@bitkyc08/opencodex 2.39.0 → 2.40.0

package/src/images/artifacts.ts

@@ -295,6 +295,69 @@ function pickPinnedAddress(addresses: PinnedAddress[]): PinnedAddress {
   return addresses.find(a => a.family === 4) ?? addresses[0]!;
 }
 
+/**
+ * HTTPS-only destination check, public-address resolution, and pinned connect.
+ * Callers own the !ok / 3xx policy so image vs video error text can stay distinct.
+ */
+async function connectPublicHttps(
+  url: string,
+  options: {
+    context: string;
+    signal?: AbortSignal;
+    pinnedDownload?: PinnedDownloadFn;
+    maxBytes?: number;
+  },
+): Promise<Response> {
+  let parsedUrl: URL;
+  try { parsedUrl = new URL(url); } catch { throw new Error(`${options.context} URL is not valid`); }
+  if (parsedUrl.protocol !== "https:") {
+    throw new Error(`${options.context} URL must use HTTPS, got ${parsedUrl.protocol}`);
+  }
+  const assessment = assessUrlDestination(url);
+  if (assessment && assessment.kind !== "public" && assessment.kind !== "hostname") {
+    throw new Error(`${options.context} URL targets ${assessment.detail}`);
+  }
+  const resolved = await resolvePublicAddresses(url, options.context);
+  const pinned = pickPinnedAddress(resolved.addresses);
+  const download = options.pinnedDownload ?? ((resource, peer, signal) =>
+    pinnedHttpGet(resource, peer, signal, {
+      // `maxBytes` is optional in pinnedHttpGet, so forwarding undefined removes the
+      // cap entirely instead of inheriting a default. Keep the 50 MiB ceiling when a
+      // caller omits a limit, and honour an explicit tighter one.
+      maxBytes: options.maxBytes ?? MAX_DOWNLOAD_BYTES,
+      context: `${options.context} download`,
+    }));
+  return download(url, pinned, options.signal);
+}
+
+/**
+ * Fetch a provider-returned image URL after destination-policy + pinned HTTPS.
+ * Redirects are not followed: the default pinned GET returns the status, and this
+ * helper rejects every non-2xx including 3xx. Throws a message that names the
+ * class of failure (scheme / destination kind / download) without reflecting the
+ * target URL.
+ */
+export async function fetchPublicHttpsImage(
+  url: string,
+  options?: {
+    signal?: AbortSignal;
+    pinnedDownload?: PinnedDownloadFn;
+    maxBytes?: number;
+  },
+): Promise<Response> {
+  const resp = await connectPublicHttps(url, {
+    context: "image",
+    signal: options?.signal,
+    pinnedDownload: options?.pinnedDownload,
+    maxBytes: options?.maxBytes,
+  });
+  if (!resp.ok || (resp.status >= 300 && resp.status < 400)) {
+    try { await resp.body?.cancel(); } catch { /* ignore */ }
+    throw new Error("image download failed");
+  }
+  return resp;
+}
+
 export async function downloadImageToArtifact(
   url: string,
   budget?: ImageBudget,
@@ -307,30 +370,11 @@ export async function downloadImageToArtifact(
     return materializeInlineImage(m[2], budget);
   }
 
-  // SSRF protection: validate the provider-returned URL before fetching.
-  // Require HTTPS strictly — plain HTTP and all other schemes (ftp, file, …) are rejected.
-  // Resolve DNS once, then pin that public address for the HTTPS connect (SNI/Host keep
-  // the original hostname) so a rebinding answer cannot retarget the TCP peer.
-  let parsedUrl: URL;
-  try { parsedUrl = new URL(url); } catch { throw new Error("image URL is not valid"); }
-  if (parsedUrl.protocol !== "https:") {
-    throw new Error(`image URL must use HTTPS, got ${parsedUrl.protocol}`);
-  }
-  // Reject literal private/loopback/link-local/metadata addresses.
-  const assessment = assessUrlDestination(url);
-  if (assessment && assessment.kind !== "public" && assessment.kind !== "hostname") {
-    throw new Error(`image URL targets ${assessment.detail}`);
-  }
-  const resolved = await resolvePublicAddresses(url);
-  const pinned = pickPinnedAddress(resolved.addresses);
-  const download = options?.pinnedDownload ?? pinnedHttpsGet;
-  const resp = await download(url, pinned, signal);
-  if (!resp.ok) {
-    // Custom `pinnedDownload` seams may still return a failed Response with a
-    // live body; cancel it so unread error payloads cannot keep the socket warm.
-    try { await resp.body?.cancel(); } catch { /* ignore */ }
-    throw new Error("image download failed: " + resp.status);
-  }
+  const resp = await fetchPublicHttpsImage(url, {
+    signal,
+    pinnedDownload: options?.pinnedDownload,
+    maxBytes: MAX_DOWNLOAD_BYTES,
+  });
 
   // Stream the body with a hard byte cap so a missing/lying Content-Length or a
   // compromised CDN URL cannot exhaust memory before the size check runs.
@@ -433,19 +477,11 @@ export async function downloadVideoToArtifact(
     return dest;
   }
 
-  // SSRF protection: same validation as downloadImageToArtifact
-  let parsedUrl: URL;
-  try { parsedUrl = new URL(url); } catch { throw new Error("video URL is not valid"); }
-  if (parsedUrl.protocol !== "https:") {
-    throw new Error(`video URL must use HTTPS, got ${parsedUrl.protocol}`);
-  }
-  const assessment = assessUrlDestination(url);
-  if (assessment && assessment.kind !== "public" && assessment.kind !== "hostname") {
-    throw new Error(`video URL targets ${assessment.detail}`);
-  }
-  const resolved = await resolvePublicAddresses(url, "video");
-  const pinned = pickPinnedAddress(resolved.addresses);
-  const resp = await pinnedHttpsGet(url, pinned, signal, { maxBytes: MAX_VIDEO_DOWNLOAD_BYTES });
+  const resp = await connectPublicHttps(url, {
+    context: "video",
+    signal,
+    maxBytes: MAX_VIDEO_DOWNLOAD_BYTES,
+  });
   if (!resp.ok) {
     try { await resp.body?.cancel(); } catch { /* ignore */ }
     throw new Error("video download failed: " + resp.status);

package/src/images/fulfill.ts

@@ -91,11 +91,16 @@ export async function fulfillImageCall(
     typeof obj.image_url === "string" ? obj.image_url : typeof obj.image === "string" ? obj.image : undefined;
   const size = typeof obj.size === "string" ? obj.size : plan.defaultSize;
   const quality = typeof obj.quality === "string" ? obj.quality : plan.defaultQuality;
+  // Forward the raw literal and let callXaiImages own validation. Folding "auto"
+  // to undefined here would make the request look like it carried no ratio at
+  // all, so the client would derive one from `size` — the opposite of what an
+  // explicit Auto selection asks for.
+  const aspectRatio = typeof obj.aspect_ratio === "string" ? obj.aspect_ratio : undefined;
 
   let result;
   try {
     result = await callXaiImages(
-      { prompt, model: plan.model, n, imageUrl, size, quality },
+      { prompt, model: plan.model, n, imageUrl, size, quality, aspectRatio },
       plan.auth,
       signal,
       plan.timeoutMs,

package/src/images/index.ts

@@ -1,4 +1,4 @@
-export { planImageBridge, planVideoBridge, findXaiProvider, resolveXaiImageApiKey } from "./plan";
+export { planImageBridge, planVideoBridge, findXaiProvider, resolveXaiImageApiKey, resolveXaiImageAuthToken } from "./plan";
 export { runWithImageBridge, clampImageMaxRounds, DEFAULT_MAX_ROUNDS, MAX_ROUNDS_HARD_LIMIT } from "./loop";
 export type { ImageBridgePlan, ImageCallResult, VideoBridgePlan, VideoCallResult } from "./types";
 export { buildImageTool, buildVideoTool, extractHostedImageGeneration, IMAGE_GEN_TOOL_NAME, VIDEO_GEN_TOOL_NAME, isImageGenName, isVideoGenName } from "./synthetic-tool";

package/src/images/plan.ts

@@ -1,7 +1,8 @@
 import type { OcxConfig, OcxParsedRequest, OcxProviderConfig } from "../types";
 import { toolChoiceToolPredicate } from "../types";
 import type { ImageBridgePlan, VideoBridgePlan } from "./types";
-import { resolveEnvValue } from "../config";
+import { resolveProviderApiKey } from "../providers/key-store";
+import { getValidAccessToken } from "../oauth/index";
 import { getProviderRegistryEntry } from "../providers/registry";
 import { IMAGE_GEN_TOOL_NAME, VIDEO_GEN_TOOL_NAME, isVideoGenName } from "./synthetic-tool";
 
@@ -36,10 +37,23 @@ export function findXaiProvider(config: OcxConfig): { name: string; provider: Oc
  */
 export function resolveXaiImageApiKey(provider: OcxProviderConfig): string | undefined {
   if (provider.authMode === "oauth") return undefined;
-  const apiKey = resolveEnvValue(provider.apiKey)?.trim();
+  const apiKey = resolveProviderApiKey(provider.apiKey)?.trim();
   return apiKey || undefined;
 }
 
+/** Token for the /v1/images → Imagine relay. OAuth reuses the Grok CLI grant. */
+export async function resolveXaiImageAuthToken(provider: OcxProviderConfig): Promise<string | undefined> {
+  if (provider.authMode === "oauth") {
+    try {
+      const token = (await getValidAccessToken("xai"))?.trim();
+      return token || undefined;
+    } catch {
+      return undefined;
+    }
+  }
+  return resolveXaiImageApiKey(provider);
+}
+
 export async function planImageBridge(
   config: OcxConfig,
   parsed: OcxParsedRequest,

package/src/images/synthetic-tool.ts

@@ -80,6 +80,11 @@ export function buildImageTool(): OcxTool {
       properties: {
         prompt: { type: "string", description: "Detailed image generation prompt. Required." },
         n: { type: "integer", minimum: 1, maximum: 4 },
+        aspect_ratio: {
+          type: "string",
+          enum: ["1:1", "16:9", "9:16", "4:3", "3:4", "auto"],
+          description: "Image aspect ratio. Default auto.",
+        },
       },
       required: ["prompt"],
     },

package/src/images/xai-client.ts

@@ -14,6 +14,8 @@ export interface XaiImageRequest {
   n?: number; // 1-4
   size?: string;
   quality?: string;
+  /** Literal xAI aspect_ratio. Wins over `size` when both are present. */
+  aspectRatio?: string;
   imageUrl?: string; // if set → /images/edits
 }
 
@@ -35,6 +37,25 @@ const XAI_ASPECT_RATIOS: ReadonlyArray<readonly [string, number]> = [
   ["9:16", 0.5625],
   ["16:9", 16 / 9],
 ];
+const XAI_ASPECT_RATIO_LITERALS = new Set(XAI_ASPECT_RATIOS.map(([label]) => label));
+
+/** Accept a hosted/Codex `aspect_ratio` literal; `auto` and unknown values drop. */
+export function resolveXaiAspectRatioLiteral(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const literal = value.trim();
+  if (!literal || literal === "auto") return undefined;
+  return XAI_ASPECT_RATIO_LITERALS.has(literal) ? literal : undefined;
+}
+
+function resolveAspectRatio(req: XaiImageRequest): string | undefined {
+  // An explicit aspect_ratio owns the decision even when it resolves to nothing:
+  // "auto" means "let xAI choose", so falling back to a size-derived ratio would
+  // silently override the caller. Only an absent field consults `size`.
+  if (req.aspectRatio !== undefined && req.aspectRatio.trim()) {
+    return resolveXaiAspectRatioLiteral(req.aspectRatio);
+  }
+  return mapSizeToAspectRatio(req.size);
+}
 
 function mapSizeToAspectRatio(size?: string): string | undefined {
   if (!size) return undefined;
@@ -75,7 +96,7 @@ export async function callXaiImages(
     prompt: req.prompt,
     n: req.n ?? 1,
   };
-  const aspectRatio = mapSizeToAspectRatio(req.size);
+  const aspectRatio = resolveAspectRatio(req);
   const resolution = mapQualityToResolution(req.quality);
   if (aspectRatio) body.aspect_ratio = aspectRatio;
   if (resolution) body.resolution = resolution;
@@ -98,8 +119,20 @@ export async function callXaiImages(
     },
     body: JSON.stringify(body),
     signal: linkedSignal,
+    // Do not follow 3xx while carrying the xAI bearer. Bun may strip Authorization
+    // cross-origin but still leave the request on the redirect target.
+    redirect: "manual",
   });
 
+  const redirected = resp.type === "opaqueredirect" || (resp.status >= 300 && resp.status < 400);
+  if (redirected) {
+    try { await resp.body?.cancel(); } catch { /* ignore */ }
+    const status = resp.status >= 300 && resp.status < 400 ? resp.status : 302;
+    const err = new Error("xAI images API returned " + status) as Error & { status: number };
+    err.status = status;
+    throw err;
+  }
+
   if (!resp.ok) {
     try { await resp.body?.cancel(); } catch { /* ignore */ }
     const err = new Error("xAI images API returned " + resp.status) as Error & { status: number };

package/src/integrations/cursor-detect.ts

@@ -0,0 +1,133 @@
+/**
+ * Detect Cursor desktop installs and tell the two builds apart.
+ *
+ * Cursor ships a second desktop distribution, "Cursor Private Inference", whose agent loop
+ * runs locally and calls an OpenAI-compatible gateway the user configures. That build can
+ * reach opencodex on loopback. Regular Cursor cannot: its backend calls the custom base URL
+ * and rejects private addresses. The two share a bundle id, data folder and URL scheme, so
+ * the only reliable discriminator is `nameLong` in the app's `product.json`.
+ *
+ * Detection is read-only and injectable: the proxy never writes anything into a Cursor
+ * install, its state database, or its keychain entries (the T20 exclusion in
+ * devlog/_plan/260822_senpi_cursor_transfer/090), and the tests run against a temp tree.
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+
+export type CursorBuild = "private-inference" | "regular";
+
+export interface CursorInstall {
+  build: CursorBuild;
+  /** The install root (the .app bundle, install directory, or AppImage extraction root). */
+  path: string;
+  version: string | null;
+}
+
+export interface CursorDetectDeps {
+  platform: string;
+  homedir: string;
+  env: Record<string, string | undefined>;
+  readText(path: string): string | null;
+  listDir(path: string): string[];
+}
+
+export function realCursorDetectDeps(): CursorDetectDeps {
+  return {
+    platform: process.platform,
+    homedir: homedir(),
+    env: process.env,
+    readText: path => {
+      try {
+        return existsSync(path) ? readFileSync(path, "utf-8") : null;
+      } catch {
+        return null;
+      }
+    },
+    listDir: path => {
+      try {
+        return readdirSync(path);
+      } catch {
+        return [];
+      }
+    },
+  };
+}
+
+const PRIVATE_INFERENCE_NAME = "Cursor Private Inference";
+const REGULAR_NAME = "Cursor";
+
+/**
+ * Candidate `product.json` paths per platform, each paired with the install root it
+ * belongs to. Only well-known locations; a custom install path is the user's to name.
+ */
+export function cursorProductJsonCandidates(deps: CursorDetectDeps): Array<{ root: string; productJson: string }> {
+  const out: Array<{ root: string; productJson: string }> = [];
+  // Join with the target platform's separator so the candidate list is stable in tests
+  // that describe another OS from this one.
+  const { join } = deps.platform === "win32" ? win32 : posix;
+  if (deps.platform === "darwin") {
+    for (const dir of ["/Applications", join(deps.homedir, "Applications")]) {
+      for (const entry of deps.listDir(dir)) {
+        if (!/^Cursor.*\.app$/i.test(entry)) continue;
+        const root = join(dir, entry);
+        out.push({ root, productJson: join(root, "Contents", "Resources", "app", "product.json") });
+      }
+    }
+    return out;
+  }
+  if (deps.platform === "win32") {
+    const bases = [
+      deps.env.LOCALAPPDATA ? join(deps.env.LOCALAPPDATA, "Programs") : null,
+      deps.env.ProgramFiles ?? null,
+    ].filter((value): value is string => value !== null);
+    for (const dir of bases) {
+      for (const entry of deps.listDir(dir)) {
+        if (!/^cursor/i.test(entry)) continue;
+        const root = join(dir, entry);
+        out.push({ root, productJson: join(root, "resources", "app", "product.json") });
+      }
+    }
+    return out;
+  }
+  // Linux: AppImages carry product.json only once extracted, so this covers the tarball /
+  // package layouts and stays best-effort.
+  for (const dir of ["/opt", join(deps.homedir, ".local", "share")]) {
+    for (const entry of deps.listDir(dir)) {
+      if (!/^cursor/i.test(entry)) continue;
+      const root = join(dir, entry);
+      out.push({ root, productJson: join(root, "resources", "app", "product.json") });
+    }
+  }
+  return out;
+}
+
+function classify(productJson: string): { build: CursorBuild; version: string | null } | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(productJson);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const record = parsed as { nameLong?: unknown; version?: unknown };
+  const version = typeof record.version === "string" ? record.version : null;
+  if (record.nameLong === PRIVATE_INFERENCE_NAME) return { build: "private-inference", version };
+  if (record.nameLong === REGULAR_NAME) return { build: "regular", version };
+  return null;
+}
+
+export function detectCursorInstalls(deps: CursorDetectDeps = realCursorDetectDeps()): CursorInstall[] {
+  const found: CursorInstall[] = [];
+  const seen = new Set<string>();
+  for (const candidate of cursorProductJsonCandidates(deps)) {
+    if (seen.has(candidate.root)) continue;
+    const text = deps.readText(candidate.productJson);
+    if (text === null) continue;
+    const classified = classify(text);
+    if (!classified) continue;
+    seen.add(candidate.root);
+    found.push({ build: classified.build, path: candidate.root, version: classified.version });
+  }
+  return found;
+}

package/src/integrations/cursor-seen.ts

@@ -0,0 +1,31 @@
+/**
+ * Remember the last time a Cursor client asked this proxy for its model list.
+ *
+ * The Integrations page cannot read Cursor's own settings (and must not write them), so
+ * "is Cursor pointed at me?" is answered from our side: Cursor's local-agent runtime sends
+ * `User-Agent: Cursor/<version>` on `GET /v1/models`. Only that header value and a
+ * timestamp are kept, in memory, so a proxy restart forgets it and the card says so.
+ */
+// Attacker-controlled header: accept only the shape Cursor sends and keep it short.
+const CURSOR_USER_AGENT = /^Cursor\/[\w.+-]{1,40}$/;
+
+export interface CursorSeen {
+  at: number;
+  userAgent: string;
+}
+
+let last: CursorSeen | null = null;
+
+export function recordCursorSeen(headers: Headers, now = Date.now()): void {
+  const userAgent = headers.get("user-agent")?.trim() ?? "";
+  if (!CURSOR_USER_AGENT.test(userAgent)) return;
+  last = { at: now, userAgent };
+}
+
+export function cursorLastSeen(): CursorSeen | null {
+  return last ? { ...last } : null;
+}
+
+export function resetCursorSeenForTests(): void {
+  last = null;
+}

package/src/lib/errors.ts

@@ -4,6 +4,24 @@ export interface OcxErrorPayload {
   code: string | null;
 }
 
+/** Canonical human-readable message paths used by Responses upstream failures. */
+export function upstreamErrorMessageFromPayload(payload: unknown): string | undefined {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return undefined;
+  const json = payload as {
+    error?: { message?: unknown };
+    last_error?: { message?: unknown };
+    response?: {
+      error?: { message?: unknown };
+      incomplete_details?: { message?: unknown };
+    };
+  };
+  const message = json.error?.message
+    ?? json.last_error?.message
+    ?? json.response?.error?.message
+    ?? json.response?.incomplete_details?.message;
+  return typeof message === "string" ? message : undefined;
+}
+
 /** OpenAI / Codex hard block for high-risk cybersecurity activity (HTTP 400 or mid-stream). */
 export const CYBER_POLICY_ERROR_CODE = "cyber_policy";
 export const CYBER_POLICY_FALLBACK_MESSAGE = "Request blocked by the upstream cybersecurity policy.";

package/src/lib/gui-pair-capability.ts

@@ -0,0 +1,104 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { isLocalAttestationSecret } from "./local-management-attestation";
+
+export const GUI_PAIR_METHOD = "POST";
+export const GUI_PAIR_PATH = "/api/gui/pairing-grants";
+export const GUI_PAIR_CAPABILITY_VERSION = "v1";
+export const GUI_PAIR_EXPECTED_PID_HEADER = "x-opencodex-gui-pair-expected-pid";
+export const GUI_PAIR_NONCE_HEADER = "x-opencodex-gui-pair-nonce";
+export const GUI_PAIR_EXPIRES_AT_HEADER = "x-opencodex-gui-pair-expires-at";
+export const GUI_PAIR_BROWSER_ORIGIN_HEADER = "x-opencodex-gui-pair-origin";
+export const GUI_PAIR_CAPABILITY_HEADER = "x-opencodex-gui-pair-capability";
+export const GUI_PAIR_CAPABILITY_TTL_MS = 10_000;
+
+const BASE64URL_256 = /^[A-Za-z0-9_-]{43}$/;
+
+export type ExpectedGuiPairPid =
+  | { kind: "absent" }
+  | { kind: "invalid" }
+  | { kind: "present"; pid: number };
+
+export function parseExpectedGuiPairPid(value: string | null): ExpectedGuiPairPid {
+  if (value === null) return { kind: "absent" };
+  if (!/^[1-9]\d*$/.test(value)) return { kind: "invalid" };
+  const pid = Number(value);
+  return Number.isSafeInteger(pid) ? { kind: "present", pid } : { kind: "invalid" };
+}
+
+export function canonicalGuiBrowserOrigin(value: unknown): string | null {
+  if (typeof value !== "string" || value !== value.trim()) return null;
+  try {
+    const parsed = new URL(value);
+    if (!parsed.host || parsed.username || parsed.password || parsed.search || parsed.hash) return null;
+    if (parsed.pathname !== "" && parsed.pathname !== "/") return null;
+    if (parsed.protocol === "http:" || parsed.protocol === "https:") return parsed.origin;
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return null;
+  }
+}
+
+function capabilityPayload(
+  nonce: string,
+  method: string,
+  path: string,
+  browserOrigin: string,
+  pid: number,
+  port: number,
+  expiresAt: number,
+): string | null {
+  if (!BASE64URL_256.test(nonce)) return null;
+  if (method !== GUI_PAIR_METHOD || path !== GUI_PAIR_PATH) return null;
+  const canonicalOrigin = canonicalGuiBrowserOrigin(browserOrigin);
+  if (!canonicalOrigin || canonicalOrigin !== browserOrigin) return null;
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+  if (!Number.isSafeInteger(expiresAt) || expiresAt <= 0) return null;
+  return `opencodex-gui-pair-v1\n${nonce}\n${method}\n${path}\n${browserOrigin}\n${pid}\n${port}\n${expiresAt}`;
+}
+
+export function createGuiPairCapability(
+  secret: string,
+  nonce: string,
+  method: string,
+  path: string,
+  browserOrigin: string,
+  pid: number,
+  port: number,
+  expiresAt: number,
+): string | null {
+  if (!isLocalAttestationSecret(secret)) return null;
+  const payload = capabilityPayload(nonce, method, path, browserOrigin, pid, port, expiresAt);
+  if (!payload) return null;
+  return createHmac("sha256", secret).update(payload).digest("base64url");
+}
+
+export function verifyGuiPairCapability(
+  secret: string,
+  nonce: string | null,
+  method: string,
+  path: string,
+  browserOrigin: string | null,
+  pid: number,
+  port: number,
+  expiresAt: number,
+  capability: string | null,
+  now = Date.now(),
+): boolean {
+  if (!nonce || !browserOrigin || !capability || !BASE64URL_256.test(capability)) return false;
+  if (!Number.isSafeInteger(now) || expiresAt <= now || expiresAt > now + GUI_PAIR_CAPABILITY_TTL_MS) return false;
+  const expected = createGuiPairCapability(
+    secret,
+    nonce,
+    method,
+    path,
+    browserOrigin,
+    pid,
+    port,
+    expiresAt,
+  );
+  if (!expected) return false;
+  const expectedBytes = Buffer.from(expected);
+  const actualBytes = Buffer.from(capability);
+  return expectedBytes.length === actualBytes.length && timingSafeEqual(expectedBytes, actualBytes);
+}

package/src/lib/lab-live-route-production.ts

@@ -8,6 +8,7 @@
  * @internal host integration only
  */
 import { resolveEnvValue } from "../config";
+import { resolveProviderApiKey } from "../providers/key-store";
 import {
   getValidAccessTokenSnapshot,
   OAuthLoginRequiredError,
@@ -75,7 +76,7 @@ async function buildLabProviderAuthHeaders(
       throw new TransportError("harness_failure", "oauth refresh unavailable");
     }
   } else {
-    const apiKey = resolveEnvValue(provider.apiKey)?.trim();
+    const apiKey = resolveProviderApiKey(provider.apiKey)?.trim();
     if (!apiKey) throw new TransportError("auth_blocked", "missing api key");
     if (provider.adapter === "anthropic" && provider.apiKeyTransport === "x-api-key") {
       headers["x-api-key"] = apiKey;

package/src/lib/process-control.ts

@@ -132,8 +132,8 @@ function drainDeadlineMs(): number {
 }
 
 /** Graceful-first stop: management-API drain, then the platform kill ladder. */
-export async function stopProxy(pid: number, io: GracefulStopIo = {}): Promise<void> {
-  if (!isProcessAlive(pid)) return;
+export async function stopProxy(pid: number, io: GracefulStopIo = {}): Promise<boolean> {
+  if (!isProcessAlive(pid)) return false;
   const runtime = io.runtimeEndpoint ?? readRuntimePort(pid);
   const graceful = await stopProxyGracefully(pid, io);
   if (graceful === "refused") {
@@ -146,10 +146,11 @@ export async function stopProxy(pid: number, io: GracefulStopIo = {}): Promise<v
   }
   if (graceful) {
     await waitForStoppedPort(runtime, pid);
-    return;
+    return true;
   }
   killProxy(pid);
   await waitForStoppedPort(runtime, pid);
+  return false;
 }
 
 /** After stop/kill, wait for the former listen port to become bindable (Windows drain). */