[alvinveroy]

Summary

Add a self-probe wedge watchdog to server-ws.mjs and the standalone-server-ws wrapper, plus the matching pack-artifact allowlist entry so the new module survives the npm tarball prepublish prune.

Also carries the upstream-merge-gate drift fixes (TypeScript api-typecheck baseline + docs migration count + i18n mirrors + changelog fragment normalization) inherited from origin/release/v3.8.51. These drift fixes are required for ANY fork PR into release/v3.8.51 to pass CI until the upstream base absorbs them.

Related Issues

• Closes: 2026-09-05 wedge incident follow-up (opencode h2 stream reset + combo cleanup client abort left the listener accepting but no request served for hours; existing supervisor only restarts on process exit).
• No upstream issue duplicates this. Closes the gap left by the previously-consolidated PR feat(resilience): surface TLS-fingerprint remediation when Cloudflare 1010 hits #12531 (now closed).

Validation

Change type: build-deploy / resilience. Focused loop from CONTRIBUTION_GOLDEN_PATH:

• Change type: build-deploy
• Focused tests and category gates from the golden path (pack-artifact closure tests + watchdog regression test)
• npm run lint
• Reconciled with the current active release base (origin/release/v3.8.51); focused checks rerun afterward
• Production-code changes include a new automated test in this PR

Commands run on the VPS (ai.servers.com, deploy@23.111.17.228):

git worktree add /home/deploy/g2-final-check pr/g2-self-probe-watchdog
ln -sfn /home/deploy/OmniRoute/node_modules /home/deploy/g2-final-check/node_modules
export PATH=/home/deploy/node24/bin:/usr/local/bin:/usr/bin:/bin

for f in tests/unit/self-probe-watchdog.test.mjs \
         tests/unit/pack-artifact-server-ws-closure.test.ts \
         tests/unit/pack-artifact-entrypoint-closures.test.ts \
         tests/unit/build/assemble-standalone.test.ts; do
  node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts \
       --import ./tests/_setup/isolateDataDir.ts --test "$f"
done

npm run check:api-typecheck        # PASS (290 errors, all within frozen baseline)
npm run check:file-size            # PASS
npm run check:changelog-integrity  # PASS
npm run check:docs-all             # PASS

Final result: 4/4 focused tests green, all 4 gate categories green on VPS.

Tests Added Or Updated

• tests/unit/self-probe-watchdog.test.mjs — pure decision helpers + loopback probe simulator; covers evaluateSelfProbeConfig parsing, shouldConsiderAlive semantics (any HTTP response, including 401, counts as alive), and the OMNIROUTE_SELF_PROBE=off escape hatch.
• tests/unit/pack-artifact-server-ws-closure.test.ts — new assertion: self-probe-watchdog.mjs in allowlist.
• tests/unit/pack-artifact-entrypoint-closures.test.ts — new assertion: dist/self-probe-watchdog.mjs in required paths.
• tests/unit/build/assemble-standalone.test.ts — new assertion: self-probe-watchdog.mjs in EXTRA_MODULE_ENTRIES.

Coverage Notes

• Production code changed: scripts/dev/standalone-server-ws.mjs (one import + one watchdog call) and scripts/dev/self-probe-watchdog.mjs (new file).
• Coverage gate (npm run test:coverage, 60% statements/lines/functions/branches) remains green: the new watchdog's pure helpers and the loopback-probe wiring are exercised by the new tests.

Reviewer Notes

• No config break: OMNIROUTE_SELF_PROBE=off is the only escape hatch; defaults to enabled, threshold 3 failures × 15s timeout × 60s interval = ~3 min worst case before forced restart.
• Why a watchdog instead of metric-gated restart: the listener keeps accepting TCP during the wedge, so any external liveness probe (k8s livenessProbe, AWS ALB target group health check) sees the port as live. The probe runs on the same event loop it monitors — only a wedged loop can fail to answer a localhost HTTP probe.
• No external network surface: the probe hits 127.0.0.1:<port>/api/status only. Same-loop answer = alive. Counter increments only on connect-refused or timeout, not on any HTTP response (401 counts as alive — OmniRoute answers 401 when healthy and keyless).
• Supervised process: relies on launchd KeepAlive / systemd Restart=always / docker restart=always to relaunch after exit(1). Documented in the watchdog JSDoc.
• Drift-fix prerequisite commit: fix(ci): clear merge-gate drift inherited from upstream release/v3.8.51 carries the api-typecheck baseline entry for open-sse/executors/glm.ts (pre-existing TS2554 base-red), the 169→170 migration-count updates in README.md/AGENTS.md/llm.txt + 41 i18n mirrors, and the changelog fragment normalization for reset-aware-model-family.md. All three are inherited from the upstream release base; every fork PR into release/v3.8.51 trips them until the upstream base absorbs them.

[alvinveroy]

/retest

[alvinveroy]

/retest

[alvinveroy]

Closing this PR for now to unblock the queue. The watchdog + pack-closure additions themselves are clean — local and CI gates for changes owned by this PR all pass:

• ✅ Docs Gates (fast-path)
• ✅ API Route Typecheck (290 errors, all within frozen baseline)
• ✅ Merge integrity (changelog + generated skills)
• ✅ No new ESLint warnings
• ✅ Vitest (fast-path)
• ✅ Semgrep / Semgrep-cloud-platform
• ✅ Change Classification

But three Unit Tests fast-path shards (1/4, 2/4, 3/4) fail with pre-existing reds inherited from upstream origin/release/v3.8.51, not from this PR's diff. Concretely:

• tests/unit/chat-rejects-image-only-model.test.ts (fix(providers): huggingface/stabilityai/stable-diffusion-xl-base-1.0 exposed as chat model, returns 400 'not a chat model' #6457)
• tests/unit/dashboard-request-failed-redaction.test.ts (fix(security): redact dashboard failure events #12469)
• tests/unit/error-sanitizer-sk-key-qv45.test.ts (GHSA-qv45)
• tests/unit/huggingchat-stream-error-boundary.test.ts (fix(huggingchat): surface HTTP 200 JSONL failures #12456)
• tests/unit/kiro-tool-call-validation.test.ts (fix(kiro): validate completed nested tool_call payloads #9314)
• tests/unit/model-sync-route.test.ts (chore(release): v3.6.6 — Stabilization #1241)
• tests/unit/stream-handler-public-error-boundary.test.ts (fix(streaming): sanitize generic stream failure boundaries #12457)
• tests/unit/zai-web-silent-empty-repro.test.ts ([v3.8.50] Fix Z.ai web browser transport and model capabilities #8451)

These test files exist on release/v3.8.51 but the production-code companions live in the in-flight fix/v3851-* / security/v3851-* branches (huggingchat-stream-error-boundary, dashboard-failure-event-redaction, zai-web-stream-error-boundary, streamhandler-public-errors, public-error-boundaries, codex-response-failed-boundary, error-sanitizer-sk-key-qv45, chat-rejects-image-only-model, kiro-tool-call-validation, model-sync-route). None of those have landed on release/v3.8.51 yet, so the test files assert behaviors the running code doesn't yet satisfy.

Verified upstream-side: on a clean checkout of origin/release/v3.8.51 (f9a1cc8a9), the same 8 tests fail with byte-identical assertion errors. Same on origin/main. These are not regressions introduced by this PR — the existing /api/status-returning 401 means the daemon is healthy, but the test suite is in a half-shipped state.

To keep CI green, the campaign/green-prs pipeline (CONTRIBUTING.md + the mergify/merge-queue workflow) needs to land the upstream fix-branches into release/v3.8.51 first; this PR can then reopen and pass cleanly without modifying the failed test files or their production companions.

The two prerequisite commits I added here (docs-count drift + changelog fragment normalization + api-typecheck baseline entry for the pre-existing glm.ts TS2554 + cli-tunnel SKILL.md regen) are still useful — they close a per-PR gate-noise class that affects every fork PR until the upstream base absorbs them. They will be carried into the reopened PR (or absorbed by a separate infra-drift PR).

Closing now to keep the queue clean for the maintainer. Reopen when the green-prs campaign has landed the fix-branches.

[amorkezouati774-cyber]

kali

[amorkezouati774-cyber]

Uploading 2025-National-Security-Strategy.pdf…