@bitkyc08/opencodex 2.12.0 → 2.13.0

package/src/server/direct-local-http.ts

@@ -0,0 +1,343 @@
+import net, { type Socket } from "node:net";
+
+const DIRECT_LOCAL_HTTP_MAX_BYTES = 8 * 1024 * 1024;
+const DIRECT_LOCAL_HTTP_TIMEOUT_MS = 10_000;
+
+type DirectLocalHttpIo = {
+  timeoutMs?: number;
+  connect?: (hostname: string, port: number) => Socket;
+};
+
+function abortReason(signal: AbortSignal): Error {
+  if (signal.reason instanceof Error) return signal.reason;
+  const error = new Error("direct local HTTP request aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+function headerBoundary(bytes: Buffer): number {
+  return bytes.indexOf("\r\n\r\n");
+}
+
+function validateTrailerLines(bytes: Buffer, start: number, end: number): void {
+  if (end === start) return;
+  for (const line of bytes.subarray(start, end).toString("latin1").split("\r\n")) {
+    if (line.indexOf(":") <= 0) {
+      throw new Error("direct local HTTP response has an invalid chunk trailer");
+    }
+  }
+}
+
+function decodeChunkedBody(body: Buffer): Buffer {
+  const chunks: Buffer[] = [];
+  let offset = 0;
+  for (;;) {
+    const lineEnd = body.indexOf("\r\n", offset);
+    if (lineEnd < 0) throw new Error("direct local HTTP response has a truncated chunk header");
+    const rawSize = body.subarray(offset, lineEnd).toString("ascii").split(";", 1)[0]?.trim() ?? "";
+    if (!/^[0-9a-f]+$/i.test(rawSize)) throw new Error("direct local HTTP response has an invalid chunk size");
+    const size = Number.parseInt(rawSize, 16);
+    offset = lineEnd + 2;
+    if (size === 0) {
+      if (body.length < offset + 2) throw new Error("direct local HTTP response has a truncated chunk trailer");
+      if (body[offset] !== 13 || body[offset + 1] !== 10) {
+        const trailerEnd = body.indexOf("\r\n\r\n", offset);
+        if (trailerEnd < 0) {
+          throw new Error("direct local HTTP response has a truncated chunk trailer");
+        }
+        validateTrailerLines(body, offset, trailerEnd);
+        if (trailerEnd + 4 !== body.length) {
+          throw new Error("direct local HTTP response has trailing bytes");
+        }
+      } else if (offset + 2 !== body.length) {
+        throw new Error("direct local HTTP response has trailing bytes");
+      }
+      return Buffer.concat(chunks);
+    }
+    if (!Number.isSafeInteger(size) || offset + size + 2 > body.length) {
+      throw new Error("direct local HTTP response has a truncated chunk body");
+    }
+    chunks.push(body.subarray(offset, offset + size));
+    offset += size;
+    if (body[offset] !== 13 || body[offset + 1] !== 10) {
+      throw new Error("direct local HTTP response has an invalid chunk terminator");
+    }
+    offset += 2;
+  }
+}
+
+type ResponseFraming =
+  | { kind: "head"; searchFrom: number }
+  | { kind: "content-length"; totalBytes: number }
+  | { kind: "chunk-size"; offset: number; searchFrom: number }
+  | { kind: "chunk-body"; offset: number; size: number }
+  | { kind: "trailers"; offset: number; searchFrom: number }
+  | { kind: "close" }
+  | { kind: "complete" };
+
+function parseResponseHead(bytes: Buffer, boundary: number): {
+  status: number;
+  statusText: string;
+  headers: Headers;
+} {
+  const lines = bytes.subarray(0, boundary).toString("latin1").split("\r\n");
+  const statusLine = lines.shift() ?? "";
+  const match = /^HTTP\/1\.[01] ([0-9]{3})(?: (.*))?$/.exec(statusLine);
+  if (!match) throw new Error("direct local HTTP response has an invalid status line");
+  const status = Number(match[1]);
+  if (status < 200 || status > 599) throw new Error("direct local HTTP response has an unsupported status");
+  const headers = new Headers();
+  for (const line of lines) {
+    const colon = line.indexOf(":");
+    if (colon <= 0) throw new Error("direct local HTTP response has an invalid header");
+    headers.append(line.slice(0, colon).trim(), line.slice(colon + 1).trim());
+  }
+  return { status, statusText: match[2] ?? "", headers };
+}
+
+function advanceResponseFraming(bytes: Buffer, initial: ResponseFraming): ResponseFraming {
+  let framing = initial;
+  for (;;) {
+    if (framing.kind === "complete" || framing.kind === "close") return framing;
+    if (framing.kind === "head") {
+      const boundary = bytes.indexOf("\r\n\r\n", framing.searchFrom);
+      if (boundary < 0) {
+        if (bytes.length > 64 * 1024) throw new Error("direct local HTTP response headers exceed the byte cap");
+        return { kind: "head", searchFrom: Math.max(0, bytes.length - 3) };
+      }
+      const { status, headers } = parseResponseHead(bytes, boundary);
+      const bodyStart = boundary + 4;
+      if (status === 204 || status === 205 || status === 304) {
+        if (bytes.length > bodyStart) {
+          throw new Error("direct local HTTP response has a body for a bodyless status");
+        }
+        return { kind: "complete" };
+      }
+      if (/\bchunked\b/i.test(headers.get("transfer-encoding") ?? "")) {
+        framing = { kind: "chunk-size", offset: bodyStart, searchFrom: bodyStart };
+        continue;
+      }
+      const rawLength = headers.get("content-length");
+      if (rawLength === null) return { kind: "close" };
+      if (!/^[0-9]+$/.test(rawLength)) throw new Error("direct local HTTP response has an invalid content length");
+      const length = Number(rawLength);
+      const totalBytes = bodyStart + length;
+      if (!Number.isSafeInteger(length) || totalBytes > DIRECT_LOCAL_HTTP_MAX_BYTES) {
+        throw new Error("direct local HTTP response exceeds the byte cap");
+      }
+      framing = { kind: "content-length", totalBytes };
+      continue;
+    }
+    if (framing.kind === "content-length") {
+      if (bytes.length > framing.totalBytes) {
+        throw new Error("direct local HTTP response has trailing bytes");
+      }
+      return bytes.length === framing.totalBytes ? { kind: "complete" } : framing;
+    }
+    if (framing.kind === "chunk-size") {
+      const lineEnd = bytes.indexOf("\r\n", framing.searchFrom);
+      if (lineEnd < 0) {
+        if (bytes.length - framing.offset > 8 * 1024) {
+          throw new Error("direct local HTTP response chunk header exceeds the byte cap");
+        }
+        return {
+          ...framing,
+          searchFrom: Math.max(framing.offset, bytes.length - 1),
+        };
+      }
+      const rawSize = bytes.subarray(framing.offset, lineEnd).toString("ascii").split(";", 1)[0]?.trim() ?? "";
+      if (!/^[0-9a-f]+$/i.test(rawSize)) throw new Error("direct local HTTP response has an invalid chunk size");
+      const size = Number.parseInt(rawSize, 16);
+      if (!Number.isSafeInteger(size) || size > DIRECT_LOCAL_HTTP_MAX_BYTES) {
+        throw new Error("direct local HTTP response chunk exceeds the byte cap");
+      }
+      const offset = lineEnd + 2;
+      framing = size === 0
+        ? { kind: "trailers", offset, searchFrom: offset }
+        : { kind: "chunk-body", offset, size };
+      continue;
+    }
+    if (framing.kind === "chunk-body") {
+      const terminator = framing.offset + framing.size;
+      if (terminator + 2 > bytes.length) return framing;
+      if (bytes[terminator] !== 13 || bytes[terminator + 1] !== 10) {
+        throw new Error("direct local HTTP response has an invalid chunk terminator");
+      }
+      framing = { kind: "chunk-size", offset: terminator + 2, searchFrom: terminator + 2 };
+      continue;
+    }
+    if (bytes.length < framing.offset + 2) return framing;
+    if (bytes[framing.offset] === 13 && bytes[framing.offset + 1] === 10) {
+      if (bytes.length > framing.offset + 2) {
+        throw new Error("direct local HTTP response has trailing bytes");
+      }
+      return { kind: "complete" };
+    }
+    const trailerEnd = bytes.indexOf("\r\n\r\n", framing.searchFrom);
+    if (trailerEnd >= 0) {
+      validateTrailerLines(bytes, framing.offset, trailerEnd);
+      if (bytes.length > trailerEnd + 4) {
+        throw new Error("direct local HTTP response has trailing bytes");
+      }
+      return { kind: "complete" };
+    }
+    if (bytes.length - framing.offset > 64 * 1024) {
+      throw new Error("direct local HTTP response trailers exceed the byte cap");
+    }
+    return { ...framing, searchFrom: Math.max(framing.offset, bytes.length - 3) };
+  }
+}
+
+function parseResponse(bytes: Buffer): Response {
+  const boundary = headerBoundary(bytes);
+  if (boundary < 0) throw new Error("direct local HTTP response has no header boundary");
+  const { status, statusText, headers } = parseResponseHead(bytes, boundary);
+
+  let body = bytes.subarray(boundary + 4);
+  if (/\bchunked\b/i.test(headers.get("transfer-encoding") ?? "")) {
+    body = decodeChunkedBody(body);
+    headers.delete("transfer-encoding");
+    headers.delete("content-length");
+  } else {
+    const rawLength = headers.get("content-length");
+    if (rawLength !== null) {
+      if (!/^[0-9]+$/.test(rawLength)) throw new Error("direct local HTTP response has an invalid content length");
+      const length = Number(rawLength);
+      if (!Number.isSafeInteger(length) || body.byteLength < length) {
+        throw new Error("direct local HTTP response body is truncated");
+      }
+      body = body.subarray(0, length);
+    }
+  }
+
+  const bodyless = status === 204 || status === 205 || status === 304;
+  return new Response(bodyless ? null : new Uint8Array(body), {
+    status,
+    statusText,
+    headers,
+  });
+}
+
+/**
+ * Fetch one local HTTP GET over a direct TCP connection.
+ *
+ * Bun's global fetch and Bun 1.3's node:http compatibility layer can honor
+ * HTTP(S)_PROXY. Local identity and capability probes must not expose headers
+ * to, or accept a fabricated response from, such a proxy. node:net connects to
+ * the selected listener without consulting proxy environment variables. Each
+ * caller retains an injected fetch seam for deterministic unit tests.
+ */
+export async function directLocalHttpFetch(
+  input: string | URL | Request,
+  init: RequestInit = {},
+  io: DirectLocalHttpIo = {},
+): Promise<Response> {
+  const url = new URL(input instanceof Request ? input.url : String(input));
+  const method = (init.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+  const signal = init.signal ?? (input instanceof Request ? input.signal : undefined);
+  const body = init.body ?? (input instanceof Request ? input.body : null);
+
+  if (url.protocol !== "http:") throw new Error("direct local request must use HTTP");
+  if (url.username || url.password) throw new Error("direct local request URL must not contain credentials");
+  if (method !== "GET" || body !== null) throw new Error("direct local request must be a bodyless GET");
+  if (signal?.aborted) throw abortReason(signal);
+
+  const headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : undefined));
+  headers.delete("proxy-authorization");
+  headers.delete("proxy-connection");
+  headers.set("host", url.host);
+  headers.set("connection", "close");
+  const headerLines: string[] = [];
+  headers.forEach((value, key) => { headerLines.push(`${key}: ${value}`); });
+  const requestBytes = Buffer.from(
+    `GET ${url.pathname}${url.search} HTTP/1.1\r\n${headerLines.join("\r\n")}\r\n\r\n`,
+    "latin1",
+  );
+  const parsedHostname = url.hostname.startsWith("[") && url.hostname.endsWith("]")
+    ? url.hostname.slice(1, -1)
+    : url.hostname;
+  const hostname = parsedHostname;
+  const port = url.port ? Number(url.port) : 80;
+  const timeoutMs = io.timeoutMs ?? DIRECT_LOCAL_HTTP_TIMEOUT_MS;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new Error("direct local HTTP timeout must be positive");
+  }
+
+  return await new Promise<Response>((resolve, reject) => {
+    let socket: Socket | undefined;
+    let settled = false;
+    let receivedBytes = 0;
+    let responseBytes = Buffer.allocUnsafe(4 * 1024);
+    let framing: ResponseFraming = { kind: "head", searchFrom: 0 };
+    const cleanup = () => {
+      signal?.removeEventListener("abort", onAbort);
+      socket?.setTimeout(0);
+    };
+    const finish = (error?: Error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      try { socket?.destroy(); } catch { /* ignore */ }
+      if (error) {
+        reject(error);
+        return;
+      }
+      try {
+        resolve(parseResponse(responseBytes.subarray(0, receivedBytes)));
+      } catch (parseError) {
+        reject(parseError instanceof Error ? parseError : new Error(String(parseError)));
+      }
+    };
+    const onAbort = () => {
+      const error = signal ? abortReason(signal) : new Error("direct local HTTP request aborted");
+      finish(error);
+    };
+
+    socket = (io.connect ?? ((host, selectedPort) => net.createConnection({
+      host,
+      port: selectedPort,
+      autoSelectFamily: true,
+    })))(hostname, port);
+    socket.setTimeout(timeoutMs, () => {
+      const error = new Error("direct local HTTP request timed out");
+      error.name = "TimeoutError";
+      finish(error);
+    });
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) {
+      onAbort();
+      return;
+    }
+    socket.on("connect", () => {
+      try { socket?.write(requestBytes); } catch (error) {
+        finish(error instanceof Error ? error : new Error(String(error)));
+      }
+    });
+    socket.on("data", chunk => {
+      if (settled) return;
+      const bytes = Buffer.from(chunk);
+      receivedBytes += bytes.byteLength;
+      if (receivedBytes > DIRECT_LOCAL_HTTP_MAX_BYTES) {
+        finish(new Error("direct local HTTP response exceeds the byte cap"));
+        return;
+      }
+      if (receivedBytes > responseBytes.byteLength) {
+        let capacity = responseBytes.byteLength;
+        while (capacity < receivedBytes) capacity = Math.min(DIRECT_LOCAL_HTTP_MAX_BYTES, capacity * 2);
+        const grown = Buffer.allocUnsafe(capacity);
+        responseBytes.copy(grown);
+        responseBytes = grown;
+      }
+      bytes.copy(responseBytes, receivedBytes - bytes.byteLength);
+      try {
+        framing = advanceResponseFraming(responseBytes.subarray(0, receivedBytes), framing);
+        if (framing.kind === "complete") finish();
+      } catch (error) {
+        finish(error instanceof Error ? error : new Error(String(error)));
+      }
+    });
+    socket.once("end", () => finish());
+    socket.once("error", error => finish(error));
+    socket.once("close", () => finish());
+  });
+}

package/src/server/index.ts

@@ -16,6 +16,7 @@ import {
   armClaudeCodeBaseline,
   loadConfig,
   saveConfig,
+  getConfigDir,
   websocketsEnabled,
 } from "../config";
 import { reconcileOAuthProviders } from "../oauth";
@@ -23,7 +24,10 @@ import { withCatalogWriteSerialization } from "../codex/catalog-write-serializat
 import { invalidateCodexModelsCacheWithPermit } from "../codex/catalog/sync";
 import { getCodexHome } from "../codex/paths";
 import { shouldSyncCodexOnStart } from "../codex/desired-state";
-import { inspectNativeCodexOwnership } from "../integrations/native/ownership-preflight";
+import {
+  inspectNativeCodexOwnership,
+  type OwnershipInspection,
+} from "../integrations/native/ownership-preflight";
 import { registerCodexCooldownRecoveryProbeWorker } from "../codex/auth-api";
 import {
   reconcileLiveStateStores,
@@ -41,9 +45,16 @@ import {
   registerDefaultAppOwnedObservedBuffers,
 } from "../lib/app-owned-memory-stores";
 import { acquireServerBackgroundLifecycle } from "./background-lifecycle";
+import {
+  setLabAutomationDispatchDeps,
+  startLabAutomationScheduler,
+} from "../lab/automation/orchestrator";
+import { loadLabAutomationPolicy } from "../lab/automation/persistence";
+import { createProductionLabRouteExecutor } from "../lib/lab-live-route-production";
 import { runOpenAiTierStartupMigration } from "../providers/openai-tier-startup";
 import { runAlibabaRegionStartupMigration } from "../providers/alibaba-region-startup";
-import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
+import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
+import { providerContextCap } from "../providers/context-cap";
 import { providerCodexAccountMode } from "../providers/registry";
 import type { StorageCleanupPolicy } from "../types";
 import {
@@ -89,7 +100,6 @@ import {
   addFinalRequestLog,
   hydrateRequestLogsFromDisk,
   httpStatusForRequestLogTerminal,
-  httpStatusForTerminalStatus,
   inspectResponseLogSsePayload,
   nextRequestLogId,
   recordFirstOutput,
@@ -161,6 +171,7 @@ import { buildDesktop3pRegistry } from "../claude/desktop-3p";
 import { runClaudeAuthModeMigration } from "../claude/auth-mode-migration";
 import {
   bindNativeMainStartupLifecycle,
+  blockNativeMainStartupForUnownedServiceHome,
   releaseNativeMainStartupLifecycle,
   startNativeMainStartupLifecycle,
   type NativeMainStartupGateDeps,
@@ -425,6 +436,8 @@ export interface StartServerDeps {
   managementApi?: ManagementApiDeps;
   /** Test-only native-main recovery dependencies; production constructs the normal manager. */
   nativeMainStartup?: NativeMainStartupGateDeps;
+  /** Test-only ownership evidence; production inspects the installed service state. */
+  inspectNativeCodexOwnership?: typeof inspectNativeCodexOwnership;
   /** Test-only seam for an upstream that cannot complete its WebSocket close handshake. */
   liveSidebandWebSocketFactory?: LiveSidebandWebSocketFactory;
   /** Test-only seam; production derives a fresh local-attestation secret per process. */
@@ -433,6 +446,17 @@ export interface StartServerDeps {
   readinessGate?: ReadinessGate;
 }
 
+function inspectStartupOwnership(deps: StartServerDeps): OwnershipInspection {
+  try {
+    return (deps.inspectNativeCodexOwnership ?? inspectNativeCodexOwnership)();
+  } catch {
+    return {
+      ownership: "unknown",
+      reason: "service-home ownership inspection failed",
+    };
+  }
+}
+
 /*
  * #1046. `startServer` rewrites the Codex models cache during boot, and an
  * app-server that started earlier keeps its own in-memory model list. The stale
@@ -497,21 +521,28 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       if (migrated) saveConfig(config);
     }
   }
+  // Resolve unattended service-home authority before any Codex lock, cache, owner,
+  // journal, or credential path. Both positive foreign evidence and an unprovable
+  // ownership state are non-authority.
+  startupCacheInvalidationWrote = false;
+  const startupCacheOwnership = inspectStartupOwnership(deps);
   // Startup cache invalidation is best-effort and must never block the server from
   // serving. It now takes K so it cannot race a convergence commit, but both the
   // home resolution and the acquisition can fail on a machine with no Codex home —
   // `getCodexHome()` THROWS when CODEX_HOME names a missing directory, which would
   // otherwise turn "no Codex installed" into "proxy will not start".
-  try {
-    const startupCodexHome = getCodexHome();
-    // #1046: record whether this actually rewrote the cache. `handleStart` ORs this
-    // with the later startup sync and warns ONCE about stale app-servers; warning
-    // here instead would read a catalog mtime the sync is about to move.
-    const outcome = withCatalogWriteSerialization(startupCodexHome, permit =>
-      invalidateCodexModelsCacheWithPermit(permit, startupCodexHome));
-    // A refused permit is not a write; only a completed run that returned true is.
-    startupCacheInvalidationWrote = outcome.kind === "completed" && outcome.value === true;
-  } catch { /* no readable Codex home: nothing to invalidate */ }
+  if (startupCacheOwnership.ownership === "owned") {
+    try {
+      const startupCodexHome = getCodexHome();
+      // #1046: record whether this actually rewrote the cache. `handleStart` ORs this
+      // with the later startup sync and warns ONCE about stale app-servers; warning
+      // here instead would read a catalog mtime the sync is about to move.
+      const outcome = withCatalogWriteSerialization(startupCodexHome, permit =>
+        invalidateCodexModelsCacheWithPermit(permit, startupCodexHome));
+      // A refused permit is not a write; only a completed run that returned true is.
+      startupCacheInvalidationWrote = outcome.kind === "completed" && outcome.value === true;
+    } catch { /* no readable Codex home: nothing to invalidate */ }
+  }
   // Arm the `claudeCode` hand-edit guard (devlog 260726_claude_auth_auto/040 H1) BEFORE
   // the server can serve a request, and AFTER the startup migrations above — those run
   // against a config nobody else holds and are the documented exception to the save
@@ -650,10 +681,15 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   // CODEX_HOME. When the user has disabled the Codex integration, starting the
   // proxy must not manufacture those Codex artifacts merely to serve other
   // clients; no Codex request can use this lifecycle in that state.
-  const nativeOwnership = inspectNativeCodexOwnership();
+  // Re-probe here instead of trusting the earlier cache decision: startup work
+  // between the two sites must not widen the service-install race.
+  const nativeOwnership = inspectStartupOwnership(deps);
   const nativeMainLifecycle: NativeMainStartupLifecycle = shouldSyncCodexOnStart(config)
-    && nativeOwnership.ownership !== "foreign"
-    ? startNativeMainStartupLifecycle(deps.nativeMainStartup)
+    ? nativeOwnership.ownership === "owned"
+      ? startNativeMainStartupLifecycle(deps.nativeMainStartup)
+      : blockNativeMainStartupForUnownedServiceHome(
+        nativeOwnership.ownership === "foreign" ? "foreign-ownership" : "ownership-unknown",
+      )
     : {
       homeId: null,
       settled: Promise.resolve({ status: "ready", homeId: null }),
@@ -911,7 +947,19 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
           const catalogNativeSlugs = accountSelectors.length > 0
             ? NATIVE_OPENAI_MODELS
             : nativeSlugs;
-          const entries = buildCatalogEntries(loadCatalogTemplate(), catalogNativeSlugs, goOrdered, config.subagentModels, websocketsEnabled(config), maMode as "v1" | "default" | "v2", exactComboCatalogSlugs(config), accountSelectors, suppressedBareNativeSlugs);
+          const entries = buildCatalogEntries(
+            loadCatalogTemplate(),
+            catalogNativeSlugs,
+            goOrdered,
+            config.subagentModels,
+            websocketsEnabled(config),
+            maMode as "v1" | "default" | "v2",
+            exactComboCatalogSlugs(config),
+            accountSelectors,
+            suppressedBareNativeSlugs,
+            new Set(),
+            providerContextCap(config, OPENAI_CODEX_PROVIDER_ID),
+          );
           return jsonResponse({
             models: applyNativeVisibility(
               entries,
@@ -1136,7 +1184,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
             abortSignal: req.signal,
             onFirstOutput: () => recordFirstOutput(logCtx, start),
             onNativePassthroughTerminal: status => {
-              finalizeNativePassthroughLog(httpStatusForTerminalStatus(status), {
+              finalizeNativePassthroughLog(httpStatusForRequestLogTerminal(status, logCtx), {
                 terminalStatus: status,
                 closeReason: "terminal",
               });
@@ -1646,5 +1694,19 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   // Opt-in storage policy (default OFF). Never blocks listen; cancellable on shutdown.
   backgroundLifecycle.scheduleStartupRun();
 
+  const labConfigDir = getConfigDir();
+  const productionLabRouteExecutor = createProductionLabRouteExecutor({
+    configDir: labConfigDir,
+    loadConfig: () => config,
+  });
+  setLabAutomationDispatchDeps({
+    configDir: labConfigDir,
+    loadConfig: () => config,
+    routeExecutor: productionLabRouteExecutor,
+  });
+  if (loadLabAutomationPolicy(labConfigDir).enabled) {
+    startLabAutomationScheduler(labConfigDir);
+  }
+
   return server;
 }

package/src/server/lifecycle.ts

@@ -1,3 +1,4 @@
+import { flushAntigravityReplay } from "../adapters/google-antigravity-replay";
 import { flushResponseState } from "../responses/state";
 import { setStorageCleanupPolicyLiveSink } from "../storage/policy";
 import {
@@ -6,6 +7,7 @@ import {
 } from "../storage/policy-job";
 import { abortRestoreTrashJobAsync } from "../storage/restore-job";
 import { stopStorageCleanupScheduler } from "../storage/policy-scheduler";
+import { stopLabAutomationScheduler, requestLabAutomationShutdown } from "../lab/automation/orchestrator";
 import { stopStateStoreSweeper } from "../lib/state-store-sweeper";
 import {
   cancelQueuedStorageWorkerSpawns,
@@ -433,12 +435,16 @@ export async function drainAndShutdown(
       console.warn("[cursor] background shell drain incomplete", shellResult.value);
     }
 
-    // Debounced replay-state snapshot may still be pending; flush so the last completed turn's
-    // previous_response_id chain survives the restart this shutdown is usually part of.
-    const responseStateFlush = await Promise.allSettled([flushResponseState()]);
-    if (responseStateFlush[0]?.status === "rejected") {
+    // Debounced replay-state snapshots may still be pending; flush so the last completed turn's
+    // previous_response_id chain and antigravity thought signatures survive the restart this
+    // shutdown is usually part of.
+    const stateFlush = await Promise.allSettled([flushResponseState(), flushAntigravityReplay()]);
+    if (stateFlush[0]?.status === "rejected") {
       console.warn("[responses] state flush during shutdown failed");
     }
+    if (stateFlush[1]?.status === "rejected") {
+      console.warn("[antigravity] replay flush during shutdown failed");
+    }
 
     // Tear down opt-in storage policy timers / worker / live-config sink so they cannot fire after stop.
     // Await worker thread exit: on Windows, a still-exiting Bun Worker under
@@ -446,6 +452,8 @@ export async function drainAndShutdown(
     // Abort each job independently so one wedged join cannot skip the other,
     // then drain leftovers; failures must not prevent `server.stop`.
     stopStorageCleanupScheduler();
+    requestLabAutomationShutdown();
+    stopLabAutomationScheduler();
     stopStateStoreSweeper();
     // The overlay reconciler is owner-scoped: the startServer stop override
     // releases THIS server's lease through runListenerShutdown →

package/src/server/local-management-read-client.ts

@@ -0,0 +1,90 @@
+import { readRuntimePort, type RuntimePortState } from "../config";
+import { createLocalAttestationChallenge } from "../lib/local-management-attestation";
+import {
+  LOCAL_MANAGEMENT_CAPABILITY_HEADER,
+  LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER,
+  LOCAL_MANAGEMENT_CAPABILITY_TTL_MS,
+  LOCAL_MANAGEMENT_EXPECTED_PID_HEADER,
+  LOCAL_MANAGEMENT_NONCE_HEADER,
+  createLocalManagementReadCapability,
+  type LocalManagementReadPath,
+} from "../lib/local-management-capability";
+import { directLocalHttpFetch } from "./direct-local-http";
+import { probeHostname, type LiveProxy } from "./proxy-liveness";
+
+export type LocalManagementReadResult =
+  | { kind: "response"; response: Response; targetPid: number }
+  | { kind: "unavailable"; reason: "unattested-target" | "runtime-mismatch" | "capability-unavailable" | "transport" };
+
+export interface LocalManagementReadDeps {
+  fetchImpl?: typeof fetch;
+  readRuntime?: (pid: number) => RuntimePortState | null;
+  createNonce?: () => string;
+  now?: () => number;
+}
+
+export interface LocalManagementReadRequestDeps extends LocalManagementReadDeps {
+  timeoutMs?: number;
+}
+
+/**
+ * Read one exact local management endpoint without sending a reusable admin credential.
+ *
+ * The runtime record is the protected source of the per-process key. The server proves
+ * it owns that key by accepting a single-use capability bound to this GET, path, PID,
+ * port, and short expiry.
+ */
+export async function fetchBoundLocalManagementRead(
+  target: LiveProxy,
+  path: LocalManagementReadPath,
+  deps: LocalManagementReadRequestDeps = {},
+): Promise<LocalManagementReadResult> {
+  if (
+    target.source !== "runtime"
+    || target.pid === null
+    || !Number.isSafeInteger(target.pid)
+    || target.pid <= 0
+  ) {
+    return { kind: "unavailable", reason: "unattested-target" };
+  }
+  const readRuntime = deps.readRuntime ?? readRuntimePort;
+  const runtime = readRuntime(target.pid);
+  if (
+    !runtime?.attestationSecret
+    || runtime.pid !== target.pid
+    || runtime.port !== target.port
+  ) {
+    return { kind: "unavailable", reason: "runtime-mismatch" };
+  }
+
+  const nonce = (deps.createNonce ?? createLocalAttestationChallenge)();
+  const expiresAt = (deps.now ?? Date.now)() + LOCAL_MANAGEMENT_CAPABILITY_TTL_MS;
+  const capability = createLocalManagementReadCapability(
+    runtime.attestationSecret,
+    nonce,
+    "GET",
+    path,
+    target.pid,
+    target.port,
+    expiresAt,
+  );
+  if (!capability) return { kind: "unavailable", reason: "capability-unavailable" };
+
+  try {
+    const response = await (deps.fetchImpl ?? directLocalHttpFetch)(
+      `http://${probeHostname(target.hostname)}:${target.port}${path}`,
+      {
+        headers: {
+          [LOCAL_MANAGEMENT_EXPECTED_PID_HEADER]: String(target.pid),
+          [LOCAL_MANAGEMENT_NONCE_HEADER]: nonce,
+          [LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER]: String(expiresAt),
+          [LOCAL_MANAGEMENT_CAPABILITY_HEADER]: capability,
+        },
+        signal: AbortSignal.timeout(deps.timeoutMs ?? 4_000),
+      },
+    );
+    return { kind: "response", response, targetPid: target.pid };
+  } catch {
+    return { kind: "unavailable", reason: "transport" };
+  }
+}