@bitkyc08/opencodex 2.43.0 → 2.44.0

package/src/integrations/aside-profiles.ts

@@ -0,0 +1,176 @@
+import type { AsideProfile } from "../clients/aside-profiles";
+import { asideHomeDir } from "../clients/config-export";
+import { join } from "node:path";
+import type { OwnedIntegrationRefreshOutcome } from "./owned-refresh";
+import { readIntegrationState, type IntegrationState, type IntegrationStatus } from "./state";
+import {
+  applyIntegrationCoordinated, disableIntegrationCoordinated,
+  overwriteIntegrationCoordinated, refreshIntegrationCoordinated,
+} from "./writer";
+import {
+  asideProfileEnabled, asideProfileFailure, asideProfileScope, asideWriteInput,
+  asideRootStore, createAsideProfileContext, persistAsidePolicy, runAsideProfileAction, selectAsideProfiles,
+  type AsideProfileContext, type AsideProfilesInput, type AsideProfileWriteOutcome,
+} from "./aside-profile-context";
+
+export { AsideProfileError } from "./aside-profile-context";
+export type { AsideProfilesInput, AsideProfileWriteOutcome } from "./aside-profile-context";
+
+export interface AsideProfileState extends IntegrationStatus {
+  profileId: number;
+  name?: string;
+  current: boolean;
+  enabled: boolean;
+  error?: string;
+}
+
+export interface AsideProfileList extends IntegrationStatus {
+  profiles: AsideProfileState[];
+  allEnabled: boolean;
+  enabledCount: number;
+  appliedCount: number;
+  total: number;
+  error?: string;
+}
+
+export interface AsideProfileMutationResult {
+  ok: boolean;
+  clientId: "aside";
+  changed: boolean;
+  state: IntegrationState;
+  message: string;
+  results: AsideProfileWriteOutcome[];
+  /** Preserve the ordinary refusal serializer for a single selected profile. */
+  result?: AsideProfileWriteOutcome;
+}
+
+function aggregateState(states: readonly IntegrationState[]): IntegrationState {
+  if (states.includes("unsafe")) return "unsafe";
+  if (states.includes("conflict")) return "conflict";
+  if (states.every(state => state === "absent")) return "absent";
+  return states.every(state => state === "current") ? "current" : "stale";
+}
+
+async function profileState(ctx: AsideProfileContext, profile: AsideProfile): Promise<AsideProfileState> {
+  const metadata = {
+    profileId: profile.id, ...(profile.name !== undefined ? { name: profile.name } : {}),
+    current: profile.current, enabled: asideProfileEnabled(ctx, profile.id),
+  };
+  try {
+    const scope = asideProfileScope(ctx, profile);
+    const input = await asideWriteInput(ctx, scope);
+    return { ...readIntegrationState(input), ...metadata };
+  } catch (error) {
+    return {
+      clientId: "aside", ...metadata, state: "unsafe", installed: false,
+      configPath: profile.configPath, reason: "unresolvable-path", snapshotCount: -1,
+      retentionDegraded: true, error: asideProfileFailure(profile.id, error).message,
+    };
+  }
+}
+
+export async function listAsideProfileStates(input: AsideProfilesInput): Promise<AsideProfileList> {
+  let ctx: AsideProfileContext;
+  try { ctx = createAsideProfileContext(input); }
+  catch (error) {
+    return {
+      clientId: "aside", profiles: [], total: 0, enabledCount: 0, appliedCount: 0, allEnabled: false,
+      state: "unsafe", installed: false, configPath: join(asideHomeDir(input.env, input.home), "u"),
+      snapshotCount: -1, retentionDegraded: true, reason: "unresolvable-path",
+      error: asideProfileFailure(0, error).message,
+    };
+  }
+  const profiles: AsideProfileState[] = [];
+  for (const profile of ctx.profiles) profiles.push(await profileState(ctx, profile));
+  const enabledCount = profiles.filter(profile => profile.enabled).length;
+  const snapshotCount = profiles.some(profile => profile.snapshotCount < 0) ? -1
+    : profiles.reduce((sum, profile) => sum + profile.snapshotCount, 0);
+  return {
+    clientId: "aside", profiles, total: profiles.length, enabledCount,
+    allEnabled: profiles.length > 0 && enabledCount === profiles.length,
+    appliedCount: profiles.filter(profile => profile.state === "current" || profile.state === "stale").length,
+    state: aggregateState(profiles.map(profile => profile.state)),
+    installed: profiles.some(profile => profile.installed),
+    configPath: profiles.find(profile => profile.current)?.configPath ?? profiles[0]?.configPath ?? "",
+    snapshotCount, retentionDegraded: profiles.some(profile => profile.retentionDegraded),
+  };
+}
+
+export async function getAsideProfileState(input: AsideProfilesInput, id: number): Promise<AsideProfileState> {
+  const ctx = createAsideProfileContext(input);
+  return profileState(ctx, selectAsideProfiles(ctx, id)[0]!);
+}
+
+export function mutateAsideProfiles(
+  input: AsideProfilesInput,
+  change: { enabled: boolean; profileId?: number; overwriteConflict?: boolean },
+): Promise<AsideProfileMutationResult> {
+  return runAsideProfileAction<AsideProfileMutationResult>(input, change.profileId, `${change.enabled ? "enable" : "disable"}:${Boolean(change.overwriteConflict)}`, async (ctx, profiles) => {
+    const refused = new Map<number, AsideProfileWriteOutcome>();
+    for (const profile of profiles) {
+      try { asideProfileScope(ctx, profile); }
+      catch (error) { refused.set(profile.id, asideProfileFailure(profile.id, error)); }
+    }
+    // This await precedes model loading, writer preflight, snapshots and all client writes.
+    await persistAsidePolicy(ctx, change);
+    const results: AsideProfileWriteOutcome[] = [];
+    for (const profile of profiles) {
+      const refusal = refused.get(profile.id);
+      if (refusal) { results.push(refusal); continue; }
+      try {
+        const scope = asideProfileScope(ctx, profile);
+        const bound = await asideWriteInput(ctx, scope);
+        const operation = !change.enabled ? disableIntegrationCoordinated
+          : change.overwriteConflict ? overwriteIntegrationCoordinated : applyIntegrationCoordinated;
+        results.push({ ...await operation(bound, { lockSeams: input.lockSeams }), profileId: profile.id });
+      } catch (error) { results.push(asideProfileFailure(profile.id, error)); }
+    }
+    const ok = results.every(result => result.ok);
+    return {
+      ok, clientId: "aside", changed: results.some(result => result.ok && result.changed),
+      state: aggregateState(results.map(result => result.state)),
+      message: ok ? "Aside profile preferences applied" : "Aside preferences saved; some profiles could not be updated",
+      results, ...(results.length === 1 ? { result: results[0] } : {}),
+    };
+  });
+}
+
+export function refreshAsideProfiles(input: AsideProfilesInput): Promise<Array<OwnedIntegrationRefreshOutcome & { profileId: number }>> {
+  const policy = input.config.asideProfileSync;
+  const selected = Object.values(policy?.profiles ?? {}).some(enabled => enabled === true);
+  if (!selected && (policy?.allProfiles === false
+    || (policy?.allProfiles !== true && !asideRootStore(input).readRecords().aside))) return Promise.resolve([]);
+  return runAsideProfileAction(input, undefined, "refresh", async (ctx, profiles) => {
+    const outcomes: Array<OwnedIntegrationRefreshOutcome & { profileId: number }> = [];
+    for (const profile of profiles) {
+      if (!asideProfileEnabled(ctx, profile.id)) continue;
+      try {
+        const scope = asideProfileScope(ctx, profile);
+        const owned = scope.store.readRecords().aside !== undefined;
+        const bound = await asideWriteInput(ctx, scope);
+        // A surviving ownership record means a removed block stays removed.
+        // A newly discovered, enabled profile may receive its first safe apply.
+        const operation = owned ? refreshIntegrationCoordinated : applyIntegrationCoordinated;
+        const result = await operation(bound, { lockSeams: input.lockSeams });
+        outcomes.push({
+          client: "aside", profileId: profile.id, ok: result.ok,
+          ...(result.ok ? { changed: result.changed } : {}),
+          ...(!result.ok || result.state === "absent" ? { reason: result.message } : {}),
+          ...(!result.ok ? {
+            refusalReason: result.reason, state: result.state,
+            ...(result.snapshotPath ? { snapshotPath: result.snapshotPath } : {}),
+            ...(result.residual ? { residual: true } : {}),
+          } : {}),
+        });
+      } catch (error) {
+        const failure = asideProfileFailure(profile.id, error);
+        outcomes.push({ client: "aside", profileId: profile.id, ok: false, reason: failure.message,
+          ...(!failure.ok ? { refusalReason: failure.reason, state: failure.state,
+            ...(failure.snapshotPath ? { snapshotPath: failure.snapshotPath } : {}),
+            ...(failure.residual ? { residual: true } : {}) } : {}),
+        });
+      }
+    }
+    return outcomes;
+  });
+}

package/src/integrations/catalog-refresh.ts

@@ -0,0 +1,40 @@
+import { redactSecretString } from "../lib/redact";
+import type { ExportModel } from "../clients/config-export";
+import type { IntegrationClientId } from "./registry";
+import {
+  refreshOwnedIntegration,
+  type OwnedIntegrationRefreshInput,
+  type OwnedIntegrationRefreshOutcome,
+} from "./owned-refresh";
+
+/** Refresh only previously connected clients; a refused file never blocks its peers. */
+export async function refreshOwnedCatalogIntegrations(
+  input: Omit<OwnedIntegrationRefreshInput, "clientId">,
+  clientIds: readonly IntegrationClientId[] = ["pi", "aside"],
+): Promise<OwnedIntegrationRefreshOutcome[]> {
+  let models: Promise<readonly ExportModel[]> | undefined;
+  const loadModels = () => models ??= Promise.resolve().then(() =>
+    typeof input.models === "function" ? input.models() : input.models);
+  const outcomes: OwnedIntegrationRefreshOutcome[] = [];
+  for (const clientId of clientIds) {
+    try {
+      if (clientId === "aside") {
+        const { refreshAsideProfiles } = await import("./aside-profiles");
+        outcomes.push(...await refreshAsideProfiles({ ...input, models: loadModels }));
+        continue;
+      }
+      const result = await refreshOwnedIntegration({ ...input, clientId, models: loadModels });
+      if (result) outcomes.push(result);
+    } catch (error) {
+      const busy = error !== null && typeof error === "object"
+        && "code" in error && error.code === "integration_mutation_busy";
+      outcomes.push({
+        client: clientId,
+        ok: false,
+        reason: busy ? "integration_mutation_busy"
+          : redactSecretString(error instanceof Error ? error.message : String(error)),
+      });
+    }
+  }
+  return outcomes;
+}

package/src/integrations/config-io.ts

@@ -162,7 +162,22 @@ export function parseConfig(text: string | null, format: ConfigFormat): unknown
          * evidence is gone.
          */
         if (/(^|[\s,[=])[-+]?(?:inf|nan)(?=[\s,\]]|$)/mi.test(text)) return PARSE_FAILED;
-        return Bun.TOML.parse(text);
+        const document = Bun.TOML.parse(text);
+        // TOML date/time scalars are Temporal objects with toJSON methods.
+        // The merge layer JSON-clones documents, which silently turns these
+        // into strings. Refuse before either status or a writer can admit a
+        // lossy rewrite, including dates nested in arrays and inline tables.
+        const pending: unknown[] = [document];
+        while (pending.length > 0) {
+          const value = pending.pop();
+          if (value === null || typeof value !== "object") continue;
+          if (!Array.isArray(value)) {
+            const prototype = Object.getPrototypeOf(value);
+            if (prototype !== Object.prototype && prototype !== null) return PARSE_FAILED;
+          }
+          for (const child of Object.values(value)) pending.push(child);
+        }
+        return document;
       }
     }
   } catch {

package/src/integrations/owned-refresh.ts

@@ -27,6 +27,8 @@ export interface OwnedIntegrationRefreshInput {
   home?: string;
   store?: IntegrationStateStore;
   io?: IntegrationIO;
+  /** Internal profile target selected before entering the coordinated writer. */
+  resolvedPaths?: { configPath: string; detectDir: string };
 }
 
 export interface OwnedIntegrationRefreshOutcome {
@@ -34,6 +36,11 @@ export interface OwnedIntegrationRefreshOutcome {
   readonly ok: boolean;
   readonly changed?: boolean;
   readonly reason?: string;
+  readonly profileId?: number;
+  readonly refusalReason?: string;
+  readonly state?: string;
+  readonly snapshotPath?: string;
+  readonly residual?: boolean;
 }
 
 /**
@@ -59,7 +66,9 @@ export async function refreshOwnedIntegration(
   const bound = { ...rest, models, store };
   const result = await runIntegrationMutationFlight(
     input.clientId,
-    "refresh",
+    // Separate catalog snapshots must not inherit another refresh's success.
+    // The shared flight owner returns busy for overlapping operations instead.
+    `refresh:${crypto.randomUUID()}`,
     input.io?.now ?? Date.now,
     () => refreshIntegrationCoordinated(bound, options),
   );
@@ -70,5 +79,8 @@ export async function refreshOwnedIntegration(
         changed: result.changed,
         ...(result.state === "absent" ? { reason: result.message } : {}),
       }
-    : { client: input.clientId, ok: false, reason: result.message };
+    : { client: input.clientId, ok: false, reason: result.message, refusalReason: result.reason, state: result.state,
+        ...(result.snapshotPath ? { snapshotPath: result.snapshotPath } : {}),
+        ...(result.residual ? { residual: true } : {}),
+      };
 }

package/src/integrations/state.ts

@@ -352,6 +352,8 @@ export interface IntegrationStateInput {
   /** The whole integration state store, bound to one root. */
   store?: IntegrationStateStore;
   io?: IntegrationIO;
+  /** Internal explicit profile target; never accepted as a caller-provided path. */
+  resolvedPaths?: { configPath: string; detectDir: string };
 }
 
 export function exportContextOf(input: {
@@ -431,7 +433,7 @@ export function readIntegrationState(input: IntegrationStateInput): IntegrationS
   try {
     // One resolution for both, so a client whose paths come from mutable state
     // cannot report one account's install beside another account's config path.
-    const paths = resolveIntegrationPaths(input.clientId, input.env, input.home);
+    const paths = input.resolvedPaths ?? resolveIntegrationPaths(input.clientId, input.env, input.home);
     configPath = paths.configPath;
     installed = io.statKind(paths.detectDir) === "dir";
   } catch (error) {

package/src/integrations/writer.ts

@@ -711,7 +711,9 @@ function freezeIntegrationInput(input: IntegrationWriteInput): FrozenIntegration
    * its manifest, so two independent calls could verify one account's install
    * and then write another account's catalog if a switch landed between them.
    */
-  const resolvedPaths = resolveIntegrationPaths(input.clientId, env, home);
+  const resolvedPaths = input.resolvedPaths
+    ? { ...input.resolvedPaths }
+    : resolveIntegrationPaths(input.clientId, env, home);
   return { ...input, env, home, store, io, resolvedPaths };
 }
 

package/src/lab/fabric/producer-isolate.ts

@@ -84,6 +84,11 @@ function killChild(child: ChildProcess): void {
 export async function runIsolatedFabricProducer(request: IsolateRequest): Promise<IsolatedProducerResult> {
   const now = request.now ?? (() => Date.now());
   let lastActivityAt = now();
+  // Budget enforcement must not follow wall-clock adjustments; telemetry still does.
+  const budgetNow = request.now ?? (() => performance.now());
+  const startedAt = request.now ? lastActivityAt : budgetNow();
+  const totalDeadline = startedAt + request.totalTimeoutMs;
+  let inactivityDeadline = startedAt + request.inactivityTimeoutMs;
 
   return await new Promise<IsolatedProducerResult>((resolve, reject) => {
     let child: ChildProcess;
@@ -104,48 +109,74 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
     let stdoutBuffer = "";
     let stderrBytes = 0;
     let settled = false;
+    let childClosed = false;
     let receivedResult: SyntheticPatchV1 | undefined;
     let killReason: FabricTaskError | undefined;
 
     const finish = (fn: () => void) => {
-      if (settled) return;
+      // A latched failure owns settlement, but scratch cleanup must wait for close.
+      if (settled || (killReason && !childClosed)) return;
       settled = true;
       clearTimeout(totalTimer);
       clearTimeout(inactivityTimer);
-      fn();
+      if (killReason) reject(killReason);
+      else fn();
     };
 
     const settleTimeout = (error: FabricTaskError) => {
-      if (settled) return;
+      if (settled || killReason) return;
       killReason = error;
-      killChild(child);
+      if (childClosed) finish(() => reject(error));
+      else killChild(child);
+    };
+
+    const expiredDeadline = (at: number): FabricTaskError | undefined => {
+      // Choose the earliest deadline, regardless of which timer/data callback ran first.
+      if (at >= inactivityDeadline && inactivityDeadline <= totalDeadline) {
+        return new FabricTaskError("inactivity timeout exceeded", "inactivity_timeout", "environment");
+      }
+      if (at >= totalDeadline) {
+        return new FabricTaskError("total timeout exceeded", "timeout", "environment");
+      }
+      return undefined;
+    };
+
+    const onInactivityTimeout = () => {
+      settleTimeout(expiredDeadline(budgetNow())
+        ?? new FabricTaskError("inactivity timeout exceeded", "inactivity_timeout", "environment"));
     };
 
     const armInactivity = () => {
       clearTimeout(inactivityTimer);
-      inactivityTimer = setTimeout(() => {
-        settleTimeout(new FabricTaskError("inactivity timeout exceeded", "inactivity_timeout", "environment"));
-      }, request.inactivityTimeoutMs);
+      inactivityTimer = setTimeout(onInactivityTimeout, request.inactivityTimeoutMs);
     };
 
-    let inactivityTimer: ReturnType<typeof setTimeout> = setTimeout(() => {
-      settleTimeout(new FabricTaskError("inactivity timeout exceeded", "inactivity_timeout", "environment"));
-    }, request.inactivityTimeoutMs);
+    let inactivityTimer: ReturnType<typeof setTimeout> = setTimeout(onInactivityTimeout, request.inactivityTimeoutMs);
 
     const totalTimer = setTimeout(() => {
-      settleTimeout(new FabricTaskError("total timeout exceeded", "timeout", "environment"));
+      settleTimeout(expiredDeadline(budgetNow())
+        ?? new FabricTaskError("total timeout exceeded", "timeout", "environment"));
     }, request.totalTimeoutMs);
 
     const handleProtocolLine = (line: string) => {
+      if (settled || killReason) return;
       try {
         const message = parseProducerProtocolLine(line);
-        if (message.type === "activity") {
-          lastActivityAt = now();
-          armInactivity();
-          return;
+        if (message.type === "activity" || message.type === "result") {
+          const at = budgetNow();
+          const expired = expiredDeadline(at);
+          if (expired) {
+            settleTimeout(expired);
+            return;
+          }
+          if (message.type === "activity") {
+            lastActivityAt = request.now ? at : now();
+            inactivityDeadline = at + request.inactivityTimeoutMs;
+            armInactivity();
+            return;
+          }
         }
         if (message.type === "result") {
-          if (settled) return;
           receivedResult = message.patch;
           finish(() => resolve({ patch: message.patch, lastActivityAt }));
           return;
@@ -176,6 +207,7 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
     };
 
     const consumeStdout = (chunk: string) => {
+      if (settled || killReason) return;
       stdoutBuffer += chunk;
       if (Buffer.byteLength(stdoutBuffer, "utf8") > FABRIC_PRODUCER_PROTOCOL_MAX_BYTES) {
         settleTimeout(new FabricTaskError("producer protocol output exceeded limit", "budget_exhausted", "environment"));
@@ -207,16 +239,50 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
       }
     });
 
+    child.stderr?.on("error", (error) => {
+      settleTimeout(new FabricTaskError(error.message, "harness_failure", "harness"));
+    });
+
     child.on("error", (error) => {
       finish(() => reject(new FabricTaskError(error.message, "harness_failure", "harness")));
     });
 
     child.stdin?.on("error", (error: NodeJS.ErrnoException) => {
-      if (settled || error.code === "EPIPE") return;
+      if (settled || killReason || error.code === "EPIPE") return;
       killChild(child);
       finish(() => reject(new FabricTaskError(error.message, "harness_failure", "harness")));
     });
 
+    child.on("close", (code, signal) => {
+      childClosed = true;
+      if (settled) return;
+      if (killReason) {
+        finish(() => reject(killReason!));
+        return;
+      }
+      if (receivedResult) {
+        finish(() => resolve({ patch: receivedResult!, lastActivityAt }));
+        return;
+      }
+      if (stdoutBuffer.trim()) {
+        try {
+          handleProtocolLine(stdoutBuffer.trim());
+          if (settled) return;
+        } catch {
+          /* fall through */
+        }
+      }
+      if (signal === "SIGKILL") {
+        finish(() => reject(new FabricTaskError("total timeout exceeded", "timeout", "environment")));
+        return;
+      }
+      finish(() => reject(new FabricTaskError(
+        code === 0 ? "isolated producer returned no result" : `isolated producer exited (${code ?? signal ?? "unknown"})`,
+        "harness_failure",
+        "harness",
+      )));
+    });
+
     const payload = JSON.stringify({
       harnessKind: request.harnessKind,
       executorModulePath: request.executorModulePath,
@@ -242,6 +308,7 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
       child.stdin?.write(payload);
       child.stdin?.end();
     } catch (error) {
+      if (killReason) return;
       killChild(child);
       finish(() => reject(new FabricTaskError(
         error instanceof Error ? error.message : String(error),
@@ -250,35 +317,6 @@ export async function runIsolatedFabricProducer(request: IsolateRequest): Promis
       )));
       return;
     }
-
-    child.on("close", (code, signal) => {
-      if (settled) return;
-      if (killReason) {
-        finish(() => reject(killReason!));
-        return;
-      }
-      if (receivedResult) {
-        finish(() => resolve({ patch: receivedResult!, lastActivityAt }));
-        return;
-      }
-      if (stdoutBuffer.trim()) {
-        try {
-          handleProtocolLine(stdoutBuffer.trim());
-          if (receivedResult) return;
-        } catch {
-          /* fall through */
-        }
-      }
-      if (signal === "SIGKILL") {
-        finish(() => reject(new FabricTaskError("total timeout exceeded", "timeout", "environment")));
-        return;
-      }
-      finish(() => reject(new FabricTaskError(
-        code === 0 ? "isolated producer returned no result" : `isolated producer exited (${code ?? signal ?? "unknown"})`,
-        "harness_failure",
-        "harness",
-      )));
-    });
   });
 }
 

package/src/lib/account-selection-events.ts

@@ -0,0 +1,32 @@
+/** Process-local invalidations. Connection limits, buffering, and timers belong to consumers. */
+export type AccountSelectionEvent = {
+  provider: string;
+  kind: "oauth" | "api-key";
+  revision: number;
+};
+
+const listeners = new Set<(event: AccountSelectionEvent) => void>();
+let revision = 0;
+
+/** Call only after the authoritative selection has been persisted. */
+export function publishAccountSelection(provider: string, kind: AccountSelectionEvent["kind"]): void {
+  const event: AccountSelectionEvent = Object.freeze({ provider, kind, revision: ++revision });
+  for (const listener of [...listeners]) {
+    try {
+      listener(event);
+    } catch {
+      // A disconnected consumer must not turn a committed write into a reported failure.
+    }
+  }
+}
+
+export function subscribeAccountSelections(listener: (event: AccountSelectionEvent) => void): () => void {
+  // Give each subscription its own lifetime, even when a callback is reused.
+  const subscription = (event: AccountSelectionEvent) => listener(event);
+  listeners.add(subscription);
+  return () => { listeners.delete(subscription); };
+}
+
+export function currentAccountSelectionRevision(): number {
+  return revision;
+}

package/src/lib/errors.ts

@@ -4,10 +4,15 @@ export interface OcxErrorPayload {
   code: string | null;
 }
 
+export const ENCRYPTED_FUNCTION_OUTPUT_REJECTION =
+  "Encrypted function output content could not be decrypted or decoded.";
+
 /** Canonical human-readable message paths used by Responses upstream failures. */
 export function upstreamErrorMessageFromPayload(payload: unknown): string | undefined {
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) return undefined;
   const json = payload as {
+    type?: unknown;
+    message?: unknown;
     error?: { message?: unknown };
     last_error?: { message?: unknown };
     response?: {
@@ -18,7 +23,10 @@ export function upstreamErrorMessageFromPayload(payload: unknown): string | unde
   const message = json.error?.message
     ?? json.last_error?.message
     ?? json.response?.error?.message
-    ?? json.response?.incomplete_details?.message;
+    ?? json.response?.incomplete_details?.message
+    // The Responses stream error event carries a flat message (type/code/message),
+    // unlike the response.failed envelope the branches above already cover.
+    ?? (json.type === "error" ? json.message : undefined);
   return typeof message === "string" ? message : undefined;
 }
 

package/src/lib/provider-outbound.ts

@@ -7,7 +7,7 @@ import {
   resolvePublicAddresses,
 } from "./destination-policy";
 import { pinnedHttpGet, pinnedHttpPost } from "./pinned-http";
-import { effectiveProxyFor, outboundProxyConfigured } from "./proxy-env";
+import { effectiveProxyFor, noProxyMatches, normalizeProxyHostname, outboundProxyConfigured } from "./proxy-env";
 import { publicProviderBaseUrl } from "./provider-url";
 
 type ProviderGetInit = Omit<RequestInit, "body" | "method" | "redirect">;
@@ -37,10 +37,6 @@ function pickPinnedAddress(addresses: Array<{ address: string; family: number }>
   return addresses.find(address => address.family === 4) ?? addresses[0]!;
 }
 
-function configuredProxyFor(): boolean {
-  return outboundProxyConfigured();
-}
-
 /**
  * Registry-owned fake-IP transparency exception (Clash/Surge/Mihomo TUN mode).
  *
@@ -76,45 +72,6 @@ function transparentFakeIpException(
   return isCanonicalUrl(name, url);
 }
 
-function normalizeProxyHostname(hostname: string): string {
-  const normalized = hostname.trim().toLowerCase().replace(/\.+$/, "");
-  return normalized.startsWith("[") && normalized.endsWith("]")
-    ? normalized.slice(1, -1)
-    : normalized;
-}
-
-function noProxyMatches(url: URL): boolean {
-  const raw = process.env.NO_PROXY ?? process.env.no_proxy ?? "";
-  const hostname = normalizeProxyHostname(url.hostname);
-  const port = url.port || (url.protocol === "https:" ? "443" : "80");
-  for (const rawEntry of raw.split(",")) {
-    let entry = rawEntry.trim().toLowerCase();
-    if (!entry) continue;
-    if (entry === "*") return true;
-    entry = entry.replace(/^https?:\/\//, "").split("/", 1)[0]!;
-
-    let entryHost = entry;
-    let entryPort = "";
-    const bracketed = /^\[([^\]]+)](?::(\d+))?$/.exec(entry);
-    if (bracketed) {
-      entryHost = bracketed[1]!;
-      entryPort = bracketed[2] ?? "";
-    } else if ((entry.match(/:/g)?.length ?? 0) === 1) {
-      const separator = entry.lastIndexOf(":");
-      const possiblePort = entry.slice(separator + 1);
-      if (/^\d+$/.test(possiblePort)) {
-        entryHost = entry.slice(0, separator);
-        entryPort = possiblePort;
-      }
-    }
-    if (entryPort && entryPort !== port) continue;
-    entryHost = normalizeProxyHostname(entryHost.replace(/^\*?\./, ""));
-    if (!entryHost) continue;
-    if (hostname === entryHost || hostname.endsWith(`.${entryHost}`)) return true;
-  }
-  return false;
-}
-
 let proxyBoundaryWarned = false;
 let proxyDnsDegradationWarned = false;
 
@@ -181,7 +138,7 @@ async function providerOutboundRequest(
     return provider.fetch(url, { ...init, method, redirect: "manual" });
   }
   const parsed = postUrl ?? new URL(url);
-  const proxyConfigured = configuredProxyFor();
+  const proxyConfigured = outboundProxyConfigured();
   // Snapshot the scheme-matched proxy once, before the DNS await, so admission and transport
   // below reason about the same value. `null` here means "no proxy fetch would actually use",
   // even if some other proxy variable is set.