@bitkyc08/opencodex 2.5.6 → 2.6.0

package/src/server.ts

@@ -1,6 +1,6 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { timingSafeEqual } from "node:crypto";
-import { extname, join } from "node:path";
+import { extname, isAbsolute, join, relative, resolve } from "node:path";
 import { createAnthropicAdapter } from "./adapters/anthropic";
 import { createAzureAdapter } from "./adapters/azure";
 import { createGoogleAdapter } from "./adapters/google";
@@ -10,32 +10,57 @@ import { bridgeToResponsesSSE, buildResponseJSON, formatErrorResponse, type Resp
 import {
   buildWarmupCompletionFrames,
   buildWsErrorFrame,
-  selectForwardHeadersForAuthContext,
+  selectForwardHeaders,
   sendJsonFrame,
   sendResponseToWebSocket,
   sendTextFrame,
   type WsData,
 } from "./ws-bridge";
-import type { ServerWebSocket } from "bun";
-import { DEFAULT_SUBAGENT_MODELS, codexAutoStartEnabled, loadConfig, saveConfig, websocketsEnabled } from "./config";
+import type { Server, ServerWebSocket } from "bun";
+import {
+  DEFAULT_SUBAGENT_MODELS,
+  codexAutoStartEnabled,
+  getConfigPath,
+  hasOwnProvider,
+  isValidProviderName,
+  loadConfig,
+  saveConfig,
+  websocketsEnabled,
+} from "./config";
 import { parseRequest } from "./responses/parser";
 import { routeModel } from "./router";
 import { namespacedToolName } from "./types";
 import {
   clearLoginState, getLoginStatus, getValidAccessToken, isOAuthProvider,
-  listOAuthProviders, reconcileOAuthProviders, startLoginFlow, upsertOAuthProvider,
+  listOAuthProviders, reconcileOAuthProviders, startLoginFlow, UnsupportedOAuthProviderError, upsertOAuthProvider,
 } from "./oauth/index";
 import type { CatalogModel } from "./codex-catalog";
-import { invalidateCodexModelsCache } from "./codex-catalog";
+import { invalidateCodexModelsCache, readCodexCatalogPath } from "./codex-catalog";
+import { CODEX_CONFIG_PATH, readRootTomlString } from "./codex-paths";
 import { buildWebSearchTool, planWebSearch, runWithWebSearch } from "./web-search";
 import { describeImagesInPlace, planVisionSidecar } from "./vision";
 import { removeCredential } from "./oauth/store";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "./oauth/key-providers";
 import { deriveProviderPresets } from "./providers/derive";
-import type { OcxConfig, OcxProviderConfig } from "./types";
+import type { AdapterEvent, OcxConfig, OcxProviderConfig } from "./types";
+import type { OcxUsage } from "./types";
+import {
+  appendUsageEntry,
+  readUsageEntries,
+  usageStatusForFinalLog,
+  usageTotalTokens,
+  type UsageStatus,
+} from "./usage-log";
+import { parseRange, summarizeUsage } from "./usage-summary";
+import {
+  appendUsageDebug,
+  isUsageDebugEnabled,
+  truncateForDebug,
+  USAGE_DEBUG_BODY_SAMPLE_BYTES,
+  type UsageDebugBodyKind,
+} from "./usage-debug";
 import {
   applyCodexAuthContextToProvider,
-  assertCodexAuthContextNotCooled,
   CodexAccountCooldownError,
   CodexAuthContextError,
   CodexThreadAffinityExpiredError,
@@ -55,7 +80,7 @@ import {
   recordCodexUpstreamOutcome,
   type CodexUpstreamOutcome,
 } from "./codex-routing";
-import { registerCodexWebSocket, unregisterCodexWebSocket } from "./codex-websocket-registry";
+import { registerCodexWebSocket, unregisterCodexWebSocket, updateCodexWebSocketAuthContext } from "./codex-websocket-registry";
 
 // ---------------------------------------------------------------------------
 // Active turn tracking + graceful shutdown drain
@@ -63,6 +88,26 @@ import { registerCodexWebSocket, unregisterCodexWebSocket } from "./codex-websoc
 
 const activeTurns = new Set<AbortController>();
 let draining = false;
+const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
+const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 0;
+const nativePassthroughSseResponses = new WeakSet<Response>();
+
+export interface RequestLogContext {
+  model: string;
+  provider: string;
+  requestedModel?: string;
+  requestedServiceTier?: string;
+  requestedSpeedLabel?: string;
+  configuredServiceTier?: string;
+  configuredSpeedLabel?: string;
+  modelSupportsServiceTier?: boolean;
+  responseServiceTier?: string;
+  resolvedModel?: string;
+  usage?: OcxUsage;
+  usageDebugBodyKind?: UsageDebugBodyKind;
+  usageDebugBodySample?: string;
+  usageDebugContentType?: string;
+}
 
 export function registerTurn(ac: AbortController): void { activeTurns.add(ac); }
 export function unregisterTurn(ac: AbortController): void { activeTurns.delete(ac); }
@@ -72,22 +117,30 @@ export function getActiveTurnCount(): number { return activeTurns.size; }
 export function trackStreamLifetime(
   body: ReadableStream<Uint8Array>,
   ac: AbortController,
+  onDone?: () => void,
 ): ReadableStream<Uint8Array> {
   registerTurn(ac);
   const reader = body.getReader();
+  let closed = false;
+  const finish = () => {
+    if (closed) return;
+    closed = true;
+    unregisterTurn(ac);
+    onDone?.();
+  };
   return new ReadableStream<Uint8Array>({
     async pull(controller) {
       try {
         const { done, value } = await reader.read();
-        if (done) { unregisterTurn(ac); controller.close(); return; }
+        if (done) { finish(); controller.close(); return; }
         controller.enqueue(value);
       } catch (err) {
-        unregisterTurn(ac);
+        finish();
         try { controller.error(err); } catch { /* already closed */ }
       }
     },
     cancel(reason) {
-      unregisterTurn(ac);
+      finish();
       ac.abort(reason);
       reader.cancel(reason).catch(() => {});
     },
@@ -144,17 +197,43 @@ function findGuiDist(): string | null {
   return null;
 }
 
+export function resolveGuiFilePath(guiDist: string, pathname: string): string | null {
+  let decodedPath: string;
+  try {
+    decodedPath = decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
+  if (decodedPath.includes("\0")) return null;
+
+  const relativePath = decodedPath === "/" || decodedPath === ""
+    ? "index.html"
+    : decodedPath.replace(/\\/g, "/").replace(/^\/+/, "");
+  const root = resolve(guiDist);
+  const filePath = resolve(root, relativePath);
+  const rel = relative(root, filePath);
+  if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) return null;
+  return filePath;
+}
+
+function isFile(path: string): boolean {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+
 function serveGuiFile(pathname: string): Response | null {
   const guiDist = findGuiDist();
   if (!guiDist) return null;
-  const filePath = pathname === "/" || pathname === ""
-    ? join(guiDist, "index.html")
-    : join(guiDist, pathname);
+  const filePath = resolveGuiFilePath(guiDist, pathname);
+  if (!filePath) return null;
 
-  if (!existsSync(filePath)) {
+  if (!isFile(filePath)) {
     if (!extname(pathname)) {
       const indexPath = join(guiDist, "index.html");
-      if (existsSync(indexPath)) {
+      if (isFile(indexPath)) {
         return new Response(Bun.file(indexPath), {
           headers: { "Content-Type": "text/html" },
         });
@@ -243,7 +322,7 @@ function codexForwardTerminalOutcomeRecorder(
 async function handleResponses(
   req: Request,
   config: OcxConfig,
-  logCtx: { model: string; provider: string },
+  logCtx: RequestLogContext,
   options: {
     forceEmptyResponseId?: boolean;
     abortSignal?: AbortSignal;
@@ -251,6 +330,8 @@ async function handleResponses(
     selectedForwardHeaders?: Headers;
     recordTerminalOutcomes?: boolean;
     setTerminalOutcomeRecorder?: (recorder: ((status: ResponsesTerminalStatus) => void) | undefined) => void;
+    onNativePassthroughTerminal?: (status: ResponsesTerminalStatus) => void;
+    onNativePassthroughCancel?: () => void;
   } = {},
 ): Promise<Response> {
   let body: unknown;
@@ -266,6 +347,11 @@ async function handleResponses(
   } catch (err) {
     return formatErrorResponse(400, "invalid_request_error", err instanceof Error ? err.message : String(err));
   }
+  logCtx.requestedModel = parsed.modelId;
+  logCtx.requestedServiceTier = parsed.options.serviceTier;
+  logCtx.requestedSpeedLabel = requestLogSpeedLabel(parsed.options.serviceTier);
+  logCtx.configuredServiceTier = readConfiguredCodexServiceTier();
+  logCtx.configuredSpeedLabel = requestLogSpeedLabel(logCtx.configuredServiceTier);
 
   let route;
   try {
@@ -285,6 +371,10 @@ async function handleResponses(
   }
   logCtx.model = route.modelId;
   logCtx.provider = route.providerName;
+  logCtx.modelSupportsServiceTier = catalogModelSupportsServiceTier(
+    route.modelId,
+    logCtx.requestedServiceTier ?? logCtx.configuredServiceTier,
+  );
 
   let authCtx: CodexAuthContext;
   let selectedForwardHeaders: Headers;
@@ -317,6 +407,13 @@ async function handleResponses(
     try {
       route.provider = { ...route.provider, apiKey: await getValidAccessToken(route.providerName) };
     } catch (err) {
+      if (err instanceof UnsupportedOAuthProviderError) {
+        return formatErrorResponse(
+          400,
+          "invalid_request_error",
+          `${err.message}. Remove or reconfigure provider '${route.providerName}' in ${getConfigPath()}.`,
+        );
+      }
       return formatErrorResponse(401, "authentication_error", err instanceof Error ? err.message : String(err));
     }
   }
@@ -359,7 +456,17 @@ async function handleResponses(
       return formatErrorResponse(502, "upstream_error", msg);
     }
     const headers = sanitizePassthroughHeaders(upstreamResponse.headers);
-    const isEventStream = headers.get("content-type")?.toLowerCase().includes("text/event-stream") ?? false;
+    const resolvedModel = headers.get("openai-model")?.trim();
+    if (resolvedModel) logCtx.resolvedModel = resolvedModel;
+    if (isUsageDebugEnabled()) {
+      const upstreamContentType = upstreamResponse.headers.get("content-type");
+      if (upstreamContentType) logCtx.usageDebugContentType = upstreamContentType;
+    }
+    // The chatgpt backend may omit Content-Type on SSE responses. Fall back to
+    // treating a successful body as SSE when the caller requested streaming.
+    const passthroughCt = headers.get("content-type")?.toLowerCase();
+    const isEventStream = passthroughCt?.includes("text/event-stream")
+      || (upstreamResponse.ok && !!upstreamResponse.body && !passthroughCt && parsed.stream);
     const terminalRecorder = codexForwardTerminalOutcomeRecorder(config, authCtx, route.provider);
     const terminalBodyWillRecord = !!terminalRecorder && upstreamResponse.ok && isEventStream;
     // Capture quota from upstream response for multi-account tracking
@@ -384,7 +491,10 @@ async function handleResponses(
         );
       }
       if (terminalBodyWillRecord) {
-        options.setTerminalOutcomeRecorder?.(terminalRecorder);
+        options.setTerminalOutcomeRecorder?.(status => {
+          terminalRecorder(status);
+          options.onNativePassthroughTerminal?.(status);
+        });
       } else {
         recordCodexUpstreamOutcome(config, authCtx.accountId, upstreamResponse.status, {
           retryAfter: retryAfterRaw,
@@ -400,14 +510,34 @@ async function handleResponses(
     if (isEventStream && upstreamResponse.body) {
       const [nativeBody, inspectBody] = upstreamResponse.body.tee();
       const turnAc = new AbortController();
-      const trackedNative = trackStreamLifetime(nativeBody, turnAc);
-      if (terminalBodyWillRecord && recordTerminalOutcomes && terminalRecorder) {
-        consumeForInspection(inspectBody, terminalRecorder);
+      linkAbortSignal(upstream, turnAc.signal);
+      registerTurn(turnAc);
+      if (terminalBodyWillRecord && recordTerminalOutcomes) {
+        const recordTerminal = terminalRecorder;
+        const reportNativeTerminal = (status: ResponsesTerminalStatus) => {
+          if (options.abortSignal?.aborted) {
+            options.onNativePassthroughCancel?.();
+            return;
+          }
+          recordTerminal(status);
+          options.onNativePassthroughTerminal?.(status);
+        };
+        consumeForInspection(inspectBody, reportNativeTerminal, turnAc.signal, () => unregisterTurn(turnAc), logCtx);
       } else {
-        inspectBody.cancel().catch(() => {});
+        consumeForResponseLogMetadata(inspectBody, logCtx, turnAc.signal, () => unregisterTurn(turnAc));
       }
-      return new Response(trackedNative, {
+      if (!headers.has("content-type")) headers.set("content-type", "text/event-stream");
+      return markNativePassthroughSseResponse(new Response(nativeBody, {
+        status: upstreamResponse.status,
+        headers,
+      }));
+    }
+    if (headers.get("content-type")?.toLowerCase().includes("application/json")) {
+      const text = await upstreamResponse.text();
+      inspectResponseLogJson(logCtx, text);
+      return new Response(text, {
         status: upstreamResponse.status,
+        statusText: upstreamResponse.statusText,
         headers,
       });
     }
@@ -440,7 +570,7 @@ async function handleResponses(
   }
 
   const upstream = new AbortController();
-  linkAbortSignal(upstream, options.abortSignal);
+  const cleanupUpstreamAbort = linkAbortSignal(upstream, options.abortSignal);
   const connectMs = config.connectTimeoutMs ?? 30_000;
 
   const request = adapter.buildRequest(parsed, { headers: selectedForwardHeaders });
@@ -450,6 +580,7 @@ async function handleResponses(
       method: request.method, headers: request.headers, body: request.body,
     }, upstream.signal, connectMs);
   } catch (err) {
+    cleanupUpstreamAbort();
     upstream.abort();
     const msg = err instanceof Error && err.name === "TimeoutError"
       ? `Provider connect timeout after ${connectMs}ms`
@@ -459,6 +590,7 @@ async function handleResponses(
 
   if (!upstreamResponse.ok) {
     const errorText = await upstreamResponse.text().catch(() => "unknown error");
+    cleanupUpstreamAbort();
     return formatErrorResponse(upstreamResponse.status, "upstream_error", `Provider error ${upstreamResponse.status}: ${errorText.slice(0, 500)}`);
   }
 
@@ -482,14 +614,19 @@ async function handleResponses(
       },
     );
     const bridgeTurnAc = new AbortController();
-    const trackedSse = trackStreamLifetime(sseStream, bridgeTurnAc);
+    const trackedSse = trackStreamLifetime(sseStream, bridgeTurnAc, cleanupUpstreamAbort);
     return new Response(trackedSse, {
       headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", "Connection": "keep-alive", "X-Accel-Buffering": "no" },
     });
   }
 
   if (adapter.parseResponse) {
-    const events = await adapter.parseResponse(upstreamResponse);
+    let events: AdapterEvent[];
+    try {
+      events = await adapter.parseResponse(upstreamResponse);
+    } finally {
+      cleanupUpstreamAbort();
+    }
     const toolNsMap = new Map<string, { namespace: string; name: string }>();
     const freeformToolNames = new Set<string>();
     const toolSearchToolNames = new Set<string>();
@@ -510,13 +647,25 @@ async function handleResponses(
   return formatErrorResponse(500, "internal_error", "Non-streaming not supported by this adapter");
 }
 
-export function linkAbortSignal(upstream: AbortController, signal?: AbortSignal): void {
-  if (!signal) return;
+export function linkAbortSignal(upstream: AbortController, signal?: AbortSignal): () => void {
+  if (!signal) return () => {};
   if (signal.aborted) {
     upstream.abort(signal.reason);
-    return;
+    return () => {};
+  }
+  const onAbort = () => upstream.abort(signal.reason);
+  signal.addEventListener("abort", onAbort, { once: true });
+  return () => signal.removeEventListener("abort", onAbort);
+}
+
+export function disableResponsesRequestTimeout(req: Request, server: Pick<Server<WsData>, "timeout"> | undefined): boolean {
+  if (!server) return false;
+  try {
+    server.timeout(req, 0);
+    return true;
+  } catch {
+    return false;
   }
-  signal.addEventListener("abort", () => upstream.abort(signal.reason), { once: true });
 }
 
 async function fetchWithHeaderTimeout(
@@ -544,9 +693,22 @@ export interface RequestLogEntry {
   timestamp: number;
   model: string;
   provider: string;
+  requestedModel?: string;
+  requestedServiceTier?: string;
+  requestedSpeedLabel?: string;
+  configuredServiceTier?: string;
+  configuredSpeedLabel?: string;
+  modelSupportsServiceTier?: boolean;
+  responseServiceTier?: string;
+  resolvedModel?: string;
   status: number;
   durationMs: number;
   errorCode?: string;
+  terminalStatus?: ResponsesTerminalStatus;
+  closeReason?: "terminal" | "client_cancel" | "non_stream";
+  usageStatus: UsageStatus;
+  usage?: OcxUsage;
+  totalTokens?: number;
 }
 
 const requestLog: RequestLogEntry[] = [];
@@ -556,6 +718,22 @@ let requestLogSeq = 0;
 function addRequestLog(entry: RequestLogEntry) {
   requestLog.push(entry);
   if (requestLog.length > MAX_LOG_SIZE) requestLog.shift();
+  try {
+    appendUsageEntry({
+      requestId: entry.requestId,
+      timestamp: entry.timestamp,
+      provider: entry.provider,
+      model: entry.model,
+      ...(entry.resolvedModel ? { resolvedModel: entry.resolvedModel } : {}),
+      status: entry.status,
+      durationMs: entry.durationMs,
+      usageStatus: entry.usageStatus,
+      ...(entry.usage ? { usage: entry.usage } : {}),
+      ...(entry.totalTokens !== undefined ? { totalTokens: entry.totalTokens } : {}),
+    });
+  } catch {
+    /* request logging must never fail a user request */
+  }
 }
 
 export function nextRequestLogId(timestamp = Date.now()): string {
@@ -568,11 +746,188 @@ export function requestLogErrorCode(status: number): string | undefined {
   if (status === 400 || status === 409) return "invalid_request_error";
   if (status === 401 || status === 403) return "invalid_api_key";
   if (status === 429) return "rate_limit_exceeded";
+  if (status === 499) return "client_closed_request";
   if (status === 503) return "server_is_overloaded";
   if (status >= 500) return "upstream_server_error";
   return `http_${status}`;
 }
 
+export function requestLogSpeedLabel(serviceTier: string | undefined): string | undefined {
+  const normalized = serviceTier?.trim().toLowerCase();
+  if (normalized === "priority" || normalized === "fast") return "fast";
+  return undefined;
+}
+
+function readConfiguredCodexServiceTier(): string | undefined {
+  try {
+    if (!existsSync(CODEX_CONFIG_PATH)) return undefined;
+    return readRootTomlString(readFileSync(CODEX_CONFIG_PATH, "utf-8"), "service_tier") ?? undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function catalogModelSupportsServiceTier(modelId: string, serviceTier: string | undefined): boolean | undefined {
+  if (!serviceTier) return undefined;
+  const requestTier = serviceTier.trim().toLowerCase() === "fast" ? "priority" : serviceTier.trim();
+  try {
+    const catalogPath = readCodexCatalogPath();
+    if (!existsSync(catalogPath)) return undefined;
+    const catalog = JSON.parse(readFileSync(catalogPath, "utf-8")) as { models?: unknown };
+    const models = Array.isArray(catalog.models) ? catalog.models : [];
+    const entry = models.find(model => {
+      if (!model || typeof model !== "object") return false;
+      return (model as { slug?: unknown; id?: unknown }).slug === modelId
+        || (model as { slug?: unknown; id?: unknown }).id === modelId;
+    });
+    if (!entry || typeof entry !== "object") return undefined;
+    const tiers = (entry as { service_tiers?: unknown }).service_tiers;
+    return Array.isArray(tiers) && tiers.some(tier => (
+      tier && typeof tier === "object" && (tier as { id?: unknown }).id === requestTier
+    ));
+  } catch {
+    return undefined;
+  }
+}
+
+function applyResponseLogMetadata(logCtx: RequestLogContext, payload: unknown): void {
+  if (!payload || typeof payload !== "object") return;
+  const source = "response" in payload && typeof (payload as { response?: unknown }).response === "object"
+    ? (payload as { response?: unknown }).response
+    : payload;
+  if (!source || typeof source !== "object") return;
+  const model = (source as { model?: unknown }).model;
+  if (typeof model === "string" && model.trim()) logCtx.resolvedModel = model;
+  const serviceTier = (source as { service_tier?: unknown }).service_tier;
+  if (typeof serviceTier === "string" && serviceTier.trim()) logCtx.responseServiceTier = serviceTier;
+  const usage = usageFromResponsesPayload((source as { usage?: unknown }).usage);
+  if (usage) logCtx.usage = usage;
+}
+
+export function usageFromResponsesPayload(usage: unknown): OcxUsage | undefined {
+  if (!usage || typeof usage !== "object") return undefined;
+  const raw = usage as {
+    input_tokens?: unknown;
+    output_tokens?: unknown;
+    input_tokens_details?: { cached_tokens?: unknown };
+    output_tokens_details?: { reasoning_tokens?: unknown };
+    prompt_tokens?: unknown;
+    completion_tokens?: unknown;
+    prompt_tokens_details?: { cached_tokens?: unknown };
+    completion_tokens_details?: { reasoning_tokens?: unknown };
+  };
+  if (typeof raw.input_tokens === "number" && typeof raw.output_tokens === "number") {
+    return {
+      inputTokens: raw.input_tokens,
+      outputTokens: raw.output_tokens,
+      ...(typeof raw.input_tokens_details?.cached_tokens === "number"
+        ? { cachedInputTokens: raw.input_tokens_details.cached_tokens }
+        : {}),
+      ...(typeof raw.output_tokens_details?.reasoning_tokens === "number"
+        ? { reasoningOutputTokens: raw.output_tokens_details.reasoning_tokens }
+        : {}),
+    };
+  }
+  if (typeof raw.prompt_tokens === "number" && typeof raw.completion_tokens === "number") {
+    return {
+      inputTokens: raw.prompt_tokens,
+      outputTokens: raw.completion_tokens,
+      ...(typeof raw.prompt_tokens_details?.cached_tokens === "number"
+        ? { cachedInputTokens: raw.prompt_tokens_details.cached_tokens }
+        : {}),
+      ...(typeof raw.completion_tokens_details?.reasoning_tokens === "number"
+        ? { reasoningOutputTokens: raw.completion_tokens_details.reasoning_tokens }
+        : {}),
+    };
+  }
+  return undefined;
+}
+
+function inspectResponseLogJson(logCtx: RequestLogContext, text: string): void {
+  try {
+    applyResponseLogMetadata(logCtx, JSON.parse(text));
+  } catch {
+    /* body may not be JSON; request log metadata is best-effort only */
+  }
+  if (isUsageDebugEnabled() && logCtx.usageDebugBodyKind === undefined) {
+    logCtx.usageDebugBodyKind = "json";
+    logCtx.usageDebugBodySample = truncateForDebug(text);
+  }
+}
+
+function inspectResponseLogSsePayload(logCtx: RequestLogContext, payload: string | null): void {
+  if (!payload || payload.trim() === "[DONE]") return;
+  const debugEnabled = isUsageDebugEnabled();
+  const sseAlreadyMarked = logCtx.usageDebugBodyKind === "sse";
+  try {
+    applyResponseLogMetadata(logCtx, JSON.parse(payload));
+  } catch {
+    /* SSE block payload may not be JSON; metadata inspection is best-effort */
+  }
+  if (debugEnabled) {
+    if (!sseAlreadyMarked) {
+      logCtx.usageDebugBodyKind = "sse";
+      logCtx.usageDebugBodySample = truncateForDebug(payload);
+    } else if (typeof logCtx.usageDebugBodySample === "string"
+      && logCtx.usageDebugBodySample.length < USAGE_DEBUG_BODY_SAMPLE_BYTES) {
+      const combined = `${logCtx.usageDebugBodySample}\n${payload}`;
+      logCtx.usageDebugBodySample = truncateForDebug(combined);
+    }
+  }
+}
+
+function httpStatusForTerminalStatus(status: ResponsesTerminalStatus): number {
+  return status === "completed" ? 200 : 502;
+}
+
+function addFinalRequestLog(
+  requestId: string,
+  start: number,
+  logCtx: RequestLogContext,
+  status: number,
+  meta?: Pick<RequestLogEntry, "terminalStatus" | "closeReason">,
+  addLog: (entry: RequestLogEntry) => void = addRequestLog,
+): void {
+  const errorCode = requestLogErrorCode(status);
+  const usageStatus = usageStatusForFinalLog(logCtx.usage);
+  const totalTokens = usageTotalTokens(logCtx.usage);
+  addLog({
+    requestId,
+    timestamp: start,
+    model: logCtx.model,
+    provider: logCtx.provider,
+    ...(logCtx.requestedModel ? { requestedModel: logCtx.requestedModel } : {}),
+    ...(logCtx.requestedServiceTier ? { requestedServiceTier: logCtx.requestedServiceTier } : {}),
+    ...(logCtx.requestedSpeedLabel ? { requestedSpeedLabel: logCtx.requestedSpeedLabel } : {}),
+    ...(logCtx.configuredServiceTier ? { configuredServiceTier: logCtx.configuredServiceTier } : {}),
+    ...(logCtx.configuredSpeedLabel ? { configuredSpeedLabel: logCtx.configuredSpeedLabel } : {}),
+    ...(logCtx.modelSupportsServiceTier !== undefined ? { modelSupportsServiceTier: logCtx.modelSupportsServiceTier } : {}),
+    ...(logCtx.responseServiceTier ? { responseServiceTier: logCtx.responseServiceTier } : {}),
+    ...(logCtx.resolvedModel ? { resolvedModel: logCtx.resolvedModel } : {}),
+    status,
+    durationMs: Date.now() - start,
+    ...(errorCode ? { errorCode } : {}),
+    ...(meta?.terminalStatus ? { terminalStatus: meta.terminalStatus } : {}),
+    ...(meta?.closeReason ? { closeReason: meta.closeReason } : {}),
+    usageStatus,
+    ...(logCtx.usage ? { usage: logCtx.usage } : {}),
+    ...(totalTokens !== undefined ? { totalTokens } : {}),
+  });
+  if (isUsageDebugEnabled()) {
+    appendUsageDebug({
+      ts: Date.now(),
+      requestId,
+      provider: logCtx.provider,
+      model: logCtx.model,
+      upstreamContentType: logCtx.usageDebugContentType ?? null,
+      upstreamStatus: status,
+      bodyKind: logCtx.usageDebugBodyKind ?? "none",
+      bodySample: logCtx.usageDebugBodySample ?? "",
+      extractedUsage: logCtx.usage ?? null,
+    });
+  }
+}
+
 export function filterRequestLogs(logs: RequestLogEntry[], params: URLSearchParams): RequestLogEntry[] {
   let filtered = logs;
   const provider = params.get("provider")?.trim();
@@ -662,11 +1017,150 @@ function terminalStatusFromSsePayload(payload: string): ResponsesTerminalStatus
   }
 }
 
+function trackSseForRequestLog(
+  body: ReadableStream<Uint8Array>,
+  onTerminal: (status: ResponsesTerminalStatus) => void,
+  onCancel: () => void,
+  logCtx?: RequestLogContext,
+): ReadableStream<Uint8Array> {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let terminalReported = false;
+
+  const reportTerminal = (status: ResponsesTerminalStatus) => {
+    if (terminalReported) return;
+    terminalReported = true;
+    onTerminal(status);
+  };
+
+  const inspectPayload = (payload: string | null) => {
+    if (!payload) return;
+    if (logCtx) inspectResponseLogSsePayload(logCtx, payload);
+    const status = terminalStatusFromSsePayload(payload);
+    if (status) reportTerminal(status);
+  };
+
+  const inspectChunk = (value: Uint8Array) => {
+    buffer += decoder.decode(value, { stream: true });
+    let next: { block: string; rest: string } | null;
+    while ((next = nextSseBlock(buffer))) {
+      buffer = next.rest;
+      inspectPayload(sseDataPayload(next.block));
+    }
+  };
+
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          buffer += decoder.decode();
+          if (buffer.trim()) inspectPayload(sseDataPayload(buffer));
+          if (!terminalReported) reportTerminal("incomplete");
+          controller.close();
+          return;
+        }
+        inspectChunk(value);
+        controller.enqueue(value);
+      } catch (err) {
+        if (!terminalReported) reportTerminal("incomplete");
+        try { controller.error(err); } catch { /* already torn down */ }
+      }
+    },
+    cancel(reason) {
+      onCancel();
+      reader.cancel(reason).catch(() => {});
+    },
+  });
+}
+
+export function responseWithDeferredRequestLog(
+  response: Response,
+  requestId: string,
+  start: number,
+  logCtx: RequestLogContext,
+  addLog: (entry: RequestLogEntry) => void = addRequestLog,
+): Response {
+  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
+  if (isUsageDebugEnabled() && !logCtx.usageDebugContentType && contentType) {
+    logCtx.usageDebugContentType = contentType;
+  }
+  if (isNativePassthroughSseResponse(response)) {
+    return response;
+  }
+  if (!response.body || !contentType.includes("text/event-stream")) {
+    if (response.body && contentType.includes("application/json")) {
+      const finalizeJsonLog = async () => {
+        const text = await response.text();
+        inspectResponseLogJson(logCtx, text);
+        addFinalRequestLog(requestId, start, logCtx, response.status, { closeReason: "non_stream" }, addLog);
+        return text;
+      };
+      const body = new ReadableStream<Uint8Array>({
+        async start(controller) {
+          try {
+            controller.enqueue(new TextEncoder().encode(await finalizeJsonLog()));
+            controller.close();
+          } catch (err) {
+            addFinalRequestLog(requestId, start, logCtx, 502, { closeReason: "non_stream" }, addLog);
+            try { controller.error(err); } catch { /* already torn down */ }
+          }
+        },
+      });
+      return new Response(body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+      });
+    }
+    if (isUsageDebugEnabled() && logCtx.usageDebugBodyKind === undefined) {
+      logCtx.usageDebugBodyKind = response.body ? "other" : "none";
+    }
+    addFinalRequestLog(requestId, start, logCtx, response.status, { closeReason: "non_stream" }, addLog);
+    return response;
+  }
+
+  let logged = false;
+  const body = trackSseForRequestLog(
+    response.body,
+    status => {
+      if (logged) return;
+      logged = true;
+      addFinalRequestLog(requestId, start, logCtx, httpStatusForTerminalStatus(status), {
+        terminalStatus: status,
+        closeReason: "terminal",
+      }, addLog);
+    },
+    () => {
+      if (logged) return;
+      logged = true;
+      addFinalRequestLog(requestId, start, logCtx, 499, { closeReason: "client_cancel" }, addLog);
+    },
+    logCtx,
+  );
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+function markNativePassthroughSseResponse(response: Response): Response {
+  nativePassthroughSseResponses.add(response);
+  return response;
+}
+
+function isNativePassthroughSseResponse(response: Response): boolean {
+  return nativePassthroughSseResponses.has(response);
+}
+
 export function relaySseWithHeartbeat(
   body: ReadableStream<Uint8Array> | null,
   upstream: AbortController,
   heartbeatMs = 15_000,
   onTerminal?: (status: ResponsesTerminalStatus) => void,
+  options?: { onStart?: () => void; onDone?: () => void },
 ): ReadableStream<Uint8Array> | null {
   if (!body) return null;
   const reader = body.getReader();
@@ -700,13 +1194,16 @@ export function relaySseWithHeartbeat(
   };
 
   const cleanup = () => {
+    if (closed) return;
     closed = true;
     if (timer) clearInterval(timer);
     timer = undefined;
+    options?.onDone?.();
   };
 
   return new ReadableStream<Uint8Array>({
     start(controller) {
+      options?.onStart?.();
       timer = setInterval(() => {
         if (closed) return;
         try {
@@ -751,11 +1248,26 @@ export function relaySseWithHeartbeat(
 function consumeForInspection(
   body: ReadableStream<Uint8Array>,
   onTerminal: (status: ResponsesTerminalStatus) => void,
+  signal?: AbortSignal,
+  onDone?: () => void,
+  logCtx?: RequestLogContext,
 ): void {
   const reader = body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
   let reported = false;
+  let cancelled = false;
+  if (signal) {
+    if (signal.aborted) {
+      cancelled = true;
+      reader.cancel(signal.reason).catch(() => {});
+      return;
+    }
+    signal.addEventListener("abort", () => {
+      cancelled = true;
+      reader.cancel(signal.reason).catch(() => {});
+    }, { once: true });
+  }
   const pump = async () => {
     try {
       for (;;) {
@@ -764,12 +1276,13 @@ function consumeForInspection(
           buffer += decoder.decode();
           if (buffer.trim() && !reported) {
             const payload = sseDataPayload(buffer);
+            if (logCtx) inspectResponseLogSsePayload(logCtx, payload);
             if (payload) {
               const status = terminalStatusFromSsePayload(payload);
               if (status) { reported = true; onTerminal(status); }
             }
           }
-          if (!reported) onTerminal("incomplete");
+          if (!reported && !cancelled) onTerminal("incomplete");
           return;
         }
         buffer += decoder.decode(value, { stream: true });
@@ -778,6 +1291,7 @@ function consumeForInspection(
           buffer = next.rest;
           if (!reported) {
             const payload = sseDataPayload(next.block);
+            if (logCtx) inspectResponseLogSsePayload(logCtx, payload);
             if (payload) {
               const status = terminalStatusFromSsePayload(payload);
               if (status) { reported = true; onTerminal(status); }
@@ -786,7 +1300,53 @@ function consumeForInspection(
         }
       }
     } catch {
-      if (!reported) onTerminal("incomplete");
+      if (!reported && !cancelled) onTerminal("incomplete");
+    } finally {
+      onDone?.();
+    }
+  };
+  pump();
+}
+
+function consumeForResponseLogMetadata(
+  body: ReadableStream<Uint8Array>,
+  logCtx: RequestLogContext,
+  signal?: AbortSignal,
+  onDone?: () => void,
+): void {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  if (signal) {
+    if (signal.aborted) {
+      reader.cancel(signal.reason).catch(() => {});
+      onDone?.();
+      return;
+    }
+    signal.addEventListener("abort", () => {
+      reader.cancel(signal.reason).catch(() => {});
+    }, { once: true });
+  }
+  const pump = async () => {
+    try {
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) {
+          buffer += decoder.decode();
+          if (buffer.trim()) inspectResponseLogSsePayload(logCtx, sseDataPayload(buffer));
+          return;
+        }
+        buffer += decoder.decode(value, { stream: true });
+        let next: { block: string; rest: string } | null;
+        while ((next = nextSseBlock(buffer))) {
+          buffer = next.rest;
+          inspectResponseLogSsePayload(logCtx, sseDataPayload(next.block));
+        }
+      }
+    } catch {
+      /* metadata inspection must not affect the client-facing stream */
+    } finally {
+      onDone?.();
     }
   };
   pump();
@@ -807,6 +1367,8 @@ export function sanitizePassthroughHeaders(upstream: Headers): Headers {
     "keep-alive",
     "proxy-authenticate",
     "proxy-authorization",
+    "set-cookie",
+    "set-cookie2",
     "te",
     "trailer",
     "upgrade",
@@ -820,27 +1382,83 @@ export function sanitizePassthroughHeaders(upstream: Headers): Headers {
 
 let _corsOrigin = "http://localhost:10100";
 function setCorsOrigin(port: number): void { _corsOrigin = `http://localhost:${port}`; }
-export function corsHeaders(): Record<string, string> {
+function configuredPort(): string {
+  try { return new URL(_corsOrigin).port; } catch { return "10100"; }
+}
+
+function parseHttpHost(value: string | null): { hostname: string; port: string } | null {
+  if (!value) return null;
+  try {
+    const parsed = new URL(`http://${value}`);
+    return { hostname: parsed.hostname.toLowerCase(), port: parsed.port };
+  } catch {
+    return null;
+  }
+}
+
+function isLoopbackRequestHost(value: string | null): boolean {
+  const parsed = parseHttpHost(value);
+  if (!parsed) return true;
+  if (!isLoopbackHostname(parsed.hostname)) return false;
+  return parsed.port === "" || parsed.port === configuredPort();
+}
+
+function isLoopbackOriginValue(value: string): boolean {
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "http:") return false;
+    if (!isLoopbackHostname(parsed.hostname)) return false;
+    return parsed.port === configuredPort();
+  } catch {
+    return false;
+  }
+}
+
+function isSameOriginAsRequest(req: Request, origin: string): boolean {
+  try {
+    return origin === new URL(req.url).origin;
+  } catch {
+    return false;
+  }
+}
+
+function isAllowedRequestOrigin(req: Request, config: OcxConfig): boolean {
+  const origin = req.headers.get("Origin");
+  if (!isApiAuthRequired(config)) {
+    if (!isLoopbackRequestHost(req.headers.get("Host"))) return false;
+    return !origin || isLoopbackOriginValue(origin);
+  }
+  return !origin || isLoopbackOriginValue(origin) || isSameOriginAsRequest(req, origin);
+}
+
+export function corsHeaders(req?: Request, config?: OcxConfig): Record<string, string> {
+  const origin = req?.headers.get("Origin");
+  const allowOrigin = origin && req && config && isAllowedRequestOrigin(req, config) ? origin : _corsOrigin;
   return {
-    "Access-Control-Allow-Origin": _corsOrigin,
+    "Access-Control-Allow-Origin": allowOrigin,
     "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type, Authorization, X-OpenCodex-API-Key",
+    "Vary": "Origin",
   };
 }
 
-function jsonResponse(data: unknown, status = 200): Response {
-  return new Response(JSON.stringify(data), {
-    status,
-    headers: { "Content-Type": "application/json", ...corsHeaders() },
+function withCors(response: Response, req: Request, config: OcxConfig): Response {
+  const headers = new Headers(response.headers);
+  for (const [name, value] of Object.entries(corsHeaders(req, config))) {
+    headers.set(name, value);
+  }
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
   });
 }
 
-function isLocalOrigin(req: Request): boolean {
-  const origin = req.headers.get("Origin");
-  if (!origin) return true;
-  const localhostOrigin = _corsOrigin;
-  const loopbackOrigin = _corsOrigin.replace("localhost", "127.0.0.1");
-  return origin === localhostOrigin || origin === loopbackOrigin;
+function jsonResponse(data: unknown, status = 200, req?: Request, config?: OcxConfig): Response {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json", ...corsHeaders(req, config) },
+  });
 }
 
 function configuredApiAuthToken(_config: OcxConfig): string | undefined {
@@ -880,6 +1498,47 @@ function requireApiAuth(req: Request, config: OcxConfig, kind: "management" | "d
   return formatErrorResponse(401, "authentication_error", "opencodex API key required");
 }
 
+function providerManagementConfigError(name: string, provider: OcxProviderConfig): string | null {
+  const baseUrlError = providerBaseUrlConfigError(provider.baseUrl);
+  if (baseUrlError) return `provider ${name} ${baseUrlError}`;
+  if (provider.authMode === "forward") {
+    const normalizedName = name.trim().toLowerCase();
+    const base = provider.baseUrl.replace(/\/+$/, "");
+    const isBuiltInChatGptForward = (normalizedName === "openai" || normalizedName === "chatgpt")
+      && provider.adapter === "openai-responses"
+      && base === "https://chatgpt.com/backend-api/codex";
+    if (isBuiltInChatGptForward) return null;
+    return `provider ${name} uses reserved authMode "forward"; configure ChatGPT passthrough via the built-in provider`;
+  }
+  return null;
+}
+
+function providerBaseUrlConfigError(baseUrl: string): string | null {
+  try {
+    const parsed = new URL(baseUrl.trim());
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "baseUrl must be an http(s) URL";
+    if (parsed.username || parsed.password) return "baseUrl must not include embedded credentials";
+    if (parsed.search || parsed.hash) return "baseUrl must not include query strings or fragments";
+  } catch {
+    return "baseUrl must be a valid URL";
+  }
+  return null;
+}
+
+function publicProviderBaseUrl(baseUrl: string): string {
+  try {
+    const parsed = new URL(baseUrl.trim());
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return "(invalid URL)";
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString().replace(/\/$/, baseUrl.endsWith("/") ? "/" : "");
+  } catch {
+    return "(invalid URL)";
+  }
+}
+
 function copyIfDefined<K extends keyof OcxProviderConfig>(
   out: Record<string, unknown>,
   provider: OcxProviderConfig,
@@ -894,7 +1553,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
   for (const [name, provider] of Object.entries(config.providers)) {
     const dto: Record<string, unknown> = {
       adapter: provider.adapter,
-      baseUrl: provider.baseUrl,
+      baseUrl: publicProviderBaseUrl(provider.baseUrl),
       hasApiKey: !!provider.apiKey,
       hasHeaders: !!provider.headers && Object.keys(provider.headers).length > 0,
     };
@@ -931,8 +1590,8 @@ export function safeConfigDTO(config: OcxConfig): unknown {
 }
 
 async function handleManagementAPI(req: Request, url: URL, config: OcxConfig): Promise<Response | null> {
-  if ((req.method === "POST" || req.method === "PUT" || req.method === "DELETE") && !isLocalOrigin(req)) {
-    return jsonResponse({ error: "cross-origin request blocked" }, 403);
+  if (!isAllowedRequestOrigin(req, config)) {
+    return jsonResponse({ error: "cross-origin request blocked" }, 403, req, config);
   }
   async function refreshCodexCatalogBestEffort(): Promise<void> {
     try {
@@ -1005,9 +1664,40 @@ async function handleManagementAPI(req: Request, url: URL, config: OcxConfig): P
     return jsonResponse(filterRequestLogs(requestLog, url.searchParams));
   }
 
+  if (url.pathname === "/api/usage" && req.method === "GET") {
+    const range = parseRange(url.searchParams.get("range"));
+    const now = Date.now();
+    try {
+      return jsonResponse(summarizeUsage(readUsageEntries(), range, now));
+    } catch {
+      return jsonResponse({
+        range,
+        since: null,
+        generatedAt: now,
+        summary: {
+          requests: 0,
+          reportedRequests: 0,
+          unreportedRequests: 0,
+          unsupportedRequests: 0,
+          estimatedRequests: 0,
+          inputTokens: 0,
+          outputTokens: 0,
+          cachedInputTokens: 0,
+          reasoningOutputTokens: 0,
+          totalTokens: 0,
+          coverageRatio: 0,
+        },
+        days: [],
+        models: [],
+        providers: [],
+        error: "read_failed",
+      });
+    }
+  }
+
   if (url.pathname === "/api/providers" && req.method === "GET") {
     return jsonResponse(Object.entries(config.providers).map(([name, p]) => ({
-      name, adapter: p.adapter, baseUrl: p.baseUrl, defaultModel: p.defaultModel,
+      name, adapter: p.adapter, baseUrl: publicProviderBaseUrl(p.baseUrl), defaultModel: p.defaultModel,
       hasApiKey: !!p.apiKey,
     })));
   }
@@ -1023,6 +1713,11 @@ async function handleManagementAPI(req: Request, url: URL, config: OcxConfig): P
     if (!name || !prov?.adapter || !prov?.baseUrl) {
       return jsonResponse({ error: "name, provider.adapter and provider.baseUrl are required" }, 400);
     }
+    if (!isValidProviderName(name)) {
+      return jsonResponse({ error: "provider name must use letters, numbers, dot, underscore, or hyphen and cannot be a reserved object key" }, 400);
+    }
+    const providerError = providerManagementConfigError(name, prov);
+    if (providerError) return jsonResponse({ error: providerError }, 400);
     // Catalog providers (e.g. ollama-cloud) carry a models + vision/reasoning classification the GUI
     // doesn't send — merge it in so the sidecars are gated correctly.
     enrichProviderFromCatalog(name, prov);
@@ -1038,7 +1733,8 @@ async function handleManagementAPI(req: Request, url: URL, config: OcxConfig): P
 
   if (url.pathname === "/api/providers" && req.method === "DELETE") {
     const name = url.searchParams.get("name")?.trim();
-    if (!name || !config.providers[name]) return jsonResponse({ error: "unknown provider" }, 404);
+    if (!name || !isValidProviderName(name) || !hasOwnProvider(config.providers, name)) return jsonResponse({ error: "unknown provider" }, 404);
+    if (name === config.defaultProvider) return jsonResponse({ error: "cannot delete the default provider; set another default first" }, 400);
     const { saveConfig: save } = await import("./config");
     delete config.providers[name];
     save(config);
@@ -1199,66 +1895,74 @@ export function startServer(port?: number) {
   const listenPort = port ?? config.port ?? 10100;
   setCorsOrigin(listenPort);
 
-  const server = Bun.serve<WsData>({
+  const server: Server<WsData> = Bun.serve<WsData>({
     port: listenPort,
     hostname: config.hostname ?? "127.0.0.1",
     idleTimeout: 255,
-    async fetch(req) {
+    async fetch(req, requestServer): Promise<Response> {
       const url = new URL(req.url);
 
       if (req.method === "OPTIONS") {
-        return new Response(null, { status: 204, headers: corsHeaders() });
+        if (!isAllowedRequestOrigin(req, config)) {
+          return new Response(null, { status: 403, headers: corsHeaders() });
+        }
+        return new Response(null, { status: 204, headers: corsHeaders(req, config) });
       }
 
       // Responses WebSocket (phase 120.2). Codex upgrades the same /v1/responses path; auth is
       // handshake-time only, so capture inbound headers and thread them into the pipeline.
       if (url.pathname === "/v1/responses" && req.headers.get("upgrade")?.toLowerCase() === "websocket") {
         if (draining) {
-          return new Response("Service shutting down", { status: 503, headers: { ...corsHeaders(), "Retry-After": "5" } });
+          return new Response("Service shutting down", { status: 503, headers: { ...corsHeaders(req, config), "Retry-After": "5" } });
         }
         const apiAuthError = requireApiAuth(req, config, "data-plane");
-        if (apiAuthError) return apiAuthError;
-        if (!isLocalOrigin(req)) {
-          return formatErrorResponse(403, "origin_rejected", "WebSocket upgrade blocked: non-local Origin");
+        if (apiAuthError) return withCors(apiAuthError, req, config);
+        if (!isAllowedRequestOrigin(req, config)) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "WebSocket upgrade blocked: non-local Origin"), req, config);
         }
         let authCtx: CodexAuthContext;
         try {
           authCtx = await resolveCodexAuthContext(req.headers, config);
         } catch (err) {
           if (err instanceof CodexAccountCooldownError) {
-            return formatErrorResponse(429, "rate_limit_error", "Selected Codex account is cooling down");
+            return withCors(formatErrorResponse(429, "rate_limit_error", "Selected Codex account is cooling down"), req, config);
           }
           if (err instanceof CodexThreadAffinityExpiredError) {
-            return formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session");
+            return withCors(formatErrorResponse(409, "invalid_request_error", "Codex thread account affinity expired; start a new session"), req, config);
           }
           if (err instanceof CodexAuthContextError) {
             const safeAccountLabel = formatCodexProviderForLog("chatgpt", err.accountId, config);
             console.error(`[codex-auth] Pool account ${safeAccountLabel} token failed during websocket upgrade; reauthentication required`);
-            return formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication");
+            return withCors(formatErrorResponse(401, "authentication_error", "Selected Codex account needs reauthentication"), req, config);
           }
           throw err;
         }
         if (server.upgrade(req, {
           data: {
-            headers: selectForwardHeadersForAuthContext(req.headers, authCtx),
+            headers: selectForwardHeaders(req.headers),
             authContext: authCtx,
           },
         })) return undefined as unknown as Response;
-        return formatErrorResponse(426, "upgrade_required", "WebSocket upgrade failed");
+        return withCors(formatErrorResponse(426, "upgrade_required", "WebSocket upgrade failed"), req, config);
       }
 
       if (url.pathname === "/healthz" && req.method === "GET") {
-        return jsonResponse({ status: "ok", version: VERSION, uptime: process.uptime() });
+        return jsonResponse({ status: "ok", version: VERSION, uptime: process.uptime() }, 200, req, config);
       }
 
       if (url.pathname.startsWith("/api/")) {
         const apiAuthError = requireApiAuth(req, config, "management");
-        if (apiAuthError) return apiAuthError;
+        if (apiAuthError) return withCors(apiAuthError, req, config);
         const mgmtResponse = await handleManagementAPI(req, url, config);
-        if (mgmtResponse) return mgmtResponse;
+        if (mgmtResponse) return withCors(mgmtResponse, req, config);
       }
 
       if (url.pathname === "/v1/models" && req.method === "GET") {
+        const apiAuthError = requireApiAuth(req, config, "data-plane");
+        if (apiAuthError) return withCors(apiAuthError, req, config);
+        if (!isAllowedRequestOrigin(req, config)) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, config);
+        }
         const goModels = await fetchAllModels(config);
         const { buildCatalogEntries, loadCatalogTemplate, nativeOpenAiSlugs, orderForSubagents } = await import("./codex-catalog");
         const nativeSlugs = nativeOpenAiSlugs();
@@ -1269,40 +1973,51 @@ export function startServer(port?: number) {
           // Codex client → Codex catalog shape: native gpt + namespaced routed models,
           // cloned from a native template so required fields (base_instructions, etc.) are present.
           // Pass the subagent picks so featured models lead by priority (matches the on-disk file).
-          return jsonResponse({ models: buildCatalogEntries(loadCatalogTemplate(), nativeSlugs, goOrdered, config.subagentModels, websocketsEnabled(config)) });
+          return jsonResponse({ models: buildCatalogEntries(loadCatalogTemplate(), nativeSlugs, goOrdered, config.subagentModels, websocketsEnabled(config)) }, 200, req, config);
         }
         // OpenAI list shape: native gpt bare + routed models namespaced "<provider>/<id>"
         const data = [
           ...nativeSlugs.map(id => ({ id, object: "model", created: 0, owned_by: "openai" })),
           ...goOrdered.map(m => ({ id: `${m.provider}/${m.id}`, object: "model", created: 0, owned_by: m.owned_by ?? m.provider })),
         ];
-        return jsonResponse({ object: "list", data });
+        return jsonResponse({ object: "list", data }, 200, req, config);
       }
 
       if (url.pathname === "/v1/responses" && req.method === "POST") {
+        disableResponsesRequestTimeout(req, requestServer);
         if (draining) {
-          return new Response("Service shutting down", { status: 503, headers: { ...corsHeaders(), "Retry-After": "5" } });
+          return new Response("Service shutting down", { status: 503, headers: { ...corsHeaders(req, config), "Retry-After": "5" } });
         }
         const apiAuthError = requireApiAuth(req, config, "data-plane");
-        if (apiAuthError) return apiAuthError;
-        if (!isLocalOrigin(req)) {
-          return formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked");
+        if (apiAuthError) return withCors(apiAuthError, req, config);
+        if (!isAllowedRequestOrigin(req, config)) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, config);
         }
         const start = Date.now();
         const requestId = nextRequestLogId(start);
         const logCtx = { model: "unknown", provider: "unknown" };
-        const response = await handleResponses(req, config, logCtx);
-        const errorCode = requestLogErrorCode(response.status);
-        addRequestLog({
-          requestId,
-          timestamp: start,
-          model: logCtx.model,
-          provider: logCtx.provider,
-          status: response.status,
-          durationMs: Date.now() - start,
-          ...(errorCode ? { errorCode } : {}),
+        let logged = false;
+        const finalizeNativePassthroughLog = (
+          status: number,
+          meta: { terminalStatus?: ResponsesTerminalStatus; closeReason: "terminal" | "client_cancel" },
+        ) => {
+          if (logged) return;
+          logged = true;
+          addFinalRequestLog(requestId, start, logCtx, status, meta);
+        };
+        const response = await handleResponses(req, config, logCtx, {
+          abortSignal: req.signal,
+          onNativePassthroughTerminal: status => {
+            finalizeNativePassthroughLog(httpStatusForTerminalStatus(status), {
+              terminalStatus: status,
+              closeReason: "terminal",
+            });
+          },
+          onNativePassthroughCancel: () => {
+            finalizeNativePassthroughLog(499, { closeReason: "client_cancel" });
+          },
         });
-        return response;
+        return withCors(responseWithDeferredRequestLog(response, requestId, start, logCtx), req, config);
       }
 
       const guiFile = serveGuiFile(url.pathname);
@@ -1311,9 +2026,10 @@ export function startServer(port?: number) {
         return jsonResponse(rootFallbackPayload());
       }
 
-      return formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`);
+      return withCors(formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`), req, config);
     },
     websocket: {
+      idleTimeout: WEBSOCKET_IDLE_TIMEOUT_SECONDS,
       // Responses WebSocket data plane (phase 120.2). Re-frames the same SSE pipeline onto the
       // socket: parse response.create → run handleResponses unchanged → pump its SSE body as WS
       // Text frames. response.processed is a no-op ack. close() aborts the upstream (RC2 parity).
@@ -1321,6 +2037,15 @@ export function startServer(port?: number) {
         registerCodexWebSocket(ws);
       },
       message(ws: ServerWebSocket<WsData>, raw: string | Buffer) {
+        const rawBytes = typeof raw === "string" ? Buffer.byteLength(raw) : raw.byteLength;
+        if (rawBytes > MAX_WS_FRAME_BYTES) {
+          sendJsonFrame(ws, buildWsErrorFrame(413, {
+            type: "invalid_request_error",
+            message: "WebSocket response.create frame is too large",
+          }));
+          ws.close(1009, "message too large");
+          return;
+        }
         let frame: Record<string, unknown>;
         try {
           frame = JSON.parse(typeof raw === "string" ? raw : raw.toString()) as Record<string, unknown>;
@@ -1351,41 +2076,97 @@ export function startServer(port?: number) {
 
         const payload: Record<string, unknown> = { ...frame };
         delete payload.type;
-        const wsTurnAc = new AbortController();
-        registerTurn(wsTurnAc);
+        registerTurn(turnAbort);
         void (async () => {
+          const start = Date.now();
+          const requestId = nextRequestLogId(start);
           const logCtx = { model: "unknown", provider: "unknown" };
+          let logged = false;
+          const finalizeLog = (status: number) => {
+            if (logged) return;
+            logged = true;
+            addFinalRequestLog(requestId, start, logCtx, status);
+          };
+          const baseHeaders = ws.data.headers ?? new Headers();
+          let authCtx: CodexAuthContext;
+          let selectedForwardHeaders: Headers;
+          try {
+            authCtx = await resolveCodexAuthContext(baseHeaders, config);
+            selectedForwardHeaders = headersForCodexAuthContext(baseHeaders, authCtx);
+            updateCodexWebSocketAuthContext(ws, authCtx);
+          } catch (err) {
+            if (!isCurrent()) return;
+            if (err instanceof CodexAccountCooldownError) {
+              finalizeLog(429);
+              sendJsonFrame(ws, buildWsErrorFrame(429, {
+                type: "rate_limit_error",
+                message: "Selected Codex account is cooling down",
+              }));
+              return;
+            }
+            if (err instanceof CodexThreadAffinityExpiredError) {
+              finalizeLog(409);
+              sendJsonFrame(ws, buildWsErrorFrame(409, {
+                type: "invalid_request_error",
+                message: "Codex thread account affinity expired; start a new session",
+              }));
+              return;
+            }
+            if (err instanceof CodexAuthContextError) {
+              const safeAccountLabel = formatCodexProviderForLog("chatgpt", err.accountId, config);
+              console.error(`[codex-auth] Pool account ${safeAccountLabel} token failed during websocket turn; reauthentication required`);
+              finalizeLog(401);
+              sendJsonFrame(ws, buildWsErrorFrame(401, {
+                type: "authentication_error",
+                message: "Selected Codex account needs reauthentication",
+              }));
+              return;
+            }
+            finalizeLog(502);
+            sendJsonFrame(ws, buildWsErrorFrame(502, {
+              type: "proxy_error",
+              message: err instanceof Error ? err.message : String(err),
+            }));
+            return;
+          }
           const fwd = new Headers({ "content-type": "application/json" });
-          ws.data.headers?.forEach((value, key) => fwd.set(key, value));
+          selectedForwardHeaders.forEach((value, key) => fwd.set(key, value));
           const req = new Request("http://localhost/v1/responses", {
             method: "POST",
             headers: fwd,
             body: JSON.stringify({ ...payload, stream: true }),
           });
           try {
-            assertCodexAuthContextNotCooled(ws.data.authContext);
             let terminalRecorder: ((status: ResponsesTerminalStatus) => void) | undefined;
             const response = await handleResponses(req, config, logCtx, {
               forceEmptyResponseId: true,
               abortSignal: turnAbort.signal,
-              authContext: ws.data.authContext,
-              selectedForwardHeaders: ws.data.headers,
+              authContext: authCtx,
+              selectedForwardHeaders,
               recordTerminalOutcomes: false,
               setTerminalOutcomeRecorder: recorder => {
                 terminalRecorder = recorder;
               },
             });
-            await sendResponseToWebSocket(ws, response, isCurrent, { onTerminal: terminalRecorder });
+            await sendResponseToWebSocket(ws, response, isCurrent, {
+              onTerminal: status => {
+                terminalRecorder?.(status);
+                finalizeLog(httpStatusForTerminalStatus(status));
+              },
+            });
+            if (!logged) finalizeLog(turnAbort.signal.aborted ? 499 : response.status);
           } catch (err) {
             if (!isCurrent()) return;
             try {
               if (err instanceof CodexAccountCooldownError) {
+                finalizeLog(429);
                 sendJsonFrame(ws, buildWsErrorFrame(429, {
                   type: "rate_limit_error",
                   message: "Selected Codex account is cooling down",
                 }));
                 return;
               }
+              finalizeLog(502);
               sendJsonFrame(ws, buildWsErrorFrame(502, {
                 type: "proxy_error",
                 message: err instanceof Error ? err.message : String(err),
@@ -1394,7 +2175,8 @@ export function startServer(port?: number) {
               /* socket already gone or send dropped */
             }
           } finally {
-            unregisterTurn(wsTurnAc);
+            unregisterTurn(turnAbort);
+            if (!logged && turnAbort.signal.aborted) finalizeLog(499);
             if (ws.data.cancel === cancelTurn) ws.data.cancel = undefined;
           }
         })();
@@ -1407,8 +2189,10 @@ export function startServer(port?: number) {
   });
 
   _serverRef = server;
+  const actualPort = server.port ?? listenPort;
+  setCorsOrigin(actualPort);
 
-  console.log(`🚀 opencodex proxy running on http://localhost:${listenPort}`);
+  console.log(`🚀 opencodex proxy running on http://localhost:${actualPort}`);
   console.log(`   POST /v1/responses → provider translation`);
   console.log(`   GET  /healthz      → health check`);
   console.log(`   GET  /api/*        → management API`);