Skip to content

Coalesce overlapping cost refreshes - #177

Open
SiavashShams wants to merge 1 commit into
openai:mainfrom
SiavashShams:oss/openai-codex-security-issue-31-20260731-0117320700
Open

Coalesce overlapping cost refreshes#177
SiavashShams wants to merge 1 commit into
openai:mainfrom
SiavashShams:oss/openai-codex-security-issue-31-20260731-0117320700

Conversation

@SiavashShams

Copy link
Copy Markdown

Fixes #31.

Summary

ScanCostTracker.refresh() appended every request to a promise chain. When a session-tree traversal exceeded the 100 ms polling interval, timer ticks accumulated full traversals and stop() queued more work behind them.

Track one active refresh and one shared follow-up refresh instead. Calls arriving during an active traversal await the same follow-up, including stop(), while successful and failed traversals both advance or reset scheduler state.

The regression blocks session reads, starts three overlapping refreshes plus stop(), and verifies that only two traversals run. On the baseline it failed after starting a third traversal. A separate case verifies recovery after a traversal error.

Verification

  • pnpm dlx bun@1.3.14 test --timeout 30000 ./tests-ts/cost.test.ts — baseline: 14 passed, 1 failed; patched: 15 passed, 0 failed.
  • pnpm dlx bun@1.3.14 test --timeout 30000 ./tests-ts — 708 passed, 5 expected skips, 0 failed.
  • pnpm run types — passed.
  • pnpm run format — passed.
  • pnpm run build — passed.
  • pnpm pack --pack-destination /private/tmp/codex-security-pack — passed.
  • npm_config_cache=/private/tmp/codex-security-npm-cache pnpm run check:package /private/tmp/codex-security-pack/openai-codex-security-0.1.4.tgz — validated the public import, CLI, bundled plugin files, and archive contents.
  • git diff --check — passed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

maxCostUsd polling queues full session-tree rescans and can delay budget enforcement

1 participant