@bitkyc08/opencodex 2.57.0 → 2.59.0

package/src/server/chat-native-sse.ts

@@ -152,6 +152,8 @@ export function nativeChatSse(
   let sawFinish = false;
   let sawDone = false;
   let firstOutput = false;
+  let sawTextOutput = false;
+  let sawToolCalls = false;
   let settled = false;
   let cancelled = false;
   let cancelledBySignal = false;
@@ -264,7 +266,7 @@ export function nativeChatSse(
     const choices = Array.isArray(parsed.choices) ? parsed.choices : [];
     const finished = choices.some(choice => isRec(choice) && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0);
     if (finished) sawFinish = true;
-    const hasProgress = choices.some(choice => {
+    const hasText = choices.some(choice => {
       if (!isRec(choice) || !isRec(choice.delta)) return false;
       const delta = choice.delta;
       return (typeof delta.content === "string" && delta.content.length > 0)
@@ -272,15 +274,22 @@ export function nativeChatSse(
         || (typeof delta.reasoning === "string" && delta.reasoning.length > 0)
         || (Array.isArray(delta.reasoning_details) && delta.reasoning_details.some(detail =>
           isRec(detail) && typeof detail.text === "string" && detail.text.length > 0))
-        || (typeof delta.refusal === "string" && delta.refusal.length > 0)
-        || (Array.isArray(delta.tool_calls) && delta.tool_calls.some(tool => {
-          if (!isRec(tool)) return false;
-          const fn = isRec(tool.function) ? tool.function : {};
-          return (typeof tool.id === "string" && tool.id.length > 0)
-            || (typeof fn.name === "string" && fn.name.length > 0)
-            || (typeof fn.arguments === "string" && fn.arguments.length > 0);
-        }));
+        || (typeof delta.refusal === "string" && delta.refusal.length > 0);
     });
+    const hasTool = choices.some(choice => {
+      if (!isRec(choice) || !isRec(choice.delta)) return false;
+      const delta = choice.delta;
+      return Array.isArray(delta.tool_calls) && delta.tool_calls.some(tool => {
+        if (!isRec(tool)) return false;
+        const fn = isRec(tool.function) ? tool.function : {};
+        return (typeof tool.id === "string" && tool.id.length > 0)
+          || (typeof fn.name === "string" && fn.name.length > 0)
+          || (typeof fn.arguments === "string" && fn.arguments.length > 0);
+      });
+    });
+    if (hasText) sawTextOutput = true;
+    if (hasTool) sawToolCalls = true;
+    const hasProgress = hasText || hasTool;
     if (hasProgress || finished) pullDeadline = performance.now() + stallMs;
     else if (performance.now() >= pullDeadline) throw stalled;
     if (!firstOutput && hasProgress) {
@@ -358,6 +367,14 @@ export function nativeChatSse(
             if (!sawDone) enqueue(controller, "data: [DONE]\n\n");
             settle(200);
             controller.close();
+          } else if (sawToolCalls) {
+            // Mid tool-call truncation must fail closed to prevent downstream executing partial arguments.
+            fail(controller, "upstream SSE ended mid tool call without a terminal signal — possible truncation", "upstream_sse_truncated");
+          } else if (sawTextOutput) {
+            // Upstream produced text or reasoning output but missed the terminal frame; recover cleanly with [DONE].
+            enqueue(controller, "data: [DONE]\n\n");
+            settle(200);
+            controller.close();
           } else {
             fail(controller, "upstream SSE ended before a terminal event", "upstream_sse_truncated");
           }

package/src/server/chat-native.ts

@@ -50,7 +50,7 @@ import { enrichOpenCodeZenFreeTierMessage } from "../providers/opencode-zen-rate
 import type { OcxProviderTransport } from "../providers/xai-transport";
 import type { RouteResult } from "../router";
 import type { OcxConfig, OcxProviderConfig } from "../types";
-import { fetchWithHeaderTimeout, providerFetch, safeHostLabel } from "./responses/fetch-helpers";
+import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { linkAbortSignal } from "./responses";
 import {
   addFinalRequestLog,
@@ -351,9 +351,15 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
                 if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
                 if (init.signal?.aborted) throw init.signal.reason;
                 noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
-                const dispatched = await ((activeProvider as OcxProviderTransport).fetch ?? execute)(request.url, applyUpstreamRecoveryInit({
-                  ...init, method: request.method, headers, body: request.body,
-                }, transportRecovery));
+                // A reselected provider transport is still a physical send: the connection policy
+                // and manual-redirect ownership wrap the selected implementation (#4992).
+                const dispatched = await sendWithConnectionPolicy(
+                  (activeProvider as OcxProviderTransport).fetch ?? execute,
+                  request.url,
+                  applyUpstreamRecoveryInit({
+                    ...init, method: request.method, headers, body: request.body,
+                  }, transportRecovery),
+                );
                 if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
                 return dispatched;
               },

package/src/server/claude-messages.ts

@@ -790,6 +790,22 @@ async function handleClaudeMessagesWithBudget(
 
   if (!requestedModel) requestedModel = (anthropicBody as Rec).model as string;
   const stream = internalBody.stream === true;
+  /**
+   * This proxy's count of the prompt it is about to forward, computed at most once.
+   *
+   * Two readers want it and they want it under different rules. The usage log takes it as a
+   * floor only for estimated-usage adapters, because its merge is `max(reported, estimate)` and
+   * would otherwise overwrite real usage. `message_start` takes it whenever the upstream sent
+   * no confirmed usage before the first frame, where nothing is merged and the terminal
+   * `message_delta` still corrects it (#4857).
+   */
+  let requestTokenFloor: number | undefined;
+  const claudeRequestTokenFloor = (): number => {
+    if (requestTokenFloor === undefined) {
+      requestTokenFloor = estimateClaudeRequestTokens(anthropicBody as Rec, requestedModel);
+    }
+    return requestTokenFloor;
+  };
   // Routed adapters only support streamed turns; always stream internally and fold
   // the translated Anthropic SSE into a message JSON for non-streaming clients.
   internalBody.stream = true;
@@ -815,7 +831,7 @@ async function handleClaudeMessagesWithBudget(
     // accurate-usage adapters — the request-log merge is max(reported, estimate) and
     // would overwrite real usage (audit 133 R1#7).
     if (route.provider.adapter === "cursor" || route.provider.adapter === "kiro") {
-      logCtx.usageLogInputTokens = estimateClaudeRequestTokens(anthropicBody as Rec, requestedModel);
+      logCtx.usageLogInputTokens = claudeRequestTokenFloor();
     }
     // Effort safety valve (devlog 136 B6, audit 139 R2#2): opus-shaped aliases make
     // every routed model look like a reasoning model to Claude clients, so a forced
@@ -988,7 +1004,13 @@ async function handleClaudeMessagesWithBudget(
 
   const contentType = response.headers.get("content-type") ?? "";
   if (contentType.includes("text/event-stream") && response.body) {
-    const anthropicSse = responsesSseToAnthropicSse(response.body, requestedModel, { translatorBudget });
+    const anthropicSse = responsesSseToAnthropicSse(response.body, requestedModel, {
+      translatorBudget,
+      // Only a floor, and only for the first frame: an upstream that reports usage early wins
+      // over it inside the translator, and the terminal `message_delta` carries the
+      // authoritative count either way (#4857).
+      inputTokenFloor: claudeRequestTokenFloor(),
+    });
     if (stream) {
       return new Response(anthropicSse, {
         status: 200,

package/src/server/gui-static.ts

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { extname, isAbsolute, join, relative, resolve } from "node:path";
+import { basename, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { browserSecurityHeaders } from "./auth-cors";
 import type { GuiSessionBootstrap } from "./gui-session";
 
@@ -18,6 +18,12 @@ const MIME_TYPES: Record<string, string> = {
   ".ico": "image/x-icon",
 };
 
+/**
+ * Matches Vite's content-hashed bundle filenames (e.g. `index-B5r7LNHN.js` or `style-D5SiRo8X.css`).
+ * Unhashed static assets (e.g. `runtime-config.js` or unversioned icons) must not be cached immutably.
+ */
+const HASHED_ASSET_PATTERN = /-[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9]+$/;
+
 function findGuiDist(): string | null {
   const candidates = [
     join(import.meta.dir, "..", "..", "gui", "dist"),
@@ -146,6 +152,14 @@ export function serveSessionBootstrap(session: GuiSessionBootstrap): Response {
   return htmlDocumentResponse(html);
 }
 
+/**
+ * Serves a GUI static file from the distribution directory.
+ * Returns a Response with MIME type and appropriate Cache-Control headers:
+ * - HTML files receive `no-store` to guarantee immediate bootstrap updates.
+ * - Content-hashed bundles under `assets/` receive 1-year `immutable` caching.
+ * - Non-hashed static files (e.g. favicon, unhashed assets) receive `no-cache` for prompt revalidation.
+ * Returns null if the file cannot be found or resolved.
+ */
 export function serveGuiFile(
   pathname: string,
   guiDist = findGuiDist(),
@@ -170,11 +184,31 @@ export function serveGuiFile(
   const ext = extname(filePath);
   const contentType = MIME_TYPES[ext] || "application/octet-stream";
   if (ext === ".html") return htmlResponse(filePath, session, runtimeRole, managementAuthRequired);
+
+  const root = resolve(guiDist);
+  // "assets/" matches Vite's default assetsDir (gui/vite.config.ts). If that value is
+  // ever changed, update this prefix to match. filePath is already resolve()-normalized
+  // by resolveGuiFilePath, so rel cannot contain ".." fragments.
+  //
+  // Immutable 1-year caching is only applied when the file is under assets/ AND its basename
+  // matches Vite's content-hash pattern (e.g. index-B5r7LNHN.js). Any unhashed asset under
+  // assets/ (e.g. runtime-config.js) or elsewhere falls back to no-cache so clients revalidate,
+  // whereas index.html uses no-store above to avoid storing any bootstrap state.
+  const rel = relative(root, filePath).replace(/\\/g, "/");
+  const isHashedAsset = rel.startsWith("assets/") && HASHED_ASSET_PATTERN.test(basename(filePath));
+  const cacheControl = isHashedAsset
+    ? "public, max-age=31536000, immutable"
+    : "no-cache";
+
   // Snapshot bytes before returning the response. Bun.file is lazy: if gui/dist is replaced
   // after Bun frames the response but before the stream finishes, its Content-Length can
   // describe the old file while the body comes from the new one (#2792).
   return new Response(readFileSync(filePath), {
-    headers: { "Content-Type": contentType, ...browserSecurityHeaders() },
+    headers: {
+      "Content-Type": contentType,
+      "Cache-Control": cacheControl,
+      ...browserSecurityHeaders(),
+    },
   });
 }
 

package/src/server/inbound-body-admission.ts

@@ -0,0 +1,187 @@
+import {
+  MAX_CONFIGURABLE_INBOUND_BODY_BYTES,
+  MAX_DECOMPRESSED_BODY_BYTES,
+  resolveInboundBodyLimitBytes,
+} from "./request-decompress";
+import { withCors, type RequestPolicyView } from "./auth-cors";
+import { codexCompatibleUrl } from "../codex/context-compat";
+import { addFinalRequestLog, markLocalRequestLogRefusal } from "./request-log";
+import type { WorkflowRefusalLog } from "./workflow-refusal";
+
+/** Admission units, not a bound on process RSS or the size of parsed object graphs. */
+export const MAX_CONCURRENT_INBOUND_BODY_BYTES = MAX_CONFIGURABLE_INBOUND_BODY_BYTES;
+let reservedInboundBodyBytes = 0;
+
+// Match the HTTP routes whose JSON readers use maxInboundBodyBytes. Keep the
+// current image/search/count_tokens support; management, audio, context relay,
+// and WebSocket frames have separate limits and are not part of this gate.
+// Exported so the contract tests classify the dispatcher's own route list
+// instead of copying it: a new loopback route has to land in one of these two
+// sets, or `tests/server/server-request-body-size.test.ts` fails.
+export const CONFIGURABLE_JSON_BODY_ROUTES: ReadonlySet<string> = new Set([
+  "/v1/responses",
+  "/v1/responses/compact",
+  "/v1/chat/completions",
+  "/v1/messages",
+  "/v1/messages/count_tokens",
+  "/v1/images/generations",
+  "/v1/images/edits",
+  "/v1/alpha/search",
+]);
+
+/**
+ * Loopback routes deliberately outside this gate. Audio uploads, realtime/live
+ * control and the model list do not read JSON under `maxInboundBodyBytes`, so
+ * reserving that allowance for them would refuse traffic the limit never covered.
+ */
+export const UNGATED_LOOPBACK_ROUTES: ReadonlySet<string> = new Set([
+  "/v1/audio/transcriptions",
+  "/v1/audio/transcriptions/stream",
+  "/v1/models",
+  "/v1/realtime",
+  "/v1/realtime/calls",
+  "/v1/live",
+]);
+
+export class InboundBodyCapacityError extends Error {
+  constructor() {
+    super("OpenCodex inbound request body capacity is temporarily exhausted. Retry after the current request completes.");
+    this.name = "InboundBodyCapacityError";
+  }
+}
+
+function cancelUnreadBody(req: Request, reason: unknown): void {
+  if (!req.body || req.body.locked) return;
+  try {
+    // A tee's cancellation can wait for the other branch. Refusal must not wait
+    // for a peer that has not finished uploading, or for an unconsumed clone.
+    void req.body.cancel(reason).catch(() => undefined);
+  } catch { /* Non-standard streams may throw synchronously. */ }
+}
+
+function capacityResponse(pathname: string, error: InboundBodyCapacityError): Response {
+  const anthropic = pathname === "/v1/messages" || pathname === "/v1/messages/count_tokens";
+  return Response.json({
+    ...(anthropic ? { type: "error" } : {}),
+    error: {
+      type: anthropic ? "overloaded_error" : "server_error",
+      code: "server_busy",
+      message: error.message,
+    },
+  }, { status: 503, headers: { "Retry-After": "1" } });
+}
+
+function retainUntilResponseSettles(response: Response, release: () => void): Response {
+  if (!response.body) {
+    release();
+    return response;
+  }
+  const reader = response.body.getReader();
+  let cancelling = false;
+  let finalized = false;
+  const finalize = (): void => {
+    if (finalized) return;
+    finalized = true;
+    try { reader.releaseLock(); } finally { release(); }
+  };
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const result = await reader.read();
+        // cancel() can resolve a pending read as EOF before the producer's
+        // asynchronous cancellation completes. Only cancel owns release then.
+        if (cancelling) return;
+        if (result.done) {
+          finalize();
+          controller.close();
+        } else {
+          controller.enqueue(result.value);
+        }
+      } catch (error) {
+        if (cancelling) return;
+        finalize();
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      cancelling = true;
+      try { await reader.cancel(reason); } finally { finalize(); }
+    },
+  }, { highWaterMark: 0 });
+  // This is the outermost HTTP wrapper, after protocol conversion, relay
+  // preflight and request logging; no internal relay marker is consumed later.
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+/**
+ * Own one raised-limit HTTP request from before body reading through response
+ * EOF/error or settled cancellation. Call only at the admitted HTTP boundary,
+ * after auth/origin checks, not from readers or internal combo/translation hops.
+ * pathname is the same canonical pathname used by the server's dispatcher.
+ */
+export async function withRaisedInboundBodyAdmission(
+  req: Request,
+  pathname: string,
+  configuredLimit: number | undefined,
+  work: () => Promise<Response>,
+  onRefusal: (response: Response) => Response = response => response,
+): Promise<Response> {
+  const maxBytes = resolveInboundBodyLimitBytes(configuredLimit);
+  if (req.method !== "POST" || !CONFIGURABLE_JSON_BODY_ROUTES.has(pathname)
+    || maxBytes <= MAX_DECOMPRESSED_BODY_BYTES || req.signal.aborted) {
+    return work();
+  }
+  const declared = req.headers.get("content-length");
+  const declaredBytes = declared === null || declared.trim() === "" ? NaN : Number(declared);
+  if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
+    // The existing bounded reader rejects this before allocating. Let its
+    // protocol-specific 413 win over temporary capacity refusal, unchanged.
+    return work();
+  }
+  if (maxBytes > MAX_CONCURRENT_INBOUND_BODY_BYTES - reservedInboundBodyBytes) {
+    const error = new InboundBodyCapacityError();
+    cancelUnreadBody(req, error);
+    return onRefusal(capacityResponse(pathname, error));
+  }
+  reservedInboundBodyBytes += maxBytes;
+  let released = false;
+  const release = (): void => {
+    if (released) return;
+    released = true;
+    reservedInboundBodyBytes -= maxBytes;
+  };
+  try {
+    return retainUntilResponseSettles(await work(), release);
+  } catch (error) {
+    release();
+    throw error;
+  }
+}
+
+/**
+ * The admitted HTTP call site. Refusal is recorded as a local terminal and
+ * carries the receiving listener's CORS headers, so a browser dashboard can
+ * read it. No request content is read or logged on this path.
+ */
+export function runAdmittedBodyWork(
+  req: Request,
+  policy: RequestPolicyView,
+  configuredLimit: number | undefined,
+  work: () => Promise<Response>,
+  refusalLog?: WorkflowRefusalLog,
+): Promise<Response> {
+  return withRaisedInboundBodyAdmission(req, codexCompatibleUrl(req.url).pathname, configuredLimit, work, refused => {
+    if (refusalLog) {
+      markLocalRequestLogRefusal(refusalLog.logCtx, "server_busy");
+      refusalLog.logCtx.errorCode = "server_busy";
+      addFinalRequestLog(refusalLog.requestId, refusalLog.start, refusalLog.logCtx, refused.status, {
+        closeReason: "terminal",
+      });
+    }
+    return withCors(refused, req, policy);
+  });
+}

package/src/server/index/websocket-handler.ts

@@ -1,3 +1,7 @@
+import { nativeSteeringUnavailableReason, nativeResponseControlMode, type NativeResponseControl } from "../responses/native-response-control";
+import { NativeInjectionChannel } from "../responses/native-injection";
+import { NativeSteeringChannel, NativeSteeringError } from "../responses/native-steering";
+import { createNativeSteeringLogObserver } from "../responses/native-steering-log";
 import type { Server, ServerWebSocket } from "bun";
 import {
   LIVE_SIDEBAND_UPSTREAM_OPEN_TIMEOUT_MS,
@@ -188,11 +192,47 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
         } catch {
           return; // text-only contract; ignore unparseable frames
         }
+        if (frame.type === "response.inject" || frame.type === "response.steer" || (frame.type === "response.create" && ws.data.nativeControl)) {
+          try {
+            if (frame.type === "response.inject") {
+              if (!ws.data.nativeControl?.inject) throw new NativeSteeringError("injection_not_supported", "Native injection is disabled or unavailable on this route.");
+              ws.data.nativeControl.inject(frame);
+              return;
+            }
+            if (frame.type === "response.steer") {
+              if (!ws.data.nativeControl) throw new NativeSteeringError("steering_not_supported", ws.data.nativeSteeringUnavailable ?? "Native steering transport is unavailable; the route may be unsupported or using HTTP fallback.");
+              ws.data.nativeControl.steer(frame);
+              return;
+            }
+            if (ws.data.nativeControl?.continue(frame)) return;
+          } catch (error) {
+            sendJsonFrame(ws, buildWsErrorFrame(400, {
+              type: "invalid_request_error",
+              code: error instanceof NativeSteeringError ? error.code : "native_steering_error",
+              message: error instanceof NativeSteeringError ? error.message : "Native steering transport failed; delivery may be unknown. Do not automatically replay input.",
+            }));
+            return;
+          }
+        }
         if (frame.type === "response.processed") return; // ack — no-op
         if (frame.type !== "response.create") return;
         markActivity("ws response.create");
 
+        let nativeControl: NativeResponseControl | undefined;
+        try {
+          const idleMs = typeof config.stallTimeoutSec === "number" && Number.isFinite(config.stallTimeoutSec)
+            ? Math.max(1, config.stallTimeoutSec) * 1000 : 300_000;
+          const mode = nativeResponseControlMode(frame, config);
+          nativeControl = mode === "injection" ? new NativeInjectionChannel(frame, idleMs)
+            : mode === "steering" ? new NativeSteeringChannel(frame, idleMs) : undefined;
+        } catch {
+          sendJsonFrame(ws, buildWsErrorFrame(400, { type: "invalid_request_error", message: "Invalid native steering request settings" }));
+          return;
+        }
         ws.data.cancel?.();
+        // A superseded turn must not keep ownership during warmup or refusal.
+        ws.data.nativeControl = undefined;
+        ws.data.nativeSteeringUnavailable = nativeSteeringUnavailableReason(frame, config.codexNativeSteering);
         const turnId = (ws.data.turnId ?? 0) + 1;
         ws.data.turnId = turnId;
         const isCurrent = () => ws.data.turnId === turnId;
@@ -227,6 +267,8 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
           return;
         }
 
+        // Only a genuinely admitted turn may receive steering or continuations.
+        ws.data.nativeControl = nativeControl;
         const payload: Record<string, unknown> = { ...frame };
         delete payload.type;
         turnAdmissionLease.bindAbortController(turnAbort);
@@ -267,6 +309,7 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
               ...(wsAdmission ? { admission: wsAdmission } : {}),
               forceEmptyResponseId: true,
               inboundTransport: "websocket",
+              nativeControl,
               abortSignal: turnAbort.signal,
               turnAdmissionLease,
               onFirstOutput: () => recordFirstOutput(logCtx, start),
@@ -277,7 +320,10 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
               },
             });
             await sendResponseToWebSocket(ws, response, isCurrent, {
-              onSsePayload: payload => inspectResponseLogSsePayload(logCtx, payload),
+              untilEof: nativeControl?.relayActive === true,
+              onSsePayload: nativeControl?.relayActive
+                ? createNativeSteeringLogObserver(logCtx, () => recordFirstOutput(logCtx, start))
+                : payload => inspectResponseLogSsePayload(logCtx, payload),
               onTerminal: status => {
                 terminalRecorder?.(status, logCtx.terminalHttpStatus);
                 finalizeLog(httpStatusForRequestLogTerminal(status, logCtx), {
@@ -313,6 +359,7 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
             }
           } finally {
             turnAdmissionLease.release();
+            if (ws.data.nativeControl === nativeControl) ws.data.nativeControl = undefined;
             if (!logged && turnAbort.signal.aborted) finalizeLog(499);
             if (ws.data.cancel === cancelTurn) ws.data.cancel = undefined;
           }

package/src/server/index.ts

@@ -1,5 +1,6 @@
 import { remoteWorkspaceEnabled } from "../remote-control/workspace-activation";
 import { AuxiliaryListenerBindError } from "./ports";
+import { runAdmittedBodyWork } from "./inbound-body-admission";
 import {
   buildWarmupCompletionFrames,
   buildWsErrorFrame,
@@ -106,7 +107,6 @@ export {
   unregisterTurn,
 } from "./lifecycle";
 import {
-  addFinalRequestLog,
   hydrateRequestLogsFromDisk,
   httpStatusForRequestLogTerminal,
   inspectResponseLogSsePayload,
@@ -116,8 +116,8 @@ import {
   type RequestLogEntry,
 } from "./request-log";
 import { sessionLaneIdFromRequest } from "./request-log-conversation";
-import { admitWorkflowTurn, type WorkflowLane } from "../lib/workflow-budget";
-import { workflowRefusalResponse, type WorkflowRefusalLog } from "./workflow-refusal";
+import { configureSharedSpendLedger, spendPolicyFromConfig } from "../lib/spend-reservation-ledger";
+import { admitHttpWorkflowTurn, workflowDecisionRefusalResponse, type WorkflowRefusalLog } from "./workflow-refusal";
 export {
   addFinalRequestLog,
   filterRequestLogs,
@@ -181,7 +181,7 @@ import {
   type NativeMainStartupLifecycle,
 } from "../codex/native-profile-startup";
 import { EXTERNAL_CALL_PREFIX, LiveCallBindings } from "./live-call-bindings";
-import { codexCompatibleUrl, contextEndpoint, contextRelayActivated } from "../codex/context-compat";
+import { contextEndpoint, contextRelayActivated } from "../codex/context-compat";
 import { fetchAllModels, handleManagementAPI, VERSION, type ManagementApiDeps } from "./management-api";
 import {
   createManagementSessionControl,
@@ -225,7 +225,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   warnPlaintextV2AgentMessagesStartup(config);
   warnAgentTaskRecoveryStartup(config);
   setLiveStateStoreConfig(config);
-  applyProxyEnv(config);
+  applyProxyEnv(config, true);
   assertServerAuthConfig(config);
   const managementAuth = deps.managementAuthState ?? initializeManagementAuthState(config);
   const managementSessionControl = createManagementSessionControl(managementAuth);
@@ -299,6 +299,12 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   registerAppOwnedMemorySweepFallback();
   configureAppOwnedMemoryBudget(resolveAppOwnedMemoryBudgetBytes(config.appOwnedMemoryBudgetMb));
   enforceAppOwnedMemoryBudget();
+  // Operator token ceilings (#4546). Applied before the listener binds: the shared ledger is
+  // built on the first reservation, and a request arriving before this ran would build it with
+  // no policy and enforce nothing. An absent `spend` section resolves to the unconfigured
+  // default, which refuses nothing and opens no journal -- so on an install that never wrote
+  // the key this line changes no behaviour at all.
+  configureSharedSpendLedger(spendPolicyFromConfig(config.spend));
   registerCodexCooldownRecoveryProbeWorker(config);
   // Issue #42 Phase 3: opt-in archived auto-cleanup (default OFF). Unref'd hourly
   // tick for daily/weekly; startup evaluation is fire-and-forget after listen.
@@ -498,28 +504,18 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   ): Promise<Response> {
     const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
     if (!lease) return serverBusyResponse(req, "active turns", policy);
-    // A fan-out shares the conversation it serves. Without a reserve, a worker burst takes every
-    // slot under its own root and the interactive turn that started it waits behind its own
-    // children. A request that names a parent is treated as that fan-out; a top-level request is
-    // the conversation and may use the reserved slots.
-    const workflowRootId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
-    const workflowThreadId = req.headers.get("thread-id")?.trim() || undefined;
-    const workflowLane: WorkflowLane = workflowRootId !== undefined
-      && workflowThreadId !== undefined
-      && workflowThreadId !== workflowRootId
-      ? "worker"
-      : "interactive";
-    const workflow = admitWorkflowTurn(workflowRootId, workflowLane, undefined, workflowThreadId);
+    // Root, lane, and the refusal that follows from them, all live in ./workflow-refusal.
+    const workflow = admitHttpWorkflowTurn(req.headers);
     if (workflow && !workflow.admitted) {
       lease.release();
       // withCors, because without Access-Control-Allow-Origin the exposed refusal header is
       // still unreadable to a browser dashboard -- which made exposing it pointless.
-      return withCors(workflowRefusalResponse(workflow.reason, undefined, refusalLog), req, policy);
+      return withCors(workflowDecisionRefusalResponse(workflow, undefined, refusalLog), req, policy);
     }
     const releaseWorkflow = (): void => { if (workflow?.admitted) workflow.lease.release(); };
     let response: Response;
     try {
-      response = await work(lease);
+      response = await runAdmittedBodyWork(req, policy, config.maxInboundBodyBytes, () => work(lease), refusalLog);
     } catch (error) {
       releaseWorkflow();
       lease.release();

package/src/server/management/api-access.ts

@@ -1,7 +1,6 @@
 import type { OcxConfig } from "../../types";
 import { isWildcardHostname } from "../../codex/loopback-target";
-import { localInferenceDestination } from "../../lib/local-destinations";
-import { probeHostname } from "../proxy-liveness";
+import { localCredentialDestinationHostname, localInferenceDestination } from "../../lib/local-destinations";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers-destination";
 import { LIVE_AUDIO_MODEL, TRANSCRIPTION_MODEL } from "../audio-upstream";
 
@@ -95,7 +94,7 @@ export function resolveApiAccessBaseUrl(
   const port = config.port ?? 10100;
 
   if (!isWildcardBindHost(config.hostname)) {
-    return `http://${probeHostname(config.hostname)}:${port}/v1`;
+    return `http://${localCredentialDestinationHostname(config.hostname)}:${port}/v1`;
   }
 
   const fromOrigin = opts.requestOrigin ? originBaseUrl(opts.requestOrigin) : null;
@@ -140,7 +139,7 @@ export function resolveApiAccessDisplayHost(
   opts: BuildApiAccessEndpointsOptions = {},
 ): string {
   if (!isWildcardBindHost(configHostname)) {
-    return probeHostname(configHostname);
+    return localCredentialDestinationHostname(configHostname);
   }
   try {
     return new URL(resolveApiAccessBaseUrl({ hostname: configHostname, port: 10100 }, opts)).hostname