From d35be4e9623615788b4491655dc943a50850c62e Mon Sep 17 00:00:00 2001
From: canvrno-oai <kbond@openai.com>
Date: Thu, 28 May 2026 16:48:32 -0700
Subject: [PATCH] prune expired system proxy cache entries

---
 codex-rs/codex-client/src/outbound_proxy.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/codex-rs/codex-client/src/outbound_proxy.rs b/codex-rs/codex-client/src/outbound_proxy.rs
index 172c578993..b7c8a7a4aa 100644
--- a/codex-rs/codex-client/src/outbound_proxy.rs
+++ b/codex-rs/codex-client/src/outbound_proxy.rs
@@ -347,11 +347,13 @@ fn cache_system_proxy_decision(
 ) {
     let cache = SYSTEM_PROXY_CACHE.get_or_init(|| Mutex::new(HashMap::new()));
     if let Ok(mut cache) = cache.lock() {
+        let now = Instant::now();
+        cache.retain(|_, cached| cached.expires_at > now);
         cache.insert(
             system_proxy_cache_key(request_url, include_auto_detect),
             CachedSystemProxyDecision {
                 decision,
-                expires_at: Instant::now() + SYSTEM_PROXY_CACHE_TTL,
+                expires_at: now + SYSTEM_PROXY_CACHE_TTL,
             },
         );
     }