@wlv-zedd/dsh-chatgpt-web 1.0.0

package/src/server.ts

@@ -0,0 +1,1111 @@
+import { chatGptWebTraceId, createChatGptWebAdapter } from "./adapters/chatgpt-web";
+import { closeChatGptBrowserWorkers } from "./adapters/chatgpt-web/browser-worker";
+import { closeTurnBrokers, TurnBroker } from "./adapters/chatgpt-web/turn-broker";
+import { timingSafeEqual, createHash } from "node:crypto";
+import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
+import { Readable } from "node:stream";
+import { chatGptTurnSessions } from "./adapters/chatgpt-web/turn-execution";
+import {
+  cancelAllStructuredCompactions,
+  cancelStructuredCompactionNativeTurn,
+  cancelStructuredCompactionTrace,
+} from "./adapters/chatgpt-web/compaction-handoff";
+import { chatGptBrowserTabClosedError } from "./adapters/chatgpt-web/adapter-error";
+import {
+  CHATGPT_TURN_REVISION_CONFLICT_MESSAGE,
+  extractChatGptTurnIdentity,
+  extractCodexTurnIdentityFromBody,
+} from "./adapters/chatgpt-web/environment";
+import { bridgeToResponsesSSE, buildResponseJSON, formatErrorResponse } from "./bridge";
+import type { AppConfig } from "./config";
+import { providerConfig } from "./config";
+import { AsyncEventQueue } from "./event-queue";
+import { readJsonRequestBody } from "./http-body";
+import { httpStatusFromTerminalError } from "./lib/errors";
+import { augmentNativeModelCatalog } from "./model-catalog";
+import {
+  readCodexModelContextOverride,
+  readCodexSubagentProtocol,
+  type CodexModelContextOverride,
+} from "./codex-integration";
+import {
+  CHATGPT_WEB_LUNA_BACKEND_MODEL,
+  isChatGptWebModelSlug,
+  requireChatGptWebModelRoute,
+  type ChatGptWebModelRoute,
+} from "./chatgpt-web-models";
+import { forwardNativeCodexRequest, type NativeFetch } from "./native-passthrough";
+import {
+  buildCompactV1Output,
+  COMPACT_PROMPT,
+  decodeCompactionSummary,
+  extractCompactUserMessages,
+} from "./responses/compaction";
+import { parseRequest } from "./responses/parser";
+import { expandPreviousResponseInput, flushResponseState, rememberResponseState } from "./responses/state";
+import { namespacedToolName, type AdapterEvent, type CodexParsedRequest } from "./types";
+import type { CodexProviderConfig } from "./types";
+import type { ProviderAdapter } from "./adapters/base";
+import { VERSION } from "./version";
+
+type HttpTrackedEndpoint = "models" | "responses" | "compact" | "search" | "unspecified";
+
+export interface NativeCodexTurnIdentity {
+  threadId: string;
+  turnId: string;
+}
+
+export interface HttpStreamFailureEvidence {
+  httpTurnId: number;
+  endpoint: HttpTrackedEndpoint;
+  reader: "client" | "windows_lifecycle";
+  platform: NodeJS.Platform;
+  chunks: number;
+  bytes: number;
+  errorName: string;
+  errorCode: string;
+}
+
+type HttpStreamFailureReporter = (evidence: HttpStreamFailureEvidence) => void;
+
+function safeStreamErrorField(value: unknown, fallback: string): string {
+  return typeof value === "string" && /^[A-Za-z0-9_.-]{1,64}$/.test(value)
+    ? value
+    : fallback;
+}
+
+function streamFailureEvidence(
+  error: unknown,
+  httpTurnId: number,
+  endpoint: HttpTrackedEndpoint,
+  reader: HttpStreamFailureEvidence["reader"],
+  platform: NodeJS.Platform,
+  chunks: number,
+  bytes: number,
+): HttpStreamFailureEvidence {
+  const candidate = error !== null && typeof error === "object"
+    ? error as { name?: unknown; code?: unknown }
+    : {};
+  return {
+    httpTurnId,
+    endpoint,
+    reader,
+    platform,
+    chunks,
+    bytes,
+    errorName: safeStreamErrorField(candidate.name, "Error"),
+    errorCode: safeStreamErrorField(candidate.code, "unknown"),
+  };
+}
+
+const reportHttpStreamFailure: HttpStreamFailureReporter = evidence => {
+  console.warn(`[dsh-chatgpt-web] http_stream_failed ${JSON.stringify(evidence)}`);
+};
+
+function emitHttpStreamFailure(
+  reporter: HttpStreamFailureReporter,
+  evidence: HttpStreamFailureEvidence,
+): void {
+  try {
+    reporter(evidence);
+  } catch {
+    // Diagnostics are a side channel: they must never replace the source stream error or retain
+    // HTTP turn ownership after the client has already observed that failure.
+  }
+}
+
+export class HttpTurnCounter {
+  private readonly active = new Map<number, {
+    abort: AbortController;
+    done: Promise<void>;
+    finish: () => void;
+    identity?: NativeCodexTurnIdentity;
+  }>();
+  private readonly interrupted = new Map<string, unknown>();
+  private nextId = 1;
+
+  private identityKey(identity: NativeCodexTurnIdentity): string {
+    return `${identity.threadId}\u0000${identity.turnId}`;
+  }
+
+  private rememberInterrupted(identity: NativeCodexTurnIdentity, reason: unknown): void {
+    const key = this.identityKey(identity);
+    this.interrupted.delete(key);
+    this.interrupted.set(key, reason);
+    while (this.interrupted.size > 1_024) {
+      const oldest = this.interrupted.keys().next().value as string | undefined;
+      if (oldest === undefined) break;
+      this.interrupted.delete(oldest);
+    }
+  }
+
+  constructor(private readonly reportStreamFailure: HttpStreamFailureReporter = reportHttpStreamFailure) {}
+
+  count(): number {
+    return this.active.size;
+  }
+
+  async cancelAll(reason: unknown = new Error("Active HTTP turns cancelled")): Promise<number> {
+    const turns = [...this.active.values()];
+    for (const turn of turns) {
+      if (!turn.abort.signal.aborted) turn.abort.abort(reason);
+    }
+    await Promise.all(turns.map(turn => turn.done));
+    return turns.length;
+  }
+
+  async cancelTurn(
+    identity: NativeCodexTurnIdentity,
+    reason: unknown = new DOMException("Codex turn interrupted", "AbortError"),
+  ): Promise<number> {
+    const cancellation = this.beginCancelTurn(identity, reason);
+    await cancellation.settlement;
+    return cancellation.cancelled;
+  }
+
+  beginCancelTurn(
+    identity: NativeCodexTurnIdentity,
+    reason: unknown = new DOMException("Codex turn interrupted", "AbortError"),
+  ): { cancelled: number; settlement: Promise<void> } {
+    this.rememberInterrupted(identity, reason);
+    const turns = [...this.active.values()].filter(turn => (
+      turn.identity?.threadId === identity.threadId && turn.identity.turnId === identity.turnId
+    ));
+    for (const turn of turns) {
+      if (!turn.abort.signal.aborted) turn.abort.abort(reason);
+    }
+    return {
+      cancelled: turns.length,
+      settlement: Promise.all(turns.map(turn => turn.done)).then(() => undefined),
+    };
+  }
+
+  async track(
+    run: (
+      signal: AbortSignal,
+      bindIdentity: (identity: NativeCodexTurnIdentity) => void,
+    ) => Promise<Response>,
+    clientSignal?: AbortSignal,
+    platform: NodeJS.Platform = process.platform,
+    endpoint: HttpTrackedEndpoint = "unspecified",
+  ): Promise<Response> {
+    const id = this.nextId++;
+    const abort = new AbortController();
+    let finish!: () => void;
+    const done = new Promise<void>(resolve => { finish = resolve; });
+    const tracked: {
+      abort: AbortController;
+      done: Promise<void>;
+      finish: () => void;
+      identity?: NativeCodexTurnIdentity;
+    } = { abort, done, finish };
+    this.active.set(id, tracked);
+    let released = false;
+    let clientAbortListener: (() => void) | undefined;
+    let streamAbortListener: (() => void) | undefined;
+    const release = () => {
+      if (released) return;
+      released = true;
+      this.active.delete(id);
+      if (clientSignal && clientAbortListener) {
+        clientSignal.removeEventListener("abort", clientAbortListener);
+        clientAbortListener = undefined;
+      }
+      if (streamAbortListener) abort.signal.removeEventListener("abort", streamAbortListener);
+      finish();
+    };
+    clientAbortListener = () => abort.abort(clientSignal?.reason);
+    if (clientSignal?.aborted) abort.abort(clientSignal.reason);
+    else clientSignal?.addEventListener("abort", clientAbortListener, { once: true });
+
+    try {
+      const response = await run(abort.signal, identity => {
+        if (!identity.threadId.trim() || !identity.turnId.trim()) {
+          throw new Error("Native Codex turn identity must contain a threadId and turnId");
+        }
+        if (tracked.identity
+          && (tracked.identity.threadId !== identity.threadId || tracked.identity.turnId !== identity.turnId)) {
+          throw new Error("An HTTP request cannot change its native Codex turn identity");
+        }
+        tracked.identity = identity;
+        const interruptedReason = this.interrupted.get(this.identityKey(identity));
+        if (interruptedReason !== undefined && !abort.signal.aborted) abort.abort(interruptedReason);
+      });
+      if (!response.body) {
+        release();
+        return response;
+      }
+      if (abort.signal.aborted) {
+        await response.body.cancel(abort.signal.reason).catch(() => {});
+        release();
+        return new Response(null, { status: 499, statusText: "Client Closed Request" });
+      }
+
+      if (platform !== "win32") {
+        // Bun's async-pull teardown bug is Windows-only. On Darwin/Linux, preserve the direct
+        // pull chain: it keeps HTTP backpressure native and lets a client body cancellation reach
+        // the original SSE reader without an eagerly drained tee branch racing the socket writer.
+        const reader = response.body.getReader();
+        const reportStreamFailure = this.reportStreamFailure;
+        let chunks = 0;
+        let bytes = 0;
+        streamAbortListener = () => {
+          void reader.cancel(abort.signal.reason).catch(() => {}).finally(release);
+        };
+        abort.signal.addEventListener("abort", streamAbortListener, { once: true });
+        const body = new ReadableStream<Uint8Array>({
+          async pull(controller) {
+            try {
+              const chunk = await reader.read();
+              if (chunk.done) {
+                release();
+                controller.close();
+                return;
+              }
+              chunks += 1;
+              bytes += chunk.value.byteLength;
+              controller.enqueue(chunk.value);
+            } catch (error) {
+              if (!abort.signal.aborted) {
+                emitHttpStreamFailure(reportStreamFailure, streamFailureEvidence(
+                  error,
+                  id,
+                  endpoint,
+                  "client",
+                  platform,
+                  chunks,
+                  bytes,
+                ));
+              }
+              release();
+              controller.error(error);
+            }
+          },
+          async cancel(reason) {
+            try {
+              await reader.cancel(reason);
+            } finally {
+              release();
+            }
+          },
+        });
+        return new Response(body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers: response.headers,
+        });
+      }
+
+      // Windows-safe Bun#32111 shape: the client gets a native tee branch,
+      // never a JS ReadableStream with async pull(). The second branch is consumed only
+      // to observe completion. The request signal releases lifecycle ownership immediately
+      // when the client disconnects and cancels the observer branch.
+      const [clientBody, lifecycleBody] = response.body.tee();
+      const reader = lifecycleBody.getReader();
+      let chunks = 0;
+      let bytes = 0;
+      streamAbortListener = () => {
+        void Promise.allSettled([
+          reader.cancel(abort.signal.reason),
+          clientBody.cancel(abort.signal.reason),
+        ]).finally(release);
+      };
+      abort.signal.addEventListener("abort", streamAbortListener, { once: true });
+      void (async () => {
+        try {
+          for (;;) {
+            const chunk = await reader.read();
+            if (chunk.done) break;
+            chunks += 1;
+            bytes += chunk.value.byteLength;
+            // Consume eagerly so the lifecycle branch never backpressures the client branch.
+          }
+        } catch (error) {
+          if (!abort.signal.aborted) {
+            emitHttpStreamFailure(this.reportStreamFailure, streamFailureEvidence(
+              error,
+              id,
+              endpoint,
+              "windows_lifecycle",
+              platform,
+              chunks,
+              bytes,
+            ));
+          }
+          // Stream failure is delivered to the client branch; lifecycle cleanup stays best-effort.
+        } finally {
+          release();
+        }
+      })();
+      return new Response(clientBody, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+      });
+    } catch (error) {
+      release();
+      throw error;
+    }
+  }
+}
+
+type ChatGptWebAdapterFactory = (provider: CodexProviderConfig) => ProviderAdapter;
+
+export interface ResponseRequestOptions {
+  /** DEV and other in-process harnesses can keep continuation state in their own canonical store. */
+  rememberState?: boolean;
+  /** Observe the exact production adapter stream when invoking the handler in-process. */
+  onAdapterEvent?: (event: AdapterEvent) => void;
+  /** Bind the physical HTTP stream to the exact native Codex turn that owns it. */
+  onTurnIdentity?: (identity: NativeCodexTurnIdentity) => void;
+}
+
+export function routeChatGptWebRequest(parsed: CodexParsedRequest, config: AppConfig): ChatGptWebModelRoute {
+  const route = requireChatGptWebModelRoute(parsed.modelId, config);
+  parsed.modelId = route.backendModel;
+  // Zero Risk preserves a distinct backend identity. Its immutable Codex effort is only a
+  // protocol/catalog value; the manual adapter must never reinterpret it as a ChatGPT selection.
+  parsed.options.reasoning = route.interactionMode === "automatic"
+    ? route.adapterEffort
+    : route.codexEffort;
+  return route;
+}
+
+export async function modelsRequest(
+  req: Request,
+  config: AppConfig,
+  fetchUpstream?: NativeFetch,
+  contextOverride?: () => CodexModelContextOverride | undefined,
+): Promise<Response> {
+  let upstream: Response;
+  try {
+    upstream = await forwardNativeCodexRequest(req, "models", fetchUpstream);
+  } catch (error) {
+    return formatErrorResponse(502, "upstream_error", error instanceof Error ? error.message : String(error));
+  }
+  if (!upstream.ok) return upstream;
+  let catalog: Record<string, unknown>;
+  try {
+    catalog = augmentNativeModelCatalog(await upstream.json(), config, contextOverride?.());
+  } catch (error) {
+    return formatErrorResponse(502, "invalid_response_error", error instanceof Error ? error.message : String(error));
+  }
+  const body = JSON.stringify(catalog);
+  const headers = new Headers(upstream.headers);
+  headers.delete("content-encoding");
+  headers.delete("content-length");
+  headers.set("content-type", "application/json");
+  headers.set("etag", `W/\"${createHash("sha256").update(body).digest("base64url")}\"`);
+  return new Response(body, { status: upstream.status, statusText: upstream.statusText, headers });
+}
+
+export async function nativeSearchRequest(
+  req: Request,
+  fetchUpstream?: NativeFetch,
+): Promise<Response> {
+  try {
+    return await forwardNativeCodexRequest(req, "alpha/search", fetchUpstream);
+  } catch (error) {
+    return formatErrorResponse(502, "upstream_error", error instanceof Error ? error.message : String(error));
+  }
+}
+
+function toolBridgeMaps(parsed: CodexParsedRequest): {
+  toolNsMap: Map<string, { namespace: string; name: string }>;
+  freeformToolNames: Set<string>;
+  toolSearchToolNames: Set<string>;
+} {
+  const toolNsMap = new Map<string, { namespace: string; name: string }>();
+  const freeformToolNames = new Set<string>();
+  const toolSearchToolNames = new Set<string>();
+  for (const tool of parsed.context.tools ?? []) {
+    if (tool.namespace) toolNsMap.set(namespacedToolName(tool.namespace, tool.name), { namespace: tool.namespace, name: tool.name });
+    if (tool.freeform) freeformToolNames.add(tool.name);
+    if (tool.toolSearch) toolSearchToolNames.add(tool.name);
+  }
+  return { toolNsMap, freeformToolNames, toolSearchToolNames };
+}
+
+export async function responseRequest(
+  req: Request,
+  config: AppConfig,
+  adapterFactory: ChatGptWebAdapterFactory = createChatGptWebAdapter,
+  options: ResponseRequestOptions = {},
+): Promise<Response> {
+  const nativeRequest = req.clone();
+  let raw: unknown;
+  try {
+    raw = await readJsonRequestBody(req);
+  } catch (error) {
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      error instanceof Error ? error.message : "Request body must be valid JSON",
+    );
+  }
+  const requestedModel = raw && typeof raw === "object" && !Array.isArray(raw)
+    ? (raw as { model?: unknown }).model
+    : undefined;
+  try {
+    const identity = extractCodexTurnIdentityFromBody(raw);
+    if (identity.threadId && identity.turnId) {
+      options.onTurnIdentity?.({ threadId: identity.threadId, turnId: identity.turnId });
+    }
+  } catch (error) {
+    return formatErrorResponse(400, "invalid_request_error", error instanceof Error ? error.message : String(error));
+  }
+  if (typeof requestedModel === "string" && !isChatGptWebModelSlug(requestedModel)) {
+    try {
+      return await forwardNativeCodexRequest(nativeRequest, "responses", undefined, raw);
+    } catch (error) {
+      return formatErrorResponse(502, "upstream_error", error instanceof Error ? error.message : String(error));
+    }
+  }
+  const requestedPreviousResponseId = raw && typeof raw === "object" && !Array.isArray(raw)
+    ? (raw as { previous_response_id?: unknown }).previous_response_id
+    : undefined;
+  const expanded = expandPreviousResponseInput(raw);
+  let parsed: CodexParsedRequest;
+  let route: ChatGptWebModelRoute;
+  try {
+    parsed = parseRequest(expanded);
+    route = routeChatGptWebRequest(parsed, config);
+    const identity = extractChatGptTurnIdentity(parsed);
+    if (identity.threadId && identity.turnId) {
+      options.onTurnIdentity?.({ threadId: identity.threadId, turnId: identity.turnId });
+    }
+  } catch (error) {
+    return formatErrorResponse(400, "invalid_request_error", error instanceof Error ? error.message : String(error));
+  }
+  if (parsed._opaqueMultiAgentV2Payload) {
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      "ChatGPT Web cannot read this encrypted cross-backend subagent payload. "
+        + "Start a new Compatibility V1 task, or delegate from a Web model whose collaboration call uses the plaintext-delivery marker.",
+    );
+  }
+  if (typeof requestedPreviousResponseId === "string" && expanded === raw) {
+    return formatErrorResponse(
+      409,
+      "invalid_request_error",
+      "Local continuation state for previous_response_id is unavailable; refusing to run ChatGPT Web with partial Codex context. Compact the Codex task or start a new task before retrying.",
+    );
+  }
+
+  const compaction = parsed._compactionRequest === true;
+  if (compaction && route.backendModel === CHATGPT_WEB_LUNA_BACKEND_MODEL) {
+    return formatErrorResponse(
+      409,
+      "invalid_request_error",
+      "ChatGPT Web Luna uses a rolling checkpoint on every completed browser turn; separate Codex compaction is disabled for this route.",
+    );
+  }
+  if (compaction) {
+    // History compaction is a dedicated summarization turn. It must never bind the active Codex
+    // tool bridge or continue an in-flight MCP round; the returned summary becomes the next turn's
+    // replacement history through the Responses compaction contract.
+    delete parsed.context.tools;
+    delete parsed.options.toolChoice;
+    delete parsed.options.parallelToolCalls;
+    parsed.context.messages.push({ role: "user", content: COMPACT_PROMPT, timestamp: Date.now() });
+  }
+
+  const provider = providerConfig(config);
+  let traceId: string | undefined;
+  try {
+    traceId = chatGptWebTraceId(provider, parsed);
+  } catch (error) {
+    // A cancelled browser session can only exist after the adapter accepted canonical native
+    // turn identity and user-revision metadata. Requests without that identity have no matching
+    // trace tombstone; preserve the adapter's existing strict validation/error path below.
+    const message = error instanceof Error ? error.message : String(error);
+    if (message === CHATGPT_TURN_REVISION_CONFLICT_MESSAGE) {
+      // Codex can reopen an interrupted task with only refreshed developer/skill context under a
+      // new turn_id. Its last human prompt still belongs to the stopped turn and must not be
+      // replayed as new work. HTTP 400 makes that malformed recovery request terminal instead of
+      // allowing Codex to retry it as an upstream 502.
+      return formatErrorResponse(400, "invalid_request_error", message);
+    }
+    if (!message.includes("requires native Codex turn_id metadata")
+      && !message.includes("requires a current-turn user message")) throw error;
+  }
+  const cancelledError = traceId ? chatGptTurnSessions.cancelledError(traceId) : undefined;
+  if (cancelledError) {
+    // Codex retries unknown streamed response.failed codes. A replay after the user explicitly
+    // closed the only browser document is instead a terminal client state: repeating that exact
+    // request is invalid and must not recreate the DOM. Codex maps HTTP 400 to its non-retryable
+    // InvalidRequest category while the body preserves the real client_cancelled classification.
+    return new Response(JSON.stringify({
+      error: {
+        type: "client_closed_request",
+        code: "client_cancelled",
+        message: cancelledError.message,
+      },
+    }), {
+      status: 400,
+      headers: { "content-type": "application/json" },
+    });
+  }
+  const adapter = adapterFactory(provider);
+  const queue = new AsyncEventQueue<AdapterEvent>();
+  const abort = new AbortController();
+  if (req.signal.aborted) abort.abort();
+  else req.signal.addEventListener("abort", () => abort.abort(), { once: true });
+  const run = async () => {
+    try {
+      await adapter.runTurn!(parsed, { headers: req.headers, abortSignal: abort.signal }, event => {
+        options.onAdapterEvent?.(event);
+        queue.push(event);
+      });
+    } catch (error) {
+      const event: AdapterEvent = { type: "error", message: error instanceof Error ? error.message : String(error) };
+      options.onAdapterEvent?.(event);
+      queue.push(event);
+    } finally {
+      queue.close();
+    }
+  };
+  const maps = toolBridgeMaps(parsed);
+  const responseModel = route.slug;
+
+  if (parsed.stream) {
+    void run();
+    const stream = bridgeToResponsesSSE(
+      queue,
+      responseModel,
+      maps.toolNsMap,
+      maps.freeformToolNames,
+      maps.toolSearchToolNames,
+      () => abort.abort(),
+      2_000,
+      {
+        hideThinkingSummary: parsed.options.hideThinkingSummary,
+        ...(provider.chatgptWeb?.stallTimeoutSec !== undefined
+          ? { stallTimeoutSec: provider.chatgptWeb.stallTimeoutSec }
+          : {}),
+        ...(compaction ? { compaction: true } : {
+          ...(options.rememberState === false ? {} : {
+            onCompletedResponse: (response: Record<string, unknown>) => rememberResponseState(parsed._rawBody, response, { force: true }),
+          }),
+        }),
+      },
+    );
+    return new Response(stream, {
+      headers: {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        "Connection": "keep-alive",
+        "X-Accel-Buffering": "no",
+      },
+    });
+  }
+
+  await run();
+  const events = await queue.collect();
+  const json = buildResponseJSON(events, responseModel, {
+    hideThinkingSummary: parsed.options.hideThinkingSummary,
+    toolNsMap: maps.toolNsMap,
+    freeformToolNames: maps.freeformToolNames,
+    toolSearchToolNames: maps.toolSearchToolNames,
+    ...(compaction ? { compaction: true } : {}),
+  });
+  if (!compaction && options.rememberState !== false) {
+    rememberResponseState(parsed._rawBody, json, { force: true });
+  }
+  return Response.json(json);
+}
+
+export async function compactRequest(
+  req: Request,
+  config: AppConfig,
+  adapterFactory: ChatGptWebAdapterFactory = createChatGptWebAdapter,
+  options: Pick<ResponseRequestOptions, "onTurnIdentity"> = {},
+): Promise<Response> {
+  const nativeRequest = req.clone();
+  let raw: Record<string, unknown>;
+  try {
+    const parsed = await readJsonRequestBody(req);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("not an object");
+    raw = parsed as Record<string, unknown>;
+  } catch (error) {
+    return formatErrorResponse(
+      400,
+      "invalid_request_error",
+      error instanceof Error ? error.message : "Compaction request body must be a JSON object",
+    );
+  }
+  const headerTurnMetadata = req.headers.get("x-codex-turn-metadata");
+  if (headerTurnMetadata) {
+    const existingMetadata = raw.client_metadata;
+    const clientMetadata = existingMetadata && typeof existingMetadata === "object" && !Array.isArray(existingMetadata)
+      ? existingMetadata as Record<string, unknown>
+      : {};
+    raw = {
+      ...raw,
+      client_metadata: {
+        ...clientMetadata,
+        // `/responses/compact` carries native turn authority in this canonical Codex header,
+        // unlike ordinary `/responses` payloads where the same value also appears in the body.
+        "x-codex-turn-metadata": headerTurnMetadata,
+      },
+    };
+  }
+  try {
+    const identity = extractCodexTurnIdentityFromBody(raw);
+    if (identity.threadId && identity.turnId) {
+      options.onTurnIdentity?.({ threadId: identity.threadId, turnId: identity.turnId });
+    }
+  } catch (error) {
+    return formatErrorResponse(400, "invalid_request_error", error instanceof Error ? error.message : String(error));
+  }
+  if (typeof raw.model !== "string" || !raw.model) {
+    return formatErrorResponse(400, "invalid_request_error", "Compaction request requires a model");
+  }
+  if (!isChatGptWebModelSlug(raw.model)) {
+    try {
+      return await forwardNativeCodexRequest(nativeRequest, "responses/compact", undefined, raw);
+    } catch (error) {
+      return formatErrorResponse(502, "upstream_error", error instanceof Error ? error.message : String(error));
+    }
+  }
+  let route: ChatGptWebModelRoute;
+  try {
+    route = requireChatGptWebModelRoute(raw.model, config);
+  } catch (error) {
+    return formatErrorResponse(400, "invalid_request_error", error instanceof Error ? error.message : String(error));
+  }
+  if (route.backendModel === CHATGPT_WEB_LUNA_BACKEND_MODEL) {
+    return formatErrorResponse(
+      409,
+      "invalid_request_error",
+      "ChatGPT Web Luna uses a rolling checkpoint on every completed browser turn; separate Codex compaction is disabled for this route.",
+    );
+  }
+  const input = Array.isArray(raw.input) ? raw.input : [];
+  const headers = new Headers(req.headers);
+  headers.set("content-type", "application/json");
+  const internal = new Request("http://127.0.0.1/v1/responses", {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ ...raw, stream: false, input: [...input, { type: "compaction_trigger" }] }),
+    signal: req.signal,
+  });
+  const response = await responseRequest(internal, config, adapterFactory, options);
+  if (!response.ok) return response;
+  let body: {
+    output?: unknown[];
+    status?: unknown;
+    error?: { message?: unknown; type?: unknown; code?: unknown } | null;
+  };
+  try {
+    body = await response.json() as typeof body;
+  } catch {
+    return formatErrorResponse(502, "invalid_response_error", "Compaction turn returned invalid JSON");
+  }
+  if (body.error) {
+    const error = {
+      message: typeof body.error.message === "string" ? body.error.message : "Compaction turn failed",
+      type: typeof body.error.type === "string" ? body.error.type : "upstream_error",
+      code: typeof body.error.code === "string" ? body.error.code : null,
+    };
+    return Response.json(
+      { error },
+      { status: httpStatusFromTerminalError(error) },
+    );
+  }
+  if (body.status !== "completed") {
+    return formatErrorResponse(502, "upstream_error", `Compaction turn failed (status: ${String(body.status ?? "unknown")})`);
+  }
+  const items = (body.output ?? []).filter(
+    (item): item is { type: "compaction"; encrypted_content?: string } =>
+      Boolean(item && typeof item === "object" && (item as { type?: string }).type === "compaction"),
+  );
+  if (items.length !== 1) {
+    return formatErrorResponse(502, "invalid_response_error", `Compaction turn produced ${items.length} compaction items; expected one`);
+  }
+  const summary = typeof items[0]!.encrypted_content === "string"
+    ? decodeCompactionSummary(items[0]!.encrypted_content)
+    : null;
+  if (!summary?.trim()) {
+    return formatErrorResponse(502, "invalid_response_error", "Compaction turn produced an empty summary");
+  }
+  return Response.json({ output: buildCompactV1Output(extractCompactUserMessages(input), summary) });
+}
+
+function nodeReqToWebRequest(req: IncomingMessage, host: string, port: number): Request {
+  const url = `http://${req.headers.host || `${host}:${port}`}${req.url}`;
+  const method = req.method || "GET";
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (Array.isArray(value)) {
+      for (const v of value) headers.append(key, v);
+    } else if (typeof value === "string") {
+      headers.set(key, value);
+    }
+  }
+
+  const hasBody = method !== "GET" && method !== "HEAD";
+  const body = hasBody ? (Readable.toWeb(req) as unknown as ReadableStream<Uint8Array>) : null;
+
+  return new Request(url, {
+    method,
+    headers,
+    body,
+    // @ts-expect-error duplex required by node fetch for stream body
+    duplex: hasBody ? "half" : undefined,
+  });
+}
+
+async function sendWebResponse(webRes: Response, res: ServerResponse): Promise<void> {
+  res.statusCode = webRes.status;
+  res.statusMessage = webRes.statusText;
+  webRes.headers.forEach((val, key) => {
+    res.setHeader(key, val);
+  });
+
+  if (!webRes.body) {
+    res.end();
+    return;
+  }
+
+  const reader = webRes.body.getReader();
+  res.on("close", () => {
+    void reader.cancel().catch(() => {});
+  });
+
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      res.write(value);
+    }
+    res.end();
+  } catch (err) {
+    if (!res.writableEnded) {
+      res.destroy(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
+}
+
+export interface RunningServer {
+  port: number;
+  stop: (closeActiveConnections?: boolean) => Promise<void> | void;
+}
+
+export function startServer(
+  config: AppConfig,
+  dependencies: { fetchUpstream?: NativeFetch; adapterFactory?: ChatGptWebAdapterFactory } = {},
+): RunningServer {
+  if (config.purpose === "dev-harness") {
+    throw new Error("DEV harness configuration cannot start a Responses listener");
+  }
+  const startedAt = Date.now();
+  const turnBroker = config.mode === "full" ? TurnBroker.forSocket(config.brokerSocketPath) : undefined;
+  if (config.mode === "full") {
+    void turnBroker!.listen().catch(error => {
+      console.error(
+        `[chatgpt-web] turn broker endpoint is unavailable: ${error instanceof Error ? error.message : String(error)}`,
+      );
+    });
+  }
+  let draining = false;
+  let shutdownPromise: Promise<void> | undefined;
+  let successfulModelCatalogRequests = 0;
+  let lastSuccessfulModelCatalogRequestAt: string | null = null;
+  const httpTurns = new HttpTurnCounter();
+  const activity = () => ({
+    active_http_turns: httpTurns.count(),
+    active_browser_turns: chatGptTurnSessions.activeCount() + (turnBroker?.externalOwnerActiveCount() ?? 0),
+  });
+  const controlAuthorized = (req: Request): boolean => {
+    const header = req.headers.get("authorization") ?? "";
+    const expected = Buffer.from(`Bearer ${config.controlToken}`);
+    const actual = Buffer.from(header);
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+  };
+  const handleFetch = async (req: Request): Promise<Response> => {
+    const url = new URL(req.url);
+    if (req.method === "GET" && url.pathname === "/healthz") {
+      return Response.json({
+        status: "ok",
+        service: "dsh-chatgpt-web",
+        version: VERSION,
+        mode: config.mode,
+        pid: process.pid,
+        port: config.port,
+        uptime: (Date.now() - startedAt) / 1_000,
+        accepting_turns: !draining,
+        successful_model_catalog_requests: successfulModelCatalogRequests,
+        last_successful_model_catalog_request_at: lastSuccessfulModelCatalogRequestAt,
+        ...activity(),
+      });
+    }
+    if (req.method === "POST" && (url.pathname === "/admin/drain" || url.pathname === "/admin/resume")) {
+      if (!controlAuthorized(req)) return new Response("Unauthorized", { status: 401 });
+      draining = url.pathname === "/admin/drain";
+      turnBroker?.setExternalOwnersAccepted(!draining);
+      return Response.json({ status: "ok", accepting_turns: !draining, ...activity() });
+    }
+    if (req.method === "POST" && url.pathname === "/admin/cancel-turn") {
+      if (!controlAuthorized(req)) return new Response("Unauthorized", { status: 401 });
+      let traceId: string;
+      try {
+        const body = await req.json() as { traceId?: unknown };
+        traceId = typeof body?.traceId === "string" ? body.traceId : "";
+        if (!/^[A-Za-z0-9_-]{6,128}$/.test(traceId)) throw new Error("traceId is invalid");
+      } catch (error) {
+        return Response.json(
+          { status: "error", error: error instanceof Error ? error.message : String(error) },
+          { status: 400 },
+        );
+      }
+      const reason = chatGptBrowserTabClosedError();
+      // Revoke the owner first. This prevents a compaction callback that observes its retained
+      // source being cancelled below from starting a fresh fallback during operator shutdown.
+      const compactionCancellation = cancelStructuredCompactionTrace(traceId, reason);
+      const browserCancellation = chatGptTurnSessions.cancelTrace(traceId, reason);
+      const [cancelledBrowserTurns, cancelledCompactionRuns] = await Promise.all([
+        browserCancellation,
+        compactionCancellation,
+      ]);
+      const cancelledBrokerTurns = turnBroker?.revokeTrace(traceId, reason) ?? 0;
+      return Response.json({
+        status: "ok",
+        trace_id: traceId,
+        cancelled_browser_turns: cancelledBrowserTurns,
+        cancelled_broker_turns: cancelledBrokerTurns,
+        cancelled_compaction_runs: cancelledCompactionRuns,
+        ...activity(),
+      });
+    }
+    if (req.method === "POST" && url.pathname === "/admin/interrupt-turn") {
+      if (!controlAuthorized(req)) return new Response("Unauthorized", { status: 401 });
+      let identity: NativeCodexTurnIdentity;
+      try {
+        const body = await req.json() as { threadId?: unknown; turnId?: unknown };
+        const threadId = typeof body?.threadId === "string" ? body.threadId.trim() : "";
+        const turnId = typeof body?.turnId === "string" ? body.turnId.trim() : "";
+        if (!/^[A-Za-z0-9_-]{6,128}$/.test(threadId) || !/^[A-Za-z0-9_-]{6,128}$/.test(turnId)) {
+          throw new Error("native Codex threadId or turnId is invalid");
+        }
+        identity = { threadId, turnId };
+      } catch (error) {
+        return Response.json(
+          { status: "error", error: error instanceof Error ? error.message : String(error) },
+          { status: 400 },
+        );
+      }
+      const reason = new DOMException("Codex turn interrupted", "AbortError");
+      const browserCancellation = chatGptTurnSessions.cancelNativeTurn(
+        identity.threadId,
+        identity.turnId,
+        reason,
+      );
+      const compactionCancellation = cancelStructuredCompactionNativeTurn(
+        identity.threadId,
+        identity.turnId,
+        reason,
+      );
+      const httpCancellation = httpTurns.beginCancelTurn(identity, reason);
+      const settlement = Promise.allSettled([
+        browserCancellation.settlement,
+        compactionCancellation.settlement,
+        httpCancellation.settlement,
+      ]);
+      void settlement.then(results => {
+        for (const result of results) {
+          if (result.status === "rejected") {
+            console.error(
+              `[chatgpt-web] interrupted turn cleanup failed: ${result.reason instanceof Error ? result.reason.message : String(result.reason)}`,
+            );
+          }
+        }
+      });
+      return Response.json({
+        status: "ok",
+        cancelled_http_turns: httpCancellation.cancelled,
+        cancelled_browser_turns: browserCancellation.cancelled,
+        cancelled_compaction_runs: compactionCancellation.cancelled,
+      });
+    }
+    if (req.method === "POST" && url.pathname === "/admin/cancel-turns") {
+      if (!controlAuthorized(req)) return new Response("Unauthorized", { status: 401 });
+      const reason = new Error("Active turn cancelled by launcher");
+      // Abort shared compaction owners before clearing their retained source sessions. The
+      // owner signal is the only cancellation boundary for a fresh fallback not in the session
+      // registry.
+      const compactionCancellation = cancelAllStructuredCompactions(reason);
+      const cancelledBrowserTurns = chatGptTurnSessions.clear() + (turnBroker?.revokeExternalOwners() ?? 0);
+      const [cancelledHttpTurns, cancelledCompactionRuns] = await Promise.all([
+        httpTurns.cancelAll(reason),
+        compactionCancellation,
+      ]);
+      return Response.json({
+        status: "ok",
+        cancelled_http_turns: cancelledHttpTurns,
+        cancelled_browser_turns: cancelledBrowserTurns,
+        cancelled_compaction_runs: cancelledCompactionRuns,
+        ...activity(),
+      });
+    }
+    if (req.method === "POST" && url.pathname === "/admin/shutdown") {
+      if (!controlAuthorized(req)) return new Response("Unauthorized", { status: 401 });
+      const current = activity();
+      if (!draining || current.active_http_turns > 0 || current.active_browser_turns > 0) {
+        return Response.json(
+          {
+            status: "refused",
+            accepting_turns: !draining,
+            ...current,
+          },
+          { status: 409 },
+        );
+      }
+      setTimeout(shutdown, 0);
+      return Response.json({ status: "ok", accepting_turns: false, ...current });
+    }
+    if (req.method === "GET" && url.pathname === "/v1/models") {
+      if (draining) {
+        return formatErrorResponse(
+          503,
+          "server_error",
+          "dsh-chatgpt-web is draining for a requested service operation",
+        );
+      }
+      return httpTurns.track(async signal => {
+        let catalogConfig: AppConfig;
+        try {
+          catalogConfig = {
+            ...config,
+            subagentProtocol: readCodexSubagentProtocol(config.subagentProtocol),
+          };
+        } catch (error) {
+          return formatErrorResponse(
+            500,
+            "server_error",
+            `Could not resolve the installed subagent protocol: ${error instanceof Error ? error.message : String(error)}`,
+          );
+        }
+        const response = await modelsRequest(
+          new Request(req, { signal }),
+          catalogConfig,
+          dependencies.fetchUpstream,
+          readCodexModelContextOverride,
+        );
+        if (response.ok) {
+          successfulModelCatalogRequests += 1;
+          lastSuccessfulModelCatalogRequestAt = new Date().toISOString();
+        }
+        return response;
+      }, req.signal, process.platform, "models");
+    }
+    if (req.method === "GET" && url.pathname === "/v1/responses") {
+      return new Response("Responses WebSocket transport is not enabled on this local route", {
+        status: 426,
+        headers: { "content-type": "text/plain; charset=utf-8" },
+      });
+    }
+    if (req.method === "POST" && url.pathname === "/v1/responses") {
+      if (draining) return formatErrorResponse(503, "server_error", "dsh-chatgpt-web is draining for a requested service operation");
+      return httpTurns.track(
+        (signal, bindIdentity) => responseRequest(
+          new Request(req, { signal }),
+          config,
+          dependencies.adapterFactory,
+          { onTurnIdentity: bindIdentity },
+        ),
+        req.signal,
+        process.platform,
+        "responses",
+      );
+    }
+    if (req.method === "POST" && url.pathname === "/v1/responses/compact") {
+      if (draining) return formatErrorResponse(503, "server_error", "dsh-chatgpt-web is draining for a requested service operation");
+      return httpTurns.track(
+        (signal, bindIdentity) => compactRequest(
+          new Request(req, { signal }),
+          config,
+          dependencies.adapterFactory,
+          { onTurnIdentity: bindIdentity },
+        ),
+        req.signal,
+        process.platform,
+        "compact",
+      );
+    }
+    if (req.method === "POST" && url.pathname === "/v1/alpha/search") {
+      if (draining) return formatErrorResponse(503, "server_error", "dsh-chatgpt-web is draining for a requested service operation");
+      return httpTurns.track(
+        signal => nativeSearchRequest(new Request(req, { signal }), dependencies.fetchUpstream),
+        req.signal,
+        process.platform,
+        "search",
+      );
+    }
+    return new Response("Not found", { status: 404 });
+  };
+
+  let server: RunningServer;
+  if (typeof Bun !== "undefined" && typeof Bun.serve === "function") {
+    const bunServer = Bun.serve({
+      hostname: config.host,
+      port: config.port,
+      idleTimeout: 0,
+      fetch: handleFetch,
+    });
+    server = {
+      port: bunServer.port ?? config.port,
+      stop: async (force) => {
+        await bunServer.stop(force);
+      },
+    };
+  } else {
+    const nodeServer = createServer(async (req, res) => {
+      try {
+        const webReq = nodeReqToWebRequest(req, config.host, config.port);
+        const webRes = await handleFetch(webReq);
+        await sendWebResponse(webRes, res);
+      } catch (err) {
+        if (!res.headersSent) {
+          res.statusCode = 500;
+          res.end(JSON.stringify({ error: err instanceof Error ? err.message : String(err) }));
+        }
+      }
+    });
+    nodeServer.listen(config.port, config.host);
+    server = {
+      port: config.port,
+      stop: () => new Promise<void>((resolve) => nodeServer.close(() => resolve())),
+    };
+  }
+
+  function shutdown(): void {
+    if (shutdownPromise) return;
+    draining = true;
+    chatGptTurnSessions.clear();
+    flushResponseState();
+    shutdownPromise = (async () => {
+      const results = await Promise.allSettled([
+        closeChatGptBrowserWorkers(),
+        closeTurnBrokers(),
+      ]);
+      const failures = results
+        .filter((result): result is PromiseRejectedResult => result.status === "rejected")
+        .map(result => result.reason);
+      if (failures.length > 0) {
+        process.exitCode = 1;
+        for (const failure of failures) {
+          console.error(`[dsh-chatgpt-web] shutdown cleanup failed: ${failure instanceof Error ? failure.message : String(failure)}`);
+        }
+      }
+      await server.stop(true);
+    })().catch(error => {
+      process.exitCode = 1;
+      console.error(`[dsh-chatgpt-web] server shutdown failed: ${error instanceof Error ? error.message : String(error)}`);
+    });
+  }
+  process.once("SIGINT", shutdown);
+  process.once("SIGTERM", shutdown);
+  return server;
+}