@bitkyc08/opencodex 2.82.0 → 2.83.0

package/src/providers/github-copilot-auto.ts

@@ -0,0 +1,169 @@
+import { createHash } from "node:crypto";
+import type { OcxParsedRequest, OcxProviderConfig } from "../types";
+import { readBoundedResponseBody } from "../lib/bounded-body";
+import { ProviderOutboundSendCancelledError, providerOutboundGet, providerOutboundPost } from "../lib/provider-outbound";
+import { githubCopilotHttpError, resolveCopilotApiBaseUrl } from "../oauth/github-copilot";
+import { resolveGithubCopilotTransport } from "./github-copilot-transport";
+import { waitForProviderRequestSlot, releaseProviderRequestSlot } from "./request-pacing";
+
+export interface CopilotModel {
+  id: string;
+  model_picker_enabled?: boolean;
+  supported_endpoints?: string[];
+  [key: string]: unknown;
+}
+const catalogs = new Map<string, { expires: number; models: CopilotModel[] }>();
+const MAX_MODELS = 512;
+const MAX_RESPONSE_BYTES = 1_048_576;
+export class CopilotAutoHttpError extends Error {
+  /** Preserve only the upstream status and bounded retry delay; never retain response bodies. */
+  constructor(readonly status: number, readonly retryAfter?: string) {
+    super(githubCopilotHttpError("Auto negotiation", status).message);
+  }
+}
+/** Reject array/scalar payloads before interpreting negotiation objects. */
+function record(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown> : undefined;
+}
+/** Accept a bounded, homogeneous list so malformed pools cannot grant routing eligibility. */
+function strings(value: unknown): string[] {
+  return Array.isArray(value) && value.length <= MAX_MODELS
+    && value.every(/** Require every pool entry to be a bounded nonempty string before it can authorize model selection. */
+      v => typeof v === "string" && v.length > 0 && v.length <= 256)
+    ? value as string[] : [];
+}
+/** Isolate discovery caches by endpoint and credential without storing plaintext cache keys. */
+function authority(provider: OcxProviderConfig): string {
+  return createHash("sha256").update(JSON.stringify([provider.baseUrl, provider.apiKey])).digest("hex");
+}
+/** Make one paced, origin-fenced negotiation send with bounded decoding and secret-safe errors. */
+async function requestJson(provider: OcxProviderConfig, path: string, signal?: AbortSignal, body?: unknown,
+  sessionToken?: string, beforeSend?: () => boolean, concurrency = true): Promise<Record<string, unknown>> {
+  const boundedSignal = signal ? AbortSignal.any([signal, AbortSignal.timeout(8_000)]) : AbortSignal.timeout(8_000);
+  boundedSignal.throwIfAborted();
+  const headers = new Headers(provider.headers);
+  headers.set("Authorization", `Bearer ${provider.apiKey}`);
+  headers.set("X-GitHub-Api-Version", "2026-08-01");
+  headers.set("Content-Type", "application/json");
+  headers.delete("Copilot-Session-Token");
+  if (sessionToken) headers.set("Copilot-Session-Token", sessionToken);
+  const url = `${provider.baseUrl}${path}`;
+  // Queued-dispatch rebuilding can already own a provider concurrency lease; that
+  // caller opts out of taking a second lease while retaining interval pacing.
+  const slot = await waitForProviderRequestSlot("github-copilot", provider, "auto", boundedSignal, { concurrency });
+  try {
+    const init = { headers, signal: boundedSignal };
+    const response = body === undefined
+      ? await providerOutboundGet("github-copilot", provider, url, init, { beforeSend })
+      : await providerOutboundPost("github-copilot", provider, url, { ...init, body: JSON.stringify(body) }, { beforeSend });
+    // Status-only failures: session endpoints can echo secret material in their bodies.
+    if (!response.ok) {
+      void response.body?.cancel().catch(/** Ignore cleanup failures after discarding a refusal body that may contain reflected credentials. */
+        () => undefined);
+      const retry = response.headers.get("retry-after");
+      throw new CopilotAutoHttpError(response.status, retry && /^\d{1,4}$/.test(retry)
+        ? String(Math.max(1, Math.min(3600, Number(retry)))) : undefined);
+    }
+    const bounded = await readBoundedResponseBody(response, { maxBytes: MAX_RESPONSE_BYTES,
+      signal: boundedSignal, totalTimeoutMs: 8_000, fatalUtf8: true });
+    if (bounded.truncated) throw new Error("GitHub Copilot Auto negotiation returned an incomplete response");
+    let value: unknown;
+    try { value = JSON.parse(bounded.text); } catch { /* never include raw bodies */ }
+    const payload = record(value);
+    if (!payload) throw new Error("GitHub Copilot Auto negotiation returned invalid JSON");
+    return payload;
+  } catch (error) {
+    if (error instanceof CopilotAutoHttpError || error instanceof ProviderOutboundSendCancelledError) throw error;
+    // Transport/decoder exception messages may contain reflected header values.
+    throw new Error(boundedSignal.aborted ? "GitHub Copilot Auto negotiation cancelled"
+      : "GitHub Copilot Auto negotiation transport failed");
+  } finally { releaseProviderRequestSlot(slot); }
+}
+
+/** Detect Auto-only permission only when every row explicitly denies named selection. */
+export function copilotRequiresAuto(_provider: OcxProviderConfig, models: CopilotModel[]): boolean {
+  return models.length > 0 && models.every(/** Missing or malformed metadata cannot establish an account-wide picker denial. */
+    model => model.model_picker_enabled === false);
+}
+/** Retain legacy rows with unknown permissions; only an explicit denial removes a named picker row. */
+export function copilotPickerModels(provider: OcxProviderConfig, models: CopilotModel[]): CopilotModel[] {
+  if (copilotRequiresAuto(provider, models)) return [{ id: "auto" }];
+  return models.filter(/** Preserve named selection unless the provider explicitly marks the row unavailable. */
+    model => model.model_picker_enabled !== false);
+}
+/** Read the credential-bound catalog; callers may disable caching or reuse an existing lease. */
+export async function fetchCopilotAutoModels(provider: OcxProviderConfig, signal?: AbortSignal,
+  beforeSend?: () => boolean, cacheTtlMs = 60_000, concurrency = true): Promise<CopilotModel[]> {
+  const key = authority(provider);
+  const cached = catalogs.get(key);
+  if (cacheTtlMs > 0 && cached && cached.expires > Date.now()) return cached.models;
+  const payload = await requestJson(provider, "/models", signal, undefined, undefined, beforeSend, concurrency);
+  if (!Array.isArray(payload.data) || payload.data.length > MAX_MODELS)
+    throw new Error("GitHub Copilot model discovery returned an invalid catalog");
+  const models = payload.data.flatMap(/** Discard malformed catalog rows while retaining metadata for bounded model identifiers. */
+    value => {
+    const row = record(value);
+    if (!row || typeof row.id !== "string" || !row.id || row.id.length > 256) return [];
+    return [{ ...row, id: row.id } as CopilotModel];
+  });
+  if (cacheTtlMs > 0) {
+    if (!catalogs.has(key) && catalogs.size >= 32) catalogs.delete(catalogs.keys().next().value!);
+    catalogs.set(key, { expires: Date.now() + Math.min(cacheTtlMs, 60_000), models });
+  }
+  return models;
+}
+/** Reset discovery state between isolated account/permission regression cases. */
+export function clearCopilotAutoModelsForTests(): void { catalogs.clear(); }
+
+/** Resolve before adapter construction: the server can choose either wire on every turn. */
+export async function resolveCopilotAuto(provider: OcxProviderConfig, requestedModel: string,
+  parsed: OcxParsedRequest, signal?: AbortSignal, beforeSend?: () => boolean, concurrency = true): Promise<{
+    provider: OcxProviderConfig; modelId: string; auto: boolean; expiresAt?: number;
+  }> {
+  const transport = resolveGithubCopilotTransport(provider, provider.authMode === "oauth"
+    ? resolveCopilotApiBaseUrl(provider.baseUrl) : undefined);
+  // Never inherit a session token from a previous account or persist it in config.
+  const cleanHeaders = new Headers(transport.headers);
+  cleanHeaders.delete("Copilot-Session-Token");
+  transport.headers = Object.fromEntries(cleanHeaders);
+  let models: CopilotModel[];
+  try { models = await fetchCopilotAutoModels(transport, signal, beforeSend, 60_000, concurrency); }
+  catch (error) {
+    if (signal?.aborted || error instanceof ProviderOutboundSendCancelledError) throw error;
+    // Permission discovery is additive for legacy paid configurations. A temporary
+    // discovery outage must not turn a previously usable named route into a refusal.
+    return { provider: transport, modelId: requestedModel, auto: false };
+  }
+  if (!copilotRequiresAuto(provider, models))
+    return { provider: transport, modelId: requestedModel, auto: false };
+  const session = await requestJson(transport, "/models/session", signal,
+    { auto_mode: { model_hints: ["auto"] } }, undefined, beforeSend, concurrency);
+  const pool = strings(session.available_models);
+  if (typeof session.session_token !== "string" || !session.session_token || session.session_token.length > 32_768 || !/^[\x21-\x7e]+$/.test(session.session_token) || !pool.length)
+    throw new Error("GitHub Copilot Auto session omitted its routing credentials");
+  if (session.expires_at !== undefined && (typeof session.expires_at !== "number" || !Number.isFinite(session.expires_at)))
+    throw new Error("GitHub Copilot Auto session returned an invalid expiry");
+  const expiresAt = typeof session.expires_at === "number" && Number.isFinite(session.expires_at)
+    ? session.expires_at * 1000 : Date.now() + 60_000;
+  if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() + 1000) throw new Error("GitHub Copilot Auto session is already expired");
+  const lastUser = [...parsed.context.messages].reverse().find(/** Find the newest user turn as the intent-routing source instead of replaying earlier conversation text. */
+    message => message.role === "user");
+  const prompt = lastUser?.role === "user"
+    ? typeof lastUser.content === "string" ? lastUser.content : lastUser.content.flatMap(/** Extract text parts for intent negotiation without forwarding image or other multimodal payloads. */
+      part => part.type === "text" ? [part.text] : []).join("\n")
+    : "";
+  const intent = await requestJson(transport, "/models/session/intent", signal,
+    { prompt: prompt.slice(0, 32_768), available_models: pool }, session.session_token, beforeSend, concurrency);
+  const modelId = strings(intent.candidate_models).find(/** Choose the first server-ranked candidate that belongs to this credential-bound session pool. */
+    candidate => pool.includes(candidate));
+  if (!modelId) throw new Error("GitHub Copilot Auto intent returned no eligible model");
+  const endpoints = strings(models.find(/** Read endpoint capabilities for the selected model before choosing its inference adapter. */
+    model => model.id === modelId)?.supported_endpoints);
+  const adapter = endpoints.includes("/responses") ? "openai-responses"
+    : endpoints.includes("/chat/completions") ? "openai-chat" : undefined;
+  if (!adapter) throw new Error("GitHub Copilot Auto selected a model with no supported inference endpoint");
+  return { auto: true, modelId, expiresAt: Math.min(expiresAt, Date.now() + 60_000), provider: { ...transport, adapter,
+    ...(adapter === "openai-responses" ? { responsesPath: "/responses" } : { chatCompletionsPath: "/chat/completions" }),
+    headers: { ...transport.headers, "X-GitHub-Api-Version": "2026-08-01", "Copilot-Session-Token": session.session_token } } };
+}

package/src/providers/model-presets.ts

@@ -12,7 +12,7 @@
  * The preset is a SEED, not a lock. Materialization evaluates these rules against the provider's
  * current catalog and stores CONCRETE ids in `selectedModels`, so the visibility hot path
  * (`filterCatalogVisibleModels`) never learns about patterns and an older binary still sees a
- * plain allowlist. Design: devlog/_plan/260824_model_ux_aliases_and_defaults/030_default_preset.md
+ * plain allowlist. Design: devlog/_fin/260824_model_ux_aliases_and_defaults/030_default_preset.md
  */
 
 import type { OcxProviderConfig } from "../types";

package/src/providers/muse-subscription-usage.ts

@@ -99,7 +99,7 @@ export function museUsageWindowsToQuota(usage: unknown): ProviderQuota | null {
  *
  * Kept as a thin adapter over the shared mapper: the frame nests the same two windows
  * under `subscription`, the muse-code/key response nests them under `subs_usage`
- * (devlog/_plan/260912_muse_device_oauth/001 C). Two parsers would drift, and the
+ * (devlog/_fin/260912_muse_device_oauth/001 C). Two parsers would drift, and the
  * five-hour-window discrimination above is the part that must not.
  */
 export function parseMuseSubscriptionUsage(payload: unknown): ProviderQuota | null {

package/src/providers/registry/entries-core.ts

@@ -94,7 +94,7 @@ import {
  * Only the models Anthropic documents for the lane are classified; Opus 4.6 silently runs
  * standard and Opus 4.7, Sonnet, Haiku and Fable reject `speed`, so they and future ids stay
  * unclassified. Source: https://platform.claude.com/docs/en/build-with-claude/fast-mode
- * (2026-09-23) and the live probe in devlog/_plan/260923_anthropic_fast_speed.
+ * (2026-09-23) and the live probe in devlog/_fin/260923_anthropic_fast_speed.
  */
 const ANTHROPIC_FAST_WIRE = Object.freeze({
   kind: "anthropic-speed" as const,
@@ -209,7 +209,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
   },
   {
     // The canonical Cognition account provider, after absorbing `devin-cli`
-    // (devlog/_plan/260913_devin_provider_merge). The two ids were the same
+    // (devlog/_fin/260913_devin_provider_merge). The two ids were the same
     // `devin` adapter, the same server.codeium.com api-server, and the same
     // `devin-session-token$<JWT>` credential — only the account source
     // differed: this entry did an Auth0 browser sign-in while `devin-cli`
@@ -273,7 +273,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // the field but answers service_tier "default" — a live downgrade, not a fast tier.
     // Unlisted and future-discovered ids stay unclassified.
     // grok-4.7 applied and confirmed priority on OAuth Responses in the 2026-09-23
-    // live probe: devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+    // live probe: devlog/_fin/260923_grok47_parity/010_probe-evidence.md.
     modelSupportsServiceTier: {
       "grok-4.7": true,
       "grok-4.6": true,
@@ -320,7 +320,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     models: XAI_MODELS,
     // grok-4.7-build-fast arrives only through OAuth discovery: xAI's Grok 4.7 Fast, "the same model
     // served on faster infrastructure" (docs.x.ai/developers/grok-4-7). Probed 2026-09-30
-    // (devlog/_plan/260930_grok47_build_unify/010_probe-evidence.md): identical effort ladder, image
+    // (devlog/_fin/260930_grok47_build_unify/010_probe-evidence.md): identical effort ladder, image
     // input, 500k limit and advertised defaults, 1.5-1.7x faster, ~2x the ticks per output token. It is
     // not a second model row: shouldExposeProviderModel hides it, and grok-4.7's Fast selection on OAuth
     // serializes it (src/providers/xai-fast-model.ts). It keeps grok-4.7's facts in the lists below so an
@@ -450,7 +450,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     // documents high as the 4.6 default but no multi-agent default, so do not invent one.
     modelReasoningEfforts: {
       // 2026-09-23 live probe accepted low..xhigh and rejected max on both wires;
-      // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+      // devlog/_fin/260923_grok47_parity/010_probe-evidence.md.
       "grok-4.7": ["low", "medium", "high", "xhigh"],
       "grok-4.7-build-fast": ["low", "medium", "high", "xhigh"],
       "grok-4.6": ["low", "medium", "high", "xhigh"],
@@ -460,7 +460,7 @@ export const PROVIDER_REGISTRY_CORE: readonly ProviderRegistryEntry[] = [
     modelDefaultReasoningEfforts: { "grok-4.7": "high", "grok-4.7-build-fast": "high", "grok-4.6": "high" },
     modelContextWindows: {
       // 500k confirmed by context_length_exceeded:
-      // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+      // devlog/_fin/260923_grok47_parity/010_probe-evidence.md.
       "grok-4.7": 500_000,
       "grok-4.7-build-fast": 500_000,
       "grok-4.6": 500_000,

package/src/providers/registry/entries-extended.ts

@@ -1176,6 +1176,10 @@ export const PROVIDER_REGISTRY_EXTENDED: readonly ProviderRegistryEntry[] = [
       "openai/o3-pro": ["text"],
     },
     noVisionModels: ["openai/o3-pro"],
+    // #6877: on the Responses wire OpenGateway answers 400 once history replays native
+    // custom_tool_call/custom_tool_call_output items (Codex code-mode exec), and accepts the
+    // same request after the custom tool is lowered to a function. Same contract as xAI.
+    supportsResponsesCustomTools: false,
     // Chat is the broad wire (77/80 active rows). o3-pro is Responses-only, on all
     // inbounds. Only the two live-verified Sionic models bypass translation for Codex.
     // Other OpenAI/Anthropic/Gemini rows stay on Chat until their Responses tool replay

package/src/providers/registry/model-seeds.ts

@@ -129,7 +129,7 @@ export const ZAI_GLM_5X_SIDECAR_VISION_MODELS = ZAI_GLM_5X_MODELS.filter(id => i
  *
  * Authoritative source: `GET https://api.z.ai/api/v1/models` returns `input_modalities:
  * ["text"]` for glm-5.3 and `["text", "image"]` for glm-5.3-flash (captured in
- * devlog/_plan/260912_zcode_protocol_and_catalog/evidence/zai-responses-models.json).
+ * devlog/_fin/260912_zcode_protocol_and_catalog/evidence/zai-responses-models.json).
  * docs.z.ai/devpack/latest-model says the same in prose: "GLM-5.3 is a text-only model...
  * GLM-5.3-FLASH is a multimodal model". Upstream also lists video and file for Flash;
  * neither the internal vocabulary nor the export vocabulary can express them, so `image`
@@ -158,7 +158,7 @@ export const ZAI_GLM_5X_REASONING_EFFORTS: Record<string, string[]> = {
 // 260930 MiniMax-M3.1-Flash-Preview: Token Plan / MiniMax Code only, 1M context, thinking
 // always on (effort none or thinking disabled answers 400 code 2013), omitted effort = max.
 // It returns thinking as reasoning_content and ignores reasoning_split. The live /v1/models
-// roster does not list it yet. Evidence: devlog/_plan/260930_minimax_m31_flash_preview/.
+// roster does not list it yet. Evidence: devlog/_fin/260930_minimax_m31_flash_preview/.
 export const MINIMAX_M31_FLASH_PREVIEW = "MiniMax-M3.1-Flash-Preview";
 export const MINIMAX_MODELS = [
   MINIMAX_M31_FLASH_PREVIEW,
@@ -416,7 +416,7 @@ export const COMMAND_CODE_IMAGE_MODELS = [
   // Live 2026-09-23 3x3 random-color grid (180x180) via ocx 2.62.0:
   // 4.7 read 9/9 in user messages and tool results; 4.6 read 9/9 and 8/9.
   // Neither route requested a vision sidecar. Evidence:
-  // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+  // devlog/_fin/260923_grok47_parity/010_probe-evidence.md.
   "xai/grok-4.6",
   "xai/grok-4.7",
   // Native Z.AI VLM (docs.z.ai/guides/vlm/glm-5.3-flash). This exact id is already

package/src/providers/xai-fast-model.ts

@@ -7,7 +7,7 @@ import type { FastWire, OcxParsedRequest, OcxProviderConfig, TierDecision } from
  * on two lanes (same effort ladder, image input, 500k limit and advertised defaults). Measured live on
  * 2026-09-30: build-fast is 1.5-1.7x faster end to end, while `service_tier: "priority"` on grok-4.7 bought
  * no measurable speed and cost ~5.9x the ticks per output token (build-fast costs ~2x).
- * Evidence: devlog/_plan/260930_grok47_build_unify/010_probe-evidence.md.
+ * Evidence: devlog/_fin/260930_grok47_build_unify/010_probe-evidence.md.
  *
  * So on the OAuth lane only, a Fast grok-4.7 request is SERIALIZED as the build-fast id and sends no tier.
  * The logical id stays grok-4.7 everywhere else (parsed.modelId, route, policy, usage attempt), so effort,

package/src/server/inbound-body-admission.ts

@@ -71,20 +71,37 @@ function capacityResponse(pathname: string, error: InboundBodyCapacityError): Re
   }, { status: 503, headers: { "Retry-After": "1" } });
 }
 
-function retainUntilResponseSettles(response: Response, release: () => void): Response {
+function retainUntilResponseSettles(response: Response, signal: AbortSignal, release: () => void): Response {
   if (!response.body) {
     release();
     return response;
   }
   const reader = response.body.getReader();
   let cancelling = false;
+  let cancellation: Promise<void> | undefined;
   let finalized = false;
+  let bodyController!: ReadableStreamDefaultController<Uint8Array>;
+  const onAbort = (): void => {
+    if (finalized) return;
+    bodyController.error(signal.reason);
+    void cancel(signal.reason).catch(() => undefined);
+  };
   const finalize = (): void => {
     if (finalized) return;
     finalized = true;
+    signal.removeEventListener("abort", onAbort);
     try { reader.releaseLock(); } finally { release(); }
   };
+  const cancel = (reason: unknown): Promise<void> => {
+    if (cancellation) return cancellation;
+    if (finalized) return Promise.resolve();
+    cancelling = true;
+    // Share one settlement even if explicit cancellation races request abort.
+    cancellation = Promise.resolve().then(() => reader.cancel(reason)).finally(finalize);
+    return cancellation;
+  };
   const body = new ReadableStream<Uint8Array>({
+    start(controller) { bodyController = controller; },
     async pull(controller) {
       try {
         const result = await reader.read();
@@ -103,18 +120,18 @@ function retainUntilResponseSettles(response: Response, release: () => void): Re
         controller.error(error);
       }
     },
-    async cancel(reason) {
-      cancelling = true;
-      try { await reader.cancel(reason); } finally { finalize(); }
-    },
+    cancel,
   }, { highWaterMark: 0 });
   // This is the outermost HTTP wrapper, after protocol conversion, relay
   // preflight and request logging; no internal relay marker is consumed later.
-  return new Response(body, {
+  const wrapped = new Response(body, {
     status: response.status,
     statusText: response.statusText,
     headers: response.headers,
   });
+  signal.addEventListener("abort", onAbort, { once: true });
+  if (signal.aborted) onAbort();
+  return wrapped;
 }
 
 /**
@@ -155,7 +172,7 @@ export async function withRaisedInboundBodyAdmission(
     reservedInboundBodyBytes -= maxBytes;
   };
   try {
-    return retainUntilResponseSettles(await work(), release);
+    return retainUntilResponseSettles(await work(), req.signal, release);
   } catch (error) {
     release();
     throw error;

package/src/server/index/link-listener.ts

@@ -8,9 +8,18 @@ import {
 } from "../../link/store";
 import { linkStorePath } from "../../link/paths";
 import { linkRouteAllowed } from "../../link/routes";
+import { withConfigMutationLockSync } from "../../config/mutation-lock";
 
 export const LINK_INGRESS_HOSTNAME = "opencodex-link.invalid";
 
+/** Internal signal: the store's port differs from the port this bind landed on. */
+class LinkListenerPortMismatchError extends Error {
+  constructor(storedPort: number, boundPort: number) {
+    super(`stored port ${storedPort} differs from bound port ${boundPort}`);
+    this.name = "LinkListenerPortMismatchError";
+  }
+}
+
 export interface LinkListenerStartContext<T> {
   dispatch: (req: Request, server: Server<T>) => Promise<Response>;
   maxRequestBodySize: number;
@@ -118,29 +127,33 @@ export function createLinkListenerLifecycle<T>(deps: LinkListenerDeps = {}): Lin
       closeWithoutAwait(bound);
       return;
     }
-    if (store.listenerPort === null) {
-      const port = bound.port;
-      if (!port || port === 0) {
-        closeWithoutAwait(bound);
-        reportFailure("bind", new Error("Bun did not report a concrete listener port"), "bind");
-        return;
-      }
-      try {
+    const port = bound.port;
+    if (!port || port === 0) {
+      closeWithoutAwait(bound);
+      reportFailure("bind", new Error("Bun did not report a concrete listener port"), "bind");
+      return;
+    }
+    try {
+      // Revalidate the admission and persist a new port in one mutation section.
+      // Even a known-port bind can race the deletion of its last recorded link.
+      const needed = withConfigMutationLockSync(() => {
         const current = readStore(storePath);
+        if (current.links.length === 0) return false;
         if (current.listenerPort !== null && current.listenerPort !== port) {
-          // Another writer fixed a different port while this bind ran. Tunnels target the stored
-          // port, so serving on this one would strand them: give it up and let the next
-          // ensureStarted() bind the stored port.
-          closeWithoutAwait(bound);
-          reportFailure("listenerPort persistence", new Error(`stored port ${current.listenerPort} differs from bound port ${port}`), "persist");
-          return;
+          throw new LinkListenerPortMismatchError(current.listenerPort, port);
         }
-        writeStore(storePath, { ...current, listenerPort: port });
-      } catch (error) {
+        if (current.listenerPort === null) writeStore(storePath, { ...current, listenerPort: port });
+        return true;
+      });
+      if (!needed) {
         closeWithoutAwait(bound);
-        reportFailure("listenerPort persistence", error, "persist");
+        setStatus("off", null, null);
         return;
       }
+    } catch (error) {
+      closeWithoutAwait(bound);
+      reportFailure("listenerPort persistence", error, "persist");
+      return;
     }
     listener = bound as Server<T>;
     relaySessions = sessions;

package/src/server/index/serve-options.ts

@@ -1594,8 +1594,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         // `policy`, not `config`: this route is now served on the unauthenticated loopback
         // listener too (#4236), and only the receiving listener's view produces CORS headers
         // that match the admission decision made above.
-        return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => withCors(
-          await handleChatCompletions(req, config, logCtx, { requestId, start, turnAdmissionLease, admission }),
+        // Promote a caller `x-session-id` before admission, as Responses and Messages do (#6520):
+        // the ChatGPT bridge forwards only canonical session headers, so the raw marker is lost.
+        const sessionReq = withCallerSessionIdentity(req, admission);
+        return runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => withCors(
+          await handleChatCompletions(sessionReq, config, logCtx, { requestId, start, turnAdmissionLease, admission }),
           req,
           policy,
         ), { requestId, start, logCtx });
@@ -1716,7 +1719,9 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         if (audioController) registerTurn(audioController, turnAdmissionLease);
         const acquisition = audioController
           ? clearableDeadline(120_000, AbortSignal.any([req.signal, audioController.signal])) : undefined;
+        const detachClientAbort = turnAdmissionLease.bindAbortSignal(req.signal);
         const releaseAcquisition = () => {
+          detachClientAbort();
           acquisition?.clear();
           if (audioController) unregisterTurn(audioController);
           else turnAdmissionLease.release();
@@ -1835,6 +1840,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           return withCors(formatErrorResponse(502, "upstream_error", "Audio WebSocket upgrade failed"), req, policy);
         }
         if (upgraded) {
+          detachClientAbort();
           acquisition?.clear();
           finalizeLiveRequest(101);
           return undefined as unknown as Response;

package/src/server/index.ts

@@ -502,7 +502,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     work: (lease: ActiveTurnLease) => Promise<Response>,
     refusalLog?: WorkflowRefusalLog,
   ): Promise<Response> {
-    const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
+    const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers), req.signal);
     if (!lease) return serverBusyResponse(req, "active turns", policy);
     // Root, lane, and the refusal that follows from them, all live in ./workflow-refusal.
     let workflow: ReturnType<typeof admitHttpWorkflowTurn>;

package/src/server/lifecycle.ts

@@ -36,6 +36,7 @@ export const SESSION_LANE_ID_BYTES = 32;
 const turnGate = createAdmissionGate("active_turns", MAX_ACTIVE_TURNS);
 export interface ActiveTurnLease extends AdmissionLease {
   attach(lease: AdmissionLease): void;
+  bindAbortSignal(signal: AbortSignal): () => void;
   bindAbortController(ac: AbortController): void;
   beginCodexAccountSelection(): CodexAccountSelectionAdmission;
   isTransferred(): boolean;
@@ -169,7 +170,7 @@ export function resetLifecycleDrainStateForTests(): void {
   serverStartupReleaseFlights = new WeakMap<ReturnType<typeof Bun.serve>, Promise<void>>();
   releaseServerStartupLifecycleImpl = releaseNativeMainStartupLifecycle;
 }
-export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
+export function tryAdmitTurn(sessionLaneId?: string, clientSignal?: AbortSignal): ActiveTurnLease | null {
   if (isDraining()) return null;
   const opaqueSessionLaneId = sessionLaneId
     ? createHash("sha256").update(sessionLaneId).digest("hex").slice(0, SESSION_LANE_ID_BYTES)
@@ -192,6 +193,8 @@ export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
   }
   const controllers = new Set<AbortController>();
   const attachedLeases = new Set<AdmissionLease>();
+  const abortListeners = new Map<AbortSignal, () => void>();
+  let cancellationReason: unknown;
   let active = true;
   let transferred = false;
   let nativeMainClaimed = false;
@@ -200,22 +203,40 @@ export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
       if (!active) attachedLease.release();
       else attachedLeases.add(attachedLease);
     },
+    bindAbortSignal(signal) {
+      if (!active || abortListeners.has(signal)) return () => {};
+      const onAbort = () => {
+        cancellationReason = signal.reason;
+        const boundControllers = [...controllers];
+        lease.release();
+        for (const controller of boundControllers) controller.abort(cancellationReason);
+      };
+      abortListeners.set(signal, onAbort);
+      signal.addEventListener("abort", onAbort, { once: true });
+      if (signal.aborted) onAbort();
+      return () => {
+        if (abortListeners.get(signal) !== onAbort) return;
+        signal.removeEventListener("abort", onAbort);
+        abortListeners.delete(signal);
+      };
+    },
     bindAbortController(ac) {
       knownTurnControllers.add(ac);
       if (!active) {
-        ac.abort(new Error("turn already settled"));
+        ac.abort(cancellationReason ?? new Error("turn already settled"));
         return;
       }
       transferred = true;
       controllers.add(ac);
       activeTurns.set(ac, lease);
+      lease.bindAbortSignal(ac.signal);
     },
     beginCodexAccountSelection() {
       const mainProfileDraining = nativeMainDrainOwners.size > 0;
-      let selectionActive = !mainProfileDraining;
+      let selectionActive = active && !mainProfileDraining;
       let released = false;
       if (selectionActive) nativeMainSelections += 1;
-      return {
+      const selection: CodexAccountSelectionAdmission = {
         mainProfileDraining,
         claimMainProfile() {
           if (released || mainProfileDraining || !active) return false;
@@ -228,18 +249,23 @@ export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
         release() {
           if (released) return;
           released = true;
+          attachedLeases.delete(selection);
           if (selectionActive) {
             selectionActive = false;
             nativeMainSelections = Math.max(0, nativeMainSelections - 1);
           }
         },
       };
+      lease.attach(selection);
+      return selection;
     },
     isTransferred() { return transferred; },
     release() {
       if (!active) return;
       active = false;
       admittedTurns.delete(lease);
+      for (const [signal, listener] of abortListeners) signal.removeEventListener("abort", listener);
+      abortListeners.clear();
       for (const controller of controllers) {
         if (activeTurns.get(controller) === lease) activeTurns.delete(controller);
       }
@@ -258,6 +284,7 @@ export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
     },
   };
   admittedTurns.add(lease);
+  if (clientSignal) lease.bindAbortSignal(clientSignal);
   return lease;
 }
 export function codexAccountSelectionForTurn(