@bitkyc08/opencodex 2.63.0 → 2.64.0

package/src/server/chat-native.ts

@@ -32,6 +32,7 @@ import {
   REPLAY_REFUSAL_CLIENT_HEADERS,
   REPLAY_REFUSED_STATUS,
   retainReplayRefusal,
+  UpstreamRetryEvidenceError,
   type UpstreamSendRecovery,
   UPSTREAM_RESET_REPLAY_REFUSED_CODE,
 } from "../lib/upstream-retry";
@@ -48,6 +49,7 @@ import {
   transientRetryPolicyFor,
 } from "../providers/key-failover";
 import { fastPolicyForModel } from "../providers/service-tier";
+import { stampApiKeyAccountLabel } from "../providers/label";
 import { providerApiKeySelectionIsCurrent, resolveCurrentProviderApiKeyTransport } from "../providers/api-key-selection";
 import { enrichOpenCodeZenFreeTierMessage } from "../providers/opencode-zen-rate-limit";
 import type { OcxProviderTransport } from "../providers/xai-transport";
@@ -68,12 +70,16 @@ import {
 } from "./request-log";
 import { jsonCompletionSse, nativeChatSse, structuredError, usageFromChat } from "./chat-native-sse";
 import { registerTurn, unregisterTurn } from "./lifecycle";
+import { attachRequestSpendTracker } from "./responses/request-spend";
+import { workflowRefusalResponse } from "./workflow-refusal";
 
 type Rec = Record<string, unknown>;
 
 const MAX_NATIVE_CHAT_JSON_BYTES = 32 * 1024 * 1024;
 const MAX_NATIVE_CHAT_ERROR_BYTES = 64 * 1024;
 
+class NativeChatSpendRefusal extends Error {}
+
 const chatEffortSnapshots = new WeakMap<Rec, {
   inputModel: string;
   providerName: string;
@@ -262,6 +268,8 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
   const proactiveKeyProvider = selectProactiveApiKeyTransport(config, route.providerName, route.provider);
   if (proactiveKeyProvider) route.provider = proactiveKeyProvider;
   let activeProvider: OcxProviderConfig = route.provider;
+  stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
+  const spendTracker = attachRequestSpendTracker(req, logCtx);
   let activeAdapter: ProviderAdapter = createOpenAIChatAdapter(activeProvider);
   let activeRequest: AdapterRequest;
   let retainedRequestBytes = 0;
@@ -339,6 +347,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
                     throw new Error("Provider key selection is no longer available for native Chat");
                   }
                   activeProvider = current;
+                  stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
                   activeAdapter = createOpenAIChatAdapter(current);
                   activeRequest.releaseBodyObservation?.();
                   releaseRetainedRequest();
@@ -353,6 +362,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
                 const encoding = new Headers(init.headers).get("accept-encoding");
                 if (!headers.has("accept-encoding") && encoding) headers.set("accept-encoding", encoding);
                 if (init.signal?.aborted) throw init.signal.reason;
+                if (!spendTracker.charge()) throw new NativeChatSpendRefusal();
                 noteProviderAttemptSend(logCtx, route.providerName, activeProvider, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
                 // A reselected provider transport is still a physical send: the connection policy
                 // and manual-redirect ownership wrap the selected implementation (#4992).
@@ -432,6 +442,7 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
       if (!transientSendAvailable()) break;
       try { void response.body?.cancel().catch(() => {}); } catch { /* already closed */ }
       activeProvider = rotated;
+      stampApiKeyAccountLabel(logCtx, route.providerName, activeProvider);
       activeAdapter = createOpenAIChatAdapter(activeProvider);
       releaseRetainedRequest();
       activeRequest = buildActiveRequest();
@@ -443,6 +454,12 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
     cleanupAbort();
     upstream.abort();
     if (req.signal.aborted) return fail(499, "Client cancelled request", "client_cancelled");
+    const sendError = error instanceof UpstreamRetryEvidenceError ? error.cause : error;
+    if (sendError instanceof NativeChatSpendRefusal) {
+      const refusal = workflowRefusalResponse("workflow-spend-exhausted", logCtx);
+      finishLog(429);
+      return refusal;
+    }
     if (isTranslatorBudgetExceededError(error)) {
       return fail(413, "request translation buffer exceeded the safe limit", "request_too_large", "translation_buffer_limit");
     }

package/src/server/claude-messages.ts

@@ -740,9 +740,10 @@ async function handleClaudeMessagesWithBudget(
       );
       if (claudeConversationId) logCtx.conversationId = claudeConversationId;
     }
-    // A fast row blocks passthrough, unlike the chat case: this path forwards to Anthropic's
-    // own API, whose wire has no service_tier field and whose FastWire kind has an empty
-    // adapter set by design, so the tier would be silently dropped.
+    // A fast row blocks passthrough, unlike the chat case: native passthrough forwards the
+    // caller's body with the caller's credential and never runs the Anthropic adapter, so the
+    // proxy-owned `speed` + beta (anthropic-speed wire) and its usage.speed observation would be
+    // silently skipped. Translation reaches the adapter, which owns both.
     if (!effortRow && !fastRow && isRec(anthropicBody) && wantsNativePassthrough(req, config, requestPolicy, anthropicBody.model)) {
       return await anthropicNativePassthrough(req, config, logCtx, logIds, anthropicBody, "/v1/messages");
     }

package/src/server/direct-local-http.ts

@@ -6,6 +6,7 @@ const DIRECT_LOCAL_HTTP_TIMEOUT_MS = 10_000;
 type DirectLocalHttpIo = {
   timeoutMs?: number;
   connect?: (hostname: string, port: number) => Socket;
+  scheduleDeadline?: (onTimeout: () => void, timeoutMs: number) => () => void;
 };
 
 function abortReason(signal: AbortSignal): Error {
@@ -270,18 +271,22 @@ export async function directLocalHttpFetch(
   return await new Promise<Response>((resolve, reject) => {
     let socket: Socket | undefined;
     let settled = false;
+    let closed = false;
+    let completed = false;
+    let outcomeError: Error | undefined;
+    let cancelDeadline: (() => void) | undefined;
     let receivedBytes = 0;
     let responseBytes = Buffer.allocUnsafe(4 * 1024);
     let framing: ResponseFraming = { kind: "head", searchFrom: 0 };
-    const cleanup = () => {
+    const disableSocketTimeout = () => { socket?.setTimeout(0); };
+    const settleAfterClose = (deadlineError?: Error) => {
+      if (!settled || (!closed && !deadlineError) || completed) return;
+      completed = true;
+      // Framing may finish before close, so the caller's deadline owns teardown too.
       signal?.removeEventListener("abort", onAbort);
-      socket?.setTimeout(0);
-    };
-    const finish = (error?: Error) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      try { socket?.destroy(); } catch { /* ignore */ }
+      cancelDeadline?.();
+      cancelDeadline = undefined;
+      const error = outcomeError ?? deadlineError;
       if (error) {
         reject(error);
         return;
@@ -292,9 +297,28 @@ export async function directLocalHttpFetch(
         reject(parseError instanceof Error ? parseError : new Error(String(parseError)));
       }
     };
+    const finish = (error?: Error) => {
+      if (settled) return;
+      settled = true;
+      outcomeError = error;
+      disableSocketTimeout();
+      try { socket?.destroy(); } catch (destroyError) {
+        settleAfterClose(error ?? (destroyError instanceof Error ? destroyError : new Error(String(destroyError))));
+        return;
+      }
+      settleAfterClose();
+    };
     const onAbort = () => {
       const error = signal ? abortReason(signal) : new Error("direct local HTTP request aborted");
+      if (settled) outcomeError ??= error;
+      else finish(error);
+      if (error.name === "TimeoutError") settleAfterClose(error);
+    };
+    const onDeadline = () => {
+      const error = new Error("direct local HTTP request timed out");
+      error.name = "TimeoutError";
       finish(error);
+      settleAfterClose(error);
     };
 
     socket = (io.connect ?? ((host, selectedPort) => net.createConnection({
@@ -302,17 +326,9 @@ export async function directLocalHttpFetch(
       port: selectedPort,
       autoSelectFamily: true,
     })))(hostname, port);
-    socket.setTimeout(timeoutMs, () => {
-      const error = new Error("direct local HTTP request timed out");
-      error.name = "TimeoutError";
-      finish(error);
-    });
-    signal?.addEventListener("abort", onAbort, { once: true });
-    if (signal?.aborted) {
-      onAbort();
-      return;
-    }
+    socket.setTimeout(timeoutMs, onDeadline);
     socket.on("connect", () => {
+      if (settled) return;
       try { socket?.write(requestBytes); } catch (error) {
         finish(error instanceof Error ? error : new Error(String(error)));
       }
@@ -342,6 +358,16 @@ export async function directLocalHttpFetch(
     });
     socket.once("end", () => finish());
     socket.once("error", error => finish(error));
-    socket.once("close", () => finish());
+    socket.once("close", () => {
+      closed = true;
+      finish();
+      settleAfterClose();
+    });
+    cancelDeadline = (io.scheduleDeadline ?? ((callback, delayMs) => {
+      const timer = setTimeout(callback, delayMs);
+      return () => clearTimeout(timer);
+    }))(onDeadline, timeoutMs);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) onAbort();
   });
 }

package/src/server/gui-session.ts

@@ -239,10 +239,8 @@ function findPairingGrant(
   state: GuiSessionState,
 ): [string, GuiPairingGrantRecord] | null {
   const digest = pairingGrantDigest(grant);
-  for (const [candidate, record] of state.pairingGrants) {
-    if (equalSecret(candidate, digest)) return [candidate, record];
-  }
-  return null;
+  const record = state.pairingGrants.get(digest);
+  return record ? [digest, record] : null;
 }
 
 function consumeGrantRateSlot(state: GuiSessionState, now: number): void {
@@ -341,19 +339,12 @@ export function consumeGuiPairingGrant(
     tailscaleUser: null,
     browserOrigin,
   };
-  const sourceRecord = attemptContext
-    ? pairingSourceAttempts.get(state)?.get(pairingSourceKey(context))
-    : undefined;
-  if (sourceRecord && sourceRecord.windowStartedAt + PAIRING_SOURCE_WINDOW_MS > now
-    && sourceRecord.failures >= PAIRING_SOURCE_FAILURE_LIMIT) {
-    return {
-      allowed: false,
-      retryAfterSeconds: Math.max(1, Math.ceil((sourceRecord.windowStartedAt + PAIRING_SOURCE_WINDOW_MS - now) / 1000)),
-      reason: "source",
-    };
-  }
+  // Source throttling is only a cost bound for invalid guesses. Look up the grant
+  // first so callers sharing a proxy address cannot lock out a valid redemption.
   const found = findPairingGrant(grant, state);
   if (!found) {
+    // Cross-origin browser requests must not create limiter state as a side effect.
+    if (!isRemoteGuiBrowserOriginAllowed(browserOrigin, config)) return null;
     const source = recordSourceFailure(state, context, now);
     return attemptContext && !source.allowed ? source : null;
   }

package/src/server/index/package-tree-guard.ts

@@ -0,0 +1,53 @@
+import {
+  createRuntimePackageTreeIntegrityGuard,
+  type PackageTreeIntegrityGuard,
+} from "../../lib/package-tree-integrity";
+import { acceptSystemRestart } from "../management/system-restart";
+import { inspectNativeCodexOwnership } from "../../integrations/native/ownership-preflight";
+import { detectInstall } from "../../update/index";
+import type { StartServerDeps } from "./startup-warnings";
+
+// Production guard wiring for the package-tree integrity fence. Tests inject
+// deps.packageTreeIntegrity and never reach this path; everything else is the
+// same default the inline construction used to build.
+export function createPackageTreeIntegrityGuardForServer(
+  deps: StartServerDeps,
+  serviceHomeOwned: () => boolean = deps.packageTreeServiceHomeOwned
+    ?? (() => inspectNativeCodexOwnership().ownership === "owned"),
+  isServiceChild: () => boolean = deps.packageTreeServiceChild ?? (() => process.env.OCX_SERVICE === "1"),
+): PackageTreeIntegrityGuard {
+  if (deps.packageTreeIntegrity) {
+    return deps.packageTreeIntegrity;
+  }
+  const acceptPackageTreeRestart = deps.acceptSystemRestart ?? acceptSystemRestart;
+  let vetoAcceptedRestart: (() => void) | undefined;
+  const guard = createRuntimePackageTreeIntegrityGuard(
+    deps.packageTreeInstaller ?? detectInstall(),
+    deps.observePackageTree,
+    undefined,
+    {
+      ...deps.packageTreeIntegrityOptions,
+      onReplaced: () => {
+        // An out-of-band install replaced the package under this live process. Serve
+        // the 503 for the triggering request, then let the standard drain-and-restart
+        // path bring the new tree up instead of refusing traffic until a manual
+        // restart. acceptSystemRestart is idempotent and supervisor-aware.
+        const beforeScheduledDrain = () => !isServiceChild() || serviceHomeOwned();
+        if (!beforeScheduledDrain()) throw new Error("service home ownership changed");
+        acceptPackageTreeRestart(undefined, {
+          onAccepted: veto => { vetoAcceptedRestart = veto; },
+          beforeScheduledDrain,
+        });
+      },
+    },
+  );
+  return {
+    status: () => guard.status(),
+    installedVersion: () => guard.installedVersion?.(),
+    dispose: () => {
+      guard.dispose();
+      vetoAcceptedRestart?.();
+      vetoAcceptedRestart = undefined;
+    },
+  };
+}

package/src/server/index/serve-options.ts

@@ -168,6 +168,7 @@ import {
 } from "../../lib/local-management-attestation";
 import { SYSTEM_RESTART_CAPABILITY_VERSION } from "../../lib/system-restart-contract";
 import { LOCAL_PROVIDER_RELOAD_CAPABILITY_VERSION } from "../../lib/local-provider-reload-contract";
+import { LOCAL_ASIDE_SYNC_CAPABILITY_VERSION } from "../../lib/local-aside-sync-contract";
 import {
   GUI_PAIR_BROWSER_ORIGIN_HEADER,
   GUI_PAIR_CAPABILITY_VERSION,
@@ -350,20 +351,32 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         || readyzPath !== undefined
         || url.pathname.startsWith("/v1/")
       )) {
-        const message = "OpenCodex package files changed while this proxy was running; restart OpenCodex before retrying.";
-        const response = url.pathname === "/healthz" || readyzPath !== undefined
+        const message = "OpenCodex package files changed while this proxy was running; it restarts on its own, or run 'ocx restart' ('ocx service restart' for a background service).";
+        const fencedPort = ctx.boundPort ?? requestServer.port ?? listenPort;
+        const fencedHealth = url.pathname === "/healthz";
+        const response = fencedHealth || readyzPath !== undefined
           ? jsonResponse({
               status: "restart_required",
               service: "opencodex",
               version: VERSION,
               uptime: process.uptime(),
               pid: process.pid,
-              port: ctx.boundPort ?? requestServer.port ?? listenPort,
+              port: fencedPort,
+              // Identity stays attestable while readiness is fenced (#5496): the CLI can only
+              // restart or stop what it can prove it owns, and an unverified 503 body is not proof.
+              // installedVersion is what an in-place respawn will run from the replaced tree.
+              ...(fencedHealth ? {
+                restartCapability: SYSTEM_RESTART_CAPABILITY_VERSION,
+                installedVersion: packageTreeIntegrity.installedVersion?.(),
+              } : {}),
               error: { code: "package_tree_changed", message },
             }, 503, req, policy)
           : packageTreeChangedResponse(req, policy, message);
         const headers = new Headers(response.headers);
         headers.set("Retry-After", "5");
+        const challenge = fencedHealth ? req.headers.get(LOCAL_ATTESTATION_CHALLENGE_HEADER) : null;
+        const proof = challenge ? createLocalAttestationProof(localAttestationSecret, challenge, process.pid, fencedPort) : null;
+        if (proof) headers.set(LOCAL_ATTESTATION_PROOF_HEADER, proof);
         return new Response(response.body, { status: 503, headers });
       }
 
@@ -565,6 +578,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           port: healthPort,
           restartCapability: SYSTEM_RESTART_CAPABILITY_VERSION,
           providerReloadCapability: LOCAL_PROVIDER_RELOAD_CAPABILITY_VERSION,
+          asideSyncCapability: LOCAL_ASIDE_SYNC_CAPABILITY_VERSION,
           guiPairCapability: GUI_PAIR_CAPABILITY_VERSION,
         }, 200, req, policy);
         const challenge = req.headers.get(LOCAL_ATTESTATION_CHALLENGE_HEADER);

package/src/server/index/startup-warnings.ts

@@ -6,6 +6,11 @@ import {
   type OwnershipInspection,
 } from "../../integrations/native/ownership-preflight";
 import { registerCodexQuotaAutoRefreshWorker } from "../../codex/quota-auto-refresh";
+import type {
+  ObservePackageTree,
+  PackageTreeIntegrityOptions,
+  PackageTreeRuntimeInstall,
+} from "../../lib/package-tree-integrity";
 import {
   consumeForInspection,
   relaySseWithHeartbeat,
@@ -141,6 +146,18 @@ export interface StartServerDeps {
   readinessGate?: ReadinessGate;
   /** Test-only package-tree observation; production captures package.json identity at boot. */
   packageTreeIntegrity?: PackageTreeIntegrityGuard;
+  /** Test-only default-guard options; production observes the installed package manifest. */
+  packageTreeIntegrityOptions?: PackageTreeIntegrityOptions;
+  /** Test-only installed-package identity; production detects the current install. */
+  packageTreeInstaller?: PackageTreeRuntimeInstall;
+  /** Test-only manifest observer; production stats the installed package.json. */
+  observePackageTree?: ObservePackageTree;
+  /** Test-only restart acceptor; production uses the normal drain-and-restart path. */
+  acceptSystemRestart?: typeof import("../management/system-restart").acceptSystemRestart;
+  /** Test-only: whether this process is a service child, for the package-tree restart. */
+  packageTreeServiceChild?: () => boolean;
+  /** Test-only: whether this service child still owns its service home. */
+  packageTreeServiceHomeOwned?: () => boolean;
   /** Test-only seam for observing quota-worker registration ownership. */
   registerCodexQuotaAutoRefreshWorker?: typeof registerCodexQuotaAutoRefreshWorker;
 }

package/src/server/index.ts

@@ -78,6 +78,7 @@ export {
 import { resolveGuiFilePath, rootFallbackPayload, serveGuiFile, serveSessionBootstrap } from "./gui-static";
 export { resolveGuiFilePath, rootFallbackPayload } from "./gui-static";
 export { resolveAdapter } from "./adapter-resolve";
+export { noteExplicitShutdownRequested } from "./management/system-restart";
 import { formatErrorResponse, type ResponsesTerminalStatus } from "../bridge";
 import {
   drainAndShutdown,
@@ -193,13 +194,9 @@ import {
   createLocalAttestationSecret,
 } from "../lib/local-management-attestation";
 import { createReadinessGate, type ReadinessGate } from "./readiness";
-import {
-  createRuntimePackageTreeIntegrityGuard,
-  type PackageTreeIntegrityGuard,
-} from "../lib/package-tree-integrity";
-import { detectInstall } from "../update/index";
 import { createServeOptions, type ServerIngress } from "./index/serve-options";
 import { createClaudeInterceptLifecycle } from "./index/claude-intercept-lifecycle";
+import { createPackageTreeIntegrityGuardForServer } from "./index/package-tree-guard";
 import { inspectStartupOwnership, resolveInboundBodyLimitWithWarning, setStartupCacheInvalidationWrite, warnAgentTaskRecoveryStartup, warnPlaintextV2AgentMessagesStartup, type StartServerDeps } from "./index/startup-warnings";
 import { acquireSpendLedgerServerLifecycle, recordFailedStartRollback, type SpendLedgerServerLifecycle } from "./index/spend-ledger-lifecycle";
 export { waitForFailedStartRollback } from "./index/spend-ledger-lifecycle";
@@ -255,10 +252,10 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   const resolveServiceHomes = deps.resolveServiceHomes ?? currentServiceHomes;
   let startupOwnershipHomes: ReturnType<typeof currentServiceHomes> | null = null;
   let startupOwnershipStatePaths: readonly string[] | null = null;
-  // #2923: both synchronous startup ownership decisions keep their fresh,
-  // race-sensitive targeted task query. Only the expensive fallback listing is
-  // shared, and only while that targeted result stays byte-for-byte unchanged.
-  // Runtime ownership retries below intentionally omit this startup-local memo.
+  // #2923: retain a successful fallback listing only within the first startup
+  // ownership decision. A targeted query's bytes are not a Task Scheduler state
+  // generation, so the later race-sensitive decision must take a fresh listing.
+  // Runtime ownership retries below intentionally omit this startup-local memo too.
   const startupWindowsTaskListingCache = createWindowsTaskListingCache();
   try {
     const homes = resolveServiceHomes();
@@ -320,12 +317,13 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   const listenPort = port ?? config.port ?? 10100;
   setCorsOrigin(listenPort);
 
-  // Canonicalize an explicit "localhost" bind to IPv4 so it matches the injected base_url (which
+  // Canonicalize an explicit "localhost" bind (including its fully-qualified spelling) to IPv4
+  // so it matches the injected base_url (which
   // resolves localhost→127.0.0.1): on Windows `localhost` resolves ::1-first, but the injected URL
   // is 127.0.0.1, so binding literal "localhost" would reintroduce the F4 refusal. Wildcards
   // (0.0.0.0/::) and specific hosts are left untouched so intentional exposure is preserved.
   const configuredHost = config.hostname?.trim();
-  const bindHost = !configuredHost || /^localhost$/i.test(configuredHost) ? "127.0.0.1" : configuredHost;
+  const bindHost = !configuredHost || /^localhost\.?$/i.test(configuredHost) ? "127.0.0.1" : configuredHost;
 
   // Unauthenticated loopback listener (#1102). Off unless explicitly enabled.
   // A port-less enabled entry is the companion form: same port as the public listener, on
@@ -515,16 +513,14 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
       // still unreadable to a browser dashboard -- which made exposing it pointless.
       return withCors(workflowDecisionRefusalResponse(workflow, undefined, refusalLog), req, policy);
     }
-    const releaseWorkflow = (): void => { if (workflow?.admitted) workflow.lease.release(); };
+    if (workflow?.admitted) lease.attach(workflow.lease);
     let response: Response;
     try {
       response = await runAdmittedBodyWork(req, policy, config.maxInboundBodyBytes, () => work(lease), refusalLog);
     } catch (error) {
-      releaseWorkflow();
       lease.release();
       throw error;
     }
-    releaseWorkflow();
     if (!lease.isTransferred()) {
       lease.release();
     }
@@ -537,8 +533,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
   // passes it in, and transitions it after the post-startup sync settles. When
   // no gate is supplied (tests, ad-hoc starts) a fresh pending gate is created.
   const readinessGate = deps.readinessGate ?? createReadinessGate();
-  const packageTreeIntegrity = deps.packageTreeIntegrity
-    ?? createRuntimePackageTreeIntegrityGuard(detectInstall());
+  const packageTreeIntegrity = createPackageTreeIntegrityGuardForServer(deps);
   // Actual bound port, filled in after Bun.serve binds so /readyz reports the
   // real ephemeral port for startServer(0). /healthz keeps its existing port
   // field (the requested listenPort) byte-for-byte.
@@ -554,7 +549,6 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     deps,
     startupOwnershipHomes,
     startupOwnershipStatePaths,
-    startupWindowsTaskListingCache,
   );
   const preparedNativeMainLifecycle = nativeOwnership.ownership !== "foreign"
     && startupOwnershipHomes !== null
@@ -757,6 +751,10 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     value: async (closeActiveConnections?: boolean): Promise<void> => {
       remoteWorkspaceStopping = true;
       liveCallBindings.clear();
+      // Disarm the package-tree restart timer before listener teardown: a queued
+      // replacement callback must not call acceptSystemRestart() after stop() has
+      // begun, or it would schedule a drain-and-restart on a stopped server.
+      packageTreeIntegrity.dispose();
       // The orchestration lives in `runListenerShutdown` so its two competing properties —
       // cleanup completes, failure propagates — are testable without a live socket.
       await runListenerShutdown(

package/src/server/lifecycle.ts

@@ -35,6 +35,7 @@ export const MAX_ACTIVE_SESSION_LANES = 64;
 export const SESSION_LANE_ID_BYTES = 32;
 const turnGate = createAdmissionGate("active_turns", MAX_ACTIVE_TURNS);
 export interface ActiveTurnLease extends AdmissionLease {
+  attach(lease: AdmissionLease): void;
   bindAbortController(ac: AbortController): void;
   beginCodexAccountSelection(): CodexAccountSelectionAdmission;
   isTransferred(): boolean;
@@ -190,10 +191,15 @@ export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
     }
   }
   const controllers = new Set<AbortController>();
+  const attachedLeases = new Set<AdmissionLease>();
   let active = true;
   let transferred = false;
   let nativeMainClaimed = false;
   const lease: ActiveTurnLease = {
+    attach(attachedLease) {
+      if (!active) attachedLease.release();
+      else attachedLeases.add(attachedLease);
+    },
     bindAbortController(ac) {
       knownTurnControllers.add(ac);
       if (!active) {
@@ -238,6 +244,8 @@ export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
         if (activeTurns.get(controller) === lease) activeTurns.delete(controller);
       }
       controllers.clear();
+      for (const attachedLease of attachedLeases) attachedLease.release();
+      attachedLeases.clear();
       nativeMainTurns.delete(lease);
       if (opaqueSessionLaneId) {
         const currentRefCount = activeSessionLaneRefCounts.get(opaqueSessionLaneId);

package/src/server/live.ts

@@ -27,7 +27,7 @@ import { codexCompatibleUrl } from "../codex/context-compat";
  * - `GET /v1/realtime?model=` — RealtimeV2 standalone (no intent)
  * - `GET /v1/live?model=` — Frameless standalone
  */
-import { appendFileSync } from "node:fs";
+import { closeSync, fchmodSync, fstatSync, openSync, statSync, writeSync } from "node:fs";
 import { formatErrorResponse } from "../bridge";
 import {
   CodexAccountCooldownError,
@@ -42,6 +42,7 @@ import {
 import { formatCodexProviderForLog } from "../codex/routing";
 import { cancelBodyOnAbort, signalWithTimeout } from "../lib/abort";
 import { sidecarEnter } from "../lib/sidecar-tracker";
+import { hardenSecretPath } from "../lib/windows-secret-acl";
 import type { OcxConfig } from "../types";
 import { resolveFirstUsableOpenAiSidecar, selectOpenAiImagesProvider } from "../providers/openai-sidecar";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential, type DataPlaneAdmission } from "./auth-cors";
@@ -103,9 +104,58 @@ export const LIVE_CLIENT_PROTOCOL_HEADERS = [
  * JSONL record: direction, frame kind, byte length, and whether the payload contains U+FFFD.
  * Privacy: no frame content is written, including excerpts around replacement characters.
  * For binary frames, U+FFFD may also be introduced by UTF-8 decoding; the flag alone does not
- * identify the source of corruption. Disabled entirely when the env var is unset.
+ * identify the source of corruption. The log is created with owner-only permissions and is
+ * disabled entirely when the env var is unset.
  */
 export const LIVE_FRAME_LOG_ENV = "OCX_LIVE_FRAME_LOG";
+/**
+ * Append one JSONL record with owner-only permissions. `appendFileSync`'s `mode` only applies
+ * when it creates the file, so an existing permissive log would stay readable by other local
+ * users. Open for append, harden the target, and verify that the path still names
+ * the opened file before writing. A failed harden or identity check writes nothing. On Windows
+ * the hardened file's identity is remembered, so a replaced file is hardened again but an
+ * unchanged one does not spawn icacls for every frame.
+ */
+/** Windows ACL hardening spawns icacls; remember the file already hardened so frames do not. */
+let hardenedWindowsFrameLog: { path: string; dev: bigint; ino: bigint } | undefined;
+
+export function appendOwnerOnly(
+  path: string,
+  line: string,
+  harden: (fd: number, path: string) => void = hardenLogDescriptor,
+  platform: NodeJS.Platform = process.platform,
+): void {
+  const fd = openSync(path, "a", 0o600);
+  try {
+    const before = fstatSync(fd, { bigint: true });
+    const memo = hardenedWindowsFrameLog;
+    const alreadyHardened = platform === "win32" && memo !== undefined && memo.path === path
+      && before.ino !== 0n && memo.dev === before.dev && memo.ino === before.ino;
+    if (!alreadyHardened) {
+      hardenedWindowsFrameLog = undefined;
+      harden(fd, path);
+    }
+    const opened = fstatSync(fd, { bigint: true });
+    const named = statSync(path, { bigint: true });
+    if (!opened.isFile() || !named.isFile() || opened.ino === 0n || named.ino === 0n
+      || opened.dev !== named.dev || opened.ino !== named.ino) {
+      throw new Error("Frame log path changed during hardening.");
+    }
+    if (platform === "win32") hardenedWindowsFrameLog = { path, dev: opened.dev, ino: opened.ino };
+    writeSync(fd, line);
+  } finally {
+    closeSync(fd);
+  }
+}
+
+function hardenLogDescriptor(fd: number, path: string): void {
+  if (process.platform === "win32") {
+    hardenSecretPath(path, { required: true });
+    return;
+  }
+  fchmodSync(fd, 0o600);
+}
+
 export function logLiveSidebandFrame(dir: "c2u" | "u2c", data: unknown): void {
   const logPath = process.env[LIVE_FRAME_LOG_ENV];
   if (!logPath) return;
@@ -134,7 +184,7 @@ export function logLiveSidebandFrame(dir: "c2u" | "u2c", data: unknown): void {
       bytes,
       fffd,
     };
-    appendFileSync(logPath, `${JSON.stringify(record)}\n`);
+    appendOwnerOnly(logPath, `${JSON.stringify(record)}\n`);
   } catch {
     // Frame forensics must never break the relay.
   }
@@ -168,7 +218,7 @@ export function logLiveSidebandStage(
     const record: Record<string, unknown> = { ts: new Date().toISOString(), stage };
     if (detail?.status !== undefined) record.status = detail.status;
     if (detail?.code !== undefined) record.code = detail.code;
-    appendFileSync(logPath, JSON.stringify(record) + "\n");
+    appendOwnerOnly(logPath, JSON.stringify(record) + "\n");
   } catch {
     // Diagnostics must never break the relay.
   }