@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/github/star-state.ts

@@ -79,7 +79,8 @@ async function spawnGh(args: string[], timeoutMs: number): Promise<{ status: num
   }
 }
 
-const defaultDeps: StarDeps = { runGh: spawnGh, nowMs: () => Date.now() };
+const productionDeps: StarDeps = { runGh: spawnGh, nowMs: () => Date.now() };
+let defaultDeps = productionDeps;
 
 let cached: { timestamp: number; state: StarState } | null = null;
 /** Coalesces concurrent probes so parallel sidebar polls share one `gh` run. */
@@ -148,6 +149,17 @@ export function invalidateStarStatusCache(): void {
   inflight = null;
 }
 
+/**
+ * Route tests must not launch the user's `gh` executable: its installation,
+ * authentication helper, and Windows shim are all outside the route contract.
+ * Production keeps the real runner; tests install an explicit deterministic
+ * dependency and must reset it afterwards.
+ */
+export function setStarDepsForTests(deps: StarDeps | null): void {
+  defaultDeps = deps ?? productionDeps;
+  invalidateStarStatusCache();
+}
+
 /**
  * Star the repository through the user's `gh` login. Returns the resulting
  * state so the caller does not need a second round trip; an unauthenticated

package/src/images/fulfill.ts

@@ -8,11 +8,32 @@ import {
   pruneArtifacts,
   type ImageBudget,
 } from "./artifacts";
+import { MAX_PENDING_IMAGE_FULFILLMENTS } from "../lib/translator-budget";
+
+const fulfillmentEncoder = new TextEncoder();
+let pendingFulfillments = 0;
+let fulfillmentCurrentBytes = 0;
+let fulfillmentHighWaterBytes = 0;
+
+function addFulfillmentBytes(bytes: number): void {
+  fulfillmentCurrentBytes += bytes;
+  fulfillmentHighWaterBytes = Math.max(fulfillmentHighWaterBytes, fulfillmentCurrentBytes);
+}
+
+function releaseFulfillmentBytes(bytes: number): void {
+  fulfillmentCurrentBytes = Math.max(0, fulfillmentCurrentBytes - bytes);
+}
+
+export function imageFulfillmentTailSnapshot(): { currentBytes: number; highWaterBytes: number; active: number } {
+  return { currentBytes: fulfillmentCurrentBytes, highWaterBytes: fulfillmentHighWaterBytes, active: pendingFulfillments };
+}
 
 /** Serialize write→prune→retain across concurrent fulfillments sharing artifacts/. */
 let retentionTail: Promise<void> = Promise.resolve();
 
 async function retainAfterBatch(paths: string[], keepCount?: number): Promise<string[]> {
+  const retainedBytes = paths.reduce((total, path) => total + fulfillmentEncoder.encode(path).byteLength, 0);
+  addFulfillmentBytes(retainedBytes);
   const run = retentionTail.then(() => {
     pruneArtifacts(keepCount);
     return paths.filter((p) => existsSync(p));
@@ -21,7 +42,11 @@ async function retainAfterBatch(paths: string[], keepCount?: number): Promise<st
     () => undefined,
     () => undefined,
   );
-  return run;
+  try {
+    return await run;
+  } finally {
+    releaseFulfillmentBytes(retainedBytes);
+  }
 }
 
 /**
@@ -35,6 +60,15 @@ export async function fulfillImageCall(
   budget: ImageBudget,
   signal?: AbortSignal,
 ): Promise<ImageCallResult> {
+  if (pendingFulfillments >= MAX_PENDING_IMAGE_FULFILLMENTS) {
+    return { ok: false, model: plan.model, prompt: "", files: [], count: 0, error: "image_fulfillment_busy" };
+  }
+  pendingFulfillments += 1;
+  const callBytes = fulfillmentEncoder.encode(call.id).byteLength
+    + fulfillmentEncoder.encode(call.name).byteLength
+    + fulfillmentEncoder.encode(call.arguments).byteLength;
+  addFulfillmentBytes(callBytes);
+  try {
   let args: unknown;
   try {
     args = JSON.parse(call.arguments || "{}");
@@ -108,4 +142,8 @@ export async function fulfillImageCall(
     // backslashes are not treated as escapes by renderers.
     markdown: `![image](${pathToFileURL(primary).href})`,
   };
+  } finally {
+    releaseFulfillmentBytes(callBytes);
+    pendingFulfillments -= 1;
+  }
 }

package/src/images/loop.ts

@@ -10,7 +10,7 @@
  * Removed vs web-search: no sidecar backend selection, no forced-answer nudge, no failed-query
  * dedup, no describeImages/structuredOutput, no recordSidecarOutcome.
  */
-import type { AdapterRequest, ProviderAdapter } from "../adapters/base";
+import type { AdapterRequest, IncomingMeta, ProviderAdapter } from "../adapters/base";
 import { existsSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { createAdapterEventQueue } from "../adapters/run-turn-queue";
@@ -20,6 +20,11 @@ import { bridgeToResponsesSSE } from "../bridge";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { fetchWithResetRetry } from "../lib/upstream-retry";
+import {
+  isTranslatorBudgetExceededError,
+  TRANSLATOR_MAX_TURN_BYTES,
+  TranslatorBudgetExceededError,
+} from "../lib/translator-budget";
 import { parseStreamWithProgress, RoutedModelInactivityError, WebSearchStreamProtocolError } from "../web-search/progress-stream";
 import { fulfillImageCall } from "./fulfill";
 import { parseVideoCallArgs, pollVideoWithHeartbeats, buildVideoResult, createVideoBudget } from "./fulfill-video";
@@ -200,6 +205,7 @@ class LoopError extends Error {
 export interface ImageBridgeDeps {
   parsed: OcxParsedRequest;
   adapter: ProviderAdapter;
+  incomingMeta: IncomingMeta;
   plan?: ImageBridgePlan;
   videoPlan?: VideoBridgePlan;
   /** Per-video generation timeout (ms) including polling. */
@@ -240,6 +246,7 @@ export interface ImageBridgeDeps {
  * inject the answer as a tool_result, and loop (bounded by `maxRounds`).
  */
 export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Response> {
+  const translatorBudget = deps.incomingMeta.translatorBudget;
   const { parsed, plan, videoPlan, videoTimeoutMs, abortSignal } = deps;
   let adapter = deps.adapter;
   const maxRounds = clampImageMaxRounds(deps.maxRounds ?? DEFAULT_MAX_ROUNDS);
@@ -347,7 +354,11 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       void adapter
         .runTurn(
           iterParsed,
-          { headers: deps.forwardHeaders ? new Headers(deps.forwardHeaders) : new Headers(), abortSignal: signal },
+          {
+            headers: deps.forwardHeaders ? new Headers(deps.forwardHeaders) : new Headers(),
+            abortSignal: signal,
+            translatorBudget,
+          },
           queue.push,
         )
         .then(() => queue.close())
@@ -396,6 +407,9 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       // runTurn adapters signal errors via {type:"error"} events, not HTTP status codes.
       const errorEvent = events.find(e => e.type === "error");
       if (errorEvent && errorEvent.type === "error") {
+        if (errorEvent.code === "translation_buffer_limit") {
+          throw new TranslatorBudgetExceededError("retained_collectors", TRANSLATOR_MAX_TURN_BYTES);
+        }
         throw new LoopError(502, errorEvent.message);
       }
 
@@ -414,11 +428,14 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         const request = await requestAdapter.buildRequest(iterParsed, {
           headers: deps.forwardHeaders ? new Headers(deps.forwardHeaders) : new Headers(),
           abortSignal: headerDeadline.signal,
+          translatorBudget,
         });
         try { deps.onRequestBuilt?.(request); } catch { /* diagnostics are best-effort */ }
         deps.onAttemptSend?.();
-        const response = requestAdapter.fetchResponse
-          ? await requestAdapter.fetchResponse(request, {
+        let response: Response;
+        try {
+          response = requestAdapter.fetchResponse
+            ? await requestAdapter.fetchResponse(request, {
               abortSignal: headerDeadline.signal,
               timeoutMs: connectTimeoutMs,
               returnRawErrors: true,
@@ -436,7 +453,10 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
                 });
               },
               { abortSignal: headerDeadline.signal, label: "image-bridge-loop" },
-            );
+              );
+        } finally {
+          request.releaseBodyObservation?.();
+        }
         return { response, responseAdapter: requestAdapter };
       };
 
@@ -476,6 +496,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       }
       return prepared;
     } catch (error) {
+      if (isTranslatorBudgetExceededError(error)) throw error;
       if (headerDeadline.didExpire()) {
         throw new LoopError(504, `Provider response-header timeout after ${connectTimeoutMs}ms during image-bridge`);
       }
@@ -503,11 +524,13 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       for await (const event of parseStreamWithProgress(prepared.response, parse, {
         signal,
         inactivityTimeoutMs: stallTimeoutMs,
+        translatorBudget,
       })) {
         if (event.type === "heartbeat") yield event;
         else events.push(event);
       }
     } catch (error) {
+      if (isTranslatorBudgetExceededError(error)) throw error;
       if (signal.aborted) throw new LoopError(499, "client closed request during image-bridge");
       if (error instanceof RoutedModelInactivityError) throw new LoopError(504, error.message);
       if (error instanceof WebSearchStreamProtocolError) throw new LoopError(502, error.message);
@@ -520,7 +543,12 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       throw new LoopError(502, `Image-bridge adapter stream protocol error: expected one final terminal event, received ${terminalIndexes.length}`);
     }
     const terminal = events[terminalIndexes[0]!];
-    if (terminal.type === "error") throw new LoopError(502, terminal.message);
+    if (terminal.type === "error") {
+      if (terminal.code === "translation_buffer_limit") {
+        throw new TranslatorBudgetExceededError("retained_collectors", TRANSLATOR_MAX_TURN_BYTES);
+      }
+      throw new LoopError(502, terminal.message);
+    }
     return scanEventsForImageCall(events, mediaToolNames);
   };
 
@@ -754,12 +782,23 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
             });
           }
         } catch (e) {
-          yield {
-            type: "error",
-            message: e instanceof LoopError ? e.message : (e instanceof Error ? e.message : String(e)),
-            ...(e instanceof LoopError ? { status: e.status } : {}),
-            ...(hiddenUsage ? { usage: hiddenUsage } : {}),
-          };
+          if (isTranslatorBudgetExceededError(e)) {
+            yield {
+              type: "error",
+              status: 502,
+              errorType: "upstream_error",
+              code: e.code,
+              message: "upstream translation buffer exceeded the safe limit",
+              ...(hiddenUsage ? { usage: hiddenUsage } : {}),
+            };
+          } else {
+            yield {
+              type: "error",
+              message: e instanceof LoopError ? e.message : (e instanceof Error ? e.message : String(e)),
+              ...(e instanceof LoopError ? { status: e.status } : {}),
+              ...(hiddenUsage ? { usage: hiddenUsage } : {}),
+            };
+          }
           return;
         }
       }
@@ -773,6 +812,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
       internalAbort.abort("client closed responses stream");
     }, 2_000,
     {
+      translatorBudget,
       ...(deps.forceEmptyResponseId ? { responseId: "" } : {}),
       hideThinkingSummary: parsed.options.hideThinkingSummary,
       stallTimeoutSec: deps.stallTimeoutSec,

package/src/lib/admission.ts

@@ -0,0 +1,83 @@
+export const RETAINED_TRUNCATION_MARKER = "\n…[truncated by opencodex]";
+
+export class ResourceAdmissionError extends Error {
+  readonly code: string = "server_busy";
+
+  constructor(readonly resource: string, readonly limit: number) {
+    super(`${resource} capacity reached (${limit})`);
+    this.name = "ResourceAdmissionError";
+  }
+}
+
+export interface AdmissionMetrics {
+  active: number;
+  peak: number;
+  admitted: number;
+  rejected: number;
+  releaseMisses: number;
+}
+
+export interface AdmissionLease {
+  release(): void;
+}
+
+export interface AdmissionReservation<T> extends AdmissionLease {
+  bind(value: T): void;
+}
+
+export function createAdmissionGate(name: string, limit: number): {
+  tryAcquire(): AdmissionLease | null;
+  metrics(): Readonly<AdmissionMetrics>;
+} {
+  if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError(`${name} admission limit must be positive`);
+  const state: AdmissionMetrics = { active: 0, peak: 0, admitted: 0, rejected: 0, releaseMisses: 0 };
+  return {
+    tryAcquire() {
+      if (state.active >= limit) {
+        state.rejected += 1;
+        return null;
+      }
+      state.active += 1;
+      state.admitted += 1;
+      state.peak = Math.max(state.peak, state.active);
+      let active = true;
+      return {
+        release() {
+          if (!active) {
+            return;
+          }
+          active = false;
+          state.active -= 1;
+        },
+      };
+    },
+    metrics() {
+      return { ...state };
+    },
+  };
+}
+
+export function retainedUtf8Bytes(value: string): number {
+  return new TextEncoder().encode(value).byteLength;
+}
+
+function utf8Prefix(value: string, maxBytes: number): string {
+  if (maxBytes <= 0) return "";
+  let bytes = 0;
+  let result = "";
+  for (const character of value) {
+    const size = retainedUtf8Bytes(character);
+    if (bytes + size > maxBytes) break;
+    result += character;
+    bytes += size;
+  }
+  return result;
+}
+
+export function truncateRetainedUtf8(value: string, maxBytes: number): string {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) throw new RangeError("maxBytes must be a non-negative integer");
+  if (retainedUtf8Bytes(value) <= maxBytes) return value;
+  const markerBytes = retainedUtf8Bytes(RETAINED_TRUNCATION_MARKER);
+  if (markerBytes > maxBytes) return utf8Prefix(RETAINED_TRUNCATION_MARKER, maxBytes);
+  return utf8Prefix(value, maxBytes - markerBytes) + RETAINED_TRUNCATION_MARKER;
+}

package/src/lib/app-owned-memory-stores.ts

@@ -0,0 +1,173 @@
+import {
+  enforceAppOwnedMemoryBudget,
+  registerRetainedStore,
+  registerObservedBuffer,
+  type RetainedStoreRegistration,
+  type RetainedStoreSnapshot,
+} from "./app-owned-memory";
+import { registerStateSweepAfterTick } from "./state-store-sweeper";
+import { debugBufferMetrics, evictOldestDebugEntryForBudget } from "./debug-log-buffer";
+import { injectionBufferMetrics, evictOldestInjectionEntryForBudget } from "./injection-debug-log";
+import { crashRingMetrics, evictOldestCrashTraceForBudget } from "./crash-guard";
+import { claudeInboundDebugMetrics, evictOldestClaudeInboundForBudget } from "../claude/inbound-debug";
+import {
+  evictOldestRequestLogForBudget,
+  requestLogRetainedStoreSnapshot,
+} from "../server/request-log";
+import {
+  anthropicImageNormalizeRetainedStoreSnapshot,
+  evictOldestAnthropicImageNormalizeForBudget,
+} from "../adapters/anthropic-image-normalize";
+import {
+  evictOldestVisionDescriptionForBudget,
+  visionDescriptionRetainedStoreSnapshot,
+} from "../vision";
+import {
+  antigravityReplayRetainedStoreSnapshot,
+  evictOldestAntigravityReplayForBudget,
+} from "../adapters/google-antigravity-replay";
+import {
+  evictOldestModelCacheForBudget,
+  modelCacheRetainedStoreSnapshot,
+} from "../codex/model-cache";
+import {
+  evictOldestUsageSummaryForBudget,
+  usageSummaryRetainedStoreSnapshot,
+} from "../server/management/usage-summary-cache";
+import {
+  cursorBlobRetainedStoreSnapshot,
+  evictOldestCursorBlobForBudget,
+} from "../adapters/cursor/native-exec";
+import {
+  evictOldestResponseContinuationForBudget,
+  responseContinuationRetainedStoreSnapshot,
+} from "../responses/state";
+import { translatorObservedBufferSnapshot } from "./translator-budget";
+import { imageFulfillmentTailSnapshot } from "../images/fulfill";
+import { oauthMutationTailSnapshot } from "../oauth/store";
+import { grokApplyFlightSnapshot } from "../server/management/agent-settings-routes";
+
+function ringSnapshot(metrics: { entries: number; bytes: number; oldestAt: number | null }): RetainedStoreSnapshot {
+  return {
+    count: metrics.entries,
+    bytes: metrics.bytes,
+    evictableBytes: metrics.bytes,
+    pinnedBytes: 0,
+    oldestAt: metrics.oldestAt,
+  };
+}
+
+function providerDebugSnapshot(): RetainedStoreSnapshot {
+  return ringSnapshot(debugBufferMetrics());
+}
+
+function injectionDebugSnapshot(): RetainedStoreSnapshot {
+  return ringSnapshot(injectionBufferMetrics());
+}
+
+function claudeDebugSnapshot(): RetainedStoreSnapshot {
+  return ringSnapshot(claudeInboundDebugMetrics());
+}
+
+function crashRingSnapshot(): RetainedStoreSnapshot {
+  return ringSnapshot(crashRingMetrics());
+}
+
+export const APP_OWNED_RETAINED_STORE_REGISTRATIONS = [
+  {
+    id: "request_log",
+    category: "logs",
+    snapshot: requestLogRetainedStoreSnapshot,
+    evictOldest: evictOldestRequestLogForBudget,
+  },
+  {
+    id: "provider_debug",
+    category: "logs",
+    snapshot: providerDebugSnapshot,
+    evictOldest: evictOldestDebugEntryForBudget,
+  },
+  {
+    id: "injection_debug",
+    category: "logs",
+    snapshot: injectionDebugSnapshot,
+    evictOldest: evictOldestInjectionEntryForBudget,
+  },
+  {
+    id: "claude_debug",
+    category: "logs",
+    snapshot: claudeDebugSnapshot,
+    evictOldest: evictOldestClaudeInboundForBudget,
+  },
+  {
+    id: "crash_ring",
+    category: "logs",
+    snapshot: crashRingSnapshot,
+    evictOldest: evictOldestCrashTraceForBudget,
+  },
+  {
+    id: "image_normalize",
+    category: "caches",
+    snapshot: anthropicImageNormalizeRetainedStoreSnapshot,
+    evictOldest: evictOldestAnthropicImageNormalizeForBudget,
+  },
+  {
+    id: "vision_descriptions",
+    category: "caches",
+    snapshot: visionDescriptionRetainedStoreSnapshot,
+    evictOldest: evictOldestVisionDescriptionForBudget,
+  },
+  {
+    id: "antigravity_replay",
+    category: "caches",
+    snapshot: antigravityReplayRetainedStoreSnapshot,
+    evictOldest: evictOldestAntigravityReplayForBudget,
+  },
+  {
+    id: "model_cache",
+    category: "caches",
+    snapshot: modelCacheRetainedStoreSnapshot,
+    evictOldest: evictOldestModelCacheForBudget,
+  },
+  {
+    id: "usage_summary",
+    category: "caches",
+    snapshot: usageSummaryRetainedStoreSnapshot,
+    evictOldest: evictOldestUsageSummaryForBudget,
+  },
+  {
+    id: "cursor_blobs",
+    category: "blobs",
+    snapshot: cursorBlobRetainedStoreSnapshot,
+    evictOldest: evictOldestCursorBlobForBudget,
+  },
+  {
+    id: "responses_continuation",
+    category: "continuation",
+    snapshot: responseContinuationRetainedStoreSnapshot,
+    evictOldest: evictOldestResponseContinuationForBudget,
+  },
+] as const satisfies readonly RetainedStoreRegistration[];
+
+export function registerDefaultAppOwnedMemoryStores(): void {
+  for (const registration of APP_OWNED_RETAINED_STORE_REGISTRATIONS) {
+    registerRetainedStore(registration);
+  }
+}
+
+export const APP_OWNED_OBSERVED_BUFFER_REGISTRATIONS = [
+  { id: "translator_buffers", category: "translator", snapshot: translatorObservedBufferSnapshot },
+  { id: "image_fulfillment_tail", category: "serialized_tails", snapshot: imageFulfillmentTailSnapshot },
+  { id: "oauth_mutation_tail", category: "serialized_tails", snapshot: oauthMutationTailSnapshot },
+  { id: "grok_apply_flight", category: "serialized_tails", snapshot: grokApplyFlightSnapshot },
+] as const;
+
+export function registerDefaultAppOwnedObservedBuffers(): void {
+  for (const registration of APP_OWNED_OBSERVED_BUFFER_REGISTRATIONS) registerObservedBuffer(registration);
+}
+
+export function registerAppOwnedMemorySweepFallback(): void {
+  registerStateSweepAfterTick({
+    name: "app-owned-memory-budget",
+    afterTick: enforceAppOwnedMemoryBudget,
+  });
+}