@bitkyc08/opencodex 2.8.0 → 2.9.0

package/src/lib/injection-debug-log.ts

@@ -6,16 +6,31 @@
  * `isInjectionDebugEnabled()` guard; this module only stores what it is given. */
 
 import type { DebugLogEntry } from "./debug-log-buffer";
+import { retainedUtf8Bytes, truncateRetainedUtf8 } from "./admission";
+import { enforceAppOwnedMemoryBudget } from "./app-owned-memory";
 
 const MAX_LINES = 2_000;
+const MAX_DEBUG_LINE_BYTES = 16 * 1024;
 const buffer: DebugLogEntry[] = [];
 let nextSeq = 1;
+let bufferBytes = 0;
+
+function removeOldestEntry(): number {
+  const entry = buffer.shift();
+  if (!entry) return 0;
+  const bytes = retainedUtf8Bytes(entry.line);
+  bufferBytes -= bytes;
+  return bytes;
+}
 
 /** Append a line to the injection buffer and echo it to the server console. */
 export function injectionDebugLog(line: string): void {
-  const entry: DebugLogEntry = { seq: nextSeq++, at: Date.now(), line };
+  const retainedLine = truncateRetainedUtf8(line, MAX_DEBUG_LINE_BYTES);
+  const entry: DebugLogEntry = { seq: nextSeq++, at: Date.now(), line: retainedLine };
   buffer.push(entry);
-  if (buffer.length > MAX_LINES) buffer.splice(0, buffer.length - MAX_LINES);
+  bufferBytes += retainedUtf8Bytes(retainedLine);
+  while (buffer.length > MAX_LINES) removeOldestEntry();
+  enforceAppOwnedMemoryBudget();
   console.log(line);
 }
 
@@ -27,8 +42,17 @@ export function getInjectionDebugLogEntries(options?: { after?: number; limit?:
   return filtered.slice(-limit);
 }
 
+export function injectionBufferMetrics(): { entries: number; bytes: number; oldestAt: number | null } {
+  return { entries: buffer.length, bytes: bufferBytes, oldestAt: buffer[0]?.at ?? null };
+}
+
+export function evictOldestInjectionEntryForBudget(): number {
+  return removeOldestEntry();
+}
+
 /** Test isolation. */
 export function resetInjectionDebugLogBufferForTests(): void {
   buffer.length = 0;
+  bufferBytes = 0;
   nextSeq = 1;
 }

package/src/lib/provider-outbound.ts

@@ -117,6 +117,9 @@ export async function providerOutboundGet(
     if (assessment?.kind === "metadata" || assessment?.kind === "link-local" || assessment?.kind === "unspecified") {
       throw new ProviderOutboundPolicyError(`provider URL targets ${assessment.detail}`);
     }
+    // Registry defaults count here too, not just the operator flag: a stock Ollama entry is
+    // local by definition and previously passed config validation only to be refused at the
+    // fetch (#758). Metadata/link-local/unspecified were already rejected above.
     const allowPrivate = providerAllowsPrivateNetwork(name, provider);
     if (!allowPrivate) {
       const destinationError = providerDestinationConfigError(name, {

package/src/lib/sidecar-tracker.ts

@@ -13,7 +13,7 @@ let lastEnterAt = 0;
 
 export function sidecarEnter(label: string): () => void {
   inFlight++;
-  lastLabel = label;
+  lastLabel = truncateRetainedUtf8(label, MAX_DIAGNOSTIC_VALUE_BYTES);
   lastEnterAt = Date.now();
   let exited = false;
   return () => {
@@ -40,10 +40,13 @@ let lastActivity = "";
 let lastActivityAt = 0;
 
 export function markActivity(note: string): void {
-  lastActivity = note;
+  lastActivity = truncateRetainedUtf8(note, MAX_DIAGNOSTIC_VALUE_BYTES);
   lastActivityAt = Date.now();
 }
 
 export function activityBreadcrumb(): { note: string; sinceMs: number } {
   return { note: lastActivity, sinceMs: lastActivityAt ? Date.now() - lastActivityAt : 0 };
 }
+import { truncateRetainedUtf8 } from "./admission";
+
+const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;

package/src/lib/sse-decoder.ts

@@ -1,3 +1,9 @@
+import {
+  TRANSLATOR_MAX_SSE_EVENT_BYTES,
+  TranslatorBudgetExceededError,
+  type TranslatorBudget,
+} from "./translator-budget";
+
 export interface ServerSentEvent {
   event?: string;
   data: string;
@@ -16,21 +22,78 @@ export type SseRecord =
  */
 export function decodeServerSentEvents(
   source: ReadableStream<Uint8Array>,
-  options: { includeComments: true; signal?: AbortSignal },
+  options: { includeComments: true; signal?: AbortSignal; translatorBudget: TranslatorBudget },
 ): AsyncGenerator<SseRecord>;
 export function decodeServerSentEvents(
   source: ReadableStream<Uint8Array>,
-  options?: { includeComments?: false; signal?: AbortSignal },
+  options: { includeComments?: false; signal?: AbortSignal; translatorBudget: TranslatorBudget },
 ): AsyncGenerator<ServerSentEvent>;
 export async function* decodeServerSentEvents(
   source: ReadableStream<Uint8Array>,
-  options?: { includeComments?: boolean; signal?: AbortSignal },
+  options: { includeComments?: boolean; signal?: AbortSignal; translatorBudget: TranslatorBudget },
 ): AsyncGenerator<ServerSentEvent | SseRecord> {
+  const translatorBudget = options.translatorBudget;
   const reader = source.getReader();
   const decoder = new TextDecoder();
-  let buffer = "";
+  let lineBuffer = "";
+  let lineRawBytes = 0;
+  let lineRetainedBytes = 0;
   let event: string | undefined;
+  let eventBytes = 0;
   let dataLines: string[] = [];
+  let dataLinesBytes = 0;
+  const scope = { kind: "live_transient" as const };
+
+  const utf8SliceBytes = (value: string, start: number, end: number): number => {
+    let bytes = 0;
+    for (let index = start; index < end; index++) {
+      const codePoint = value.codePointAt(index)!;
+      if (codePoint <= 0x7f) bytes += 1;
+      else if (codePoint <= 0x7ff) bytes += 2;
+      else if (codePoint <= 0xffff) bytes += 3;
+      else {
+        bytes += 4;
+        index += 1;
+      }
+    }
+    return bytes;
+  };
+
+  const linePrefixAfter = (sourceValue: string, start: number, end: number): string => {
+    if (lineBuffer.length >= 6) return lineBuffer.slice(0, 6);
+    return (lineBuffer + sourceValue.slice(start, Math.min(end, start + 6 - lineBuffer.length))).slice(0, 6);
+  };
+
+  const accountedLineBytes = (rawBytes: number, prefix: string): number => {
+    if (prefix.length < 5 && "data:".startsWith(prefix)) return 0;
+    if (!prefix.startsWith("data:")) return rawBytes;
+    return Math.max(0, rawBytes - (prefix[5] === " " ? 6 : 5));
+  };
+
+  const appendLine = (sourceValue: string, start: number, end: number): void => {
+    if (start >= end) return;
+    const nextRawBytes = lineRawBytes + utf8SliceBytes(sourceValue, start, end);
+    const prefix = linePrefixAfter(sourceValue, start, end);
+    const nextRetainedBytes = accountedLineBytes(nextRawBytes, prefix);
+    if (prefix.startsWith("data:")) {
+      const logicalEventBytes = dataLinesBytes + dataLines.length + nextRetainedBytes;
+      if (logicalEventBytes > TRANSLATOR_MAX_SSE_EVENT_BYTES) {
+        throw new TranslatorBudgetExceededError("live_transient", TRANSLATOR_MAX_SSE_EVENT_BYTES);
+      }
+    }
+    const reservation = translatorBudget.reserveTransient(nextRawBytes, scope);
+    try {
+      const fragment = sourceValue.slice(start, end);
+      lineBuffer += fragment;
+      reservation.commitRetained();
+      translatorBudget.releaseRetained(lineRetainedBytes, scope);
+      lineRawBytes = nextRawBytes;
+      lineRetainedBytes = nextRawBytes;
+    } catch (error) {
+      reservation.release();
+      throw error;
+    }
+  };
   // Prompt cancellation channel: an abort cancels the underlying reader directly, which
   // settles any in-flight read() so a consumer's iterator.return() cannot hang behind an
   // idle upstream (a plain generator return waits for the pending await first).
@@ -41,61 +104,218 @@ export async function* decodeServerSentEvents(
 
   const includeComments = options?.includeComments === true;
 
-  const dispatch = (): ServerSentEvent | SseRecord | undefined => {
+  const dispatch = (): { record: ServerSentEvent | SseRecord; bytes: number } | undefined => {
     if (dataLines.length === 0) {
+      translatorBudget.releaseRetained(eventBytes, scope);
       event = undefined;
+      eventBytes = 0;
       return undefined;
     }
-    const record = { ...(event ? { event } : {}), data: dataLines.join("\n") };
+    const payloadBytes = dataLinesBytes + Math.max(0, dataLines.length - 1);
+    if (payloadBytes > TRANSLATOR_MAX_SSE_EVENT_BYTES) {
+      throw new TranslatorBudgetExceededError("live_transient", TRANSLATOR_MAX_SSE_EVENT_BYTES);
+    }
+    let data: string;
+    if (dataLines.length === 1) {
+      data = dataLines[0]!;
+    } else {
+      const reservation = translatorBudget.reserveTransient(payloadBytes, scope);
+      try {
+        data = dataLines.join("\n");
+        reservation.commitRetained();
+        translatorBudget.releaseRetained(dataLinesBytes, scope);
+      } catch (error) {
+        reservation.release();
+        throw error;
+      }
+    }
+    const record = { ...(event ? { event } : {}), data };
+    const retainedRecordBytes = payloadBytes + eventBytes;
     event = undefined;
+    eventBytes = 0;
     dataLines = [];
-    return includeComments ? { kind: "event", ...record } : record;
+    dataLinesBytes = 0;
+    return {
+      record: includeComments ? { kind: "event", ...record } : record,
+      bytes: retainedRecordBytes,
+    };
   };
 
-  const acceptLine = (rawLine: string): ServerSentEvent | SseRecord | undefined => {
-    const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
-    if (line === "") return dispatch();
-    if (line.startsWith(":")) {
-      if (!includeComments) return undefined;
-      let comment = line.slice(1);
-      if (comment.startsWith(" ")) comment = comment.slice(1);
-      return { kind: "comment", comment };
-    }
+  const acceptLine = (): { record: ServerSentEvent | SseRecord; bytes: number } | undefined => {
+    let line = lineBuffer;
+    let retainedLineBytes = lineRetainedBytes;
+    let lineOwned = true;
+    const releaseLine = (): void => {
+      if (!lineOwned) return;
+      lineOwned = false;
+      translatorBudget.releaseRetained(retainedLineBytes, scope);
+    };
+    lineBuffer = "";
+    lineRawBytes = 0;
+    lineRetainedBytes = 0;
+    try {
+      if (line.endsWith("\r")) {
+        const nextLineBytes = retainedLineBytes - 1;
+        const reservation = translatorBudget.reserveTransient(nextLineBytes, scope);
+        try {
+          const nextLine = line.slice(0, -1);
+          reservation.commitRetained();
+          translatorBudget.releaseRetained(retainedLineBytes, scope);
+          line = nextLine;
+          retainedLineBytes = nextLineBytes;
+        } catch (error) {
+          reservation.release();
+          throw error;
+        }
+      }
+      if (line === "") {
+        releaseLine();
+        return dispatch();
+      }
+      if (line.startsWith(":")) {
+        if (!includeComments) {
+          releaseLine();
+          return undefined;
+        }
+        const commentStart = line[1] === " " ? 2 : 1;
+        const commentBytes = utf8SliceBytes(line, commentStart, line.length);
+        translatorBudget.chargeRetained(commentBytes, scope);
+        try {
+          const comment = line.slice(commentStart);
+          releaseLine();
+          return { record: { kind: "comment", comment }, bytes: commentBytes };
+        } catch (error) {
+          translatorBudget.releaseRetained(commentBytes, scope);
+          throw error;
+        }
+      }
 
-    const colon = line.indexOf(":");
-    const field = colon < 0 ? line : line.slice(0, colon);
-    let value = colon < 0 ? "" : line.slice(colon + 1);
-    if (value.startsWith(" ")) value = value.slice(1);
+      const colon = line.indexOf(":");
+      const fieldEnd = colon < 0 ? line.length : colon;
+      const fieldBytes = utf8SliceBytes(line, 0, fieldEnd);
+      const fieldReservation = translatorBudget.reserveTransient(fieldBytes, scope);
+      let field = "";
+      try {
+        field = line.slice(0, fieldEnd);
+        fieldReservation.commitRetained();
+      } catch (error) {
+        fieldReservation.release();
+        throw error;
+      }
+      try {
+        let valueStart = colon < 0 ? line.length : colon + 1;
+        if (line[valueStart] === " ") valueStart += 1;
+        const valueBytes = utf8SliceBytes(line, valueStart, line.length);
+
+        if (field === "event") {
+          const reservation = translatorBudget.reserveTransient(valueBytes, scope);
+          try {
+            const value = line.slice(valueStart);
+            reservation.commitRetained();
+            translatorBudget.releaseRetained(eventBytes, scope);
+            event = value;
+            eventBytes = valueBytes;
+            releaseLine();
+          } catch (error) {
+            reservation.release();
+            throw error;
+          }
+        }
+        else if (field === "data") {
+          const nextEventBytes = dataLinesBytes + valueBytes + dataLines.length;
+          if (nextEventBytes > TRANSLATOR_MAX_SSE_EVENT_BYTES) {
+            throw new TranslatorBudgetExceededError("live_transient", TRANSLATOR_MAX_SSE_EVENT_BYTES);
+          }
+          // The extracted value is a distinct retained allocation while the source line is still
+          // live. Admit that insertion before slicing/pushing, then release the source owner.
+          translatorBudget.chargeRetained(valueBytes, scope);
+          try {
+            const value = line.slice(valueStart);
+            dataLines.push(value);
+            dataLinesBytes += valueBytes;
+            releaseLine();
+          } catch (error) {
+            translatorBudget.releaseRetained(valueBytes, scope);
+            throw error;
+          }
+        } else {
+          releaseLine();
+        }
+      } finally {
+        translatorBudget.releaseRetained(fieldBytes, scope);
+      }
+      return undefined;
+    } catch (error) {
+      releaseLine();
+      throw error;
+    }
+  };
 
-    if (field === "event") event = value;
-    else if (field === "data") dataLines.push(value);
-    return undefined;
+  const consumeDecoded = async function* (
+    decoded: string,
+  ): AsyncGenerator<ServerSentEvent | SseRecord> {
+    let offset = 0;
+    while (offset < decoded.length) {
+      const newline = decoded.indexOf("\n", offset);
+      if (newline < 0) {
+        appendLine(decoded, offset, decoded.length);
+        return;
+      }
+      appendLine(decoded, offset, newline);
+      const accepted = acceptLine();
+      if (accepted) {
+        try {
+          yield accepted.record;
+        } finally {
+          translatorBudget.releaseRetained(accepted.bytes, scope);
+        }
+      }
+      offset = newline + 1;
+    }
   };
 
   try {
     while (true) {
       const { done, value } = await reader.read();
-      if (value) buffer += decoder.decode(value, { stream: !done });
-
-      let newline: number;
-      while ((newline = buffer.indexOf("\n")) >= 0) {
-        const record = acceptLine(buffer.slice(0, newline));
-        buffer = buffer.slice(newline + 1);
-        if (record) yield record;
+      if (value) {
+        const sourceBytes = value.byteLength;
+        const sourceReservation = translatorBudget.reserveTransient(sourceBytes, scope);
+        let sourceCommitted = false;
+        try {
+          const decoded = decoder.decode(value, { stream: !done });
+          sourceReservation.commitRetained();
+          sourceCommitted = true;
+          yield* consumeDecoded(decoded);
+        } finally {
+          if (sourceCommitted) translatorBudget.releaseRetained(sourceBytes, scope);
+          else sourceReservation.release();
+        }
       }
-
       if (!done) continue;
-      buffer += decoder.decode();
-      if (buffer.length > 0) {
-        const record = acceptLine(buffer);
-        buffer = "";
-        if (record) yield record;
+      const finalDecoded = decoder.decode();
+      yield* consumeDecoded(finalDecoded);
+      if (lineBuffer.length > 0) {
+        const accepted = acceptLine();
+        if (accepted) {
+          try {
+            yield accepted.record;
+          } finally {
+            translatorBudget.releaseRetained(accepted.bytes, scope);
+          }
+        }
       }
       const finalRecord = dispatch();
-      if (finalRecord) yield finalRecord;
+      if (finalRecord) {
+        try {
+          yield finalRecord.record;
+        } finally {
+          translatorBudget.releaseRetained(finalRecord.bytes, scope);
+        }
+      }
       break;
     }
   } finally {
+    translatorBudget.releaseRetained(lineRetainedBytes + dataLinesBytes + eventBytes, scope);
     signal?.removeEventListener("abort", onAbort);
     try { await reader.cancel(); } catch { /* already closed/errored */ }
     try { reader.releaseLock(); } catch { /* already released */ }

package/src/lib/state-store-registrations.ts

@@ -0,0 +1,109 @@
+import {
+  getConfigDir,
+  reconcileConfigWarningMemos,
+  sweepDeadOcxStartProcessCache,
+} from "../config";
+import { reconcileCodexReauthState } from "../codex/account-runtime-state";
+import { reconcileCatalogWarningMemos } from "../codex/catalog/aggregation";
+import { reconcileProviderFetchWarnings } from "../codex/catalog/provider-fetch";
+import { reconcileModelCacheGeneration } from "../codex/model-cache";
+import { reconcilePoolRotationState } from "../codex/pool-rotation";
+import { reconcileCodexQuotaAccounts } from "../codex/quota";
+import {
+  listLiveCodexAccountIds,
+  reconcileCodexRoutingHealth,
+} from "../codex/routing";
+import { sweepExpiredSubagentModelHealth } from "../codex/subagent-model-fallback";
+import {
+  reconcileComboTargetCooldowns,
+  sweepExpiredComboTargetCooldowns,
+} from "../combos/failover";
+import { reconcileComboWarningMemos } from "../combos/request";
+import { reconcileComboRotationState } from "../combos/resolve";
+import { listLiveComboTargetKeys } from "../combos/types";
+import {
+  listLiveConfigOwnershipRoots,
+  reconcileConfigOwnershipRoots,
+} from "./config-ownership";
+import { reconcileGcpAdcTokens, sweepExpiredGcpAdcTokens } from "./gcp-adc";
+import {
+  reconcileOAuthFlowState,
+  sweepExpiredXaiPermanentFailureVerdicts,
+} from "../oauth";
+import { sweepExpiredAnthropicRoutingHealth } from "../oauth/anthropic-routing";
+import { listLiveOAuthAccountKeys, reconcileOAuthReauthState } from "../oauth/store";
+import { reconcileGuardianBackoff } from "../oauth/token-guardian";
+import { sweepExpiredApiKeyCooldowns } from "../providers/key-failover";
+import { sweepExpiredResponseStates } from "../responses/state";
+import { sweepExpiredAntigravityReplay } from "../adapters/google-antigravity-replay";
+import { reconcileProviderAccountQuotaRows } from "../providers/quota";
+import { reconcileRouterWarningMemos } from "../router";
+import type { OcxConfig } from "../types";
+import {
+  type GenerationContext,
+  reconcileStateGeneration,
+  registerStateStore,
+  setGenerationContextBuilder,
+  type StateStoreRegistration,
+} from "./state-store-sweeper";
+
+let liveServerConfig: OcxConfig | null = null;
+
+export function setLiveStateStoreConfig(config: OcxConfig): void {
+  liveServerConfig = config;
+}
+
+export function reconcileLiveStateStores() {
+  if (!liveServerConfig) return { storesVisited: 0, rowsRemoved: 0 };
+  return reconcileStateGeneration(buildGenerationContext());
+}
+
+export function buildGenerationContext(): GenerationContext {
+  if (!liveServerConfig) throw new Error("live server config is not installed");
+  const providerNames = new Set(Object.keys(liveServerConfig.providers));
+  return {
+    generation: 0,
+    providerNames,
+    comboIds: new Set(Object.keys(liveServerConfig.combos ?? {})),
+    comboTargets: listLiveComboTargetKeys(liveServerConfig),
+    codexAccountIds: listLiveCodexAccountIds(liveServerConfig),
+    oauthAccountKeys: listLiveOAuthAccountKeys(providerNames),
+    configRoots: listLiveConfigOwnershipRoots(getConfigDir()),
+  };
+}
+
+export const STATE_STORE_REGISTRATIONS = [
+  { name: "subagent-model-health", sweepExpired: sweepExpiredSubagentModelHealth },
+  { name: "api-key-cooldowns", sweepExpired: sweepExpiredApiKeyCooldowns },
+  {
+    name: "combo-target-cooldowns",
+    sweepExpired: sweepExpiredComboTargetCooldowns,
+    reconcileGeneration: reconcileComboTargetCooldowns,
+  },
+  { name: "anthropic-routing-health", sweepExpired: sweepExpiredAnthropicRoutingHealth },
+  { name: "xai-refresh-verdicts", sweepExpired: sweepExpiredXaiPermanentFailureVerdicts },
+  { name: "responses-continuation", sweepExpired: sweepExpiredResponseStates },
+  { name: "antigravity-replay", sweepExpired: sweepExpiredAntigravityReplay },
+  { name: "config-warning-memos", reconcileGeneration: (context: GenerationContext) => reconcileConfigWarningMemos(context.generation) },
+  { name: "catalog-warning-memos", reconcileGeneration: (context: GenerationContext) => reconcileCatalogWarningMemos(context.generation) },
+  { name: "provider-fetch-warning-memos", reconcileGeneration: (context: GenerationContext) => reconcileProviderFetchWarnings(context.generation) },
+  { name: "combo-warning-memos", reconcileGeneration: (context: GenerationContext) => reconcileComboWarningMemos(context.generation) },
+  { name: "router-warning-memos", reconcileGeneration: (context: GenerationContext) => reconcileRouterWarningMemos(context.generation) },
+  { name: "codex-quota", reconcileGeneration: reconcileCodexQuotaAccounts },
+  { name: "provider-quota-history", reconcileGeneration: reconcileProviderAccountQuotaRows },
+  { name: "codex-routing-health", reconcileGeneration: reconcileCodexRoutingHealth },
+  { name: "model-cache-history", reconcileGeneration: reconcileModelCacheGeneration },
+  { name: "pool-rotation", reconcileGeneration: reconcilePoolRotationState },
+  { name: "combo-rotation", reconcileGeneration: reconcileComboRotationState },
+  { name: "guardian-backoff", reconcileGeneration: reconcileGuardianBackoff },
+  { name: "codex-reauth", reconcileGeneration: reconcileCodexReauthState },
+  { name: "oauth-reauth", reconcileGeneration: reconcileOAuthReauthState },
+  { name: "gcp-adc", sweepExpired: sweepExpiredGcpAdcTokens, reconcileGeneration: reconcileGcpAdcTokens },
+  { name: "config-ownership", reconcileGeneration: reconcileConfigOwnershipRoots },
+  { name: "oauth-flow-state", reconcileGeneration: reconcileOAuthFlowState },
+  { name: "ocx-start-process-cache", sweepLiveness: sweepDeadOcxStartProcessCache },
+] satisfies readonly StateStoreRegistration[];
+
+for (const registration of STATE_STORE_REGISTRATIONS) registerStateStore(registration);
+
+setGenerationContextBuilder(buildGenerationContext);