[WRONG BRANCH] fix(server): bound live sideband lease cleanup

[luvs01]

Motivation

• Prevent an uncooperative upstream WebSocket from holding a live sideband admission lease indefinitely and blocking native-main profile switches.
• Ensure the server always performs local cleanup after a bounded close retry instead of leaving resources attached while an upstream remains CONNECTING/CLOSING.

Description

• Change armLiveSidebandCloseFallback in src/server/index.ts to force local finalization after the bounded retry instead of only finalizing when the upstream reports CLOSED.
• Update closeLiveSideband comments and fallback behavior so the fallback performs a retry and then releases local sideband state if the upstream never completes the handshake.
• Adjust src/server/ws-bridge.ts documentation to reflect the bounded forced-cleanup semantics for liveCloseFallback.
• Update tests/native-profile-drain-server.test.ts to assert that an uncooperative upstream no longer pins native-main ownership and that a profile switch can proceed after the fallback.

Testing

• Ran bun run typecheck, which completed successfully.
• Ran bun run test; the modified native-profile drain scenarios passed, including the updated uncooperative-upstream regression, while the overall suite exhibited unrelated timeouts/failures in a different test (management-provider-validation).
• Ran bun run privacy:scan, which passed.
• Noted that invoking bun test tests/native-profile-drain-server.test.ts directly in this environment failed due to a local Bun/runtime mismatch (node:zlib export), but the repository test wrapper (bun run test) exercised and validated the focused changes.

---

Codex Task

Summary by CodeRabbit

• Bug Fixes
  • Improved Live sideband connection shutdown when the remote peer does not complete the close handshake.
  • Ensured local resources are released after the close fallback timeout, allowing profile switching to complete successfully.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fd35a2ca-689d-4c6d-b030-22f7abc4548a

📥 Commits

Reviewing files that changed from the base of the PR and between 2468502 and 0a81f7b.

📒 Files selected for processing (3)

• src/server/index.ts
• src/server/ws-bridge.ts
• tests/native-profile-drain-server.test.ts

---

📝 Walkthrough

Walkthrough

The Live sideband close fallback now performs forced local cleanup after a bounded upstream close retry. The drain test verifies that main-profile ownership is released and a profile switch returns status 200.

Changes

Live sideband cleanup

Layer / File(s)	Summary
Force local cleanup after close retry src/server/index.ts, src/server/ws-bridge.ts	At src/server/index.ts:216-223, the fallback always finalizes the sideband and releases local state after retrying upstream.close. At src/server/index.ts:238-243 and src/server/ws-bridge.ts:45, comments and error handling describe the forced cleanup behavior.
Validate ownership release during profile switch tests/native-profile-drain-server.test.ts	At tests/native-profile-drain-server.test.ts:346 and 431-444, the test expects zero active main-profile requests and a successful profile switch with status 200.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: lidge-j, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the server change: bounded cleanup for live sideband leases.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/propose-fix-for-admission-lease-vulnerability

---

_{Comment @coderabbitai help to get the list of available commands.}