@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/server/claude-messages.ts

@@ -61,6 +61,7 @@ import { resolveWireProtocolOverride } from "./adapter-resolve";
 import type { OcxConfig } from "../types";
 import { readJsonRequestBody, resolveInboundBodyLimitBytes } from "./request-decompress";
 import { addFinalRequestLog, httpStatusForRequestLogTerminal, recordFirstOutput, type RequestLogContext } from "./request-log";
+import { recordGenerationEvent } from "./request-log-generation-window";
 import { createFinalRequestLog } from "./inference/final-log";
 import {
   conversationIdFromClaudeMetadata,
@@ -79,7 +80,7 @@ import { upstreamWireForAdapter } from "../protocols/contract";
 import { createProtocolEnvelope, type ProtocolEnvelope } from "../protocols/envelope";
 import { featuresFromMessagesBody, type ProtocolFeature } from "../protocols/features";
 import { credentialDomainFor, messagesBodyHasOpaqueState } from "../protocols/opaque-state";
-import { hasAnthropicFailoverQuorum } from "../oauth/anthropic-routing";
+import { hasAnthropicFailoverQuorum, anthropicSessionKeyFromParts } from "../oauth/anthropic-routing";
 import { checkRepresentable, unrepresentableMessage } from "../protocols/guard";
 import { requestPathForLane } from "../protocols/path";
 import { resolveApiSurfaceSettings, resolveProtocolSettings } from "../protocols/settings";
@@ -143,10 +144,10 @@ function decodeClaudeFastSelector(raw: string, cc?: OcxConfig["claudeCode"]): st
   return decodedBase === bare ? exact : `${decodedBase}--fast`;
 }
 
-/** Restore the reversible Fable picker alias before Anthropic passthrough checks. */
-function decodeFablePickerAlias(raw: string, cc?: OcxConfig["claudeCode"]): string {
+/** Restore reversible native Claude picker aliases before Anthropic passthrough checks. */
+function decodeNativeClaudePickerAlias(raw: string, cc?: OcxConfig["claudeCode"]): string {
   const decoded = resolveInboundModel(raw, cc);
-  if (!decoded.startsWith("claude-fable-")) return raw;
+  if (!decoded.startsWith("claude-")) return raw;
   // A picker value saved before the ocx-claude spelling keeps the native passthrough too.
   return claudeCodeNativeAlias(decoded) === raw || legacyAliasForNative(decoded) === raw ? decoded : raw;
 }
@@ -334,6 +335,7 @@ export function tapAnthropicSseForLog(
     let data: unknown;
     try { data = JSON.parse(dataLine); } catch { return; }
     if (!isRec(data)) return;
+    recordGenerationEvent(logCtx, data.type);
     if (data.type === "message_start" && isRec(data.message) && isRec(data.message.usage)) {
       usageAcc = { ...usageAcc, ...data.message.usage };
     } else if (data.type === "message_delta" && isRec(data.usage)) {
@@ -894,7 +896,7 @@ async function handleClaudeMessagesWithBudget(
       }
     }
     if (isRec(anthropicBody) && typeof anthropicBody.model === "string") {
-      anthropicBody.model = decodeFablePickerAlias(anthropicBody.model, cc);
+      anthropicBody.model = decodeNativeClaudePickerAlias(anthropicBody.model, cc);
     }
     if (isRec(anthropicBody) && typeof anthropicBody.model === "string") {
       requestedModel = anthropicBody.model;
@@ -1206,6 +1208,13 @@ async function handleClaudeMessagesWithBudget(
       // Compatibility identity is an opaque request-local handle, separate from credentials.
       clientIdentity: captureAnthropicClientIdentity(req.headers),
       callerAnthropicBeta: req.headers.get("anthropic-beta"),
+      sessionKey: anthropicSessionKeyFromParts({
+        sessionIdHeader: req.headers.get("session_id")?.trim() || req.headers.get("x-claude-code-session-id"),
+        threadIdHeader: req.headers.get("thread_id"),
+        clientThreadId: conversationIdFromClaudeMetadata(isRec(nativeBody.metadata) ? nativeBody.metadata : undefined),
+        promptCacheKey: typeof internalBody.prompt_cache_key === "string" ? internalBody.prompt_cache_key : null,
+        promptCacheKeyIsSharedCohort: cacheKeySource === "system",
+      }),
     });
   }
 
@@ -1313,10 +1322,12 @@ async function handleClaudeMessagesWithBudget(
     const replayRefusal = isReplayRefusalResponse(response);
     // Re-shape the OpenAI-style error envelope into the Anthropic one, preserving status.
     let message = `upstream error (${response.status})`;
+    let contextError = false;
     try {
       const text = await response.text();
       try {
-        const parsed = JSON.parse(text) as { error?: { message?: string; type?: string } | string; message?: string };
+        const parsed = JSON.parse(text) as { error?: { message?: string; type?: string; code?: unknown } | string; message?: string };
+        contextError = typeof parsed?.error === "object" && parsed.error?.code === "context_length_exceeded";
         const nested = typeof parsed?.error === "object" && parsed.error ? parsed.error.message : undefined;
         const flat = typeof parsed?.error === "string" ? parsed.error : parsed?.message;
         message = nested || flat || (text ? `upstream error (${response.status}): ${text.slice(0, 400)}` : message);
@@ -1325,7 +1336,7 @@ async function handleClaudeMessagesWithBudget(
       }
     } catch { /* keep fallback message */ }
     const upstreamRetryAfter = response.headers.get("retry-after");
-    const retryAfter = replayRefusal
+    const retryAfter = replayRefusal || contextError
       ? undefined
       : resolveClientRetryAfter({
           status: response.status,
@@ -1345,10 +1356,10 @@ async function handleClaudeMessagesWithBudget(
     const nativeMainFence = response.status === 503
       && upstreamRetryAfter?.trim() === "1"
       && message === CODEX_MAIN_PROFILE_MAINTENANCE_MESSAGE;
-    const transient = !replayRefusal && !nativeMainFence && isTransientUpstreamStatus(response.status);
+    const transient = !replayRefusal && !nativeMainFence && !contextError && isTransientUpstreamStatus(response.status);
     const outStatus = replayRefusal
       ? REPLAY_REFUSED_STATUS
-      : nativeMainFence ? 503 : transient ? 529 : response.status;
+      : nativeMainFence ? 503 : contextError ? 400 : transient ? 529 : response.status;
     const outHeaders = new Headers({ "Content-Type": "application/json" });
     if (retryAfter) outHeaders.set("Retry-After", retryAfter);
     else if (transient) outHeaders.set("Retry-After", "2");
@@ -1357,7 +1368,7 @@ async function handleClaudeMessagesWithBudget(
       outStatus,
       message,
       undefined,
-      replayRefusal ? UPSTREAM_RESET_REPLAY_REFUSED_CODE : undefined,
+      replayRefusal ? UPSTREAM_RESET_REPLAY_REFUSED_CODE : contextError ? "context_length_exceeded" : undefined,
     )), {
       status: outStatus,
       headers: outHeaders,
@@ -1408,7 +1419,7 @@ async function handleClaudeMessagesWithBudget(
       );
     }
     return new Response(JSON.stringify(message), {
-      status: isError ? 502 : 200,
+      status: isError ? (translatedError?.code === "context_length_exceeded" ? 400 : 502) : 200,
       headers: { "Content-Type": "application/json" },
     });
   }
@@ -1431,6 +1442,9 @@ async function handleClaudeMessagesWithBudget(
         "translation_buffer_limit",
       );
     }
+    if (error?.code === "context_length_exceeded") {
+      return anthropicErrorResponse(400, error.message ?? "upstream context limit exceeded", "invalid_request_error", error.code);
+    }
     return anthropicErrorResponse(502, error?.message ?? "upstream request failed", "api_error");
   }
   let message: Rec;
@@ -1659,7 +1673,7 @@ export async function handleClaudeCountTokens(
       model = stripOneMillionMarker(countRoute);
       raw.model = model;
     }
-    model = decodeFablePickerAlias(model, cc);
+    model = decodeNativeClaudePickerAlias(model, cc);
     raw.model = model;
     // Fast-only: count_tokens never parsed an effort row, so it must not start. It returns a
     // token estimate and sends no tier, so only the IDENTITY is corrected - without this the
@@ -1678,9 +1692,9 @@ export async function handleClaudeCountTokens(
     // A thread delta would undercount; refuse it exactly as the translated Messages path does.
     if (carriesMessageThread(raw)) return messageThreadUnsupportedResponse();
     // PF-08: an eligible managed-key route counts the body the native lane would send.
-    const nativeCountBody = resolveProtocolSettings(config).rollout.managedMessagesNative
-      ? (await import("./messages-native")).nativeMessagesCountBody(config, cc, raw, { fastRow: countFastRow !== null })
-      : undefined;
+    const nativeCountBody = (await import("./messages-native")).nativeMessagesCountBody(
+      config, cc, raw, { fastRow: countFastRow !== null }, captureAnthropicClientIdentity(req.headers),
+    );
     // A count answers for the prompt a real turn from this model would forward, so it projects
     // the same unserialized content that turn's `message_start` floor does. Counting the raw
     // caller body instead reported replayed thinking this route never sends (#4857 family).

package/src/server/droid-reasoning-default.ts

@@ -0,0 +1,50 @@
+import { CODEX_REASONING_LEVELS, configuredReasoningEfforts, isDeclaredReasoningEffort } from "../reasoning-effort";
+import { isPlainObject } from "../lib/plain-data";
+import type { OcxProviderConfig } from "../types";
+
+export { DROID_DEFAULT_EFFORT_HEADER } from "../clients/config-export/contracts";
+
+type ChatRequestBody = Record<string, unknown>;
+type DroidReasoningTarget = { provider: OcxProviderConfig; modelId: string };
+
+function hasExplicitEffort(body: ChatRequestBody): boolean {
+  return Object.hasOwn(body, "reasoning_effort")
+    || (isPlainObject(body.reasoning) && Object.hasOwn(body.reasoning, "effort"));
+}
+
+/** Read before the Chat body is bridged: the bridge drops null and unknown efforts, which still count as explicit. */
+export function droidReasoningDefault(header: string | null, chatBody: ChatRequestBody): string | undefined {
+  return header && isDeclaredReasoningEffort(header) && !hasExplicitEffort(chatBody) ? header : undefined;
+}
+
+function pendingDefault(
+  body: ChatRequestBody,
+  defaultEffort: string | undefined,
+  target: DroidReasoningTarget,
+): string | undefined {
+  if (!defaultEffort || hasExplicitEffort(body)) return undefined;
+  const supportedEfforts = configuredReasoningEfforts(target.provider, target.modelId)
+    ?? CODEX_REASONING_LEVELS.map(level => level.effort);
+  return supportedEfforts.includes(defaultEffort) ? defaultEffort : undefined;
+}
+
+export function applyDroidReasoningDefault(
+  body: ChatRequestBody,
+  defaultEffort: string | undefined,
+  target: DroidReasoningTarget,
+): void {
+  const effort = pendingDefault(body, defaultEffort, target);
+  if (effort) body.reasoning_effort = effort;
+}
+
+export function applyDroidResponsesReasoningDefault(
+  body: unknown,
+  defaultEffort: string | undefined,
+  target: DroidReasoningTarget,
+): boolean {
+  if (!isPlainObject(body)) return false;
+  const effort = pendingDefault(body, defaultEffort, target);
+  if (!effort) return false;
+  body.reasoning = { ...(isPlainObject(body.reasoning) ? body.reasoning : {}), effort };
+  return true;
+}

package/src/server/github-copilot-responses-repair.ts

@@ -14,6 +14,8 @@ import {
 } from "../lib/translator-budget";
 import {
   replaceSseDataPayload,
+  splitSseBlock,
+  sseLineEnding as blockNewline,
   sseDataPayload,
   type SseBlockRewrite,
 } from "./sse-payload-rewrite";
@@ -46,14 +48,9 @@ function byteLength(value: unknown): number {
   return Buffer.byteLength(JSON.stringify(value), "utf8");
 }
 
-function blockNewline(block: string): "\r\n" | "\n" {
-  return block.includes("\r\n") ? "\r\n" : "\n";
-}
-
 /** Keep a named SSE block's `event:` field aligned with its JSON `type`. */
 function withEventName(block: string, eventName: string): string {
-  const newline = blockNewline(block);
-  const lines = block.split(/\r?\n/);
+  const { newline, lines } = splitSseBlock(block);
   let replaced = false;
   const rewritten = lines.flatMap((line) => {
     if (!line.startsWith("event:")) return [line];

package/src/server/grok-responses-control-frame.ts

@@ -1,4 +1,4 @@
-import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, splitSseBlock, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 
 const GROK_CONTROL_FRAME_TYPES: Record<string, true> = {
   "codex.rate_limits": true,
@@ -144,7 +144,7 @@ export function createGrokResponsesControlFrameBlockRewrite(): SseBlockRewrite {
     let eventName = "";
     // SSE overwrites the event type on every event field, including empty resets.
     // Like sseDataPayload, remove only one optional ASCII space after the colon.
-    for (const line of block.split(/\r?\n/)) {
+    for (const line of splitSseBlock(block).lines) {
       if (line === "event") eventName = "";
       else if (line.startsWith("event:")) {
         const value = line.slice("event:".length);

package/src/server/grok-responses-snapshot-repair.ts

@@ -1,7 +1,7 @@
 /** Strict terminal reconstruction selected by the Grok compatibility marker. */
 import type { TranslatorBudget } from "../lib/translator-budget";
 import { MAX_COMPLETED_OUTPUT_ITEMS, MAX_COMPLETED_OUTPUT_ITEM_SOURCE_BYTES } from "./relay";
-import { replaceSseDataPayload, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+import { replaceSseDataPayload, splitSseBlock, sseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
 import { isPlainObject, jsonBlock, type RetainedOutputItem } from "./responses-snapshot-codec";
 import {
   requestToolScope,
@@ -215,14 +215,13 @@ function refusedTerminalBlock(
     },
   });
   const rewritten = replaceSseDataPayload(block, payload);
-  const newline = block.includes("\r\n") ? "\r\n" : "\n";
+  const { newline, lines } = splitSseBlock(rewritten);
   let eventRewritten = false;
-  const lines = rewritten.split(/\r?\n/).map(line => {
+  return lines.map(line => {
     if (eventRewritten || !line.startsWith("event:")) return line;
     eventRewritten = true;
     return `event: ${GROK_REFUSED_TERMINAL_EVENT_TYPE}`;
-  });
-  return lines.join(newline);
+  }).join(newline);
 }
 
 /**

package/src/server/gui-session.ts

@@ -1,6 +1,6 @@
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import type { OcxConfig } from "../types";
-import { canonicalGuiBrowserOrigin } from "../lib/gui-pair-capability";
+import { canonicalGuiBrowserOrigin, standaloneGuiPairingOrigin } from "../lib/gui-pair-capability";
 import {
   isAllowedManagementOrigin,
   isApiAuthRequired,
@@ -20,6 +20,8 @@ export interface GuiSessionRecord {
   csrfToken: string;
   expiresAt: number;
   issuance: GuiSessionIssuance;
+  /** Process-local marker; never accepted from a browser. */
+  localPairing?: true;
 }
 
 export interface GuiSessionBootstrap extends GuiSessionRecord {
@@ -31,6 +33,7 @@ export interface GuiPairingGrantRecord {
   browserOrigin: string;
   expiresAt: number;
   failedAttempts?: number;
+  localPairing?: true;
 }
 
 export interface PairingAttemptContext {
@@ -131,6 +134,7 @@ function mintSession(
   issuance: GuiSessionIssuance,
   state: GuiSessionState,
   now: number,
+  localPairing = false,
 ): GuiSessionBootstrap {
   pruneExpired(state, now);
   evictOldestSession(state);
@@ -142,8 +146,9 @@ function mintSession(
     serverOrigin,
     browserOrigin,
     csrfToken: randomBytes(32).toString("base64url"),
-    expiresAt: now + (issuance === "loopback" ? LOOPBACK_GUI_SESSION_TTL_MS : REMOTE_GUI_SESSION_TTL_MS),
+    expiresAt: now + (issuance === "loopback" || localPairing ? LOOPBACK_GUI_SESSION_TTL_MS : REMOTE_GUI_SESSION_TTL_MS),
     issuance,
+    ...(localPairing ? { localPairing: true as const } : {}),
   };
   state.sessions.set(token, session);
   return {
@@ -258,13 +263,16 @@ export function createGuiPairingGrant(
   now = Date.now(),
 ): { grant: string; browserOrigin: string; serverOrigin: string; expiresAt: number } {
   const canonicalBrowserOrigin = canonicalGuiBrowserOrigin(browserOrigin);
-  const serverOrigin = canonicalHttpOrigin(config.hub?.managementPublicOrigin);
+  const localOrigin = standaloneGuiPairingOrigin(config);
+  const localPairing = localOrigin !== null && canonicalBrowserOrigin === localOrigin;
+  const serverOrigin = config.runtimeRole === "hub"
+    ? canonicalHttpOrigin(config.hub?.managementPublicOrigin) : localOrigin;
   if (
-    config.runtimeRole !== "hub"
-    || !canonicalBrowserOrigin
+    !canonicalBrowserOrigin
     || canonicalBrowserOrigin !== browserOrigin
     || !serverOrigin
-    || !isRemoteGuiBrowserOriginAllowed(canonicalBrowserOrigin, config)
+    || (config.runtimeRole === "hub"
+      ? !isRemoteGuiBrowserOriginAllowed(canonicalBrowserOrigin, config) : !localPairing)
   ) throw new TypeError("remote GUI origin is not allowed");
   pruneExpired(state, now);
   consumeGrantRateSlot(state, now);
@@ -276,7 +284,8 @@ export function createGuiPairingGrant(
     digest = pairingGrantDigest(grant);
   } while (state.pairingGrants.has(digest));
   const expiresAt = now + GUI_PAIRING_GRANT_TTL_MS;
-  state.pairingGrants.set(digest, { browserOrigin: canonicalBrowserOrigin, serverOrigin, expiresAt });
+  state.pairingGrants.set(digest, { browserOrigin: canonicalBrowserOrigin, serverOrigin, expiresAt,
+    ...(localPairing ? { localPairing: true as const } : {}) });
   return { grant, browserOrigin: canonicalBrowserOrigin, serverOrigin, expiresAt };
 }
 
@@ -316,7 +325,8 @@ export function consumeGuiPairingGrant(
   now = Date.now(),
   attemptContext?: PairingAttemptContext,
 ): GuiSessionBootstrap | PairingAttemptRefusal | null {
-  if (req.method !== "POST" || hasAlternateCredential(req) || config.runtimeRole !== "hub") return null;
+  const localOrigin = standaloneGuiPairingOrigin(config);
+  if (req.method !== "POST" || hasAlternateCredential(req) || (config.runtimeRole !== "hub" && !localOrigin)) return null;
   // Scheme check FIRST, before the grant is parsed or looked up.
   //
   // A grant is single-use, so consuming one and then refusing to mint would burn the
@@ -333,6 +343,11 @@ export function consumeGuiPairingGrant(
   const grant = strictPairingGrantBody(body);
   const browserOrigin = canonicalGuiBrowserOrigin(req.headers.get("Origin"));
   if (!grant || !browserOrigin) return null;
+  // Unlike the hub path, standalone redemption never accepts a proxy-origin claim:
+  // both origins must be the configured loopback origin and the kernel peer must be local.
+  if (localOrigin && (destination !== localOrigin || browserOrigin !== localOrigin
+    || attemptContext?.ingress !== "public"
+    || !["127.0.0.1", "::1", "::ffff:127.0.0.1"].includes(attemptContext.peerAddress ?? ""))) return null;
   const context = attemptContext ?? {
     ingress: "public",
     peerAddress: null,
@@ -344,11 +359,14 @@ export function consumeGuiPairingGrant(
   const found = findPairingGrant(grant, state);
   if (!found) {
     // Cross-origin browser requests must not create limiter state as a side effect.
-    if (!isRemoteGuiBrowserOriginAllowed(browserOrigin, config)) return null;
+    if (localOrigin ? browserOrigin !== localOrigin : !isRemoteGuiBrowserOriginAllowed(browserOrigin, config)) return null;
     const source = recordSourceFailure(state, context, now);
     return attemptContext && !source.allowed ? source : null;
   }
   const [digest, record] = found;
+  // A live role/config change must not turn a hub grant into local operator consent, or vice versa.
+  if (record.localPairing ? !localOrigin || record.serverOrigin !== localOrigin
+    : config.runtimeRole !== "hub") return null;
   if (record.expiresAt <= now) {
     state.pairingGrants.delete(digest);
     return null;
@@ -369,7 +387,7 @@ export function consumeGuiPairingGrant(
   // the session is actually minted from.
   if (!isPairingTransportPermitted(record.serverOrigin)) return null;
   state.pairingGrants.delete(digest);
-  return mintSession(record.serverOrigin, record.browserOrigin, "pairing", state, now);
+  return mintSession(record.serverOrigin, record.browserOrigin, "pairing", state, now, record.localPairing === true);
 }
 
 /**
@@ -420,6 +438,10 @@ export function authorizeGuiSessionRequest(
     state.sessions.delete(token);
     return { ok: false, reason: "expired" };
   }
+  if (session.localPairing && standaloneGuiPairingOrigin(config) !== session.serverOrigin) {
+    state.sessions.delete(token);
+    return { ok: false, reason: "server-origin" };
+  }
   if (managementRequestOrigin(req, config) !== session.serverOrigin) {
     return { ok: false, reason: "server-origin" };
   }
@@ -435,6 +457,6 @@ export function authorizeGuiSessionRequest(
     const csrf = req.headers.get("x-opencodex-csrf-token")?.trim();
     if (!csrf || !equalSecret(csrf, session.csrfToken)) return { ok: false, reason: "csrf" };
   }
-  if (session.issuance !== "loopback") session.expiresAt = now + REMOTE_GUI_SESSION_TTL_MS;
+  if (session.issuance !== "loopback" && !session.localPairing) session.expiresAt = now + REMOTE_GUI_SESSION_TTL_MS;
   return { ok: true, principal: "gui-session", session };
 }

package/src/server/index/claude-intercept-lifecycle.ts

@@ -1,5 +1,7 @@
 import type { Server } from "bun";
 import type { OcxConfig } from "../../types";
+import { getConfigDir } from "../../config/paths";
+import { discardPickerCaKey } from "../../claude/intercept/picker-ca";
 import type { PickerRouteInput } from "../../claude/intercept/picker-models";
 import { observeClaudeDesktopMode, type ClaudeDesktopModeObservation } from "../../claude/desktop-first-party";
 import { firstPartyDesired, type ClaudeFirstPartyDesired } from "../../claude/first-party-settings";
@@ -79,6 +81,8 @@ export function createClaudeInterceptLifecycle<T>(): ClaudeInterceptLifecycle<T>
     if (!options) return Promise.resolve(outcome = { ok: false, reason: "failed" });
     const opts = options;
     const run = async (): Promise<ClaudeInterceptOutcome> => {
+      // Legacy key cleanup is independent of listener eligibility, including on-demand retries.
+      try { discardPickerCaKey(opts.configDir ?? getConfigDir()); } catch { /* best-effort; retried on the next attempt */ }
       if (opts.config.runtimeRole === "client") return { ok: false, reason: "client_role" };
       if (!claudeInterceptEnabled(opts.config)) return { ok: false, reason: "disabled" };
       if (opts.requestedPort === 0 && typeof opts.config.claudeCode?.intercept?.port !== "number")

package/src/server/index/serve-options.ts

@@ -202,6 +202,8 @@ import type { WorkflowRefusalLog } from "../workflow-refusal";
 import { readyProtocolMetadata } from "../../remote/protocol";
 import { modelCapabilityFields } from "../models-capabilities";
 import { createWebsocketHandler } from "./websocket-handler";
+import { withGrokSessionIdentity } from "../../grok/session-identity";
+import { withCallerSessionIdentity } from "../caller-session-identity";
 
 export type ServerIngress = "public" | "unauthenticated-loopback" | "hub-management" | "claude-intercept" | "hub-link";
 
@@ -297,9 +299,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
   const requestMetrics = metricsExportEnabled(config)
     ? createRequestMetricsOwner(Date.now() / 1000, cachedKiroQuotaMetricRows) : undefined;
   const requestMetricsLogContext = requestMetrics ? { requestMetricsRecorder: requestMetrics } : {};
-  const requestManagementApiDeps: ManagementApiDeps = requestMetrics
-    ? { ...managementApiDeps, requestMetrics: { snapshot: () => requestMetrics.snapshot() } }
-    : managementApiDeps;
+  const requestManagementApiDeps: ManagementApiDeps = {
+    ...managementApiDeps,
+    liveListenPort: () => ctx.boundPort ?? listenPort,
+    ...(requestMetrics ? { requestMetrics: { snapshot: () => requestMetrics.snapshot() } } : {}),
+  };
   const serveOptions = {
       idleTimeout: 255,
       // Bun rejects an oversized body before `fetch` runs, so the listener has to be raised
@@ -1473,10 +1477,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           logged = true;
           addFinalRequestLog(requestId, start, logCtx, status, meta);
         };
-        return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => {
+        const sessionReq = withCallerSessionIdentity(withGrokSessionIdentity(req), admission);
+        return runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => {
           let response: Response;
           try {
-            response = await handleResponses(req, config, logCtx, {
+            response = await handleResponses(sessionReq, config, logCtx, {
               turnAdmissionLease,
               admission,
               onRequestBodyRead: () => disableResponsesRequestTimeout(req, requestServer),
@@ -1553,8 +1558,9 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         // Logging is finalized inside handleClaudeMessages (Responses-vocab tap on the
         // pre-translation stream + native passthrough callbacks) — do not re-wrap the
         // translated Anthropic stream here.
-        return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => withCors(
-          await handleClaudeMessages(req, config, logCtx, { requestId, start, turnAdmissionLease, admission }, policy, { claudeIntercept: ingress === "claude-intercept" }),
+        const sessionReq = withCallerSessionIdentity(req, admission);
+        return runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => withCors(
+          await handleClaudeMessages(sessionReq, config, logCtx, { requestId, start, turnAdmissionLease, admission }, policy, { claudeIntercept: ingress === "claude-intercept" }),
           req,
           policy,
         ), { requestId, start, logCtx });

package/src/server/index.ts

@@ -281,7 +281,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
       // with the later startup sync and warns ONCE about stale app-servers; warning
       // here instead would read a catalog mtime the sync is about to move.
       const outcome = withCatalogWriteSerialization(startupCodexHome, permit =>
-        invalidateCodexModelsCacheWithPermit(permit, startupCodexHome));
+        invalidateCodexModelsCacheWithPermit(permit, startupCodexHome), { intent: "cache", writer: "startup-cache" });
       // A refused permit is not a write; only a completed run that returned true is.
       setStartupCacheInvalidationWrite(outcome.kind === "completed" && outcome.value === true);
     } catch { /* no readable Codex home: nothing to invalidate */ }