@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/lib/app-owned-memory.ts

@@ -0,0 +1,265 @@
+export type AppOwnedRetainedCategory = "logs" | "caches" | "blobs" | "continuation";
+export type AppOwnedObservedCategory = "translator" | "serialized_tails";
+
+export interface RetainedStoreSnapshot {
+  count: number;
+  bytes: number;
+  evictableBytes: number;
+  pinnedBytes: number;
+  oldestAt: number | null;
+}
+
+export interface RetainedStoreRegistration {
+  id: string;
+  category: AppOwnedRetainedCategory;
+  snapshot(): RetainedStoreSnapshot;
+  evictOldest(): number;
+}
+
+export interface ObservedBufferRegistration {
+  id: string;
+  category: AppOwnedObservedCategory;
+  snapshot(): { currentBytes: number; highWaterBytes: number; active: number };
+}
+
+export interface AppOwnedBytesSnapshot {
+  budgetBytes: number;
+  retainedBytes: number;
+  evictableBytes: number;
+  pinnedBytes: number;
+  overBudgetBytes: number;
+  stores: Record<string, RetainedStoreSnapshot>;
+  observedInFlight: Record<string, { currentBytes: number; highWaterBytes: number; active: number }>;
+  enforcement: {
+    runs: number;
+    entriesDemoted: number;
+    bytesReleased: number;
+    noEvictableCandidate: number;
+    snapshotFailures: number;
+    oldestAtContractViolations: number;
+  };
+}
+
+export const DEFAULT_APP_OWNED_MEMORY_BUDGET_BYTES = 256 * 1024 * 1024;
+/**
+ * The budget above is an eviction target, not a hard resident limit: active/pinned
+ * state may temporarily keep retained bytes above it. Every pin-capable owner has
+ * its own finite admission cap; their documented aggregate must remain below this
+ * process-owned hard ceiling.
+ */
+export const APP_OWNED_WORST_CASE_PINNED_BYTES = 512 * 1024 * 1024;
+export const MIN_APP_OWNED_MEMORY_BUDGET_MB = 64;
+export const MAX_APP_OWNED_MEMORY_BUDGET_MB = 4_096;
+
+const CATEGORY_ORDER: readonly AppOwnedRetainedCategory[] = [
+  "logs",
+  "caches",
+  "blobs",
+  "continuation",
+];
+const WARN_INTERVAL_MS = 60_000;
+const ZERO_RETAINED_SNAPSHOT: RetainedStoreSnapshot = {
+  count: 0,
+  bytes: 0,
+  evictableBytes: 0,
+  pinnedBytes: 0,
+  oldestAt: null,
+};
+const ZERO_OBSERVED_SNAPSHOT = { currentBytes: 0, highWaterBytes: 0, active: 0 };
+
+const retainedStores = new Map<string, RetainedStoreRegistration>();
+const observedBuffers = new Map<string, ObservedBufferRegistration>();
+let budgetBytes = DEFAULT_APP_OWNED_MEMORY_BUDGET_BYTES;
+let lastSaturationWarningAt = Number.NEGATIVE_INFINITY;
+const enforcementCounters = {
+  runs: 0,
+  entriesDemoted: 0,
+  bytesReleased: 0,
+  noEvictableCandidate: 0,
+  snapshotFailures: 0,
+  oldestAtContractViolations: 0,
+};
+let isEnforcing = false;
+
+export function resolveAppOwnedMemoryBudgetBytes(value: unknown): number {
+  return typeof value === "number"
+    && Number.isInteger(value)
+    && value >= MIN_APP_OWNED_MEMORY_BUDGET_MB
+    && value <= MAX_APP_OWNED_MEMORY_BUDGET_MB
+    ? value * 1024 * 1024
+    : DEFAULT_APP_OWNED_MEMORY_BUDGET_BYTES;
+}
+
+export function registerRetainedStore(registration: RetainedStoreRegistration): () => void {
+  retainedStores.set(registration.id, registration);
+  return () => {
+    if (retainedStores.get(registration.id) === registration) retainedStores.delete(registration.id);
+  };
+}
+
+export function registerObservedBuffer(registration: ObservedBufferRegistration): () => void {
+  observedBuffers.set(registration.id, registration);
+  return () => {
+    if (observedBuffers.get(registration.id) === registration) observedBuffers.delete(registration.id);
+  };
+}
+
+export function configureAppOwnedMemoryBudget(bytes: number): void {
+  budgetBytes = bytes;
+}
+
+function retainedSnapshot(registration: RetainedStoreRegistration): RetainedStoreSnapshot {
+  try {
+    return registration.snapshot();
+  } catch {
+    enforcementCounters.snapshotFailures += 1;
+    return { ...ZERO_RETAINED_SNAPSHOT };
+  }
+}
+
+function observedSnapshot(
+  registration: ObservedBufferRegistration,
+): { currentBytes: number; highWaterBytes: number; active: number } {
+  try {
+    return registration.snapshot();
+  } catch {
+    enforcementCounters.snapshotFailures += 1;
+    return { ...ZERO_OBSERVED_SNAPSHOT };
+  }
+}
+
+export function appOwnedBytesSnapshot(): AppOwnedBytesSnapshot {
+  return appOwnedBytesSnapshotFrom(retainedSnapshots().stores);
+}
+
+function appOwnedBytesSnapshotFrom(
+  retained: ReadonlyMap<string, RetainedStoreSnapshot>,
+): AppOwnedBytesSnapshot {
+  const stores: Record<string, RetainedStoreSnapshot> = {};
+  let retainedBytes = 0;
+  let evictableBytes = 0;
+  let pinnedBytes = 0;
+  for (const registration of retainedStores.values()) {
+    const snapshot = retained.get(registration.id) ?? ZERO_RETAINED_SNAPSHOT;
+    stores[registration.id] = snapshot;
+    retainedBytes += snapshot.bytes;
+    evictableBytes += snapshot.evictableBytes;
+    pinnedBytes += snapshot.pinnedBytes;
+  }
+
+  const observedInFlight: AppOwnedBytesSnapshot["observedInFlight"] = {};
+  for (const registration of observedBuffers.values()) {
+    observedInFlight[registration.id] = observedSnapshot(registration);
+  }
+
+  return {
+    budgetBytes,
+    retainedBytes,
+    evictableBytes,
+    pinnedBytes,
+    overBudgetBytes: Math.max(0, retainedBytes - budgetBytes),
+    stores,
+    observedInFlight,
+    enforcement: { ...enforcementCounters },
+  };
+}
+
+function nextCandidate(
+  snapshots: ReadonlyMap<string, RetainedStoreSnapshot>,
+  ineligible: Set<string>,
+): RetainedStoreRegistration | undefined {
+  for (const category of CATEGORY_ORDER) {
+    let candidate: RetainedStoreRegistration | undefined;
+    let candidateAt = Number.POSITIVE_INFINITY;
+    for (const registration of retainedStores.values()) {
+      if (registration.category !== category || ineligible.has(registration.id)) continue;
+      const snapshot = snapshots.get(registration.id);
+      if (!snapshot || snapshot.evictableBytes <= 0) continue;
+      const oldestAt = snapshot.oldestAt;
+      if (oldestAt === null || !Number.isFinite(oldestAt)) {
+        enforcementCounters.oldestAtContractViolations += 1;
+        ineligible.add(registration.id);
+        continue;
+      }
+      if (!candidate || oldestAt < candidateAt) {
+        candidate = registration;
+        candidateAt = oldestAt;
+      }
+    }
+    if (candidate) return candidate;
+  }
+  return undefined;
+}
+
+function retainedSnapshots(): { total: number; stores: Map<string, RetainedStoreSnapshot> } {
+  const stores = new Map<string, RetainedStoreSnapshot>();
+  let total = 0;
+  for (const registration of retainedStores.values()) {
+    const snapshot = retainedSnapshot(registration);
+    stores.set(registration.id, snapshot);
+    total += snapshot.bytes;
+  }
+  return { total, stores };
+}
+
+function warnPinnedSaturation(): void {
+  const at = Date.now();
+  if (at - lastSaturationWarningAt < WARN_INTERVAL_MS) return;
+  lastSaturationWarningAt = at;
+  console.warn("[app-owned-memory] retained state remains over budget with no evictable candidate");
+}
+
+export function enforceAppOwnedMemoryBudget(): AppOwnedBytesSnapshot {
+  if (isEnforcing) return appOwnedBytesSnapshot();
+  isEnforcing = true;
+  enforcementCounters.runs += 1;
+  try {
+    const ineligible = new Set<string>();
+    const current = retainedSnapshots();
+    while (current.total > budgetBytes) {
+      const candidate = nextCandidate(current.stores, ineligible);
+      if (!candidate) {
+        enforcementCounters.noEvictableCandidate += 1;
+        warnPinnedSaturation();
+        break;
+      }
+
+      let reportedReleased = 0;
+      try {
+        reportedReleased = candidate.evictOldest();
+      } catch {
+        ineligible.add(candidate.id);
+        continue;
+      }
+      const previousSnapshot = current.stores.get(candidate.id) ?? ZERO_RETAINED_SNAPSHOT;
+      const nextSnapshot = retainedSnapshot(candidate);
+      current.stores.set(candidate.id, nextSnapshot);
+      const nextTotal = Math.max(0, current.total - previousSnapshot.bytes + nextSnapshot.bytes);
+      const actualReleased = Math.max(0, current.total - nextTotal);
+      if (reportedReleased <= 0 || actualReleased <= 0) {
+        ineligible.add(candidate.id);
+      } else {
+        enforcementCounters.entriesDemoted += 1;
+        enforcementCounters.bytesReleased += actualReleased;
+      }
+      current.total = nextTotal;
+    }
+    return appOwnedBytesSnapshotFrom(current.stores);
+  } finally {
+    isEnforcing = false;
+  }
+}
+
+export function resetAppOwnedMemoryForTests(): void {
+  retainedStores.clear();
+  observedBuffers.clear();
+  budgetBytes = DEFAULT_APP_OWNED_MEMORY_BUDGET_BYTES;
+  lastSaturationWarningAt = Number.NEGATIVE_INFINITY;
+  enforcementCounters.runs = 0;
+  enforcementCounters.entriesDemoted = 0;
+  enforcementCounters.bytesReleased = 0;
+  enforcementCounters.noEvictableCandidate = 0;
+  enforcementCounters.snapshotFailures = 0;
+  enforcementCounters.oldestAtContractViolations = 0;
+  isEnforcing = false;
+}

package/src/lib/bun-stream-caps.ts

@@ -1,13 +1,15 @@
 /**
- * Bun runtime stream-capability gate for the Windows SSE passthrough path (#314).
+ * Bun runtime stream-capability gate for eager SSE passthrough (#314).
  *
  * The eager bounded relay (src/server/relay-eager.ts) uses a JS async producer
  * loop — the exact shape of the Bun#32111 use-after-free (fixed upstream by Bun
  * PR #32120, merged 2026-06-21). No RELEASED Bun version is proven to carry
  * that fix yet, so `MIN_FIXED_BUN_VERSION` is null: every runtime is
- * "known-bad" until a bundle-bump commit sets it. Config `streamMode` can force
- * either path (persisted in config.json because Windows services do not
- * inherit shell env — see devlog/_plan/260723_win_mem_safestream/001).
+ * "known-bad" until a bundle-bump commit sets it. Windows no-rewrite traffic
+ * follows this runtime/config decision. Darwin no-rewrite traffic stays on tee
+ * for `auto` regardless of runtime capability and reaches eager relay only via
+ * explicit `streamMode: "eager-relay"` opt-in (see
+ * devlog/_plan/260731_macos_rss_retention/100_darwin_eager_optin.md).
  *
  * Prerelease conservatism: a version carrying a prerelease suffix (e.g.
  * `1.4.0-canary.3`) is NEVER treated as fixed even when its numeric triple
@@ -71,9 +73,8 @@ export type EagerRelayDecision = {
 };
 
 /**
- * Decide the win32 SSE client-path shape. `version`/`minFixed` are injectable
- * for tests. Non-win32 callers never consult this (their default path is
- * unchanged); the caller owns the platform check.
+ * Decide the runtime/config SSE client-path capability. `version`/`minFixed`
+ * are injectable for tests; `selectEagerPath` applies platform policy.
  */
 export function decideEagerRelay(
   mode: StreamMode,
@@ -86,3 +87,26 @@ export function decideEagerRelay(
     ? { useEagerRelay: true, reason: "auto-fixed-runtime" }
     : { useEagerRelay: false, reason: "auto-known-bad" };
 }
+
+/**
+ * Apply the two-platform eager-relay policy to the runtime/config capability.
+ * Windows preserves the decision for no-rewrite traffic. Darwin permits only
+ * explicit config opt-in; `auto` remains tee even on a future fixed runtime.
+ * Returns the normalized effective decision, or null when platform policy,
+ * rewrite needs, or a Darwin non-config-eager mode selects tee.
+ */
+export function selectEagerPath(
+  platform: NodeJS.Platform,
+  needsClientRewrite: boolean,
+  mode: StreamMode,
+  version: string = Bun.version,
+  minFixed: string | null = MIN_FIXED_BUN_VERSION,
+): EagerRelayDecision | null {
+  if (needsClientRewrite || (platform !== "win32" && platform !== "darwin")) {
+    return null;
+  }
+
+  const decision = decideEagerRelay(mode, version, minFixed);
+  if (platform === "win32") return decision;
+  return decision.reason === "config-eager" ? decision : null;
+}

package/src/lib/config-ownership.ts

@@ -12,6 +12,7 @@ import {
 } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import type { GenerationContext } from "./state-store-sweeper";
 
 export const CONFIG_OWNER_FILE = ".opencodex-owner.json";
 export const CONFIG_UNINSTALL_MANIFEST = ".opencodex-uninstall.json";
@@ -47,6 +48,10 @@ const INITIAL_OWNED_PATHS = [
   "codex-shim.autorestore.lock",
   "codex-shim.json",
   "config.json",
+  "config-mutation.sqlite",
+  "config-mutation.sqlite-journal",
+  "config-mutation.sqlite-shm",
+  "config-mutation.sqlite-wal",
   "crash.log",
   "kimi-device-id",
   "mimo-client-id",
@@ -76,6 +81,34 @@ const ownershipCache = new Map<string, {
   owner: ConfigOwner;
   manifest: ConfigUninstallManifest;
 } | null>();
+let lastReconciledGeneration = 0;
+
+export function listLiveConfigOwnershipRoots(currentConfigDir: string): ReadonlySet<string> {
+  const currentRoot = ownershipCacheKey(currentConfigDir);
+  const roots = new Set<string>([currentRoot]);
+  for (const [root, ownership] of ownershipCache) {
+    if (root === currentRoot) continue;
+    if (ownership?.manifest.paths.some(rel => existsSync(join(root, ...rel.split("/"))))) {
+      roots.add(root);
+    }
+  }
+  return roots;
+}
+
+export function reconcileConfigOwnershipRoots(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  let removed = 0;
+  for (const [root, ownership] of ownershipCache) {
+    if (context.configRoots.has(root)) continue;
+    const hasLiveOwnedPath = ownership?.manifest.paths.some(rel =>
+      existsSync(join(root, ...rel.split("/"))));
+    if (hasLiveOwnedPath) continue;
+    ownershipCache.delete(root);
+    removed += 1;
+  }
+  lastReconciledGeneration = context.generation;
+  return removed;
+}
 
 function ownershipCacheKey(configDir: string): string {
   const key = resolve(configDir);

package/src/lib/crash-guard.ts

@@ -4,6 +4,8 @@ import { getConfigDir } from "../config";
 import { recordOwnedConfigPath } from "./config-ownership";
 import { redactSecretString, redactUrlForLog } from "./redact";
 import { sidecarBreadcrumb, activityBreadcrumb } from "./sidecar-tracker";
+import { retainedUtf8Bytes, truncateRetainedUtf8 } from "./admission";
+import { enforceAppOwnedMemoryBudget } from "./app-owned-memory";
 
 /**
  * Process-level safety net for the long-running proxy daemon.
@@ -205,8 +207,42 @@ function record(kind: string, err: unknown, promise?: unknown): void {
 
 interface FetchTrace { url: string; at: number; origin: string; settled: boolean; rejected?: string }
 const FETCH_RING_MAX = 12;
+const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
 const fetchRing: FetchTrace[] = [];
 let fetchInstrumented = false;
+let fetchRingBytes = 0;
+
+function fetchTraceBytes(trace: FetchTrace): number {
+  return retainedUtf8Bytes(trace.url) + retainedUtf8Bytes(trace.origin) + retainedUtf8Bytes(trace.rejected ?? "");
+}
+
+function removeOldestFetchTrace(): number {
+  const trace = fetchRing.shift();
+  if (!trace) return 0;
+  const bytes = fetchTraceBytes(trace);
+  fetchRingBytes -= bytes;
+  return bytes;
+}
+
+function setFetchTraceRejected(trace: FetchTrace, value: string): void {
+  const retained = fetchRing.includes(trace);
+  if (retained) fetchRingBytes -= retainedUtf8Bytes(trace.rejected ?? "");
+  trace.rejected = truncateRetainedUtf8(value, MAX_DIAGNOSTIC_VALUE_BYTES);
+  if (retained) fetchRingBytes += retainedUtf8Bytes(trace.rejected);
+}
+
+function appendFetchTrace(url: string, origin: string): FetchTrace {
+  const trace: FetchTrace = {
+    url: truncateRetainedUtf8(redactUrlForLog(url), MAX_DIAGNOSTIC_VALUE_BYTES),
+    at: Date.now(),
+    origin: truncateRetainedUtf8(origin, MAX_DIAGNOSTIC_VALUE_BYTES),
+    settled: false,
+  };
+  fetchRing.push(trace);
+  fetchRingBytes += fetchTraceBytes(trace);
+  while (fetchRing.length > FETCH_RING_MAX) removeOldestFetchTrace();
+  return trace;
+}
 
 /**
  * The recurring native-only rejection carries no source location, and every JS `await fetch(...)`
@@ -228,24 +264,48 @@ function instrumentFetch(): void {
       url = typeof input === "string" ? input : input instanceof URL ? input.href : (input as Request)?.url ?? "";
     } catch { /* best-effort */ }
     const origin = (new Error().stack ?? "").split("\n").slice(2, 5).map(l => l.trim()).join(" <- ");
-    const trace: FetchTrace = { url: redactUrlForLog(url), at: Date.now(), origin, settled: false };
-    fetchRing.push(trace);
-    if (fetchRing.length > FETCH_RING_MAX) fetchRing.shift();
+    const trace = appendFetchTrace(url, origin);
+    enforceAppOwnedMemoryBudget();
     let p: ReturnType<typeof fetch>;
     try {
       p = original.apply(this, args);
     } catch (e) {
       trace.settled = true;
-      trace.rejected = redactDiagnosticText(e instanceof Error ? `${e.name}: ${e.message}` : String(e));
+      setFetchTraceRejected(trace, redactDiagnosticText(e instanceof Error ? `${e.name}: ${e.message}` : String(e)));
       throw e;
     }
     return p.then(
       r => { trace.settled = true; return r; },
-      e => { trace.settled = true; trace.rejected = redactDiagnosticText(e instanceof Error ? `${e.name}: ${e.message}` : String(e)); throw e; },
+      e => { trace.settled = true; setFetchTraceRejected(trace, redactDiagnosticText(e instanceof Error ? `${e.name}: ${e.message}` : String(e))); throw e; },
     );
   } as typeof fetch;
 }
 
+export function crashRingMetrics(): { entries: number; bytes: number; oldestAt: number | null } {
+  return { entries: fetchRing.length, bytes: fetchRingBytes, oldestAt: fetchRing[0]?.at ?? null };
+}
+
+export function evictOldestCrashTraceForBudget(): number {
+  return removeOldestFetchTrace();
+}
+
+export function appendCrashTraceForTests(url: string, origin: string, rejected?: string): void {
+  const trace = appendFetchTrace(url, origin);
+  if (rejected !== undefined) {
+    trace.settled = true;
+    setFetchTraceRejected(trace, rejected);
+  }
+}
+
+export function crashRingEntriesForTests(): readonly Readonly<FetchTrace>[] {
+  return fetchRing.map(trace => ({ ...trace }));
+}
+
+export function resetCrashRingForTests(): void {
+  fetchRing.length = 0;
+  fetchRingBytes = 0;
+}
+
 /** Render the recent fetch ring (pending first) for the crash breadcrumb. */
 function recentFetches(): string {
   try {

package/src/lib/debug-log-buffer.ts

@@ -8,15 +8,31 @@ export interface DebugLogEntry {
 }
 
 const MAX_LINES = 2_000;
+const MAX_DEBUG_SUBSCRIBERS = 64;
+const MAX_DEBUG_LINE_BYTES = 16 * 1024;
 const buffer: DebugLogEntry[] = [];
-const listeners = new Set<(entry: DebugLogEntry) => void>();
+interface DebugSubscriberRegistration { lease: AdmissionLease }
+const listeners = new Map<(entry: DebugLogEntry) => void, DebugSubscriberRegistration>();
+const subscriberGate = createAdmissionGate("debug_subscribers", MAX_DEBUG_SUBSCRIBERS);
 let nextSeq = 1;
+let bufferBytes = 0;
+
+function removeOldestEntry(): number {
+  const entry = buffer.shift();
+  if (!entry) return 0;
+  const bytes = retainedUtf8Bytes(entry.line);
+  bufferBytes -= bytes;
+  return bytes;
+}
 
 export function appendDebugLogLine(line: string): void {
-  const entry: DebugLogEntry = { seq: nextSeq++, at: Date.now(), line };
+  const retainedLine = truncateRetainedUtf8(line, MAX_DEBUG_LINE_BYTES);
+  const entry: DebugLogEntry = { seq: nextSeq++, at: Date.now(), line: retainedLine };
   buffer.push(entry);
-  if (buffer.length > MAX_LINES) buffer.splice(0, buffer.length - MAX_LINES);
-  for (const listener of listeners) {
+  bufferBytes += retainedUtf8Bytes(retainedLine);
+  while (buffer.length > MAX_LINES) removeOldestEntry();
+  enforceAppOwnedMemoryBudget();
+  for (const listener of listeners.keys()) {
     try { listener(entry); } catch { /* listeners must not break logging */ }
   }
 }
@@ -30,13 +46,38 @@ export function getDebugLogEntries(options?: { after?: number; limit?: number })
 }
 
 export function subscribeDebugLogEntries(listener: (entry: DebugLogEntry) => void): () => void {
-  listeners.add(listener);
-  return () => listeners.delete(listener);
+  let registration = listeners.get(listener);
+  if (!registration) {
+    const lease = subscriberGate.tryAcquire();
+    if (!lease) throw new ResourceAdmissionError("debug_subscribers", MAX_DEBUG_SUBSCRIBERS);
+    registration = { lease };
+    listeners.set(listener, registration);
+  }
+  let disposed = false;
+  return () => {
+    if (disposed) return;
+    disposed = true;
+    if (listeners.get(listener) !== registration) return;
+    listeners.delete(listener);
+    registration.lease.release();
+  };
+}
+
+export function debugBufferMetrics(): { entries: number; bytes: number; subscribers: AdmissionMetrics; oldestAt: number | null } {
+  return { entries: buffer.length, bytes: bufferBytes, subscribers: subscriberGate.metrics(), oldestAt: buffer[0]?.at ?? null };
+}
+
+export function evictOldestDebugEntryForBudget(): number {
+  return removeOldestEntry();
 }
 
 /** Test isolation. */
 export function resetDebugLogBufferForTests(): void {
   buffer.length = 0;
+  bufferBytes = 0;
+  for (const registration of listeners.values()) registration.lease.release();
   listeners.clear();
   nextSeq = 1;
 }
+import { createAdmissionGate, ResourceAdmissionError, retainedUtf8Bytes, truncateRetainedUtf8, type AdmissionLease, type AdmissionMetrics } from "./admission";
+import { enforceAppOwnedMemoryBudget } from "./app-owned-memory";

package/src/lib/destination-policy.ts

@@ -130,7 +130,18 @@ function registryAllowsPrivateNetwork(name: string): boolean {
   return getProviderRegistryEntry(name)?.allowPrivateNetworkByDefault === true;
 }
 
-/** True when the provider config or registry default admits private/loopback destinations. */
+/**
+ * Whether a provider may reach loopback/private addresses.
+ *
+ * Two sources, and both have to be consulted at every boundary: the operator's explicit
+ * `allowPrivateNetwork`, and the registry's `allowPrivateNetworkByDefault` for entries that are
+ * local BY DEFINITION (Ollama, vLLM, LM Studio, LiteLLM). Config validation already read both;
+ * outbound discovery read only the first, so a stock Ollama entry passed validation and was then
+ * refused at the fetch (#758).
+ *
+ * This grants nothing new. Metadata, link-local and unspecified destinations are rejected before
+ * this is consulted, and a provider without either source still cannot reach a private address.
+ */
 export function providerAllowsPrivateNetwork(
   name: string,
   provider: Pick<OcxProviderConfig, "allowPrivateNetwork">,

package/src/lib/errors.ts

@@ -104,6 +104,9 @@ export function isClientClosedMessage(text: string): boolean {
 
 export function classifyError(status: number, type: string, message: string): OcxErrorPayload {
   const text = message.toLowerCase();
+  if (type === "previous_response_not_found") {
+    return { message, type: "invalid_request_error", code: "previous_response_not_found" };
+  }
   // Preserve explicit cancel types used by compact/combo JSON errors; unify message-inferred
   // client closes (web-search abort text) onto client_closed_request for /api/logs.
   if (type === "client_cancelled") {

package/src/lib/gcp-adc.ts

@@ -18,6 +18,11 @@ import { Buffer } from "node:buffer";
 import * as os from "node:os";
 import * as path from "node:path";
 import { readFileSync, existsSync, statSync } from "node:fs";
+import {
+  captureConfigGeneration,
+  sweepExpiredOnWrite,
+  type GenerationContext,
+} from "./state-store-sweeper";
 
 /** Injectable fetch (tests pass a mock); defaults to the global fetch. */
 export type FetchImpl = typeof fetch;
@@ -60,6 +65,33 @@ interface TokenResponse {
 
 const tokenCache = new Map<string, CachedToken>();
 const inflight = new Map<string, Promise<string>>();
+let lastReconciledGeneration = 0;
+let liveSources = new Set<string>();
+
+export function sweepExpiredGcpAdcTokens(now = Date.now()): number {
+  const skew = getRefreshSkewMs();
+  let removed = 0;
+  for (const [source, cached] of tokenCache) {
+    if (cached.expiresAtMs - skew > now) continue;
+    tokenCache.delete(source);
+    removed += 1;
+  }
+  return removed;
+}
+
+export function reconcileGcpAdcTokens(context: GenerationContext): number {
+  if (context.generation <= lastReconciledGeneration) return 0;
+  const currentSource = currentAdcSourceKey();
+  let removed = 0;
+  for (const source of tokenCache.keys()) {
+    if (source === currentSource) continue;
+    tokenCache.delete(source);
+    removed += 1;
+  }
+  liveSources = new Set([currentSource]);
+  lastReconciledGeneration = context.generation;
+  return removed;
+}
 
 function getRefreshSkewMs(): number {
   const raw = Number(process.env.GOOGLE_VERTEX_REFRESH_SKEW_MS);
@@ -271,6 +303,7 @@ export async function getVertexAccessToken(options?: { signal?: AbortSignal; fet
   // Only serve a cached token that matches the source the next resolve would actually use; prune
   // expired or now-stale (different-source) entries so a credential-source change is honored.
   const expectedSource = currentAdcSourceKey();
+  const writerGeneration = captureConfigGeneration();
   for (const [source, cached] of tokenCache) {
     if (source === expectedSource && cached.expiresAtMs - skew > now) return cached.token;
     if (cached.expiresAtMs - skew <= now) tokenCache.delete(source);
@@ -286,7 +319,10 @@ export async function getVertexAccessToken(options?: { signal?: AbortSignal; fet
     try {
       const { source, token } = await resolveAccessTokenUncached(options?.signal, fetchImpl);
       const expiresAtMs = Date.now() + Math.max(0, token.expires_in * 1000);
-      tokenCache.set(source, { token: token.access_token, expiresAtMs });
+      if (writerGeneration >= lastReconciledGeneration || liveSources.has(source)) {
+        tokenCache.set(source, { token: token.access_token, expiresAtMs });
+        sweepExpiredOnWrite(Date.now());
+      }
       return token.access_token;
     } finally {
       inflight.delete(cacheKey);
@@ -296,8 +332,10 @@ export async function getVertexAccessToken(options?: { signal?: AbortSignal; fet
   return promise;
 }
 
-/** Test seam: clears every cached token + in-flight promise. */
+/** Test seam: restores complete process-local token and reconciliation state. */
 export function __resetVertexTokenCache(): void {
   tokenCache.clear();
   inflight.clear();
+  lastReconciledGeneration = 0;
+  liveSources = new Set();
 }