import type { v2 } from "./protocol.js";

import { embeddedAgentLog } from "openclaw/plugin-sdk/agent-harness-runtime";

import type { JsonValue, v2 } from "./protocol.js";

export const CODEX_APP_INVENTORY_CACHE_TTL_MS = 60 * 60 * 1_000;

const MAX_SERIALIZED_ERROR_MESSAGE_LENGTH = 500;

export type CodexAppInventoryRequest = (

method: "app/list",

request: CodexAppInventoryRequest;

nowMs?: number;

forceRefetch?: boolean;

suppressRefresh?: boolean;

};

export class CodexAppInventoryCache {

private readonly ttlMs: number;

private readonly entries = new Map<string, CacheEntry>();

private readonly inFlight = new Map<string, Promise<CodexAppInventorySnapshot>>();

// Per-key refresh generation. Each refresh attempt claims the next token so

// an older request that finishes late cannot overwrite a newer snapshot.

private readonly refreshTokens = new Map<string, number>();

private readonly diagnostics = new Map<string, CodexAppInventoryCacheDiagnostic>();

private revision = 0;

const nowMs = params.nowMs ?? Date.now();

const entry = this.entries.get(params.key);

if (!entry) {

const refreshScheduled = this.scheduleRefresh(params);

const refreshScheduled = params.suppressRefresh ? false : this.scheduleRefresh(params);

return {

state: "missing",

key: params.key,

expiresAtMs: nowMs + this.ttlMs,

revision: this.revision,

};

// Only publish this snapshot if no newer refresh started for the same key

// while this request was in flight.

if (this.refreshTokens.get(params.key) === refreshToken) {

this.entries.set(params.key, { ...snapshot, invalidated: false });

this.diagnostics.delete(params.key);

}

return snapshot;

} catch (error) {

const diagnostic = {

message: error instanceof Error ? error.message : String(error),

message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),

atMs: nowMs,

};

this.diagnostics.set(params.key, diagnostic);

const entry = this.entries.get(params.key);

if (entry) {

entry.lastError = diagnostic;

}

embeddedAgentLog.warn("codex app inventory refresh failed", {

forceRefetch: params.forceRefetch === true,

keyFingerprint: fingerprintInventoryCacheKey(params.key),

error: serializeCodexAppInventoryError(error),

});

throw error;

}

}

}

export function serializeCodexAppInventoryError(error: unknown): Record<string, unknown> {

const record = isRecord(error) ? error : undefined;

const data = record && "data" in record ? redactErrorData(record.data) : undefined;

return {

name:

error instanceof Error

? error.name

: typeof record?.name === "string"

? record.name

: undefined,

message: sanitizeErrorMessage(error instanceof Error ? error.message : String(error)),

...(typeof record?.code === "number" ? { code: record.code } : {}),

...(data !== undefined ? { data } : {}),

};

}

export const defaultCodexAppInventoryCache = new CodexAppInventoryCache();

export function buildCodexAppInventoryCacheKey(input: CodexAppInventoryCacheKeyInput): string {

const { invalidated: _invalidated, ...snapshot } = entry;

return snapshot;

}

function fingerprintInventoryCacheKey(key: string): string {

let hash = 0;

for (let index = 0; index < key.length; index += 1) {

hash = (hash * 31 + key.charCodeAt(index)) >>> 0;

}

return hash.toString(16).padStart(8, "0");

}

function isRecord(value: unknown): value is Record<string, unknown> {

return Boolean(value && typeof value === "object" && !Array.isArray(value));

}

function redactErrorData(value: unknown, depth = 0): JsonValue | undefined {

if (value === undefined) {

return undefined;

}

if (value === null || typeof value === "boolean" || typeof value === "number") {

return value;

}

if (depth > 6) {

return "[truncated]";

}

if (Array.isArray(value)) {

return value.map((entry) => redactErrorData(entry, depth + 1) ?? null);

}

if (isRecord(value)) {

const redacted: Record<string, JsonValue> = {};

for (const [key, entry] of Object.entries(value)) {

redacted[key] = isSensitiveErrorDataKey(key)

? "<redacted>"

: (redactErrorData(entry, depth + 1) ?? null);

}

return redacted;

}

if (typeof value === "string" && value.length > 500) {

return `${value.slice(0, 500)}...`;

}

if (typeof value === "string") {

return value;

}

if (typeof value === "bigint") {

return value.toString();

}

if (typeof value === "symbol") {

return value.description ? `Symbol(${value.description})` : "Symbol()";

}

if (typeof value === "function") {

return value.name ? `[function ${value.name}]` : "[function]";

}

return "[unserializable]";

}

function sanitizeErrorMessage(message: string): string {

const htmlStart = message.search(/<html[\s>]/i);

const withoutHtml =

htmlStart >= 0

? `${message.slice(0, htmlStart).trimEnd()} [HTML response body omitted]`

: message;

const redacted = withoutHtml.replace(

/([?&][^=\s"'<>]*(?:api[_-]?key|authorization|cookie|credential|password|secret|token|tk)[^=\s"'<>]*=)[^&\s"'<>]+/gi,

"$1<redacted>",

);

return redacted.length > MAX_SERIALIZED_ERROR_MESSAGE_LENGTH

? `${redacted.slice(0, MAX_SERIALIZED_ERROR_MESSAGE_LENGTH)}...`

: redacted;

}

function isSensitiveErrorDataKey(key: string): boolean {

return /api[_-]?key|authorization|cookie|credential|password|secret|token/i.test(key);

}