zengate 1.0.4 → 1.1.0

package/src/opencode/events.js

@@ -34,6 +34,7 @@ export function createEventHub({ getClient, logger, ownsAllSessions }) {
     let controller = null;
     let connectedWaiters = [];
     let loop = null;
+    let toolRejections = 0;
 
     const isOurs = (sessionId) => ownsAllSessions || owned.has(sessionId);
 
@@ -45,12 +46,20 @@ export function createEventHub({ getClient, logger, ownsAllSessions }) {
         }
     }
 
+    /**
+     * OpenCode answers 404 once a request is gone: rejecting one request of
+     * a session also rejects the rest, and the sweep can race the event.
+     */
+    const alreadyAnswered = (error) => error?.status === 404;
+
     async function rejectPermission(id, sessionId) {
         try {
             await getClient().replyPermission(id, 'reject', TOOL_REJECTION_MESSAGE);
+            toolRejections += 1;
             logger.debug('Rejected OpenCode tool permission', { sessionId });
         } catch (error) {
-            logger.warn('Failed to reject an OpenCode tool permission', { sessionId, error: error.message });
+            if (alreadyAnswered(error)) logger.debug('OpenCode tool permission was already answered', { sessionId });
+            else logger.warn('Failed to reject an OpenCode tool permission', { sessionId, error: error.message });
         }
     }
 
@@ -58,7 +67,8 @@ export function createEventHub({ getClient, logger, ownsAllSessions }) {
         try {
             await getClient().rejectQuestion(id);
         } catch (error) {
-            logger.warn('Failed to reject an OpenCode question', { sessionId, error: error.message });
+            if (alreadyAnswered(error)) logger.debug('OpenCode question was already answered', { sessionId });
+            else logger.warn('Failed to reject an OpenCode question', { sessionId, error: error.message });
         }
     }
 
@@ -142,12 +152,21 @@ export function createEventHub({ getClient, logger, ownsAllSessions }) {
             };
         },
         release(sessionId) {
-            for (const child of children.get(sessionId) || []) owned.delete(child);
+            // Subagents can start subagents of their own, so release the whole tree.
+            const descendants = [...(children.get(sessionId) || [])];
             children.delete(sessionId);
+            while (descendants.length) {
+                const child = descendants.pop();
+                owned.delete(child);
+                descendants.push(...(children.get(child) || []));
+                children.delete(child);
+            }
             owned.delete(sessionId);
             listeners.delete(sessionId);
         },
         isConnected: () => connected,
+        /** OpenCode tool permissions rejected so far. */
+        toolRejections: () => toolRejections,
         waitConnected(timeoutMs) {
             if (connected) return Promise.resolve(true);
             return new Promise((resolve) => {

package/src/opencode/isolation.js

@@ -1,9 +1,36 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
+import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
 
 const ROOT_PREFIX = 'zengate-';
+const OWNER_FILE = 'owner.pid';
+const BACKEND_FILE = 'backend.pid';
+const SOCKET_FILE = 'owner.sock';
+const PROBE_TIMEOUT_MS = 2000;
+/** Tells this gateway process apart from an earlier one that had the same pid. */
+const INSTANCE_ID = crypto.randomBytes(8).toString('hex');
+/**
+ * A tree made in another pid namespace (another container sharing this
+ * /tmp) cannot be judged by its pid. Its owner listens on a Unix socket in
+ * the tree, which refuses connections once the owner is gone but still
+ * accepts them while it is merely frozen, and touches the tree every
+ * HEARTBEAT_MS for filesystems where that socket cannot be reached.
+ */
+export const HEARTBEAT_MS = 30000;
+const FOREIGN_STALE_MS = 4 * HEARTBEAT_MS;
+
+function pidNamespace() {
+    try {
+        return fs.readlinkSync('/proc/self/ns/pid');
+    } catch {
+        return '';
+    }
+}
+const PID_NAMESPACE = pidNamespace();
+/** Liveness sockets of the trees this process owns, by root. */
+const ownerSockets = new Map();
 
 /** Environment variables the backend legitimately needs from the host. */
 const PASSTHROUGH_ENV = [
@@ -17,6 +44,11 @@ const PASSTHROUGH_ENV = [
  * OpenCode configuration for the managed backend. Every tool permission is
  * "ask" (the tool stays advertised exactly as in stock OpenCode) and the
  * gateway answers every ask with "reject", so tools never run.
+ *
+ * `continue_loop_on_deny` hands each rejection back to the model instead of
+ * ending the turn. OpenCode rejects every other pending request of a session
+ * along with the one answered, and without it those plain rejections stop
+ * the turn before the model has written an answer.
  */
 export function backendConfig() {
     return {
@@ -28,6 +60,7 @@ export function backendConfig() {
             '*': 'ask', read: 'ask', edit: 'ask', bash: 'ask', glob: 'ask', grep: 'ask', list: 'ask',
             task: 'ask', webfetch: 'ask', websearch: 'ask', external_directory: 'ask', skill: 'ask', lsp: 'ask',
         },
+        experimental: { continue_loop_on_deny: true },
     };
 }
 
@@ -44,12 +77,44 @@ export function createIsolatedRoot() {
         dirs[name] = path.join(root, name);
         fs.mkdirSync(dirs[name], { recursive: true, mode: 0o700 });
     }
-    fs.writeFileSync(path.join(root, 'owner.pid'), String(process.pid), { mode: 0o600 });
+    fs.writeFileSync(path.join(root, OWNER_FILE), `${process.pid}\n${INSTANCE_ID}\n${PID_NAMESPACE}\n`, { mode: 0o600 });
+    holdOwnerSocket(root);
     return { root, ...dirs };
 }
 
+function holdOwnerSocket(root) {
+    if (process.platform === 'win32') return;
+    const server = net.createServer((socket) => socket.destroy());
+    // Without the socket (a path too long for one, say) the heartbeat still vouches for the tree.
+    server.on('error', () => ownerSockets.delete(root));
+    server.listen(path.join(root, SOCKET_FILE));
+    server.unref();
+    ownerSockets.set(root, server);
+}
+
+/** Mark a tree as still in use (see HEARTBEAT_MS). */
+export function touchIsolatedRoot(root) {
+    try {
+        const now = new Date();
+        fs.utimesSync(path.join(root, OWNER_FILE), now, now);
+    } catch {
+        // The tree is gone or being removed.
+    }
+}
+
+/** Remember the backend's pid so a later start can stop it if this gateway dies first. */
+export function recordBackendPid(root, pid) {
+    try {
+        fs.writeFileSync(path.join(root, BACKEND_FILE), String(pid), { mode: 0o600 });
+    } catch {
+        // Only orphan cleanup depends on it.
+    }
+}
+
 export function removeIsolatedRoot(root) {
     if (!root || !path.basename(root).startsWith(ROOT_PREFIX)) return;
+    ownerSockets.get(root)?.close();
+    ownerSockets.delete(root);
     try {
         fs.rmSync(root, { recursive: true, force: true, maxRetries: 3, retryDelay: 200 });
     } catch {
@@ -66,8 +131,75 @@ function isAlive(pid) {
     }
 }
 
-/** Remove scratch trees left behind by gateway processes that no longer exist. */
-export function sweepStaleRoots() {
+/** Only trees this user created are swept; another user's look-alike in a shared /tmp is left alone. */
+function ownedByUs(root) {
+    if (typeof process.getuid !== 'function') return true;
+    try {
+        const stat = fs.lstatSync(root);
+        return stat.isDirectory() && stat.uid === process.getuid();
+    } catch {
+        return false;
+    }
+}
+
+function readOwner(root) {
+    try {
+        const file = path.join(root, OWNER_FILE);
+        const [pid, instance = '', namespace = ''] = fs.readFileSync(file, 'utf8').split('\n');
+        return { pid: Number(pid), instance: instance.trim(), namespace: namespace.trim(), touchedAt: fs.statSync(file).mtimeMs };
+    } catch {
+        return null;
+    }
+}
+
+/** Whether the gateway that owns `root` still accepts connections on its liveness socket. */
+function ownerAnswers(root) {
+    if (process.platform === 'win32') return Promise.resolve(false);
+    return new Promise((resolve) => {
+        const socket = net.connect(path.join(root, SOCKET_FILE));
+        const settle = (alive) => {
+            socket.destroy();
+            resolve(alive);
+        };
+        socket.setTimeout(PROBE_TIMEOUT_MS, () => settle(true));
+        socket.once('connect', () => settle(true));
+        socket.once('error', () => settle(false));
+    });
+}
+
+/**
+ * A tree is stale when its gateway is gone. A container restart reuses the
+ * same pid (often 1), so a tree with our pid but another instance id is
+ * stale too. A tree from another pid namespace is stale once its owner has
+ * stopped touching it and no longer answers on its socket.
+ */
+async function isStale(root, owner) {
+    if (!owner || !(owner.pid > 0)) return false;
+    if (owner.namespace && owner.namespace !== PID_NAMESPACE) {
+        return Date.now() - owner.touchedAt > FOREIGN_STALE_MS && !(await ownerAnswers(root));
+    }
+    if (owner.pid === process.pid) return owner.instance !== INSTANCE_ID;
+    return !isAlive(owner.pid);
+}
+
+/**
+ * Stop the OpenCode backend a dead gateway left running (Linux only: the
+ * process must still be working in that tree, so an unrelated process that
+ * reused the pid is never touched).
+ */
+function stopOrphanBackend(root) {
+    if (process.platform !== 'linux') return;
+    try {
+        const pid = Number(fs.readFileSync(path.join(root, BACKEND_FILE), 'utf8'));
+        if (!(pid > 1) || fs.readlinkSync(`/proc/${pid}/cwd`) !== path.join(root, 'workspace')) return;
+        try { process.kill(-pid, 'SIGKILL'); } catch { process.kill(pid, 'SIGKILL'); }
+    } catch {
+        // No pid file, or the backend is already gone.
+    }
+}
+
+/** Remove scratch trees, and stop backends, left behind by gateway processes that no longer exist. */
+export async function sweepStaleRoots() {
     let entries = [];
     try {
         entries = fs.readdirSync(os.tmpdir(), { withFileTypes: true });
@@ -78,12 +210,10 @@ export function sweepStaleRoots() {
     for (const entry of entries) {
         if (!entry.isDirectory() || !entry.name.startsWith(ROOT_PREFIX)) continue;
         const root = path.join(os.tmpdir(), entry.name);
-        let pid = 0;
-        try { pid = Number(fs.readFileSync(path.join(root, 'owner.pid'), 'utf8')); } catch { /* unreadable: leave it */ }
-        if (pid > 0 && pid !== process.pid && !isAlive(pid)) {
-            removeIsolatedRoot(root);
-            removed += 1;
-        }
+        if (!ownedByUs(root) || !(await isStale(root, readOwner(root)))) continue;
+        stopOrphanBackend(root);
+        removeIsolatedRoot(root);
+        removed += 1;
     }
     return removed;
 }

package/src/opencode/runner.js

@@ -82,11 +82,7 @@ export function createRunner({ getClient, hub, logger, agent }) {
                 if (signal.aborted) throw signal.reason ?? error;
                 throw mapBackendError(error);
             }
-            // Several assistant messages mean OpenCode continued after a
-            // rejected tool; without live events we cannot know, so re-read.
-            const assistantMessages = tracker.assistantCount() > 1 || !hub.isConnected()
-                ? (await client.messages(sessionId, { signal })).filter((m) => m?.info?.role === 'assistant')
-                : [last];
+            const assistantMessages = await readTurn({ client, sessionId, last, ids: tracker.assistantIds(), connected: hub.isConnected(), signal });
             const result = summarize(assistantMessages);
             tracker.flushRemainder(result);
             return result;
@@ -98,6 +94,28 @@ export function createRunner({ getClient, hub, logger, agent }) {
         }
     }
 
+    /**
+     * The turn's assistant messages. Several of them mean OpenCode continued
+     * after a rejected tool, so the earlier ones are fetched one by one: the
+     * session listing also returns the user message, which OpenCode fails to
+     * encode (HTTP 400) when the prompt carried an output format. Without live
+     * events the message ids are unknown and only the listing can find them.
+     * If the re-read fails, the final message alone is still a valid answer.
+     */
+    async function readTurn({ client, sessionId, last, ids, connected, signal }) {
+        const earlier = ids.filter((messageId) => messageId !== last?.info?.id);
+        if (connected && earlier.length === 0) return [last];
+        try {
+            if (!connected) return (await client.messages(sessionId, { signal })).filter((m) => m?.info?.role === 'assistant');
+            const fetched = await Promise.all(earlier.map((messageId) => client.message(sessionId, messageId, { signal })));
+            return [...fetched, last];
+        } catch (error) {
+            if (signal.aborted) throw signal.reason ?? error;
+            logger.warn('Could not re-read the OpenCode turn; answering from its final message', { sessionId, error: error.message });
+            return [last];
+        }
+    }
+
     async function cleanup(client, sessionId) {
         for (let attempt = 0; attempt < 2; attempt += 1) {
             try {
@@ -169,7 +187,8 @@ function createStreamTracker(onDelta) {
     return {
         handle,
         flushRemainder,
-        assistantCount: () => [...roles.values()].filter((role) => role === 'assistant').length,
+        /** Assistant message ids in the order OpenCode created them. */
+        assistantIds: () => [...roles].filter(([, role]) => role === 'assistant').map(([messageId]) => messageId),
     };
 }
 

package/src/server/app.js

@@ -1,16 +1,18 @@
 import express from 'express';
 import { chatCompletionsHandler } from '../openai/chat.js';
+import { completionsHandler } from '../openai/completions.js';
 import { modelsHandlers } from '../openai/models.js';
 import { responsesHandlers } from '../openai/responses.js';
 import { corsMiddleware } from './cors.js';
 import { ApiError, sendError, toApiError } from './errors.js';
-import { createLimiter } from './limiter.js';
+import { admissionMiddleware, createLimiter } from './limiter.js';
 import { createMetrics } from './metrics.js';
-import { authMiddleware, rateLimitMiddleware, requestId, securityHeaders } from './middleware.js';
+import { authMiddleware, hostGuard, rateLimitMiddleware, requestId, securityHeaders } from './middleware.js';
 import { slotMiddleware } from './slot.js';
 
 const MB = 1024 * 1024;
 const EXPOSED_HEADERS = ['x-request-id', 'x-gateway-ignored-params', 'Retry-After'];
+const PROBE_PATHS = new Set(['/health', '/ready']);
 
 /** Wrap an async handler so rejections reach the error handler. */
 const route = (handler) => (req, res, next) => Promise.resolve(handler(req, res, next)).catch(next);
@@ -22,16 +24,33 @@ function openAiRoutes({ runner, catalog, store, limits }) {
     router.get('/models', route(models.list));
     router.get('/models/*id', route(models.retrieve));
     router.post('/chat/completions', route(chatCompletionsHandler({ runner, catalog, limits })));
+    router.post('/completions', route(completionsHandler({ runner, catalog })));
+    router.post('/embeddings', () => {
+        throw new ApiError(404, 'Embeddings are not available: OpenCode Zen serves chat models only.', { code: 'unsupported_endpoint' });
+    });
     router.post('/responses', route(responses.create));
     router.get('/responses/:id', route(responses.retrieve));
     router.delete('/responses/:id', route(responses.remove));
     return router;
 }
 
+/** Adds `req.log` and writes an access-log line for every request except probes. */
 function requestLogger(logger) {
     return (req, res, next) => {
         const scoped = (level) => (msg, fields) => logger[level](msg, { requestId: req.id, ...fields });
         req.log = { debug: scoped('debug'), info: scoped('info'), warn: scoped('warn'), error: scoped('error') };
+        if (!PROBE_PATHS.has(req.path)) {
+            const started = performance.now();
+            res.once('close', () => {
+                // Control and line-separator characters are dropped so a path cannot forge or break up log lines.
+                const path = req.originalUrl.split('?')[0].replace(/[\n\r\u2028\u2029\x00-\x1f\x7f-\x9f]/g, '');
+                req.log.info(`${req.method} ${path} ${res.statusCode}`, {
+                    ms: Math.round(performance.now() - started),
+                    client: req.clientId,
+                    ...(res.writableFinished ? {} : { aborted: true }),
+                });
+            });
+        }
         next();
     };
 }
@@ -60,9 +79,11 @@ function errorHandler(error, req, res, next) {
 export function createApp({ config, logger, backend, hub, catalog, runner, store }) {
     const app = express();
     const metrics = createMetrics();
-    const limiter = createLimiter({ maxConcurrent: config.MAX_CONCURRENT, maxQueue: config.MAX_QUEUE });
+    const limiter = createLimiter({ maxConcurrent: config.MAX_CONCURRENT, maxQueue: config.MAX_QUEUE, queueTimeoutMs: config.QUEUE_TIMEOUT_MS });
+    const admission = admissionMiddleware({ limit: config.MAX_CONCURRENT + config.MAX_QUEUE });
     const rateLimit = rateLimitMiddleware({ perMinute: config.RATE_LIMIT_PER_MINUTE, onLimited: metrics.rateLimited });
-    const limits = { maxBytes: config.MAX_MEDIA_MB * MB };
+    const limits = { maxBytes: config.MAX_MEDIA_MB * MB, maxTotalBytes: config.MAX_BODY_MB * MB };
+    let draining = false;
 
     app.disable('x-powered-by');
     app.set('trust proxy', config.TRUST_PROXY || false);
@@ -73,15 +94,38 @@ export function createApp({ config, logger, backend, hub, catalog, runner, store
 
     app.get('/health', (req, res) => res.json({ status: 'ok' }));
     app.get('/ready', (req, res) => {
-        const ready = backend.isReady() && hub.isConnected();
-        res.status(ready ? 200 : 503).json({ status: ready ? 'ready' : 'starting', backend: backend.mode, opencode: backend.version() });
+        const ready = !draining && backend.isReady() && hub.isConnected();
+        const status = draining ? 'stopping' : (ready ? 'ready' : 'starting');
+        res.status(ready ? 200 : 503).json({ status, backend: backend.mode });
     });
 
+    if (config.ALLOW_NO_AUTH) app.use(hostGuard({ allowedHosts: config.ALLOWED_HOSTS }));
     app.use(rateLimit);
     app.use(authMiddleware({ apiKeys: config.API_KEYS, allowNoAuth: config.ALLOW_NO_AUTH, onFailure: metrics.authFailure }));
-    app.get('/metrics', (req, res) => res.json(metrics.snapshot({
-        slots: limiter.stats(), stored_responses: store.size(), backend_ready: backend.isReady(), events_connected: hub.isConnected(),
-    })));
+    app.get('/metrics', (req, res) => {
+        const slots = { ...limiter.stats(), admitted: admission.count() };
+        const toolRejections = hub.toolRejections?.() ?? 0;
+        // Prometheus asks for OpenMetrics or text/plain with a version parameter, which
+        // req.accepts() does not match; browsers and curl get JSON.
+        const accept = String(req.headers.accept || '');
+        const scraper = /openmetrics-text|text\/plain/.test(accept) && !accept.includes('application/json');
+        if (req.query.format === 'prometheus' || (req.query.format === undefined && scraper)) {
+            res.type('text/plain; version=0.0.4').send(metrics.prometheus({
+                slots, storedResponses: store.size(), backendReady: backend.isReady(), eventsConnected: hub.isConnected(),
+                toolRejections, opencode: backend.version(),
+            }));
+            return;
+        }
+        res.json(metrics.snapshot({
+            slots,
+            stored_responses: store.size(),
+            backend_ready: backend.isReady(),
+            events_connected: hub.isConnected(),
+            tool_rejections: toolRejections,
+            opencode: backend.version(),
+        }));
+    });
+    app.use(admission);
     app.use(express.json({ limit: config.MAX_BODY_MB * MB }));
     app.use(slotMiddleware({ limiter, timeoutMs: config.REQUEST_TIMEOUT_MS }));
 
@@ -92,5 +136,10 @@ export function createApp({ config, logger, backend, hub, catalog, runner, store
     app.use((req, res) => sendError(res, new ApiError(404, `Unknown endpoint: ${req.method} ${req.path}`, { code: 'unknown_url' })));
     app.use(errorHandler);
 
-    return { app, close: () => rateLimit.close() };
+    return {
+        app,
+        /** Report "not ready" so load balancers stop sending new requests. */
+        startDraining: () => { draining = true; },
+        close: () => rateLimit.close(),
+    };
 }

package/src/server/client-key.js

@@ -0,0 +1,29 @@
+import net from 'node:net';
+
+const MAPPED_IPV4 = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i;
+
+/** The first four groups (the /64 network) of an IPv6 address, normalized. */
+function network64(address) {
+    const plain = address.split('%')[0].toLowerCase();
+    const [head, tail = ''] = plain.split('::');
+    const left = head ? head.split(':') : [];
+    if (!plain.includes('::')) return left.slice(0, 4).map((group) => parseInt(group, 16).toString(16)).join(':');
+    const right = tail ? tail.split(':') : [];
+    // An embedded IPv4 address fills the last two groups.
+    const rightGroups = right.reduce((count, group) => count + (group.includes('.') ? 2 : 1), 0);
+    const groups = [...left, ...Array(Math.max(0, 8 - left.length - rightGroups)).fill('0'), ...right];
+    return groups.slice(0, 4).map((group) => parseInt(group, 16).toString(16)).join(':');
+}
+
+/**
+ * The key a client is rate limited by. An IPv6 client normally has a whole
+ * /64 to pick addresses from, so IPv6 addresses count per /64 network;
+ * IPv4-mapped IPv6 counts as the IPv4 address.
+ * @param {{ ip?: string, socket?: { remoteAddress?: string } }} req
+ */
+export function clientKey(req) {
+    const ip = req.ip || req.socket?.remoteAddress || 'unknown';
+    if (!net.isIPv6(ip)) return ip;
+    const mapped = MAPPED_IPV4.exec(ip);
+    return mapped ? mapped[1] : `${network64(ip)}::/64`;
+}

package/src/server/limiter.js

@@ -1,5 +1,8 @@
+import { clientKey } from './client-key.js';
 import { ApiError } from './errors.js';
 
+const busy = (message) => new ApiError(429, message, { code: 'server_busy', retryAfter: 2 });
+
 /**
  * Concurrency gate with a bounded FIFO queue.
  *
@@ -7,10 +10,12 @@ import { ApiError } from './errors.js';
  * slots are free (a request with n choices runs n generations, so it costs
  * n slots). The slots are released exactly once: when the caller calls
  * release, or when `signal` aborts (timeout or client disconnect), so work
- * that ignores cancellation can never hold a slot forever.
- * @param {{ maxConcurrent: number, maxQueue: number }} options
+ * that ignores cancellation can never hold a slot forever. A request that
+ * waits longer than `queueTimeoutMs` gets a 429, well before a proxy in
+ * front would give up on a response that has not started.
+ * @param {{ maxConcurrent: number, maxQueue: number, queueTimeoutMs?: number }} options
  */
-export function createLimiter({ maxConcurrent, maxQueue }) {
+export function createLimiter({ maxConcurrent, maxQueue, queueTimeoutMs = 0 }) {
     let active = 0;
     const waiting = [];
 
@@ -30,7 +35,7 @@ export function createLimiter({ maxConcurrent, maxQueue }) {
             pump();
         };
         signal?.addEventListener('abort', release, { once: true });
-        return release;
+        return Object.assign(release, { weight });
     };
 
     const abortedError = () => new ApiError(499, 'Request cancelled.', { code: 'cancelled' });
@@ -42,24 +47,32 @@ export function createLimiter({ maxConcurrent, maxQueue }) {
             active += weight;
             return Promise.resolve(makeRelease(signal, weight));
         }
-        if (waiting.length >= maxQueue) {
-            return Promise.reject(new ApiError(429, 'Gateway is busy; retry shortly.', { code: 'server_busy', retryAfter: 2 }));
-        }
+        if (waiting.length >= maxQueue) return Promise.reject(busy('Gateway is busy; retry shortly.'));
         return new Promise((resolve, reject) => {
+            let timer = null;
             const entry = {
                 weight,
                 grant() {
+                    clearTimeout(timer);
                     signal?.removeEventListener('abort', onAbort);
                     active += weight;
                     resolve(makeRelease(signal, weight));
                 },
             };
-            const onAbort = () => {
+            const leave = (error) => {
+                clearTimeout(timer);
+                signal?.removeEventListener('abort', onAbort);
                 const index = waiting.indexOf(entry);
                 if (index >= 0) waiting.splice(index, 1);
-                reject(abortedError());
+                reject(error);
                 pump();
             };
+            const onAbort = () => leave(abortedError());
+            if (queueTimeoutMs > 0) {
+                const seconds = Math.round(queueTimeoutMs / 1000);
+                timer = setTimeout(() => leave(busy(`Gateway is busy; no slot freed up within ${seconds}s (QUEUE_TIMEOUT_MS).`)), queueTimeoutMs);
+                timer.unref();
+            }
             signal?.addEventListener('abort', onAbort, { once: true });
             waiting.push(entry);
         });
@@ -70,3 +83,44 @@ export function createLimiter({ maxConcurrent, maxQueue }) {
         stats: () => ({ active, queued: waiting.length, maxConcurrent, maxQueue }),
     });
 }
+
+/**
+ * Caps the requests that are reading a body, queued or running. Bodies are
+ * parsed before a request reaches the queue, so without this cap many large
+ * uploads at once could hold far more memory than MAX_QUEUE implies.
+ *
+ * One client address may have at most `perClientUploads` bodies still
+ * arriving, so a client that trickles its uploads cannot take every place.
+ * Ordinary JSON bodies arrive at once and barely count against it.
+ * @param {{ limit: number, perClientUploads?: number }} options
+ */
+export function admissionMiddleware({ limit, perClientUploads = Math.max(2, Math.ceil(limit / 4)) }) {
+    let admitted = 0;
+    const uploading = new Map();
+    const middleware = (req, res, next) => {
+        if (req.method !== 'POST') return next();
+        if (admitted >= limit) return next(busy('Gateway is busy; retry shortly.'));
+        const client = clientKey(req);
+        const inProgress = uploading.get(client) || 0;
+        if (inProgress >= perClientUploads) return next(busy('Too many uploads in progress from this client; retry shortly.'));
+        admitted += 1;
+        uploading.set(client, inProgress + 1);
+        let arrived = false;
+        const bodyArrived = () => {
+            if (arrived) return;
+            arrived = true;
+            const left = uploading.get(client) - 1;
+            if (left > 0) uploading.set(client, left);
+            else uploading.delete(client);
+        };
+        if (req.readableEnded) bodyArrived();
+        else req.once('end', bodyArrived);
+        res.once('close', () => {
+            admitted -= 1;
+            bodyArrived();
+        });
+        return next();
+    };
+    middleware.count = () => admitted;
+    return middleware;
+}