@bitkyc08/opencodex 2.63.0 → 2.64.0

package/src/integrations/raycast-detect.ts

@@ -44,10 +44,19 @@ export interface RaycastDetectDeps {
  */
 const RAYCAST_DEFAULTS_DOMAIN = "com.raycast.macos.v1";
 const RAYCAST_SUBSCRIPTION_KEY = "subscriptions_active";
+const DEFAULTS_PATH = "/usr/bin/defaults";
+const DEFAULTS_TIMEOUT_MS = 2_000;
 
-export function realRaycastDetectDeps(): RaycastDetectDeps {
+interface RealRaycastDetectRuntime {
+  platform?: string;
+  spawnSync?: typeof Bun.spawnSync;
+}
+
+export function realRaycastDetectDeps(runtime: RealRaycastDetectRuntime = {}): RaycastDetectDeps {
+  const platform = runtime.platform ?? process.platform;
+  const spawnSync = runtime.spawnSync ?? Bun.spawnSync;
   return {
-    platform: process.platform,
+    platform,
     homedir: homedir(),
     env: process.env,
     exists: path => {
@@ -59,9 +68,15 @@ export function realRaycastDetectDeps(): RaycastDetectDeps {
     },
     readDefault: (domain, key) => {
       // `defaults` is macOS-only; elsewhere the plan is simply unknown.
-      if (process.platform !== "darwin") return null;
+      if (platform !== "darwin") return null;
       try {
-        const result = Bun.spawnSync(["defaults", "read", domain, key], { stdout: "pipe", stderr: "pipe" });
+        const result = spawnSync([DEFAULTS_PATH, "read", domain, key], {
+          stdout: "pipe",
+          stderr: "pipe",
+          timeout: DEFAULTS_TIMEOUT_MS,
+        });
+        // A timed-out or signal-killed probe reports exitCode === null; that
+        // and any non-zero exit mean the preference was not read.
         if (result.exitCode !== 0) return null;
         return result.stdout.toString().trim();
       } catch {

package/src/integrations/serialize.ts

@@ -177,7 +177,17 @@ export function quoteTomlKey(key: string): string {
 function tomlScalar(value: unknown): string {
   if (typeof value === "string") return tomlString(value);
   if (typeof value === "boolean") return value ? "true" : "false";
-  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  if (typeof value === "number" && Number.isFinite(value)) {
+    // Bun.TOML.parse returns TOML integers as JavaScript numbers. Values outside
+    // the safe range may already have been rounded, so writing them back would
+    // silently alter a user-owned config rather than merely reformatting it.
+    if (Number.isInteger(value) && !Number.isSafeInteger(value)) {
+      throw new UnserializableValueError(
+        "TOML cannot safely rewrite an integer outside JavaScript's safe range",
+      );
+    }
+    return String(value);
+  }
   /*
    * Arrays of ANY scalar, not just strings. The string-only check was written
    * against our own builder output; a user's config legitimately holds

package/src/lib/bounded-body.ts

@@ -15,6 +15,8 @@ export interface BoundedBodyOptions {
 	 * Reader cancellation and lock release still run. Defaults to false.
 	 */
 	fatalUtf8?: boolean;
+	/** Report UTF-8 validity without rejecting malformed bodies. */
+	reportUtf8Validity?: boolean;
 	/**
 	 * Byte ceiling for retained body data. Defaults to BOUNDED_BODY_MAX_BYTES (64 KiB),
 	 * which suits error bodies; callers materializing whole success payloads (e.g. a
@@ -44,6 +46,8 @@ export interface BoundedBodyResult {
 	oversized: boolean;
 	/** False means callers should use a status-only fallback, not `text`. */
 	displaySafe: boolean;
+	/** Present when reportUtf8Validity was requested and the retained body reached EOF. */
+	utf8Valid?: boolean;
 }
 
 export interface BoundedBytesOptions {
@@ -238,6 +242,14 @@ function decodeUtf8(chunks: readonly Uint8Array[], fatal: boolean, timedOut = fa
 	}
 }
 
+function decodeUtf8WithValidity(bytes: Uint8Array): { text: string; utf8Valid: boolean } {
+	try {
+		return { text: decodeUtf8([bytes], true), utf8Valid: true };
+	} catch {
+		return { text: decodeUtf8([bytes], false), utf8Valid: false };
+	}
+}
+
 /**
  * Consume the original response body under strict memory and time bounds.
  *
@@ -326,6 +338,24 @@ export async function readBoundedResponseBody(
 
 			const { value, done } = outcome as ReadableStreamReadResult<Uint8Array>;
 			if (done) {
+				if (options.reportUtf8Validity) {
+					const bytes = retained.subarray(0, retainedBytes);
+					// A fatal decode that returned already proved the bytes valid; still
+					// honour the reporting contract instead of dropping utf8Valid.
+					const decoded = options.fatalUtf8 === true
+						? { text: decodeUtf8([bytes], true), utf8Valid: true }
+						: decodeUtf8WithValidity(bytes);
+					return {
+						text: decoded.text,
+						truncated: false,
+						timedOut: false,
+						totalTimedOut: false,
+						inactivityTimedOut: false,
+						oversized: false,
+						displaySafe: true,
+						utf8Valid: decoded.utf8Valid,
+					};
+				}
 				return {
 					text: decodeUtf8([retained.subarray(0, retainedBytes)], options.fatalUtf8 === true),
 					truncated: false,

package/src/lib/crash-guard.ts

@@ -150,7 +150,9 @@ function safeStringify(value: unknown): string {
 
 let benignSuppressed = 0;
 let benignLastLoggedAt = 0;
+let benignLastOrigin: string | undefined;
 const BENIGN_LOG_INTERVAL_MS = 5 * 60_000;
+const MAX_BENIGN_ORIGIN_BYTES = 1024;
 
 /**
  * Bun raises an off-path `unhandledRejection: TypeError: null is not an object` (native-only stack)
@@ -176,17 +178,53 @@ export function isBenignAbortTeardown(err: unknown): boolean {
   const lockedStreamTeardown = err.message === "Invalid state: ReadableStream is locked"
     && (err as { code?: unknown }).code === "ERR_INVALID_STATE";
   if (!bareNullTeardown && !lockedStreamTeardown) return false;
-  const stack = err.stack ?? "";
-  // Native-only: no JS source frame. A real app TypeError would carry a `(file:line:col)` frame.
-  return !/\((?!native:)[^)]*:\d+:\d+\)/.test(stack);
+  // Native-only: no JS source frame, parenthesized or not. Hidden JSC source fields
+  // (sourceURL/line/column) do not decide this: Bun can attach them to errors raised from
+  // its own builtin frames, and the benign summary still records them through diagnose().
+  return !hasJsSourceFrame(err.stack ?? "");
+}
+
+/**
+ * True when a stack line is an `at …` frame ending in `line:col` (optionally inside
+ * parentheses) whose location is not a Bun builtin (`native:`). Covers `at fn (/abs/x.ts:1:2)`,
+ * `at /abs/x.ts:1:2`, `at async fn (file:///x.ts:1:2)` and Windows drive paths.
+ */
+function hasJsSourceFrame(stack: string): boolean {
+  return stack.split(/\r?\n/).some(raw => {
+    const frame = raw.trim();
+    return frame.startsWith("at ")
+      && /:\d+:\d+\)?$/.test(frame)
+      && !/[(\s]native:\d+:\d+\)?$/.test(frame);
+  });
+}
+
+/**
+ * The JSC hidden throw site (`sourceURL:line:col`), when the error carries one. Best-effort:
+ * this runs inside the process crash handler, so an accessor that throws yields no site.
+ */
+function hiddenThrowSite(err: unknown): string | undefined {
+  try {
+    if (!err || typeof err !== "object") return undefined;
+    const e = err as Record<string, unknown>;
+    if (typeof e.sourceURL !== "string" || !e.sourceURL) return undefined;
+    const site = `${e.sourceURL}:${String(e.line ?? e.originalLine ?? "")}:${String(e.column ?? e.originalColumn ?? "")}`;
+    return truncateRetainedUtf8(site, MAX_BENIGN_ORIGIN_BYTES);
+  } catch {
+    return undefined;
+  }
 }
 
 function record(kind: string, err: unknown, promise?: unknown): void {
   if (kind === "unhandledRejection" && isBenignAbortTeardown(err)) {
     benignSuppressed++;
     const now = Date.now();
-    if (now - benignLastLoggedAt < BENIGN_LOG_INTERVAL_MS) return; // fold repeats silently
+    // A throw site JSC recorded on hidden fields is new information when it differs from
+    // the last one logged, so it is written even inside the fold window; repeats still fold.
+    const origin = hiddenThrowSite(err);
+    const novelOrigin = origin !== undefined && origin !== benignLastOrigin;
+    if (!novelOrigin && now - benignLastLoggedAt < BENIGN_LOG_INTERVAL_MS) return; // fold repeats silently
     benignLastLoggedAt = now;
+    if (origin !== undefined) benignLastOrigin = origin;
     const summary = `\n[${new Date(now).toISOString()}] benign-abort-teardown x${benignSuppressed}`
       + ` (Bun fetch-body abort; proxy unaffected)${diagnose(err)}${diagnosePromise(promise)}${breadcrumb()}\n`;
     benignSuppressed = 0;
@@ -306,6 +344,16 @@ export function resetCrashRingForTests(): void {
   fetchRingBytes = 0;
 }
 
+export function recordCrashForTests(kind: string, err: unknown): void {
+  record(kind, err);
+}
+
+export function resetBenignFoldForTests(): void {
+  benignSuppressed = 0;
+  benignLastLoggedAt = 0;
+  benignLastOrigin = undefined;
+}
+
 /** Render the recent fetch ring (pending first) for the crash breadcrumb. */
 function recentFetches(): string {
   try {

package/src/lib/local-aside-sync-contract.ts

@@ -0,0 +1,41 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { isLocalAttestationSecret } from "./local-management-attestation";
+
+export const LOCAL_ASIDE_SYNC_METHOD = "POST";
+export const LOCAL_ASIDE_SYNC_PATH = "/api/client-integrations/aside/sync";
+export const LOCAL_ASIDE_SYNC_CAPABILITY_VERSION = "v1";
+export const LOCAL_ASIDE_SYNC_EXPECTED_PID_HEADER = "x-opencodex-aside-sync-expected-pid";
+export const LOCAL_ASIDE_SYNC_NONCE_HEADER = "x-opencodex-aside-sync-nonce";
+export const LOCAL_ASIDE_SYNC_EXPIRES_AT_HEADER = "x-opencodex-aside-sync-expires-at";
+export const LOCAL_ASIDE_SYNC_CAPABILITY_HEADER = "x-opencodex-aside-sync-capability";
+export const LOCAL_ASIDE_SYNC_CAPABILITY_TTL_MS = 10_000;
+
+const BASE64URL_256 = /^[A-Za-z0-9_-]{43}$/;
+
+export function parseExpectedLocalAsideSyncPid(value: string | null): number | null {
+  if (!value || !/^[1-9]\d*$/.test(value)) return null;
+  const pid = Number(value);
+  return Number.isSafeInteger(pid) ? pid : null;
+}
+
+function payload(nonce: string, method: string, path: string, pid: number, port: number, expiresAt: number): string | null {
+  if (!BASE64URL_256.test(nonce) || method !== LOCAL_ASIDE_SYNC_METHOD || path !== LOCAL_ASIDE_SYNC_PATH) return null;
+  if (!Number.isSafeInteger(pid) || pid <= 0 || !Number.isInteger(port) || port <= 0 || port > 65535) return null;
+  if (!Number.isSafeInteger(expiresAt) || expiresAt <= 0) return null;
+  return `opencodex-local-aside-sync-v1\n${nonce}\n${method}\n${path}\n${pid}\n${port}\n${expiresAt}`;
+}
+
+export function createLocalAsideSyncCapability(secret: string, nonce: string, method: string, path: string, pid: number, port: number, expiresAt: number): string | null {
+  if (!isLocalAttestationSecret(secret)) return null;
+  const value = payload(nonce, method, path, pid, port, expiresAt);
+  return value ? createHmac("sha256", secret).update(value).digest("base64url") : null;
+}
+
+export function verifyLocalAsideSyncCapability(secret: string, nonce: string | null, method: string, path: string, pid: number, port: number, expiresAt: number, capability: string | null, now = Date.now()): boolean {
+  if (!nonce || !capability || !BASE64URL_256.test(capability) || expiresAt <= now || expiresAt > now + LOCAL_ASIDE_SYNC_CAPABILITY_TTL_MS) return false;
+  const expected = createLocalAsideSyncCapability(secret, nonce, method, path, pid, port, expiresAt);
+  if (!expected) return false;
+  const expectedBytes = Buffer.from(expected);
+  const actualBytes = Buffer.from(capability);
+  return expectedBytes.length === actualBytes.length && timingSafeEqual(expectedBytes, actualBytes);
+}

package/src/lib/package-tree-integrity.ts

@@ -1,4 +1,4 @@
-import { statSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { isStandaloneBinary } from "./standalone";
 
 export interface PackageTreeObservation {
@@ -14,13 +14,66 @@ export type PackageTreeIntegrityStatus =
 
 export interface PackageTreeIntegrityGuard {
   status(): PackageTreeIntegrityStatus;
+  /**
+   * Version recorded in the package manifest that is on disk NOW, once the replacement has
+   * settled. A fenced proxy reports it so `ocx restart` compares the CLI with the files an
+   * in-place respawn would run, not with the version this process booted from.
+   *
+   * A readable manifest is not an install-completion signal: npm can write package.json while
+   * it is still extracting the rest of the tree. So this stays undefined until the guard's own
+   * stability debounce has seen the same replacement identity for the full interval, and again
+   * whenever the tree has moved since. Undefined also covers an unreadable or malformed manifest.
+   */
+  installedVersion?(): string | undefined;
+  /**
+   * Permanently disarms the guard: cancels any pending restart timer and
+   * invalidates queued callbacks. Called from `server.stop()` so a still-queued
+   * replacement callback cannot schedule a drain-and-restart after shutdown
+   * has already begun.
+   */
+  dispose(): void;
 }
 
-type ObservePackageTree = () => PackageTreeObservation | null;
-type PackageTreeRuntimeInstall = "bun" | "npm" | "pnpm" | "source";
+export interface PackageTreeIntegrityOptions {
+  /**
+   * Called once when a replaced package tree persists past `replacedRestartDelayMs`
+   * of sustained failure. The intended handler is the graceful drain-and-restart
+   * acceptor: an out-of-band install (npm/bun/pnpm global upgrade under a live
+   * proxy) then self-heals instead of serving 503s until someone restarts by hand.
+   * Only `package_tree_replaced` counts — an unreadable manifest resets the timer,
+   * so an install still mid-write does not trigger a restart on partial state.
+   */
+  onReplaced?: () => void;
+  /** Sustained-replacement delay before `onReplaced` fires. 0 fires on first detection. */
+  replacedRestartDelayMs?: number;
+  /**
+   * Test seam; production uses an unref'd timer. May return a cancellation
+   * function; when it does, `resetRestartTimer` cancels the pending callback
+   * instead of leaving it queued behind a generation check.
+   */
+  schedule?: (callback: () => void, delayMs: number) => (() => void) | void;
+  /** Test seam for `installedVersion()`; production reads the package manifest. */
+  readInstalledVersion?: () => string | undefined;
+}
+
+export type ObservePackageTree = () => PackageTreeObservation | null;
+export type PackageTreeRuntimeInstall = "bun" | "npm" | "pnpm" | "source";
 
 const packageManifestUrl = new URL("../../package.json", import.meta.url);
 
+const INSTALLED_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+function readInstalledManifestVersion(): string | undefined {
+  try {
+    const version = (JSON.parse(readFileSync(packageManifestUrl, "utf8")) as { version?: unknown }).version;
+    return typeof version === "string" && version.length <= 64 && INSTALLED_VERSION_PATTERN.test(version)
+      ? version
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 function observePackageManifest(): PackageTreeObservation | null {
   try {
     const stat = statSync(packageManifestUrl, { bigint: true });
@@ -70,17 +123,133 @@ const PACKAGE_TREE_RECHECK_MS = 1_000;
 export function createPackageTreeIntegrityGuard(
   observe: ObservePackageTree = observePackageManifest,
   now: () => number = Date.now,
+  options: PackageTreeIntegrityOptions = {},
 ): PackageTreeIntegrityGuard {
   const boot = observe();
   let lastOkAt: number | null = null;
+  let notified = false;
+  let timerGeneration = 0;
+  let timerScheduled = false;
+  let cancelScheduled: (() => void) | null = null;
+  let waitingForReadableTree = false;
+  let replacementCandidate: PackageTreeObservation | null = null;
+  /** The replacement identity that survived a full stability interval (see installedVersion). */
+  let settledReplacement: PackageTreeObservation | null = null;
+  const restartDelayMs = options.replacedRestartDelayMs ?? 5_000;
+  const readInstalledVersion = options.readInstalledVersion ?? readInstalledManifestVersion;
+  const schedule = options.schedule ?? ((callback, delayMs) => {
+    const timer = setTimeout(callback, delayMs);
+    timer.unref?.();
+    return () => clearTimeout(timer);
+  });
+
+  const resetRestartTimer = (): void => {
+    timerGeneration += 1;
+    timerScheduled = false;
+    const cancel = cancelScheduled;
+    cancelScheduled = null;
+    cancel?.();
+  };
+
+  const armRestartTimer = (delayMs = restartDelayMs): void => {
+    if (!options.onReplaced || notified || timerScheduled) return;
+    timerScheduled = true;
+    const generation = timerGeneration;
+    const verifyAndNotify = () => {
+      if (generation !== timerGeneration || notified) return;
+      timerScheduled = false;
+      const current = observe();
+      if (boot === null || current === null) {
+        // A package manager may replace package.json before the rest of the tree.
+        // Wait for a readable tree, then require a fresh full debounce interval.
+        resetRestartTimer();
+        waitingForReadableTree = true;
+        armRestartTimer(PACKAGE_TREE_RECHECK_MS);
+        return;
+      }
+      if (sameObservation(boot, current)) {
+        resetRestartTimer();
+        waitingForReadableTree = false;
+        replacementCandidate = null;
+        return;
+      }
+      if (waitingForReadableTree) {
+        waitingForReadableTree = false;
+        replacementCandidate = current;
+        resetRestartTimer();
+        armRestartTimer();
+        return;
+      }
+      if (replacementCandidate === null || !sameObservation(replacementCandidate, current)) {
+        replacementCandidate = current;
+        resetRestartTimer();
+        armRestartTimer();
+        return;
+      }
+      settledReplacement = current;
+      try {
+        options.onReplaced?.();
+        notified = true;
+      } catch {
+        // A failed restart admission must not leave the proxy fenced forever.
+        // Re-observe after the normal debounce and try again if replacement persists.
+        armRestartTimer(Math.max(PACKAGE_TREE_RECHECK_MS, restartDelayMs));
+      }
+    };
+    if (delayMs === 0) {
+      // Defer like the scheduled path: verifyAndNotify can arm the next timer, and a
+      // synchronous verify inside this frame would re-enter armRestartTimer while this
+      // arm is still running.
+      queueMicrotask(verifyAndNotify);
+    } else {
+      // The seam may run the callback synchronously; defer the work so
+      // cancelScheduled ownership is settled before verifyAndNotify can
+      // re-enter armRestartTimer.
+      const cancel = schedule(() => {
+        queueMicrotask(verifyAndNotify);
+      }, delayMs);
+      if (generation === timerGeneration && timerScheduled && typeof cancel === "function") {
+        cancelScheduled = cancel;
+      }
+    }
+  };
+
   return {
+    installedVersion: () => {
+      if (settledReplacement === null) return undefined;
+      const current = observe();
+      if (current === null || !sameObservation(settledReplacement, current)) return undefined;
+      return readInstalledVersion();
+    },
+    dispose(): void {
+      resetRestartTimer();
+      notified = true;
+    },
     status(): PackageTreeIntegrityStatus {
       const at = now();
       if (lastOkAt !== null && at - lastOkAt < PACKAGE_TREE_RECHECK_MS) return { ok: true };
       const current = observe();
-      if (boot === null || current === null) return { ok: false, reason: "package_tree_unreadable" };
-      if (!sameObservation(boot, current)) return { ok: false, reason: "package_tree_replaced" };
+      if (boot === null || current === null) {
+        const wasWatchingReplacement = timerScheduled;
+        resetRestartTimer();
+        if (wasWatchingReplacement && boot !== null) {
+          waitingForReadableTree = true;
+          armRestartTimer(PACKAGE_TREE_RECHECK_MS);
+        }
+        return { ok: false, reason: "package_tree_unreadable" };
+      }
+      if (!sameObservation(boot, current)) {
+        if (replacementCandidate === null || !sameObservation(replacementCandidate, current)) {
+          replacementCandidate = current;
+          resetRestartTimer();
+        }
+        armRestartTimer();
+        return { ok: false, reason: "package_tree_replaced" };
+      }
       lastOkAt = at;
+      resetRestartTimer();
+      waitingForReadableTree = false;
+      replacementCandidate = null;
       return { ok: true };
     },
   };
@@ -96,7 +265,10 @@ export function createRuntimePackageTreeIntegrityGuard(
   installer: PackageTreeRuntimeInstall,
   observe: ObservePackageTree = observePackageManifest,
   now: () => number = Date.now,
-): PackageTreeIntegrityGuard {
-  if (installer === "source" || isStandaloneBinary()) return { status: () => ({ ok: true }) };
-  return createPackageTreeIntegrityGuard(observe, now);
-}
+  options: PackageTreeIntegrityOptions = {},
+  ): PackageTreeIntegrityGuard {
+    if (installer === "source" || isStandaloneBinary()) {
+      return { status: () => ({ ok: true }), dispose: () => {} };
+    }
+    return createPackageTreeIntegrityGuard(observe, now, options);
+  }

package/src/lib/proxy-env.ts

@@ -29,6 +29,7 @@ export function noProxyMatches(
     if (!entry) continue;
     if (entry === "*") return true;
     entry = entry.replace(/^(?:https?|wss?):\/\//, "").split("/", 1)[0]!;
+    const domainForm = /^\*?\./.test(entry);
 
     let entryHost = entry;
     let entryPort = "";
@@ -46,11 +47,20 @@ export function noProxyMatches(
     }
     if (entryPort && entryPort !== port) continue;
     entryHost = normalizeProxyHostname(entryHost.replace(/^\*?\./, ""));
-    if (entryHost && (hostname === entryHost || hostname.endsWith(`.${entryHost}`))) return true;
+    if (!entryHost) continue;
+    if (hostname === entryHost) return true;
+    // A bare loopback name or an IP literal names one host: "localhost" must not send
+    // "anything.localhost" direct, which need not resolve to loopback. ".localhost" still does.
+    if (!domainForm && isExactOnlyNoProxyHost(entryHost)) continue;
+    if (hostname.endsWith(`.${entryHost}`)) return true;
   }
   return false;
 }
 
+function isExactOnlyNoProxyHost(host: string): boolean {
+  return host === "localhost" || host.includes(":") || /^\d{1,3}(?:\.\d{1,3}){3}$/.test(host);
+}
+
 export function resolveProxyRoute(
   url: URL,
   env: ProxyEnvMap = process.env,
@@ -211,6 +221,13 @@ export function configuredOutboundFetch(
   } catch {
     return base!(input, init);
   }
+  // A mixed inherited SOCKS/HTTP ALL_PROXY environment cannot put bare "localhost" in
+  // NO_PROXY: Bun would also bypass its HTTP proxy for app.localhost. Keep the name exact
+  // here and force native fetch direct so the opposite-case HTTP proxy cannot take over.
+  if (proxy && explicitProxy === undefined && (url.protocol === "http:" || url.protocol === "https:")
+    && normalizeProxyHostname(url.hostname) === "localhost") {
+    return base!(input, { ...init, proxy: false } as ProxyCapableRequestInit);
+  }
   if (proxy && (url.protocol === "http:" || url.protocol === "https:") && (explicitProxy !== undefined || !noProxyMatches(url))) {
     return socks5Fetch(input, init, proxy);
   }

package/src/lib/request-failure-attribution.ts

@@ -98,6 +98,7 @@ export function deriveRequestFailureStage(facts: RequestFailureFacts): RequestFa
 const STATUS_CONFIRMED_RECOVERY_KINDS: Readonly<Partial<Record<AttemptRecoveryKind, number>>> = Object.freeze({
   "opaque-blob-rejection": 400,
   "reasoning-effort-downgrade": 400,
+  "anthropic-fast-downgrade": 400,
 });
 
 function refinedFourHundredCause(

package/src/lib/request-failure-model.ts

@@ -229,6 +229,9 @@ const RECOVERY_KIND_CAUSE = {
   "opaque-blob-rejection": "ciphertext-refusal",
   "empty-completion": "empty-output",
   "reasoning-effort-downgrade": "parameter-rejected",
+  // Anthropic refused `speed: "fast"` (no usage credits, org not enabled, model outside the
+  // lane); the same turn succeeds once the parameter is dropped.
+  "anthropic-fast-downgrade": "parameter-rejected",
 } as const satisfies Record<AttemptRecoveryKind, RequestFailureCause>;
 
 export function causeForRecoveryKind(kind: AttemptRecoveryKind): RequestFailureCause {

package/src/lib/service-secrets.ts

@@ -1,8 +1,8 @@
 import { createHash } from "node:crypto";
-import { closeSync, existsSync, fsyncSync, lstatSync, openSync, readFileSync, unlinkSync } from "node:fs";
+import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, lstatSync, openSync, readFileSync, readSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "../config";
-import { atomicWriteFile } from "../config/atomic-write";
+import { atomicWriteFile, atomicWriteFileNoFollow } from "../config/atomic-write";
 
 const MAX_SERVICE_API_TOKEN_BYTES = 4096;
 
@@ -49,6 +49,103 @@ export function readServiceApiTokenState(): ServiceApiTokenState {
   }
 }
 
+/**
+ * Validate and tighten a reused service token without applying permissions to a
+ * pathname that may have been replaced since validation.
+ *
+ * The token is read off the opened descriptor — never off the path a second
+ * time — and once it validates, it is REPUBLISHED through the no-follow atomic
+ * writer rather than hardened in place. Windows ACL tooling is pathname-based,
+ * so an in-place harden there could still land on a substituted entry; the
+ * republish instead replaces whatever entry sits at the path with a freshly
+ * hardened owner-only file holding the same token. On return the path names
+ * that file, which is the contract `origin: "file"` reports. On POSIX the
+ * opened descriptor is also fchmod'd first, so a token-bearing inode a race
+ * moved aside is still tightened wherever its entry ended up.
+ *
+ *
+ * Return contract vs `readServiceApiTokenState`: an empty or malformed token file
+ * reports `unsafe` here and is never written — the path-based pre-check may still
+ * pass the install on loopback while this writer deliberately leaves the file
+ * untouched. Only `absent` permits a fresh write; anything unreadable stays as-is.
+ *
+ * Callers must run this under `withConfigMutationLockSync`: client-key rotation
+ * replaces the token under that lock, and a republish outside it could rename a
+ * stale token back over a committed rotation.
+ */
+export function hardenReusedServiceApiToken(
+  validate: (token: string) => void,
+): ServiceApiTokenState {
+  const path = serviceApiTokenFilePath();
+  // O_NOFOLLOW refuses a symlinked entry and O_NONBLOCK keeps a FIFO (or other
+  // blocking node) from stalling the open before fstat can reject it. Windows
+  // omits both flags, so there the descriptor is bound to its entry by the
+  // lstat/fstat identity comparison below.
+  const flags = process.platform === "win32"
+    ? constants.O_RDONLY
+    : constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+  let fd: number | undefined;
+  try {
+    fd = openSync(path, flags);
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (code === "ENOENT") return { kind: "absent" };
+    if (code === "ELOOP") return { kind: "unsafe", reason: "service token path is not a bounded regular file" };
+    return { kind: "unsafe", reason: "service token path could not be inspected" };
+  }
+  try {
+    const stat = fstatSync(fd, { bigint: true });
+    if (!stat.isFile() || stat.size > BigInt(MAX_SERVICE_API_TOKEN_BYTES)) {
+      return { kind: "unsafe", reason: "service token path is not a bounded regular file" };
+    }
+    if (process.platform === "win32") {
+      let entry;
+      try {
+        entry = lstatSync(path, { bigint: true });
+      } catch {
+        return { kind: "unsafe", reason: "service token path could not be inspected" };
+      }
+      if (entry.isSymbolicLink() || !entry.isFile() || entry.dev !== stat.dev || entry.ino !== stat.ino) {
+        return { kind: "unsafe", reason: "service token path is not a bounded regular file" };
+      }
+    }
+    // Bound the read as well as the stat: a file that grows past the cap after
+    // fstat is unsafe, not something to buffer whole.
+    const bytes = Buffer.alloc(MAX_SERVICE_API_TOKEN_BYTES + 1);
+    let length = 0;
+    try {
+      while (length < bytes.length) {
+        const count = readSync(fd, bytes, length, bytes.length - length, null);
+        if (!count) break;
+        length += count;
+      }
+    } catch {
+      return { kind: "unsafe", reason: "service token file could not be read" };
+    }
+    if (length > MAX_SERVICE_API_TOKEN_BYTES) {
+      return { kind: "unsafe", reason: "service token path is not a bounded regular file" };
+    }
+    const token = bytes.subarray(0, length).toString("utf8").trim();
+    if (!token) return { kind: "unsafe", reason: "service token file is empty" };
+    validate(token);
+    if (process.platform !== "win32") {
+      // Best-effort matches the previous repair behavior: the descriptor binds
+      // the chmod to the regular file opened above even if its directory entry
+      // moved, so the validated inode is never left loose under another name.
+      try { fchmodSync(fd, 0o600); } catch { /* best-effort */ }
+    }
+    // The descriptor's work ends here — and must: Windows refuses to rename over
+    // a file this process still holds open, so the republish cannot run while it
+    // is held.
+    closeSync(fd);
+    fd = undefined;
+    atomicWriteFileNoFollow(path, `${token}\n`);
+    return { kind: "present", token, fingerprint: serviceApiTokenFingerprint(token) };
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
 export function writeServiceApiTokenFile(token: string): PersistedServiceApiToken {
   const value = token.trim();
   if (!value || /[\r\n\0]/.test(value) || Buffer.byteLength(value) > MAX_SERVICE_API_TOKEN_BYTES) {