@bitkyc08/opencodex 2.58.0 → 2.60.0

package/src/server/index/serve-options.ts

@@ -37,6 +37,7 @@ import {
   type WsData,
 } from "../ws-bridge";
 import { websocketsEnabled } from "../../config";
+import { metricsExportEnabled } from "../../config/feature-flags";
 import { grokDefaultReasoningEffort } from "../../grok/effort";
 import { OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers";
 import { providerCodexAccountMode } from "../../providers/registry";
@@ -84,6 +85,7 @@ import {
 } from "../request-log";
 import { sessionLaneIdFromRequest } from "../request-log-conversation";
 import { responseWithDeferredRequestLog } from "../relay";
+import { createRequestMetricsOwner } from "../request-metrics";
 import {
   corsHeaders,
   managementCorsHeaders,
@@ -266,6 +268,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
     port,
   } = ctx;
   void port;
+  const requestMetrics = metricsExportEnabled(config) ? createRequestMetricsOwner() : undefined;
+  const requestMetricsLogContext = requestMetrics ? { requestMetricsRecorder: requestMetrics } : {};
+  const requestManagementApiDeps: ManagementApiDeps = requestMetrics
+    ? { ...managementApiDeps, requestMetrics: { snapshot: () => requestMetrics.snapshot() } }
+    : managementApiDeps;
   const serveOptions = {
       idleTimeout: 255,
       // Bun rejects an oversized body before `fetch` runs, so the listener has to be raised
@@ -616,7 +623,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             }), req, config);
           }
         }
-        const mgmtResponse = await handleManagementAPI(req, url, config, managementApiDeps, principal, managementSessionControl);
+        const mgmtResponse = await handleManagementAPI(req, url, config, requestManagementApiDeps, principal, managementSessionControl);
         if (mgmtResponse) return withManagementCors(mgmtResponse, req, config);
         return withManagementCors(formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`), req, config);
       }
@@ -1197,6 +1204,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "unknown",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
           inboundProtocol: "responses",
         };
@@ -1233,6 +1241,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "image_gen",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
         };
         const endpoint = url.pathname.endsWith("/edits") ? "edits" as const : "generations" as const;
@@ -1290,6 +1299,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "context_history",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
         };
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
@@ -1316,6 +1326,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "web_search",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
         };
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
@@ -1340,6 +1351,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "unknown",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
           inboundProtocol: "responses",
         };
@@ -1347,29 +1359,41 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         let logged = false;
         const finalizeNativePassthroughLog = (
           status: number,
-          meta: { terminalStatus?: ResponsesTerminalStatus; closeReason: "terminal" | "client_cancel" },
+          meta: Pick<RequestLogEntry, "terminalStatus" | "closeReason">,
         ) => {
           if (logged) return;
           logged = true;
           addFinalRequestLog(requestId, start, logCtx, status, meta);
         };
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
-          const response = await handleResponses(req, config, logCtx, {
-            turnAdmissionLease,
-            admission,
-            onRequestBodyRead: () => disableResponsesRequestTimeout(req, requestServer),
-            abortSignal: req.signal,
-            onFirstOutput: () => recordFirstOutput(logCtx, start),
-            onNativePassthroughTerminal: status => {
-              finalizeNativePassthroughLog(httpStatusForRequestLogTerminal(status, logCtx), {
-                terminalStatus: status,
-                closeReason: "terminal",
-              });
-            },
-            onNativePassthroughCancel: () => {
-              finalizeNativePassthroughLog(499, { closeReason: "client_cancel" });
-            },
-          });
+          let response: Response;
+          try {
+            response = await handleResponses(req, config, logCtx, {
+              turnAdmissionLease,
+              admission,
+              onRequestBodyRead: () => disableResponsesRequestTimeout(req, requestServer),
+              abortSignal: req.signal,
+              onFirstOutput: () => recordFirstOutput(logCtx, start),
+              onNativePassthroughTerminal: status => {
+                finalizeNativePassthroughLog(httpStatusForRequestLogTerminal(status, logCtx), {
+                  terminalStatus: status,
+                  closeReason: "terminal",
+                });
+              },
+              onNativePassthroughCancel: () => {
+                finalizeNativePassthroughLog(499, { closeReason: "client_cancel" });
+              },
+            });
+          } catch (error) {
+            // A bounded upstream body can fail before handleResponses returns a client response.
+            // Finalize before rethrow so accounting observes the physical send while the caller
+            // retains the existing reset/rejection instead of receiving a synthesized response.
+            finalizeNativePassthroughLog(
+              req.signal.aborted ? 499 : 502,
+              { closeReason: req.signal.aborted ? "client_cancel" : "non_stream" },
+            );
+            throw error;
+          }
           return withRequestLogId(
             withCors(responseWithDeferredRequestLog(response, requestId, start, logCtx), req, policy),
             requestId,
@@ -1414,6 +1438,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "unknown",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
           inboundProtocol: "messages",
         };
@@ -1443,6 +1468,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "unknown",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
           inboundProtocol: "chat",
         };
@@ -1466,7 +1492,12 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         }
         const start = Date.now();
         const requestId = nextRequestLogId(start);
-        const logCtx: RequestLogContext = { model: TRANSCRIPTION_MODEL, provider: "unknown", ...admissionFields(admission) };
+        const logCtx: RequestLogContext = {
+          model: TRANSCRIPTION_MODEL,
+          provider: "unknown",
+          ...requestMetricsLogContext,
+          ...admissionFields(admission),
+        };
         return runAdmittedHttpTurn(req, policy, async lease => {
           const response = await handleAudioTranscriptions(req, config, logCtx, admission, lease);
           addFinalRequestLog(requestId, start, logCtx, response.status);
@@ -1497,6 +1528,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "gpt-live",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
         };
         return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
@@ -1544,10 +1576,23 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         const logCtx: RequestLogContext = {
           model: "gpt-live",
           provider: "unknown",
+          ...requestMetricsLogContext,
           ...admissionFields(admission),
         };
+        let liveRequestFinalized = false;
+        const finalizeLiveRequest = (
+          status: number,
+          meta?: Pick<RequestLogEntry, "terminalStatus" | "closeReason">,
+        ): void => {
+          if (liveRequestFinalized) return;
+          liveRequestFinalized = true;
+          addFinalRequestLog(requestId, start, logCtx, status, meta);
+        };
         const turnAdmissionLease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
-        if (!turnAdmissionLease) return serverBusyResponse(req, "active turns", policy);
+        if (!turnAdmissionLease) {
+          finalizeLiveRequest(503);
+          return serverBusyResponse(req, "active turns", policy);
+        }
         const audioController = audioClient ? new AbortController() : undefined;
         if (audioController) registerTurn(audioController, turnAdmissionLease);
         const acquisition = audioController
@@ -1567,18 +1612,26 @@ export function createServeOptions(ctx: ServeOptionsContext) {
                 ? await resolveLiveSidebandUpgrade(req, config, logCtx, liveSidebandTarget, turnAdmissionLease)
                 : formatErrorResponse(401, "authentication_error", "opencodex API key required");
         } catch (error) {
-          releaseAcquisition();
+          try { releaseAcquisition(); }
+          finally {
+            finalizeLiveRequest(req.signal.aborted ? 499 : 500,
+              req.signal.aborted ? { closeReason: "client_cancel" } : undefined);
+          }
           throw error;
         }
         if (acquisition?.signal.aborted) {
+          const status = req.signal.aborted ? 499 : acquisition.didExpire() ? 504 : 503;
           try { if (!(resolved instanceof Response) && "finish" in resolved) resolved.finish(); }
-          finally { releaseAcquisition(); }
-          return withCors(formatErrorResponse(req.signal.aborted ? 499 : acquisition.didExpire() ? 504 : 503,
+          finally {
+            try { releaseAcquisition(); }
+            finally { finalizeLiveRequest(status, status === 499 ? { closeReason: "client_cancel" } : undefined); }
+          }
+          return withCors(formatErrorResponse(status,
             "upstream_error", acquisition.didExpire() ? "Audio connection timed out" : "Audio connection canceled"), req, policy);
         }
         if (resolved instanceof Response) {
           releaseAcquisition();
-          addFinalRequestLog(requestId, start, logCtx, resolved.status);
+          finalizeLiveRequest(resolved.status);
           return withCors(resolved, req, policy);
         }
         const audio = "finish" in resolved ? resolved : undefined;
@@ -1591,7 +1644,8 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           else releaseAcquisition();
         };
         if (req.signal.aborted) {
-          discardUpgrade();
+          try { discardUpgrade(); }
+          finally { finalizeLiveRequest(499, { closeReason: "client_cancel" }); }
           return withCors(formatErrorResponse(499, "client_closed_request", "Audio connection canceled"), req, policy);
         }
         const upstreamHandshake = await openLiveSidebandUpstream(
@@ -1609,7 +1663,8 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           } else {
             discardUpgrade();
           }
-          addFinalRequestLog(requestId, start, logCtx, upstreamHandshake.status);
+          finalizeLiveRequest(upstreamHandshake.status,
+            upstreamHandshake.status === 499 ? { closeReason: "client_cancel" } : undefined);
           console.error("[live] sideband upstream handshake failed: " + upstreamHandshake.message);
           return withCors(
             formatErrorResponse(upstreamHandshake.status, upstreamHandshake.code, upstreamHandshake.message),
@@ -1625,7 +1680,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             code: "upstream_error",
             message: "voice upstream closed before client upgrade",
           };
-          addFinalRequestLog(requestId, start, logCtx, failure.status);
+          finalizeLiveRequest(failure.status);
           return withCors(formatErrorResponse(failure.status, failure.code, failure.message), req, policy);
         }
         let upgraded = false;
@@ -1657,11 +1712,12 @@ export function createServeOptions(ctx: ServeOptionsContext) {
             /* ignore */
           }
           closeLiveSidebandBeforeUpgrade(upstreamHandshake.socket, () => discardUpgrade());
+          finalizeLiveRequest(502);
           return withCors(formatErrorResponse(502, "upstream_error", "Audio WebSocket upgrade failed"), req, policy);
         }
         if (upgraded) {
           acquisition?.clear();
-          addFinalRequestLog(requestId, start, logCtx, 101);
+          finalizeLiveRequest(101);
           return undefined as unknown as Response;
         }
         try {
@@ -1670,6 +1726,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           /* ignore */
         }
         closeLiveSidebandBeforeUpgrade(upstreamHandshake.socket, () => discardUpgrade());
+        finalizeLiveRequest(426);
         return withCors(formatErrorResponse(426, "upgrade_required", "WebSocket upgrade failed"), req, policy);
       }
 
@@ -1760,7 +1817,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
 
       return withCors(formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`), req, config);
     },
-    websocket: createWebsocketHandler(ctx),
+    websocket: createWebsocketHandler(ctx, requestMetrics),
   } as const;
   return serveOptions;
 }

package/src/server/index/spend-ledger-lifecycle.ts

@@ -0,0 +1,66 @@
+import type { OcxSpendConfig } from "../../types/config";
+import {
+  acquireSpendLedgerOwner,
+  type SpendLedgerOwnerLease,
+} from "../../lib/spend-ledger-owner";
+import {
+  configureSharedSpendLedger,
+  spendPolicyFromConfig,
+} from "../../lib/spend-reservation-ledger";
+
+export interface SpendLedgerServerLifecycle {
+  configure(spend: OcxSpendConfig | undefined): void;
+  track<T extends { stop(closeActiveConnections?: boolean): void | Promise<void> }>(server: T): T;
+  release(): void;
+  releaseAfterFailedStart(): void;
+}
+
+/** Acquire before config loading so every later startup failure has one rollback owner. */
+export function acquireSpendLedgerServerLifecycle(configDir: string): SpendLedgerServerLifecycle {
+  const owner: SpendLedgerOwnerLease = acquireSpendLedgerOwner(configDir);
+  // Each entry returns whatever the listener's own stop returned. Typed as void-or-promise
+  // because the rollback below has to WAIT on it: declaring it `() => void` let the call site
+  // compile while statically erasing the promise it needs to await.
+  const failedStartStops: Array<() => void | Promise<void>> = [];
+  let released = false;
+  const release = (): void => {
+    if (released) return;
+    released = true;
+    owner.release();
+  };
+  return {
+    configure(spend): void {
+      configureSharedSpendLedger(spendPolicyFromConfig(spend));
+    },
+    track<T extends { stop(closeActiveConnections?: boolean): void | Promise<void> }>(server: T): T {
+      // Capture the raw stop before startServer replaces the public method with full teardown.
+      const stop = server.stop.bind(server);
+      failedStartStops.push(() => stop(true));
+      return server;
+    },
+    release,
+    releaseAfterFailedStart(): void {
+      // Every listener that came up is stopped, newest first, and the lease is held until those
+      // stops have actually SETTLED. Bun's Server.stop(true) returns a promise that resolves
+      // once connections are closed, so discarding it handed the state directory back while a
+      // listener could still be serving, which is the one thing single-writer ownership exists
+      // to prevent.
+      //
+      // This stays synchronous and returns void on purpose: startServer must not become async,
+      // so the wait is a continuation rather than an await. Rollback failures are contained
+      // because the startup error that brought us here is the one worth reporting.
+      const settling: Promise<unknown>[] = [];
+      for (const stop of failedStartStops.splice(0).reverse()) {
+        try {
+          const pending = stop();
+          if (pending !== undefined) settling.push(Promise.resolve(pending));
+        } catch { /* a rollback failure must not replace the startup error that caused it */ }
+      }
+      const finish = (): void => {
+        try { release(); } catch { /* same: the startup error is the one that matters */ }
+      };
+      if (settling.length === 0) { finish(); return; }
+      void Promise.allSettled(settling).then(finish);
+    },
+  };
+}

package/src/server/index/websocket-handler.ts

@@ -85,13 +85,17 @@ import {
   resolveLiveSidebandUpgrade,
 } from "../live";
 import type { ServeOptionsContext } from "./serve-options";
+import type { RequestMetricsRecorder } from "../request-metrics";
 
 /**
  * The WebSocket half of the Bun.serve options, split out of serve-options.ts to keep that file
  * under the 2,000-line ratchet threshold. The body is the original handler verbatim; it reads the
  * same startServer context the HTTP half does, so it takes the same context object.
  */
-export function createWebsocketHandler(ctx: ServeOptionsContext) {
+export function createWebsocketHandler(
+  ctx: ServeOptionsContext,
+  requestMetricsRecorder?: RequestMetricsRecorder,
+) {
   const { config, deps } = ctx;
   return {
       maxPayloadLength: MAX_WS_FRAME_BYTES,
@@ -283,6 +287,7 @@ export function createWebsocketHandler(ctx: ServeOptionsContext) {
           const logCtx: RequestLogContext = {
             model: "unknown",
             provider: "unknown",
+            ...(requestMetricsRecorder ? { requestMetricsRecorder } : {}),
             ...(wsAdmission ? admissionFields(wsAdmission) : {}),
             inboundProtocol: "responses",
           };

package/src/server/index.ts

@@ -1,5 +1,6 @@
 import { remoteWorkspaceEnabled } from "../remote-control/workspace-activation";
 import { AuxiliaryListenerBindError } from "./ports";
+import { runAdmittedBodyWork } from "./inbound-body-admission";
 import {
   buildWarmupCompletionFrames,
   buildWsErrorFrame,
@@ -106,7 +107,6 @@ export {
   unregisterTurn,
 } from "./lifecycle";
 import {
-  addFinalRequestLog,
   hydrateRequestLogsFromDisk,
   httpStatusForRequestLogTerminal,
   inspectResponseLogSsePayload,
@@ -116,8 +116,7 @@ import {
   type RequestLogEntry,
 } from "./request-log";
 import { sessionLaneIdFromRequest } from "./request-log-conversation";
-import { admitWorkflowTurn, type WorkflowLane } from "../lib/workflow-budget";
-import { workflowRefusalResponse, type WorkflowRefusalLog } from "./workflow-refusal";
+import { admitHttpWorkflowTurn, workflowDecisionRefusalResponse, type WorkflowRefusalLog } from "./workflow-refusal";
 export {
   addFinalRequestLog,
   filterRequestLogs,
@@ -181,7 +180,7 @@ import {
   type NativeMainStartupLifecycle,
 } from "../codex/native-profile-startup";
 import { EXTERNAL_CALL_PREFIX, LiveCallBindings } from "./live-call-bindings";
-import { codexCompatibleUrl, contextEndpoint, contextRelayActivated } from "../codex/context-compat";
+import { contextEndpoint, contextRelayActivated } from "../codex/context-compat";
 import { fetchAllModels, handleManagementAPI, VERSION, type ManagementApiDeps } from "./management-api";
 import {
   createManagementSessionControl,
@@ -205,8 +204,15 @@ import {
 import { detectInstall } from "../update/index";
 import { createServeOptions, type ServerIngress } from "./index/serve-options";
 import { inspectStartupOwnership, setStartupCacheInvalidationWrite, warnAgentTaskRecoveryStartup, warnPlaintextV2AgentMessagesStartup, type StartServerDeps } from "./index/startup-warnings";
+import { acquireSpendLedgerServerLifecycle, type SpendLedgerServerLifecycle } from "./index/spend-ledger-lifecycle";
 
 export function startServer(port?: number, deps: StartServerDeps = {}): Server<WsData> {
+  const spendLedgerLifecycle = acquireSpendLedgerServerLifecycle(getConfigDir());
+  try { return startServerWithSpendLedgerOwner(port, deps, spendLedgerLifecycle); }
+  catch (error) { spendLedgerLifecycle.releaseAfterFailedStart(); throw error; }
+}
+
+function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartServerDeps, spendLedgerLifecycle: SpendLedgerServerLifecycle): Server<WsData> {
   const localAttestationSecret = deps.localAttestationSecret ?? createLocalAttestationSecret();
   // Captured before loadConfig() starts the optional ACL flight so stop() drains the same dir
   // even if OPENCODEX_HOME changes underneath a long-lived process.
@@ -225,7 +231,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   warnPlaintextV2AgentMessagesStartup(config);
   warnAgentTaskRecoveryStartup(config);
   setLiveStateStoreConfig(config);
-  applyProxyEnv(config);
+  applyProxyEnv(config, true);
   assertServerAuthConfig(config);
   const managementAuth = deps.managementAuthState ?? initializeManagementAuthState(config);
   const managementSessionControl = createManagementSessionControl(managementAuth);
@@ -299,6 +305,8 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   registerAppOwnedMemorySweepFallback();
   configureAppOwnedMemoryBudget(resolveAppOwnedMemoryBudgetBytes(config.appOwnedMemoryBudgetMb));
   enforceAppOwnedMemoryBudget();
+  // Observe-only mode still journals physical sends, so every server owns before configuring.
+  spendLedgerLifecycle.configure(config.spend);
   registerCodexCooldownRecoveryProbeWorker(config);
   // Issue #42 Phase 3: opt-in archived auto-cleanup (default OFF). Unref'd hourly
   // tick for daily/weekly; startup evaluation is fire-and-forget after listen.
@@ -498,28 +506,18 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
   ): Promise<Response> {
     const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
     if (!lease) return serverBusyResponse(req, "active turns", policy);
-    // A fan-out shares the conversation it serves. Without a reserve, a worker burst takes every
-    // slot under its own root and the interactive turn that started it waits behind its own
-    // children. A request that names a parent is treated as that fan-out; a top-level request is
-    // the conversation and may use the reserved slots.
-    const workflowRootId = req.headers.get("x-codex-parent-thread-id")?.trim() || undefined;
-    const workflowThreadId = req.headers.get("thread-id")?.trim() || undefined;
-    const workflowLane: WorkflowLane = workflowRootId !== undefined
-      && workflowThreadId !== undefined
-      && workflowThreadId !== workflowRootId
-      ? "worker"
-      : "interactive";
-    const workflow = admitWorkflowTurn(workflowRootId, workflowLane, undefined, workflowThreadId);
+    // Root, lane, and the refusal that follows from them, all live in ./workflow-refusal.
+    const workflow = admitHttpWorkflowTurn(req.headers);
     if (workflow && !workflow.admitted) {
       lease.release();
       // withCors, because without Access-Control-Allow-Origin the exposed refusal header is
       // still unreadable to a browser dashboard -- which made exposing it pointless.
-      return withCors(workflowRefusalResponse(workflow.reason, undefined, refusalLog), req, policy);
+      return withCors(workflowDecisionRefusalResponse(workflow, undefined, refusalLog), req, policy);
     }
     const releaseWorkflow = (): void => { if (workflow?.admitted) workflow.lease.release(); };
     let response: Response;
     try {
-      response = await work(lease);
+      response = await runAdmittedBodyWork(req, policy, config.maxInboundBodyBytes, () => work(lease), refusalLog);
     } catch (error) {
       releaseWorkflow();
       lease.release();
@@ -707,7 +705,7 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
       get remoteWorkspaceStopping() { return remoteWorkspaceStopping; },
     });
 
-    server = Bun.serve<WsData>({ ...serveOptions, port: listenPort, hostname: bindHost });
+    server = spendLedgerLifecycle.track(Bun.serve<WsData>({ ...serveOptions, port: listenPort, hostname: bindHost }));
 
     // Both binds are one startup transaction (#1102). If the loopback bind fails after the
     // public one succeeded, leaving the public listener up would strand it: the CLI's port
@@ -715,11 +713,11 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     // accumulating listeners. Roll back and rethrow the original error instead.
     if (loopbackListenerPort !== null) {
       try {
-        loopbackServer = Bun.serve<WsData>({
+        loopbackServer = spendLedgerLifecycle.track(Bun.serve<WsData>({
           ...serveOptions,
           port: loopbackListenerPort,
           hostname: "127.0.0.1",
-        });
+        }));
       } catch (error) {
         try {
           // startServer is synchronous, so this rollback cannot await. Bun begins closing the
@@ -735,11 +733,11 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
     }
     if (managementIngressPort !== null) {
       try {
-        managementIngressServer = Bun.serve<WsData>({
+        managementIngressServer = spendLedgerLifecycle.track(Bun.serve<WsData>({
           ...serveOptions,
           port: managementIngressPort,
           hostname: "127.0.0.1",
-        });
+        }));
       } catch (error) {
         // Preserve the management bind failure while synchronously initiating rollback of every
         // listener already opened in this startup transaction. startServer must not become async.
@@ -796,7 +794,8 @@ export function startServer(port?: number, deps: StartServerDeps = {}): Server<W
             // removes the dir right after stop() settles would hit EPERM/EBUSY on Windows
             // otherwise. Runs even when an earlier release rejected — that rejection still
             // propagates, but not before the child is drained.
-            await flushConfigDirHardening(startupConfigDir);
+            try { spendLedgerLifecycle.release(); }
+            finally { await flushConfigDirHardening(startupConfigDir); }
           }
         },
       );

package/src/server/management/api-access.ts

@@ -1,7 +1,6 @@
 import type { OcxConfig } from "../../types";
 import { isWildcardHostname } from "../../codex/loopback-target";
-import { localInferenceDestination } from "../../lib/local-destinations";
-import { probeHostname } from "../proxy-liveness";
+import { localCredentialDestinationHostname, localInferenceDestination } from "../../lib/local-destinations";
 import { isCanonicalOpenAiForwardProvider, OPENAI_API_PROVIDER_ID, OPENAI_CODEX_PROVIDER_ID } from "../../providers/openai-tiers-destination";
 import { LIVE_AUDIO_MODEL, TRANSCRIPTION_MODEL } from "../audio-upstream";
 
@@ -95,7 +94,7 @@ export function resolveApiAccessBaseUrl(
   const port = config.port ?? 10100;
 
   if (!isWildcardBindHost(config.hostname)) {
-    return `http://${probeHostname(config.hostname)}:${port}/v1`;
+    return `http://${localCredentialDestinationHostname(config.hostname)}:${port}/v1`;
   }
 
   const fromOrigin = opts.requestOrigin ? originBaseUrl(opts.requestOrigin) : null;
@@ -140,7 +139,7 @@ export function resolveApiAccessDisplayHost(
   opts: BuildApiAccessEndpointsOptions = {},
 ): string {
   if (!isWildcardBindHost(configHostname)) {
-    return probeHostname(configHostname);
+    return localCredentialDestinationHostname(configHostname);
   }
   try {
     return new URL(resolveApiAccessBaseUrl({ hostname: configHostname, port: 10100 }, opts)).hostname