@bitkyc08/opencodex 2.58.0 → 2.59.0

package/src/server/auth-cors.ts

@@ -1,3 +1,4 @@
+import { providerRelativeSendPathConfigError } from "../config/provider-relative-send-path";
 import { modelCapabilitiesConfigError } from "../config/provider-validation";
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { initialModelSelection } from "../providers/initial-model-selection";
@@ -29,6 +30,7 @@ import {
 } from "../config/provider-validation";
 import { providerDestinationConfigError } from "../lib/destination-policy";
 import { redactSecretString } from "../lib/redact";
+import { DECLARABLE_HOSTED_TOOL_TYPES } from "../responses/hosted-tool-policy";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerCodexAccountMode, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
@@ -754,6 +756,10 @@ export function providerManagementConfigError(
   }
   const destinationError = providerDestinationConfigError(name, typed);
   if (destinationError) return `provider ${name} ${destinationError}`;
+  for (const field of ["responsesPath", "chatCompletionsPath"] as const) {
+    const sendPathError = providerRelativeSendPathConfigError(field, raw[field]);
+    if (sendPathError) return `provider ${JSON.stringify(redactSecretString(name))} ${sendPathError}`;
+  }
   const headersError = providerHeadersConfigError(typed.headers);
   if (headersError) return `provider ${name} ${headersError}`;
   const retryOn429Error = retryOn429PolicyConfigError(raw.retryOn429);
@@ -793,6 +799,8 @@ export function providerManagementConfigError(
   }
   const reasoningSummariesError = booleanRecordConfigError(raw.modelSupportsReasoningSummaries, "modelSupportsReasoningSummaries");
   if (reasoningSummariesError) return `provider ${name} ${reasoningSummariesError}`;
+  const suppressSyntheticMaxError = booleanRecordConfigError(raw.modelSuppressSyntheticMax, "modelSuppressSyntheticMax");
+  if (suppressSyntheticMaxError) return `provider ${name} ${suppressSyntheticMaxError}`;
   const reasoningSummaryDeliveryError = reasoningSummaryDeliveryRecordConfigError(
     raw.modelReasoningSummaryDelivery,
     raw.modelSupportsReasoningSummaries,
@@ -834,6 +842,22 @@ export function providerManagementConfigError(
     "omitReasoningEffortWithToolsModels",
   );
   if (toolReasoningOptOutError) return `provider ${name} ${toolReasoningOptOutError}`;
+  const unsupportedHostedToolsError = nonBlankStringArrayConfigError(
+    raw.unsupportedHostedTools,
+    "unsupportedHostedTools",
+  );
+  if (unsupportedHostedToolsError) return `provider ${name} ${unsupportedHostedToolsError}`;
+  if (Array.isArray(raw.unsupportedHostedTools)) {
+    // Closed vocabulary, same reason as the config schema: an unrecognized name would be
+    // stored and then strip nothing, so the operator would keep getting the upstream 400
+    // this field exists to prevent.
+    const unknownTool = (raw.unsupportedHostedTools as unknown[])
+      .find(tool => typeof tool === "string" && !DECLARABLE_HOSTED_TOOL_TYPES.has(tool.trim()));
+    if (unknownTool !== undefined) {
+      return `provider ${name} unsupportedHostedTools must name only hosted tool types: `
+        + `${[...DECLARABLE_HOSTED_TOOL_TYPES].join(", ")}`;
+    }
+  }
   const openRouterError = openRouterRoutingConfigError(typed);
   if (openRouterError) return `provider ${name} ${openRouterError}`;
   const vercelError = vercelGatewayRoutingConfigError(typed);
@@ -964,6 +988,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   refreshPolicy: "editor",
   reasoningEfforts: "editor",
   modelReasoningEfforts: "editor",
+  modelSuppressSyntheticMax: "editor",
   modelDefaultReasoningEfforts: "editor",
   pinnedReasoningEffort: "editor",
   modelPinnedReasoningEfforts: "editor",
@@ -979,6 +1004,7 @@ const PROVIDER_CONFIG_FIELD_POLICY = {
   xaiResponsesDefaultVersion: "runtime",
   zaiResponsesDefaultVersion: "runtime",
   supportsResponsesCustomTools: "editor",
+  unsupportedHostedTools: "editor",
   responsesSnapshotRepair: "editor",
   webSearchBridge: "editor",
   reasoningEffortMap: "editor",

package/src/server/chat-completions.ts

@@ -150,10 +150,15 @@ async function handleChatCompletionsWithBudget(
   let chatNativeRoute: ReturnType<typeof routeModel> | null = null;
   try {
     const route = routeModel(config, chatBody.model as string, evidenceFromBody(chatBody));
-    route.provider = resolveOpenCodeGoTransport(route.provider, getOrAllocateRequestSessionLane(req));
-    // Settle the wire once so every branch below reads the adapter this model will
-    // actually use, not the provider-wide default (#404).
-    route.provider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider, "chat");
+    // Preserve the routed destination for Go recognition, then settle the wire before
+    // deriving protocol-scoped affinity. Recognition must not inspect the flipped adapter.
+    const routedProvider = route.provider;
+    const wireProvider = resolveWireProtocolOverride(route.providerName, route.modelId, routedProvider, "chat");
+    route.provider = resolveOpenCodeGoTransport(
+      wireProvider,
+      getOrAllocateRequestSessionLane(req),
+      routedProvider,
+    );
     logCtx.model = route.modelId;
     logCtx.providerAdapter = route.provider.adapter;
     logCtx.requestedModel = requestedModel;

package/src/server/chat-native-sse.ts

@@ -152,6 +152,8 @@ export function nativeChatSse(
   let sawFinish = false;
   let sawDone = false;
   let firstOutput = false;
+  let sawTextOutput = false;
+  let sawToolCalls = false;
   let settled = false;
   let cancelled = false;
   let cancelledBySignal = false;
@@ -264,7 +266,7 @@ export function nativeChatSse(
     const choices = Array.isArray(parsed.choices) ? parsed.choices : [];
     const finished = choices.some(choice => isRec(choice) && typeof choice.finish_reason === "string" && choice.finish_reason.length > 0);
     if (finished) sawFinish = true;
-    const hasProgress = choices.some(choice => {
+    const hasText = choices.some(choice => {
       if (!isRec(choice) || !isRec(choice.delta)) return false;
       const delta = choice.delta;
       return (typeof delta.content === "string" && delta.content.length > 0)
@@ -272,15 +274,22 @@ export function nativeChatSse(
         || (typeof delta.reasoning === "string" && delta.reasoning.length > 0)
         || (Array.isArray(delta.reasoning_details) && delta.reasoning_details.some(detail =>
           isRec(detail) && typeof detail.text === "string" && detail.text.length > 0))
-        || (typeof delta.refusal === "string" && delta.refusal.length > 0)
-        || (Array.isArray(delta.tool_calls) && delta.tool_calls.some(tool => {
-          if (!isRec(tool)) return false;
-          const fn = isRec(tool.function) ? tool.function : {};
-          return (typeof tool.id === "string" && tool.id.length > 0)
-            || (typeof fn.name === "string" && fn.name.length > 0)
-            || (typeof fn.arguments === "string" && fn.arguments.length > 0);
-        }));
+        || (typeof delta.refusal === "string" && delta.refusal.length > 0);
     });
+    const hasTool = choices.some(choice => {
+      if (!isRec(choice) || !isRec(choice.delta)) return false;
+      const delta = choice.delta;
+      return Array.isArray(delta.tool_calls) && delta.tool_calls.some(tool => {
+        if (!isRec(tool)) return false;
+        const fn = isRec(tool.function) ? tool.function : {};
+        return (typeof tool.id === "string" && tool.id.length > 0)
+          || (typeof fn.name === "string" && fn.name.length > 0)
+          || (typeof fn.arguments === "string" && fn.arguments.length > 0);
+      });
+    });
+    if (hasText) sawTextOutput = true;
+    if (hasTool) sawToolCalls = true;
+    const hasProgress = hasText || hasTool;
     if (hasProgress || finished) pullDeadline = performance.now() + stallMs;
     else if (performance.now() >= pullDeadline) throw stalled;
     if (!firstOutput && hasProgress) {
@@ -358,6 +367,14 @@ export function nativeChatSse(
             if (!sawDone) enqueue(controller, "data: [DONE]\n\n");
             settle(200);
             controller.close();
+          } else if (sawToolCalls) {
+            // Mid tool-call truncation must fail closed to prevent downstream executing partial arguments.
+            fail(controller, "upstream SSE ended mid tool call without a terminal signal — possible truncation", "upstream_sse_truncated");
+          } else if (sawTextOutput) {
+            // Upstream produced text or reasoning output but missed the terminal frame; recover cleanly with [DONE].
+            enqueue(controller, "data: [DONE]\n\n");
+            settle(200);
+            controller.close();
           } else {
             fail(controller, "upstream SSE ended before a terminal event", "upstream_sse_truncated");
           }

package/src/server/chat-native.ts

@@ -50,7 +50,7 @@ import { enrichOpenCodeZenFreeTierMessage } from "../providers/opencode-zen-rate
 import type { OcxProviderTransport } from "../providers/xai-transport";
 import type { RouteResult } from "../router";
 import type { OcxConfig, OcxProviderConfig } from "../types";
-import { fetchWithHeaderTimeout, providerFetch, safeHostLabel } from "./responses/fetch-helpers";
+import { fetchWithHeaderTimeout, providerFetch, safeHostLabel, sendWithConnectionPolicy } from "./responses/fetch-helpers";
 import { linkAbortSignal } from "./responses";
 import {
   addFinalRequestLog,
@@ -351,9 +351,15 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
                 if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
                 if (init.signal?.aborted) throw init.signal.reason;
                 noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
-                const dispatched = await ((activeProvider as OcxProviderTransport).fetch ?? execute)(request.url, applyUpstreamRecoveryInit({
-                  ...init, method: request.method, headers, body: request.body,
-                }, transportRecovery));
+                // A reselected provider transport is still a physical send: the connection policy
+                // and manual-redirect ownership wrap the selected implementation (#4992).
+                const dispatched = await sendWithConnectionPolicy(
+                  (activeProvider as OcxProviderTransport).fetch ?? execute,
+                  request.url,
+                  applyUpstreamRecoveryInit({
+                    ...init, method: request.method, headers, body: request.body,
+                  }, transportRecovery),
+                );
                 if (!dispatched.ok) await recordKeyAttemptFailure(logCtx, dispatched, init.signal ?? upstream.signal);
                 return dispatched;
               },

package/src/server/claude-messages.ts

@@ -790,6 +790,22 @@ async function handleClaudeMessagesWithBudget(
 
   if (!requestedModel) requestedModel = (anthropicBody as Rec).model as string;
   const stream = internalBody.stream === true;
+  /**
+   * This proxy's count of the prompt it is about to forward, computed at most once.
+   *
+   * Two readers want it and they want it under different rules. The usage log takes it as a
+   * floor only for estimated-usage adapters, because its merge is `max(reported, estimate)` and
+   * would otherwise overwrite real usage. `message_start` takes it whenever the upstream sent
+   * no confirmed usage before the first frame, where nothing is merged and the terminal
+   * `message_delta` still corrects it (#4857).
+   */
+  let requestTokenFloor: number | undefined;
+  const claudeRequestTokenFloor = (): number => {
+    if (requestTokenFloor === undefined) {
+      requestTokenFloor = estimateClaudeRequestTokens(anthropicBody as Rec, requestedModel);
+    }
+    return requestTokenFloor;
+  };
   // Routed adapters only support streamed turns; always stream internally and fold
   // the translated Anthropic SSE into a message JSON for non-streaming clients.
   internalBody.stream = true;
@@ -815,7 +831,7 @@ async function handleClaudeMessagesWithBudget(
     // accurate-usage adapters — the request-log merge is max(reported, estimate) and
     // would overwrite real usage (audit 133 R1#7).
     if (route.provider.adapter === "cursor" || route.provider.adapter === "kiro") {
-      logCtx.usageLogInputTokens = estimateClaudeRequestTokens(anthropicBody as Rec, requestedModel);
+      logCtx.usageLogInputTokens = claudeRequestTokenFloor();
     }
     // Effort safety valve (devlog 136 B6, audit 139 R2#2): opus-shaped aliases make
     // every routed model look like a reasoning model to Claude clients, so a forced
@@ -988,7 +1004,13 @@ async function handleClaudeMessagesWithBudget(
 
   const contentType = response.headers.get("content-type") ?? "";
   if (contentType.includes("text/event-stream") && response.body) {
-    const anthropicSse = responsesSseToAnthropicSse(response.body, requestedModel, { translatorBudget });
+    const anthropicSse = responsesSseToAnthropicSse(response.body, requestedModel, {
+      translatorBudget,
+      // Only a floor, and only for the first frame: an upstream that reports usage early wins
+      // over it inside the translator, and the terminal `message_delta` carries the
+      // authoritative count either way (#4857).
+      inputTokenFloor: claudeRequestTokenFloor(),
+    });
     if (stream) {
       return new Response(anthropicSse, {
         status: 200,

package/src/server/gui-static.ts

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { extname, isAbsolute, join, relative, resolve } from "node:path";
+import { basename, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { browserSecurityHeaders } from "./auth-cors";
 import type { GuiSessionBootstrap } from "./gui-session";
 
@@ -18,6 +18,12 @@ const MIME_TYPES: Record<string, string> = {
   ".ico": "image/x-icon",
 };
 
+/**
+ * Matches Vite's content-hashed bundle filenames (e.g. `index-B5r7LNHN.js` or `style-D5SiRo8X.css`).
+ * Unhashed static assets (e.g. `runtime-config.js` or unversioned icons) must not be cached immutably.
+ */
+const HASHED_ASSET_PATTERN = /-[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9]+$/;
+
 function findGuiDist(): string | null {
   const candidates = [
     join(import.meta.dir, "..", "..", "gui", "dist"),
@@ -146,6 +152,14 @@ export function serveSessionBootstrap(session: GuiSessionBootstrap): Response {
   return htmlDocumentResponse(html);
 }
 
+/**
+ * Serves a GUI static file from the distribution directory.
+ * Returns a Response with MIME type and appropriate Cache-Control headers:
+ * - HTML files receive `no-store` to guarantee immediate bootstrap updates.
+ * - Content-hashed bundles under `assets/` receive 1-year `immutable` caching.
+ * - Non-hashed static files (e.g. favicon, unhashed assets) receive `no-cache` for prompt revalidation.
+ * Returns null if the file cannot be found or resolved.
+ */
 export function serveGuiFile(
   pathname: string,
   guiDist = findGuiDist(),
@@ -170,11 +184,31 @@ export function serveGuiFile(
   const ext = extname(filePath);
   const contentType = MIME_TYPES[ext] || "application/octet-stream";
   if (ext === ".html") return htmlResponse(filePath, session, runtimeRole, managementAuthRequired);
+
+  const root = resolve(guiDist);
+  // "assets/" matches Vite's default assetsDir (gui/vite.config.ts). If that value is
+  // ever changed, update this prefix to match. filePath is already resolve()-normalized
+  // by resolveGuiFilePath, so rel cannot contain ".." fragments.
+  //
+  // Immutable 1-year caching is only applied when the file is under assets/ AND its basename
+  // matches Vite's content-hash pattern (e.g. index-B5r7LNHN.js). Any unhashed asset under
+  // assets/ (e.g. runtime-config.js) or elsewhere falls back to no-cache so clients revalidate,
+  // whereas index.html uses no-store above to avoid storing any bootstrap state.
+  const rel = relative(root, filePath).replace(/\\/g, "/");
+  const isHashedAsset = rel.startsWith("assets/") && HASHED_ASSET_PATTERN.test(basename(filePath));
+  const cacheControl = isHashedAsset
+    ? "public, max-age=31536000, immutable"
+    : "no-cache";
+
   // Snapshot bytes before returning the response. Bun.file is lazy: if gui/dist is replaced
   // after Bun frames the response but before the stream finishes, its Content-Length can
   // describe the old file while the body comes from the new one (#2792).
   return new Response(readFileSync(filePath), {
-    headers: { "Content-Type": contentType, ...browserSecurityHeaders() },
+    headers: {
+      "Content-Type": contentType,
+      "Cache-Control": cacheControl,
+      ...browserSecurityHeaders(),
+    },
   });
 }
 

package/src/server/inbound-body-admission.ts

@@ -0,0 +1,187 @@
+import {
+  MAX_CONFIGURABLE_INBOUND_BODY_BYTES,
+  MAX_DECOMPRESSED_BODY_BYTES,
+  resolveInboundBodyLimitBytes,
+} from "./request-decompress";
+import { withCors, type RequestPolicyView } from "./auth-cors";
+import { codexCompatibleUrl } from "../codex/context-compat";
+import { addFinalRequestLog, markLocalRequestLogRefusal } from "./request-log";
+import type { WorkflowRefusalLog } from "./workflow-refusal";
+
+/** Admission units, not a bound on process RSS or the size of parsed object graphs. */
+export const MAX_CONCURRENT_INBOUND_BODY_BYTES = MAX_CONFIGURABLE_INBOUND_BODY_BYTES;
+let reservedInboundBodyBytes = 0;
+
+// Match the HTTP routes whose JSON readers use maxInboundBodyBytes. Keep the
+// current image/search/count_tokens support; management, audio, context relay,
+// and WebSocket frames have separate limits and are not part of this gate.
+// Exported so the contract tests classify the dispatcher's own route list
+// instead of copying it: a new loopback route has to land in one of these two
+// sets, or `tests/server/server-request-body-size.test.ts` fails.
+export const CONFIGURABLE_JSON_BODY_ROUTES: ReadonlySet<string> = new Set([
+  "/v1/responses",
+  "/v1/responses/compact",
+  "/v1/chat/completions",
+  "/v1/messages",
+  "/v1/messages/count_tokens",
+  "/v1/images/generations",
+  "/v1/images/edits",
+  "/v1/alpha/search",
+]);
+
+/**
+ * Loopback routes deliberately outside this gate. Audio uploads, realtime/live
+ * control and the model list do not read JSON under `maxInboundBodyBytes`, so
+ * reserving that allowance for them would refuse traffic the limit never covered.
+ */
+export const UNGATED_LOOPBACK_ROUTES: ReadonlySet<string> = new Set([
+  "/v1/audio/transcriptions",
+  "/v1/audio/transcriptions/stream",
+  "/v1/models",
+  "/v1/realtime",
+  "/v1/realtime/calls",
+  "/v1/live",
+]);
+
+export class InboundBodyCapacityError extends Error {
+  constructor() {
+    super("OpenCodex inbound request body capacity is temporarily exhausted. Retry after the current request completes.");
+    this.name = "InboundBodyCapacityError";
+  }
+}
+
+function cancelUnreadBody(req: Request, reason: unknown): void {
+  if (!req.body || req.body.locked) return;
+  try {
+    // A tee's cancellation can wait for the other branch. Refusal must not wait
+    // for a peer that has not finished uploading, or for an unconsumed clone.
+    void req.body.cancel(reason).catch(() => undefined);
+  } catch { /* Non-standard streams may throw synchronously. */ }
+}
+
+function capacityResponse(pathname: string, error: InboundBodyCapacityError): Response {
+  const anthropic = pathname === "/v1/messages" || pathname === "/v1/messages/count_tokens";
+  return Response.json({
+    ...(anthropic ? { type: "error" } : {}),
+    error: {
+      type: anthropic ? "overloaded_error" : "server_error",
+      code: "server_busy",
+      message: error.message,
+    },
+  }, { status: 503, headers: { "Retry-After": "1" } });
+}
+
+function retainUntilResponseSettles(response: Response, release: () => void): Response {
+  if (!response.body) {
+    release();
+    return response;
+  }
+  const reader = response.body.getReader();
+  let cancelling = false;
+  let finalized = false;
+  const finalize = (): void => {
+    if (finalized) return;
+    finalized = true;
+    try { reader.releaseLock(); } finally { release(); }
+  };
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const result = await reader.read();
+        // cancel() can resolve a pending read as EOF before the producer's
+        // asynchronous cancellation completes. Only cancel owns release then.
+        if (cancelling) return;
+        if (result.done) {
+          finalize();
+          controller.close();
+        } else {
+          controller.enqueue(result.value);
+        }
+      } catch (error) {
+        if (cancelling) return;
+        finalize();
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      cancelling = true;
+      try { await reader.cancel(reason); } finally { finalize(); }
+    },
+  }, { highWaterMark: 0 });
+  // This is the outermost HTTP wrapper, after protocol conversion, relay
+  // preflight and request logging; no internal relay marker is consumed later.
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+/**
+ * Own one raised-limit HTTP request from before body reading through response
+ * EOF/error or settled cancellation. Call only at the admitted HTTP boundary,
+ * after auth/origin checks, not from readers or internal combo/translation hops.
+ * pathname is the same canonical pathname used by the server's dispatcher.
+ */
+export async function withRaisedInboundBodyAdmission(
+  req: Request,
+  pathname: string,
+  configuredLimit: number | undefined,
+  work: () => Promise<Response>,
+  onRefusal: (response: Response) => Response = response => response,
+): Promise<Response> {
+  const maxBytes = resolveInboundBodyLimitBytes(configuredLimit);
+  if (req.method !== "POST" || !CONFIGURABLE_JSON_BODY_ROUTES.has(pathname)
+    || maxBytes <= MAX_DECOMPRESSED_BODY_BYTES || req.signal.aborted) {
+    return work();
+  }
+  const declared = req.headers.get("content-length");
+  const declaredBytes = declared === null || declared.trim() === "" ? NaN : Number(declared);
+  if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
+    // The existing bounded reader rejects this before allocating. Let its
+    // protocol-specific 413 win over temporary capacity refusal, unchanged.
+    return work();
+  }
+  if (maxBytes > MAX_CONCURRENT_INBOUND_BODY_BYTES - reservedInboundBodyBytes) {
+    const error = new InboundBodyCapacityError();
+    cancelUnreadBody(req, error);
+    return onRefusal(capacityResponse(pathname, error));
+  }
+  reservedInboundBodyBytes += maxBytes;
+  let released = false;
+  const release = (): void => {
+    if (released) return;
+    released = true;
+    reservedInboundBodyBytes -= maxBytes;
+  };
+  try {
+    return retainUntilResponseSettles(await work(), release);
+  } catch (error) {
+    release();
+    throw error;
+  }
+}
+
+/**
+ * The admitted HTTP call site. Refusal is recorded as a local terminal and
+ * carries the receiving listener's CORS headers, so a browser dashboard can
+ * read it. No request content is read or logged on this path.
+ */
+export function runAdmittedBodyWork(
+  req: Request,
+  policy: RequestPolicyView,
+  configuredLimit: number | undefined,
+  work: () => Promise<Response>,
+  refusalLog?: WorkflowRefusalLog,
+): Promise<Response> {
+  return withRaisedInboundBodyAdmission(req, codexCompatibleUrl(req.url).pathname, configuredLimit, work, refused => {
+    if (refusalLog) {
+      markLocalRequestLogRefusal(refusalLog.logCtx, "server_busy");
+      refusalLog.logCtx.errorCode = "server_busy";
+      addFinalRequestLog(refusalLog.requestId, refusalLog.start, refusalLog.logCtx, refused.status, {
+        closeReason: "terminal",
+      });
+    }
+    return withCors(refused, req, policy);
+  });
+}

package/src/server/index.ts

@@ -1,5 +1,6 @@
 import { remoteWorkspaceEnabled } from "../remote-control/workspace-activation";
 import { AuxiliaryListenerBindError } from "./ports";
+import { runAdmittedBodyWork } from "./inbound-body-admission";
 import {
   buildWarmupCompletionFrames,
   buildWsErrorFrame,
@@ -106,7 +107,6 @@ export {
   unregisterTurn,
 } from "./lifecycle";
 import {
-  addFinalRequestLog,
   hydrateRequestLogsFromDisk,
   httpStatusForRequestLogTerminal,
   inspectResponseLogSsePayload,
@@ -116,8 +116,8 @@ import {
   type RequestLogEntry,
 } from "./request-log";
 import { sessionLaneIdFromRequest } from "./request-log-conversation";
-import { admitWorkflowTurn, type WorkflowLane } from "../lib/workflow-budget";
-import { workflowRefusalResponse, type WorkflowRefusalLog } from "./workflow-refusal";
+import { configureSharedSpendLedger, spendPolicyFromConfig } from "../lib/spend-reservation-ledger";
+import { admitHttpWorkflowTurn, workflowDecisionRefusalResponse, type WorkflowRefusalLog } from "./workflow-refusal";
 export {
   addFinalRequestLog,
   filterRequestLogs,
@@ -181,7 +181,7 @@ import {
   type NativeMainStartupLifecycle,
 } from "../codex/native-profile-startup";
 import { EXTERNAL_CALL_PREFIX, LiveCallBindings } from "./live-call-bindings";
-import { codexCompatibleUrl, contextEndpoint, contextRelayActivated } from "../codex/context-compat";
+import { contextEndpoint, contextRelayActivated } from "../codex/context-compat";
 import { fetchAllModels, handleManagementAPI, VERSION, type ManagementApiDeps } from "./management-api";
 import {
   createManagementSessionControl,
@@ -225,7 +225,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   warnPlaintextV2AgentMessagesStartup(config);
   warnAgentTaskRecoveryStartup(config);
   setLiveStateStoreConfig(config);
-  applyProxyEnv(config);
+  applyProxyEnv(config, true);
   assertServerAuthConfig(config);
   const managementAuth = deps.managementAuthState ?? initializeManagementAuthState(config);
   const managementSessionControl = createManagementSessionControl(managementAuth);
@@ -299,6 +299,12 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   registerAppOwnedMemorySweepFallback();
   configureAppOwnedMemoryBudget(resolveAppOwnedMemoryBudgetBytes(config.appOwnedMemoryBudgetMb));
   enforceAppOwnedMemoryBudget();
+  // Operator token ceilings (#4546). Applied before the listener binds: the shared ledger is
+  // built on the first reservation, and a request arriving before this ran would build it with
+  // no policy and enforce nothing. An absent `spend` section resolves to the unconfigured
+  // default, which refuses nothing and opens no journal -- so on an install that never wrote
+  // the key this line changes no behaviour at all.
+  configureSharedSpendLedger(spendPolicyFromConfig(config.spend));
   registerCodexCooldownRecoveryProbeWorker(config);
   // Issue #42 Phase 3: opt-in archived auto-cleanup (default OFF). Unref'd hourly
   // tick for daily/weekly; startup evaluation is fire-and-forget after listen.
@@ -498,28 +504,18 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   ): Promise<Response> {
     const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
     if (!lease) return serverBusyResponse(req, "active turns", policy);
-    // A fan-out shares the conversation it serves. Without a reserve, a worker burst takes every
-    // slot under its own root and the interactive turn that started it waits behind its own
-    // children. A request that names a parent is treated as that fan-out; a top-level request is
-    // the conversation and may use the reserved slots.
-    const workflowRootId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
-    const workflowThreadId = req.headers.get("thread-id")?.trim() || undefined;
-    const workflowLane: WorkflowLane = workflowRootId !== undefined
-      && workflowThreadId !== undefined
-      && workflowThreadId !== workflowRootId
-      ? "worker"
-      : "interactive";
-    const workflow = admitWorkflowTurn(workflowRootId, workflowLane, undefined, workflowThreadId);
+    // Root, lane, and the refusal that follows from them, all live in ./workflow-refusal.
+    const workflow = admitHttpWorkflowTurn(req.headers);
     if (workflow && !workflow.admitted) {
       lease.release();
       // withCors, because without Access-Control-Allow-Origin the exposed refusal header is
       // still unreadable to a browser dashboard -- which made exposing it pointless.
-      return withCors(workflowRefusalResponse(workflow.reason, undefined, refusalLog), req, policy);
+      return withCors(workflowDecisionRefusalResponse(workflow, undefined, refusalLog), req, policy);
     }
     const releaseWorkflow = (): void => { if (workflow?.admitted) workflow.lease.release(); };
     let response: Response;
     try {
-      response = await work(lease);
+      response = await runAdmittedBodyWork(req, policy, config.maxInboundBodyBytes, () => work(lease), refusalLog);
     } catch (error) {
       releaseWorkflow();
       lease.release();

package/src/server/management/api-access.ts

@@ -1,7 +1,6 @@
 import type { OcxConfig } from "../../types";
 import { isWildcardHostname } from "../../codex/loopback-target";
-import { localInferenceDestination } from "../../lib/local-destinations";
-import { probeHostname } from "../proxy-liveness";
+import { localCredentialDestinationHostname, localInferenceDestination } from "../../lib/local-destinations";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers-destination";
 import { LIVE_AUDIO_MODEL, TRANSCRIPTION_MODEL } from "../audio-upstream";
 
@@ -95,7 +94,7 @@ export function resolveApiAccessBaseUrl(
   const port = config.port ?? 10100;
 
   if (!isWildcardBindHost(config.hostname)) {
-    return `http://${probeHostname(config.hostname)}:${port}/v1`;
+    return `http://${localCredentialDestinationHostname(config.hostname)}:${port}/v1`;
   }
 
   const fromOrigin = opts.requestOrigin ? originBaseUrl(opts.requestOrigin) : null;
@@ -140,7 +139,7 @@ export function resolveApiAccessDisplayHost(
   opts: BuildApiAccessEndpointsOptions = {},
 ): string {
   if (!isWildcardBindHost(configHostname)) {
-    return probeHostname(configHostname);
+    return localCredentialDestinationHostname(configHostname);
   }
   try {
     return new URL(resolveApiAccessBaseUrl({ hostname: configHostname, port: 10100 }, opts)).hostname