[parth2024-tech]

Summary

This PR delivers a comprehensive hardening pass covering local control-plane security, prefix cache stability for dynamic deferred tools, cross-process credential safety, and non-blocking session compaction persistence.

Key Changes

1. Control Plane & Request Guardrails:

   • Enforce constant-time local token verification (subtle::ConstantTimeEq) across all control and capture routes.
   • Reject cross-origin browser requests (Origin, Sec-Fetch-Site: cross-site) and restrict Host header to loopback addresses to prevent DNS rebinding.
   • Enforce Content-Type: application/json on mutation endpoints to block CORS-exempt browser simple-requests.

2. Prefix Cache Stability for Dynamic Tools (Codex Responses Lite & Grok):

   • Codex Responses Lite input[0] AdditionalTools is now frozen strictly to base non-deferred tools (defer_loading != true).
   • Dynamically resolved tools (via tool_reference in tool_result content) are injected as discrete AdditionalTools items at the turn boundary where they resolve, preventing token-stream mutation of historical conversation turns and preserving 100% of KV prefix caching.
   • Wired Grok translator to use sort_tools_stable_prefix.
   • Stripped lookahead/lookbehind patterns ((?=...), (?!...), etc.) from tool schemas to prevent upstream regex validator failures.

3. Non-Blocking Async File Locking & Double-Checked Auth:

   • Implemented FileLock::try_acquire (LOCK_EX | LOCK_NB) and acquire_lock_async with cooperative async polling sleeps and spawn_blocking fallback so Tokio worker threads are never blocked by synchronous OS syscalls during upstream OAuth handshakes.
   • Implemented double-checked locking across Codex, Grok, and Kimi auth managers by re-reading load_auth() inside the locked section to prevent race conditions during concurrent single-use refresh token rotations.
   • Memory-backed test auth stores bypass disk file locks.

4. Compaction & Secret Hygiene:

   • Keyed subagent compaction by composite (session_id, lineage) to prevent subagent turns from clobbering parent compaction states.
   • Debounced compaction store writes to sessions.json with an atomic dirty flag and background 5-second flusher instead of synchronous disk writes in live stream handlers.
   • Redacted sensitive tokens (sk-ant-***, sk-***, ghp_***, AKIA***, PRIVATE KEY) in captured request logs.

Validation

• cargo check: Clean (0 errors).
• cargo clippy --all-targets -- -D warnings: Clean (0 warnings).
• cargo test --lib: 982 passed (including new prefix-stability and secret scrubbing tests).
• Integration test suite: 55 smoke cutover tests and all CLI/WebSocket/Foundation tests passed.