@coseung2/opencodex 2.8.0-cs.1 → 2.8.0-cs.11

package/src/server/memory-watchdog.ts

@@ -1,18 +1,21 @@
 /**
- * Memory watchdog (#314 WP3 / #509) — warn-only observability for the Windows
- * native-memory growth reported upstream (Bun fetch buffers / socket handles).
+ * Memory watchdog (#314 WP3 / #509) — observability plus a bounded Windows
+ * native-memory reclamation attempt for the Bun fetch-buffer retention shape.
  *
  * Samples process.memoryUsage() on an unref'd interval into a bounded ring and
- * logs ONE rate-limited warning when observed memory crosses the threshold. It never
- * restarts anything (threshold auto-restart is deliberately deferred; the
- * service managers' crash-respawn already covers hard failures). The active
- * instance is a module-level singleton so the management API can expose the
- * snapshot without threading server state through route contexts.
+ * logs ONE rate-limited warning when observed memory crosses the threshold. On
+ * Windows, a supported Bun.gc(true) is attempted once per pressure episode,
+ * only after observed memory reaches the reclamation threshold and the active
+ * turn registry is idle. The active instance is a module-level singleton so
+ * the management API can expose the snapshot without threading server state
+ * through route contexts.
  *
  * Privacy: samples are scalar numbers only; the warn line never interpolates
  * paths, hostnames, or tokens.
  */
 
+import { getActiveTurnCount, onActiveTurnsIdle } from "./lifecycle";
+
 export type MemorySampleBase = {
   /** Epoch ms. */
   at: number;
@@ -52,6 +55,7 @@ export type MemoryWatchdog = {
 
 const DEFAULT_INTERVAL_MS = 60_000;
 const DEFAULT_WARN_THRESHOLD_BYTES = 4 * 1024 ** 3; // 4 GiB
+const DEFAULT_RECLAIM_THRESHOLD_BYTES = 2 * 1024 ** 3; // 2 GiB, based on Windows reproduction
 const DEFAULT_RING_SIZE = 360; // ≈6h at 60s
 const WARN_INTERVAL_MS = 30 * 60_000;
 const DOCS_URL = "https://opencodex.me/troubleshooting/windows-memory/";
@@ -71,6 +75,24 @@ export function observedMemoryCounter(sample: Pick<MemorySampleBase, "rss" | "ex
   return { observedBytes: best.bytes, observedMetric: best.metric };
 }
 
+export type MemoryReclamationPolicyInput = {
+  observedBytes: number;
+  pressureThresholdBytes: number;
+  activeTurns: number;
+  platform: NodeJS.Platform;
+  gcSupported: boolean;
+  pressureLatched: boolean;
+};
+
+/** Pure policy gate for the pressure-triggered, idle-only reclamation path. */
+export function shouldAttemptMemoryReclamation(input: MemoryReclamationPolicyInput): boolean {
+  return input.platform === "win32"
+    && input.gcSupported
+    && input.activeTurns === 0
+    && input.observedBytes >= input.pressureThresholdBytes
+    && !input.pressureLatched;
+}
+
 /** The running watchdog, if any — read by /api/system/memory. */
 export function getActiveMemoryWatchdog(): MemoryWatchdog | null {
   return active;
@@ -93,6 +115,12 @@ function normalizeSample(sample: MemorySampleBase): MemorySample {
   return { ...sample, ...observedMemoryCounter(sample) };
 }
 
+function defaultGarbageCollector(platform: NodeJS.Platform): (() => void) | null {
+  if (platform !== "win32") return null;
+  if (typeof Bun === "undefined" || typeof Bun.gc !== "function") return null;
+  return () => Bun.gc(true);
+}
+
 /**
  * Start (or replace) the process-wide memory watchdog. Idempotent: a previous
  * active instance is stopped first, so repeated startServer() calls in tests
@@ -102,23 +130,57 @@ function normalizeSample(sample: MemorySampleBase): MemorySample {
 export function startMemoryWatchdog(opts?: {
   intervalMs?: number;
   warnThresholdBytes?: number;
+  pressureThresholdBytes?: number;
   ringSize?: number;
   now?: () => number;
   sample?: () => MemorySampleBase;
   warn?: (msg: string) => void;
+  platform?: NodeJS.Platform;
+  activeTurnCount?: () => number;
+  gc?: (() => void) | null;
 }): MemoryWatchdog {
   active?.stop();
   const intervalMs = opts?.intervalMs ?? DEFAULT_INTERVAL_MS;
   const warnThresholdBytes = opts?.warnThresholdBytes ?? DEFAULT_WARN_THRESHOLD_BYTES;
+  const pressureThresholdBytes = opts?.pressureThresholdBytes ?? DEFAULT_RECLAIM_THRESHOLD_BYTES;
   const ringSize = opts?.ringSize ?? DEFAULT_RING_SIZE;
   const now = opts?.now ?? Date.now;
   const sample = opts?.sample ?? (() => defaultSample(now));
   const warn = opts?.warn ?? ((msg: string) => console.warn(msg));
+  const platform = opts?.platform ?? process.platform;
+  const activeTurnCount = opts?.activeTurnCount ?? getActiveTurnCount;
+  const collectGarbage = opts !== undefined && "gc" in opts
+    ? opts.gc ?? null
+    : defaultGarbageCollector(platform);
 
   const samples: MemorySample[] = [];
   let lastWarnAt: number | null = null;
   let observedBytes = 0;
   let observedMetric: MemoryMetric = "rss";
+  let pressureLatched = false;
+
+  const reclaimIfIdle = (): void => {
+    if (!shouldAttemptMemoryReclamation({
+      observedBytes,
+      pressureThresholdBytes,
+      activeTurns: activeTurnCount(),
+      platform,
+      gcSupported: collectGarbage !== null,
+      pressureLatched,
+    })) return;
+    // Latch before calling Bun.gc so a sustained high sample cannot turn into
+    // a GC on every timer tick or every later turn completion.
+    pressureLatched = true;
+    try {
+      collectGarbage?.();
+    } catch {
+      // Reclamation is a best-effort runtime hint. A collector failure must not
+      // escape the watchdog timer and terminate the proxy.
+    }
+  };
+  const removeIdleListener = platform === "win32" && collectGarbage !== null
+    ? onActiveTurnsIdle(reclaimIfIdle)
+    : () => {};
 
   const tick = () => {
     let s: MemorySample;
@@ -131,6 +193,8 @@ export function startMemoryWatchdog(opts?: {
     if (samples.length > ringSize) samples.splice(0, samples.length - ringSize);
     observedBytes = s.observedBytes;
     observedMetric = s.observedMetric;
+    if (observedBytes < pressureThresholdBytes) pressureLatched = false;
+    reclaimIfIdle();
     if (s.observedBytes >= warnThresholdBytes && (lastWarnAt === null || now() - lastWarnAt >= WARN_INTERVAL_MS)) {
       lastWarnAt = now();
       const observedMb = Math.round(s.observedBytes / (1024 * 1024));
@@ -145,6 +209,7 @@ export function startMemoryWatchdog(opts?: {
   const instance: MemoryWatchdog = {
     stop() {
       clearInterval(timer);
+      removeIdleListener();
       if (active === instance) active = null;
     },
     snapshot() {

package/src/server/proxy-liveness.ts

@@ -68,7 +68,11 @@ export interface LiveProxy {
  */
 export function probeHostname(hostname: string | undefined): string {
   const trimmed = (hostname ?? "").trim();
-  if (!trimmed || trimmed === "0.0.0.0" || trimmed === "::" || trimmed === "[::]") return "127.0.0.1";
+  if (!trimmed || /^localhost$/i.test(trimmed) || trimmed === "0.0.0.0" || trimmed === "::" || trimmed === "[::]") {
+    // startServer canonicalizes localhost to IPv4 loopback because Codex's injected URL does
+    // the same. Keep liveness probes on that exact address (Windows otherwise prefers ::1).
+    return "127.0.0.1";
+  }
   if (trimmed.startsWith("[") && trimmed.endsWith("]")) return trimmed;
   return trimmed.includes(":") ? `[${trimmed}]` : trimmed;
 }

package/src/service.ts

@@ -2326,8 +2326,8 @@ export function diagnoseService(): ServiceDiagnostic {
   return { supported: false, installed: false, enabled: false, running: false, viable: false, startable: false, stale: false, conflict: false, backend: null, summary: `unsupported on ${process.platform}` };
 }
 
-export function serviceStatusSummary(): string {
-  return diagnoseService().summary;
+export function serviceStatusSummary(service: ServiceDiagnostic = diagnoseService()): string {
+  return `${service.summary}; log: ${serviceLogPath()}`;
 }
 
 /**
@@ -2394,6 +2394,16 @@ export interface ParsedServiceArgs {
   invalid: string[];
 }
 
+const SERVICE_SUBCOMMANDS = new Set(["install", "repair", "start", "stop", "status", "uninstall", "remove"]);
+
+function exitServiceUsage(): never {
+  console.error("Usage: ocx service [install|repair|start|stop|status|uninstall|remove] [--native|--scheduler]");
+  console.error("       With no subcommand, installs/updates and starts the background service.");
+  console.error("       repair: refresh assets and restart an already-installed service (no admin re-prompt).");
+  console.error("       --native (Windows only): register a real SCM service via WinSW instead of Task Scheduler.");
+  process.exit(1);
+}
+
 /**
  * `ocx service [sub] [--native|--scheduler]`. The first non-flag token is the
  * subcommand; backend flags are only meaningful for `install` (validated by the caller).
@@ -2421,6 +2431,7 @@ export function parseServiceArgs(args: string[]): ParsedServiceArgs {
 export async function serviceCommand(...args: (string | undefined)[]): Promise<void> {
   const parsed = parseServiceArgs(args.filter((a): a is string => Boolean(a)));
   const command = parsed.sub;
+  if (!SERVICE_SUBCOMMANDS.has(command)) exitServiceUsage();
   if (parsed.invalid.length > 0) {
     console.error(`Unknown service option: ${parsed.invalid.join(" ")}`);
     process.exit(1);
@@ -2545,10 +2556,6 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       console.log("✅ service uninstalled.");
       break;
     default:
-      console.error("Usage: ocx service [install|repair|start|stop|status|uninstall|remove] [--native|--scheduler]");
-      console.error("       With no subcommand, installs/updates and starts the background service.");
-      console.error("       repair: refresh assets and restart an already-installed service (no admin re-prompt).");
-      console.error("       --native (Windows only): register a real SCM service via WinSW instead of Task Scheduler.");
-      process.exit(1);
+      exitServiceUsage();
   }
 }

package/src/types.ts

@@ -9,6 +9,8 @@ export interface OcxParsedRequest {
   _rawBody?: unknown;
   /** Number of leading raw input items restored from local previous_response_id state. */
   _replayPrefixLen?: number;
+  /** Number of parsed messages produced by that restored raw-input prefix. */
+  _replayMessagePrefixLen?: number;
   /** True when the proxy expanded a previous_response_id request into a full input replay. */
   _previousResponseInputExpanded?: boolean;
   /** Provider-private stable Cursor conversation id resolved from the Responses previous_response_id chain. */
@@ -722,6 +724,13 @@ export interface OcxConfig {
   codexAccounts?: CodexAccount[];
   /** Account ids administratively excluded from future pool selection until resumed. */
   pausedCodexAccountIds?: string[];
+  /**
+   * OAuth provider account ids administratively excluded from pool selection until
+   * resumed, keyed by provider name (for example `kiro`, `anthropic`, `xai`).
+   * A paused account cannot be activated; pausing the active account promotes the
+   * first non-paused account (or clears the active selection when none remain).
+   */
+  pausedOauthAccountIds?: Record<string, string[]>;
   /**
    * Public model-selector namespaces bound to one Codex account. Values are stored account ids;
    * `"@main"` selects the Codex Desktop/main auth.json account. Account display aliases