@bitkyc08/opencodex 2.82.0 → 2.84.0

package/src/adapters/openai-responses/plaintext-reasoning-notice.ts

@@ -0,0 +1,85 @@
+import { sanitizeLogMetadataString } from "../../lib/redact";
+import { isOpenAiOperatedResponsesDestination } from "../../providers/openai-tiers";
+import { normalizedProviderEndpoint, PROVIDER_REGISTRY } from "../../providers/registry";
+import type { OcxProviderConfig } from "../../types";
+
+/**
+ * #6675: a custom Responses provider drops replayed plaintext reasoning unless it sets
+ * `preserveResponsesReasoningContent`. That default is deliberate (the ChatGPT backend rejects
+ * echoed raw reasoning, and forwarding it costs tokens), but it is silent, and the similarly named
+ * Chat-wire `preserveReasoningContentModels` does not opt in. Say so once per destination.
+ *
+ * Only a hand-configured `openai-responses` row with key auth qualifies. Registry presets (matched
+ * by endpoint on either OpenAI wire, since a preset may be routed to Responses per model), OAuth and
+ * forward rows, Azure, and OpenAI-operated destinations are skipped: their replay contract is
+ * curated, so blanking there is a decision rather than a missing setting. The notice carries only
+ * the destination host and option names, never request content.
+ */
+const MAX_NOTICED_DESTINATIONS = 64;
+const noticedDestinations = new Set<string>();
+
+function destinationHost(baseUrl: unknown): string | undefined {
+  if (typeof baseUrl !== "string") return undefined;
+  try {
+    return sanitizeLogMetadataString(new URL(baseUrl).host, 128);
+  } catch {
+    return undefined;
+  }
+}
+
+/** Azure OpenAI and Azure AI Foundry serve OpenAI-operated models under per-resource hosts. */
+const AZURE_OPENAI_HOST_SUFFIXES = [".openai.azure.com", ".services.ai.azure.com", ".cognitiveservices.azure.com"];
+
+function hostnameOf(url: string): string | undefined {
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return undefined;
+  }
+}
+
+/** A templated preset (`https://{resource}.openai.azure.com/...`) matches by host pattern. */
+function templatedHostMatches(template: string, hostname: string): boolean {
+  const host = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]+)/i.exec(template)?.[1];
+  if (!host || !/\{[^}]*\}/.test(host)) return false;
+  const pattern = host.toLowerCase().split(/\{[^}]*\}/).map(part => part.replace(/[.*+?^$()|[\]\\]/g, "\\$&")).join("[^.]+");
+  return new RegExp(`^${pattern}$`).test(hostname);
+}
+
+function isRegistryDestination(baseUrl: string): boolean {
+  const endpoint = normalizedProviderEndpoint(baseUrl);
+  const hostname = hostnameOf(baseUrl);
+  if (hostname && AZURE_OPENAI_HOST_SUFFIXES.some(suffix => hostname.endsWith(suffix))) return true;
+  return PROVIDER_REGISTRY.some(entry =>
+    normalizedProviderEndpoint(entry.baseUrl) === endpoint
+    || (hostname !== undefined && templatedHostMatches(entry.baseUrl, hostname))
+    || (entry.destinationAliases ?? []).some(alias => normalizedProviderEndpoint(alias.baseUrl) === endpoint));
+}
+
+function isCustomResponsesProvider(provider: OcxProviderConfig): boolean {
+  if (provider.adapter !== "openai-responses") return false;
+  if (provider.authMode !== undefined && provider.authMode !== "key") return false;
+  if (typeof provider.baseUrl !== "string" || !provider.baseUrl) return false;
+  return !isOpenAiOperatedResponsesDestination(provider) && !isRegistryDestination(provider.baseUrl);
+}
+
+export function plaintextReasoningDroppedNotice(host: string): string {
+  return `[opencodex] Replayed plaintext reasoning was dropped for the custom Responses provider at ${host}. `
+    + "If that endpoint accepts reasoning_text replay, set \"preserveResponsesReasoningContent\": true on the provider; "
+    + "\"preserveReasoningContentModels\" applies only to the Chat wire.";
+}
+
+export function notePlaintextReasoningDropped(
+  provider: OcxProviderConfig,
+  warn: (message: string) => void = message => console.warn(message),
+): void {
+  if (!isCustomResponsesProvider(provider)) return;
+  const host = destinationHost(provider.baseUrl);
+  if (!host || noticedDestinations.has(host) || noticedDestinations.size >= MAX_NOTICED_DESTINATIONS) return;
+  noticedDestinations.add(host);
+  warn(plaintextReasoningDroppedNotice(host));
+}
+
+export function resetPlaintextReasoningNoticesForTests(): void {
+  noticedDestinations.clear();
+}

package/src/adapters/openai-responses/reasoning.ts

@@ -78,6 +78,11 @@ export function sanitizeReasoningInputContent(
      * placeholder, rather than emitted in the shape the upstream 400s on.
      */
     requirePlaintextReasoning?: boolean;
+    /**
+     * Called once per sanitized body when a reasoning item that carried nonempty plaintext
+     * `reasoning_text` was blanked. Observability only; it never changes the body (#6675).
+     */
+    onPlaintextReasoningBlanked?: () => void;
   },
 ): unknown {
   if (!body || typeof body !== "object" || Array.isArray(body)) return body;
@@ -85,6 +90,7 @@ export function sanitizeReasoningInputContent(
   if (!Array.isArray(raw.input)) return body;
 
   let changed = false;
+  let blankedPlaintext = false;
   const input = raw.input.map(item => {
     if (!item || typeof item !== "object" || Array.isArray(item)) return item;
     const rec = item as Record<string, unknown>;
@@ -148,11 +154,15 @@ export function sanitizeReasoningInputContent(
     // guide merges reasoning items into the adjacent assistant message), so providers flagged
     // `preserveResponsesReasoningContent` keep it — deleting valid replay content there breaks
     // continuations after tool calls (issue #875 family).
-    if (blankContent) next.content = [];
+    if (blankContent) {
+      if (hasPlaintextReasoningContent(rec.content)) blankedPlaintext = true;
+      next.content = [];
+    }
     if (missingPlaintextReasoning) next.content = plaintextReasoningBackfill(next);
     return next;
   });
 
+  if (blankedPlaintext) opts?.onPlaintextReasoningBlanked?.();
   return changed ? { ...raw, input } : body;
 }
 

package/src/adapters/openai-responses/request-strips.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { COMPACT_PROMPT, compactionItemToText, decodeCompactionSummary, isCompactionItemType } from "../../responses/compaction";
+import { COMPACT_PROMPT, appendCheckpointContinuationNote, compactionItemToText, decodeCompactionSummary, isCompactionItemType } from "../../responses/compaction";
 import { debugProviderDiagnostic } from "../../lib/debug";
 import { modelInList } from "../../types";
 import { isPlainObject } from "./internal";
@@ -260,10 +260,12 @@ export function scrubOcxCompactionItems(
   body: unknown,
   destinationDecodesNativeBlob: boolean,
   threadServingIdentityChanged: boolean,
+  addContinuationNote = false,
 ): unknown {
   if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
 
   let changed = false;
+  let decodedCheckpoint = false;
   const input = body.input.map(item => {
     if (!isPlainObject(item) || !isCompactionItemType(item.type)) return item;
     const encrypted = typeof item.encrypted_content === "string" ? item.encrypted_content : undefined;
@@ -274,6 +276,7 @@ export function scrubOcxCompactionItems(
       && !threadServingIdentityChanged
     ) return item;
     changed = true;
+    if (decodeCompactionSummary(encrypted) !== null) decodedCheckpoint = true;
     return {
       type: "message",
       role: "user",
@@ -281,5 +284,10 @@ export function scrubOcxCompactionItems(
     };
   });
 
-  return changed ? { ...body, input } : body;
+  if (!changed) return body;
+  // #6764: a decoded checkpoint is plain user text from here on, so name its role in the
+  // instructions. Compaction requests skip this; the summarizer must not be told to continue.
+  return addContinuationNote && decodedCheckpoint
+    ? { ...body, input, instructions: appendCheckpointContinuationNote(body.instructions) }
+    : { ...body, input };
 }

package/src/adapters/qoder/adapter.ts

@@ -5,7 +5,7 @@ import { mapReasoningEffort } from "../../reasoning-effort";
 import { buildSystemPrompt, MAX_TOOL_BLOCK_STARTS } from "../coding-agent/protocol";
 import { buildCodingAgentToolCatalog, CodingAgentToolCatalogError } from "../coding-agent/tool-catalog";
 import { baseScopedEnv, runCodingAgentTurn, type CodingAgentDeps, type CodingAgentToolBridgeInput } from "../coding-agent/turn";
-import { QODER_PROFILES, type QoderProfile } from "./profiles";
+import { QODER_PROFILES, resolveQoderProfile, type QoderProfile } from "./profiles";
 import { QoderScaffoldFilter, QODER_SCAFFOLD_ERROR_CODE, qoderScaffoldErrorMessage } from "./scaffold-guard";
 
 export type QoderAdapterDeps = CodingAgentDeps;
@@ -114,19 +114,21 @@ export function createQoderAdapter(provider: OcxProviderConfig, deps: QoderAdapt
       yield { type: "error", message: "Qoder adapter uses runTurn; the fetch/parseStream path is disabled." };
     },
     async runTurn(parsed, incoming, emit): Promise<void> {
-      const hasImage = parsed.context.messages.some(message =>
-        Array.isArray(message.content) && message.content.some(part => part.type === "image"),
-      );
-      if (hasImage) {
-        emit({
-          type: "error",
-          message: "Qoder image input is not enabled because the CLI provider route has no verified multimodal contract.",
-          status: 400,
-          errorType: "invalid_request_error",
-          code: "unsupported_input_modality",
-          retryable: false,
-        });
-        return;
+      if (resolveQoderProfile(provider.baseUrl)?.region === "cn") {
+        const hasImage = parsed.context.messages.some(message =>
+          Array.isArray(message.content) && message.content.some(part => part.type === "image"),
+        );
+        if (hasImage) {
+          emit({
+            type: "error",
+            message: "Qoder image input is not enabled because the CLI provider route has no verified multimodal contract.",
+            status: 400,
+            errorType: "invalid_request_error",
+            code: "unsupported_input_modality",
+            retryable: false,
+          });
+          return;
+        }
       }
       let catalog: ReturnType<typeof buildCodingAgentToolCatalog>;
       try {

package/src/bridge/errors.ts

@@ -12,6 +12,7 @@ import {
   cyberPolicyErrorType,
   CYBER_POLICY_ERROR_CODE,
   isCyberPolicyCode,
+  SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE,
   type OcxErrorPayload,
 } from "../lib/errors";
 
@@ -22,6 +23,10 @@ export function formatErrorResponse(
   options?: { code?: string | null; retryAfter?: string | null },
 ): Response {
   const error = classifyError(status, type, message);
+  if (options?.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE) {
+    error.type = "server_error";
+    error.code = SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE;
+  }
   if (isCyberPolicyCode(options?.code)) {
     error.code = CYBER_POLICY_ERROR_CODE;
     error.type = cyberPolicyErrorType(type);
@@ -36,7 +41,8 @@ export function formatErrorResponse(
   // that would hand the client a 5xx it is configured to retry four times.
   const finalStatus = error.code === CYBER_POLICY_ERROR_CODE
     ? 400
-    : isReplayRefusalCode(error.code) ? REPLAY_REFUSED_STATUS : status;
+    : error.code === SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE ? 503
+      : isReplayRefusalCode(error.code) ? REPLAY_REFUSED_STATUS : status;
   const headers = new Headers({ "Content-Type": "application/json" });
   const retryAfter = options?.retryAfter?.trim();
   if (error.code !== CYBER_POLICY_ERROR_CODE
@@ -62,3 +68,22 @@ export function formatErrorResponse(
   if (refusal) retainReplayRefusal(response);
   return response;
 }
+
+/**
+ * A spent usage window, in the shape the Codex client treats as final (#6991): HTTP 429 with
+ * `error.type: "usage_limit_reached"` and, when the reset is known, `resets_at` in epoch
+ * seconds. Codex stops (and shows the reset time when present) instead of backing off through its
+ * retry budget, which is what it does with `rate_limit_exceeded`. No `plan_type` is sent: Codex
+ * would read it as a ChatGPT plan and print that plan's upgrade advice. `formatErrorResponse`
+ * cannot build this, because every 429 it classifies becomes `rate_limit_exceeded` and its
+ * payload has no `resets_at`.
+ */
+export function formatUsageLimitReachedResponse(message: string, resetsAtMs: number | null, retryAfterSeconds: number | null): Response {
+  const error = {
+    message, type: "usage_limit_reached", code: "usage_limit_reached",
+    ...(resetsAtMs !== null ? { resets_at: Math.ceil(resetsAtMs / 1000) } : {}),
+  };
+  const headers = new Headers({ "Content-Type": "application/json" });
+  if (retryAfterSeconds !== null) headers.set("Retry-After", String(retryAfterSeconds));
+  return new Response(JSON.stringify({ error }), { status: 429, headers });
+}

package/src/bridge.ts

@@ -1,6 +1,6 @@
 export { adapterFailureFromMessage } from "./lib/errors";
 
-export { formatErrorResponse } from "./bridge/errors";
+export { formatErrorResponse, formatUsageLimitReachedResponse } from "./bridge/errors";
 export { setOwnedBudgetAbandonedMsForTests } from "./bridge/internal";
 export { buildResponseJSON } from "./bridge/response-json";
 export { bridgeToResponsesSSE } from "./bridge/sse";

package/src/claude/context-windows.ts

@@ -10,7 +10,7 @@
  * adapter-reported CatalogModel.contextWindow / the Anthropic registry for passthrough ids);
  * nothing is guessed.
  */
-import { aliasForNative, aliasForRoute, currentClaudeAliasSpelling, legacyAliasForNative, legacyAliasForRoute } from "./alias";
+import { aliasForNative, aliasForRoute, currentClaudeAliasSpelling, legacyAliasForNative, legacyAliasForRoute, resolveAlias } from "./alias";
 import { desktop3pAlias } from "./desktop-3p";
 import { nativeOpenAiContextWindow, type CatalogModel, type NativeContextLimitsInput } from "../codex/catalog";
 import { ANTHROPIC_MODEL_CONTEXT_WINDOWS } from "../providers/registry/model-seeds";
@@ -20,13 +20,13 @@ import { AUTO_COMPACT_WINDOW_DEFAULT, AUTO_CONTEXT_FLOOR, ONE_MILLION } from "./
 export { AUTO_COMPACT_WINDOW_DEFAULT, AUTO_CONTEXT_FLOOR } from "./long-context";
 
 /**
- * The native id each Claude Code tier alias resolves to (2.1.282: `--model opus` sends
- * `claude-opus-5-5`, `sonnet` sends `claude-sonnet-5`, `fable` sends `claude-fable-5-1`).
+ * The native id each Claude Code tier alias resolves to (2.1.296: `--model opus` sends
+ * `claude-opus-5-5`, `sonnet` sends `claude-sonnet-5-5`, `fable` sends `claude-fable-5-1`).
  * Behind a gateway Claude Code accounts an unmarked id at 200k, so an unset tier slot is filled
  * with this id when the map marks it (#5755). A marked alias cannot stand in: Claude Code sends
  * `sonnet[1m]` upstream unresolved. Haiku has no entry; its 200k window never marks.
  */
-const CLAUDE_CODE_NATIVE_TIERS = { opus: "claude-opus-5-5", sonnet: "claude-sonnet-5", fable: "claude-fable-5-1" } as const;
+const CLAUDE_CODE_NATIVE_TIERS = { opus: "claude-opus-5-5", sonnet: "claude-sonnet-5-5", fable: "claude-fable-5-1" } as const;
 
 /** Binary-verified accepted range for CLAUDE_CODE_AUTO_COMPACT_WINDOW (2.1.207: pSo=1e5, yDs=1e6). */
 export const AUTO_COMPACT_WINDOW_MIN = 100_000;
@@ -277,6 +277,59 @@ export function effectiveModelEnv(
   return out;
 }
 
+/**
+ * Tier slots Claude Code pairs with a `<slot>_NAME` label (#6926). Its /model tier row is
+ * `label: <slot>_NAME ?? <first-party display name> ?? <slot value>` (2.1.296), and an
+ * `ocx-claude-*` alias is not a first-party id, so without the label the row prints the alias.
+ * The alias itself stays the submitted id: saved selections and inbound resolution depend on it.
+ */
+export const CLAUDE_TIER_LABEL_SLOTS = [
+  "ANTHROPIC_DEFAULT_OPUS_MODEL",
+  "ANTHROPIC_DEFAULT_SONNET_MODEL",
+  "ANTHROPIC_DEFAULT_FABLE_MODEL",
+  "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+] as const;
+
+export type ClaudeTierLabelSlot = (typeof CLAUDE_TIER_LABEL_SLOTS)[number];
+
+export function isClaudeTierLabelSlot(name: string): name is ClaudeTierLabelSlot {
+  return (CLAUDE_TIER_LABEL_SLOTS as readonly string[]).includes(name);
+}
+
+/**
+ * The picker label for a tier slot holding an OpenCodex alias, spelled like the discovery
+ * row's `display_name` (model-info.ts): `<slug> (native)`, `<model> (<provider>)` and a
+ * ` · 1M` variant. The native-namespaced `claude-*` selector is the Anthropic Fable picker
+ * alias, which discovery labels `(anthropic)`. A trailing `--fast` stays in the model name:
+ * without the catalog this cannot tell a synthetic Fast sibling from a real model whose id ends
+ * in `--fast`, and naming the exact model beats a prettier label that could name the wrong one.
+ * Anything that is not an alias (a first-party id, `provider/model`, a bare slug) gets no
+ * label: Claude Code either names it itself or the id is already what the user typed.
+ */
+export function claudeTierDisplayName(selector: string): string | undefined {
+  const trimmed = selector.trim();
+  const oneMillion = hasOneMillionMarker(trimmed);
+  const route = resolveAlias(stripOneMillionMarker(trimmed));
+  if (route === null) return undefined;
+  const slash = route.indexOf("/");
+  let provider = slash > 0 ? route.slice(0, slash) : "native";
+  const model = slash > 0 ? route.slice(slash + 1) : route;
+  if (!model) return undefined;
+  if (provider === "native" && model.startsWith("claude-")) provider = "anthropic";
+  return `${model} (${provider})${oneMillion ? " · 1M" : ""}`;
+}
+
+/** `{ "<slot>_NAME": label }` for each tier slot in `env` that holds an OpenCodex alias. */
+export function claudeTierDisplayNameEnv(env: Readonly<Record<string, string | undefined>>): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const slot of CLAUDE_TIER_LABEL_SLOTS) {
+    const value = env[slot];
+    const label = value ? claudeTierDisplayName(value) : undefined;
+    if (label !== undefined) out[`${slot}_NAME`] = label;
+  }
+  return out;
+}
+
 /** Shared 3s bounded acquisition (audit R4#3) for context-window sources. */
 export async function boundedContextWindows(
   acquire: () => Promise<Record<string, number>>,

package/src/claude/desktop-picker.ts

@@ -2,7 +2,7 @@
  * Claude Desktop picker mode: the one server-side controller for every picker mutation.
  *
  * While a server runs, enable, disable and Desktop mode transitions run here, serialized by one
- * lock (devlog/_plan/260924_claude_desktop_picker_mode/030_wp4_picker_activation.md, D11).
+ * lock (devlog/_fin/260924_claude_desktop_picker_mode/030_wp4_picker_activation.md, D11).
  */
 import type { OcxConfig } from "../types";
 import { claudeDesktopIntegrationEnabled } from "../codex/desired-state";

package/src/claude/intercept/connect-proxy.ts

@@ -113,12 +113,19 @@ export function isLoopbackTarget(host: string): boolean {
   return /^(0x[0-9a-f]+|\d+)(\.(0x[0-9a-f]+|\d+))*$/.test(host);
 }
 
-function respond(socket: Socket, status: number, reason: string, headers: Readonly<Record<string, string>> = {}): void {
+function respond(
+  socket: Socket, status: number, reason: string, headers: Readonly<Record<string, string>> = {}, body = "",
+): void {
   if (socket.destroyed) return;
   const extra = Object.entries(headers).map(([name, value]) => `${name}: ${value}\r\n`).join("");
-  socket.end(`HTTP/1.1 ${status} ${reason}\r\n${extra}Connection: close\r\nContent-Length: 0\r\n\r\n`);
+  const type = body ? "Content-Type: text/plain; charset=utf-8\r\n" : "";
+  socket.end(`HTTP/1.1 ${status} ${reason}\r\n${extra}${type}Connection: close\r\nContent-Length: ${Buffer.byteLength(body)}\r\n\r\n${body}`);
 }
 
+// Plain proxied HTTP (often loopback MCP traffic missing a NO_PROXY bypass) lands here; say why.
+const CONNECT_ONLY_BODY = "OpenCodex Claude intercept proxy accepts only CONNECT tunnels. "
+  + "Exclude this host via NO_PROXY (loopback and unspecified hosts: 127.0.0.1,localhost,::1,0.0.0.0).\n";
+
 function splice(client: Socket, upstream: Socket, pending: Uint8Array): void {
   const teardown = () => {
     client.destroy();
@@ -173,7 +180,7 @@ function handleConnection(socket: Socket, options: ResolvedConnectProxyOptions):
     // Bytes after the head belong to the tunnel (a client may pipeline its TLS ClientHello).
     let pending = head.subarray(end + 4);
     if (!target) {
-      respond(socket, 405, "Method Not Allowed");
+      respond(socket, 405, "Method Not Allowed", { Allow: "CONNECT" }, CONNECT_ONLY_BODY);
       return;
     }
     if (options.authToken !== undefined) {

package/src/claude/intercept/picker-ca-persistence.ts

@@ -22,6 +22,7 @@ export function canonicalPickerConfigDir(configDir: string): string {
 /** Public records still cannot follow symlinks or accept oversized/malformed recovery data. */
 function readState(path: string, configId: string, initialization: boolean): Initialization | AuthorityMetadata | null {
   // BigInt stats: a Windows file ID exceeds 2^53, so Number ino loses low bits and two files can compare equal.
+  // Refuse zero identity or metadata changes between the path snapshot and opened descriptor.
   let expected: BigIntStats;
   try { expected = lstatSync(path, { bigint: true }); }
   catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return null; throw new Error("picker_ca_metadata_unsafe"); }
@@ -31,7 +32,8 @@ function readState(path: string, configId: string, initialization: boolean): Ini
   catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return null; throw new Error("picker_ca_metadata_unsafe"); }
   try {
     const stat = fstatSync(fd, { bigint: true });
-    if (stat.dev !== expected.dev || stat.ino !== expected.ino) throw new Error("picker_ca_metadata_unsafe");
+    if (stat.dev !== expected.dev || stat.ino !== expected.ino || stat.ino === 0n
+      || stat.ctimeNs !== expected.ctimeNs) throw new Error("picker_ca_metadata_unsafe");
     if (!stat.isFile() || stat.nlink !== 1n || stat.size > BigInt(MAX_PUBLIC_STATE_BYTES)
       || (process.platform !== "win32" && stat.uid !== BigInt(process.getuid!()))) throw new Error();
     const bytes = Buffer.alloc(MAX_PUBLIC_STATE_BYTES + 1);

package/src/claude/intercept/picker-listener.ts

@@ -34,6 +34,11 @@ export interface PickerListenerOptions {
   maxEncodedBytes?: number;
   /** Test seam: concurrent upstream requests; production uses PICKER_MAX_ACTIVE_UPSTREAMS. */
   maxActiveUpstreams?: number;
+  /**
+   * Test seam: arms the drop of a connection whose backend ended, after PICKER_ABANDONED_INPUT_LINGER_MS;
+   * returns a cancel function. Production uses a timer.
+   */
+  scheduleAbandonedInputDrop?: (drop: () => void, ms: number) => () => void;
   log?: (line: string) => void;
 }
 export interface PickerListenerHandle { port: number; close(): Promise<void> }
@@ -51,6 +56,12 @@ export const PICKER_MAX_ACTIVE_UPSTREAMS = 256;
 export const PICKER_MAX_CONCURRENT_STREAMS = 100;
 /** A connection that has not sent a complete ClientHello by then is dropped. */
 const CLIENT_HELLO_TIMEOUT_MS = 10_000;
+/**
+ * Once the backend has ended a connection and its reply has been flushed, input the client still
+ * sends is discarded for at most this long before the connection is dropped. A cooperative client
+ * closes as soon as it reads a Connection: close reply; this only bounds one that keeps uploading.
+ */
+export const PICKER_ABANDONED_INPUT_LINGER_MS = 30_000;
 
 const HOP_HEADERS = new Set([
   "connection", "keep-alive", "proxy-connection", "proxy-authenticate", "proxy-authorization",
@@ -152,6 +163,10 @@ export async function startPickerListener(options: PickerListenerOptions): Promi
   const upstream = options.upstream ?? { host: "claude.ai", port: 443, servername: "claude.ai" };
   const cap = options.maxEncodedBytes ?? BOOTSTRAP_MAX_ENCODED_BYTES;
   const maxActiveUpstreams = options.maxActiveUpstreams ?? PICKER_MAX_ACTIVE_UPSTREAMS;
+  const scheduleAbandonedInputDrop = options.scheduleAbandonedInputDrop ?? ((drop: () => void, ms: number) => {
+    const timer = setTimeout(drop, ms);
+    return () => clearTimeout(timer);
+  });
   let activeUpstreams = 0;
   const upgrades = new Set<Duplex>();
   const spliced = new Set<Socket>();
@@ -205,8 +220,18 @@ export async function startPickerListener(options: PickerListenerOptions): Promi
         } else req.destroy();
       }
     };
+    // An HTTP/1.1 reply sent while the upload is unfinished advertises Connection: close. Bun 1.4.3
+    // ends such a response with socket.destroySoon() before our finish listeners run, which resets
+    // the splice before the reply reaches the client; keep it a graceful FIN that discards input.
+    // Only that closing socket is changed, and destroy() stays available for errors and shutdown.
+    const closesUnfinishedUpload = () => !h2 && uploading && !req.complete;
+    const keepClosingReplyIntact = () => {
+      const socket = req.socket;
+      socket.destroySoon = () => { req.resume(); socket.end(); return socket; };
+    };
     // Refusals answer with an empty response and a fixed log line that carries no request data.
     const refuse = (status: 400 | 503) => {
+      if (closesUnfinishedUpload()) keepClosingReplyIntact();
       // Do not leave a refused, still-uploading stream behind after delivering its empty reply.
       if (uploading && !req.complete) {
         req.once("error", () => res.destroy());
@@ -236,6 +261,7 @@ export async function startPickerListener(options: PickerListenerOptions): Promi
       if (clientGone) return;
       if (res.headersSent) res.destroy();
       else {
+        if (closesUnfinishedUpload()) keepClosingReplyIntact();
         res.writeHead(502, { "Content-Length": "0", ...(!h2 && uploading && !req.complete ? { Connection: "close" } : {}) });
         res.end(); log(502);
       }
@@ -260,7 +286,10 @@ export async function startPickerListener(options: PickerListenerOptions): Promi
           // HTTP/2 has no reason phrase; its compat writeHead takes the same flat raw header array.
           if (h2) (relayRes as Http2ServerResponse).writeHead(status, raw as unknown as Record<string, string>);
           else {
-            if (uploading && !req.complete) raw.push("Connection", "close");
+            if (uploading && !req.complete) {
+              keepClosingReplyIntact();
+              raw.push("Connection", "close");
+            }
             res.writeHead(status, upRes.statusMessage, raw);
           }
           log(status);
@@ -438,6 +467,8 @@ export async function startPickerListener(options: PickerListenerOptions): Promi
       const offersH2 = clientHelloOffersH2(head);
       if (offersH2 === null) return;
       client.off("data", onData);
+      // Keep reading an aborted upload after the backend reply FIN.
+      client.allowHalfOpen = true;
       // Paused, a FIN or later bytes wait in the readable buffer and follow `head` once piped.
       client.pause();
       clearTimeout(deadline);
@@ -450,6 +481,23 @@ export async function startPickerListener(options: PickerListenerOptions): Promi
       // its peer (reset, dial failure) tears the peer down instead of leaving it open.
       inner.once("close", () => { spliced.delete(inner); if (!client.writableEnded) client.destroy(); });
       client.once("close", () => { if (!inner.writableEnded) inner.destroy(); });
+      // The backend reply ended; discard ciphertext still coming from the aborted upload.
+      // Unpipe before resuming, so backpressure cannot hide the peer FIN. The discard is bounded
+      // from the moment the reply has been flushed to the socket (finish), never before, so the
+      // drop cannot cut a reply still being written; finish is not peer receipt, so a peer that
+      // also stops reading for the whole budget can lose unread bytes. A peer that keeps sending
+      // past the budget is dropped instead of holding the connection until shutdown (#6984).
+      inner.once("end", () => {
+        client.unpipe(inner);
+        client.resume();
+        const linger = () => {
+          if (client.destroyed) return;
+          const cancel = scheduleAbandonedInputDrop(() => client.destroy(), PICKER_ABANDONED_INPUT_LINGER_MS);
+          client.once("close", cancel);
+        };
+        if (client.writableFinished) linger();
+        else client.once("finish", linger);
+      });
       inner.once("connect", () => {
         inner.setNoDelay(true);
         client.setNoDelay(true);