test: stop rebinding released loopback ports

tests/claude-integration/claude-intercept-proxy-auth.test.ts

@@ -1,7 +1,8 @@
 import { afterEach, expect, spyOn, test } from "bun:test";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import * as filesystem from "node:fs";
-import { connect, createServer } from "node:net";
+import { connect } from "node:net";
+import { startConnectProxy } from "../../src/claude/intercept/connect-proxy";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { claudeInterceptProxyTokenPath, ensureClaudeInterceptProxyToken, readClaudeInterceptProxyToken } from "../../src/claude/intercept/proxy-auth";
@@ -94,14 +95,6 @@ test("a linked credential directory never grants authority", () => {
   expect(readFileSync(join(external, "proxy-token"), "utf8")).toBe("D".repeat(43) + "\n");
 });
 
-async function unusedPort(): Promise<number> {
-  const server = createServer();
-  await new Promise<void>(resolve => server.listen(0, "127.0.0.1", resolve));
-  const address = server.address();
-  if (!address || typeof address === "string") throw new Error("no test port");
-  await new Promise<void>((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
-  return address.port;
-}
 function connectStatus(port: number, token?: string): Promise<number> {
   return new Promise((resolve, reject) => {
     const socket = connect({ host: "127.0.0.1", port }, () => {
@@ -129,14 +122,17 @@ test("a live intercept adopts an explicitly recreated token without restarting",
   process.env.CLAUDE_CONFIG_DIR = claudeHome;
   const { startClaudeIntercept } = await import("../../src/claude/intercept/runtime");
   const { applyDesktopFirstParty } = await import("../../src/claude/desktop-first-party");
-  const port = await unusedPort();
   const config = { port: 10100, defaultProvider: "openai", providers: {},
-    claudeCode: { intercept: { enabled: true, port, picker: false } } };
+    claudeCode: { intercept: { enabled: true, port: 0, picker: false } } };
   let handle: Awaited<ReturnType<typeof startClaudeIntercept>> = null;
   try {
     handle = await startClaudeIntercept({ config, configDir: root, publicPort: 10100,
-      dispatch: async () => new Response("local fixture") });
+      dispatch: async () => new Response("local fixture"),
+      startProxy: (_port, options) => startConnectProxy(0, options) });
     expect(handle).not.toBeNull();
+    const port = handle!.proxyPort;
+    expect(port).toBeGreaterThan(0);
+    config.claudeCode.intercept.port = port;
     expect(applyDesktopFirstParty(config, { opencodexConfigDir: root, claudeConfigDir: claudeHome }).ok).toBe(true);
     const old = readClaudeInterceptProxyToken(root)!;
     expect(await connectStatus(port, old)).toBe(200);
@@ -147,6 +143,7 @@ test("a live intercept adopts an explicitly recreated token without restarting",
     const current = readClaudeInterceptProxyToken(root)!;
     expect(current).not.toBe(old);
     const settings = JSON.parse(readFileSync(join(claudeHome, "settings.json"), "utf8"));
+    expect(Number(new URL(settings.env.HTTPS_PROXY).port)).toBe(port);
     expect(new URL(settings.env.HTTPS_PROXY).password).toBe(current);
     expect(await connectStatus(port, current)).toBe(200);
     expect(await connectStatus(port, old)).toBe(407);

tests/cli/cli-client-start-owner-e2e.test.ts

@@ -128,12 +128,10 @@ test.skipIf(process.platform === "win32")("a desktop claim committed as the clie
   let watchdog: ReturnType<typeof setTimeout> | undefined;
   const timeoutMs = watchdogMs(10_000);
   try {
-    // A port nothing listens on, so the start path's liveness probe reads absent.
-    const probe = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch: () => new Response(null, { status: 404 }) });
-    const freePort = probe.port;
-    probe.stop(true);
+    // The child preload refuses the configured-port probe deterministically;
+    // the ownership fence must still prevent all runtime publication.
     writeFileSync(join(ocxHome, "config.json"), JSON.stringify({
-      port: freePort,
+      port: 42101,
       hostname: "127.0.0.1",
       codexAutoStart: false,
       syncResumeHistory: false,
@@ -157,6 +155,8 @@ test.skipIf(process.platform === "win32")("a desktop claim committed as the clie
     child = Bun.spawn([
       process.execPath,
       "--preload",
+      repoPath("tests/fixtures/refused-local-probe-preload.ts"),
+      "--preload",
       repoPath("tests/fixtures/client-runtime-claim-preload.ts"),
       repoPath("src/cli/index.ts"),
       "start",
@@ -182,6 +182,7 @@ test.skipIf(process.platform === "win32")("a desktop claim committed as the clie
       }),
     ]);
     const output = result[2] || result[1];
+    expect(result[2], output).toContain("[refused-probe] ECONNREFUSED");
     // The claim landed on the connected-client branch, after the recovery fence passed.
     expect(result[2], output).toContain("[claim-preload] desktop claim committed at client runtime load");
     expect(result[0], output).toBe(0);

tests/cli/cli-export-command.test.ts

@@ -383,31 +383,30 @@ describe("ocx export with no live proxy (accept criterion 5)", () => {
    * would be discovered and the assertion would pass for the wrong reason.
    */
   test("fails through the runtime-api error naming ocx start, emitting no config", () => {
-    const probe = Bun.serve({ port: 0, fetch: () => new Response("") });
-    const deadPort = probe.port;
-    probe.stop(true);
-
     const home = tempDir();
     // Must pass config validation: a rejected config falls back to the DEFAULT config, whose
     // port 10100 may host the developer's own proxy — the test would then probe a live one.
     writeFileSync(
       join(home, "config.json"),
       JSON.stringify({
-        port: deadPort,
+        // The child preload injects ECONNREFUSED at this exact endpoint.
+        port: 42101,
         defaultProvider: "mock",
         providers: { mock: { adapter: "openai-chat", baseUrl: "http://127.0.0.1/v1", allowPrivateNetwork: true } },
       }),
       "utf8",
     );
 
-    const result = spawnSync(process.execPath, [cliPath, "export", "--client", "opencode", "--json"], {
+    const preload = join(repoRoot, "tests", "fixtures", "refused-local-probe-preload.ts");
+    const result = spawnSync(process.execPath, ["--preload", preload, cliPath, "export", "--client", "opencode", "--json"], {
       cwd: repoRoot,
       env: { ...process.env, OPENCODEX_HOME: home },
       encoding: "utf8",
     });
 
     expect(result.status).not.toBe(0);
     expect(result.stdout).toBe("");
+    expect(result.stderr).toContain("[refused-probe] ECONNREFUSED");
     expect(result.stderr).toContain("ocx start");
     // Routed by the dispatcher, not swallowed by the unknown-command branch.
     expect(result.stderr).not.toContain("Unknown command");

tests/cli/cli-start-auxiliary-bind.test.ts

@@ -1,8 +1,8 @@
-import { expect, test } from "bun:test";
+import { expect, spyOn, test } from "bun:test";
+import * as net from "node:net";
 import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { findAvailablePort } from "../../src/server/ports";
 import { repoPath } from "../helpers/repo-root";
 import { removeTreeWithRetry } from "../helpers/remove-tree";
 import { watchdogMs } from "../helpers/ci-watchdog";
@@ -20,7 +20,10 @@ for (const listener of ["unauthenticatedLoopbackListener", "hub.managementIngres
       for (const path of [home, ocxHome, codexHome]) mkdirSync(path);
       const occupied = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: () => new Response("occupied") });
       const auxiliaryPort = occupied.port!;
-      const publicPort = await findAvailablePort(0, "127.0.0.1");
+      // Also hold the public endpoint: auxiliary failure must win before even a
+      // pinned start attempts public-port reclamation. Nobody can steal this port.
+      const publicListener = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: () => new Response("public canary") });
+      const publicPort = publicListener.port;
       writeFileSync(join(ocxHome, "config.json"), JSON.stringify({
         port: publicPort, hostname: "127.0.0.1", providers: {}, defaultProvider: "openai",
         codexAutoStart: false, syncResumeHistory: false,
@@ -52,38 +55,45 @@ for (const listener of ["unauthenticatedLoopbackListener", "hub.managementIngres
         // publication (and its synchronous Windows icacls subprocesses).
         expect(existsSync(join(ocxHome, "spend-ledger-owner.sqlite"))).toBe(false);
         expect(existsSync(join(ocxHome, "admin-api-token"))).toBe(false);
-        const rebound = Bun.serve({ port: publicPort, hostname: "127.0.0.1", fetch: () => new Response("free") });
-        await rebound.stop(true);
+        expect(await (await fetch(`http://127.0.0.1:${publicPort}`)).text()).toBe("public canary");
       } finally {
         clearTimeout(deadline);
         if (child.exitCode === null) { child.kill(); await child.exited; }
         await occupied.stop(true);
+        await publicListener.stop(true);
         removeTreeWithRetry(root);
       }
     }, DEADLINE + 10_000);
   }
 }
 
-test("auxiliary preflight leaves free sockets available for the actual bind", async () => {
-  const loopbackPort = await findAvailablePort(0);
-  const managementPort = await findAvailablePort(0, "127.0.0.1", { reservedPort: loopbackPort });
-  await assertAuxiliaryListenerPortsAvailable({
-    port: 0, providers: {}, defaultProvider: "openai", runtimeRole: "hub",
-    unauthenticatedLoopbackListener: { enabled: true, port: loopbackPort },
-    hub: { managementIngress: { enabled: true, port: managementPort } },
+test("auxiliary preflight closes its sockets before returning", async () => {
+  // Observe the actual handles instead of rebinding a released number.
+  const probes: net.Server[] = [];
+  const create = net.createServer;
+  const spy = spyOn(net, "createServer").mockImplementation((...args) => {
+    const probe = create(...args); probes.push(probe); return probe;
   });
-  // Bind inside try: if another process takes the second port, the first server still stops.
-  const listeners: ReturnType<typeof Bun.serve>[] = [];
+  const base = { port: 0, providers: {}, defaultProvider: "openai", runtimeRole: "hub" as const };
   try {
-    for (const port of [loopbackPort, managementPort]) {
-      listeners.push(Bun.serve({ hostname: "127.0.0.1", port, fetch: () => new Response("ok") }));
+    await assertAuxiliaryListenerPortsAvailable({ ...base, unauthenticatedLoopbackListener: { enabled: true, port: 0 } });
+    await assertAuxiliaryListenerPortsAvailable({ ...base, hub: { managementIngress: { enabled: true, port: 0 } } });
+    expect(probes).toHaveLength(2);
+    for (const probe of probes) {
+      expect(probe.listening).toBe(false);
+      await new Promise<void>((resolve, reject) => { probe.once("error", reject); probe.listen(0, "127.0.0.1", resolve); });
+      expect(probe.listening).toBe(true);
+      await new Promise<void>((resolve, reject) => probe.close(error => error ? reject(error) : resolve()));
     }
-    expect(listeners.map(server => server.port)).toEqual([loopbackPort, managementPort]);
-  } finally { await Promise.all(listeners.map(server => server.stop(true))); }
+  } finally {
+    spy.mockRestore();
+    for (const probe of probes) if (probe.listening) probe.close();
+  }
 });
 
 test("auxiliary preflight rejects two listeners configured for one port", async () => {
-  const port = await findAvailablePort(0);
+  // Collision is rejected before binding, so no allocation is required.
+  const port = 12345;
   await expect(assertAuxiliaryListenerPortsAvailable({
     port: 0, providers: {}, defaultProvider: "openai", runtimeRole: "hub",
     unauthenticatedLoopbackListener: { enabled: true, port },

tests/cli/ocx-launcher-runtime.test.ts

@@ -1,7 +1,6 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { spawn, spawnSync, type ChildProcess } from "node:child_process";
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, readlinkSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
-import { createServer } from "node:net";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -50,18 +49,6 @@ type WindowsProcessIdentity = {
   creationDate: string;
 };
 
-function freePort(): Promise<number> {
-  return new Promise((resolvePort, reject) => {
-    const server = createServer();
-    server.on("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      const port = typeof address === "object" && address ? address.port : 0;
-      server.close(() => (port ? resolvePort(port) : reject(new Error("no port"))));
-    });
-  });
-}
-
 async function healthAt(port: number): Promise<Health | null> {
   try {
     const response = await fetch(`http://127.0.0.1:${port}/healthz`, {
@@ -82,15 +69,18 @@ async function healthAt(port: number): Promise<Health | null> {
 }
 
 async function waitForHealth(
-  port: number,
+  runtimeRecord: string,
   deadlineMs: number,
   launcher: ChildProcess,
 ): Promise<Health | null> {
   const deadline = Date.now() + deadlineMs;
   while (Date.now() < deadline) {
     if (launcher.exitCode !== null) return null;
-    const health = await healthAt(port);
-    if (health) return health;
+    try {
+      const record = JSON.parse(readFileSync(runtimeRecord, "utf8")) as { port: number; pid: number };
+      const health = await healthAt(record.port);
+      if (health?.pid === record.pid) return health;
+    } catch { /* runtime publication has not finished */ }
     await Bun.sleep(200);
   }
   return null;
@@ -208,18 +198,23 @@ async function effectiveRuntime(override: string): Promise<string> {
   let hasPrimaryError = false;
   let primaryError: unknown;
   try {
-    port = await freePort();
-    launcher = spawn("node", [BIN_OCX, "start", "--port", String(port)], {
+    const env = isolatedLauncherEnv(root, override);
+    // CLI --port requires a positive pin; configured zero requests allocation.
+    writeFileSync(join(root, "opencodex", "config.json"), JSON.stringify({
+      port: 0, providers: {}, defaultProvider: "openai",
+    }));
+    launcher = spawn("node", [BIN_OCX, "start"], {
       stdio: "ignore",
       windowsHide: true,
-      env: isolatedLauncherEnv(root, override),
+      env,
     });
     if (!launcher.pid) throw new Error("Node launcher has no process id");
     launcherPid = launcher.pid;
     ownedLauncher = captureWindowsProcessIdentity(launcherPid);
 
-    const health = await waitForHealth(port, PROXY_HEALTH_TIMEOUT_MS, launcher);
+    const health = await waitForHealth(join(root, "opencodex", "runtime-port.json"), PROXY_HEALTH_TIMEOUT_MS, launcher);
     if (!health) throw new Error("proxy did not become healthy");
+    port = health.port;
     const identity = windowsProcessIdentity(health.pid);
     if (!identity || identity.parentPid !== launcher.pid) {
       throw new Error("health PID is not the spawned Node launcher's direct Bun child");