@bitkyc08/opencodex 2.65.0 → 2.66.0-preview.20260925

package/src/integrations/omp-yaml-source.ts

@@ -80,8 +80,87 @@ function isComment(line: string): boolean {
   return line.trimStart().startsWith("#");
 }
 
+/**
+ * The lexical state a scalar scan carries out of a line. Quoted and plain
+ * scalars may both continue onto later physical lines, so the state persists
+ * across the owned range: a continuation line opening with the scalar's
+ * closing quote is not a new opener — a ` #` behind it is a real comment —
+ * and a `#` on a line still inside an open quote is scalar content, not a
+ * comment.
+ */
+interface ScalarScan {
+  comment: boolean;
+  quote: "'" | "\"" | null;
+  scalarStarted: boolean;
+}
+
+/**
+ * Quote tracking has to work in both directions: a `#` inside a quoted scalar
+ * is content (`"model#variant"`), but a quote inside a plain scalar is also
+ * content — `user's model` is one plain scalar, and treating its `'` as an
+ * opener would hide a real ` #` comment behind quote mode.
+ */
+function scanScalarLine(line: string, quote: "'" | "\"" | null, scalarStarted: boolean): ScalarScan {
+  // A `'` or `"` opens a quoted scalar only where a scalar may begin — after
+  // `key:`, `- `, or a flow indicator — never inside a plain scalar already
+  // in progress.
+  let flowDepth = 0;
+  for (let index = 0; index < line.length; index += 1) {
+    const character = line[index]!;
+    if (quote === "\"") {
+      if (character === "\\") index += 1;
+      else if (character === quote) quote = null;
+      continue;
+    }
+    if (quote === "'") {
+      if (character !== quote) continue;
+      if (line[index + 1] === quote) index += 1;
+      else quote = null;
+      continue;
+    }
+    if (character === "#" && /\s/u.test(line[index - 1] ?? "")) {
+      return { comment: true, quote, scalarStarted };
+    }
+    const next = line[index + 1] ?? "";
+    if (scalarStarted) {
+      // `:` ends a plain scalar where a value boundary follows; inside flow
+      // collections `,`, `]`, and `}` do too.
+      if (character === ":" && (next === "" || /\s/u.test(next))) scalarStarted = false;
+      else if (flowDepth > 0 && (character === "," || character === "]" || character === "}")) {
+        scalarStarted = false;
+        if (character !== ",") flowDepth -= 1;
+      }
+      continue;
+    }
+    if (/\s/u.test(character)) continue;
+    if (character === "'" || character === "\"") {
+      quote = character;
+      continue;
+    }
+    if (character === "[" || character === "{") {
+      flowDepth += 1;
+      continue;
+    }
+    if (character === "]" || character === "}") {
+      flowDepth -= 1;
+      continue;
+    }
+    if (character === ",") continue;
+    // `key:`, `- `, `? `: indicators only where a value boundary follows.
+    if ((character === ":" || character === "-" || character === "?")
+      && (next === "" || /\s/u.test(next))) continue;
+    // Anchors, aliases, and tags decorate the scalar that follows them.
+    if (character === "&" || character === "*" || character === "!") {
+      while (index + 1 < line.length && !/\s/u.test(line[index + 1]!)) index += 1;
+      continue;
+    }
+    scalarStarted = true;
+  }
+  return { comment: false, quote, scalarStarted };
+}
+
 function hasInlineComment(line: string): boolean {
-  return line.includes("#");
+  return scanScalarLine(line, null, false).comment;
 }
 
 function regexpEscape(value: string): string {
@@ -171,16 +250,42 @@ function childEnd(
   parentEnd: number,
   indent: number,
 ): number | null {
+  // Scalar state carries across physical lines: a scalar continuation is
+  // always deeper than the leaf's indent, so a `spaces <= indent` line can
+  // never be one. Inside an open quote a blank or `#`-leading line is scalar
+  // content; inside a plain scalar a blank line folds but a `#` line is still
+  // a real comment.
+  let quote: "'" | "\"" | null = null;
+  let scalarStarted = false;
   for (let index = start + 1; index < parentEnd; index += 1) {
     const body = lines[index]!.body;
     const spaces = leadingSpaces(body);
     if (spaces === null) return null;
     // Blank lines and same-level comments remain outside our replacement.
     // Deeper comments belong to the leaf and would be destroyed, so refuse.
-    if (isBlank(body)) return index;
-    if (isComment(body)) return spaces <= indent ? index : null;
+    if (isBlank(body)) {
+      if (quote !== null) continue;
+      if (!scalarStarted) return index;
+      // A plain scalar's blank line folds only when deeper content follows;
+      // otherwise it is the separator before a sibling and stays outside.
+      let ahead = index + 1;
+      while (ahead < parentEnd && isBlank(lines[ahead]!.body)) ahead += 1;
+      if (ahead >= parentEnd) return index;
+      const nextSpaces = leadingSpaces(lines[ahead]!.body);
+      if (nextSpaces === null) return null;
+      if (nextSpaces <= indent) return index;
+      continue;
+    }
+    if (quote === null && isComment(body)) return spaces <= indent ? index : null;
     if (spaces <= indent) return index;
-    if (hasInlineComment(body)) return null;
+    // A block sequence indicator opens a new node: scalar state never carries
+    // across item boundaries. Inside an open quote a leading `- ` is content.
+    const trimmed = body.trimStart();
+    if (quote === null && (trimmed === "-" || trimmed.startsWith("- "))) scalarStarted = false;
+    const scan = scanScalarLine(body, quote, scalarStarted);
+    if (scan.comment) return null;
+    quote = scan.quote;
+    scalarStarted = scan.scalarStarted;
   }
   return parentEnd;
 }

package/src/lab/automation/orchestrator.ts

@@ -1,6 +1,9 @@
 import { readConfigDiagnostics } from "../../config";
 import { registerCurrentServerResourceCleanup } from "../../lib/server-resource-ownership";
-import { registerOptionalShutdownHook } from "../../lib/optional-shutdown-hooks";
+import {
+  didRunOptionalShutdownHooks,
+  registerOptionalShutdownHook,
+} from "../../lib/optional-shutdown-hooks";
 import { queryLabStatus } from "../query";
 import { rebuildLabProjection } from "../projection/rebuild";
 import { planLabAutomationRuns } from "./planner";
@@ -58,6 +61,9 @@ let shutdownRequested = false;
 const dispatchDepsByConfigDir = new Map<string, DispatchOwner>();
 const inFlightControllers = new Map<string, AbortController>();
 const cancellingRunIds = new Set<string>();
+// Test seam: invoked after a manual run's queue row and per-run shutdown hook exist but
+// before the post-registration sweep check, so a test can land a sweep in that gap.
+let manualEnqueuePostWriteHookForTests: (() => void) | null = null;
 
 function configKey(configDir?: string): string {
   return configDir ?? "";
@@ -403,6 +409,13 @@ export async function runLabAutomationTick(configDir?: string): Promise<void> {
 
 export function startLabAutomationScheduler(configDir?: string): void {
   const key = configKey(configDir);
+  // Same late-request race as enqueueManualLabRun: a policy PUT or CLI enable can resume
+  // after the shutdown sweep already ran. Starting here would reset the latch and leave a
+  // live interval dispatching Lab work outside the completed sweep.
+  if (didRunOptionalShutdownHooks()) {
+    requestLabAutomationShutdown();
+    return;
+  }
   const currentOwner = dispatchDepsByConfigDir.get(key)?.token;
   const existing = schedulerTimers.get(key);
   if (existing) {
@@ -418,6 +431,14 @@ export function startLabAutomationScheduler(configDir?: string): void {
     requestLabAutomationShutdown();
     stopLabAutomationScheduler(configDir);
   });
+  // The sweep may have run in the gap between the entry check and this registration; it
+  // snapshots the registry once, so a hook that landed afterwards is orphaned. Keep the
+  // latch set and never start the timer — the registration stays live so a repeat sweep
+  // still tears this scheduler down.
+  if (didRunOptionalShutdownHooks()) {
+    requestLabAutomationShutdown();
+    return;
+  }
   shutdownRequested = false;
   const { policy, routes } = loadLabAutomationConfig(configDir);
   const now = Date.now();
@@ -457,6 +478,12 @@ export function resetLabAutomationSchedulerStateForTests(): void {
   dispatchDepsByConfigDir.clear();
   inFlightControllers.clear();
   cancellingRunIds.clear();
+  manualEnqueuePostWriteHookForTests = null;
+}
+
+/** Test-only seam for the gap between a manual run's queue write and its post-write sweep check. */
+export function setLabAutomationManualEnqueuePostWriteHookForTests(hook: (() => void) | null): void {
+  manualEnqueuePostWriteHookForTests = hook;
 }
 
 export async function enqueueManualLabRun(
@@ -464,6 +491,14 @@ export async function enqueueManualLabRun(
   configDir?: string,
   abortSignal?: AbortSignal,
 ): Promise<LabAutomationRunRecordV1 | null> {
+  // The management route is not covered by the data-plane drain gate, so a request accepted
+  // before listener teardown can reach this point after the shutdown sweep already ran. A
+  // hook registered then is never invoked; run its teardown inline instead of letting the
+  // dispatch escape shutdown.
+  if (didRunOptionalShutdownHooks()) {
+    requestLabAutomationShutdown();
+    return null;
+  }
   const now = Date.now();
   const created = mutateLabAutomationState(configDir, (state) => {
     const next = enqueuePlannedRuns(state, [planned], "manual", now);
@@ -473,8 +508,29 @@ export async function enqueueManualLabRun(
     return { state: next, value: run };
   });
   if (!created) return null;
-  // Manual execution is independent of automation enablement/layer toggles.
-  await runDispatchBatch(configDir, { manualRunId: created.runId, abortSignal });
+  // Manual execution can run without activation or a scheduler, so it must own a shutdown
+  // hook for the lifetime of its dispatch instead of relying on either of those paths.
+  const detachShutdownHook = registerOptionalShutdownHook(
+    `lab-automation-manual:${created.runId}`,
+    requestLabAutomationShutdown,
+  );
+  // The sweep may have run in the gap between the entry check and this registration; it
+  // snapshots the registry once, so a hook that landed afterwards is orphaned.
+  manualEnqueuePostWriteHookForTests?.();
+  if (didRunOptionalShutdownHooks()) {
+    requestLabAutomationShutdown();
+    detachShutdownHook();
+    // The queue row was already written; leaving it `queued` would persist a manual run no
+    // scheduler tick ever picks up while the route reports success. Cancel it and fail.
+    cancelLabAutomationRun(created.runId, configDir);
+    return null;
+  }
+  try {
+    // Manual execution is independent of automation enablement/layer toggles.
+    await runDispatchBatch(configDir, { manualRunId: created.runId, abortSignal });
+  } finally {
+    detachShutdownHook();
+  }
   return loadLabAutomationState(configDir).runs.find((row) => row.runId === created.runId) ?? created;
 }
 
@@ -496,4 +552,4 @@ export function cancelLabAutomationRun(runId: string, configDir?: string): boole
     }
     return { state: next, value: true };
   });
-}
+}

package/src/lab/events/limits.ts

@@ -32,7 +32,7 @@ const FORBIDDEN_EXACT_KEYS = new Set([
 ]);
 
 const RAW_POSIX_PATH_RE =
-  /(?:^|[^A-Za-z0-9._~/])\/(?:(?=$|[^A-Za-z0-9._~/])|(?!\/)(?![ \t\r\n])(?:\/|[^/\0\r\n]+)+\/?(?=$|[^A-Za-z0-9._~/]))/u;
+  /(?:^|[^A-Za-z0-9._~/])\/(?:(?=$|[^A-Za-z0-9._~/])|(?!\/)(?![ \t\r\n])[^/\0\r\n]+(?:\/+[^/\0\r\n]+)*\/*(?=$|[^A-Za-z0-9._~/]))/u;
 const ASCII_URL_WHITESPACE_RE = /[\t\r\n]/g;
 const FILE_URI_RE = /(?:^|[^A-Za-z0-9+.-])file:/i;
 

package/src/lib/bounded-body.ts

@@ -88,15 +88,46 @@ export function boundedBodyBufferGrowthsForTests(): number {
 	return bufferGrowthsForTests;
 }
 
-function timeoutPromise(ms: number, value: symbol): { promise: Promise<symbol>; clear: () => void } {
-	let timer: ReturnType<typeof setTimeout> | undefined;
-	const promise = new Promise<symbol>((resolve) => {
-		timer = setTimeout(() => resolve(value), Math.max(0, ms));
-	});
+function bodyDeadline(ms: number, onTimeout: () => void): { clear: () => void } {
+	const timer = setTimeout(onTimeout, Math.max(0, ms));
 	return {
-		promise,
-		clear: () => {
-			if (timer !== undefined) clearTimeout(timer);
+		clear: () => clearTimeout(timer),
+	};
+}
+
+/**
+ * A reader is consumed serially. Deadlines and abort own only its current wait,
+ * never a promise raced against every read: those reactions retain completed
+ * read results (including empty chunks) until the long-lived promise settles.
+ */
+function interruptibleRead<T = never>(reader: ReadableStreamDefaultReader<Uint8Array>) {
+	type Outcome = Awaited<ReturnType<typeof reader.read>> | T;
+	type Interruption = { value: T } | { error: unknown };
+	let interruption: Interruption | undefined;
+	let pending: { resolve: (value: Outcome) => void; reject: (error: unknown) => void } | undefined;
+	const interrupt = (outcome: Interruption) => {
+		// Latch an interruption even between reads or before the first wait.
+		interruption ??= outcome;
+		if ("error" in interruption) pending?.reject(interruption.error);
+		else pending?.resolve(interruption.value);
+	};
+	return {
+		interrupt,
+		async read(): Promise<Outcome> {
+			try {
+				return await new Promise<Outcome>((resolve, reject) => {
+					pending = { resolve, reject };
+					if (interruption) {
+						interrupt(interruption);
+						return;
+					}
+					// Both reactions belong to this read only. A late rejection stays
+					// observed after interruption, even if cancel throws or never settles.
+					void reader.read().then(resolve, reject);
+				});
+			} finally {
+				pending = undefined;
+			}
 		},
 	};
 }
@@ -147,30 +178,20 @@ export async function readBoundedResponseBytes(
 	let mustCancel = false;
 	let cancelReason: unknown;
 	const inactivityReason = new DOMException("Response body stalled", "TimeoutError");
-	let rejectForInactivity: ((reason: unknown) => void) | undefined;
-	const inactive = new Promise<never>((_resolve, reject) => {
-		rejectForInactivity = reject;
-	});
+	const waiting = interruptibleRead(reader);
 	const inactivity = options.inactivityTimeoutMs === undefined
 		? null
-		: idleDeadline(options.inactivityTimeoutMs, () => rejectForInactivity?.(inactivityReason));
+		: idleDeadline(options.inactivityTimeoutMs, () => waiting.interrupt({ error: inactivityReason }));
 	inactivity?.reset();
 
-	let rejectForAbort: ((reason: unknown) => void) | undefined;
-	const aborted = new Promise<never>((_resolve, reject) => {
-		rejectForAbort = reject;
-	});
-	const onAbort = () => rejectForAbort?.(signal?.reason);
+	const onAbort = () => waiting.interrupt({ error: signal?.reason });
 	signal?.addEventListener("abort", onAbort, { once: true });
 	// Close the narrow race between the preflight check and listener install.
 	if (signal?.aborted) onAbort();
 
 	try {
 		while (true) {
-			const read = reader.read();
-			// Observe a late read rejection when abort/cancellation wins the race.
-			void read.catch(() => undefined);
-			const outcome = await Promise.race([read, aborted, inactive]);
+			const outcome = await waiting.read();
 			if (signal?.aborted) {
 				mustCancel = true;
 				cancelReason = signal.reason;
@@ -289,30 +310,26 @@ export async function readBoundedResponseBody(
 	bufferGrowthsForTests = 0;
 	let mustCancel = false;
 	let cancelReason: unknown;
-	const total = timeoutPromise(options.totalTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS, TOTAL_TIMEOUT);
-	let inactivity = timeoutPromise(
+	const waiting = interruptibleRead<symbol>(reader);
+	const total = bodyDeadline(
+		options.totalTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS,
+		() => waiting.interrupt({ value: TOTAL_TIMEOUT }),
+	);
+	let inactivity = bodyDeadline(
 		options.firstByteTimeoutMs ?? options.inactivityTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS,
-		INACTIVITY_TIMEOUT,
+		() => waiting.interrupt({ value: INACTIVITY_TIMEOUT }),
 	);
 
-	let rejectForAbort: ((reason: unknown) => void) | undefined;
-	const aborted = new Promise<never>((_resolve, reject) => {
-		rejectForAbort = reject;
-	});
-	const onAbort = () => rejectForAbort?.(signal?.reason);
+	const onAbort = () => waiting.interrupt({ error: signal?.reason });
 	signal?.addEventListener("abort", onAbort, { once: true });
 	// Close the narrow race between the preflight check and listener install.
 	if (signal?.aborted) onAbort();
 
 	try {
 		while (true) {
-			// Attach a rejection handler before racing. If a deadline wins and
-			// cancellation later rejects this read, it remains observed.
-			const read = reader.read();
-			void read.catch(() => undefined);
-			const outcome = await Promise.race([read, total.promise, inactivity.promise, aborted]);
+			const outcome = await waiting.read();
 			// Cancellation owns the body lifetime even when EOF/readability settles in
-			// the same turn. Promise.race otherwise lets array order hide the abort.
+			// the same turn, even if the read settled before the abort callback.
 			if (signal?.aborted) {
 				mustCancel = true;
 				cancelReason = signal.reason;
@@ -370,9 +387,9 @@ export async function readBoundedResponseBody(
 			if (!value || value.byteLength === 0) continue;
 
 			inactivity.clear();
-			inactivity = timeoutPromise(
+			inactivity = bodyDeadline(
 				options.inactivityTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS,
-				INACTIVITY_TIMEOUT,
+				() => waiting.interrupt({ value: INACTIVITY_TIMEOUT }),
 			);
 
 			if (value.byteLength > maxBytes - retainedBytes) {

package/src/lib/config-ownership.ts

@@ -267,9 +267,8 @@ function removeOwnedEntry(root: string, path: string): void {
   rmdirSync(path);
 }
 
-export function recordOwnedConfigPath(configDir: string, candidatePath: string): boolean {
-  const rel = manifestRelativePath(configDir, candidatePath);
-  if (!rel) return false;
+/** Initialize only an empty or already-owned root; do not claim a candidate path. */
+export function initializeConfigOwnership(configDir: string): boolean {
   const cacheKey = ownershipCacheKey(configDir);
   if (!existsSync(configDir)) {
     ownershipCache.delete(cacheKey);
@@ -280,6 +279,15 @@ export function recordOwnedConfigPath(configDir: string, candidatePath: string):
     ownership = loadOwnership(configDir) ?? createOwnership(configDir);
     ownershipCache.set(cacheKey, ownership);
   }
+  return ownership !== null;
+}
+
+export function recordOwnedConfigPath(configDir: string, candidatePath: string): boolean {
+  const rel = manifestRelativePath(configDir, candidatePath);
+  if (!rel) return false;
+  if (!initializeConfigOwnership(configDir)) return false;
+  const cacheKey = ownershipCacheKey(configDir);
+  const ownership = ownershipCache.get(cacheKey);
   if (!ownership) return false;
   if (ownership.manifest.paths.includes(rel)) return true;
   const manifest = {
@@ -337,25 +345,6 @@ export function removeOwnedConfigState(configDir: string): ConfigRemovalResult {
     }
   }
 
-  // Per-catalog backups are named `catalog-backup-<16 hex>.json` (catalogBackupPathFor), one per
-  // CODEX_HOME, so they cannot be enumerated as literal manifest entries the way every other
-  // owned file can. Without this, `ocx uninstall` always reported "unowned files remain" and
-  // refused to remove a home OpenCodex created itself — the file is unambiguously ours, produced
-  // by our own writer, and the strict hex shape keeps the match from widening.
-  for (const name of readdirSync(configDir)) {
-    if (!/^catalog-backup-[0-9a-f]{16}\.json$/.test(name)) continue;
-    const path = join(configDir, name);
-    try {
-      removeOwnedEntry(rootPath, path);
-    } catch (error) {
-      return {
-        status: "partial",
-        reason: `could not remove owned path ${name}: ${error instanceof Error ? error.message : String(error)}`,
-        residualPaths: [path],
-      };
-    }
-  }
-
   try {
     unlinkSync(join(configDir, CONFIG_UNINSTALL_MANIFEST));
     unlinkSync(join(configDir, CONFIG_OWNER_FILE));

package/src/lib/local-desktop-snapshot-capability.ts

@@ -0,0 +1,56 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { isLocalAttestationSecret } from "./local-management-attestation";
+import { LOCAL_MANAGEMENT_CAPABILITY_TTL_MS } from "./local-management-capability";
+
+export const LOCAL_DESKTOP_SNAPSHOT_PATH = "/api/update/desktop-snapshot";
+export const LOCAL_DESKTOP_SNAPSHOT_BODY_HEADER = "x-opencodex-desktop-snapshot-sha256";
+const BASE64URL_256 = /^[A-Za-z0-9_-]{43}$/;
+
+/** Digest the exact bytes sent on the wire, before JSON parsing or reserialization. */
+export function desktopSnapshotBodyDigest(body: Uint8Array): string {
+  return createHash("sha256").update(body).digest("base64url");
+}
+
+/** A separate, body-bound grant for the one bounded desktop display-state POST. */
+export function createLocalDesktopSnapshotCapability(
+  secret: string,
+  nonce: string,
+  method: string,
+  path: string,
+  pid: number,
+  port: number,
+  expiresAt: number,
+  bodyDigest: string,
+): string | null {
+  if (!isLocalAttestationSecret(secret) || !BASE64URL_256.test(nonce)) return null;
+  if (method !== "POST" || path !== LOCAL_DESKTOP_SNAPSHOT_PATH) return null;
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+  if (!Number.isSafeInteger(expiresAt) || expiresAt <= 0) return null;
+  if (!BASE64URL_256.test(bodyDigest)) return null;
+  const payload = `opencodex-local-desktop-snapshot-v1\n${nonce}\n${method}\n${path}\n${pid}\n${port}\n${expiresAt}\n${bodyDigest}`;
+  return createHmac("sha256", secret).update(payload).digest("base64url");
+}
+
+/** Verify scope, lifetime and MAC; admission separately consumes the grant once. */
+export function verifyLocalDesktopSnapshotCapability(
+  secret: string,
+  nonce: string | null,
+  method: string,
+  path: string,
+  pid: number,
+  port: number,
+  expiresAt: number,
+  bodyDigest: string | null,
+  capability: string | null,
+  now = Date.now(),
+): boolean {
+  if (!nonce || !bodyDigest || !capability || !BASE64URL_256.test(capability)) return false;
+  if (!Number.isSafeInteger(now) || expiresAt <= now
+    || expiresAt > now + LOCAL_MANAGEMENT_CAPABILITY_TTL_MS) return false;
+  const expected = createLocalDesktopSnapshotCapability(
+    secret, nonce, method, path, pid, port, expiresAt, bodyDigest,
+  );
+  if (!expected) return false;
+  return timingSafeEqual(Buffer.from(expected), Buffer.from(capability));
+}

package/src/lib/local-management-capability.ts

@@ -9,7 +9,16 @@ export const LOCAL_MANAGEMENT_CAPABILITY_TTL_MS = 10_000;
 
 export const LOCAL_MANAGEMENT_READ_PATHS = {
   codexAccounts: "/api/codex-auth/accounts",
+  codexAuthActive: "/api/codex-auth/active",
+  oauthAccounts: "/api/oauth/accounts",
+  providerKeys: "/api/providers/keys",
+  config: "/api/config",
   systemMemory: "/api/system/memory",
+  companionSettings: "/api/companion/settings",
+  usage: "/api/usage",
+  startupHealth: "/api/startup-health",
+  providerQuotas: "/api/provider-quotas",
+  usageTimeline: "/api/usage/timeline",
 } as const;
 
 export type LocalManagementReadPath =
@@ -32,7 +41,16 @@ export function parseExpectedLocalManagementPid(value: string | null): ExpectedL
 
 function isLocalManagementReadPath(path: string): path is LocalManagementReadPath {
   return path === LOCAL_MANAGEMENT_READ_PATHS.codexAccounts
-    || path === LOCAL_MANAGEMENT_READ_PATHS.systemMemory;
+    || path === LOCAL_MANAGEMENT_READ_PATHS.codexAuthActive
+    || path === LOCAL_MANAGEMENT_READ_PATHS.oauthAccounts
+    || path === LOCAL_MANAGEMENT_READ_PATHS.providerKeys
+    || path === LOCAL_MANAGEMENT_READ_PATHS.config
+    || path === LOCAL_MANAGEMENT_READ_PATHS.systemMemory
+    || path === LOCAL_MANAGEMENT_READ_PATHS.companionSettings
+    || path === LOCAL_MANAGEMENT_READ_PATHS.usage
+    || path === LOCAL_MANAGEMENT_READ_PATHS.startupHealth
+    || path === LOCAL_MANAGEMENT_READ_PATHS.providerQuotas
+    || path === LOCAL_MANAGEMENT_READ_PATHS.usageTimeline;
 }
 
 function localReadCapabilityPayload(
@@ -44,7 +62,11 @@ function localReadCapabilityPayload(
   expiresAt: number,
 ): string | null {
   if (!BASE64URL_256.test(nonce)) return null;
-  if (method !== LOCAL_READ_METHOD || !isLocalManagementReadPath(path)) return null;
+  // `path` arrives as pathname+search. The allowlist judges the pathname; the query is
+  // still signed into the payload, so a capability minted for one range cannot be replayed
+  // against another. Query-less paths keep the exact v1 payload shape.
+  const pathname = path.split("?", 1)[0]!;
+  if (method !== LOCAL_READ_METHOD || !isLocalManagementReadPath(pathname)) return null;
   if (!Number.isSafeInteger(pid) || pid <= 0) return null;
   if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
   if (!Number.isSafeInteger(expiresAt) || expiresAt <= 0) return null;
@@ -56,7 +78,7 @@ export function createLocalManagementReadCapability(
   secret: string,
   nonce: string,
   method: string,
-  path: string,
+  path: string, // pathname plus any query; the query is bound into the signature
   pid: number,
   port: number,
   expiresAt: number,

package/src/lib/optional-shutdown-hooks.ts

@@ -22,12 +22,22 @@
 type ShutdownHook = () => void;
 
 const hooks = new Map<string, ShutdownHook>();
+let hooksRan = false;
 
 /**
  * Register (or replace) the teardown for one optional subsystem.
  *
  * Keyed so repeated activation of the same subsystem cannot accumulate duplicate hooks.
  * Returns a detach function so an owner-scoped lease can release its registration.
+ *
+ * Registration after a sweep is NOT retro-applied: the hook waits for the next
+ * `runOptionalShutdownHooks`, which a draining process never reaches. Callers whose work
+ * must not outlive the sweep should gate on `didRunOptionalShutdownHooks`.
+ *
+ * The `hooksRan` latch is process-lifetime: every production caller runs the sweep inside
+ * `drainAndShutdown`, whose callers then exit or hand off to a newly spawned process —
+ * there is no in-process restart after a sweep. `resetOptionalShutdownHooksForTests`
+ * models that fresh process; it is the only way a post-sweep subsystem may start again.
  */
 export function registerOptionalShutdownHook(key: string, hook: ShutdownHook): () => void {
   hooks.set(key, hook);
@@ -37,8 +47,14 @@ export function registerOptionalShutdownHook(key: string, hook: ShutdownHook): (
   };
 }
 
+/** Whether `runOptionalShutdownHooks` has run at least once since the last test reset. */
+export function didRunOptionalShutdownHooks(): boolean {
+  return hooksRan;
+}
+
 /** Run every registered teardown. Never throws. */
 export function runOptionalShutdownHooks(): void {
+  hooksRan = true;
   for (const [key, hook] of [...hooks]) {
     try {
       hook();
@@ -54,4 +70,5 @@ export function runOptionalShutdownHooks(): void {
 /** Test-only reset so an isolated lifecycle test does not inherit registrations. */
 export function resetOptionalShutdownHooksForTests(): void {
   hooks.clear();
+  hooksRan = false;
 }

package/src/lib/state-store-registrations.ts

@@ -37,7 +37,7 @@ import { listLiveOAuthAccountKeys, reconcileOAuthReauthState } from "../oauth/st
 import { reconcileGuardianBackoff } from "../oauth/token-guardian";
 import { sweepExpiredApiKeyCooldowns } from "../providers/key-failover";
 import { reconcileProviderRequestPacing } from "../providers/request-pacing";
-import { sweepAbandonedResponseStateTemps, sweepExpiredResponseStates } from "../responses/state";
+import { sweepAbandonedResponseStateTemps, sweepExpiredResponseStates, sweepOrphanedResponseSpills } from "../responses/state";
 import { sweepExpiredAntigravityReplay } from "../adapters/google-antigravity-replay";
 import { reconcileProviderAccountQuotaRows } from "../providers/quota";
 import { reconcileRouterWarningMemos } from "../router";
@@ -98,7 +98,7 @@ export const STATE_STORE_REGISTRATIONS = [
     sweepExpired: sweepExpiredResponseStates,
     // Disk reclaim rides the liveness tick, not the TTL tick: sweepExpiredOnWrite puts
     // sweepExpired on hot write paths, where a directory scan does not belong.
-    sweepLiveness: sweepAbandonedResponseStateTemps,
+    sweepLiveness: () => sweepAbandonedResponseStateTemps() + sweepOrphanedResponseSpills(),
   },
   { name: "antigravity-replay", sweepExpired: sweepExpiredAntigravityReplay },
   { name: "config-warning-memos", reconcileGeneration: (context: GenerationContext) => reconcileConfigWarningMemos(context.generation) },