt !== null && entry.fetchedAt >= oldestCachedAt) continue;
+    oldestCachedProvider = provider;
+    oldestCachedAt = entry.fetchedAt;
+  }
+}
+
+function deleteCachedProvider(provider: string): number {
+  const entry = cache.get(provider);
+  if (!entry) return 0;
+  cache.delete(provider);
+  cacheBytes = Math.max(0, cacheBytes - entry.sizeBytes);
+  if (oldestCachedProvider === provider) recomputeOldestCachedProvider();
+  return entry.sizeBytes;
+}
 
 /** Cooldown after a failed live `/models` fetch, so a dead/unreachable provider doesn't re-pay
  * the full fetch timeout on every catalog poll (issue #54: UI stalls behind corporate proxies). */
@@ -54,6 +80,7 @@ const discoveryStatus = new Map<string, ProviderModelDiscoveryStatus>();
  * custom-only, and the provider's configured fallback would wrongly stay authoritative.
  */
 const liveModelCounts = new Map<string, number>();
+let lastReconciledGeneration = 0;
 
 export function markModelsFetchFailure(provider: string, now = Date.now()): void {
   failureAt.set(provider, now);
@@ -129,20 +156,72 @@ export function getStaleCached(provider: string): CatalogModel[] | null {
 }
 
 export function setCached(provider: string, models: CatalogModel[], now = Date.now()): void {
-  cache.set(provider, { models, fetchedAt: now });
+  deleteCachedProvider(provider);
+  const sizeBytes = modelCacheEncoder.encode(provider).byteLength
+    + modelCacheEncoder.encode(JSON.stringify(models)).byteLength;
+  cache.set(provider, { models, fetchedAt: now, sizeBytes });
+  cacheBytes += sizeBytes;
+  if (oldestCachedAt === null || now < oldestCachedAt) {
+    oldestCachedProvider = provider;
+    oldestCachedAt = now;
+  }
+  enforceAppOwnedMemoryBudget();
 }
 
 /** Drop one provider's cache (or all) so the next resolve forces a live re-fetch. */
 export function clearModelCache(provider?: string): void {
   if (provider) {
-    cache.delete(provider);
+    deleteCachedProvider(provider);
     failureAt.delete(provider);
     discoveryStatus.delete(provider);
     liveModelCounts.delete(provider);
   } else {
     cache.clear();
+    cacheBytes = 0;
+    oldestCachedProvider = undefined;
+    oldestCachedAt = null;
     failureAt.clear();
     discoveryStatus.clear();
     liveModelCounts.clear();
   }
 }
+
+export function reconcileModelCacheProviders(
+  validProviders: ReadonlySet<string>,
+  generation = lastReconciledGeneration + 1,
+): number {
+  if (generation <= lastReconciledGeneration) return 0;
+  const removedProviders = new Set<string>();
+  for (const store of [failureAt, discoveryStatus, liveModelCounts]) {
+    for (const provider of store.keys()) {
+      if (validProviders.has(provider)) continue;
+      store.delete(provider);
+      removedProviders.add(provider);
+    }
+  }
+  for (const provider of cache.keys()) {
+    if (validProviders.has(provider)) continue;
+    deleteCachedProvider(provider);
+    removedProviders.add(provider);
+  }
+  lastReconciledGeneration = generation;
+  return removedProviders.size;
+}
+
+export function reconcileModelCacheGeneration(context: GenerationContext): number {
+  return reconcileModelCacheProviders(context.providerNames, context.generation);
+}
+
+export function modelCacheRetainedStoreSnapshot(): RetainedStoreSnapshot {
+  return {
+    count: cache.size,
+    bytes: cacheBytes,
+    evictableBytes: cacheBytes,
+    pinnedBytes: 0,
+    oldestAt: oldestCachedAt,
+  };
+}
+
+export function evictOldestModelCacheForBudget(): number {
+  return oldestCachedProvider === undefined ? 0 : deleteCachedProvider(oldestCachedProvider);
+}

package/src/codex/pool-rotation.ts

@@ -1,4 +1,5 @@
 import type { OcxAccountPoolRotationStrategy } from "../types";
+import type { GenerationContext } from "../lib/state-store-sweeper";
 
 export const POOL_KEY_CODEX = "codex";
 export const POOL_KEY_ANTHROPIC = "anthropic";
@@ -10,6 +11,7 @@ interface SelectionState {
 }
 
 const selectionState = new Map<string, SelectionState>();
+let lastReconciledGeneration = 0;
 
 const DEFAULT_STICKY_LIMIT = 1;
 const MIN_STICKY_LIMIT = 1;
@@ -184,3 +186,40 @@ export function clearPoolRotationState(poolKey?: string): void {
   }
   selectionState.delete(poolKey);
 }
+
+export function reconcilePoolRotationState(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  const anthropicIds = new Set<string>();
+  for (const key of context.oauthAccountKeys) {
+    const separator = key.indexOf("\0");
+    if (separator > 0 && key.slice(0, separator) === "anthropic") {
+      anthropicIds.add(key.slice(separator + 1));
+    }
+  }
+  let removed = 0;
+  for (const [poolKey, state] of selectionState) {
+    const valid = poolKey === POOL_KEY_ANTHROPIC
+      ? anthropicIds
+      : poolKey === POOL_KEY_CODEX || poolKey.startsWith(`${POOL_KEY_CODEX}:`)
+        ? context.codexAccountIds
+        : null;
+    if (!valid) continue;
+    if (valid.size === 0) {
+      selectionState.delete(poolKey);
+      removed += 1;
+      continue;
+    }
+    if (state.activeKey && !valid.has(state.activeKey)) {
+      delete state.activeKey;
+      state.successes = 0;
+      removed += 1;
+    }
+    for (const accountId of state.currentWeights.keys()) {
+      if (valid.has(accountId)) continue;
+      state.currentWeights.delete(accountId);
+      removed += 1;
+    }
+  }
+  lastReconciledGeneration = context.generation;
+  return removed;
+}

package/src/codex/project-config-warnings.ts

@@ -3,9 +3,11 @@ import path, { dirname, join, resolve } from "node:path";
 import { expandUserPath } from "../config";
 import { defaultCodexHome } from "./home";
 import { readRootTomlString } from "./paths";
+import { truncateRetainedUtf8 } from "../lib/admission";
 
 const OCX_SECTION_MARKER = "# Auto-injected by opencodex";
 const DIAGNOSTICS_CACHE_TTL_MS = 30_000;
+const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
 
 function resolveCodexConfigPath(): string {
   const raw = process.env.CODEX_HOME?.trim();
@@ -309,7 +311,16 @@ export function getCachedProjectConfigDiagnostics(): {
 } {
   const now = Date.now();
   if (!diagnosticsCache || now - diagnosticsCache.at > DIAGNOSTICS_CACHE_TTL_MS) {
-    diagnosticsCache = { at: now, warnings: collectProjectCodexConfigWarnings() };
+    diagnosticsCache = {
+      at: now,
+      warnings: collectProjectCodexConfigWarnings().map(warning => ({
+        ...warning,
+        path: truncateRetainedUtf8(warning.path, MAX_DIAGNOSTIC_VALUE_BYTES),
+        detail: truncateRetainedUtf8(warning.detail, MAX_DIAGNOSTIC_VALUE_BYTES),
+        ...(warning.profileName === undefined ? {} : { profileName: truncateRetainedUtf8(warning.profileName, MAX_DIAGNOSTIC_VALUE_BYTES) }),
+        message: truncateRetainedUtf8(warning.message, MAX_DIAGNOSTIC_VALUE_BYTES),
+      })),
+    };
   }
   const warnings = diagnosticsCache.warnings;
   return { warnings, grouped: groupProjectCodexConfigWarningsByPath(warnings) };