Bound Codex cost cache persistence size (#2637)

Sources/CodexBarCore/Generated/CodexParserHash.generated.swift

@@ -1,5 +1,5 @@
 // Generated by Scripts/regenerate-codex-parser-hash.sh. Do not edit by hand.
 
 enum CodexParserHash {
-    static let value = "843ca061c36bbea1"
+    static let value = "3c03b1d5045174e2"
 }

Sources/CodexBarCore/Vendored/CostUsage/CostUsageCache.swift

@@ -1,6 +1,17 @@
 import Foundation
 
 enum CostUsageCacheIO {
+    /// Persistence budgets for the Codex cost cache. The artifact holds one entry per
+    /// scanned session file plus per-file detail (rows, turn IDs, token snapshots) and is
+    /// decoded and encoded as a single JSON document on every scan, so an unbounded corpus
+    /// can otherwise grow it to multiple gigabytes. These bounds mirror the scan-side byte
+    /// budgets; in-window data is never dropped, so reports stay complete.
+    static let maxCacheFileBytes: Int = 256 * 1024 * 1024
+    static let maxCacheFileEntries: Int = 25000
+    /// Artifacts above this size are refused at load time and rebuilt by the bounded
+    /// scanner instead of being decoded in one shot.
+    static let maxCacheLoadBytes: Int = 1024 * 1024 * 1024
+
     /// Producer keys from older parser hashes whose caches are still valid under the current
     /// delta semantics. Cleared for #2037: interleave containment changed how cumulative
     /// totals are counted, so every earlier cache must be rebuilt.
@@ -36,7 +47,8 @@ enum CostUsageCacheIO {
         provider: UsageProvider,
         cacheRoot: URL? = nil,
         producerKey: String? = nil,
-        calendar: Calendar? = nil) -> CostUsageCache
+        calendar: Calendar? = nil,
+        maxCacheBytes: Int = CostUsageCacheIO.maxCacheLoadBytes) -> CostUsageCache
     {
         let url = self.cacheFileURL(provider: provider, cacheRoot: cacheRoot)
         let expectedProducerKey = producerKey ?? self.currentProducerKey(provider: provider)
@@ -46,7 +58,8 @@ enum CostUsageCacheIO {
         if let decoded = self.loadCache(
             at: url,
             expectedProducerKey: expectedProducerKey,
-            compatibleProducerKeys: compatibleProducerKeys)
+            compatibleProducerKeys: compatibleProducerKeys,
+            maxBytes: maxCacheBytes)
         {
             if let calendar, decoded.timeZoneIdentifier != calendar.timeZone.identifier {
                 return CostUsageCache()
@@ -59,10 +72,11 @@ enum CostUsageCacheIO {
     static func loadCodexForMigration(
         cacheRoot: URL? = nil,
         producerKey: String? = nil,
-        calendar: Calendar? = nil) -> CostUsageCodexCacheLoadResult
+        calendar: Calendar? = nil,
+        maxCacheBytes: Int = CostUsageCacheIO.maxCacheLoadBytes) -> CostUsageCodexCacheLoadResult
     {
         let url = self.cacheFileURL(provider: .codex, cacheRoot: cacheRoot)
-        guard let decoded = self.decodeCache(at: url) else {
+        guard let decoded = self.decodeCache(at: url, maxBytes: maxCacheBytes) else {
             return CostUsageCodexCacheLoadResult(cache: CostUsageCache(), incompatibleCache: nil)
         }
         if let calendar, decoded.timeZoneIdentifier != calendar.timeZone.identifier {
@@ -89,9 +103,10 @@ enum CostUsageCacheIO {
     private static func loadCache(
         at url: URL,
         expectedProducerKey: String?,
-        compatibleProducerKeys: Set<String>) -> CostUsageCache?
+        compatibleProducerKeys: Set<String>,
+        maxBytes: Int) -> CostUsageCache?
     {
-        guard let decoded = self.decodeCache(at: url) else { return nil }
+        guard let decoded = self.decodeCache(at: url, maxBytes: maxBytes) else { return nil }
         if let expectedProducerKey {
             guard decoded.producerKey == expectedProducerKey
                 || decoded.producerKey.map(compatibleProducerKeys.contains) == true
@@ -100,7 +115,10 @@ enum CostUsageCacheIO {
         return decoded
     }
 
-    private static func decodeCache(at url: URL) -> CostUsageCache? {
+    private static func decodeCache(at url: URL, maxBytes: Int) -> CostUsageCache? {
+        let fileSize = (try? FileManager.default.attributesOfItem(atPath: url.path)[.size] as? NSNumber)?
+            .int64Value ?? 0
+        guard fileSize <= maxBytes else { return nil }
         guard let data = try? Data(contentsOf: url) else { return nil }
         guard let decoded = try? JSONDecoder().decode(CostUsageCache.self, from: data)
         else { return nil }
@@ -113,7 +131,10 @@ enum CostUsageCacheIO {
         cache: CostUsageCache,
         cacheRoot: URL? = nil,
         producerKey: String? = nil,
-        calendar: Calendar = .current)
+        calendar: Calendar = .current,
+        requestedScanWindow: (sinceKey: String, untilKey: String)? = nil,
+        maxCacheBytes: Int = CostUsageCacheIO.maxCacheFileBytes,
+        maxCacheEntries: Int = CostUsageCacheIO.maxCacheFileEntries)
     {
         let url = self.cacheFileURL(provider: provider, cacheRoot: cacheRoot)
         let dir = url.deletingLastPathComponent()
@@ -123,10 +144,86 @@ enum CostUsageCacheIO {
         cache.producerKey = producerKey ?? self.currentProducerKey(provider: provider)
         cache.timeZoneIdentifier = calendar.timeZone.identifier
 
+        if provider == .codex {
+            Self.pruneCodexCacheForBudget(
+                &cache,
+                requestedScanWindow: requestedScanWindow,
+                maxCacheBytes: maxCacheBytes,
+                maxCacheEntries: maxCacheEntries,
+                previousArtifactBytes: Self.fileSize(at: url))
+        }
+
         let data = (try? JSONEncoder().encode(cache)) ?? Data()
         try? data.write(to: url, options: [.atomic])
     }
 
+    /// Bounds the Codex cache artifact when the corpus has outgrown the persistence budget.
+    /// The all-time accumulation lives in per-file entries whose usage days fall outside the
+    /// current scan window; the current report never reads those entries, and dropping them
+    /// (with the same day-aggregate subtraction the scanner uses) keeps the artifact from
+    /// growing without limit. Entries that are still resuming or that in-window forks depend
+    /// on are preserved so bounded scans and fork baselines keep making progress. Priority
+    /// turn IDs outside the window are only consulted for in-window rows, so they are trimmed
+    /// to the window as well.
+    private static func pruneCodexCacheForBudget(
+        _ cache: inout CostUsageCache,
+        requestedScanWindow: (sinceKey: String, untilKey: String)?,
+        maxCacheBytes: Int,
+        maxCacheEntries: Int,
+        previousArtifactBytes: Int64?)
+    {
+        // Prune against the active requested scan window (what the current report reads),
+        // not the historically widened retained union persisted in the cache.
+        let sinceKey = requestedScanWindow?.sinceKey ?? cache.scanSinceKey
+        let untilKey = requestedScanWindow?.untilKey ?? cache.scanUntilKey
+        guard let sinceKey, let untilKey else { return }
+        let overBudget = cache.files.count > maxCacheEntries
+            || (previousArtifactBytes ?? 0) > Int64(maxCacheBytes)
+        guard overBudget else { return }
+
+        let neededParentSessionIDs = Set(cache.files.values.compactMap(\.forkedFromId))
+        let outOfWindowKeys = cache.files.keys.filter { key in
+            guard let usage = cache.files[key] else { return false }
+            if usage.touchesCodexScanWindow(sinceKey: sinceKey, untilKey: untilKey) { return false }
+            if usage.codexScanComplete == false { return false }
+            if usage.codexJSONLResumeState != nil { return false }
+            if usage.hasBufferedCodexForkRetryLines { return false }
+            if let sessionId = usage.sessionId, neededParentSessionIDs.contains(sessionId) {
+                return false
+            }
+            return true
+        }
+        for key in outOfWindowKeys {
+            guard let old = cache.files.removeValue(forKey: key) else { continue }
+            CostUsageScanner.applyFileDays(cache: &cache, fileDays: old.days, sign: -1)
+        }
+        if !outOfWindowKeys.isEmpty, requestedScanWindow != nil {
+            // Entries outside the requested window are gone; narrow persisted coverage so a
+            // later refresh does not treat them as in-window again.
+            cache.scanSinceKey = requestedScanWindow?.sinceKey ?? cache.scanSinceKey
+            cache.scanUntilKey = requestedScanWindow?.untilKey ?? cache.scanUntilKey
+        }
+
+        let inWindow: (String) -> Bool = { key in
+            CostUsageScanner.CostUsageDayRange.isInRange(
+                dayKey: key,
+                since: sinceKey,
+                until: untilKey)
+        }
+        if let idsByDay = cache.codexPriorityTurnIDsByDay {
+            let trimmed = idsByDay.filter { inWindow($0.key) }
+            cache.codexPriorityTurnIDsByDay = trimmed.isEmpty ? nil : trimmed
+        }
+        if let turnKeys = cache.codexPriorityTurnKeys {
+            let trimmed = turnKeys.filter { inWindow($0.key) }
+            cache.codexPriorityTurnKeys = trimmed.isEmpty ? nil : trimmed
+        }
+    }
+
+    private static func fileSize(at url: URL) -> Int64? {
+        (try? FileManager.default.attributesOfItem(atPath: url.path)[.size] as? NSNumber)?.int64Value
+    }
+
     static func currentProducerKey(
         provider: UsageProvider,
         parserHash: String = CodexParserHash.value) -> String?

Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner.swift

@@ -4462,7 +4462,8 @@ enum CostUsageScanner {
             provider: .codex,
             cache: cache,
             cacheRoot: options.cacheRoot,
-            calendar: range.calendar)
+            calendar: range.calendar,
+            requestedScanWindow: (sinceKey: range.scanSinceKey, untilKey: range.scanUntilKey))
     }
 
     // swiftlint:disable:next function_body_length