pi-freeflow 1.9.1 → 1.9.4

package/src/health.ts

@@ -6,6 +6,7 @@
 import type * as http from "node:http";
 import { ALL_MODELS } from "./models.ts";
 import { getActiveRelayState, getRelayHealth, isRelayHealthy } from "./relay-state.ts";
+import { getLastActivityAt, getLeaseCount, getLeaseSnapshot } from "./lease.ts";
 import { PKG_VERSION, PORT } from "./config.ts";
 
 export interface HealthRelayInfo {
@@ -26,7 +27,14 @@ export interface HealthData {
 	version: string;
 	/** In-flight proxied requests right now (stale-daemon replacement guard). */
 	activeRequests: number;
+	/** Clients holding a live lease (detached-daemon GC). */
+	clients: number;
+	/** clientId -> lastSeenAt for every live lease. */
+	leases: Record<string, number>;
+	/** Last time any request was proxied (request-touch for legacy clients). */
+	lastActivityAt: number;
 }
+
 /**
  * Collect current health snapshot.
  * @param portOverride - actual listening port (defaults to config PORT)
@@ -54,10 +62,16 @@ export function getHealthData(portOverride?: number, activeRequests = 0): Health
 		catalog: ALL_MODELS.length,
 		version: PKG_VERSION,
 		activeRequests,
+		clients: getLeaseCount(),
+		leases: getLeaseSnapshot(),
+		lastActivityAt: getLastActivityAt(),
 	};
 }
 
-function isLoopbackIP(ip: string): boolean {
+/**
+ * Check whether an IP address is a loopback address (127.0.0.1, ::1, localhost).
+ */
+export function isLoopbackIP(ip: string): boolean {
 	if (!ip) return false;
 	const withoutZone = ip.split("%")[0];
 	const clean = withoutZone.startsWith("::ffff:") ? withoutZone.slice(7) : withoutZone;
@@ -75,38 +89,31 @@ export function handleHealthRequest(
 	portOverride?: number,
 	activeRequests = 0,
 ): boolean {
-	let pathname: string | null = null;
+	if (req.method !== "GET") return false;
+
+	let reqPathname: string | null = null;
 	try {
-		pathname = new URL(req.url ?? "/", "http://127.0.0.1").pathname;
+		reqPathname = new URL(req.url ?? "/", `http://127.0.0.1`).pathname;
 	} catch {
 		return false;
 	}
+	if (reqPathname === null) return false;
+	if (reqPathname !== "/_health" && reqPathname !== "/health") return false;
 
-	const isHealthPath = pathname === "/_health" || pathname === "/health";
-	if (req.method !== "GET" || !isHealthPath) {
-		return false;
-	}
-
-	const sock: unknown = req.socket;
-	let rawIp = "";
-	if (sock && typeof sock === "object" && "remoteAddress" in sock) {
-		const v = sock.remoteAddress;
-		if (typeof v === "string") rawIp = v;
-	}
-	const clientIP = rawIp.startsWith("::ffff:") ? rawIp.slice(7) : rawIp;
+	const clientIP = req.socket.remoteAddress ?? "";
 	if (!isLoopbackIP(clientIP)) {
-		const body = JSON.stringify({ error: "forbidden" });
-		res.writeHead(403, { "content-type": "application/json", "content-length": Buffer.byteLength(body) });
-		res.end(body);
+		res.writeHead(403, { "content-type": "application/json" });
+		res.end(JSON.stringify({ error: "loopback only" }));
 		return true;
 	}
 
 	const data = getHealthData(portOverride, activeRequests);
-	const body = JSON.stringify(data);
+	const body = JSON.stringify(data, null, 2);
 	res.writeHead(200, {
 		"content-type": "application/json",
 		"content-length": Buffer.byteLength(body),
+		"cache-control": "no-store",
 	});
 	res.end(body);
 	return true;
-}
+}

package/src/index.ts

@@ -9,7 +9,6 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import type * as http from "node:http";
 import {
 	getAliveCatalog,
 	mergeCatalog,
@@ -17,13 +16,12 @@ import {
 	refreshCatalog,
 	setAliveCatalog,
 } from "./catalog.ts";
+import { ensureDaemon as ensureClientDaemon, getClientPort, stopHeartbeat } from "./client.ts";
 import { createCommandSpec, updateStatusBar } from "./commands.ts";
-import { HOST, LEGACY_PORT, NO_KILL_ENV, ONBOARDED_FLAG_FILE, PKG_VERSION, PORT } from "./config.ts";
-import { log, logInfo, logWarn } from "./logger.ts";
+import { HOST, ONBOARDED_FLAG_FILE, PORT } from "./config.ts";
+import { logInfo, logWarn } from "./logger.ts";
 import { ALL_MODELS, KILO_MODEL_IDS, MODEL_MAP, resolveCanonicalModelId } from "./models.ts";
-import { getDaemonHealth, getDaemonVersion, isProxyAlive, killPortHolder, startProxy } from "./proxy.ts";
-import { resetRateLimits } from "./rate-limiter.ts";
-import { checkForUpdateInBackground, compareVersions } from "./update-checker.ts";
+import { checkForUpdateInBackground } from "./update-checker.ts";
 import {
 	ensureRelay,
 	getActiveRelayState,
@@ -160,150 +158,18 @@ export function buildProviderConfig(
 		}),
 	};
 }
-
-/**
- * Stale-daemon replacement guard.
- * Never interrupt a working shared daemon: a newer-version daemon is left
- * running (downgrade case), an in-flight daemon is left running (busy case —
- * its streams would die mid-flight), a pre-1.9 daemon that cannot report
- * usage is left running (cannot verify), and NO_KILL_ENV disables replacement
- * entirely. Only older, VERIFIED-idle daemons are replaced.
- */
-async function shouldReplaceDaemon(port: number, remoteVer: string): Promise<boolean> {
-	if (NO_KILL_ENV && process.env[NO_KILL_ENV] === "1") {
-		logInfo(
-			`Reusing existing pi-freeflow proxy daemon on http://${HOST}:${port} (replacement disabled by env)`,
-		);
-		return false;
-	}
-	if (compareVersions(remoteVer, PKG_VERSION) > 0) {
-		logInfo(
-			`Reusing existing pi-freeflow proxy daemon on http://${HOST}:${port} (newer daemon v${remoteVer} left running)`,
-		);
-		return false;
-	}
-	const health = await getDaemonHealth(port);
-	if (health === null || health.activeRequests === undefined) {
-		// Pre-1.9 daemons do not report in-flight requests: usage cannot be
-		// verified, so the running daemon is left untouched. Interrupting a
-		// possibly-busy session is worse than keeping an older daemon alive.
-		logInfo(
-			`Reusing existing pi-freeflow proxy daemon on http://${HOST}:${port} (cannot verify usage — leaving the running daemon untouched)`,
-		);
-		return false;
-	}
-	if (health.activeRequests > 0) {
-		logInfo(
-			`Reusing existing pi-freeflow proxy daemon on http://${HOST}:${port} (${health.activeRequests} active request${health.activeRequests === 1 ? "" : "s"} — not interrupted)`,
-		);
-		return false;
-	}
-	return true;
-}
-
-/**
- * Guarded kill ritual for a stale daemon: decide (older-only, verified-idle,
- * NO_KILL) → log → kill → wait for the port to free. Returns true when the
- * port stopped answering (caller re-binds or re-attaches below); false when
- * the daemon is left running — every skip reason is logged here.
- */
-async function killStaleDaemon(
-	port: number,
-	remoteVer: string,
-	what: string,
-): Promise<boolean> {
-	if (!(await shouldReplaceDaemon(port, remoteVer))) return false;
-	logWarn(`stale ${what} v${remoteVer} on :${port} (need v${PKG_VERSION}) — replacing`, {
-		remoteVer,
-		expected: PKG_VERSION,
-	});
-	await killPortHolder(port);
-	for (let i = 0; i < 10; i++) {
-		await new Promise<void>((r) => setTimeout(r, 200));
-		if (!(await isProxyAlive(port))) return true;
-	}
-	logInfo(
-		`Reusing existing pi-freeflow proxy daemon on http://${HOST}:${port} (stale kill did not free port)`,
-	);
-	return false;
-}
 /**
  * Main extension entrypoint
  */
 export default async function (pi: ExtensionAPI): Promise<void> {
 	logInfo("pi-freeflow extension initializing...");
 
-
-	let server: http.Server | null = null;
-	let actualPort = PORT;
-
-	// 2. Single-Port Shared Pattern: Check if daemon is already running (e.g. parent session)
-	// Dual-probe: probe current PORT first; if missing, check LEGACY_PORT so existing v1.4.9
-	// sessions on 18080 are seamlessly reused without split-brain or duplicate daemons.
-	// Stale-daemon heal: if the alive daemon reports a different version (e.g. 1.7.1 vs 1.8.0
-	// after an upgrade), the auth fix never loads for the new session. Detect via /_health
-	// and best-effort replace the stale holder so old users are auto-healed.
-	let alreadyRunning = await isProxyAlive(PORT);
-	if (alreadyRunning) {
-		const remoteVer = await getDaemonVersion(PORT);
-		if (remoteVer !== null && remoteVer !== PKG_VERSION) {
-			if (await killStaleDaemon(PORT, remoteVer, "proxy daemon")) {
-				try {
-					const r = await startProxy();
-					server = r.server;
-					actualPort = r.port;
-					alreadyRunning = false;
-				} catch (e) {
-					log("error", "stale daemon replaced but fresh bind failed — reusing stale as fallback", {
-						error: String(e),
-					});
-					actualPort = PORT;
-				}
-			} else {
-				actualPort = PORT;
-			}
-		} else {
-			logInfo(`Reusing existing pi-freeflow proxy daemon on http://${HOST}:${PORT}`);
-			actualPort = PORT;
-		}
-	} else if (PORT !== LEGACY_PORT && (await isProxyAlive(LEGACY_PORT))) {
-		const remoteVer = await getDaemonVersion(LEGACY_PORT);
-		if (remoteVer !== null && remoteVer !== PKG_VERSION) {
-			if (await killStaleDaemon(LEGACY_PORT, remoteVer, "legacy proxy daemon")) {
-				try {
-					const r = await startProxy();
-					server = r.server;
-					actualPort = r.port;
-					alreadyRunning = false;
-				} catch (e) {
-					log("error", "stale legacy daemon replaced but fresh bind failed — reusing as fallback", {
-						error: String(e),
-					});
-					alreadyRunning = true;
-					actualPort = LEGACY_PORT;
-				}
-			} else {
-				alreadyRunning = true;
-				actualPort = LEGACY_PORT;
-			}
-		} else {
-			logInfo(`Reusing existing legacy pi-freeflow proxy daemon on http://${HOST}:${LEGACY_PORT}`);
-			alreadyRunning = true;
-			actualPort = LEGACY_PORT;
-		}
-	} else {
-		try {
-			const r = await startProxy();
-			server = r.server;
-			actualPort = r.port;
-		} catch (e) {
-			log(
-				"error",
-				"extension inactive — could not bind proxy port. resolve the port conflict and restart pi.",
-				{ error: String(e) },
-			);
-			return;
-		}
+	let actualPort: number;
+	try {
+		actualPort = await ensureClientDaemon();
+	} catch (e) {
+		logWarn("daemon ensure failed — using configured port", { error: String(e) });
+		actualPort = getClientPort();
 	}
 	// Register static models immediately on boot so Pi/OMP picker is populated with zero latency!
 	const registeredCatalog: RegisteredModel[] = ALL_MODELS.map((m) => ({
@@ -318,63 +184,16 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 			buildProviderConfig(models, actualPort),
 		);
 	};
-	let ensuringDaemon = false;
 	const ensureDaemon = async (): Promise<void> => {
-		if (ensuringDaemon) return;
-		ensuringDaemon = true;
 		try {
-			if (await isProxyAlive(actualPort)) {
-				const v = await getDaemonVersion(actualPort);
-				if (v === null || v === PKG_VERSION) return;
-				if (!(await killStaleDaemon(actualPort, v, "proxy daemon"))) return;
-			}
-			if (await isProxyAlive(PORT)) {
-				const v = await getDaemonVersion(PORT);
-				if (v === null || v === PKG_VERSION) {
-					actualPort = PORT;
-					registerCatalog(getAliveCatalog());
-					logInfo(`Re-attached to proxy daemon on http://${HOST}:${PORT}`);
-					return;
-				}
-				if (await killStaleDaemon(PORT, v, "proxy daemon")) {
-					// Port freed — fall through to legacy probe / re-bind below.
-				} else if (await isProxyAlive(PORT)) {
-					actualPort = PORT;
-					registerCatalog(getAliveCatalog());
-					logInfo(`Re-attached to proxy daemon on http://${HOST}:${PORT} (stale kill did not free port)`);
-					return;
-				} else {
-					return; // daemon replaced; re-bind happens below
-				}
+			const port = await ensureClientDaemon();
+			if (port !== actualPort) {
+				actualPort = port;
+				registerCatalog(getAliveCatalog());
+				logInfo(`Re-attached to proxy daemon on http://${HOST}:${port}`);
 			}
-			if (PORT !== LEGACY_PORT && (await isProxyAlive(LEGACY_PORT))) {
-				const v = await getDaemonVersion(LEGACY_PORT);
-				if (v === null || v === PKG_VERSION) {
-					actualPort = LEGACY_PORT;
-					registerCatalog(getAliveCatalog());
-					logInfo(`Re-attached to legacy proxy daemon on http://${HOST}:${LEGACY_PORT}`);
-					return;
-				}
-				if (await killStaleDaemon(LEGACY_PORT, v, "legacy proxy daemon")) {
-					// Port freed — fall through to the re-bind below.
-				} else if (await isProxyAlive(LEGACY_PORT)) {
-					actualPort = LEGACY_PORT;
-					registerCatalog(getAliveCatalog());
-					logInfo(`Re-attached to legacy proxy daemon on http://${HOST}:${LEGACY_PORT} (stale kill did not free port)`);
-					return;
-				} else {
-					return; // daemon replaced; re-bind happens below
-				}
-			}
-			const r = await startProxy();
-			if (r.server) server = r.server;
-			if (r.port) actualPort = r.port;
-			registerCatalog(getAliveCatalog());
-			logWarn("proxy daemon was lost — re-bound locally", { port: actualPort });
 		} catch (e) {
-			logWarn("proxy daemon lost and re-bind failed", { error: String(e) });
-		} finally {
-			ensuringDaemon = false;
+			logWarn("proxy daemon re-attach failed", { error: String(e) });
 		}
 	};
 
@@ -510,16 +329,6 @@ export default async function (pi: ExtensionAPI): Promise<void> {
 		}
 	});
 	pi.on?.("session_shutdown", () => {
-		if (server) {
-			logInfo("shutting down proxy daemon...");
-			const closing = server;
-			server = null;
-			closing.close();
-			// Node 18.2+: closeIdleConnections exists at runtime even if lib types lag
-			const closable = closing as unknown as { closeIdleConnections?: () => void };
-			closable.closeIdleConnections?.();
-			resetRateLimits();
-			logInfo("shutdown complete");
-		}
+		stopHeartbeat();
 	});
 }

package/src/lease.ts

@@ -0,0 +1,106 @@
+/**
+ * Client lease registry for the detached pi-freeflow proxy daemon.
+ *
+ * Each OMP/Pi session is a client that registers a lease and renews it with a
+ * heartbeat while alive. The daemon drops expired leases and, once NO client
+ * holds a live lease AND no request has been proxied recently, retires itself.
+ *
+ * The request-touch (`lastActivityAt`) is the fallback for legacy clients that
+ * never heartbeated: any proxied request counts as a live user, so the daemon
+ * is never idle-killed while a session is actually using it.
+ */
+
+export interface LeaseOptions {
+	/** Lease lifetime (ms); a client that misses ~3 beats is dropped. */
+	ttlMs: number;
+	/** GC sweep interval (ms). */
+	gcMs: number;
+	/** Idle grace after the last proxied request before a lease-less daemon exits (ms). */
+	graceMs: number;
+	/** Current in-flight proxied requests — daemon never exits mid-stream. */
+	getActiveRequests: () => number;
+	/** Called once when the daemon should retire (close server + exit). */
+	onIdle: () => void;
+}
+
+const leases = new Map<string, number>();
+let lastActivityAt = Date.now();
+let gcTimer: ReturnType<typeof setInterval> | null = null;
+
+/** Register or refresh a client lease. */
+export function registerClient(clientId: string): void {
+	leases.set(clientId, Date.now());
+}
+
+/** Renew an existing client lease (unknown ids are ignored). */
+export function renewClient(clientId: string): void {
+	if (leases.has(clientId)) {
+		leases.set(clientId, Date.now());
+	}
+}
+
+/** Remove a client lease (graceful detach on session end). */
+export function unregisterClient(clientId: string): void {
+	leases.delete(clientId);
+}
+
+/** Number of clients holding a live lease. */
+export function getLeaseCount(): number {
+	return leases.size;
+}
+
+/** Snapshot of live client leases (id -> lastSeenAt) for health/debugging. */
+export function getLeaseSnapshot(): Record<string, number> {
+	return Object.fromEntries(leases);
+}
+
+/** Record proxy activity — any proxied request counts as a live user. */
+export function touchActivity(): void {
+	lastActivityAt = Date.now();
+}
+
+/** Timestamp of the last proxied request (0 = never; daemon inits at bind). */
+export function getLastActivityAt(): number {
+	return lastActivityAt;
+}
+
+/**
+ * Start the lease GC sweep. Prunes expired leases and, when no client holds a
+ * lease, nothing is in flight, and no request has been proxied within the
+ * grace window, invokes `onIdle` (the daemon retires). Idempotent — a second
+ * call is a no-op.
+ */
+export function startLeaseGC(opts: LeaseOptions): void {
+	if (gcTimer !== null) return;
+	gcTimer = setInterval(() => {
+		const now = Date.now();
+		for (const [id, seenAt] of leases) {
+			if (now - seenAt > opts.ttlMs) {
+				leases.delete(id);
+			}
+		}
+		if (
+			leases.size === 0 &&
+			opts.getActiveRequests() === 0 &&
+			now - lastActivityAt > opts.graceMs
+		) {
+			stopLeaseGC();
+			opts.onIdle();
+		}
+	}, opts.gcMs);
+}
+
+/** Stop the GC sweep (test teardown / daemon shutdown). */
+export function stopLeaseGC(): void {
+	if (gcTimer !== null) {
+		clearInterval(gcTimer);
+		gcTimer = null;
+	}
+}
+
+/** Test-only: reset all lease state. */
+export function _resetLeaseStateForTest(): void {
+	leases.clear();
+	lastActivityAt = Date.now();
+	stopLeaseGC();
+}

package/src/proxy.ts

@@ -9,9 +9,11 @@ import { randomUUID } from "node:crypto";
 import { execSync } from "node:child_process";
 import * as http from "node:http";
 import * as https from "node:https";
-import { handleHealthRequest } from "./health.ts";
+import { handleHealthRequest, isLoopbackIP } from "./health.ts";
+import { registerClient, renewClient, touchActivity, unregisterClient } from "./lease.ts";
 import { Readable } from "node:stream";
 import type { ReadableStream as WebReadableStream } from "node:stream/web";
+
 import { getAliveCatalog } from "./catalog.ts";
 import {
 	ALLOWED_METHODS,
@@ -25,15 +27,22 @@ import {
 	UPSTREAM_OPENCODE,
 	opencodeHeaders,
 } from "./config.ts";
+
 import { isDebugEnabled, log } from "./logger.ts";
 import { KILO_MODEL_IDS, resolveCanonicalModelId } from "./models.ts";
 // normalize removed — host pi-ai already normalizes thinking/reasoning before proxy
 import { checkRateLimit } from "./rate-limiter.ts";
-import { agent, canUseCustomDispatcher, relayFetch } from "./relay.ts";
+import { relayFetch } from "./relay.ts";
 import { getActiveRelayState } from "./relay-state.ts";
 import { pipeUpstreamStream } from "./stream-pipe.ts";
 import type { Upstream } from "./types.ts";
 
+
+let shutdownShouldExit = false;
+export function setShutdownShouldExit(v: boolean): void {
+	shutdownShouldExit = v;
+}
+
 /**
  * Direct-mode 429 hint throttle: the guidance hint is emitted at most once per
  * 10 minutes per process so repeated rate-limit responses don't spam clients.
@@ -173,7 +182,11 @@ export async function killPortHolder(port: number): Promise<boolean> {
 	try {
 		if (process.platform === "win32") {
 			try {
-				const out = execSync(`netstat -ano | findstr :${port}`, { encoding: "utf8", timeout: 3000 }) as string;
+				const out = execSync(`netstat -ano | findstr :${port}`, {
+					encoding: "utf8",
+					timeout: 3000,
+					windowsHide: true,
+				}) as string;
 				for (const line of out.split("\n")) {
 					if (!line.includes("LISTENING")) continue;
 					if (!line.includes(`:${port}`)) continue;
@@ -182,7 +195,7 @@ export async function killPortHolder(port: number): Promise<boolean> {
 					if (!pid || !/^\d+$/.test(pid)) continue;
 					// Windows netstat report: 127.0.0.1:38180 ... LISTENING/PID
 					if (Number(pid) === process.pid) continue; // never self-kill
-					execSync(`taskkill /F /PID ${pid}`, { timeout: 3000, stdio: "ignore" });
+					execSync(`taskkill /F /PID ${pid}`, { timeout: 3000, stdio: "ignore", windowsHide: true });
 					return true;
 				}
 			} catch {}
@@ -206,6 +219,71 @@ export async function killPortHolder(port: number): Promise<boolean> {
 	}
 }
 
+/**
+ * Loopback-only client lease + control endpoints used by the detached-daemon
+ * protocol (src/client.ts). Returns false when the request is not a control
+ * endpoint (caller continues). Control writes are async (chunked JSON).
+ */
+export function handleControlRequest(
+	req: http.IncomingMessage,
+	res: http.ServerResponse,
+	reqPathname: string | null,
+	closeServer: () => void,
+): boolean {
+	if (reqPathname === null) return false;
+	const isShutdown = reqPathname === "/_shutdown";
+	const isClientRoute = reqPathname.startsWith("/_client/");
+	if (!isShutdown && !isClientRoute) return false;
+	const clientIP = req.socket.remoteAddress ?? "";
+	if (!isLoopbackIP(clientIP)) {
+		res.writeHead(403, { "content-type": "application/json" });
+		res.end(JSON.stringify({ error: "loopback only" }));
+		return true;
+	}
+	if (isShutdown) {
+		res.writeHead(200, { "content-type": "application/json" });
+		res.end(JSON.stringify({ ok: true }));
+		setTimeout(() => {
+			try { closeServer(); } catch {}
+			if (shutdownShouldExit) process.exit(0);
+		}, 50);
+		return true;
+	}
+	const chunks: Buffer[] = [];
+	let total = 0;
+	req.on("data", (c: Buffer) => {
+		total += c.length;
+		if (total > 4096) { req.destroy(); return; }
+		chunks.push(c);
+	});
+	req.on("end", () => {
+		let clientId = "";
+		try {
+			const parsed: unknown = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+			if (parsed && typeof parsed === "object" && "id" in parsed) {
+				const candidate = parsed.id;
+				if (typeof candidate === "string" && candidate) clientId = candidate;
+			}
+		} catch {}
+		if (!clientId) {
+			res.writeHead(400, { "content-type": "application/json" });
+			res.end(JSON.stringify({ error: "missing client id" }));
+			return;
+		}
+		if (reqPathname === "/_client/attach") registerClient(clientId);
+		else if (reqPathname === "/_client/heartbeat") renewClient(clientId);
+		else if (reqPathname === "/_client/detach") unregisterClient(clientId);
+		else {
+			res.writeHead(404, { "content-type": "application/json" });
+			res.end(JSON.stringify({ error: "not found" }));
+			return;
+		}
+		res.writeHead(200, { "content-type": "application/json" });
+		res.end(JSON.stringify({ ok: true }));
+	});
+	return true;
+}
+
 /**
  * Tagged abort reason for the proxy-internal header-wait timeout.
  * relayFetch rethrows AbortErrors untouched, and stream-pipe recognizes
@@ -213,9 +291,7 @@ export async function killPortHolder(port: number): Promise<boolean> {
  * rolls nor penalizes a healthy relay when the request merely ran slow.
  */
 function upstreamTimeoutError(): Error & { code: string } {
-	const err = new Error(
-		`upstream header timeout (${UPSTREAM_HEADER_TIMEOUT_MS}ms)`,
-	) as Error & { code: string };
+	const err = new Error(`upstream header timeout (${UPSTREAM_HEADER_TIMEOUT_MS}ms)`) as Error & { code: string };
 	err.name = "AbortError";
 	err.code = "FF_INTERNAL_ABORT";
 	return err;
@@ -261,6 +337,7 @@ export function startProxy(
 		try {
 			reqPathname = new URL(req.url ?? "/", `http://${HOST}`).pathname;
 		} catch {}
+		if (handleControlRequest(req, res, reqPathname, () => server.close())) return;
 		// Loopback-only health endpoint — always accessible even when widget hidden
 		if (req.method === "GET" && reqPathname !== null && (reqPathname === "/_health" || reqPathname === "/health")) {
 			const addr = server.address();
@@ -268,6 +345,7 @@ export function startProxy(
 			if (handleHealthRequest(req, res, realPort, getActiveRequests())) return;
 		}
 		if (req.method === "GET" && (reqPathname === "/v1/models" || reqPathname === "/v1/models/")) {
+			touchActivity();
 			const alive = getAliveCatalog();
 			const body = JSON.stringify({
 				object: "list",
@@ -298,6 +376,7 @@ export function startProxy(
 			}
 			return;
 		}
+		touchActivity();
 		// Buffer request body to inspect model ID for upstream routing
 		const bodyChunks: Buffer[] = [];
 		activeRequests += 1;
@@ -566,7 +645,6 @@ export function startProxy(
 							headers: fwd,
 							body: directBody.length > 0 ? directBody : undefined,
 							signal: controller.signal,
-							...(canUseCustomDispatcher ? { dispatcher: agent } : {}),
 						} as unknown as RequestInit);
 						clearTimeout(timeoutId);
 						res.off("close", onClientClose);