@bitkyc08/opencodex 2.7.18 → 2.7.19

package/src/oauth/callback-server.ts

@@ -235,12 +235,16 @@ export abstract class OAuthCallbackFlow {
         while (true) {
           const result = await Promise.race([
             callbackPromise,
-            requestManualInput()
+            requestManualInput(expectedState)
               .then((input): CallbackResult | null => {
                 const parsed = parseCallbackInput(input);
                 if (!parsed.code) return null;
-                if (expectedState && parsed.state !== expectedState) return null;
-                return { code: parsed.code, state: parsed.state ?? "" };
+                // Kind-aware state enforcement: url/query-shaped input is an authorization
+                // RESPONSE and must carry a matching state — missing state is rejected, not
+                // downgraded to raw. Only a syntactically raw code (same PKCE session) is
+                // exempt, so the CLI/GUI paste fallback still works.
+                if (parsed.kind !== "raw" && expectedState && parsed.state !== expectedState) return null;
+                return { code: parsed.code, state: parsed.state ?? expectedState };
               })
               .catch((): CallbackResult | null => null),
           ]);
@@ -255,14 +259,19 @@ export abstract class OAuthCallbackFlow {
   }
 }
 
-/** Parse a redirect URL or code string to extract code and state. */
-export function parseCallbackInput(input: string): { code?: string; state?: string } {
+/**
+ * Parse a redirect URL or code string to extract code and state.
+ * `kind` records the syntactic shape so callers can enforce state on authorization
+ * responses (url/query) while exempting raw in-session codes.
+ */
+export function parseCallbackInput(input: string): { kind: "url" | "query" | "raw"; code?: string; state?: string } {
   const value = input.trim();
-  if (!value) return {};
+  if (!value) return { kind: "raw" };
 
   try {
     const url = new URL(value);
     return {
+      kind: "url",
       code: url.searchParams.get("code") ?? undefined,
       state: url.searchParams.get("state") ?? undefined,
     };
@@ -273,6 +282,7 @@ export function parseCallbackInput(input: string): { code?: string; state?: stri
   if (value.includes("code=")) {
     const params = new URLSearchParams(value.replace(/^[?#]/, ""));
     return {
+      kind: "query",
       code: params.get("code") ?? undefined,
       state: params.get("state") ?? undefined,
     };
@@ -280,5 +290,5 @@ export function parseCallbackInput(input: string): { code?: string; state?: stri
 
   // Assume raw code, possibly with state after #
   const [code, state] = value.split("#", 2);
-  return { code, state };
+  return { kind: "raw", code, state };
 }

package/src/oauth/index.ts

@@ -1,4 +1,5 @@
 import type { OAuthController, OAuthCredentials } from "./types";
+import { parseCallbackInput } from "./callback-server";
 import type { OcxConfig, OcxProviderConfig, RefreshPolicy } from "../types";
 import { loadConfig, resolveEnvValue, saveConfig } from "../config";
 import { maskEmail } from "../lib/privacy";
@@ -362,10 +363,95 @@ export async function runLogin(provider: string, ctrl: OAuthController, opts?: L
  * GUI async login: start the flow, return the auth URL EARLY (the flow keeps running in the
  * background until the callback server captures the redirect), with a concurrency guard and an
  * error surfaced via getLoginStatus().
+ *
+ * Manual fallback: when the browser cannot reach the loopback callback (remote GUI, SSH, blocked
+ * localhost), the GUI can POST the final redirect URL or authorization code via
+ * submitManualLoginCode(), which feeds OAuthController.onManualCodeInput.
  */
 const loginState = new Map<string, { error?: string; done: boolean }>();
 const loginAbort = new Map<string, AbortController>();
 
+/** Pending paste for a login in progress: either a waiter or a stashed early submission. */
+interface ManualCodeSlot {
+  pendingInput?: string;
+  resolve?: (value: string) => void;
+  /** Registered by the callback flow so submits can validate state synchronously. */
+  expectedState?: string;
+}
+const loginManual = new Map<string, ManualCodeSlot>();
+
+function clearManualCodeSlot(provider: string): void {
+  loginManual.delete(provider);
+}
+
+function ensureManualCodeSlot(provider: string): ManualCodeSlot {
+  let slot = loginManual.get(provider);
+  if (!slot) {
+    slot = {};
+    loginManual.set(provider, slot);
+  }
+  return slot;
+}
+
+/** Wait for a GUI/CLI paste of the OAuth redirect URL or code (or return a stashed early submit). */
+function waitForManualLoginCode(provider: string, signal: AbortSignal, expectedState?: string): Promise<string> {
+  if (signal.aborted) {
+    return Promise.reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
+  }
+  const slot = ensureManualCodeSlot(provider);
+  if (expectedState !== undefined) slot.expectedState = expectedState;
+  if (slot.pendingInput !== undefined) {
+    const value = slot.pendingInput;
+    slot.pendingInput = undefined;
+    return Promise.resolve(value);
+  }
+  return new Promise<string>((resolve, reject) => {
+    const onAbort = () => {
+      if (slot.resolve === resolve) slot.resolve = undefined;
+      reject(new Error(`OAuth callback cancelled: ${signal.reason}`));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    slot.resolve = (value: string) => {
+      signal.removeEventListener("abort", onAbort);
+      if (slot.resolve === resolve) slot.resolve = undefined;
+      resolve(value);
+    };
+  });
+}
+
+/**
+ * Feed a pasted redirect URL or authorization code into an in-progress GUI login.
+ * Returns ok:false when no login is waiting (or input is empty). Invalid pastes are accepted
+ * here and re-prompted by the OAuth callback loop if they cannot be parsed / fail state checks.
+ */
+export function submitManualLoginCode(provider: string, input: string): { ok: true } | { ok: false; error: string } {
+  const trimmed = input.trim();
+  if (!trimmed) return { ok: false, error: "empty code" };
+  const st = loginState.get(provider);
+  if (!st || st.done) return { ok: false, error: "no login in progress" };
+  const slot = ensureManualCodeSlot(provider);
+  // Synchronous validation (validated request/ack): reject un-parseable input and
+  // authorization responses (url/query kind) whose state is missing or mismatched
+  // once the flow has registered its expected state. Raw codes stay in-session-PKCE
+  // protected. Early posts (flow not yet waiting, no expectedState) are stashed and
+  // re-validated by the callback loop.
+  const parsed = parseCallbackInput(trimmed);
+  if (!parsed.code) return { ok: false, error: "no authorization code found in input" };
+  if (parsed.kind !== "raw" && slot.expectedState !== undefined) {
+    if (parsed.state === undefined) return { ok: false, error: "redirect URL is missing the state parameter" };
+    if (parsed.state !== slot.expectedState) return { ok: false, error: "state mismatch — paste the redirect URL from THIS login attempt" };
+  }
+  if (slot.resolve) {
+    const resolve = slot.resolve;
+    slot.resolve = undefined;
+    resolve(trimmed);
+  } else {
+    // Race: GUI may POST before the flow reaches onManualCodeInput — stash for the waiter.
+    slot.pendingInput = trimmed;
+  }
+  return { ok: true };
+}
+
 export interface OAuthAccountSummary { id: string; email?: string; active: boolean; needsReauth?: boolean; expiresAt?: number }
 
 export function getLoginStatus(provider: string): { loggedIn: boolean; email?: string; source?: OAuthCredentials["source"]; error?: string; done: boolean; activeAccountId?: string; accounts?: OAuthAccountSummary[] } {
@@ -400,6 +486,7 @@ export function oauthLoginSummary(): Array<{ provider: string; loggedIn: boolean
 export function clearLoginState(provider: string): void {
   loginAbort.get(provider)?.abort("cleared");
   loginAbort.delete(provider);
+  clearManualCodeSlot(provider);
   loginState.delete(provider);
 }
 
@@ -409,6 +496,7 @@ export function cancelLoginFlow(provider: string): boolean {
   if (!ctrl && (!existing || existing.done)) return false;
   ctrl?.abort("cancelled");
   loginAbort.delete(provider);
+  clearManualCodeSlot(provider);
   loginState.set(provider, { done: true, error: "Login cancelled" });
   return true;
 }
@@ -420,6 +508,7 @@ export async function startLoginFlow(provider: string, opts?: LoginOpts): Promis
   if (existing && !existing.done) {
     throw new Error(`A login for ${provider} is already in progress`);
   }
+  clearManualCodeSlot(provider);
   loginState.set(provider, { done: false });
   const abort = new AbortController();
   loginAbort.set(provider, abort);
@@ -431,12 +520,15 @@ export async function startLoginFlow(provider: string, opts?: LoginOpts): Promis
         resolve({ url, instructions });
       },
       onProgress: () => {},
+      // GUI fallback when the browser cannot hit the loopback callback server.
+      onManualCodeInput: (expectedState?: string) => waitForManualLoginCode(provider, abort.signal, expectedState),
       signal: abort.signal,
     };
     // Background: runLogin persists the credential + upserts the provider entry to disk config.
     runLogin(provider, ctrl, opts)
       .then(() => {
         loginAbort.delete(provider);
+        clearManualCodeSlot(provider);
         loginState.set(provider, { done: true });
         // Local-token import (grok-cli / Claude Code keychain) completes WITHOUT firing onAuth —
         // resolve so the GUI call returns instead of hanging.
@@ -444,6 +536,7 @@ export async function startLoginFlow(provider: string, opts?: LoginOpts): Promis
       })
       .catch((e: unknown) => {
         loginAbort.delete(provider);
+        clearManualCodeSlot(provider);
         const msg = e instanceof Error ? e.message : String(e);
         loginState.set(provider, { done: true, error: msg });
         if (!urlResolved) reject(e);

package/src/oauth/types.ts

@@ -31,7 +31,7 @@ export interface ProviderAccountSet {
 export interface OAuthController {
   onAuth?(info: { url: string; instructions?: string }): void;
   onProgress?(message: string): void;
-  onManualCodeInput?(): Promise<string>;
+  onManualCodeInput?(expectedState?: string): Promise<string>;
   signal?: AbortSignal;
 }
 

package/src/providers/derive.ts

@@ -48,6 +48,7 @@ export interface DerivedProviderPreset {
   oauthProvider?: string;
   dashboardUrl?: string;
   note?: string;
+  keyOptional?: boolean;
 }
 
 export function listRegistryEntries(): readonly ProviderRegistryEntry[] {
@@ -69,6 +70,7 @@ export function providerConfigSeed(entry: ProviderRegistryEntry): OcxProviderCon
     authMode: entry.authKind === "local" ? undefined : entry.authKind,
     ...(entry.keyOptional !== undefined ? { keyOptional: entry.keyOptional } : {}),
     ...(entry.modelSuffixBracketStrip !== undefined ? { modelSuffixBracketStrip: entry.modelSuffixBracketStrip } : {}),
+    ...(entry.staticHeaders ? { headers: { ...entry.staticHeaders } } : {}),
     ...(entry.defaultModel ? { defaultModel: entry.defaultModel } : {}),
     ...(entry.models ? { models: [...entry.models] } : {}),
     ...(entry.liveModels !== undefined ? { liveModels: entry.liveModels } : {}),
@@ -193,6 +195,7 @@ export function enrichProviderFromRegistry(name: string, prov: OcxProviderConfig
   if (prov.escapeBuiltinToolNames === undefined && seed.escapeBuiltinToolNames !== undefined) prov.escapeBuiltinToolNames = seed.escapeBuiltinToolNames;
   if (prov.keyOptional === undefined && seed.keyOptional !== undefined) prov.keyOptional = seed.keyOptional;
   if (prov.modelSuffixBracketStrip === undefined && seed.modelSuffixBracketStrip !== undefined) prov.modelSuffixBracketStrip = seed.modelSuffixBracketStrip;
+  if (!prov.headers && seed.headers) prov.headers = { ...seed.headers };
 }
 
 export function deriveFeaturedProviderIds(): string[] {
@@ -227,6 +230,7 @@ function entryToPreset(entry: ProviderRegistryEntry): DerivedProviderPreset {
     ...(entry.authKind === "oauth" ? { oauthProvider: entry.oauthId ?? entry.id } : {}),
     ...(entry.dashboardUrl ? { dashboardUrl: entry.dashboardUrl } : {}),
     ...(entry.note ? { note: entry.note } : {}),
+    ...(entry.keyOptional ? { keyOptional: true } : {}),
   };
 }
 

package/src/providers/registry.ts

@@ -23,6 +23,8 @@ export interface ProviderRegistryEntry {
   allowPrivateNetworkByDefault?: boolean;
   keyOptional?: boolean;
   allowBaseUrlOverride?: boolean;
+  /** Static headers merged into every upstream request for this provider. */
+  staticHeaders?: Record<string, string>;
   modelSuffixBracketStrip?: boolean;
   featured?: boolean;
   dashboardPreset?: boolean;
@@ -66,7 +68,7 @@ export type ProviderConfigSeed = Pick<
   | "reasoningEfforts" | "modelReasoningEfforts" | "reasoningEffortMap" | "modelReasoningEffortMap"
   | "noVisionModels" | "noReasoningModels" | "noTemperatureModels" | "noTopPModels" | "noPenaltyModels"
   | "autoToolChoiceOnlyModels" | "preserveReasoningContentModels" | "thinkingToggleModels" | "thinkingBudgetModels" | "escapeBuiltinToolNames"
-  | "googleMode" | "project" | "location"
+  | "googleMode" | "project" | "location" | "headers"
 >;
 
 // Shared between the OAuth (Claude account) and API-key Anthropic entries so both expose the
@@ -133,6 +135,7 @@ const THINKING_BUDGET_MODELS = [
 ];
 const OPENCODE_GO_THINKING_BUDGET_MODELS = ["qwen3.5-plus", "qwen3.6-plus", "qwen3.7-max", "qwen3.7-plus"];
 const DEEPSEEK_THINKING_MODELS = ["deepseek-v4-pro", "deepseek-v4-flash"];
+const OPENCODE_FREE_DEEPSEEK_MODELS = ["deepseek-v4-flash-free"];
 // "max" is advertised too: the wire map routes xhigh->max and max->max, so the picker
 // should surface the max tier instead of hiding it behind xhigh.
 const DEEPSEEK_THINKING_EFFORTS = ["high", "xhigh", "max"];
@@ -608,8 +611,41 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   },
   { id: "opencode-zen", label: "opencode zen", baseUrl: "https://opencode.ai/zen/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://opencode.ai/auth" },
   { id: "vercel-ai-gateway", label: "Vercel AI Gateway", baseUrl: "https://ai-gateway.vercel.sh/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://vercel.com/dashboard" },
+  {
+    id: "opencode-free",
+    label: "OpenCode Free",
+    adapter: "openai-chat",
+    baseUrl: "https://opencode.ai/zen/v1",
+    authKind: "key",
+    keyOptional: true,
+    featured: true,
+    liveModels: true,
+    note: "No key needed — public desktop tier. OpenCode currently advertises about 200 Big Pickle/free-model requests per 5 hours. Free models are discovered live from Zen. Data use: per OpenCode's Zen docs (https://opencode.ai/docs/zen/), prompts sent to free models may be retained and used for training/improvement — do not send confidential material through this provider.",
+    dashboardUrl: "https://opencode.ai",
+    staticHeaders: {
+      "x-opencode-client": "desktop",
+    },
+    modelReasoningEfforts: Object.fromEntries(OPENCODE_FREE_DEEPSEEK_MODELS.map(id => [id, DEEPSEEK_THINKING_EFFORTS])),
+    modelReasoningEffortMap: Object.fromEntries(OPENCODE_FREE_DEEPSEEK_MODELS.map(id => [id, DEEPSEEK_THINKING_REASONING_MAP])),
+    preserveReasoningContentModels: OPENCODE_FREE_DEEPSEEK_MODELS,
+    noVisionModels: OPENCODE_FREE_DEEPSEEK_MODELS,
+  },
   { id: "xiaomi", label: "Xiaomi MiMo", baseUrl: "https://api.xiaomimimo.com/anthropic", adapter: "anthropic", authKind: "key", dashboardUrl: "https://xiaomimimo.com", defaultModel: "mimo-v2.5-pro" },
   { id: "kilo", label: "Kilo", baseUrl: "https://api.kilo.ai/api/gateway", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://kilo.ai" },
+  {
+    id: "mimo-free",
+    label: "MiMo Free",
+    adapter: "mimo-free",
+    baseUrl: "https://api.xiaomimimo.com/api/free-ai/openai/chat",
+    authKind: "key",
+    keyOptional: true,
+    featured: true,
+    liveModels: true,
+    dashboardUrl: "https://xiaomimimo.com",
+    defaultModel: "mimo-auto",
+    models: ["mimo-auto"],
+    note: "No key needed — uses Xiaomi MiMo's free public tier (limited-time offer). A JWT is bootstrapped automatically with an anonymous random client id stored locally. The endpoint contract mirrors the official MiMoCode client and is not publicly documented — Xiaomi may change or restrict it at any time. Prompts may be processed/retained by Xiaomi; do not send confidential material.",
+  },
   { id: "cloudflare-ai-gateway", label: "Cloudflare AI Gateway", baseUrl: "https://gateway.ai.cloudflare.com/v1/{account-id}/{gateway}/anthropic", adapter: "anthropic", authKind: "key", dashboardUrl: "https://dash.cloudflare.com/?to=/:account/ai/ai-gateway" },
   // FREEZE 2026-07-10: /models is auth-gated, so ids remain unverified. Evidence: devlog/_plan/260710_provider_hardening/003_research_aggregators.md.
   { id: "github-copilot", label: "GitHub Copilot", baseUrl: "https://api.githubcopilot.com", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://github.com/settings/copilot" },

package/src/server/adapter-resolve.ts

@@ -3,6 +3,7 @@ import { createAzureAdapter } from "../adapters/azure";
 import { createCursorAdapter } from "../adapters/cursor";
 import { createGoogleAdapter } from "../adapters/google";
 import { createKiroAdapter } from "../adapters/kiro";
+import { createMimoFreeAdapter } from "../adapters/mimo-free";
 import { createOpenAIChatAdapter } from "../adapters/openai-chat";
 import { createResponsesPassthroughAdapter } from "../adapters/openai-responses";
 import type { OcxProviderConfig } from "../types";
@@ -40,6 +41,8 @@ export function resolveAdapter(providerConfig: OcxProviderConfig, cacheRetention
       return createAzureAdapter(providerConfig);
     case "cursor":
       return createCursorAdapter(providerConfig);
+    case "mimo-free":
+      return createMimoFreeAdapter(providerConfig);
     default:
       throw new Error(`Unknown adapter: ${providerConfig.adapter}`);
   }

package/src/server/auth-cors.ts

@@ -6,6 +6,7 @@ import {
   providerHeadersConfigError,
 } from "../config";
 import { providerDestinationConfigError } from "../lib/destination-policy";
+import { getProviderRegistryEntry } from "../providers/registry";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
 let _corsOrigin = "http://localhost:10100";
@@ -210,6 +211,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "disabled",
       "allowPrivateNetwork",
       "authMode",
+      "keyOptional",
       "liveModels",
       "models",
       "contextWindow",
@@ -227,6 +229,8 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     ] as const) {
       copyIfDefined(dto, provider, key);
     }
+    const registryNote = getProviderRegistryEntry(name)?.note;
+    if (typeof registryNote === "string" && registryNote.trim()) dto.note = registryNote;
     providers[name] = dto;
   }
   return {

package/src/server/management-api.ts

@@ -16,6 +16,7 @@ import {
   isOAuthProvider,
   listOAuthProviders,
   startLoginFlow,
+  submitManualLoginCode,
   upsertOAuthProvider,
 } from "../oauth";
 import { removeCredential } from "../oauth/store";
@@ -28,6 +29,7 @@ import { readUsageEntries } from "../usage/log";
 import { getUsageDebugLogEntries } from "../usage/debug";
 import { parseRange, summarizeUsage } from "../usage/summary";
 import { stripCodexRuntimeProviderFields } from "../codex/auth-context";
+import { getProviderRegistryEntry } from "../providers/registry";
 import { getDebugLogEntries } from "../lib/debug-log-buffer";
 import { getInjectionDebugLogEntries } from "../lib/injection-debug-log";
 import {
@@ -430,7 +432,7 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     // let the (possibly new) apiKey join the pool as the active entry.
     const existingPool = config.providers[name]?.apiKeyPool;
     if (existingPool && !prov.apiKeyPool) prov.apiKeyPool = existingPool;
-    config.providers[name] = prov;
+    config.providers[name] = stripRegistryOnlyStaticHeaders(name, prov);
     if (body.setDefault) config.defaultProvider = name;
     save(config);
     if (prov.apiKey && prov.apiKeyPool) {
@@ -1043,6 +1045,21 @@ export async function handleManagementAPI(req: Request, url: URL, config: OcxCon
     }
   }
 
+  // Manual fallback for browser OAuth: paste the final redirect URL (or authorization code)
+  // when the browser cannot reach the loopback callback (remote/SSH/blocked localhost).
+  if (url.pathname === "/api/oauth/login/code" && req.method === "POST") {
+    const body = await req.json().catch(() => ({})) as { provider?: string; input?: string; code?: string };
+    const provider = (body.provider ?? "").trim().toLowerCase();
+    if (!isOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    const input = typeof body.input === "string" ? body.input : typeof body.code === "string" ? body.code : "";
+    // Authorization responses are measured in hundreds of bytes; never accept the
+    // generic management-body allowance here.
+    if (input.length > 4096) return jsonResponse({ error: "input too long" }, 400);
+    const result = submitManualLoginCode(provider, input);
+    if (!result.ok) return jsonResponse({ error: result.error }, 409);
+    return jsonResponse({ ok: true });
+  }
+
   if (url.pathname === "/api/oauth/status" && req.method === "GET") {
     const provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
     return jsonResponse(getLoginStatus(provider));
@@ -1207,3 +1224,15 @@ export async function fetchAllModels(config: OcxConfig): Promise<CatalogModel[]>
   const { gatherRoutedModels } = await import("../codex/catalog");
   return gatherRoutedModels(config);
 }
+
+function stripRegistryOnlyStaticHeaders(name: string, provider: OcxProviderConfig): OcxProviderConfig {
+  const entry = getProviderRegistryEntry(name);
+  if (!entry?.staticHeaders || !provider.headers) return provider;
+  const headerEntries = Object.entries(provider.headers);
+  const staticEntries = Object.entries(entry.staticHeaders);
+  if (headerEntries.length !== staticEntries.length) return provider;
+  const matchesRegistryStaticHeaders = staticEntries.every(([key, value]) => provider.headers?.[key] === value);
+  if (!matchesRegistryStaticHeaders) return provider;
+  const { headers: _headers, ...rest } = provider;
+  return rest;
+}

package/src/server/relay.ts

@@ -212,10 +212,14 @@ export function responseWithDeferredRequestLog(
     return response;
   }
   if (!response.body || !contentType.includes("text/event-stream")) {
-    if (response.body && contentType.includes("application/json")) {
+    if (response.body && (contentType.includes("application/json") || response.status >= 400)) {
       const finalizeJsonLog = async () => {
         const text = await response.text();
-        inspectResponseLogJson(logCtx, text);
+        // Non-JSON error bodies: inspect/log only a bounded prefix (the stored
+        // upstreamError is 500 chars anyway); the FULL text is still forwarded to the
+        // client below, unchanged. JSON bodies keep full inspection (usage parsing).
+        const isJson = contentType.includes("application/json");
+        inspectResponseLogJson(logCtx, isJson ? text : text.slice(0, 8192));
         addFinalRequestLog(requestId, start, logCtx, response.status, { closeReason: "non_stream" }, addLog);
         return text;
       };

package/src/server/request-log.ts

@@ -294,7 +294,10 @@ function captureUpstreamError(logCtx: RequestLogContext, text: string | null): v
       logCtx.upstreamError = redactSecretString(incompleteReasonLabel(reason.trim())).slice(0, 500);
     }
   } catch {
-    /* not JSON; nothing to capture */
+    const trimmed = text.trim();
+    if (trimmed) {
+      logCtx.upstreamError = redactSecretString(trimmed).slice(0, 500);
+    }
   }
 }