@bitkyc08/opencodex 2.7.42 → 2.7.43

package/src/server/management/provider-routes.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import type { CatalogModel } from "../../codex/catalog";
 import { catalogModelSlug, invalidateCodexModelsCache, nativeModelRows, uniqueCatalogModelsForPublicList } from "../../codex/catalog";
+import { providerModelsListFromProbeResponse } from "../../codex/catalog/provider-fetch";
 import {
   DEFAULT_SUBAGENT_MODELS,
   codexAutoStartEnabled,
@@ -23,12 +24,14 @@ import {
 } from "../../oauth";
 import { removeCredential } from "../../oauth/store";
 import { providerDestinationResolvedError } from "../../lib/destination-policy";
+import { providerOutboundGet, providerRedirectError } from "../../lib/provider-outbound";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "../../oauth/key-providers";
 import { deriveProviderPresets } from "../../providers/derive";
 import { providerCodexAccountMode } from "../../providers/registry";
 import { routedSlug, slugEquals } from "../../providers/slug-codec";
 import { clearProviderQuotaCache, fetchProviderQuotaReports } from "../../providers/quota";
 import { CODEX_FORWARD_BASE_URL, isCanonicalOpenAiForwardProvider } from "../../providers/openai-tiers";
+import { codexAccountNamespaceProviderCollisionError } from "../../codex/account-namespace-match";
 import { clearThreadAccountMap } from "../../codex/routing";
 import { primeCodexPoolQuotas } from "../../codex/auth-api";
 import { getProviderDiscoveryStatus } from "../../codex/model-cache";
@@ -76,6 +79,7 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       liveModels: p.liveModels !== false,
       models: p.models ?? [],
       authMode: p.authMode,
+      apiKeyTransport: p.apiKeyTransport,
       disabled: p.disabled === true,
       codexAccountMode: providerCodexAccountMode(name, p),
       discovery: p.liveModels === false ? undefined : getProviderDiscoveryStatus(name),
@@ -98,6 +102,10 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     if (!isValidProviderName(name)) {
       return jsonResponse({ error: "provider name must use letters, numbers, dot, underscore, or hyphen and cannot be a reserved object key" }, 400);
     }
+    const namespaceCollision = codexAccountNamespaceProviderCollisionError(config.codexAccountNamespaces, name);
+    if (namespaceCollision) {
+      return jsonResponse({ error: namespaceCollision }, 409);
+    }
     // Hostname destinations additionally get a DNS-resolved SSRF check at write time —
     // the sync check above only classifies literal IPs (review finding, PR #96).
     // Canonical openai still runs the resolver: only Clash fake-IP (198.18.0.0/15)
@@ -213,6 +221,18 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         return jsonResponse({ error: "authMode must be key, forward, oauth, or local" }, 400);
       }
     }
+    if (Object.hasOwn(rawBody, "apiKeyTransport")) {
+      const transport = rawBody.apiKeyTransport;
+      if (transport === "x-api-key" || transport === "bearer") {
+        next.apiKeyTransport = transport;
+        touched = true;
+      } else if (transport === "") {
+        delete next.apiKeyTransport;
+        touched = true;
+      } else {
+        return jsonResponse({ error: "apiKeyTransport must be x-api-key, bearer, or empty to clear" }, 400);
+      }
+    }
    if (Object.hasOwn(rawBody, "note")) {
      if (typeof rawBody.note !== "string") return jsonResponse({ error: "note must be a string" }, 400);
      const note = rawBody.note.trim();
@@ -321,17 +341,25 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     const { url: modelsUrl, headers } = buildModelsRequest(prov, apiKey, name);
     const started = Date.now();
     try {
-      const res = await fetch(modelsUrl, { headers, signal: AbortSignal.timeout(8000) });
+      const res = await providerOutboundGet(name, prov, modelsUrl, {
+        headers,
+        signal: AbortSignal.timeout(8000),
+      });
       const latencyMs = Date.now() - started;
+      const redirectError = await providerRedirectError(res, modelsUrl);
+      if (redirectError) {
+        return jsonResponse({
+          ok: false,
+          latencyMs,
+          error: redirectError,
+        });
+      }
       if (!res.ok) {
         return jsonResponse({ ok: false, latencyMs, error: `upstream /models returned ${res.status}` });
       }
-      const json = await res.json().catch(() => null) as { data?: unknown; models?: unknown } | null;
-      // OpenAI-style lists use { data: [...] }; Google's /v1beta/models (the other shape
-      // buildModelsRequest can produce) returns { models: [...] }.
-      const list = json && typeof json === "object" && !Array.isArray(json)
-        ? (Array.isArray(json.data) ? json.data : Array.isArray(json.models) ? json.models : undefined)
-        : undefined;
+      const json = await res.json().catch(() => null);
+      // OpenAI-style { data }, Google { models }, and Together-style top-level arrays (#617).
+      const list = providerModelsListFromProbeResponse(json);
       if (!Array.isArray(list)) {
         return jsonResponse({ ok: false, latencyMs, error: "upstream /models returned an unexpected shape" });
       }

package/src/server/management/system-restart.ts

@@ -0,0 +1,172 @@
+/**
+ * Dashboard memory-card drain-and-restart (#563).
+ *
+ * Longer than POST /api/stop's short drain: waits up to 60s for active turns,
+ * then respawns. Never runs restoreNativeCodex / stripGrokConfig — this is a
+ * recycle to reclaim RSS, not a teardown.
+ *
+ * Respawn policy (matches real supervisor configs in src/service.ts):
+ * - Supervised child (`OCX_SERVICE=1` + service installed): exit(1) so
+ *   failure-only supervisors (systemd Restart=on-failure, WinSW onfailure,
+ *   Task Scheduler ERRORLEVEL loop) bring the proxy back.
+ * - Otherwise: detached `ocx start --port <live>` (bypasses ensure's
+ *   codexAutoStart gate), mark recycle so exit cleanup keeps injection, exit(0).
+ * - If detached spawn fails (sync throw or pre-start `error`): exit(1) without
+ *   markRecycling — after drain the listen socket is already closed, so a latch
+ *   reset cannot recover serving. Clear inherited `OCX_SERVICE` so exit cleanup
+ *   can restore Codex/Grok fences (ensure/tray daemons set the marker without a
+ *   real supervisor). Log only a stable errno code — never the raw message
+ *   (paths in ENOENT often include the OS username).
+ */
+import { spawn } from "node:child_process";
+import {
+  drainAndShutdown,
+  getActiveTurnCount,
+  getServerListenPort,
+  isDraining,
+  markRecyclingForExit,
+  setDraining,
+} from "../lifecycle";
+import { isServiceInstalled } from "../../service";
+import { readRuntimePort } from "../../config";
+
+/** Fixed v1 drain window for the memory-card action (not config-driven). */
+export const MEMORY_DRAIN_RESTART_MS = 60_000;
+
+export interface SystemRestartIo {
+  drainAndShutdown?: typeof drainAndShutdown;
+  isServiceInstalled?: () => boolean;
+  isSupervisedServiceChild?: () => boolean;
+  /** Must resolve only after the replacement process has actually started. */
+  spawnStart?: (port?: number) => void | Promise<void>;
+  markRecycling?: () => void;
+  exitProcess?: (code: number) => void;
+  schedule?: (fn: () => void | Promise<void>, ms: number) => void;
+  isDraining?: () => boolean;
+  setDraining?: (value: boolean) => void;
+  getActiveTurnCount?: () => number;
+  listenPort?: () => number | undefined;
+}
+
+let restartIo: SystemRestartIo = {};
+/** Prevents double-scheduling in the 200ms window before drainAndShutdown sets draining. */
+let restartAccepted = false;
+
+/** Test seam — reset between tests. */
+export function setSystemRestartIoForTests(io: SystemRestartIo = {}): void {
+  restartIo = io;
+  restartAccepted = false;
+}
+
+function resolveListenPort(): number | undefined {
+  const live = getServerListenPort();
+  if (live) return live;
+  const runtime = readRuntimePort(process.pid);
+  if (runtime && runtime.port > 0) return runtime.port;
+  return undefined;
+}
+
+function isSupervisedServiceChild(): boolean {
+  return process.env.OCX_SERVICE === "1" && isServiceInstalled();
+}
+
+/** Stable, path-free spawn failure label for logs (never interpolate err.message). */
+function spawnFailureCode(err: unknown): string {
+  if (err && typeof err === "object" && "code" in err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (typeof code === "string" && code.length > 0 && code.length <= 64) return code;
+  }
+  return "spawn_failed";
+}
+
+function spawnDetachedStart(port?: number): Promise<void> {
+  const args = [process.argv[1], "start"];
+  if (typeof port === "number" && Number.isFinite(port) && port > 0 && port <= 65535) {
+    args.push("--port", String(Math.trunc(port)));
+  }
+  return new Promise<void>((resolve, reject) => {
+    let child: ReturnType<typeof spawn>;
+    try {
+      child = spawn(process.execPath, args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        env: { ...process.env, OCX_SERVICE: "1" },
+      });
+    } catch (err) {
+      reject(err);
+      return;
+    }
+    let settled = false;
+    const finish = (fn: () => void) => {
+      if (settled) return;
+      settled = true;
+      fn();
+    };
+    child.once("error", (err) => {
+      finish(() => reject(err));
+    });
+    child.once("spawn", () => {
+      finish(() => {
+        child.unref();
+        resolve();
+      });
+    });
+  });
+}
+
+/**
+ * Accept a drain-and-restart request. Returns immediately; the drain +
+ * respawn runs on a short timer so the HTTP response can flush first.
+ * Idempotent while already draining: returns the accepted shape again.
+ */
+export function acceptSystemRestart(io: SystemRestartIo = restartIo): {
+  accepted: true;
+  alreadyDraining: boolean;
+  activeTurnCount: number;
+  drainTimeoutMs: number;
+} {
+  const alreadyDraining = restartAccepted || (io.isDraining ?? isDraining)();
+  const activeTurnCount = (io.getActiveTurnCount ?? getActiveTurnCount)();
+  const schedule = io.schedule ?? ((fn, ms) => { setTimeout(() => { void fn(); }, ms); });
+
+  if (!alreadyDraining) {
+    restartAccepted = true;
+    // Reject new data-plane traffic immediately (503), before the 200ms response-flush delay.
+    (io.setDraining ?? setDraining)(true);
+    schedule(async () => {
+      const drain = io.drainAndShutdown ?? drainAndShutdown;
+      await drain(undefined, MEMORY_DRAIN_RESTART_MS);
+      const supervised = (io.isSupervisedServiceChild ?? isSupervisedServiceChild)();
+      if (supervised) {
+        // Failure-only supervisors ignore exit(0); intentional non-zero triggers respawn.
+        (io.exitProcess ?? ((code: number) => { process.exit(code); }))(1);
+        return;
+      }
+      const port = (io.listenPort ?? resolveListenPort)();
+      const exitProcess = io.exitProcess ?? ((code: number) => { process.exit(code); });
+      try {
+        await (io.spawnStart ?? spawnDetachedStart)(port);
+      } catch (err) {
+        console.warn(
+          `⚠️  Drain-and-restart spawn failed (${spawnFailureCode(err)}); exiting without replacement`,
+        );
+        // Listen socket is already stopped; do not markRecycling — no child to inherit fences.
+        // ensure/tray children inherit OCX_SERVICE=1 without an installed service; clear it so
+        // syncCleanup can restore Codex/Grok fences instead of leaving clients pointed at a dead port.
+        delete process.env.OCX_SERVICE;
+        exitProcess(1);
+        return;
+      }
+      (io.markRecycling ?? markRecyclingForExit)();
+      exitProcess(0);
+    }, 200);
+  }
+
+  return {
+    accepted: true,
+    alreadyDraining,
+    activeTurnCount,
+    drainTimeoutMs: MEMORY_DRAIN_RESTART_MS,
+  };
+}

package/src/server/management/system-routes.ts

@@ -1,25 +1,31 @@
 /**
- * /api/system/* — service-process runtime/memory introspection (#314 WP3).
+ * /api/system/* — service-process runtime/memory introspection (#314 WP3)
+ * and the memory-card drain-and-restart action (#563).
  *
  * Rides the standard management gate: every /api/* request already passed
- * requireApiAuth("management") + the origin check before dispatch, so these
+ * the independent management-auth gate + the origin check before dispatch, so these
  * routes add no auth of their own. NEVER expose this data on the
  * unauthenticated /healthz surface.
  *
- * The payload is scalar-only (numbers, enum strings): no paths, no tokens, no
- * account identifiers. `external` and `arrayBuffers` keep Windows diagnostics
- * honest when RSS/working-set counters under-report committed retention.
- * `jscHeap` (bun:jsc heapStats) is useful context, but on Bun 1.3.14 it is not a
- * standalone leak discriminator. `responseState` attributes growth further: it
- * is the proxy's previous_response_id continuation store, so a growing
- * responseState.totalBytes under rising observed memory points at conversation
- * retention rather than the runtime allocator.
+ * The payload is scalar-only (numbers, enum strings, booleans): no paths, no
+ * tokens, no account identifiers. `external` and `arrayBuffers` keep Windows
+ * diagnostics honest when RSS/working-set counters under-report committed
+ * retention. `jscHeap` (bun:jsc heapStats) is useful context, but on Bun 1.3.14
+ * it is not a standalone leak discriminator. `responseState` attributes growth
+ * further: it is the proxy's previous_response_id continuation store, so a
+ * growing responseState.totalBytes under rising observed memory points at
+ * conversation retention rather than the runtime allocator.
+ *
+ * `activeTurnCount` / `isDraining` are scalar lifecycle counters for the
+ * dashboard drain-and-restart confirm UX — never request bodies or IDs.
  */
 import { decideEagerRelay } from "../../lib/bun-stream-caps";
+import { getActiveTurnCount, isDraining } from "../lifecycle";
 import { getActiveMemoryWatchdog, observedMemoryCounter } from "../memory-watchdog";
 import { responseStateMetrics } from "../../responses/state";
 import { jsonResponse } from "../auth-cors";
 import type { ManagementContext } from "./context";
+import { acceptSystemRestart } from "./system-restart";
 
 const ENDPOINT_SAMPLE_LIMIT = 60;
 
@@ -76,7 +82,24 @@ export async function handleSystemRoutes(ctx: ManagementContext): Promise<Respon
       streamMode,
       eagerRelay: process.platform === "win32" ? decideEagerRelay(streamMode) : null,
       watchdog,
+      activeTurnCount: getActiveTurnCount(),
+      isDraining: isDraining(),
     });
   }
+
+  if (url.pathname === "/api/system/restart" && req.method === "POST") {
+    // Longer informed drain than /api/stop; does not tear down Codex/Grok injection.
+    const result = acceptSystemRestart();
+    return jsonResponse({
+      success: true,
+      message: result.alreadyDraining
+        ? "Drain already in progress."
+        : "Draining in-flight requests, then restarting.",
+      activeTurnCount: result.activeTurnCount,
+      drainTimeoutMs: result.drainTimeoutMs,
+      alreadyDraining: result.alreadyDraining,
+    }, 202, req, config);
+  }
+
   return null;
 }

package/src/server/management-api.ts

@@ -53,7 +53,7 @@ import { drainAndShutdown } from "./lifecycle";
 import { filterRequestLogs, getRequestLogEntries, type RequestLogEntry } from "./request-log";
 import { estimateComboCost, estimateRequestCost, normalizeCostTokens, tokensPerSecond } from "../usage/cost";
 import type { PersistedUsageAttempt } from "../usage/log";
-import { isAllowedRequestOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "./auth-cors";
+import { isAllowedManagementOrigin, jsonResponse, providerManagementConfigError, publicProviderBaseUrl, safeConfigDTO } from "./auth-cors";
 import { applySystemEnvToggle } from "./system-env";
 
 import type { ManagementApiDeps } from "./management/context";
@@ -79,7 +79,7 @@ export const VERSION = (() => {
 })();
 
 export async function handleManagementAPI(req: Request, url: URL, config: OcxConfig, deps: ManagementApiDeps = {}): Promise<Response | null> {
-  if (!isAllowedRequestOrigin(req, config)) {
+  if (!isAllowedManagementOrigin(req, config)) {
     return jsonResponse({ error: "cross-origin request blocked" }, 403, req, config);
   }
   // Management bodies are small JSON (provider names, key ids, settings). Reject oversized

package/src/server/management-auth.ts

@@ -0,0 +1,216 @@
+import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  fsyncSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+import { adminApiTokenFilePath } from "../lib/admin-secrets";
+import { hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
+import type { OcxConfig } from "../types";
+import {
+  isAllowedManagementOrigin,
+  isApiAuthRequired,
+  isDataPlaneAdmissionSecret,
+  isLoopbackHostname,
+  managementRequestOrigin,
+  parseHttpHost,
+} from "./auth-cors";
+
+const GUI_SESSION_TTL_MS = 5 * 60_000;
+const GUI_SESSION_LIMIT = 128;
+
+interface GuiSessionRecord {
+  csrfToken: string;
+  origin: string;
+  expiresAt: number;
+}
+
+export interface GuiSessionBootstrap extends GuiSessionRecord {
+  token: string;
+}
+
+export type ManagementAuthState =
+  | {
+    available: true;
+    token: string;
+    source: "environment" | "file";
+    sessions: Map<string, GuiSessionRecord>;
+  }
+  | { available: false; reason: string };
+
+function fail(reason: string): ManagementAuthState {
+  return { available: false, reason };
+}
+
+function assertSafeDirectory(path: string): void {
+  mkdirSync(path, { recursive: true, mode: 0o700 });
+  const stat = lstatSync(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("management token directory is not a regular directory");
+  chmodSync(path, 0o700);
+  const hardened = hardenSecretDir(path, { required: true });
+  if (!hardened.ok) throw new Error("management token directory ACL hardening did not complete");
+}
+
+function readExistingToken(path: string): string {
+  const stat = lstatSync(path);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 512) {
+    throw new Error("management token path is not a regular secret file");
+  }
+  chmodSync(path, 0o600);
+  const hardened = hardenSecretPath(path, { required: true });
+  if (!hardened.ok) throw new Error("management token file ACL hardening did not complete");
+  const token = readFileSync(path, "utf8").trim();
+  if (!/^ocx_admin_[A-Za-z0-9_-]{43}$/.test(token)) throw new Error("management token file is invalid");
+  return token;
+}
+
+function removeBestEffort(path: string): void {
+  try { unlinkSync(path); } catch { /* fail-closed state is preserved by the caller */ }
+}
+
+function createTokenFile(path: string): string {
+  const directory = dirname(path);
+  const token = `ocx_admin_${randomBytes(32).toString("base64url")}`;
+  const temporary = join(directory, `.${randomUUID()}.admin-token.tmp`);
+  let linked = false;
+  let fd: number | null = null;
+  try {
+    fd = openSync(temporary, "wx", 0o600);
+    writeFileSync(fd, `${token}\n`, "utf8");
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = null;
+    chmodSync(temporary, 0o600);
+    const temporaryHardened = hardenSecretPath(temporary, { required: true });
+    if (!temporaryHardened.ok) throw new Error("management token temporary ACL hardening did not complete");
+    try {
+      linkSync(temporary, path);
+      linked = true;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "EEXIST") return readExistingToken(path);
+      throw error;
+    }
+    const finalHardened = hardenSecretPath(path, { required: true });
+    if (!finalHardened.ok) throw new Error("management token file ACL hardening did not complete");
+    return token;
+  } catch (error) {
+    if (linked) removeBestEffort(path);
+    throw error;
+  } finally {
+    if (fd !== null) {
+      try { closeSync(fd); } catch { /* best effort */ }
+    }
+    removeBestEffort(temporary);
+  }
+}
+
+function ready(token: string, source: "environment" | "file", config: OcxConfig): ManagementAuthState {
+  if (isDataPlaneAdmissionSecret(token, config)) {
+    return fail("management credential conflicts with a data-plane credential");
+  }
+  return { available: true, token, source, sessions: new Map() };
+}
+
+export function initializeManagementAuthState(config: OcxConfig): ManagementAuthState {
+  const environmentToken = process.env.OPENCODEX_ADMIN_AUTH_TOKEN?.trim();
+  if (environmentToken) {
+    return ready(environmentToken, "environment", config);
+  }
+  try {
+    const path = adminApiTokenFilePath();
+    assertSafeDirectory(dirname(path));
+    let token: string;
+    try {
+      token = readExistingToken(path);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      token = createTokenFile(path);
+    }
+    return ready(token, "file", config);
+  } catch (error) {
+    return fail(error instanceof Error ? error.message : "management token initialization failed");
+  }
+}
+
+function equalSecret(actual: string, expected: string): boolean {
+  const encoder = new TextEncoder();
+  const left = encoder.encode(actual);
+  const right = encoder.encode(expected);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+
+function removeExpiredSessions(state: Extract<ManagementAuthState, { available: true }>, now = Date.now()): void {
+  for (const [token, session] of state.sessions) {
+    if (session.expiresAt <= now) state.sessions.delete(token);
+  }
+}
+
+function randomSessionSecret(prefix: "ocx_session_"): string {
+  return `${prefix}${randomBytes(32).toString("base64url")}`;
+}
+
+export function issueGuiSession(
+  req: Request,
+  config: OcxConfig,
+  state: ManagementAuthState,
+): GuiSessionBootstrap | null {
+  if (isApiAuthRequired(config) || !state.available || req.method !== "GET" || !isAllowedManagementOrigin(req, config)) return null;
+  const host = parseHttpHost(req.headers.get("Host"));
+  if (!host || !isLoopbackHostname(host.hostname)) return null;
+  const origin = managementRequestOrigin(req, config);
+  if (!origin) return null;
+  const now = Date.now();
+  removeExpiredSessions(state, now);
+  while (state.sessions.size >= GUI_SESSION_LIMIT) {
+    const oldest = state.sessions.keys().next().value as string | undefined;
+    if (!oldest) break;
+    state.sessions.delete(oldest);
+  }
+  const token = randomSessionSecret("ocx_session_");
+  const session: GuiSessionRecord = {
+    csrfToken: randomBytes(32).toString("base64url"),
+    origin,
+    expiresAt: now + GUI_SESSION_TTL_MS,
+  };
+  state.sessions.set(token, session);
+  return { token, ...session };
+}
+
+export function requireManagementAuth(
+  req: Request,
+  state: ManagementAuthState,
+  config?: OcxConfig,
+): Response | null {
+  if (!state.available) {
+    return Response.json({ error: "management API unavailable" }, { status: 503 });
+  }
+  const actual = req.headers.get("x-opencodex-api-key")?.trim()
+    || req.headers.get("authorization")?.replace(/^Bearer\s+/i, "").trim();
+  if (actual && equalSecret(actual, state.token)) return null;
+  if (actual && config) {
+    removeExpiredSessions(state);
+    const session = state.sessions.get(actual);
+    if (session) {
+      const requestOrigin = managementRequestOrigin(req, config);
+      const claimedOrigin = req.headers.get("x-opencodex-gui-origin");
+      const browserOrigin = req.headers.get("Origin");
+      const sameOrigin = requestOrigin === session.origin
+        && claimedOrigin === session.origin
+        && (!browserOrigin || browserOrigin === session.origin);
+      const safeMethod = req.method === "GET" || req.method === "HEAD";
+      const csrf = req.headers.get("x-opencodex-csrf-token")?.trim();
+      if (sameOrigin && (safeMethod || (browserOrigin === session.origin && !!csrf && equalSecret(csrf, session.csrfToken)))) {
+        return null;
+      }
+    }
+  }
+  return Response.json({ error: "opencodex admin token required" }, { status: 401 });
+}

package/src/server/proxy-liveness.ts

@@ -37,6 +37,8 @@ export interface LiveProxy {
   port: number;
   /** Raw bind hostname the probe succeeded against; compose URLs via `probeHostname`. */
   hostname?: string;
+  /** Whether the successful probe used runtime-port metadata or the configured listen port. */
+  source: "runtime" | "config";
 }
 
 /**
@@ -118,7 +120,7 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
         // healthz confirmed the pid itself → trusted; a pidless legacy body did not,
         // so the cheap pid must pass full identity verification before it is returned.
         const trusted = identity.pid === pid ? pid : killablePid(pid);
-        return { pid: trusted, port: runtime.port, hostname: runtime.hostname };
+        return { pid: trusted, port: runtime.port, hostname: runtime.hostname, source: "runtime" };
       }
     }
   }
@@ -133,12 +135,21 @@ export async function findLiveProxy(io: LivenessIo = {}): Promise<LiveProxy | nu
     // Only the healthz-reported pid is authoritative here. The record's pid may be stale
     // (its process dead, the port reused by a pidless legacy proxy) — synthesizing it
     // would hand destructive callers (stopProxy → kill fallback) a reusable pid.
-    if (identity) return { pid: identity.pid ?? null, port: record.port, hostname: record.hostname };
+    if (identity) {
+      return { pid: identity.pid ?? null, port: record.port, hostname: record.hostname, source: "runtime" };
+    }
   }
 
   const config = configFn();
   const port = config.port ?? 10100;
   const identity = await proxyIdentityAt(port, { hostname: config.hostname }, io);
-  if (identity) return { pid: identity.pid ?? killablePid(pid), port, hostname: config.hostname };
+  if (identity) {
+    return {
+      pid: identity.pid ?? killablePid(pid),
+      port,
+      hostname: config.hostname,
+      source: "config",
+    };
+  }
   return null;
 }