@bitkyc08/opencodex 2.82.0 → 2.84.0

package/src/server/configured-credentials.ts

@@ -0,0 +1,194 @@
+/**
+ * Credentials this installation is configured with, read when an upstream diagnostic is checked.
+ *
+ * A gateway can echo a credential it learned before this process ever sent it: an inactive pool
+ * key, another provider's key, an OAuth token from an earlier session. Learning only from sends
+ * would let such an echo be warned and finalized before the value is first dispatched, and a warning
+ * cannot be retracted. So the request log also refuses any diagnostic that repeats a configured
+ * value: every provider's apiKey and apiKeyPool keys (keychain and env references resolved), every
+ * configured header value, every credential-named provider field, and every token in the OAuth
+ * store. The set is rebuilt when the bytes of config.json or auth.json change, a stored keychain
+ * secret is replaced in this process, or a referenced environment variable changes.
+ *
+ * Freshness is decided by content, never by file metadata. Every check reads both stores and
+ * compares a digest of the bytes it read; the rebuild parses those same bytes. An inode/size/mtime
+ * key missed a same-length rewrite inside one timestamp tick (coarse on Windows) and any writer that
+ * preserves or backdates mtime, and then kept serving the previous, complete-looking view (#6923).
+ * The cost is two small reads per check; checks run only for retained upstream diagnostics.
+ *
+ * Reads are observe-only: no hardening, backup, repair or warning. A file that exists but cannot be
+ * read, parsed or recognized as the expected shape, or a keychain reference that cannot be resolved,
+ * makes coverage incomplete and callers fail closed; an incomplete set is retried after a short delay
+ * so a keychain that becomes available restores diagnostics. Values are held in memory only and
+ * never serialized or exposed.
+ *
+ * Not covered: keychain secrets are cached per process (`readKeychain` in
+ * src/providers/api-key-resolve.ts), so a secret replaced by another process is seen only after
+ * this process re-resolves it.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { resolveEnvValue } from "../config/proxy-env";
+import { isKeychainReference, providerKeyResolutionGeneration, resolveProviderApiKeyQuietly } from "../providers/api-key-resolve";
+import { credentialComponents, credentialSetMatches } from "../lib/outbound-credential-registry";
+import { SENSITIVE_KEY_PATTERN } from "../lib/redact";
+
+const CREDENTIAL_FIELD = /(?:key|token|secret|password|passwd|credential|cookie|authorization)$/i;
+/** How long an incomplete set is trusted before its sources are read again. */
+export const INCOMPLETE_RETRY_MS = 30_000;
+
+export interface ConfiguredCredentials {
+  readonly complete: boolean;
+  matches(value: string): boolean;
+}
+
+interface Snapshot {
+  /** The only object handed out: cache metadata (including env values) stays private here. */
+  readonly view: ConfiguredCredentials;
+  readonly signature: string;
+  readonly envNames: readonly string[];
+  readonly envFingerprint: string;
+  readonly builtAt: number;
+}
+
+let cached: Snapshot | undefined;
+
+/** One read of a store: its state for the signature and, for a readable file, the bytes read. */
+interface StoreRead {
+  /** "absent", "not-a-file", "unreadable", or "sha256:<hex>" of exactly the bytes in `text`. */
+  readonly state: string;
+  readonly text?: string;
+}
+
+function readStore(path: string): StoreRead {
+  try {
+    if (!statSync(path).isFile()) return { state: "not-a-file" };
+  } catch (error) {
+    // Only a store that is not there at all counts as intentionally absent.
+    return { state: (error as NodeJS.ErrnoException)?.code === "ENOENT" ? "absent" : "unreadable" };
+  }
+  let bytes: Buffer;
+  try {
+    bytes = readFileSync(path);
+  } catch {
+    // Present a moment ago, gone or unreadable now (a replacement in progress): fail closed.
+    return { state: "unreadable" };
+  }
+  return { state: `sha256:${createHash("sha256").update(bytes).digest("hex")}`, text: bytes.toString("utf8") };
+}
+
+function parseStore(read: StoreRead): { ok: boolean; value?: unknown } {
+  if (read.state === "absent") return { ok: true };
+  if (read.text === undefined) return { ok: false };
+  try {
+    return { ok: true, value: JSON.parse(read.text.replace(/^\uFEFF/, "")) };
+  } catch {
+    return { ok: false };
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function envFingerprint(names: readonly string[]): string {
+  return names.map(name => process.env[name] ?? "\u0000unset").join("\u0000");
+}
+
+/** Mirrors resolveEnvValue: a braced or bare dollar reference reads the environment. */
+function envReference(raw: string): string | undefined {
+  if (!raw.startsWith("$")) return undefined;
+  return /^\$\{(\w+)\}$/.exec(raw)?.[1] ?? raw.slice(1);
+}
+
+function build(configRead: StoreRead, authRead: StoreRead, signature: string, now: number): Snapshot {
+  const values = new Set<string>();
+  const envNames = new Set<string>();
+  let complete = true;
+  const add = (raw: string | undefined) => {
+    if (raw) for (const part of credentialComponents(raw)) values.add(part);
+  };
+  const noteEnv = (raw: string) => {
+    const name = envReference(raw);
+    if (name) envNames.add(name);
+  };
+  const addReference = (raw: unknown) => {
+    if (typeof raw !== "string" || !raw) return;
+    noteEnv(raw);
+    const resolved = resolveProviderApiKeyQuietly(raw);
+    if (resolved === undefined && isKeychainReference(raw)) complete = false;
+    add(resolved);
+  };
+  const isCredentialField = (field: string) => CREDENTIAL_FIELD.test(field) || SENSITIVE_KEY_PATTERN.test(field);
+  const walkProvider = (node: unknown, depth: number) => {
+    if (depth > 8) return;
+    if (Array.isArray(node)) { for (const item of node) walkProvider(item, depth + 1); return; }
+    if (!isRecord(node)) return;
+    for (const [field, value] of Object.entries(node)) {
+      if (field === "headers" && isRecord(value)) {
+        for (const header of Object.values(value)) {
+          if (typeof header !== "string") continue;
+          noteEnv(header);
+          add(resolveEnvValue(header) ?? header);
+        }
+      } else if (typeof value === "string") {
+        if (isCredentialField(field)) addReference(value);
+      } else {
+        walkProvider(value, depth + 1);
+      }
+    }
+  };
+  const walkAuth = (node: unknown, depth: number) => {
+    if (depth > 8) return;
+    if (Array.isArray(node)) { for (const item of node) walkAuth(item, depth + 1); return; }
+    if (!isRecord(node)) return;
+    for (const [field, value] of Object.entries(node)) {
+      if (typeof value === "string") {
+        if (field === "access" || field === "refresh" || isCredentialField(field)) add(value);
+      } else {
+        walkAuth(value, depth + 1);
+      }
+    }
+  };
+
+  const configSig = configRead.state;
+  const authSig = authRead.state;
+  const config = parseStore(configRead);
+  const auth = parseStore(authRead);
+  if (!config.ok || !auth.ok) complete = false;
+  // An existing file must have the shape its loader expects; anything else hides credentials.
+  if (configSig !== "absent" && config.ok && (!isRecord(config.value)
+    || (config.value.providers !== undefined && !isRecord(config.value.providers)))) complete = false;
+  if (authSig !== "absent" && auth.ok && !isRecord(auth.value)) complete = false;
+  if (isRecord(config.value) && isRecord(config.value.providers)) walkProvider(config.value.providers, 0);
+  if (isRecord(auth.value)) walkAuth(auth.value, 0);
+
+  const names = [...envNames].sort();
+  const view: ConfiguredCredentials = Object.freeze({
+    complete,
+    matches: (value: string) => credentialSetMatches(values, candidate => values.has(candidate), value),
+  });
+  return {
+    view,
+    signature,
+    envNames: names,
+    envFingerprint: envFingerprint(names),
+    builtAt: now,
+  };
+}
+
+/** The configured credential set for the active config home, rebuilt when any input changes. */
+export function configuredCredentials(now = Date.now()): ConfiguredCredentials {
+  const dir = getConfigDir();
+  const configRead = readStore(join(dir, "config.json"));
+  const authRead = readStore(join(dir, "auth.json"));
+  const signature = `${configRead.state}|${authRead.state}|${providerKeyResolutionGeneration()}|${dir}`;
+  const stale = !cached
+    || cached.signature !== signature
+    || cached.envFingerprint !== envFingerprint(cached.envNames)
+    || (!cached.view.complete && now - cached.builtAt >= INCOMPLETE_RETRY_MS);
+  if (stale) cached = build(configRead, authRead, signature, now);
+  return cached!.view;
+}

package/src/server/inbound-body-admission.ts

@@ -71,20 +71,37 @@ function capacityResponse(pathname: string, error: InboundBodyCapacityError): Re
   }, { status: 503, headers: { "Retry-After": "1" } });
 }
 
-function retainUntilResponseSettles(response: Response, release: () => void): Response {
+function retainUntilResponseSettles(response: Response, signal: AbortSignal, release: () => void): Response {
   if (!response.body) {
     release();
     return response;
   }
   const reader = response.body.getReader();
   let cancelling = false;
+  let cancellation: Promise<void> | undefined;
   let finalized = false;
+  let bodyController!: ReadableStreamDefaultController<Uint8Array>;
+  const onAbort = (): void => {
+    if (finalized) return;
+    bodyController.error(signal.reason);
+    void cancel(signal.reason).catch(() => undefined);
+  };
   const finalize = (): void => {
     if (finalized) return;
     finalized = true;
+    signal.removeEventListener("abort", onAbort);
     try { reader.releaseLock(); } finally { release(); }
   };
+  const cancel = (reason: unknown): Promise<void> => {
+    if (cancellation) return cancellation;
+    if (finalized) return Promise.resolve();
+    cancelling = true;
+    // Share one settlement even if explicit cancellation races request abort.
+    cancellation = Promise.resolve().then(() => reader.cancel(reason)).finally(finalize);
+    return cancellation;
+  };
   const body = new ReadableStream<Uint8Array>({
+    start(controller) { bodyController = controller; },
     async pull(controller) {
       try {
         const result = await reader.read();
@@ -103,18 +120,18 @@ function retainUntilResponseSettles(response: Response, release: () => void): Re
         controller.error(error);
       }
     },
-    async cancel(reason) {
-      cancelling = true;
-      try { await reader.cancel(reason); } finally { finalize(); }
-    },
+    cancel,
   }, { highWaterMark: 0 });
   // This is the outermost HTTP wrapper, after protocol conversion, relay
   // preflight and request logging; no internal relay marker is consumed later.
-  return new Response(body, {
+  const wrapped = new Response(body, {
     status: response.status,
     statusText: response.statusText,
     headers: response.headers,
   });
+  signal.addEventListener("abort", onAbort, { once: true });
+  if (signal.aborted) onAbort();
+  return wrapped;
 }
 
 /**
@@ -155,7 +172,7 @@ export async function withRaisedInboundBodyAdmission(
     reservedInboundBodyBytes -= maxBytes;
   };
   try {
-    return retainUntilResponseSettles(await work(), release);
+    return retainUntilResponseSettles(await work(), req.signal, release);
   } catch (error) {
     release();
     throw error;

package/src/server/index/link-listener.ts

@@ -8,9 +8,18 @@ import {
 } from "../../link/store";
 import { linkStorePath } from "../../link/paths";
 import { linkRouteAllowed } from "../../link/routes";
+import { withConfigMutationLockSync } from "../../config/mutation-lock";
 
 export const LINK_INGRESS_HOSTNAME = "opencodex-link.invalid";
 
+/** Internal signal: the store's port differs from the port this bind landed on. */
+class LinkListenerPortMismatchError extends Error {
+  constructor(storedPort: number, boundPort: number) {
+    super(`stored port ${storedPort} differs from bound port ${boundPort}`);
+    this.name = "LinkListenerPortMismatchError";
+  }
+}
+
 export interface LinkListenerStartContext<T> {
   dispatch: (req: Request, server: Server<T>) => Promise<Response>;
   maxRequestBodySize: number;
@@ -118,29 +127,33 @@ export function createLinkListenerLifecycle<T>(deps: LinkListenerDeps = {}): Lin
       closeWithoutAwait(bound);
       return;
     }
-    if (store.listenerPort === null) {
-      const port = bound.port;
-      if (!port || port === 0) {
-        closeWithoutAwait(bound);
-        reportFailure("bind", new Error("Bun did not report a concrete listener port"), "bind");
-        return;
-      }
-      try {
+    const port = bound.port;
+    if (!port || port === 0) {
+      closeWithoutAwait(bound);
+      reportFailure("bind", new Error("Bun did not report a concrete listener port"), "bind");
+      return;
+    }
+    try {
+      // Revalidate the admission and persist a new port in one mutation section.
+      // Even a known-port bind can race the deletion of its last recorded link.
+      const needed = withConfigMutationLockSync(() => {
         const current = readStore(storePath);
+        if (current.links.length === 0) return false;
         if (current.listenerPort !== null && current.listenerPort !== port) {
-          // Another writer fixed a different port while this bind ran. Tunnels target the stored
-          // port, so serving on this one would strand them: give it up and let the next
-          // ensureStarted() bind the stored port.
-          closeWithoutAwait(bound);
-          reportFailure("listenerPort persistence", new Error(`stored port ${current.listenerPort} differs from bound port ${port}`), "persist");
-          return;
+          throw new LinkListenerPortMismatchError(current.listenerPort, port);
         }
-        writeStore(storePath, { ...current, listenerPort: port });
-      } catch (error) {
+        if (current.listenerPort === null) writeStore(storePath, { ...current, listenerPort: port });
+        return true;
+      });
+      if (!needed) {
         closeWithoutAwait(bound);
-        reportFailure("listenerPort persistence", error, "persist");
+        setStatus("off", null, null);
         return;
       }
+    } catch (error) {
+      closeWithoutAwait(bound);
+      reportFailure("listenerPort persistence", error, "persist");
+      return;
     }
     listener = bound as Server<T>;
     relaySessions = sessions;

package/src/server/index/link-management.ts

@@ -0,0 +1,58 @@
+/**
+ * The Home end of the Remote Link management relay (#6957).
+ *
+ * Reached only on the hub-link listener, after the request has passed its link-key admission
+ * (`resolveApiAuth` restricted to recorded link keys) and the shared route table in
+ * `src/link/management-routes.ts`. The management handler sees a fresh request built here: no
+ * caller header, cookie, Origin or credential crosses from the link, and the principal is
+ * absent, so no consent- or capability-gated branch can be reached. Only allowlisted reads run.
+ * They run as passive reads (`src/lib/passive-read.ts`): no discovery, config write or diagnostic (#6959).
+ */
+import type { OcxConfig } from "../../types";
+import { handleManagementAPI, type ManagementApiDeps } from "../management-api";
+import type { ManagementSessionControl } from "../management-auth";
+import { runPassiveRead } from "../../lib/passive-read";
+import { LINK_CODEX_SETTINGS_PATH, linkManagementRouteAllowed, linkManagementTarget } from "../../link/management-routes";
+import { projectHomeCodexSettings } from "../../link/codex-settings";
+import { packageVersion } from "../../lib/package-version";
+
+const VERSION = packageVersion("0.0.0");
+const KEPT_RESPONSE_HEADERS = ["content-type", "content-language", "etag", "last-modified"];
+
+function notFound(): Response {
+  return Response.json({ error: "not_found" }, { status: 404, headers: { "cache-control": "no-store" } });
+}
+
+export async function handleLinkManagementRequest(
+  req: Request,
+  url: URL,
+  config: OcxConfig,
+  deps: ManagementApiDeps,
+  sessionControl?: ManagementSessionControl,
+): Promise<Response> {
+  if (!linkManagementRouteAllowed(url, req)) return notFound();
+  if (url.pathname === LINK_CODEX_SETTINGS_PATH) {
+    return Response.json(projectHomeCodexSettings(config, VERSION), { headers: { "cache-control": "no-store" } });
+  }
+  const target = linkManagementTarget(url);
+  if (!target) return notFound();
+  const local = new URL(`${target.pathname}${target.search}`, "http://127.0.0.1");
+  // The handlers branch on GET; an admitted HEAD runs as GET and its body is dropped below.
+  const inner = new Request(local.href, {
+    method: "GET",
+    headers: { accept: "application/json", host: "127.0.0.1" },
+  });
+  const response = await runPassiveRead(() =>
+    handleManagementAPI(inner, local, config, deps, undefined, sessionControl, { trustedLoopback: false }));
+  if (!response) return notFound();
+  const headers = new Headers({ "cache-control": "no-store" });
+  for (const name of KEPT_RESPONSE_HEADERS) {
+    const value = response.headers.get(name);
+    if (value) headers.set(name, value);
+  }
+  if (req.method === "HEAD") {
+    try { await response.body?.cancel(); } catch { /* best effort */ }
+    return new Response(null, { status: response.status, headers });
+  }
+  return new Response(response.body, { status: response.status, headers });
+}

package/src/server/index/optional-listeners.ts

@@ -14,6 +14,7 @@ import {
   type LinkListenerStatus,
 } from "./link-listener";
 import { createLinkSupervisor, type LinkSupervisor } from "../../link/supervisor";
+import { linkManagementRouteAllowed } from "../../link/management-routes";
 import { saveConfigPreservingClaudeCode } from "../../config/live-reconcile";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 export { LINK_INGRESS_HOSTNAME } from "./link-listener";
@@ -77,7 +78,10 @@ export function createOptionalListenerSet<T>(linkDeps: LinkListenerDeps = {}): O
       if (claudeIntercept.ownsListener(server)) return "claude-intercept";
       return undefined;
     },
-    linkRouteAllowed,
+    // The Home's link listener admits the data plane plus the read-only management relay
+    // (#6957). The Child's own ingress keeps the data-only table, so a local caller on the Child
+    // cannot reach the Home's management reads without the Child's dashboard session.
+    linkRouteAllowed: (url, req) => linkRouteAllowed(url, req) || linkManagementRouteAllowed(url, req),
     linkAdmissionKeyIds: () => linkListener.linkAdmissionKeyIds(),
     onAuthenticatedCatalog: listener => linkListener.onAuthenticatedCatalog(listener),
     notifyAuthenticatedCatalog: apiKeyId => linkListener.notifyAuthenticatedCatalog(apiKeyId),

package/src/server/index/serve-options.ts

@@ -1,5 +1,6 @@
 import type { Server, ServerWebSocket } from "bun";
 import type { StartServerDeps } from "./startup-warnings";
+import { isLinkManagementPath } from "../../link/management-routes";
 import {
   GUI_PAIRING_EXCHANGE_BODY_LIMIT,
   REMOTE_WORKSPACE_PAIRING_BODY_LIMIT,
@@ -96,6 +97,7 @@ import {
   isAllowedManagementOrigin,
   isApiAuthRequired,
   isLoopbackHostname,
+  markTrustedHubManagementRequest,
   jsonResponse,
   admissionFields,
   resolveApiAuth,
@@ -313,6 +315,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
       maxRequestBodySize: inboundBodyLimitBytes,
       async fetch(req: Request, requestServer: Server<WsData>): Promise<Response> {
       const ingress = ingressForServer(requestServer);
+      // Bind management-origin trust to the actual Bun listener object resolved above.
+      // Neither Host nor any X-Forwarded-* header can manufacture this process-local mark.
+      if (ingress === "hub-management" && config.runtimeRole === "hub") {
+        markTrustedHubManagementRequest(req);
+      }
       const requestUrl = codexCompatibleUrl(req.url);
       const linkPolicyView = ingress === "hub-link" ? linkPolicy() : undefined;
       // The unauthenticated loopback listener (#1102) serves a fixed allowlist and nothing
@@ -367,6 +374,12 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         if (requestUrl.pathname === "/v1/catalog" && requestUrl.search === ""
           && (req.method === "GET" || req.method === "HEAD")
           && admission.kind === "configured") onAuthenticatedCatalog(admission.keyId);
+        // #6957: the Child's read-only view of this Home. Admitted by the link key above and by
+        // the shared table in src/link/management-routes.ts; never reachable on another ingress.
+        if (isLinkManagementPath(requestUrl.pathname)) {
+          const { handleLinkManagementRequest } = await import("./link-management");
+          return withCors(await handleLinkManagementRequest(req, requestUrl, config, requestManagementApiDeps, managementSessionControl), req, policy);
+        }
       }
       const url = requestUrl;
       const admissionOptions = { linkIngress: policy.linkIngress?.allowedKeyIds };
@@ -1594,8 +1607,11 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         // `policy`, not `config`: this route is now served on the unauthenticated loopback
         // listener too (#4236), and only the receiving listener's view produces CORS headers
         // that match the admission decision made above.
-        return runAdmittedHttpTurn(req, policy, async turnAdmissionLease => withCors(
-          await handleChatCompletions(req, config, logCtx, { requestId, start, turnAdmissionLease, admission }),
+        // Promote a caller `x-session-id` before admission, as Responses and Messages do (#6520):
+        // the ChatGPT bridge forwards only canonical session headers, so the raw marker is lost.
+        const sessionReq = withCallerSessionIdentity(req, admission);
+        return runAdmittedHttpTurn(sessionReq, policy, async turnAdmissionLease => withCors(
+          await handleChatCompletions(sessionReq, config, logCtx, { requestId, start, turnAdmissionLease, admission }),
           req,
           policy,
         ), { requestId, start, logCtx });
@@ -1716,7 +1732,9 @@ export function createServeOptions(ctx: ServeOptionsContext) {
         if (audioController) registerTurn(audioController, turnAdmissionLease);
         const acquisition = audioController
           ? clearableDeadline(120_000, AbortSignal.any([req.signal, audioController.signal])) : undefined;
+        const detachClientAbort = turnAdmissionLease.bindAbortSignal(req.signal);
         const releaseAcquisition = () => {
+          detachClientAbort();
           acquisition?.clear();
           if (audioController) unregisterTurn(audioController);
           else turnAdmissionLease.release();
@@ -1835,6 +1853,7 @@ export function createServeOptions(ctx: ServeOptionsContext) {
           return withCors(formatErrorResponse(502, "upstream_error", "Audio WebSocket upgrade failed"), req, policy);
         }
         if (upgraded) {
+          detachClientAbort();
           acquisition?.clear();
           finalizeLiveRequest(101);
           return undefined as unknown as Response;

package/src/server/index.ts

@@ -502,7 +502,7 @@ function startServerWithSpendLedgerOwner(port: number | undefined, deps: StartSe
     work: (lease: ActiveTurnLease) => Promise<Response>,
     refusalLog?: WorkflowRefusalLog,
   ): Promise<Response> {
-    const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers));
+    const lease = tryAdmitTurn(sessionLaneIdFromRequest(req.headers), req.signal);
     if (!lease) return serverBusyResponse(req, "active turns", policy);
     // Root, lane, and the refusal that follows from them, all live in ./workflow-refusal.
     let workflow: ReturnType<typeof admitHttpWorkflowTurn>;

package/src/server/lifecycle.ts

@@ -8,7 +8,7 @@ import {
 } from "../storage/policy-job";
 import { abortRestoreTrashJobAsync } from "../storage/restore-job";
 import { stopStorageCleanupScheduler } from "../storage/policy-scheduler";
-import { runOptionalShutdownHooks } from "../lib/optional-shutdown-hooks";
+import { runDrainStartHooks, runOptionalShutdownHooks } from "../lib/optional-shutdown-hooks";
 import { stopStateStoreSweeper } from "../lib/state-store-sweeper";
 import {
   cancelQueuedStorageWorkerSpawns,
@@ -36,6 +36,7 @@ export const SESSION_LANE_ID_BYTES = 32;
 const turnGate = createAdmissionGate("active_turns", MAX_ACTIVE_TURNS);
 export interface ActiveTurnLease extends AdmissionLease {
   attach(lease: AdmissionLease): void;
+  bindAbortSignal(signal: AbortSignal): () => void;
   bindAbortController(ac: AbortController): void;
   beginCodexAccountSelection(): CodexAccountSelectionAdmission;
   isTransferred(): boolean;
@@ -169,7 +170,7 @@ export function resetLifecycleDrainStateForTests(): void {
   serverStartupReleaseFlights = new WeakMap<ReturnType<typeof Bun.serve>, Promise<void>>();
   releaseServerStartupLifecycleImpl = releaseNativeMainStartupLifecycle;
 }
-export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
+export function tryAdmitTurn(sessionLaneId?: string, clientSignal?: AbortSignal): ActiveTurnLease | null {
   if (isDraining()) return null;
   const opaqueSessionLaneId = sessionLaneId
     ? createHash("sha256").update(sessionLaneId).digest("hex").slice(0, SESSION_LANE_ID_BYTES)
@@ -192,6 +193,8 @@ export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
   }
   const controllers = new Set<AbortController>();
   const attachedLeases = new Set<AdmissionLease>();
+  const abortListeners = new Map<AbortSignal, () => void>();
+  let cancellationReason: unknown;
   let active = true;
   let transferred = false;
   let nativeMainClaimed = false;
@@ -200,22 +203,40 @@ export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
       if (!active) attachedLease.release();
       else attachedLeases.add(attachedLease);
     },
+    bindAbortSignal(signal) {
+      if (!active || abortListeners.has(signal)) return () => {};
+      const onAbort = () => {
+        cancellationReason = signal.reason;
+        const boundControllers = [...controllers];
+        lease.release();
+        for (const controller of boundControllers) controller.abort(cancellationReason);
+      };
+      abortListeners.set(signal, onAbort);
+      signal.addEventListener("abort", onAbort, { once: true });
+      if (signal.aborted) onAbort();
+      return () => {
+        if (abortListeners.get(signal) !== onAbort) return;
+        signal.removeEventListener("abort", onAbort);
+        abortListeners.delete(signal);
+      };
+    },
     bindAbortController(ac) {
       knownTurnControllers.add(ac);
       if (!active) {
-        ac.abort(new Error("turn already settled"));
+        ac.abort(cancellationReason ?? new Error("turn already settled"));
         return;
       }
       transferred = true;
       controllers.add(ac);
       activeTurns.set(ac, lease);
+      lease.bindAbortSignal(ac.signal);
     },
     beginCodexAccountSelection() {
       const mainProfileDraining = nativeMainDrainOwners.size > 0;
-      let selectionActive = !mainProfileDraining;
+      let selectionActive = active && !mainProfileDraining;
       let released = false;
       if (selectionActive) nativeMainSelections += 1;
-      return {
+      const selection: CodexAccountSelectionAdmission = {
         mainProfileDraining,
         claimMainProfile() {
           if (released || mainProfileDraining || !active) return false;
@@ -228,18 +249,23 @@ export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
         release() {
           if (released) return;
           released = true;
+          attachedLeases.delete(selection);
           if (selectionActive) {
             selectionActive = false;
             nativeMainSelections = Math.max(0, nativeMainSelections - 1);
           }
         },
       };
+      lease.attach(selection);
+      return selection;
     },
     isTransferred() { return transferred; },
     release() {
       if (!active) return;
       active = false;
       admittedTurns.delete(lease);
+      for (const [signal, listener] of abortListeners) signal.removeEventListener("abort", listener);
+      abortListeners.clear();
       for (const controller of controllers) {
         if (activeTurns.get(controller) === lease) activeTurns.delete(controller);
       }
@@ -258,6 +284,7 @@ export function tryAdmitTurn(sessionLaneId?: string): ActiveTurnLease | null {
     },
   };
   admittedTurns.add(lease);
+  if (clientSignal) lease.bindAbortSignal(clientSignal);
   return lease;
 }
 export function codexAccountSelectionForTurn(
@@ -472,6 +499,7 @@ export async function drainAndShutdown(
   // ordinary in-flight turns. A stuck scoped owner must not pin shutdown forever.
   const deadline = Date.now() + Math.max(0, timeoutMs);
   beginShutdownDrain();
+  runDrainStartHooks();
   const temporaryDrainsSettled = await waitForTemporaryDrainsUntil(deadline);
   if (!temporaryDrainsSettled) {
     console.warn("Temporary drain lease did not settle before the shutdown deadline; forcing shutdown");