@bitkyc08/opencodex 2.7.42 → 2.7.43

package/src/server/images.ts

@@ -25,10 +25,16 @@ import { signalWithTimeout } from "../lib/abort";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import type { OcxConfig } from "../types";
 import { resolveFirstUsableOpenAiSidecar, selectImagesProvider } from "../providers/openai-sidecar";
+import { getProviderRegistryEntry } from "../providers/registry";
 import { readJsonRequestBody } from "./request-decompress";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId, decodeRequestErrorResponse } from "./responses";
+import { getValidAccessToken, getOAuthCredentialProjectId } from "../oauth/index";
+import { safeAntigravityHttpErrorMessage } from "../adapters/google-errors";
+import { sanitizeUpstreamErrorText } from "../adapters/upstream-http-error";
+import { ANTIGRAVITY_REQUEST_UA } from "../adapters/google-antigravity-wire";
+import { decodeValidatedImageBase64, MAX_ENCODED_BYTES_PER_IMAGE } from "../images/artifacts";
 
 export type ImagesEndpoint = "generations" | "edits";
 
@@ -42,6 +48,276 @@ const IMAGES_UPSTREAM_TIMEOUT_MS = 300_000;
  */
 const IMAGES_RESPONSE_MAX_BYTES = 100 * 1024 * 1024;
 
+const CCA_IMAGE_MODEL = "gemini-3.1-flash-image";
+
+/**
+ * Google Gemini finishReasons that indicate a permanent content/safety block.
+ * When any of these is present, the same prompt will always fail — retrying
+ * wastes paid quota. The response is surfaced as 400 (non-retryable) instead
+ * of 502 (which codex retries up to 5 times).
+ */
+const CCA_BLOCKING_FINISH_REASONS: ReadonlySet<string> = new Set([
+  "SAFETY",
+  "BLOCKLIST",
+  "PROHIBITED_CONTENT",
+  "SPII",
+  "RECITATION",
+]);
+
+/**
+ * Race a promise against an abort signal. If the signal aborts first, reject
+ * immediately — our code stops awaiting the underlying operation even though
+ * the HTTP request behind it may still complete. Used to make the non-cancellable
+ * OAuth refresh chain responsive to client cancellation and deadline expiry.
+ */
+function abortableRace<T>(promise: Promise<T>, signal: AbortSignal): Promise<T> {
+  if (signal.aborted) {
+    return Promise.reject(signal.reason ?? new DOMException("The operation was aborted.", "AbortError"));
+  }
+  return new Promise<T>((resolve, reject) => {
+    const onAbort = () => reject(signal.reason ?? new DOMException("The operation was aborted.", "AbortError"));
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(
+      (val) => { signal.removeEventListener("abort", onAbort); resolve(val); },
+      (err) => { signal.removeEventListener("abort", onAbort); reject(err); },
+    );
+  });
+}
+
+async function tryCcaImageGeneration(
+  body: unknown,
+  config: OcxConfig,
+  logCtx: RequestLogContext,
+  signal: AbortSignal,
+  endpoint: ImagesEndpoint,
+): Promise<Response | undefined> {
+  if (endpoint !== "generations") return undefined;
+  const provider = config.providers?.["google-antigravity"];
+  if (!provider || provider.disabled) return undefined;
+
+  const prompt = (body as { prompt?: unknown })?.prompt;
+  if (typeof prompt !== "string" || !prompt.trim()) {
+    return formatErrorResponse(400, "invalid_request_error", "prompt is required and must not be empty");
+  }
+
+  const nRaw = (body as { n?: unknown })?.n;
+  if (nRaw !== undefined && nRaw !== null) {
+    const n = typeof nRaw === "number" ? nRaw : Number(nRaw);
+    if (!Number.isInteger(n) || n !== 1) {
+      return formatErrorResponse(400, "invalid_request_error", "CCA image generation supports n=1 only");
+    }
+  }
+
+  // Create the deadline before credential resolution so the timeout covers
+  // OAuth token refresh and project discovery, not just the upstream fetch.
+  const timeoutMs = config.images?.timeoutMs ?? IMAGES_UPSTREAM_TIMEOUT_MS;
+  const linkedSignal = signalWithTimeout(timeoutMs, signal);
+  let token: string;
+  try {
+    // Race the OAuth refresh against the deadline signal. getValidAccessToken
+    // chains through 4 layers (resolveAccessSnapshotForAccount →
+    // refreshAndPersistAccessToken → refreshGenericAccountWithLock →
+    // def.refresh()) that do HTTP calls without accepting a signal. Rather than
+    // threading signal through the entire chain, race the whole call against
+    // linkedSignal: when the signal aborts we stop awaiting and surface the
+    // cancellation immediately instead of hanging on the refresh HTTP call.
+    token = await abortableRace(getValidAccessToken("google-antigravity"), linkedSignal.signal);
+  } catch (err) {
+    linkedSignal.cleanup();
+    // abortableRace rejects immediately when the signal fires, so client
+    // cancellation and deadline expiry surface here. Parent abort propagates
+    // into the linked signal, so check parent first (499) before the linked
+    // signal (504).
+    if (signal.aborted) {
+      return formatErrorResponse(499, "client_closed_request", "CCA image request canceled by client");
+    }
+    if (linkedSignal.signal.aborted) {
+      return formatErrorResponse(504, "upstream_error", "CCA image generation timed out during authentication");
+    }
+    // Missing/revoked credential → 401 (re-login required); transient refresh/network → 502.
+    const errName = err instanceof Error ? err.name : "";
+    if (errName === "OAuthLoginRequiredError") {
+      return formatErrorResponse(401, "invalid_request_error", "Google Antigravity login required: run 'ocx login google-antigravity'");
+    }
+    return formatErrorResponse(502, "upstream_error", "CCA image generation failed: OAuth token refresh failed");
+  }
+  const project = getOAuthCredentialProjectId("google-antigravity");
+  if (!project) {
+    linkedSignal.cleanup();
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      "Antigravity requires a discovered Cloud Code Assist project id (re-run `ocx login google-antigravity`).",
+    );
+  }
+
+  logCtx.provider = "google-antigravity";
+  logCtx.model = CCA_IMAGE_MODEL;
+
+  // Pin to the registry endpoint — never use a config-level baseUrl override for OAuth token transmission.
+  const registryEntry = getProviderRegistryEntry("google-antigravity");
+  const baseUrl = registryEntry?.baseUrl ?? "https://daily-cloudcode-pa.googleapis.com";
+  const envelope = {
+    model: CCA_IMAGE_MODEL,
+    userAgent: "antigravity",
+    requestType: "agent",
+    project,
+    requestId: `agent-${crypto.randomUUID()}`,
+    request: {
+      contents: [{ role: "user", parts: [{ text: prompt }] }],
+      generationConfig: { responseModalities: ["TEXT", "IMAGE"] },
+      sessionId: `ocx-img-${crypto.randomUUID().slice(0, 8)}`,
+    },
+  };
+  let upstream: Response;
+  try {
+    try {
+      upstream = await fetch(`${baseUrl}/v1internal:generateContent`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Authorization": `Bearer ${token}`,
+          "User-Agent": ANTIGRAVITY_REQUEST_UA,
+        },
+        body: JSON.stringify(envelope),
+        signal: linkedSignal.signal,
+      });
+    } catch (err) {
+      if (signal.aborted) return formatErrorResponse(499, "client_closed_request", "CCA image request canceled by client");
+      if (err instanceof Error && err.name === "TimeoutError") {
+        return formatErrorResponse(504, "upstream_error", "CCA image generation timed out");
+      }
+      // Network/DNS/runtime errors may embed the request URL or headers verbatim
+      // (e.g. "fetch failed: https://…/v1internal:generateContent"). The token
+      // lives in an Authorization header, not in the URL, but sanitize defensively
+      // so no upstream-rejected credential or query param can reach the client,
+      // and strip the internal base URL host from the surfaced message.
+      const rawMsg = err instanceof Error ? err.message : String(err);
+      const safeMsg = sanitizeUpstreamErrorText(rawMsg).replace(
+        /https?:\/\/[^\s"'<>]+/gi,
+        "[upstream-url]",
+      );
+      return formatErrorResponse(502, "upstream_error", `CCA image generation failed: ${safeMsg}`);
+    }
+
+    // Stream the upstream body with a bounded reader so an oversized or malicious
+    // response is rejected mid-stream rather than after a full arrayBuffer() allocation.
+    let payload: Uint8Array;
+    try {
+      const reader = upstream.body?.getReader();
+      if (!reader) {
+        return formatErrorResponse(502, "upstream_error", "CCA image response had no body");
+      }
+      const chunks: Uint8Array[] = [];
+      let total = 0;
+      try {
+        for (;;) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          total += value.byteLength;
+          if (total > IMAGES_RESPONSE_MAX_BYTES) {
+            await reader.cancel().catch(() => {});
+            return formatErrorResponse(502, "upstream_error", `CCA image response too large (exceeded ${IMAGES_RESPONSE_MAX_BYTES} bytes)`);
+          }
+          chunks.push(value);
+        }
+      } finally {
+        try { await reader.cancel(); } catch { /* ignore */ }
+        reader.releaseLock();
+      }
+      payload = new Uint8Array(total);
+      let offset = 0;
+      for (const chunk of chunks) {
+        payload.set(chunk, offset);
+        offset += chunk.byteLength;
+      }
+    } catch (err) {
+      // Body-read timeout/abort: when CCA returns headers then stalls, the linked
+      // signal's timeout aborts reader.read(), which rejects here. The rejection
+      // often surfaces as AbortError (not TimeoutError), so distinguish by signal
+      // state, not error name. Parent abort propagates into the linked signal, so
+      // check the parent first: parent abort → 499 (client cancelled); linked-only
+      // abort → 504 (upstream stall); anything else → 502 body-read failure.
+      if (signal.aborted) {
+        return formatErrorResponse(499, "client_closed_request", "CCA image request canceled by client");
+      }
+      if (linkedSignal.signal.aborted) {
+        return formatErrorResponse(504, "upstream_error", "CCA image response timed out during body read");
+      }
+      const rawMsg = err instanceof Error ? err.message : String(err);
+      const safeMsg = sanitizeUpstreamErrorText(rawMsg).replace(/https?:\/\/[^\s"'<>]+/gi, "[upstream-url]");
+      return formatErrorResponse(502, "upstream_error", `CCA image body read failed: ${safeMsg}`);
+    }
+
+    if (!upstream.ok) {
+      // Preserve auth/rate-limit and other permanent 4xx signals so callers can
+      // distinguish retryable from permanent failures. Remaining 5xx collapse to 502.
+      const text = new TextDecoder().decode(payload);
+      const safeMsg = safeAntigravityHttpErrorMessage(upstream.status, text);
+      if (upstream.status >= 400 && upstream.status < 500) {
+        return formatErrorResponse(upstream.status, "upstream_error", safeMsg);
+      }
+      return formatErrorResponse(502, "upstream_error", safeMsg);
+    }
+
+    let json: Record<string, unknown>;
+    try {
+      json = JSON.parse(new TextDecoder().decode(payload)) as Record<string, unknown>;
+    } catch {
+      return formatErrorResponse(502, "upstream_error", "CCA image response was not valid JSON");
+    }
+    const resp = (json.response ?? json) as {
+      candidates?: { content?: { parts?: { inlineData?: { mimeType?: string; data?: string }; text?: string }[] }; finishReason?: string }[];
+      promptFeedback?: { blockReason?: string };
+    };
+    // Safety blocks are permanent for the same prompt — return 400 (non-retryable)
+    // instead of 502 (which codex retries up to 5 times, wasting paid quota on a
+    // prompt that will never succeed). Two blocking signals exist in the Gemini
+    // API: promptFeedback.blockReason (prompt rejected before generation) and
+    // candidate.finishReason (generation cut off by a content filter).
+    const blockReason = resp.promptFeedback?.blockReason;
+    if (typeof blockReason === "string" && blockReason.trim()) {
+      return formatErrorResponse(400, "invalid_request_error", `CCA image generation blocked by safety filter (promptFeedback.blockReason: ${blockReason})`);
+    }
+    const candidate = resp.candidates?.[0];
+    const finishReason = candidate?.finishReason;
+    if (typeof finishReason === "string" && CCA_BLOCKING_FINISH_REASONS.has(finishReason)) {
+      return formatErrorResponse(400, "invalid_request_error", `CCA image generation blocked by safety filter (finishReason: ${finishReason})`);
+    }
+    const parts = candidate?.content?.parts;
+    if (!Array.isArray(parts)) {
+      return formatErrorResponse(502, "upstream_error", "CCA image response had no valid parts array");
+    }
+    const images: { b64_json: string }[] = [];
+    for (const part of parts) {
+      if (!part || typeof part !== "object") continue;
+      const data = part.inlineData?.data;
+      if (typeof data !== "string" || data.length === 0) continue;
+      if (data.length > MAX_ENCODED_BYTES_PER_IMAGE) {
+        return formatErrorResponse(502, "upstream_error", "CCA image payload exceeds per-image size cap");
+      }
+      try {
+        decodeValidatedImageBase64(data);
+      } catch {
+        return formatErrorResponse(502, "upstream_error", "CCA image payload failed base64/magic validation");
+      }
+      images.push({ b64_json: data });
+    }
+    if (images.length === 0) {
+      return formatErrorResponse(502, "upstream_error", "CCA image model returned no image data");
+    }
+    // Only `{created, data:[{b64_json}]}` is returned — no token, projectId, or
+    // upstream metadata leak through. The Authorization header is consumed by the
+    // fetch above and never copied onto this Response.
+    return new Response(JSON.stringify({ created: Math.floor(Date.now() / 1000), data: images }), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  } finally {
+    linkedSignal.cleanup();
+  }
+}
+
 export async function handleImages(
   req: Request,
   config: OcxConfig,
@@ -53,11 +329,18 @@ export async function handleImages(
     return formatErrorResponse(400, "invalid_request_error", candidates.error);
   }
   const explicitKeyedProvider = config.images?.provider !== undefined && candidates.keyed !== undefined;
+  // Admission bearer is valid proxy auth (requireApiAuth already passed) but must never be
+  // forwarded as OpenAI ChatGPT credentials. When the caller sent it, skip OpenAI forward
+  // and allow CCA / keyed paths instead of rejecting the whole request.
+  let skipOpenAiForwardForAdmissionBearer = false;
   if (!explicitKeyedProvider) {
     try { validateForwardAdmissionCredential(req.headers, config); }
     catch (err) {
-      if (err instanceof ForwardAdmissionCredentialError) return formatErrorResponse(401, "authentication_error", err.message);
-      throw err;
+      if (err instanceof ForwardAdmissionCredentialError) {
+        skipOpenAiForwardForAdmissionBearer = true;
+      } else {
+        throw err;
+      }
     }
   }
   let body: unknown;
@@ -69,15 +352,19 @@ export async function handleImages(
   const model = (body as { model?: unknown } | null)?.model;
   if (typeof model === "string" && model) logCtx.model = model;
 
-  if (candidates.forwardCandidates.length === 0 && !candidates.keyed) {
+  const canUseOpenAiForward = !skipOpenAiForwardForAdmissionBearer && candidates.forwardCandidates.length > 0;
+
+  if (!canUseOpenAiForward && !candidates.keyed) {
+    const ccaResponse = await tryCcaImageGeneration(body, config, logCtx, req.signal, endpoint);
+    if (ccaResponse) return ccaResponse;
     // 400, not 5xx: codex retries every 5xx up to 5 total attempts, and this is a permanent
     // configuration state that must surface on the first attempt.
     return formatErrorResponse(
       400,
       "invalid_request_error",
-      "Built-in image generation needs an OpenAI upstream (ChatGPT login or an OpenAI API-key provider), "
-      + "but none is configured in opencodex. Routed providers cannot serve /v1/images/* — "
-      + "add an OpenAI provider or disable the tool with `codex features disable image_generation`.",
+      "Built-in image generation needs an OpenAI upstream (ChatGPT login or an OpenAI API-key provider) "
+      + "or a logged-in Google Antigravity (Cloud Code Assist) provider, "
+      + "but none is configured in opencodex. Add a provider or disable the tool with `codex features disable image_generation`.",
     );
   }
 
@@ -86,7 +373,7 @@ export async function handleImages(
   // 429 image_gen while api.openai.com sits idle).
   let forward: Awaited<ReturnType<typeof resolveFirstUsableOpenAiSidecar>>;
   let forwardAuthError: Response | undefined;
-  if (candidates.forwardCandidates.length > 0) {
+  if (canUseOpenAiForward) {
     try {
       forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config);
       if (forward) logCtx.provider = formatCodexProviderForLog(forward.providerName, codexLogAccountId(forward.authContext), config);
@@ -116,8 +403,12 @@ export async function handleImages(
     // The ChatGPT codex backend takes bare paths (matches the adapter's `${baseUrl}/responses`).
     url = `${provider.baseUrl}/images/${endpoint}`;
   } else if (forwardAuthError) {
-    // A configured OpenAI pool mode owns its authentication failure. Do not hide a
-    // broken/expired pool behind separately billed API-key image generation.
+    // Before surfacing the OpenAI auth failure, try CCA — the user may have a
+    // valid Google Antigravity login even though their OpenAI pool is broken.
+    const ccaResponse = await tryCcaImageGeneration(body, config, logCtx, req.signal, endpoint);
+    if (ccaResponse) return ccaResponse;
+    // No CCA either: a configured OpenAI pool mode owns its authentication failure.
+    // Do not hide a broken/expired pool behind separately billed API-key image generation.
     return forwardAuthError;
   } else if (candidates.keyed) {
     const { provider, apiKey, providerName } = candidates.keyed;
@@ -127,6 +418,9 @@ export async function handleImages(
     // Keyed providers tolerate baseUrl with or without /v1 (mirrors openai-responses.ts).
     url = `${provider.baseUrl.replace(/\/v1\/?$/, "")}/v1/images/${endpoint}`;
   } else {
+    // No usable OpenAI credential — try CCA before giving up.
+    const ccaResponse = await tryCcaImageGeneration(body, config, logCtx, req.signal, endpoint);
+    if (ccaResponse) return ccaResponse;
     return formatErrorResponse(
       401,
       "authentication_error",

package/src/server/index.ts

@@ -20,10 +20,14 @@ import {
 import { reconcileOAuthProviders } from "../oauth";
 import { invalidateCodexModelsCache } from "../codex/catalog";
 import { startMemoryWatchdog } from "./memory-watchdog";
+import { setStorageCleanupPolicyLiveSink } from "../storage/policy";
+import { setStorageCleanupPolicyJobLiveApply } from "../storage/policy-job";
+import { scheduleStorageCleanupStartupRun, startStorageCleanupScheduler } from "../storage/policy-scheduler";
 import { runOpenAiTierStartupMigration } from "../providers/openai-tier-startup";
 import { runAlibabaRegionStartupMigration } from "../providers/alibaba-region-startup";
 import { isCanonicalOpenAiForwardProvider } from "../providers/openai-tiers";
 import { providerCodexAccountMode } from "../providers/registry";
+import type { StorageCleanupPolicy } from "../types";
 import {
   CodexAccountCooldownError,
   cooldownErrorMessage,
@@ -52,6 +56,8 @@ export {
   drainAndShutdown,
   getActiveTurnCount,
   isDraining,
+  isRecyclingForExit,
+  markRecyclingForExit,
   registerTurn,
   trackStreamLifetime,
   unregisterTurn,
@@ -98,8 +104,10 @@ export {
 import {
   assertServerAuthConfig,
   corsHeaders,
+  managementCorsHeaders,
   hasValidApiAuth,
   isAllowedRequestOrigin,
+  isAllowedManagementOrigin,
   isApiAuthRequired,
   isLoopbackHostname,
   jsonResponse,
@@ -108,6 +116,7 @@ import {
   safeConfigDTO,
   setCorsOrigin,
   withCors,
+  withManagementCors,
 } from "./auth-cors";
 export {
   assertServerAuthConfig,
@@ -129,6 +138,7 @@ import { handleImages } from "./images";
 import { handleLive, logLiveSidebandFrame, parseLiveSidebandTarget, resolveLiveSidebandUpgrade } from "./live";
 import { handleSearch } from "./search";
 import { fetchAllModels, handleManagementAPI, VERSION } from "./management-api";
+import { initializeManagementAuthState, issueGuiSession, requireManagementAuth } from "./management-auth";
 
 const MAX_WS_FRAME_BYTES = 50 * 1024 * 1024;
 const WEBSOCKET_IDLE_TIMEOUT_SECONDS = 0;
@@ -220,14 +230,16 @@ function attachLiveSidebandUpstream(ws: ServerWebSocket<WsData>): void {
 // Source invariant for tests/passthrough-abort.test.ts after the pure module split:
 // if (isEventStream && upstreamResponse.body) {
 // const repairConfig = route.provider.responsesItemIdRepair;
-// #314 gated shape (win32-no-repair only; default OFF on the bundled known-bad runtime):
+// const needsClientRewrite = imageGenCallAliases.size > 0
+// #314 gated shape (win32-no-client-rewrite only; default OFF on the bundled known-bad runtime):
 // decideEagerRelay(config.streamMode ?? "auto")
 // relaySseEagerBounded(upstreamResponse.body, turnAc,
+// new Response(eagerBody,
 // Default shape (tee + background inspection):
 // upstreamResponse.body.tee()
 // const repairedBody = hasResponsesItemIdRepair(repairConfig)
 // process.platform === "win32"
-// && !hasResponsesItemIdRepair(repairConfig)
+// && !needsClientRewrite
 // ? nativeBody
 // relaySseWithFailedTail(repairedBody, upstream)
 // new Response(clientBody
@@ -242,6 +254,7 @@ export function startServer(port?: number) {
   const config = runAlibabaRegionStartupMigration(runOpenAiTierStartupMigration(loadConfig()));
   applyProxyEnv(config);
   assertServerAuthConfig(config);
+  const managementAuth = initializeManagementAuthState(config);
   // Refresh OAuth provider presets (models/noReasoningModels) from the registry so a proxy update
   // adding/dropping models reaches existing configs on start — not just fresh installs.
   reconcileOAuthProviders(config);
@@ -288,6 +301,16 @@ export function startServer(port?: number) {
   // #314: warn-only RSS observability (unref'd, idempotent — safe under repeated
   // startServer(0) in tests). Snapshot surfaces via GET /api/system/memory.
   startMemoryWatchdog();
+  // Issue #42 Phase 3: opt-in archived auto-cleanup (default OFF). Unref'd hourly
+  // tick for daily/weekly; startup evaluation is fire-and-forget after listen.
+  // Heavy work runs in a Worker via the single-flight job controller.
+  // Keep live config.policy in sync when background runs advance nextRun/lastRun.
+  const applyPolicy = (policy: StorageCleanupPolicy) => {
+    config.storageCleanupPolicy = policy;
+  };
+  setStorageCleanupPolicyLiveSink(applyPolicy);
+  setStorageCleanupPolicyJobLiveApply(applyPolicy);
+  startStorageCleanupScheduler();
 
   const listenPort = port ?? config.port ?? 10100;
   setCorsOrigin(listenPort);
@@ -296,7 +319,8 @@ export function startServer(port?: number) {
   // resolves localhost→127.0.0.1): on Windows `localhost` resolves ::1-first, but the injected URL
   // is 127.0.0.1, so binding literal "localhost" would reintroduce the F4 refusal. Wildcards
   // (0.0.0.0/::) and specific hosts are left untouched so intentional exposure is preserved.
-  const bindHost = /^localhost$/i.test(config.hostname ?? "") ? "127.0.0.1" : (config.hostname ?? "127.0.0.1");
+  const configuredHost = config.hostname?.trim();
+  const bindHost = !configuredHost || /^localhost$/i.test(configuredHost) ? "127.0.0.1" : configuredHost;
 
   // Codex treats empty / non-JSON 503 bodies as "Unknown error" (#452). Keep Retry-After and
   // the server_is_overloaded code so clients can back off, but always return a JSON envelope.
@@ -319,10 +343,17 @@ export function startServer(port?: number) {
       markActivity(`${req.method} ${url.pathname}`);
 
       if (req.method === "OPTIONS") {
-        if (!isAllowedRequestOrigin(req, config)) {
+        const managementPreflight = url.pathname.startsWith("/api/");
+        const allowed = managementPreflight
+          ? isAllowedManagementOrigin(req, config)
+          : isAllowedRequestOrigin(req, config);
+        if (!allowed) {
           return new Response(null, { status: 403, headers: corsHeaders() });
         }
-        return new Response(null, { status: 204, headers: corsHeaders(req, config) });
+        return new Response(null, {
+          status: 204,
+          headers: managementPreflight ? managementCorsHeaders(req, config) : corsHeaders(req, config),
+        });
       }
 
       // Responses WebSocket (phase 120.2). Codex upgrades the same /v1/responses path; auth is
@@ -358,10 +389,11 @@ export function startServer(port?: number) {
       }
 
       if (url.pathname.startsWith("/api/")) {
-        const apiAuthError = requireApiAuth(req, config, "management");
-        if (apiAuthError) return withCors(apiAuthError, req, config);
+        const apiAuthError = requireManagementAuth(req, managementAuth, config);
+        if (apiAuthError) return withManagementCors(apiAuthError, req, config);
         const mgmtResponse = await handleManagementAPI(req, url, config);
-        if (mgmtResponse) return withCors(mgmtResponse, req, config);
+        if (mgmtResponse) return withManagementCors(mgmtResponse, req, config);
+        return withManagementCors(formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`), req, config);
       }
 
       if (url.pathname === "/v1/models" && req.method === "GET") {
@@ -484,6 +516,36 @@ export function startServer(port?: number) {
         return withCors(response, req, config);
       }
 
+      if (req.method === "GET" && url.pathname.startsWith("/v1/opencodex/artifacts/")) {
+        const apiAuthError = requireApiAuth(req, config, "data-plane");
+        if (apiAuthError) return withCors(apiAuthError, req, config);
+        if (!isAllowedRequestOrigin(req, config)) {
+          return withCors(formatErrorResponse(403, "origin_rejected", "cross-origin data-plane request blocked"), req, config);
+        }
+        const id = decodeURIComponent(url.pathname.slice("/v1/opencodex/artifacts/".length));
+        const { resolveArtifactPath } = await import("../images/artifacts");
+        const artifactPath = resolveArtifactPath(id);
+        if (!artifactPath) {
+          return withCors(formatErrorResponse(404, "not_found", "artifact not found"), req, config);
+        }
+        const file = Bun.file(artifactPath);
+        const ext = artifactPath.split(".").pop()?.toLowerCase();
+        const contentType =
+          ext === "png" ? "image/png"
+            : ext === "jpg" || ext === "jpeg" ? "image/jpeg"
+              : ext === "webp" ? "image/webp"
+                : ext === "gif" ? "image/gif"
+                  : "application/octet-stream";
+        return withCors(new Response(file, {
+          status: 200,
+          headers: {
+            "content-type": contentType,
+            "cache-control": "private, max-age=3600",
+            "x-content-type-options": "nosniff",
+          },
+        }), req, config);
+      }
+
       if (url.pathname === "/v1/alpha/search" && req.method === "POST") {
         disableResponsesRequestTimeout(req, requestServer);
         if (isDraining()) {
@@ -675,7 +737,10 @@ export function startServer(port?: number) {
         return withCors(formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`), req, config);
       }
 
-      const guiFile = serveGuiFile(url.pathname);
+      const guiSessionCandidate = req.method === "GET" && (url.pathname === "/" || !url.pathname.includes("."))
+        ? issueGuiSession(req, config, managementAuth)
+        : null;
+      const guiFile = serveGuiFile(url.pathname, undefined, guiSessionCandidate ?? undefined);
       if (guiFile) return guiFile;
       if (url.pathname === "/" && req.method === "GET") {
         return jsonResponse(rootFallbackPayload());
@@ -876,5 +941,8 @@ export function startServer(port?: number) {
       .catch(() => {});
   }
 
+  // Opt-in storage policy (default OFF). Never blocks listen; cancellable on shutdown.
+  scheduleStorageCleanupStartupRun();
+
   return server;
 }

package/src/server/lifecycle.ts

@@ -1,4 +1,10 @@
 import { flushResponseState } from "../responses/state";
+import { setStorageCleanupPolicyLiveSink } from "../storage/policy";
+import {
+  abortStorageCleanupPolicyJob,
+  setStorageCleanupPolicyJobLiveApply,
+} from "../storage/policy-job";
+import { stopStorageCleanupScheduler } from "../storage/policy-scheduler";
 
 // ---------------------------------------------------------------------------
 // Active turn tracking + graceful shutdown drain
@@ -6,6 +12,7 @@ import { flushResponseState } from "../responses/state";
 
 const activeTurns = new Set<AbortController>();
 let draining = false;
+let recyclingForExit = false;
 let _serverRef: ReturnType<typeof Bun.serve> | undefined;
 
 export function setServerRef(server: ReturnType<typeof Bun.serve> | undefined): void { _serverRef = server; }
@@ -14,6 +21,18 @@ export function registerTurn(ac: AbortController): void { activeTurns.add(ac); }
 export function unregisterTurn(ac: AbortController): void { activeTurns.delete(ac); }
 export function isDraining(): boolean { return draining; }
 export function getActiveTurnCount(): number { return activeTurns.size; }
+/** Live listen port of the Bun server, when started. */
+export function getServerListenPort(): number | undefined {
+  const port = _serverRef?.port;
+  return typeof port === "number" && port > 0 ? port : undefined;
+}
+/**
+ * Mark this process as a recycle (dashboard drain-and-restart). Exit cleanup
+ * must keep Codex/Grok/system-env injection so the replacement process inherits
+ * a working fence — unlike an intentional `ocx stop` teardown.
+ */
+export function markRecyclingForExit(): void { recyclingForExit = true; }
+export function isRecyclingForExit(): boolean { return recyclingForExit; }
 
 export function trackStreamLifetime(
   body: ReadableStream<Uint8Array>,
@@ -67,7 +86,12 @@ export async function drainAndShutdown(
   }
   // Debounced replay-state snapshot may still be pending; flush so the last completed turn's
   // previous_response_id chain survives the restart this shutdown is usually part of.
-  flushResponseState();
+  await flushResponseState();
+  // Tear down opt-in storage policy timers / worker / live-config sink so they cannot fire after stop.
+  stopStorageCleanupScheduler();
+  abortStorageCleanupPolicyJob();
+  setStorageCleanupPolicyLiveSink(null);
+  setStorageCleanupPolicyJobLiveApply(null);
   s?.stop(true);
   draining = false;
 }