@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/codex/quota.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { atomicWriteFile, getConfigDir } from "../config";
+import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
 
 export type StoredAccountQuota = {
   weeklyPercent?: number;
@@ -49,8 +50,16 @@ const MONTHLY_WINDOW_MIN_SECONDS = 28 * 24 * 60 * 60;
 const MONTHLY_WINDOW_MIN_MINUTES = MONTHLY_WINDOW_MIN_SECONDS / 60;
 
 const accountQuota = new Map<string, StoredAccountQuota>();
+let lastReconciledGeneration = 0;
+let liveAccountIds = new Set<string>();
 
-export const CODEX_UNKNOWN_USAGE_SCORE = 100;
+function mayCommitAccountQuota(accountId: string, writerGeneration: number): boolean {
+  return writerGeneration >= lastReconciledGeneration || liveAccountIds.has(accountId);
+}
+
+// Valid upstream percentages are normalized to 0..100. Keep "unknown" outside that domain so an
+// actually exhausted account is still eligible for threshold rotation.
+export const CODEX_UNKNOWN_USAGE_SCORE = 101;
 export const CODEX_EXHAUSTED_USAGE_PERCENT = 100;
 
 export function isCodexQuotaExhausted(
@@ -125,8 +134,10 @@ function snapshotHasUsage(quota: Omit<StoredAccountQuota, "updatedAt">): boolean
 export function setAccountQuotaFromParsed(
   accountId: string,
   quota: Omit<StoredAccountQuota, "updatedAt"> | null,
+  writerGeneration = captureConfigGeneration(),
 ): void {
   if (!quota) return;
+  if (!mayCommitAccountQuota(accountId, writerGeneration)) return;
   const existing = accountQuota.get(accountId);
   const next: StoredAccountQuota = { updatedAt: Date.now() };
   const creditsOnly = quota.resetCredits !== undefined && !snapshotHasUsage(quota);
@@ -214,10 +225,14 @@ export function parseUpstreamQuotaHeaders(headers: Headers): Omit<StoredAccountQ
   return hasKnownQuotaValue(quota) ? quota : null;
 }
 
-export function applyAccountQuotaFromUpstreamHeaders(accountId: string, headers: Headers): void {
+export function applyAccountQuotaFromUpstreamHeaders(
+  accountId: string,
+  headers: Headers,
+  writerGeneration = captureConfigGeneration(),
+): void {
   const quota = parseUpstreamQuotaHeaders(headers);
   if (!quota) return;
-  setAccountQuotaFromParsed(accountId, quota);
+  setAccountQuotaFromParsed(accountId, quota, writerGeneration);
 }
 
 export function updateAccountQuota(
@@ -227,7 +242,9 @@ export function updateAccountQuota(
   monthly?: unknown,
   monthlyResetAt?: unknown,
   resetCredits?: number,
+  writerGeneration = captureConfigGeneration(),
 ): void {
+  if (!mayCommitAccountQuota(accountId, writerGeneration)) return;
   const existing = accountQuota.get(accountId);
   const nextWeekly = normalizeUsagePercent(weekly);
   const nextMonthly = normalizeUsagePercent(monthly);
@@ -325,6 +342,21 @@ export function clearAccountQuota(accountId?: string): void {
   }
 }
 
+export function reconcileCodexQuotaAccounts(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  hydrateAccountQuotasFromDisk();
+  let removed = 0;
+  for (const accountId of accountQuota.keys()) {
+    if (context.codexAccountIds.has(accountId)) continue;
+    accountQuota.delete(accountId);
+    removed += 1;
+  }
+  liveAccountIds = new Set(context.codexAccountIds);
+  lastReconciledGeneration = context.generation;
+  if (removed > 0) schedulePersistAccountQuotas();
+  return removed;
+}
+
 export function parseUsageQuota(data: WhamUsageResponse): Omit<StoredAccountQuota, "updatedAt"> | null {
   const resetCredits = typeof data.rate_limit_reset_credits?.available_count === "number"
     ? data.rate_limit_reset_credits.available_count

package/src/codex/routing.ts

@@ -19,6 +19,9 @@ import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./quota";
 import { MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "./main-account";
 import { isSelectableCodexPoolAccount } from "./account-id";
 import type { OcxConfig } from "../types";
+import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
+import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { retainedUtf8Bytes } from "../lib/admission";
 
 type ThreadAffinityEntry = {
   accountId: string;
@@ -104,6 +107,7 @@ const CODEX_TRANSIENT_SOFT_AVOID_ESCALATION_MS = [
 ] as const;
 export const CODEX_THREAD_AFFINITY_IDLE_TTL_MS = 24 * 60 * 60_000;
 export const CODEX_THREAD_AFFINITY_MAX_ENTRIES = 2048;
+const MAX_AFFINITY_COMPONENT_BYTES = 512;
 // Min interval between quota threshold re-evaluations for a single bound thread.
 // Well under the 5h/weekly quota windows, but enough to stop per-request flapping.
 export const CODEX_THREAD_AFFINITY_REEVAL_INTERVAL_MS = 60_000;
@@ -115,6 +119,8 @@ const upstreamHealth = new Map<string, CodexUpstreamHealth>();
  * from account-wide Retry-After/default throttles and transient health.
  */
 const quotaScopedHealth = new Map<string, Map<CodexQuotaScope, CodexUpstreamHealth>>();
+let lastReconciledGeneration = 0;
+let liveHealthAccountIds = new Set<string>();
 
 export type CodexUpstreamOutcome = number | "connect_error" | "timeout";
 export type CodexUpstreamOutcomeClass = "success" | "credential" | "quota" | "transient" | "caller" | "unknown";
@@ -185,6 +191,8 @@ export type CodexUpstreamOutcomeMeta = {
    * again (which would advance a round-robin ring twice).
    */
   promoteAccountId?: string;
+  /** Generation captured when this routed account was selected. */
+  writerGeneration?: number;
 };
 
 function hasConfiguredPoolAccount(config: OcxConfig, accountId: string): boolean {
@@ -193,6 +201,15 @@ function hasConfiguredPoolAccount(config: OcxConfig, accountId: string): boolean
     .some(account => isSelectableCodexPoolAccount(account) && account.id === accountId);
 }
 
+export function listLiveCodexAccountIds(config: OcxConfig): ReadonlySet<string> {
+  const ids = new Set((config.codexAccounts ?? []).map(account => account.id));
+  const openai = config.providers.openai;
+  if (openai && openai.disabled !== true && isCanonicalOpenAiForwardProvider(openai)) {
+    ids.add(MAIN_CODEX_ACCOUNT_ID);
+  }
+  return ids;
+}
+
 export function clearThreadAccountMap(): void {
   threadAccountMap.clear();
 }
@@ -217,6 +234,24 @@ export function clearCodexUpstreamHealthForAccount(accountId: string): void {
   quotaScopedHealth.delete(accountId);
 }
 
+export function reconcileCodexRoutingHealth(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  let removed = 0;
+  for (const accountId of upstreamHealth.keys()) {
+    if (context.codexAccountIds.has(accountId)) continue;
+    upstreamHealth.delete(accountId);
+    removed += 1;
+  }
+  for (const accountId of quotaScopedHealth.keys()) {
+    if (context.codexAccountIds.has(accountId)) continue;
+    quotaScopedHealth.delete(accountId);
+    removed += 1;
+  }
+  liveHealthAccountIds = new Set(context.codexAccountIds);
+  lastReconciledGeneration = context.generation;
+  return removed;
+}
+
 export function getCodexUpstreamHealth(
   accountId: string,
 ): CodexUpstreamHealth | null {
@@ -600,11 +635,17 @@ function threadAffinityScope(quotaScope?: CodexQuotaScope): ThreadAffinityScope
   return quotaScope ?? LEGACY_THREAD_AFFINITY_SCOPE;
 }
 
+function admissibleAffinityComponent(value: string): boolean {
+  return retainedUtf8Bytes(value) <= MAX_AFFINITY_COMPONENT_BYTES;
+}
+
 function getThreadAffinity(threadId: string, quotaScope?: CodexQuotaScope): ThreadAffinityEntry | undefined {
+  if (!admissibleAffinityComponent(threadId)) return undefined;
   return threadAccountMap.get(threadId)?.get(threadAffinityScope(quotaScope));
 }
 
 function deleteThreadAffinity(threadId: string, quotaScope?: CodexQuotaScope): void {
+  if (!admissibleAffinityComponent(threadId)) return;
   const affinities = threadAccountMap.get(threadId);
   if (!affinities) return;
   affinities.delete(threadAffinityScope(quotaScope));
@@ -613,6 +654,7 @@ function deleteThreadAffinity(threadId: string, quotaScope?: CodexQuotaScope): v
 
 /** Remove only the matching failed account's affinities for one thread. */
 function deleteThreadAffinitiesForAccount(threadId: string, accountId: string): void {
+  if (!admissibleAffinityComponent(threadId) || !admissibleAffinityComponent(accountId)) return;
   const affinities = threadAccountMap.get(threadId);
   if (!affinities) return;
   for (const [scope, entry] of affinities) {
@@ -671,6 +713,7 @@ function bindThreadAffinity(
   now: number,
   quotaScope?: CodexQuotaScope,
 ): void {
+  if (!admissibleAffinityComponent(threadId) || !admissibleAffinityComponent(accountId)) return;
   const record = accountId === MAIN_CODEX_ACCOUNT_ID ? undefined : readCodexAccountRecord(accountId);
   if (accountId !== MAIN_CODEX_ACCOUNT_ID && (!record?.credential || record.deletedAt != null)) return;
   pruneExpiredThreadAffinities(now);
@@ -1204,6 +1247,8 @@ export function recordCodexUpstreamOutcome(
   meta: CodexUpstreamOutcomeMeta = {},
 ): void {
   if (!accountId) return;
+  const writerGeneration = meta.writerGeneration ?? captureConfigGeneration();
+  if (writerGeneration < lastReconciledGeneration && !liveHealthAccountIds.has(accountId)) return;
   const now = meta.now ?? Date.now();
   const outcomeClass = classifyCodexUpstreamOutcome(outcome);
   const quotaScope = codexQuotaScopeForModel(meta.modelId);
@@ -1275,7 +1320,7 @@ export function recordCodexUpstreamOutcome(
       lastFailureAt: now,
     });
     quotaScopedHealth.delete(accountId);
-    markAccountNeedsReauth(accountId);
+    markAccountNeedsReauth(accountId, writerGeneration);
     clearThreadAccountMapForAccount(accountId);
     return;
   }

package/src/codex/shim.ts

@@ -25,12 +25,14 @@ import { serviceApiTokenFilePath } from "../lib/service-secrets";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { windowsEnvIndirectBatchValue } from "../lib/win-paths";
 import { isWslRuntime, wslAutomountRoot } from "./home";
+import { truncateRetainedUtf8 } from "../lib/admission";
 
 const SHIM_MARKER = "opencodex codex autostart shim";
 const CODEX_SHIM_PROBE_BYTES = 16 * 1024;
 export const CODEX_SHIM_REPLACEMENT_STABLE_MS = 100;
 export const CODEX_SHIM_STATE_MAX_BYTES = 1024 * 1024;
 const CODEX_SHIM_RESTORE_LOCK_STALE_MS = 30_000;
+const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
 let lastShimDiscoveryError: string | null = null;
 /** Last human-readable reason discovery returned null (exposed for doctor/tests). */
 export function lastCodexDiscoveryError(): string | null {
@@ -309,10 +311,12 @@ export function findCodexOnPath(deps: CodexPathScanDeps = {}): string | null {
   }
 
   if (skippedInterop) {
-    lastShimDiscoveryError =
+    lastShimDiscoveryError = truncateRetainedUtf8(
       `Found a Windows codex at ${skippedInterop} via WSL PATH interop, but no Linux-side codex. ` +
       "Refusing to shim a Windows launcher from WSL (a WSL shim breaks Windows invocations). " +
-      "Install codex inside WSL (npm i -g @openai/codex), or run 'ocx ensure' from Windows to shim the Windows side.";
+      "Install codex inside WSL (npm i -g @openai/codex), or run 'ocx ensure' from Windows to shim the Windows side.",
+      MAX_DIAGNOSTIC_VALUE_BYTES,
+    );
   }
   return null;
 }
@@ -324,9 +328,11 @@ function findWindowsCodexTargets(): ShimFileState[] | null {
     if (existsSync(exe) && !isShim(exe)) {
       try {
         if (!lstatSync(exe).isDirectory()) {
-          lastShimDiscoveryError =
+          lastShimDiscoveryError = truncateRetainedUtf8(
             `Found codex.exe at ${exe}. Refusing to rename a real .exe because exact codex.exe invocations would break; ` +
-            "install a codex.cmd/codex.ps1 launcher or use `ocx service install` for autostart.";
+            "install a codex.cmd/codex.ps1 launcher or use `ocx service install` for autostart.",
+            MAX_DIAGNOSTIC_VALUE_BYTES,
+          );
           return null;
         }
       } catch { /* keep scanning */ }

package/src/codex/subagent-model-fallback.ts

@@ -26,6 +26,7 @@ import { isThreadSpawnRequest } from "../server/effort-policy";
 import { PROVIDER_REGISTRY } from "../providers/registry";
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
 import { routeModel, type RouteResult } from "../router";
+import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 export const DEFAULT_SUBAGENT_MODEL_FALLBACK_POLL_MS = 60_000;
 
 type SubagentQuotaPrimeFn = (config: OcxConfig, reason: string) => Promise<void>;
@@ -245,6 +246,17 @@ export function noteSubagentModelFailure(
       reason: "quota_exhausted",
     },
   );
+  sweepExpiredOnWrite(now);
+}
+
+export function sweepExpiredSubagentModelHealth(now = Date.now()): number {
+  let removed = 0;
+  for (const [key, health] of modelHealth) {
+    if (health.unavailableUntil > now) continue;
+    modelHealth.delete(key);
+    removed += 1;
+  }
+  return removed;
 }
 
 export function resetSubagentModelFallbackStateForTests(): void {

package/src/codex/websocket-registry.ts

@@ -1,5 +1,32 @@
 import type { ServerWebSocket } from "bun";
 import type { WsData } from "../server/ws-bridge";
+import { createAdmissionGate, type AdmissionMetrics, type AdmissionReservation } from "../lib/admission";
+
+export const MAX_TRACKED_CODEX_WEBSOCKETS = 128;
+const websocketGate = createAdmissionGate("codex_websockets", MAX_TRACKED_CODEX_WEBSOCKETS);
+
+export function tryReserveCodexWebSocket(): AdmissionReservation<ServerWebSocket<WsData>> | null {
+  const gateLease = websocketGate.tryAcquire();
+  if (!gateLease) return null;
+  let socket: ServerWebSocket<WsData> | undefined;
+  let active = true;
+  return {
+    bind(value) {
+      if (!active) return;
+      socket = value;
+    },
+    release() {
+      if (!active) return;
+      active = false;
+      socket = undefined;
+      gateLease.release();
+    },
+  };
+}
+
+export function codexWebSocketAdmissionMetrics(): AdmissionMetrics {
+  return websocketGate.metrics();
+}
 
 const socketsByAccount = new Map<string, Set<ServerWebSocket<WsData>>>();
 

package/src/combos/failover.ts

@@ -1,6 +1,11 @@
 import { classifyError, isCyberPolicyCode } from "../lib/errors";
 import type { OcxComboTarget } from "../types";
 import { targetKey } from "./types";
+import {
+  captureConfigGeneration,
+  sweepExpiredOnWrite,
+  type GenerationContext,
+} from "../lib/state-store-sweeper";
 
 interface TargetCooldown {
   cooldownUntil: number;
@@ -11,6 +16,8 @@ const MAX_COOLDOWN_MS = 10 * 60_000;
 
 /** Map<`${comboId}\0${provider/model}`, TargetCooldown> */
 const targetCooldowns = new Map<string, TargetCooldown>();
+let lastReconciledGeneration = 0;
+let liveComboTargets = new Set<string>();
 
 function cooldownMapKey(
   comboId: string,
@@ -55,20 +62,43 @@ export function isComboTargetInCooldown(
 export function coolComboTarget(
   comboId: string,
   target: Pick<OcxComboTarget, "provider" | "model">,
-  options?: { retryAfter?: string | null; now?: number; cooldownMs?: number },
+  options?: { retryAfter?: string | null; now?: number; cooldownMs?: number; writerGeneration?: number },
 ): void {
   const now = options?.now ?? Date.now();
+  const writerGeneration = options?.writerGeneration ?? captureConfigGeneration();
+  const ownerKey = `${comboId}::${targetKey(target)}`;
+  if (writerGeneration < lastReconciledGeneration && !liveComboTargets.has(ownerKey)) return;
   const cooldownMs = options?.cooldownMs
     ?? parseRetryAfterMs(options?.retryAfter, now)
     ?? DEFAULT_COOLDOWN_MS;
   targetCooldowns.set(cooldownMapKey(comboId, target), {
     cooldownUntil: now + Math.min(Math.max(cooldownMs, 1), MAX_COOLDOWN_MS),
   });
+  sweepExpiredOnWrite(now);
+}
+
+export function reconcileComboTargetCooldowns(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  liveComboTargets = new Set(context.comboTargets);
+  lastReconciledGeneration = context.generation;
+  return 0;
+}
+
+export function sweepExpiredComboTargetCooldowns(now = Date.now()): number {
+  let removed = 0;
+  for (const [key, cooldown] of targetCooldowns) {
+    if (cooldown.cooldownUntil > now) continue;
+    targetCooldowns.delete(key);
+    removed += 1;
+  }
+  return removed;
 }
 
 export function clearComboTargetCooldowns(comboId?: string): void {
   if (comboId === undefined) {
     targetCooldowns.clear();
+    liveComboTargets.clear();
+    lastReconciledGeneration = 0;
     return;
   }
   const prefix = `${comboId}\0`;

package/src/combos/request.ts

@@ -2,6 +2,15 @@ import type { OcxComboDefaultEffort, OcxComboTarget, OcxConfig } from "../types"
 import { resolveComboId } from "./types";
 
 const warnedUnsupportedDefaults = new Set<string>();
+let lastWarningReconciledGeneration = 0;
+
+export function reconcileComboWarningMemos(generation: number): number {
+  if (generation <= lastWarningReconciledGeneration) return 0;
+  const removed = warnedUnsupportedDefaults.size;
+  warnedUnsupportedDefaults.clear();
+  lastWarningReconciledGeneration = generation;
+  return removed;
+}
 
 export function resetComboEffortWarningStateForTests(): void {
   warnedUnsupportedDefaults.clear();

package/src/combos/resolve.ts

@@ -2,12 +2,17 @@ import type { OcxComboTarget, OcxConfig } from "../types";
 import { coolComboTarget, isComboTargetInCooldown } from "./failover";
 import { getCombo, resolveComboId, targetKey } from "./types";
 import type { NormalizedComboConfig } from "./types";
+import {
+  captureConfigGeneration,
+  type GenerationContext,
+} from "../lib/state-store-sweeper";
 
 export interface ComboPick {
   comboId: string;
   target: Required<OcxComboTarget>;
   targetIndex: number;
   attempted: string[];
+  writerGeneration: number;
 }
 
 interface SelectionState {
@@ -17,6 +22,17 @@ interface SelectionState {
 }
 
 const selectionState = new Map<string, SelectionState>();
+let lastReconciledGeneration = 0;
+let liveComboTargets = new Set<string>();
+
+function comboTargetOwnerKey(comboId: string, key: string): string {
+  return `${comboId}::${key}`;
+}
+
+function mayCommitComboState(comboId: string, key: string, writerGeneration: number): boolean {
+  return writerGeneration >= lastReconciledGeneration
+    || liveComboTargets.has(comboTargetOwnerKey(comboId, key));
+}
 
 export class UnknownComboError extends Error {
   constructor(readonly comboId: string) {
@@ -74,6 +90,7 @@ export function pickComboTarget(
     eligible?: (target: Required<OcxComboTarget>) => boolean;
   } = {},
 ): ComboPick | null {
+  const writerGeneration = captureConfigGeneration();
   const combo = getCombo(config, comboId);
   if (!combo) throw new UnknownComboError(comboId);
   const excluded = new Set(options.exclude ?? []);
@@ -114,6 +131,7 @@ export function pickComboTarget(
     target,
     targetIndex,
     attempted: [...excluded, targetKey(target)],
+    writerGeneration,
   };
 }
 
@@ -121,10 +139,13 @@ export function noteComboSuccess(
   comboId: string,
   combo: NormalizedComboConfig,
   target: Required<OcxComboTarget>,
+  writerGeneration = captureConfigGeneration(),
 ): void {
   if (combo.strategy !== "round-robin") return;
+  const key = targetKey(target);
+  if (!mayCommitComboState(comboId, key, writerGeneration)) return;
   const state = selectionState.get(comboId);
-  if (!state || state.activeKey !== targetKey(target)) return;
+  if (!state || state.activeKey !== key) return;
   state.successes += 1;
   if (state.successes >= combo.stickyLimit) {
     delete state.activeKey;
@@ -132,7 +153,12 @@ export function noteComboSuccess(
   }
 }
 
-export function noteComboFailure(comboId: string, target: OcxComboTarget): void {
+export function noteComboFailure(
+  comboId: string,
+  target: OcxComboTarget,
+  writerGeneration = captureConfigGeneration(),
+): void {
+  if (!mayCommitComboState(comboId, targetKey(target), writerGeneration)) return;
   const state = selectionState.get(comboId);
   if (state?.activeKey === targetKey(target)) {
     delete state.activeKey;
@@ -149,8 +175,11 @@ export function advanceComboAfterFailure(
     eligible?: (target: Required<OcxComboTarget>) => boolean;
   } = {},
 ): ComboPick | null {
-  noteComboFailure(pick.comboId, pick.target);
-  coolComboTarget(pick.comboId, pick.target, options);
+  noteComboFailure(pick.comboId, pick.target, pick.writerGeneration);
+  coolComboTarget(pick.comboId, pick.target, {
+    ...options,
+    writerGeneration: pick.writerGeneration,
+  });
   return pickComboTarget(config, pick.comboId, {
     exclude: pick.attempted,
     eligible: target => !isComboTargetInCooldown(pick.comboId, target, options.now)
@@ -158,9 +187,36 @@ export function advanceComboAfterFailure(
   });
 }
 
+export function reconcileComboRotationState(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  let removed = 0;
+  for (const [comboId, state] of selectionState) {
+    if (!context.comboIds.has(comboId)) {
+      selectionState.delete(comboId);
+      removed += 1;
+      continue;
+    }
+    if (state.activeKey && !context.comboTargets.has(comboTargetOwnerKey(comboId, state.activeKey))) {
+      delete state.activeKey;
+      state.successes = 0;
+      removed += 1;
+    }
+    for (const key of state.currentWeights.keys()) {
+      if (context.comboTargets.has(comboTargetOwnerKey(comboId, key))) continue;
+      state.currentWeights.delete(key);
+      removed += 1;
+    }
+  }
+  liveComboTargets = new Set(context.comboTargets);
+  lastReconciledGeneration = context.generation;
+  return removed;
+}
+
 export function clearComboSelectionState(comboId?: string): void {
   if (comboId === undefined) {
     selectionState.clear();
+    liveComboTargets.clear();
+    lastReconciledGeneration = 0;
     return;
   }
   selectionState.delete(comboId);

package/src/combos/types.ts

@@ -304,6 +304,18 @@ export function listComboIds(config: { combos?: Record<string, OcxComboConfig> }
   return Object.keys(config.combos ?? {}).sort((a, b) => a.localeCompare(b));
 }
 
+export function listLiveComboTargetKeys(
+  config: { combos?: Record<string, OcxComboConfig> },
+): ReadonlySet<string> {
+  const keys = new Set<string>();
+  for (const id of listComboIds(config)) {
+    const combo = getCombo(config, id);
+    if (!combo) continue;
+    for (const target of combo.targets) keys.add(`${id}::${targetKey(target)}`);
+  }
+  return keys;
+}
+
 export function getCombo(
   config: { combos?: Record<string, OcxComboConfig> },
   id: string,