@bitkyc08/opencodex 2.7.40 → 2.7.41

package/src/lib/errors.ts

@@ -4,6 +4,32 @@ export interface OcxErrorPayload {
   code: string | null;
 }
 
+/** OpenAI / Codex hard block for high-risk cybersecurity activity (HTTP 400 or mid-stream). */
+export const CYBER_POLICY_ERROR_CODE = "cyber_policy";
+
+export function isCyberPolicyCode(code: string | null | undefined): boolean {
+  return code === CYBER_POLICY_ERROR_CODE;
+}
+
+/**
+ * Detect OpenAI cyber-policy refusals from message text when structured `code` was stripped.
+ * Matches Codex fallback copy and Cursor/API agent wording (session evidence 2026-07-24).
+ * Does not treat a bare `cyber_policy` token as conclusive — model ids / routing errors can
+ * include that substring without being a policy refusal.
+ */
+export function isCyberPolicyMessage(text: string): boolean {
+  const lower = text.toLowerCase();
+  // Serialized error-code signatures only (not bare model-id collisions).
+  if (/"code"\s*:\s*"cyber_policy"/.test(lower)) return true;
+  if (/\bcode\s*[:=]\s*["']?cyber_policy\b/.test(lower)) return true;
+  if (lower.includes("high-risk cybersecurity")) return true;
+  if (lower.includes("high-risk cyber activity") || lower.includes("high-risk cyber ")) return true;
+  if (lower.includes("possible cybersecurity risk")) return true;
+  if (lower.includes("flagged") && lower.includes("cybersecurity")) return true;
+  if (lower.includes("flagged") && lower.includes("cyber activity")) return true;
+  return false;
+}
+
 function isSubscriptionGateMessage(text: string): boolean {
   return (
     text.includes("requires a subscription") ||
@@ -90,6 +116,11 @@ export function classifyError(status: number, type: string, message: string): Oc
   ) {
     return { message, type: "invalid_request_error", code: "client_closed_request" };
   }
+  // Codex only shows the dedicated cyber UI when error.code === "cyber_policy".
+  // Prefer that code (and invalid_request_error) over generic remaps / 502 upstream_server_error.
+  if (type === CYBER_POLICY_ERROR_CODE || isCyberPolicyMessage(text)) {
+    return { message, type: "invalid_request_error", code: CYBER_POLICY_ERROR_CODE };
+  }
   if (
     text.includes("context_length_exceeded") ||
     text.includes("context window") ||
@@ -190,6 +221,29 @@ export function classifyError(status: number, type: string, message: string): Oc
   return { message, type, code: type || null };
 }
 
+/**
+ * True when a provider failure should participate in rate-limit / quota health blocking.
+ * Reuses {@link classifyError} so generic 429 wording and quota phrases stay aligned.
+ */
+export function isRateLimitOrQuotaFailureMessage(message: string): boolean {
+  const normalized = String(message ?? "").trim();
+  if (!normalized) return false;
+  const numericStatus = Number(normalized);
+  if (numericStatus === 429 || numericStatus === 402) return true;
+  const statusHint = Number.isInteger(numericStatus) && numericStatus > 0 ? numericStatus : 0;
+  const classified = classifyError(statusHint, "", normalized);
+  if (
+    classified.type === "rate_limit_error"
+    || classified.code === "rate_limit_exceeded"
+    || classified.type === "insufficient_quota"
+    || classified.code === "insufficient_quota"
+  ) {
+    return true;
+  }
+  // Retained quota cue used by subagent health before classifyError covered it.
+  return normalized.toLowerCase().includes("usage limit");
+}
+
 /** Best-effort parse of a retry delay embedded in an upstream error message. */
 export function parseRetryAfterFromMessage(message: string): number | undefined {
   const patterns = [
@@ -211,6 +265,8 @@ export function inferHttpStatusFromAdapterMessage(message: string): number {
   const lower = message.toLowerCase();
   // Client aborts (e.g. mid web-search loop) must not look like upstream 502s in /api/logs.
   if (isClientClosedMessage(lower)) return 499;
+  // Codex Transport maps cyber_policy only on HTTP 400 (SSE is code-based).
+  if (isCyberPolicyMessage(lower)) return 400;
   // See classifyError: this prefix now only means explicit request-size overflow (400);
   // quota-style Cursor resource exhaustion carries the rate-limit prefix and maps to 429.
   if (lower.includes("cursor resource limit exceeded")) return 400;
@@ -282,6 +338,9 @@ export function httpStatusFromTerminalError(error: {
 } | undefined): number {
   if (!error) return 502;
   if (error.code === "client_closed_request" || error.code === "client_cancelled") return 499;
+  if (isCyberPolicyCode(error.code) || (error.message ? isCyberPolicyMessage(error.message) : false)) {
+    return 400;
+  }
   if (error.type === "rate_limit_error" || error.code === "rate_limit_exceeded") return 429;
   if (error.type === "authentication_error" || error.code === "invalid_api_key") return 401;
   if (

package/src/lib/privacy.ts

@@ -9,3 +9,12 @@ export function maskEmail(value: string | null | undefined): string | null {
   if (local.length === 2) return `${local[0]}*@${domain}`;
   return `${local[0]}***${local[local.length - 1]}@${domain}`;
 }
+
+export function maskAccountId(value: string | null | undefined): string | null {
+  if (!value) return null;
+  const id = value.trim();
+  if (!id) return null;
+  // Short IDs would disclose the entire identifier via the suffix; use a non-identifying placeholder.
+  if (id.length <= 4) return "account-…";
+  return `account-…${id.slice(-4)}`;
+}

package/src/lib/process-control.ts

@@ -45,15 +45,22 @@ export function gracefulStopHost(hostname: string | undefined): string {
   return trimmed.includes(":") ? `[${trimmed}]` : trimmed;
 }
 
+/**
+ * Outcome of a graceful stop attempt. `"refused"` is distinct from failure: the proxy answered
+ * that it must NOT be stopped from here, so callers must not escalate to a forced kill.
+ */
+export type GracefulStopResult = boolean | "refused";
+
 /**
  * Ask a running proxy to stop itself via the management API (`POST /api/stop`), which
  * drains in-flight turns, restores native Codex, and cleans its pid/runtime files.
  * This is the only way to get a GRACEFUL stop on Windows, where the POSIX
  * SIGTERM-then-SIGKILL ladder does not exist and `taskkill /F` gives the proxy no
  * chance to run its shutdown handlers. Returns false when the proxy can't be reached
- * or doesn't exit in time — callers fall back to {@link killProxy}.
+ * or doesn't exit in time — callers fall back to {@link killProxy}. Returns `"refused"`
+ * when the proxy declines the stop (HTTP 409), which callers must NOT force past.
  */
-export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}): Promise<boolean> {
+export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}): Promise<GracefulStopResult> {
   const readRuntime = io.readRuntime ?? readRuntimePort;
   const runtime = readRuntime(pid);
   if (!runtime?.port) return false;
@@ -67,8 +74,15 @@ export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}):
     const res = await fetchFn(`http://${gracefulStopHost(runtime.hostname)}:${runtime.port}/api/stop`, {
       method: "POST",
       headers,
-      signal: AbortSignal.timeout(2000),
+      // Hung proxies with many CLOSE_WAIT clients can be slow to accept; give them
+      // longer than a health poll so we prefer drain over taskkill /F.
+      signal: AbortSignal.timeout(io.exitTimeoutMs ? Math.min(io.exitTimeoutMs, 10_000) : 10_000),
     });
+    // 409 is the proxy REFUSING to stop (a service installed under another home owns it and
+    // would respawn it anyway). That is a policy answer, not a dead endpoint — escalating to
+    // SIGTERM here would run the daemon's cleanup and strip shared config out from under the
+    // still-running service. Report the refusal instead of forcing.
+    if (res.status === 409) return "refused";
     if (!res.ok) return false;
   } catch {
     return false;
@@ -91,13 +105,52 @@ function drainDeadlineMs(): number {
 /** Graceful-first stop: management-API drain, then the platform kill ladder. */
 export async function stopProxy(pid: number): Promise<void> {
   if (!isProcessAlive(pid)) return;
-  if (await stopProxyGracefully(pid)) return;
+  const runtime = readRuntimePort(pid);
+  const graceful = await stopProxyGracefully(pid);
+  if (graceful === "refused") {
+    // The proxy refused on purpose (foreign service owns it). Forcing would strip shared
+    // config while that service keeps the proxy alive.
+    throw new Error(
+      "The running proxy refused to stop: a service installed under a different "
+      + "CODEX_HOME/OPENCODEX_HOME owns it. Run the stop from that home.",
+    );
+  }
+  if (graceful) {
+    await waitForStoppedPort(runtime, pid);
+    return;
+  }
   killProxy(pid);
+  await waitForStoppedPort(runtime, pid);
+}
+
+/** After stop/kill, wait for the former listen port to become bindable (Windows drain). */
+async function waitForStoppedPort(
+  runtime: { port: number; hostname?: string } | null | undefined,
+  stoppedPid?: number,
+): Promise<void> {
+  if (!runtime?.port) return;
+  try {
+    const { reclaimListenPort } = await import("../server/port-reclaim");
+    await reclaimListenPort(runtime.port, runtime.hostname ?? "127.0.0.1", {
+      timeoutMs: 15_000,
+      intervalMs: 100,
+      scanIntervalMs: 500,
+      // Only the process we just stopped — never kill a newly started twin proxy.
+      killOcxHolders: !!(stoppedPid && stoppedPid > 0),
+      onlyKillPids: stoppedPid && stoppedPid > 0 ? [stoppedPid] : [],
+    });
+  } catch {
+    /* best-effort — callers that need a hard guarantee reclaim again before bind */
+  }
 }
 
 export function killProxy(pid: number): void {
   if (!isProcessAlive(pid)) return;
   if (process.platform === "win32") {
+    // Windows process.kill(SIGTERM/SIGINT) is TerminateProcess — not a graceful signal.
+    // Graceful drain happens only via stopProxyGracefully() (POST /api/stop). This path
+    // is the hard fallback: taskkill /T /F so the process tree exits (ghost LISTEN /
+    // CLOSE_WAIT are then cleared by reclaimListenPort / SetTcpEntry).
     const taskkill = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\taskkill.exe`;
     try {
       execFileSync(taskkill, ["/PID", String(pid), "/T", "/F"], { stdio: "pipe", windowsHide: true });

package/src/oauth/health.ts

@@ -0,0 +1,375 @@
+import { getCodexAccountHealthSnapshot, type CodexCooldownSource } from "../codex/routing";
+import { isAccountNeedsReauth } from "../codex/account-runtime-state";
+import { getCodexAccountCredential, listCodexAccountIds } from "../codex/account-store";
+import { MAIN_CODEX_ACCOUNT_ID } from "../codex/main-account";
+import { maskAccountId } from "../lib/privacy";
+import { loadServiceTokenFromFile } from "../lib/service-secrets";
+import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
+import { loadAuthStore, peekAuthStore, peekOAuthRefreshIntent, readOAuthRefreshIntent } from "./store";
+import type { ProviderAccount } from "./types";
+
+export type OAuthAccountHealth =
+  | { status: "healthy" }
+  | { status: "cooldown"; until: string; reason: "rate_limit" | "quota" }
+  | { status: "reauth_required"; reason: "unauthorized" | "forbidden" | "refresh_failed" }
+  | { status: "warning"; reason: "refresh_conflict" | "metadata_mismatch" | "stale_credentials" };
+
+export type OAuthHealthLabel =
+  | "Healthy"
+  | "Rate limited"
+  | "Quota limited"
+  | "Reauthentication required"
+  | "Refresh failed"
+  | "Metadata mismatch"
+  | "Credential conflict";
+
+/** Shared masked-id fallback when `maskAccountId` returns nullish. */
+export const MASKED_ACCOUNT_FALLBACK = "account-…????";
+
+export type OAuthHealthEntry = {
+  provider: string;
+  accountId: string;
+  health: OAuthAccountHealth;
+  action?: string;
+};
+
+export type OAuthAccountHealthFields = {
+  health: OAuthAccountHealth;
+  healthLabel: OAuthHealthLabel;
+  healthSummary: string;
+  healthAction?: string;
+};
+
+export type CollectOAuthHealthOptions = {
+  /** Skip chmod/backup side effects when reading credential files (doctor/status). */
+  observeOnly?: boolean;
+  /**
+   * When true (default), include Codex entries from this process's in-memory maps.
+   * CLI surfaces should prefer {@link collectOAuthHealthEntriesForCli} which queries the live proxy.
+   */
+  includeLocalCodex?: boolean;
+};
+
+type OAuthWarningReason = "refresh_conflict" | "metadata_mismatch" | "stale_credentials";
+
+export function projectOAuthAccountHealth(input: {
+  needsReauth?: boolean;
+  reauthReason?: "unauthorized" | "forbidden" | "refresh_failed";
+  cooldownUntilMs?: number;
+  cooldownReason?: "rate_limit" | "quota";
+  warningReason?: OAuthWarningReason;
+  now?: number;
+}): OAuthAccountHealth {
+  const now = input.now ?? Date.now();
+  if (input.needsReauth) {
+    return { status: "reauth_required", reason: input.reauthReason ?? "refresh_failed" };
+  }
+  if (
+    typeof input.cooldownUntilMs === "number"
+    && Number.isFinite(input.cooldownUntilMs)
+    && input.cooldownUntilMs > now
+  ) {
+    return {
+      status: "cooldown",
+      until: new Date(input.cooldownUntilMs).toISOString(),
+      reason: input.cooldownReason ?? "quota",
+    };
+  }
+  if (input.warningReason) {
+    return { status: "warning", reason: input.warningReason };
+  }
+  return { status: "healthy" };
+}
+
+/** Codex pool accounts are not a public `ocx login` provider; reauth is dashboard-driven. */
+export const CODEX_REAUTH_ACTION = "reauthenticate via the dashboard Codex account pool";
+
+function actionFor(provider: string, health: OAuthAccountHealth): string | undefined {
+  if (health.status === "reauth_required") {
+    if (provider === "codex") return CODEX_REAUTH_ACTION;
+    return `run \`ocx login ${provider}\``;
+  }
+  if (health.status === "cooldown") {
+    // Keep the transported deadline machine-readable (ISO); presentation layers localize/format.
+    return `wait until ${health.until} or start a new session with another eligible account`;
+  }
+  if (health.status === "warning" && health.reason === "refresh_conflict") {
+    return "re-run `ocx doctor` after ensuring only one proxy process writes the credential store";
+  }
+  return undefined;
+}
+
+export function oauthHealthLabel(health: OAuthAccountHealth): OAuthHealthLabel {
+  switch (health.status) {
+    case "healthy":
+      return "Healthy";
+    case "cooldown":
+      return health.reason === "rate_limit" ? "Rate limited" : "Quota limited";
+    case "reauth_required":
+      return health.reason === "refresh_failed" ? "Refresh failed" : "Reauthentication required";
+    case "warning":
+      switch (health.reason) {
+        case "refresh_conflict":
+          return "Credential conflict";
+        case "metadata_mismatch":
+          return "Metadata mismatch";
+        case "stale_credentials":
+          return "Refresh failed";
+      }
+  }
+}
+
+function displayAccountForHealth(accountId: string): string {
+  if (accountId === MAIN_CODEX_ACCOUNT_ID) return "main account";
+  return maskAccountId(accountId) ?? MASKED_ACCOUNT_FALLBACK;
+}
+
+export function oauthHealthSummary(
+  provider: string,
+  accountId: string,
+  health: OAuthAccountHealth,
+  action?: string,
+): string {
+  const masked = displayAccountForHealth(accountId);
+  let summary: string;
+  switch (health.status) {
+    case "healthy":
+      summary = `${provider} ${masked}: healthy`;
+      break;
+    case "cooldown": {
+      const why = health.reason === "rate_limit" ? "rate limited" : "quota limited";
+      summary = `${provider} ${masked}: ${why} until ${health.until}. Routing for this account is paused until then.`;
+      break;
+    }
+    case "reauth_required":
+      summary = `${provider} ${masked}: reauthentication required (${health.reason.replaceAll("_", " ")}).`;
+      break;
+    case "warning":
+      summary = `${provider} ${masked}: ${health.reason.replaceAll("_", " ")}.`;
+      break;
+  }
+  if (action && health.status !== "healthy") {
+    return `${summary} Next: ${action}`;
+  }
+  return summary;
+}
+
+export function oauthAccountHealthFields(
+  provider: string,
+  accountId: string,
+  health: OAuthAccountHealth,
+): OAuthAccountHealthFields {
+  const action = actionFor(provider, health);
+  return {
+    health,
+    healthLabel: oauthHealthLabel(health),
+    healthSummary: oauthHealthSummary(provider, accountId, health, action),
+    ...(action ? { healthAction: action } : {}),
+  };
+}
+
+export function projectStoredOAuthAccountHealth(
+  provider: string,
+  account: ProviderAccount,
+  now = Date.now(),
+  opts: { observeOnly?: boolean } = {},
+): OAuthAccountHealth {
+  return projectOAuthAccountHealth({
+    needsReauth: account.needsReauth === true,
+    reauthReason: account.needsReauth === true ? "refresh_failed" : undefined,
+    warningReason: detectOAuthWarning(provider, account, opts.observeOnly === true, now),
+    now,
+  });
+}
+
+export function projectCodexAccountHealth(input: {
+  accountId: string;
+  needsReauth: boolean;
+  now?: number;
+}): OAuthAccountHealth {
+  const now = input.now ?? Date.now();
+  const snap = getCodexAccountHealthSnapshot(input.accountId, now);
+  return projectOAuthAccountHealth({
+    needsReauth: input.needsReauth,
+    reauthReason: input.needsReauth ? "refresh_failed" : undefined,
+    cooldownUntilMs: snap?.cooldownUntil,
+    cooldownReason: cooldownReasonFromSource(snap?.cooldownSource),
+    now,
+  });
+}
+
+/**
+ * Incomplete credentials warning. Kiro may intentionally store an empty refresh
+ * when authenticated via KIRO_ACCESS_TOKEN or a pasted access-only token, as long
+ * as the access token is still unexpired.
+ */
+export function detectOAuthWarning(
+  provider: string,
+  account: ProviderAccount,
+  observeOnly = false,
+  now = Date.now(),
+): OAuthWarningReason | undefined {
+  const intent = observeOnly
+    ? peekOAuthRefreshIntent(provider, account.id)
+    : readOAuthRefreshIntent(provider, account.id);
+  if (intent?.uncertain) return "refresh_conflict";
+  const cred = account.credential;
+  if (!cred?.access) return "stale_credentials";
+  if (!cred.refresh) {
+    if (
+      provider === "kiro"
+      && typeof cred.expires === "number"
+      && Number.isFinite(cred.expires)
+      && cred.expires > now
+    ) {
+      return undefined;
+    }
+    return "stale_credentials";
+  }
+  return undefined;
+}
+
+function cooldownReasonFromSource(
+  source: CodexCooldownSource | undefined,
+): "rate_limit" | "quota" | undefined {
+  if (!source) return undefined;
+  return source === "retry-after" ? "rate_limit" : "quota";
+}
+
+function pushEntry(
+  entries: OAuthHealthEntry[],
+  provider: string,
+  accountId: string,
+  health: OAuthAccountHealth,
+): void {
+  const action = actionFor(provider, health);
+  entries.push({
+    provider,
+    accountId,
+    health,
+    ...(action ? { action } : {}),
+  });
+}
+
+function collectLocalCodexEntries(now: number): OAuthHealthEntry[] {
+  const entries: OAuthHealthEntry[] = [];
+  const codexIds = new Set(listCodexAccountIds());
+  codexIds.add(MAIN_CODEX_ACCOUNT_ID);
+  for (const accountId of codexIds) {
+    const snap = getCodexAccountHealthSnapshot(accountId, now);
+    const needsReauth = isAccountNeedsReauth(accountId);
+    const hasPoolCredential = accountId !== MAIN_CODEX_ACCOUNT_ID && getCodexAccountCredential(accountId) !== null;
+    if (!hasPoolCredential && !needsReauth && !snap) continue;
+
+    const health = projectOAuthAccountHealth({
+      needsReauth,
+      reauthReason: needsReauth ? "refresh_failed" : undefined,
+      cooldownUntilMs: snap?.cooldownUntil,
+      cooldownReason: cooldownReasonFromSource(snap?.cooldownSource),
+      now,
+    });
+    pushEntry(entries, "codex", accountId, health);
+  }
+  return entries;
+}
+
+export function collectOAuthHealthEntries(
+  now = Date.now(),
+  opts: CollectOAuthHealthOptions = {},
+): OAuthHealthEntry[] {
+  const observeOnly = opts.observeOnly === true;
+  const includeLocalCodex = opts.includeLocalCodex !== false;
+  const entries: OAuthHealthEntry[] = [];
+  const store = observeOnly ? peekAuthStore() : loadAuthStore();
+
+  for (const [provider, set] of Object.entries(store)) {
+    for (const account of set.accounts) {
+      const health = projectStoredOAuthAccountHealth(provider, account, now, { observeOnly });
+      pushEntry(entries, provider, account.id, health);
+    }
+  }
+
+  if (includeLocalCodex) {
+    for (const entry of collectLocalCodexEntries(now)) entries.push(entry);
+  }
+
+  return entries;
+}
+
+type ProxyCodexAccountHealth = {
+  id: string;
+  health?: OAuthAccountHealth;
+  needsReauth?: boolean;
+};
+
+const KNOWN_HEALTH_STATUSES = new Set(["healthy", "cooldown", "reauth_required", "warning"]);
+
+function coerceRemoteAccountHealth(
+  account: ProxyCodexAccountHealth,
+): OAuthAccountHealth {
+  const raw = account.health;
+  if (raw && typeof raw === "object" && KNOWN_HEALTH_STATUSES.has((raw as { status?: string }).status ?? "")) {
+    return raw;
+  }
+  return projectOAuthAccountHealth({ needsReauth: account.needsReauth === true });
+}
+
+async function fetchCodexHealthFromLiveProxy(
+  fetchImpl: typeof fetch = fetch,
+  findLiveProxyImpl: typeof findLiveProxy = findLiveProxy,
+): Promise<OAuthHealthEntry[] | null> {
+  const live = await findLiveProxyImpl();
+  if (!live) return null;
+  const token = process.env.OPENCODEX_API_AUTH_TOKEN ?? loadServiceTokenFromFile(process.env);
+  const headers: Record<string, string> = {};
+  if (token) headers.Authorization = `Bearer ${token}`;
+  try {
+    const res = await fetchImpl(
+      `http://${probeHostname(live.hostname)}:${live.port}/api/codex-auth/accounts`,
+      { headers, signal: AbortSignal.timeout(4000) },
+    );
+    if (!res.ok) return null;
+    const json = await res.json() as { accounts?: ProxyCodexAccountHealth[] };
+    if (!Array.isArray(json.accounts)) return null;
+    const entries: OAuthHealthEntry[] = [];
+    for (const account of json.accounts) {
+      if (!account?.id || typeof account.id !== "string") continue;
+      pushEntry(entries, "codex", account.id, coerceRemoteAccountHealth(account));
+    }
+    return entries;
+  } catch {
+    return null;
+  }
+}
+
+/** How CLI/doctor obtained Codex cooldown/reauth (proxy memory only lives in the proxy). */
+export type CodexHealthSource = "management-api" | "unavailable";
+
+export type OAuthCliHealthReport = {
+  entries: OAuthHealthEntry[];
+  codexHealthSource: CodexHealthSource;
+};
+
+/** Shown by `ocx status` / `ocx doctor` when the proxy management API is unreachable. */
+export const CODEX_HEALTH_UNAVAILABLE_NOTE =
+  "Codex health: unavailable (proxy not running; live cooldown/reauth requires the management API)";
+
+/**
+ * CLI/doctor collector: observe-only OAuth store reads, and Codex health only from the
+ * running proxy management API. Never reads proxy process-local maps from the CLI process.
+ */
+export async function collectOAuthHealthEntriesForCli(
+  now = Date.now(),
+  deps: {
+    fetchImpl?: typeof fetch;
+    findLiveProxyImpl?: typeof findLiveProxy;
+  } = {},
+): Promise<OAuthCliHealthReport> {
+  const entries = collectOAuthHealthEntries(now, { observeOnly: true, includeLocalCodex: false });
+  const remote = await fetchCodexHealthFromLiveProxy(deps.fetchImpl, deps.findLiveProxyImpl);
+  if (remote) {
+    for (const entry of remote) entries.push(entry);
+    return { entries, codexHealthSource: "management-api" };
+  }
+  return { entries, codexHealthSource: "unavailable" };
+}