Bound Codex session metadata reads (#2050)

* Bound Codex session metadata reads

* fix: bound Codex metadata pre-scan memory

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>

Author: Yuxin-Qiao

CHANGELOG.md

@@ -7,6 +7,7 @@
 
 ### Fixed
 - Claude: prevent CodexBar's passive CLI probes from starting background Claude Code updates, avoiding repeated partial downloads when a probe exits before an update completes. Thanks @PG2047!
+- Codex cost history: bound malformed session-metadata lines and release read chunks promptly, preventing metadata pre-scans from retaining memory in proportion to oversized JSONL records. Thanks @Yuxin-Qiao!
 
 ## 0.42.0 — 2026-07-11
 

Sources/CodexBarCore/Generated/CodexParserHash.generated.swift

@@ -1,5 +1,5 @@
 // Generated by Scripts/regenerate-codex-parser-hash.sh. Do not edit by hand.
 
 enum CodexParserHash {
-    static let value = "ed9cd73bd15c2398"
+    static let value = "4cf70ccd355c42ac"
 }

Sources/CodexBarCore/Vendored/CostUsage/CostUsageScanner.swift

@@ -1315,13 +1315,15 @@ enum CostUsageScanner {
         }
     }
 
-    private static func parseCodexSessionIdentifier(
+    static func parseCodexSessionIdentifier(
         fileURL: URL,
         checkCancellation: CancellationCheck? = nil) throws -> String?
     {
         try self.parseCodexSessionMetadata(fileURL: fileURL, checkCancellation: checkCancellation)?.sessionId
     }
 
+    static let codexSessionMetadataMaxLineBytes = 256 * 1024
+
     private static func parseCodexSessionMetadata(
         fileURL: URL,
         checkCancellation: CancellationCheck? = nil) throws -> CodexSessionMetadata?
@@ -1338,7 +1340,7 @@ enum CostUsageScanner {
         defer { try? handle.close() }
 
         var buffer = Data()
-        let newline = Data([0x0A])
+        var discardingOversizedLine = false
 
         func parseSessionMetadata(from lineData: Data) -> CodexSessionMetadata? {
             guard !lineData.isEmpty else { return nil }
@@ -1365,16 +1367,47 @@ enum CostUsageScanner {
         }
 
         do {
-            while let chunk = try handle.read(upToCount: 64 * 1024), !chunk.isEmpty {
-                try checkCancellation?()
-                buffer.append(chunk)
-                while let newlineRange = buffer.range(of: newline) {
-                    let lineData = buffer.subdata(in: 0..<newlineRange.lowerBound)
-                    buffer.removeSubrange(0..<newlineRange.upperBound)
-                    if let metadata = parseSessionMetadata(from: lineData) {
-                        return metadata
+            var matchedMetadata: CodexSessionMetadata?
+            while true {
+                let reachedEOF = try autoreleasepool { () throws -> Bool in
+                    guard let chunk = try handle.read(upToCount: 64 * 1024), !chunk.isEmpty else {
+                        return true
                     }
+                    try checkCancellation?()
+
+                    var segmentStart = chunk.startIndex
+                    while segmentStart < chunk.endIndex {
+                        let newlineIndex = chunk[segmentStart...].firstIndex(of: 0x0A)
+                        let segmentEnd = newlineIndex ?? chunk.endIndex
+
+                        if !discardingOversizedLine {
+                            let segmentCount = chunk.distance(from: segmentStart, to: segmentEnd)
+                            let remainingBytes = Self.codexSessionMetadataMaxLineBytes - buffer.count
+                            if segmentCount <= remainingBytes {
+                                buffer.append(contentsOf: chunk[segmentStart..<segmentEnd])
+                            } else {
+                                // Release the retained prefix immediately. The buffer never exceeds the line limit.
+                                buffer.removeAll(keepingCapacity: false)
+                                discardingOversizedLine = true
+                            }
+                        }
+
+                        guard let newlineIndex else { break }
+                        if !discardingOversizedLine,
+                           let metadata = parseSessionMetadata(from: buffer)
+                        {
+                            matchedMetadata = metadata
+                            break
+                        }
+                        buffer.removeAll(keepingCapacity: true)
+                        discardingOversizedLine = false
+                        segmentStart = chunk.index(after: newlineIndex)
+                    }
+
+                    return false
                 }
+                if let matchedMetadata { return matchedMetadata }
+                if reachedEOF { break }
             }
         } catch is CancellationError {
             throw CancellationError()
@@ -1385,7 +1418,9 @@ enum CostUsageScanner {
             return nil
         }
 
-        if let metadata = parseSessionMetadata(from: buffer) {
+        if !discardingOversizedLine,
+           let metadata = parseSessionMetadata(from: buffer)
+        {
             return metadata
         }
         return nil

Tests/CodexBarTests/CostUsageScannerTests.swift

@@ -3,6 +3,53 @@ import Testing
 @testable import CodexBarCore
 
 struct CostUsageScannerTests {
+    @Test
+    func `codex session metadata skips an oversized line without retaining it`() throws {
+        let env = try CostUsageTestEnvironment()
+        defer { env.cleanup() }
+
+        let fileURL = env.root.appendingPathComponent("oversized-session-meta.jsonl")
+        FileManager.default.createFile(atPath: fileURL.path, contents: nil)
+        let handle = try FileHandle(forWritingTo: fileURL)
+        defer { try? handle.close() }
+
+        let oversizedPrefix = "{\"type\":\"session_meta\",\"payload\":{\"id\":\"too-large\",\"padding\":\""
+        try handle.write(contentsOf: Data(oversizedPrefix.utf8))
+        let chunk = Data(repeating: 0x78, count: 64 * 1024)
+        for _ in 0..<128 {
+            try handle.write(contentsOf: chunk)
+        }
+        let expectedLine = #"{"type":"session_meta","payload":{"id":"expected-session"}}"#
+        try handle.write(contentsOf: Data((#""}}"# + "\n" + expectedLine).utf8))
+        try handle.close()
+
+        let sessionID = try CostUsageScanner.parseCodexSessionIdentifier(fileURL: fileURL)
+        #expect(sessionID == "expected-session")
+    }
+
+    @Test
+    func `codex session metadata accepts a line exactly at the byte limit`() throws {
+        let env = try CostUsageTestEnvironment()
+        defer { env.cleanup() }
+
+        let prefix = "{\"type\":\"session_meta\",\"payload\":{\"id\":\"limit-session\",\"padding\":\""
+        let suffix = "\"}}"
+        let paddingCount = CostUsageScanner.codexSessionMetadataMaxLineBytes
+            - prefix.utf8.count
+            - suffix.utf8.count
+        var line = Data(prefix.utf8)
+        line.append(Data(repeating: 0x78, count: paddingCount))
+        line.append(contentsOf: suffix.utf8)
+        #expect(line.count == CostUsageScanner.codexSessionMetadataMaxLineBytes)
+
+        let fileURL = env.root.appendingPathComponent("max-size-session-meta.jsonl")
+        try line.write(to: fileURL)
+        #expect(try (JSONSerialization.jsonObject(with: line)) is [String: Any])
+
+        let sessionID = try CostUsageScanner.parseCodexSessionIdentifier(fileURL: fileURL)
+        #expect(sessionID == "limit-session")
+    }
+
     @Test
     func `codex file metadata detects append truncation and replacement`() throws {
         let root = FileManager.default.temporaryDirectory