@bitkyc08/opencodex 2.7.25 → 2.7.26

package/src/providers/github-copilot-transport.ts

@@ -0,0 +1,56 @@
+import type { OcxProviderConfig } from "../types";
+import {
+  GITHUB_COPILOT_DEFAULT_API_BASE,
+  GITHUB_COPILOT_EDITOR_HEADERS,
+  validateCopilotApiBaseUrl,
+} from "../oauth/github-copilot";
+
+export type OcxProviderTransport = OcxProviderConfig & {
+  fetch?: typeof globalThis.fetch;
+};
+
+function hasHeaderCaseInsensitive(
+  headers: Record<string, string> | undefined,
+  name: string,
+): boolean {
+  const target = name.toLowerCase();
+  return Object.keys(headers ?? {}).some(key => key.toLowerCase() === target);
+}
+
+function withoutUserOverridden(
+  defaults: Readonly<Record<string, string>>,
+  userHeaders: Record<string, string> | undefined,
+): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(defaults).filter(([name]) => !hasHeaderCaseInsensitive(userHeaders, name)),
+  );
+}
+
+/**
+ * Copilot chat requires editor fingerprint headers. Defaults are honest OpenCodex values
+ * with Copilot-Integration-Id set to the vscode-chat integration id the public client uses.
+ * User-configured headers always win.
+ */
+export function resolveGithubCopilotTransport(
+  provider: OcxProviderTransport,
+  apiBaseUrl?: string,
+): OcxProviderTransport {
+  const stableDefaults = withoutUserOverridden(GITHUB_COPILOT_EDITOR_HEADERS, provider.headers);
+  const headers = {
+    ...stableDefaults,
+    ...(provider.headers ?? {}),
+  };
+  // Fail closed: the OAuth bearer only ever goes to an allowlisted *.githubcopilot.com
+  // host. A legacy/crafted credential without endpoints.api, or a user-edited baseUrl,
+  // must not redirect the token — fall back to the canonical default instead.
+  const baseUrl = provider.authMode === "oauth"
+    ? validateCopilotApiBaseUrl(apiBaseUrl)
+      ?? validateCopilotApiBaseUrl(provider.baseUrl)
+      ?? GITHUB_COPILOT_DEFAULT_API_BASE
+    : apiBaseUrl?.trim() || provider.baseUrl || GITHUB_COPILOT_DEFAULT_API_BASE;
+  return {
+    ...provider,
+    baseUrl,
+    headers,
+  };
+}

package/src/providers/quota.ts

@@ -1,5 +1,6 @@
 import { fetchMainAccountInfo, listCodexAuthAccounts } from "../codex/auth-api";
 import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
+import { resolveEnvValue } from "../config";
 import { getValidAccessToken } from "../oauth";
 import { getCredential } from "../oauth/store";
 import { antigravityUserAgent } from "../adapters/client-fingerprint";
@@ -79,7 +80,14 @@ function providerLabel(providerId: string): string {
 function normalizeResetAt(value: unknown): number | undefined {
   if (typeof value === "number" && Number.isFinite(value)) return value > 10_000_000_000 ? value : value * 1000;
   if (typeof value === "string" && value.trim()) {
-    const parsed = Date.parse(value);
+    const trimmed = value.trim();
+    // Cursor Connect RPC returns billingCycleEnd as a unix-ms decimal string ("1771077734000").
+    // Date.parse treats that as invalid; numeric epoch strings must be handled explicitly.
+    if (/^\d+(\.\d+)?$/.test(trimmed)) {
+      const numeric = Number(trimmed);
+      if (Number.isFinite(numeric)) return numeric > 10_000_000_000 ? numeric : numeric * 1000;
+    }
+    const parsed = Date.parse(trimmed);
     return Number.isFinite(parsed) ? parsed : undefined;
   }
   return undefined;
@@ -231,38 +239,70 @@ function quotaResetAt(row: Record<string, unknown>): number | undefined {
   return normalizeResetAt(row.resetTime ?? row.resetAt ?? row.reset_time ?? row.reset_at);
 }
 
+function isCanonicalKimiCodeBaseUrl(baseUrl: string): boolean {
+  return normalizedBaseUrl(baseUrl) === KIMI_CODE_BASE_URL;
+}
+
+/** Prefer the nested `data` shell when the outer object is only an envelope. */
+function unwrapKimiQuotaPayload(value: unknown): Record<string, unknown> | null {
+  const body = asRecord(value);
+  if (!body) return null;
+  const nested = asRecord(body.data);
+  if (!nested) return body;
+  // A null/non-usable outer field is a placeholder, not data — an envelope like
+  // { usage: null, data: { usage: {...} } } must still unwrap to the nested payload.
+  const usable = (field: unknown): boolean => field !== undefined && field !== null;
+  const outerHasUsage = usable(body.usage) || usable(body.limits) || usable(body.totalQuota);
+  const nestedHasUsage = usable(nested.usage) || usable(nested.limits) || usable(nested.totalQuota);
+  return !outerHasUsage && nestedHasUsage ? nested : body;
+}
+
+function kimiLimitLabel(item: Record<string, unknown>, detail: Record<string, unknown>): string {
+  return [item.name, item.title, item.scope, detail.name, detail.title]
+    .filter((value): value is string => typeof value === "string")
+    .join(" ")
+    .toLowerCase();
+}
+
 function parseKimiQuotaRow(value: unknown, resetFallback?: Record<string, unknown>): { percent: number; resetAt?: number } | null {
   const row = asRecord(value);
   if (!row) return null;
+  const resetAt = quotaResetAt(row) ?? (resetFallback ? quotaResetAt(resetFallback) : undefined);
   const limit = toFiniteNumber(row.limit);
-  if (limit === undefined || limit <= 0) return null;
-  let used = toFiniteNumber(row.used);
-  if (used === undefined) {
-    const remaining = toFiniteNumber(row.remaining);
-    if (remaining === undefined) return null;
-    used = limit - remaining;
+  if (limit !== undefined && limit > 0) {
+    let used = toFiniteNumber(row.used);
+    if (used === undefined) {
+      const remaining = toFiniteNumber(row.remaining);
+      if (remaining !== undefined) used = limit - remaining;
+    }
+    if (used !== undefined) {
+      const percent = normalizePercent((used / limit) * 100);
+      if (percent !== undefined) return { percent, ...(resetAt !== undefined ? { resetAt } : {}) };
+    }
   }
-  const percent = normalizePercent((used / limit) * 100);
-  if (percent === undefined) return null;
-  const resetAt = quotaResetAt(row) ?? (resetFallback ? quotaResetAt(resetFallback) : undefined);
-  return { percent, ...(resetAt !== undefined ? { resetAt } : {}) };
+  // Some payloads expose utilisation directly when limit/used arithmetic is absent.
+  const direct = normalizePercent(row.utilization ?? row.percent ?? row.usedPercent ?? row.used_percent);
+  return direct === undefined ? null : { percent: direct, ...(resetAt !== undefined ? { resetAt } : {}) };
 }
 
 function isKimiFiveHourLimit(item: Record<string, unknown>, detail: Record<string, unknown>, window: Record<string, unknown>): boolean {
   const duration = toFiniteNumber(window.duration ?? item.duration ?? detail.duration);
   const unit = String(window.timeUnit ?? item.timeUnit ?? detail.timeUnit ?? "").toUpperCase();
   if ((unit.includes("MINUTE") && duration === 300) || (unit.includes("HOUR") && duration === 5)) return true;
-  const label = [item.name, item.title, item.scope, detail.name, detail.title]
-    .filter((value): value is string => typeof value === "string")
-    .join(" ")
-    .toLowerCase();
-  return /(^|\b)5\s*(?:h|hour)/.test(label);
+  return /(^|\b)5\s*(?:h|hour)/.test(kimiLimitLabel(item, detail));
+}
+
+function isKimiWeeklyLimit(item: Record<string, unknown>, detail: Record<string, unknown>, window: Record<string, unknown>): boolean {
+  const duration = toFiniteNumber(window.duration ?? item.duration ?? detail.duration);
+  const unit = String(window.timeUnit ?? item.timeUnit ?? detail.timeUnit ?? "").toUpperCase();
+  if ((unit.includes("DAY") && duration === 7) || (unit.includes("HOUR") && duration === 168)) return true;
+  return /weekly|7\s*(?:d|day)/.test(kimiLimitLabel(item, detail));
 }
 
 function parseKimiQuotaPayload(value: unknown): ProviderQuota | null {
-  const body = asRecord(value);
+  const body = unwrapKimiQuotaPayload(value);
   if (!body) return null;
-  const weekly = parseKimiQuotaRow(body.usage);
+  let weekly = parseKimiQuotaRow(body.usage);
   const total = parseKimiQuotaRow(body.totalQuota);
   let fiveHour: { percent: number; resetAt?: number } | null = null;
   if (Array.isArray(body.limits)) {
@@ -271,9 +311,13 @@ function parseKimiQuotaPayload(value: unknown): ProviderQuota | null {
       if (!item) continue;
       const detail = asRecord(item.detail) ?? item;
       const window = asRecord(item.window) ?? {};
-      if (!isKimiFiveHourLimit(item, detail, window)) continue;
-      fiveHour = parseKimiQuotaRow(detail, window);
-      if (fiveHour) break;
+      if (!fiveHour && isKimiFiveHourLimit(item, detail, window)) {
+        fiveHour = parseKimiQuotaRow(detail, window);
+      }
+      if (!weekly && isKimiWeeklyLimit(item, detail, window)) {
+        weekly = parseKimiQuotaRow(detail, window);
+      }
+      if (fiveHour && weekly) break;
     }
   }
   const quota: ProviderQuota = {
@@ -291,15 +335,26 @@ function parseKimiQuotaPayload(value: unknown): ProviderQuota | null {
   return hasQuotaRows(quota) ? quota : null;
 }
 
-async function fetchKimiQuota(provider: string, config: OcxProviderConfig): Promise<ProviderQuotaReport | null> {
-  // Never release an OAuth token to a user-edited or lookalike provider host.
-  if (normalizedBaseUrl(config.baseUrl) !== KIMI_CODE_BASE_URL) return null;
-  let accessToken: string;
-  try {
-    accessToken = await getValidAccessToken("kimi");
-  } catch {
-    return null;
+async function resolveKimiQuotaBearer(config: OcxProviderConfig): Promise<string | null> {
+  if (config.authMode === "oauth") {
+    try {
+      return await getValidAccessToken("kimi");
+    } catch {
+      return null;
+    }
   }
+  // ACTIVE key only: silently walking apiKeyPool when the primary env reference is
+  // unresolved would render a quota bar for a DIFFERENT account than the one routing
+  // requests — a wrong meter is worse than no meter.
+  const primary = resolveEnvValue(config.apiKey)?.trim();
+  return primary || null;
+}
+
+async function fetchKimiQuota(provider: string, config: OcxProviderConfig): Promise<ProviderQuotaReport | null> {
+  // Never release credentials to a user-edited or lookalike provider host.
+  if (!isCanonicalKimiCodeBaseUrl(config.baseUrl)) return null;
+  const accessToken = await resolveKimiQuotaBearer(config);
+  if (!accessToken) return null;
   const response = await fetch(KIMI_CODE_USAGE_URL, {
     headers: { Accept: "application/json", Authorization: `Bearer ${accessToken}` },
     signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
@@ -342,7 +397,22 @@ async function fetchCursorQuota(provider: string): Promise<ProviderQuotaReport |
       const planUsage = asRecord(body?.planUsage);
       if (planUsage) {
         const resetAt = normalizeResetAt(body?.billingCycleEnd ?? planUsage.billingCycleEnd ?? body?.periodEnd);
-        // Cursor tracks two linked pools: First-party models (Auto/Composer/Grok) and API usage.
+
+        // Primary meter: overall included allowance (Cursor Settings → Usage total %).
+        // autoPercentUsed / apiPercentUsed are secondary pools and must not replace the total.
+        const limit = toFiniteNumber(planUsage.limit ?? planUsage.limitCents ?? planUsage.totalLimitCents);
+        const remaining = toFiniteNumber(planUsage.remaining ?? planUsage.remainingCents);
+        const includedSpend = toFiniteNumber(planUsage.includedSpend ?? planUsage.usedCents ?? planUsage.used);
+        const totalSpend = toFiniteNumber(planUsage.totalSpend);
+        let used: number | undefined;
+        if (includedSpend !== undefined) used = includedSpend;
+        else if (limit !== undefined && remaining !== undefined) used = Math.max(0, limit - remaining);
+        else if (totalSpend !== undefined) used = totalSpend;
+        const totalPercent = normalizePercent(planUsage.totalPercentUsed ?? planUsage.percentUsed)
+          ?? (limit !== undefined && limit > 0 && used !== undefined
+            ? normalizePercent((used / limit) * 100)
+            : undefined);
+
         const autoPercent = normalizePercent(planUsage.autoPercentUsed);
         const apiPercent = normalizePercent(planUsage.apiPercentUsed);
         const customWindows: ProviderQuotaWindow[] = [];
@@ -360,37 +430,14 @@ async function fetchCursorQuota(provider: string): Promise<ProviderQuotaReport |
             ...(resetAt !== undefined ? { resetAt } : {}),
           });
         }
-        if (customWindows.length > 0) {
-          const built = report(provider, "cursor:period-usage", {
-            customWindows,
-            updatedAt: Date.now(),
-          });
-          if (built) return { ...built, reverseEngineered: true };
-        }
 
-        const limit = toFiniteNumber(planUsage.limit ?? planUsage.limitCents ?? planUsage.totalLimitCents);
-        const remaining = toFiniteNumber(planUsage.remaining ?? planUsage.remainingCents);
-        const includedSpend = toFiniteNumber(planUsage.includedSpend ?? planUsage.usedCents ?? planUsage.used);
-        const totalSpend = toFiniteNumber(planUsage.totalSpend);
-        let used: number | undefined;
-        if (includedSpend !== undefined) used = includedSpend;
-        else if (limit !== undefined && remaining !== undefined) used = Math.max(0, limit - remaining);
-        else if (totalSpend !== undefined) used = totalSpend;
-        const totalPercent = normalizePercent(planUsage.totalPercentUsed ?? planUsage.percentUsed);
-        if (limit !== undefined && limit > 0 && used !== undefined) {
-          const percent = totalPercent ?? normalizePercent((used / limit) * 100);
-          if (percent !== undefined) {
-            const built = report(provider, "cursor:period-usage", {
-              monthlyPercent: percent,
-              ...(resetAt !== undefined ? { monthlyResetAt: resetAt } : {}),
-              updatedAt: Date.now(),
-            });
-            if (built) return { ...built, reverseEngineered: true };
-          }
-        } else if (totalPercent !== undefined) {
+        if (totalPercent !== undefined || customWindows.length > 0) {
           const built = report(provider, "cursor:period-usage", {
-            monthlyPercent: totalPercent,
-            ...(resetAt !== undefined ? { monthlyResetAt: resetAt } : {}),
+            ...(totalPercent !== undefined ? {
+              monthlyPercent: totalPercent,
+              ...(resetAt !== undefined ? { monthlyResetAt: resetAt } : {}),
+            } : {}),
+            ...(customWindows.length > 0 ? { customWindows } : {}),
             updatedAt: Date.now(),
           });
           if (built) return { ...built, reverseEngineered: true };
@@ -596,7 +643,12 @@ async function maybeFetchProviderQuota(
     if (provider.authMode === "oauth" && name === "anthropic") return fetchAnthropicQuota(name);
     if (provider.authMode === "oauth" && name === "cursor") return fetchCursorQuota(name);
     if (provider.authMode === "oauth" && name === "google-antigravity") return fetchAntigravityQuota(name, provider);
+    // Kimi Code `/usages` accepts OAuth or coding-plan API keys, but only on the canonical
+    // host and only for real key auth — forward/local modes carry no credential of ours.
     if (provider.authMode === "oauth" && name === "kimi") return fetchKimiQuota(name, provider);
+    if (provider.authMode === "key" && isCanonicalKimiCodeBaseUrl(provider.baseUrl)) {
+      return fetchKimiQuota(name, provider);
+    }
     return null;
   } catch {
     return null;

package/src/providers/registry.ts

@@ -172,6 +172,25 @@ const DEEPSEEK_THINKING_REASONING_MAP: Record<string, string> = {
   xhigh: "max",
   max: "max",
 };
+// 260719 Alibaba Token Plan Personal Edition (China/Beijing). Keep it distinct from
+// Coding Plan: the products use different exact allowlists and different base URLs.
+// Evidence: https://help.aliyun.com/en/model-studio/token-plan-personal-overview
+//           https://help.aliyun.com/en/model-studio/token-plan-quickstart
+const ALIBABA_TOKEN_PLAN_MODELS = [
+  "qwen3.8-max-preview", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-flash",
+  "glm-5.2", "deepseek-v4-pro",
+];
+const ALIBABA_TOKEN_PLAN_QWEN_MODELS = [
+  "qwen3.8-max-preview", "qwen3.7-max", "qwen3.7-plus", "qwen3.6-flash",
+];
+const ALIBABA_TOKEN_PLAN_INPUT_MODALITIES: Record<string, string[]> = {
+  "qwen3.8-max-preview": ["text", "image"],
+  "qwen3.7-max": ["text"],
+  "qwen3.7-plus": ["text", "image"],
+  "qwen3.6-flash": ["text", "image"],
+  "glm-5.2": ["text"],
+  "deepseek-v4-pro": ["text"],
+};
 // 260717 Kimi K3: the subscription endpoint uses one upstream id (`k3`) for both
 // entitlement tiers. Bare `k3` advertises the Moderato 256K ceiling; the local `[1m]`
 // alias advertises Allegretto's 1M ceiling and is stripped before the upstream request.
@@ -649,6 +668,27 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   { id: "qianfan", label: "Qianfan (Baidu)", baseUrl: "https://qianfan.baidubce.com/v2", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://console.bce.baidu.com/iam/#/iam/apikey/list" },
   // 2026-07-10: docs unverified; model data frozen. Evidence: devlog/_plan/260710_provider_hardening/002_research_cn.md.
   { id: "alibaba", label: "Alibaba Coding Plan", baseUrl: "https://coding-intl.dashscope.aliyuncs.com/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://dashscope.console.aliyun.com/apiKey" },
+  {
+    id: "alibaba-token-plan",
+    label: "Alibaba Token Plan (Beijing)",
+    baseUrl: "https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1",
+    adapter: "openai-chat",
+    authKind: "key",
+    dashboardUrl: "https://bailian.console.aliyun.com/cn-beijing?tab=plan",
+    defaultModel: "qwen3.8-max-preview",
+    models: ALIBABA_TOKEN_PLAN_MODELS,
+    liveModels: false,
+    note: "Token Plan Personal Edition · China (Beijing)",
+    modelInputModalities: ALIBABA_TOKEN_PLAN_INPUT_MODALITIES,
+    modelReasoningEfforts: {
+      ...Object.fromEntries(ALIBABA_TOKEN_PLAN_QWEN_MODELS.map(id => [id, THINKING_BUDGET_EFFORTS])),
+      "glm-5.2": ZAI_GLM_52_REASONING_EFFORTS,
+      "deepseek-v4-pro": DEEPSEEK_THINKING_EFFORTS,
+    },
+    modelReasoningEffortMap: { "deepseek-v4-pro": DEEPSEEK_THINKING_REASONING_MAP },
+    thinkingBudgetModels: ALIBABA_TOKEN_PLAN_QWEN_MODELS,
+    preserveReasoningContentModels: ["glm-5.2", "deepseek-v4-pro"],
+  },
   // NEEDS_HUMAN 2026-07-10: kept for config compatibility, but this is a dashboard URL,
   // no /models endpoint is documented, and tools are silently ignored upstream per docs.parallel.ai.
   // Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
@@ -757,8 +797,22 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     note: "No key needed — uses Xiaomi MiMo's free public tier (limited-time offer). A JWT is bootstrapped automatically with an anonymous random client id stored locally. The endpoint contract mirrors the official MiMoCode client and is not publicly documented — Xiaomi may change or restrict it at any time. Prompts may be processed/retained by Xiaomi; do not send confidential material.",
   },
   { id: "cloudflare-ai-gateway", label: "Cloudflare AI Gateway", baseUrl: "https://gateway.ai.cloudflare.com/v1/{account-id}/{gateway}/anthropic", adapter: "anthropic", authKind: "key", dashboardUrl: "https://dash.cloudflare.com/?to=/:account/ai/ai-gateway" },
-  // FREEZE 2026-07-10: /models is auth-gated, so ids remain unverified. Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
-  { id: "github-copilot", label: "GitHub Copilot", baseUrl: "https://api.githubcopilot.com", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://github.com/settings/copilot" },
+  // FREEZE 2026-07-10: /models was auth-gated under key login. OAuth device-flow + copilot_internal
+  // exchange (issue #151) unlocks live discovery; static seed is a cold-start fallback only.
+  {
+    id: "github-copilot",
+    label: "GitHub Copilot",
+    baseUrl: "https://api.githubcopilot.com",
+    adapter: "openai-chat",
+    authKind: "oauth",
+    allowKeyAuthOverride: true,
+    featured: false,
+    dashboardUrl: "https://github.com/settings/copilot",
+    liveModels: true,
+    models: ["gpt-4o", "gpt-4.1", "gpt-4.1-mini", "claude-sonnet-4", "gemini-2.5-pro"],
+    defaultModel: "gpt-4o",
+    note: "Experimental unofficial Copilot bridge. Logs in via GitHub device flow using the public VS Code OAuth client id, then exchanges for a short-lived Copilot API token (copilot_internal). Requires an active Copilot subscription. GitHub may tighten or revoke this path; do not send confidential material you would not paste into Copilot Chat.",
+  },
   // FREEZE 2026-07-10: no public OpenAI-compatible endpoint is documented. Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
   { id: "gitlab-duo", label: "GitLab Duo", baseUrl: "https://cloud.gitlab.com/ai/v1/proxy/openai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://gitlab.com/-/user_settings/personal_access_tokens" },
 ];

package/src/providers/xai-transport.ts

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import type { OcxProviderConfig } from "../types";
+import { resolveGithubCopilotTransport } from "./github-copilot-transport";
 
 export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 
@@ -90,7 +91,11 @@ export function resolveProviderTransport(
   providerName: string,
   provider: OcxProviderTransport,
   promptCacheKey?: string,
+  apiBaseUrl?: string,
 ): OcxProviderTransport {
+  if (providerName === "github-copilot") {
+    return resolveGithubCopilotTransport(provider, apiBaseUrl);
+  }
   if (providerName !== "xai") return provider;
 
   const cacheKey = promptCacheKey?.trim();

package/src/server/ports.ts

@@ -24,8 +24,50 @@ export async function isPortAvailable(port: number, hostname = "127.0.0.1"): Pro
   });
 }
 
-export async function findAvailablePort(preferredPort: number, hostname = "127.0.0.1"): Promise<number> {
-  if (await isPortAvailable(preferredPort, hostname)) return preferredPort;
+export type WaitForPortOptions = {
+  timeoutMs?: number;
+  intervalMs?: number;
+};
+
+/** Poll until `port` accepts a bind, or until the timeout elapses. */
+export async function waitForPortAvailable(
+  port: number,
+  hostname = "127.0.0.1",
+  opts: WaitForPortOptions = {},
+): Promise<boolean> {
+  const timeoutMs = opts.timeoutMs ?? 5000;
+  const intervalMs = opts.intervalMs ?? 50;
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    if (await isPortAvailable(port, hostname)) return true;
+    if (Date.now() >= deadline) return false;
+    await new Promise(resolve => setTimeout(resolve, intervalMs));
+  }
+}
+
+export type FindAvailablePortOptions = {
+  /** How long to keep retrying the preferred port before falling back to an ephemeral port. */
+  preferRetryMs?: number;
+  preferRetryIntervalMs?: number;
+};
+
+export async function findAvailablePort(
+  preferredPort: number,
+  hostname = "127.0.0.1",
+  opts: FindAvailablePortOptions = {},
+): Promise<number> {
+  const preferRetryMs = opts.preferRetryMs ?? 0;
+  if (preferRetryMs > 0) {
+    if (await waitForPortAvailable(preferredPort, hostname, {
+      timeoutMs: preferRetryMs,
+      intervalMs: opts.preferRetryIntervalMs ?? 50,
+    })) {
+      return preferredPort;
+    }
+  } else if (await isPortAvailable(preferredPort, hostname)) {
+    return preferredPort;
+  }
+
   return await new Promise((resolve, reject) => {
     const server = createServer();
     server.once("error", reject);

package/src/server/proxy-liveness.ts

@@ -9,7 +9,7 @@
  *
  * Lives outside cli.ts (which dispatches argv at module top level) so tests can import it.
  */
-import { loadConfig, readPid, readRuntimePort } from "../config";
+import { loadConfig, readAlivePid, readRuntimePort, verifyPidIdentity } from "../config";
 
 export interface HealthzIdentity {
   service?: unknown;
@@ -22,6 +22,11 @@ export interface HealthzIdentity {
 export interface LivenessIo {
   fetchFn?: typeof fetch;
   readPidFn?: () => number | null;
+  /**
+   * Full identity check of the passed candidate pid; must return the SAME pid or null.
+   * Destructive callers only ever receive pids that passed this gate.
+   */
+  verifyPidFn?: (candidatePid: number) => number | null;
   readRuntimeFn?: (pid?: number) => { pid?: number; port: number; hostname?: string } | null;
   configFn?: () => { port?: number; hostname?: string };
   timeoutMs?: number;
@@ -86,10 +91,22 @@ export async function proxyIdentityAt(
  * found and a foreign listener on the configured port is rejected.
  */
 export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | null> {
-  const readPidFn = io.readPidFn ?? readPid;
+  // Prefer the cheap alive-pid check: the Windows cmdline probe (WMIC/PowerShell) is too
+  // expensive for waitForProxy's 150ms poll loop, and /healthz identity is the real trust gate.
+  const readPidFn = io.readPidFn ?? readAlivePid;
+  const verifyPidFn = io.verifyPidFn ?? verifyPidIdentity;
   const readRuntimeFn = io.readRuntimeFn ?? readRuntimePort;
   const configFn = io.configFn ?? loadConfig;
 
+  // The cheap pid is discovery-only. Before it can appear in a returned (killable) result
+  // it must pass the full identity check AND the verifier must echo the exact candidate —
+  // a pidfile rewrite between discovery and verification can never swap in another process.
+  const killablePid = (candidate: number | null): number | null => {
+    if (candidate === null) return null;
+    const verified = verifyPidFn(candidate);
+    return verified === candidate ? verified : null;
+  };
+
   const pid = readPidFn();
   let probedPort: number | null = null;
   if (pid) {
@@ -97,7 +114,12 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
     if (runtime?.port) {
       probedPort = runtime.port;
       const identity = await proxyIdentityAt(runtime.port, { hostname: runtime.hostname, expectedPid: pid }, io);
-      if (identity) return { pid, port: runtime.port, hostname: runtime.hostname };
+      if (identity) {
+        // healthz confirmed the pid itself → trusted; a pidless legacy body did not,
+        // so the cheap pid must pass full identity verification before it is returned.
+        const trusted = identity.pid === pid ? pid : killablePid(pid);
+        return { pid: trusted, port: runtime.port, hostname: runtime.hostname };
+      }
     }
   }
 
@@ -117,6 +139,6 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
   const config = configFn();
   const port = config.port ?? 10100;
   const identity = await proxyIdentityAt(port, { hostname: config.hostname }, io);
-  if (identity) return { pid: identity.pid ?? pid ?? null, port, hostname: config.hostname };
+  if (identity) return { pid: identity.pid ?? killablePid(pid), port, hostname: config.hostname };
   return null;
 }

package/src/server/request-log.ts

@@ -3,6 +3,7 @@ import type { ResponsesTerminalStatus } from "../bridge";
 import {
   classifyError,
   httpStatusFromTerminalError as httpStatusFromClassifiedTerminalError,
+  isClientClosedMessage,
 } from "../lib/errors";
 import { CODEX_CONFIG_PATH, readRootTomlString } from "../codex/paths";
 import { readCodexCatalogPath } from "../codex/catalog";
@@ -134,6 +135,10 @@ export function nextRequestLogId(timestamp = Date.now()): string {
 
 export function requestLogErrorCode(status: number, upstreamError?: string): string | undefined {
   if (status >= 200 && status < 400) return undefined;
+  // Defense in depth: mid-stream web-search aborts used to land as 502 with this message.
+  if (status === 499 || (upstreamError?.trim() && classifyError(status, "upstream_error", upstreamError).code === "client_closed_request")) {
+    return "client_closed_request";
+  }
   if (status === 400 || status === 409) return "invalid_request_error";
   if (status === 401) return "invalid_api_key";
   if (status === 403) {
@@ -146,7 +151,6 @@ export function requestLogErrorCode(status: number, upstreamError?: string): str
     return "permission_denied";
   }
   if (status === 429) return "rate_limit_exceeded";
-  if (status === 499) return "client_closed_request";
   if (status === 503) return "server_is_overloaded";
   if (status >= 500) return "upstream_server_error";
   return `http_${status}`;
@@ -400,11 +404,21 @@ export function addFinalRequestLog(
   meta?: Pick<RequestLogEntry, "terminalStatus" | "closeReason">,
   addLog: (entry: RequestLogEntry) => void = addRequestLog,
 ): void {
-  const errorCode = requestLogErrorCode(status, logCtx.upstreamError);
+  // Mid-stream web-search aborts used to emit response.failed and land as 502/upstream_server_error.
+  // Prefer the client-close classification whenever the captured reason says so.
+  const effectiveStatus = status >= 500 && logCtx.upstreamError && isClientClosedMessage(logCtx.upstreamError)
+    ? 499
+    : status;
+  const errorCode = requestLogErrorCode(effectiveStatus, logCtx.upstreamError);
+  // A response.failed whose classified status is 499 is still a client cancel, not an upstream
+  // terminal failure — keep /api/logs closeReason aligned with that.
+  const closeReason = effectiveStatus === 499
+    ? "client_cancel"
+    : meta?.closeReason;
   if (logCtx.activeAttempt) {
     finishRequestAttempt(
       logCtx.activeAttempt,
-      status,
+      effectiveStatus,
       Date.now() - (logCtx.activeAttemptStartedAt ?? start),
       logCtx.usage,
     );
@@ -440,11 +454,11 @@ export function addFinalRequestLog(
     ...(logCtx.modelSupportsServiceTier !== undefined ? { modelSupportsServiceTier: logCtx.modelSupportsServiceTier } : {}),
     ...(logCtx.responseServiceTier ? { responseServiceTier: logCtx.responseServiceTier } : {}),
     ...(logCtx.resolvedModel ? { resolvedModel: logCtx.resolvedModel } : {}),
-    status,
+    status: effectiveStatus,
     durationMs: Date.now() - start,
     ...(errorCode ? { errorCode } : {}),
     ...(meta?.terminalStatus ? { terminalStatus: meta.terminalStatus } : {}),
-    ...(meta?.closeReason ? { closeReason: meta.closeReason } : {}),
+    ...(closeReason ? { closeReason } : {}),
     ...(logCtx.upstreamError ? { upstreamError: logCtx.upstreamError } : {}),
     usageStatus,
     ...(loggedUsage ? { usage: loggedUsage } : {}),
@@ -458,7 +472,7 @@ export function addFinalRequestLog(
       provider: logCtx.provider,
       model: logCtx.model,
       upstreamContentType: logCtx.usageDebugContentType ?? null,
-      upstreamStatus: status,
+      upstreamStatus: effectiveStatus,
       bodyKind: logCtx.usageDebugBodyKind ?? "none",
       bodySample: logCtx.usageDebugBodySample ?? "",
       extractedUsage: loggedUsage ?? null,

package/src/server/responses.ts

@@ -29,6 +29,7 @@ import { modelInList, namespacedToolName } from "../types";
 import type { AdapterEvent, OcxConfig, OcxParsedRequest, OcxProviderConfig, OcxUsage } from "../types";
 import {
   forceRefreshOAuthAccessSnapshot,
+  getOAuthCredentialApiBaseUrl,
   getOAuthCredentialProjectId,
   getValidAccessTokenSnapshot,
   type OAuthAccessSnapshot,
@@ -950,12 +951,13 @@ export async function handleResponses(
 
   // OAuth providers: swap in a fresh access token (auto-refreshed) as the Bearer key, so the
   // existing openai-chat / anthropic adapters authenticate with no change.
-  const isXaiOAuthRequest = route.providerName === "xai" && route.provider.authMode === "oauth";
+  const isOAuth401ReplayProvider = (route.providerName === "xai" || route.providerName === "github-copilot")
+    && route.provider.authMode === "oauth";
   let sentOAuthSnapshot: OAuthAccessSnapshot | undefined;
   if (route.provider.authMode === "oauth") {
     try {
       const resolved = await getValidAccessTokenSnapshot(route.providerName);
-      if (isXaiOAuthRequest) sentOAuthSnapshot = resolved;
+      if (isOAuth401ReplayProvider) sentOAuthSnapshot = resolved;
       route.provider = { ...route.provider, apiKey: resolved.accessToken };
       // Antigravity (cloud-code-assist) needs the discovered Cloud Code Assist project id in the
       // CCA envelope; the server injects only the bare token, so pull project from the credential.
@@ -974,7 +976,12 @@ export async function handleResponses(
       return formatErrorResponse(401, "authentication_error", err instanceof Error ? err.message : String(err));
     }
   }
-  route.provider = resolveProviderTransport(route.providerName, route.provider, parsed.options.promptCacheKey);
+  route.provider = resolveProviderTransport(
+    route.providerName,
+    route.provider,
+    parsed.options.promptCacheKey,
+    route.providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(route.providerName) : undefined,
+  );
   const adapterProvider = resolveWireProtocolOverride(route.providerName, route.modelId, route.provider);
   const adapter = resolveAdapter(adapterProvider, config.cacheRetention);
   logCtx.providerAdapter = adapter.name;
@@ -1425,7 +1432,7 @@ export async function handleResponses(
     recovery: for (;;) {
       if (
         upstreamResponse.status === 401
-        && isXaiOAuthRequest
+        && isOAuth401ReplayProvider
         && sentOAuthSnapshot
         && !oauth401ReplayAttempted
       ) {
@@ -1443,6 +1450,7 @@ export async function handleResponses(
           route.providerName,
           { ...route.provider, apiKey: refreshed.accessToken },
           parsed.options.promptCacheKey,
+          route.providerName === "github-copilot" ? getOAuthCredentialApiBaseUrl(route.providerName) : undefined,
         );
         route.provider = refreshedProvider;
         activeAdapter = resolveAdapter(
@@ -1588,7 +1596,8 @@ function compactResponseTooLargeError(): Response {
   }), { status: 502, headers: { "Content-Type": "application/json" } });
 }
 
-async function bufferCompactResponse(upstream: Response, signal: AbortSignal): Promise<Response> {
+/** Exported for tests: owns the compact client-cancel branch (499 client_cancelled). */
+export async function bufferCompactResponse(upstream: Response, signal: AbortSignal): Promise<Response> {
   const reader = upstream.body?.getReader();
   const contentType = upstream.headers.get("content-type") ?? "application/json";
   if (!reader) return new Response(null, { status: upstream.status, headers: { "Content-Type": contentType } });