auto-model-router 0.2.24 → 0.2.26

package/CLAUDE.md

@@ -141,4 +141,4 @@ A URL + token is enough to enable it; `GET /health` on the router confirms.
   guard, and `USER_VERSION` is bumped. `test/trust-attribution.test.ts` asserts the version.
 - **bun:sqlite named params must be written `$name`** in the bind object. Bare keys bind
   nothing and every column silently lands NULL.
-- Verify with `bunx tsc --noEmit` and `bun test` (406+ tests) before declaring done.
+- Verify with `bun run typecheck` (covers src, test, omp-extension, tools — the extension and tools dirs were UNCHECKED until tsconfig.all.json, which is how two port bugs shipped) and `bun test` (483 tests) before declaring done.

package/omp-extension/embed-logic.ts

@@ -80,22 +80,15 @@ export function deriveAgentdoxScope(cwd: string): string {
 }
 
 /**
- * Resolves the port the embedded router should serve on, in precedence order:
- * an explicit `AUTO_MODEL_ROUTER_PORT`, else the configured `server.port`, else
- * 0 (let the OS pick a free one).
+ * Resolves the desired bind port: an explicit `AUTO_MODEL_ROUTER_PORT` when set
+ * and valid, else 0 so the OS assigns a free ephemeral port.
  *
- * A STABLE port is what keeps omp's model resolution honest. omp resolves
- * `modelRoles.default` from `models.yml` during startup — BEFORE extensions
- * load, so before this session can bind and rewrite that file. With an
- * ephemeral port the block names the PREVIOUS session's port, which is dead
- * once that session exits, and every main-agent turn fails with "Unable to
- * connect" while utility calls (resolved later, from the live registration)
- * still work. A deterministic port makes the pre-bind block correct by
- * construction. Sessions sharing that port share one router, which is already
- * how subagents behave.
- *
- * `0` is still honoured when asked for explicitly, and remains the fallback
- * when the desired port is occupied by something that is not our router.
+ * Ephemeral is the DEFAULT ON PURPOSE: each interactive omp session gets its
+ * OWN router process, so sessions cannot interfere with one another and no
+ * session depends on another staying alive. `configuredPort` is honoured only
+ * when a deployment asks for a fixed port explicitly (env var, or `server.port`
+ * passed in by a caller that wants it), which is the shared/always-on shape
+ * `serve` uses for other harnesses.
  */
 export function resolveEmbedPort(envPort: string | undefined, configuredPort = 0): number {
 	if (envPort !== undefined && envPort !== "") {

package/omp-extension/pi-coding-agent.d.ts

@@ -0,0 +1,76 @@
+/**
+ * LOCAL ambient stub for omp's extension API — not the vendor's types.
+ *
+ * `@oh-my-pi/pi-coding-agent` is injected by the omp process at runtime and is
+ * not an installed dependency, so without this declaration every extension file
+ * fails to resolve it, TS gives up, and the whole `omp-extension/` directory
+ * goes unchecked. That gap was not theoretical: two user-visible port bugs
+ * shipped from these files while `tsconfig.json` only included `src` and `test`.
+ *
+ * Deliberately minimal — it declares the surface these extensions actually use.
+ * It buys checking of OUR logic (control flow, ports, async, config shapes), not
+ * validation against omp's real signatures; treat a change here as a claim about
+ * omp's API that only a live session can confirm.
+ */
+declare module "@oh-my-pi/pi-coding-agent" {
+	export interface ProviderModelCost {
+		input: number;
+		output: number;
+		cacheRead?: number;
+		cacheWrite?: number;
+	}
+
+	export interface ProviderModel {
+		id: string;
+		name: string;
+		api: string;
+		reasoning?: boolean;
+		input?: string[];
+		contextWindow?: number;
+		maxTokens?: number;
+		cost?: ProviderModelCost;
+	}
+
+	export interface ProviderRegistration {
+		baseUrl: string;
+		api: string;
+		apiKey?: string;
+		headers?: Record<string, string>;
+		models: ProviderModel[];
+	}
+
+	export interface SessionManager {
+		getSessionId(): string;
+	}
+
+	/** Mirrors `ConfigUi` in configure-logic.ts, which is what /router drives. */
+	export interface ExtensionUI {
+		select(title: string, options: string[], selected?: number): Promise<string | undefined>;
+		input(title: string, placeholder?: string, initial?: string): Promise<string | undefined>;
+		confirm(title: string, message: string): Promise<boolean>;
+		notify(text: string, level?: "info" | "warn" | "error"): void;
+	}
+
+	export interface ExtensionContext {
+		/** False for subagents and headless (`-p`) runs: the discriminator the embed extension keys on. */
+		hasUI: boolean;
+		sessionManager: SessionManager;
+		ui: ExtensionUI;
+		/** Interval whose errors omp isolates, and whose handle `clearTimer` cancels. */
+		setInterval(handler: () => void | Promise<void>, ms: number): unknown;
+		clearTimer(timer: unknown): void;
+	}
+
+	export interface CommandDefinition {
+		description: string;
+		handler(args: string, ctx: ExtensionContext): void | Promise<void>;
+	}
+
+	export interface ExtensionAPI {
+		setLabel(label: string): void;
+		on(event: string, handler: (event: unknown, ctx: ExtensionContext) => void | Promise<void>): void;
+		registerProvider(id: string, registration: ProviderRegistration): void;
+		unregisterProvider(id: string): void;
+		registerCommand(name: string, command: CommandDefinition): void;
+	}
+}

package/omp-extension/router-embed.ts

@@ -19,7 +19,7 @@
  *     - /path/to/auto-model-router/omp-extension/router-toast.ts
  */
 
-import { readFileSync } from "node:fs";
+import { appendFileSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -52,6 +52,39 @@ function readModelsYml(): string {
 	}
 }
 
+/**
+ * Appends one line to `$AUTO_MODEL_ROUTER_HOME/embed.log`.
+ *
+ * A FILE, deliberately: `console.*` from an extension does not reach omp's
+ * session log, so the first attempt at this diagnostic left no trace anywhere
+ * and the port lifecycle had to be reconstructed from netstat and mtimes. Best
+ * effort — a logging failure must never break a session.
+ */
+function writeEmbedLog(line: string): void {
+	try {
+		appendFileSync(join(routerHome(), "embed.log"), `${new Date().toISOString()} ${line}\n`, "utf8");
+	} catch {
+		// Unwritable home: the router still works, we just lose the breadcrumb.
+	}
+}
+
+/**
+ * Stops the router when the PROCESS ends — never when a session does.
+ * Idempotent: registered once, however many sessions this process hosts.
+ */
+let exitHooked = false;
+function trackProcessExit(): void {
+	if (exitHooked) return;
+	exitHooked = true;
+	// `exit` cannot await, and does not need to: the OS reclaims the socket.
+	// The signal hooks exist so a Ctrl-C releases the port promptly.
+	for (const signal of ["SIGINT", "SIGTERM"] as const) {
+		process.once(signal, () => {
+			void app?.stop().catch(() => {});
+		});
+	}
+}
+
 /**
  * Registers the auto-model-router provider (and its virtual models) into omp's model
  * registry at a specific bound port.
@@ -94,28 +127,54 @@ function registerRouterProvider(pi: ExtensionAPI, port: number, cfg: RouterConfi
 	});
 }
 
+/**
+ * The router bound by THIS PROCESS, and the port it serves.
+ *
+ * Module scope on purpose: Bun caches the module per process, so when omp loads
+ * the extension into a second host (its provider-refresh / reload path does
+ * exactly that) these stay visible. A second host then REUSES this router
+ * instead of binding another port and orphaning every model handle omp already
+ * resolved against the first one.
+ */
+let app: StartedServer | null = null;
+let boundPort: number | null = null;
+
+/** `$AUTO_MODEL_ROUTER_HOME`, tilde-expanded, defaulting to ~/.auto-model-router. */
+function routerHome(): string {
+	const raw = process.env.AUTO_MODEL_ROUTER_HOME ?? join(homedir(), ".auto-model-router");
+	return raw === "~" || raw.startsWith("~/") || raw.startsWith("~\\") ? join(homedir(), raw.slice(1)) : raw;
+}
+
 export default function (pi: ExtensionAPI): void {
 	pi.setLabel("auto-model-router embed");
 
 	// Shared port file, written only by the main session's router.
-	const homeRaw = process.env.AUTO_MODEL_ROUTER_HOME ?? join(homedir(), ".auto-model-router");
-	const home =
-		homeRaw === "~" || homeRaw.startsWith("~/") || homeRaw.startsWith("~\\")
-			? join(homedir(), homeRaw.slice(1))
-			: homeRaw;
-	const portFile = embedPortPath(home);
-	// Load first WITHOUT a port override so `server.port` from config.yml is
-	// visible, then let it (or the env var) decide the bind port.
-	const cfg = loadConfig({ overrides: { server: { host: "127.0.0.1" } } });
-	const requestedPort = resolveEmbedPort(process.env.AUTO_MODEL_ROUTER_PORT, cfg.server.port);
-	cfg.server.port = requestedPort;
-
-	let app: StartedServer | null = null;
+	const portFile = embedPortPath(routerHome());
+	// Each interactive session binds its OWN router on an ephemeral port, so
+	// sessions stay independent: no shared process to contend over, and no
+	// session left broken because another one exited. `server.port` from
+	// config.yml is deliberately NOT used here — that port belongs to the
+	// standalone `serve` daemon, which may legitimately be running alongside.
+	// Set AUTO_MODEL_ROUTER_PORT to pin a fixed port on purpose.
+	const requestedPort = resolveEmbedPort(process.env.AUTO_MODEL_ROUTER_PORT);
+	const cfg = loadConfig({ overrides: { server: { host: "127.0.0.1", port: requestedPort } } });
 
 	pi.on("session_start", async (_event, ctx) => {
 		// The omp UI session id tags every request so the toast can scope its
 		// notifications to that exact session (see router-toast.ts).
 		const sessionId = ctx.sessionManager.getSessionId();
+
+		// This module is cached per PROCESS, so `app` and `boundPort` are
+		// process-global even when omp loads the extension into more than one
+		// host. A router already bound in this process is therefore reusable:
+		// re-register it for the new session id and return. Never rebind — a
+		// second bind would take a different port and orphan every model handle
+		// omp already resolved against the first one.
+		if (app !== null && boundPort !== null) {
+			registerRouterProvider(pi, boundPort, cfg, sessionId);
+			return;
+		}
+
 		if (!ctx.hasUI) {
 			// Subagents and headless (-p) sessions prefer the main session's
 			// shared router: one process, one ledger, one place to inspect.
@@ -133,23 +192,19 @@ export default function (pi: ExtensionAPI): void {
 			const started = startServer(cfg);
 			if (started.server.port === undefined) return;
 			app = started;
-			registerRouterProvider(pi, started.server.port, cfg, sessionId);
-			pi.on("session_shutdown", () => {
-				void app?.stop().catch(() => {});
-				app = null;
-			});
+			boundPort = started.server.port;
+			registerRouterProvider(pi, boundPort, cfg, sessionId);
 			return;
 		}
 
-		// Main interactive session. The port is deterministic (see
-		// resolveEmbedPort), which matters because omp resolves
-		// `modelRoles.default` from models.yml BEFORE this extension loads: the
-		// URL that block names must be one this session will actually serve.
-		if (app) return;
+		// Main interactive session: bind this session's OWN router, then register
+		// the provider against the exact bound port. Registration happens only
+		// here — never at factory load, where a stale shared port would be
+		// captured into omp's model registry and defeat the correct bound URL.
 
-		// Another live session already serving this port? Share it rather than
-		// fighting over the socket — subagents already share one router, and the
-		// ledger and DB are shared regardless.
+		// A fixed port was asked for (env var) and a live router already answers
+		// there: share it rather than failing to bind. Ephemeral ports — the
+		// default — never take this path, so sessions stay independent.
 		if (requestedPort !== 0 && (await probeEmbed(requestedPort))) {
 			writeEmbedPort(portFile, requestedPort);
 			syncModelsYml(cfg, requestedPort);
@@ -158,10 +213,9 @@ export default function (pi: ExtensionAPI): void {
 			return;
 		}
 
-		// Bind the desired port; if something that is NOT our router holds it,
-		// fall back to an ephemeral port rather than leaving the session with no
-		// provider at all. models.yml is rewritten either way, so headless runs
-		// and subagents still resolve.
+		// Bind. If a FIXED port was requested and something else holds it, fall
+		// back to an ephemeral one rather than leaving this session with no
+		// provider at all. An ephemeral request that fails is a real error.
 		let started: StartedServer;
 		try {
 			started = startServer(cfg);
@@ -173,39 +227,41 @@ export default function (pi: ExtensionAPI): void {
 		const actualPort = started.server.port;
 		if (actualPort === undefined) return;
 		app = started;
+		boundPort = actualPort;
 
-		// Publish the shared port; subagents and the toast read it from here.
+		// Publish the port; subagents and the toast read it from here.
 		writeEmbedPort(portFile, actualPort);
 
-		// What omp resolved `modelRoles.default` against at STARTUP, before this
-		// extension loaded. If it names a different port than we serve, this
-		// session's main-model handle points at a socket we are not listening on
-		// and every real turn fails with "Unable to connect" while utility calls
-		// (resolved later, from the registration below) still work. Nothing here
-		// can rebuild that handle, so say so plainly instead of leaving the user
-		// to diagnose it.
-		const advertised = modelsYmlPort(readModelsYml());
-		if (advertised !== null && advertised !== actualPort) {
-			pi.setLabel(`auto-model-router: RESTART NEEDED — omp resolved :${advertised}, router serves :${actualPort}`);
-			console.warn(
-				`[auto-model-router] models.yml advertised port ${advertised} at startup but this router serves ${actualPort}. ` +
-					`omp resolves the default model before extensions load, so this session's main model still points at ${advertised}. ` +
-					`models.yml has been corrected — restart omp once and it will be right.`,
-			);
-		}
-
 		// Keep models.yml pointing at this port. Headless runs (`-p`) and
 		// subagent processes resolve models from models.yml in a FRESH registry
 		// — extension registration does not reach them — so without this they
 		// fail with "Model not found" when no interactive session is live
 		// (the print-mode gap the external benchmark hit).
+		const advertised = modelsYmlPort(readModelsYml());
 		const syncAction = syncModelsYml(cfg, actualPort);
-		if (syncAction !== null && advertised === actualPort) pi.setLabel(`auto-model-router embed (models.yml ${syncAction})`);
+
+		// Register BEFORE any await: everything omp resolves after this point
+		// picks up the live URL, so the registration must not sit behind I/O.
 		registerRouterProvider(pi, actualPort, cfg, sessionId);
+		pi.setLabel(`auto-model-router embed :${actualPort}${syncAction === null ? "" : ` (models.yml ${syncAction})`}`);
 
-		pi.on("session_shutdown", () => {
-			void app?.stop().catch(() => {});
-			app = null;
-		});
+		// NO `session_shutdown` teardown. That event is emitted from session
+		// DISPOSAL — including omp's provider-refresh / extension-reload path,
+		// which runs in a throwaway extension host while the real session keeps
+		// going. Because this module is cached per process, such a handler stops
+		// the LIVE router: every subsequent turn then fails with Bun's
+		// "Unable to connect", while utility calls that resolve after a later
+		// rebind still work — the exact asymmetry observed in the field. The
+		// router's lifetime is the PROCESS, and the OS reclaims the socket when
+		// the process exits.
+		trackProcessExit();
+
+		writeEmbedLog(
+			`embed ready pid=${process.pid} port=${actualPort}` +
+				` models.yml-advertised=${advertised ?? "none"}` +
+				` sync=${syncAction ?? "current"}` +
+				` self-probe=${(await probeEmbed(actualPort)) ? "ok" : "FAILED"}` +
+				` session=${sessionId}`,
+		);
 	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-model-router",
-  "version": "0.2.24",
+  "version": "0.2.26",
   "private": false,
   "description": "Local cost/complexity-aware model router for Oh My Pi, backed by OpenRouter",
   "type": "module",
@@ -8,7 +8,8 @@
     "auto-model-router": "./src/index.ts"
   },
   "scripts": {
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit --project tsconfig.all.json",
+    "typecheck:src": "tsc --noEmit",
     "test": "bun test",
     "smoke": "bun run tools/smoke.ts",
     "version": "bun run tools/sync-marketplace-version.ts",

package/src/config/defaults.ts

@@ -11,6 +11,10 @@ export const DEFAULT_CONFIG: RouterConfig = {
 	server: {
 		host: "127.0.0.1",
 		port: 8788,
+		// One router process serves every omp session on this machine (the port
+		// is deterministic, so peers reuse it), so this covers N sessions plus
+		// their subagents. Was effectively 8 per session when each bound its own.
+		maxConcurrentTurns: 24,
 	},
 	openrouter: {
 		baseUrl: "https://openrouter.ai/api/v1",

package/src/config/load.ts

@@ -40,6 +40,20 @@ export function deepMerge(base: RouterConfig, override: unknown): RouterConfig {
 	return mergeValue(base, override) as RouterConfig;
 }
 
+/**
+ * Recursive partial: `loadConfig` merges overrides key by key, so a caller may
+ * legitimately supply just `{ server: { host } }`. Typing the parameter as a
+ * flat `Partial<RouterConfig>` demanded a COMPLETE `ServerConfig` for that,
+ * which made honest call sites (the omp extension, the smoke tools) type
+ * errors — invisible ones, since those directories were outside the
+ * typechecked project until `tsconfig.all.json`.
+ */
+export type DeepPartial<T> = T extends readonly unknown[] | Date | RegExp
+	? T
+	: T extends object
+		? { [K in keyof T]?: DeepPartial<T[K]> }
+		: T;
+
 /**
  * Resolves the effective configuration:
  *   DEFAULT_CONFIG
@@ -52,7 +66,7 @@ export function deepMerge(base: RouterConfig, override: unknown): RouterConfig {
  * config work keyless; an embedded router warns at startup and completions
  * fail at dispatch time.
  */
-export function loadConfig(opts?: { path?: string; overrides?: Partial<RouterConfig> }): RouterConfig {
+export function loadConfig(opts?: { path?: string; overrides?: DeepPartial<RouterConfig> }): RouterConfig {
 	const home = resolveTilde(process.env.AUTO_MODEL_ROUTER_HOME ?? "~/.auto-model-router");
 
 	// Config file, when present.

package/src/config/schema.ts

@@ -20,6 +20,7 @@ const server = z.strictObject({
 	port: z.number().int().min(0).max(65_535).optional(),
 	apiKey: z.string().optional(),
 	harnessId: z.string().optional(),
+	maxConcurrentTurns: z.number().int().positive().max(1_000).optional(),
 });
 
 const openrouter = z.strictObject({

package/src/config/types.ts

@@ -38,6 +38,14 @@ export interface ServerConfig {
 	 * ⇒ no header (single-harness default).
 	 */
 	harnessId?: string;
+	/**
+	 * Concurrent in-flight turns this router process will accept; excess gets a
+	 * 429 rather than being queued, so a local flood cannot pile up unbounded
+	 * upstream spend. The budget is per PROCESS, and one process now serves
+	 * every omp session on the machine, so it must cover all live sessions plus
+	 * their subagents.
+	 */
+	maxConcurrentTurns: number;
 }
 
 export interface OpenRouterConfig {

package/src/server/http.ts

@@ -247,7 +247,13 @@ export function startServer(cfg: RouterConfig): StartedServer {
 	// upstream streams at once (each can run up to idleTimeout). Excess requests
 	// are rejected with 429 rather than queued, so a local flood cannot pile up
 	// unbounded upstream spend or memory.
-	const MAX_CONCURRENT_TURNS = 8;
+	//
+	// This budget is per ROUTER PROCESS, and since v0.2.23 one process serves
+	// every omp session on the machine (the port is deterministic, so peers
+	// reuse it). It therefore has to cover N interactive sessions plus their
+	// subagents, not one session — hence configurable, and defaulted higher
+	// than the 8 that used to be private to a single session.
+	const MAX_CONCURRENT_TURNS = cfg.server.maxConcurrentTurns;
 	let inFlightTurns = 0;
 	const acquireTurn = (): boolean => {
 		if (inFlightTurns >= MAX_CONCURRENT_TURNS) return false;

package/test/config.test.ts

@@ -96,7 +96,7 @@ describe("loadConfig", () => {
 
 	test("explicit overrides beat the environment", () => {
 		setEnv("AUTO_MODEL_ROUTER_PORT", "9999");
-		const cfg = loadConfig({ overrides: { server: { host: "127.0.0.1", port: 7777 } } });
+		const cfg = loadConfig({ overrides: { server: { host: "127.0.0.1", port: 7777, maxConcurrentTurns: 24 } } });
 		expect(cfg.server.port).toBe(7777);
 	});
 

package/test/embed-lifecycle.test.ts

@@ -0,0 +1,119 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import type { ExtensionAPI, ExtensionContext, ProviderRegistration } from "@oh-my-pi/pi-coding-agent";
+
+/**
+ * The embedded router's lifetime is the PROCESS, not a session.
+ *
+ * omp emits `session_shutdown` from session DISPOSAL, and disposal includes its
+ * provider-refresh / extension-reload path — which runs in a throwaway
+ * extension host while the real session keeps going. This module is cached per
+ * process, so tearing the router down in that handler stopped the LIVE router.
+ * Every later turn then failed with Bun's "Unable to connect", while utility
+ * calls resolved after a subsequent rebind still worked: exactly the asymmetry
+ * seen in the field, where only `toolCount: 0` dispatches reached the ledger and
+ * the port named in `embed.port` answered nothing.
+ *
+ * One boot shared by every test here, deliberately: the extension module is
+ * cached per process in production too, so this is the real shape.
+ */
+
+const handlers = new Map<string, ((event: unknown, ctx: ExtensionContext) => void | Promise<void>)[]>();
+const registrations: { id: string; baseUrl: string }[] = [];
+
+const pi: ExtensionAPI = {
+	setLabel: () => {},
+	on: (event, handler) => {
+		const list = handlers.get(event) ?? [];
+		list.push(handler);
+		handlers.set(event, list);
+	},
+	registerProvider: (id: string, registration: ProviderRegistration) => {
+		registrations.push({ id, baseUrl: registration.baseUrl });
+	},
+	unregisterProvider: () => {},
+	registerCommand: () => {},
+};
+
+async function fire(event: string, sessionId: string): Promise<void> {
+	const ctx = { hasUI: true, sessionManager: { getSessionId: () => sessionId } } as ExtensionContext;
+	for (const handler of handlers.get(event) ?? []) await handler({ type: event }, ctx);
+}
+
+/** Health-probes the router; used to assert the socket's state, not to wait. */
+async function alive(port: number): Promise<boolean> {
+	try {
+		const res = await fetch(`http://127.0.0.1:${port}/health`, { signal: AbortSignal.timeout(2_000) });
+		return res.ok;
+	} catch {
+		return false;
+	}
+}
+
+let home = "";
+let port = 0;
+
+beforeAll(async () => {
+	home = mkdtempSync(join(tmpdir(), "embed-life-"));
+	process.env.AUTO_MODEL_ROUTER_HOME = home;
+	process.env.AUTO_MODEL_ROUTER_DB = join(home, "router.db");
+	const mod = (await import("../omp-extension/router-embed.ts")) as { default: (api: ExtensionAPI) => void };
+	mod.default(pi);
+	await fire("session_start", "session-one");
+	port = Number.parseInt(/:(\d+)\//.exec(registrations.at(-1)?.baseUrl ?? "")?.[1] ?? "0", 10);
+});
+
+afterAll(async () => {
+	// Release the socket the way the extension intends: on process signals.
+	process.emit("SIGTERM");
+	// Poll the real condition rather than guessing a duration; each fetch
+	// attempt yields, so this settles as soon as the socket is actually closed.
+	for (let i = 0; i < 50 && (await alive(port)); i++) {
+		/* keep probing until the port stops answering */
+	}
+	// A still-open SQLite handle can hold the file on Windows; the temp dir is
+	// disposable either way.
+	try {
+		rmSync(home, { recursive: true, force: true });
+	} catch {
+		/* leave it to the OS temp reaper */
+	}
+});
+
+describe("embedded router lifetime", () => {
+	test("binds a router and registers it for the session", () => {
+		expect(port).toBeGreaterThan(0);
+		expect(registrations.at(-1)?.id).toBe("auto-model-router");
+	});
+
+	test("the router answers on the port it registered", async () => {
+		expect(await alive(port)).toBe(true);
+	});
+
+	test("registers NO session_shutdown teardown", () => {
+		// omp fires this from a throwaway host during provider refresh, so a
+		// teardown here kills a router the live session is still using.
+		expect(handlers.get("session_shutdown") ?? []).toHaveLength(0);
+	});
+
+	test("a session_shutdown leaves the router running", async () => {
+		await fire("session_shutdown", "session-one");
+		expect(await alive(port)).toBe(true);
+	});
+
+	test("a second session reuses the same port instead of rebinding", async () => {
+		// Rebinding would take a different port and orphan every model handle omp
+		// had already resolved against the first one.
+		await fire("session_start", "session-two");
+		const latest = Number.parseInt(/:(\d+)\//.exec(registrations.at(-1)?.baseUrl ?? "")?.[1] ?? "0", 10);
+		expect(latest).toBe(port);
+		expect(await alive(port)).toBe(true);
+	});
+
+	test("each session still gets its own registration, so per-session tagging survives reuse", () => {
+		expect(registrations.length).toBeGreaterThanOrEqual(2);
+	});
+});

package/test/failover.test.ts

@@ -28,7 +28,7 @@ import type {
 
 function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 	return {
-		server: { host: "127.0.0.1", port: 8787 },
+		server: { host: "127.0.0.1", port: 8787, maxConcurrentTurns: 24 },
 		openrouter: { baseUrl: "https://openrouter.ai/api/v1", apiKey: "", title: "test", timeoutMs: 30_000, catalogTtlMs: 3_600_000, catalogRefreshMs: 0 },
 		benchmarks: { enabled: false, artificialAnalysisApiKey: "", benchlm: true, refreshMs: 86_400_000, timeoutMs: 30_000, useLocalScores: false },
 		tiers: {

package/test/http-resilience.test.ts

@@ -10,7 +10,7 @@ describe("HTTP server resilience against dead streams", () => {
 	beforeAll(() => {
 		const cfg: RouterConfig = {
 			...DEFAULT_CONFIG,
-			server: { host: "127.0.0.1", port: 0 },
+			server: { host: "127.0.0.1", port: 0, maxConcurrentTurns: 24 },
 			ledger: { ...DEFAULT_CONFIG.ledger, path: ":memory:" },
 			context: { ...DEFAULT_CONFIG.context, enabled: false },
 			logLevel: "silent",

package/test/turn.test.ts

@@ -29,7 +29,7 @@ import type {
 
 function mkConfig(escalation: Partial<EscalationConfig> = {}): RouterConfig {
 	return {
-		server: { host: "127.0.0.1", port: 8787 },
+		server: { host: "127.0.0.1", port: 8787, maxConcurrentTurns: 24 },
 		openrouter: { baseUrl: "https://openrouter.ai/api/v1", apiKey: "", title: "test", timeoutMs: 30_000, catalogTtlMs: 3_600_000, catalogRefreshMs: 0 },
 		benchmarks: { enabled: false, artificialAnalysisApiKey: "", benchlm: true, refreshMs: 86_400_000, timeoutMs: 30_000, useLocalScores: false },
 		tiers: {

package/tools/agentdox-e2e.ts

@@ -40,6 +40,10 @@ const bridge = createContextBridge({
 	log,
 	maxStalenessMs: 900_000,
 	maxBlockChars: 24_000,
+	memoryLimit: 4,
+	docsLimit: 0,
+	sessionLimit: 6,
+	briefChars: 12_000,
 	recordTurns: true,
 	maxQueue: 64,
 });

package/tools/mock-openrouter.ts

@@ -254,7 +254,7 @@ export async function startMockOpenRouter(fixturePath: string, port = 0): Promis
 
 	return {
 		url: `http://127.0.0.1:${server.port}`,
-		port: server.port,
+		port: server.port ?? 0,
 		control,
 		requests,
 		stop: async () => {

package/tools/replay.ts

@@ -54,7 +54,7 @@
 import { Database } from "bun:sqlite";
 
 import { createCatalog } from "../src/catalog/openrouter-catalog.ts";
-import type { CatalogModel } from "../src/catalog/types.ts";
+import type { CatalogModel, CatalogSnapshot } from "../src/catalog/types.ts";
 import { loadConfig } from "../src/config/load.ts";
 import type { RouterConfig } from "../src/config/types.ts";
 import { computeCost } from "../src/cost/forecast.ts";
@@ -207,6 +207,9 @@ function stateOf(row: Row, prior: PriorTurn | undefined): ConversationState {
 		cacheWarmAtMs: prior?.atMs ?? 0,
 		contextVersion: null,
 		contextFetchedAtMs: 0,
+		// Compaction cannot be replanned offline (messages are not recorded), so
+		// replay carries no plan: forced off in the config it replays under.
+		compactionPlan: null,
 		updatedAtMs: prior?.atMs ?? 0,
 	};
 }
@@ -256,6 +259,7 @@ if (snapshot === null) {
 	console.error(`no cached catalog in ${dbPath}; run the router once so it populates catalog_cache`);
 	process.exit(2);
 }
+const catalogSnapshot: CatalogSnapshot = snapshot;
 const bySlug = new Map(snapshot.models.map((m) => [m.slug, m]));
 const ledger = createLedger(db, cfgA);
 
@@ -302,7 +306,7 @@ function run(cfg: RouterConfig, row: Row, usage: UsageCounts, prior: PriorTurn |
 		classification: scoreHeuristic(f, cfg),
 		profile: profileOf(cfg, row.requested_model),
 		state: stateOf(row, prior),
-		snapshot,
+		snapshot: catalogSnapshot,
 		ledger,
 		cfg,
 		nowMs: Date.now(),

package/tools/smoke.ts

@@ -140,7 +140,7 @@ async function drain(res: Response) {
 		const frame = FrameSchema.safeParse(parsed);
 		if (!frame.success) continue;
 		if (frame.data.model !== undefined) seenModel = frame.data.model;
-		if (frame.data.x_auto_model_router !== undefined) meta = frame.data.x_auto_model_router;
+		if (frame.data.x_auto_model_router !== undefined) meta = { ...(frame.data.x_auto_model_router.model === undefined ? {} : { model: frame.data.x_auto_model_router.model }), ...(frame.data.x_auto_model_router.tier === undefined ? {} : { tier: frame.data.x_auto_model_router.tier }) };
 		const delta = frame.data.choices?.[0]?.delta;
 		if (typeof delta?.content === "string") content += delta.content;
 		for (const call of delta?.tool_calls ?? []) toolArgs += call.function?.arguments ?? "";
@@ -153,7 +153,7 @@ const mock = await startMockOpenRouter("test/fixtures/openrouter-models.json");
 console.log(`mock openrouter: ${mock.url}`);
 
 const cfg = loadConfig({});
-cfg.server = { host: "127.0.0.1", port: 0 };
+cfg.server = { ...cfg.server, host: "127.0.0.1", port: 0 };
 cfg.openrouter.baseUrl = `${mock.url}/api/v1`;
 cfg.openrouter.apiKey = "sk-mock";
 cfg.ledger.path = join(home, "router.db");

package/tools/verify-plan-persist.ts

@@ -28,7 +28,7 @@ const home = mkdtempSync(join(tmpdir(), "verify-plan-persist-"));
 const mock = await startMockOpenRouter("test/fixtures/openrouter-models.json");
 
 const cfg = loadConfig({});
-cfg.server = { host: "127.0.0.1", port: 0 };
+cfg.server = { ...cfg.server, host: "127.0.0.1", port: 0 };
 cfg.openrouter.baseUrl = `${mock.url}/api/v1`;
 cfg.openrouter.apiKey = "sk-mock";
 cfg.ledger.path = join(home, "router.db");
@@ -100,8 +100,11 @@ for (let n = 1; n <= TURNS; n++) {
 	// same bytes. A dropped or altered edit rewrites the cached prefix.
 	for (const [i, content] of prev) {
 		const now = shrunk.get(i);
-		if (now === undefined) fail(`turn ${n}: edit at message ${i} was DROPPED (bytes re-inflated)`, { turn: n, i });
-		if (now !== content) fail(`turn ${n}: edit at message ${i} changed bytes`, { was: content.slice(0, 90), now: now.slice(0, 90) });
+		if (now === undefined) {
+			fail(`turn ${n}: edit at message ${i} was DROPPED (bytes re-inflated mid-prefix)`, { turn: n, i });
+		} else if (now !== content) {
+			fail(`turn ${n}: edit at message ${i} changed bytes`, { was: content.slice(0, 90), now: now.slice(0, 90) });
+		}
 	}
 
 	const added = [...shrunk.keys()].filter((i) => !prev.has(i));
@@ -122,6 +125,6 @@ console.log(`\nfloorRatio ${floorRatio}`);
 console.log(`PASS stability: no edit was ever dropped or rewritten across ${TURNS} turns`);
 console.log(`plan changes: ${changes} over ${planningTurns} compacting turns (${((changes / planningTurns) * 100).toFixed(0)}% of turns invalidate cache)`);
 
-app.stop(true);
+await app.stop();
 await mock.stop();
 process.exit(0);

package/tsconfig.all.json

@@ -0,0 +1,4 @@
+{
+	"extends": "./tsconfig.json",
+	"include": ["src", "test", "omp-extension", "tools"]
+}