@bitkyc08/opencodex 2.7.9-preview.20260712.1 → 2.7.9

package/src/lib/upstream-retry.ts

@@ -14,12 +14,19 @@
  * MUST stay a leaf module: imports nothing from server.ts or adapters (kiro-retry imports
  * the shared abort helpers from here).
  */
+import { clearableDeadline } from "./abort";
 
 // 1 initial + 2 retries: the pool may hold more than one stale socket.
 const RESET_RETRY_MAX_ATTEMPTS = 3;
 const RESET_RETRY_BASE_DELAY_MS = 150;
 const RESET_RETRY_MAX_DELAY_MS = 1_000;
 
+export interface RetryBackoffOptions {
+  baseDelayMs: number;
+  maxDelayMs: number;
+  headers?: Headers;
+}
+
 export function abortError(signal?: AbortSignal): unknown {
   return signal?.reason ?? new DOMException("The operation was aborted", "AbortError");
 }
@@ -56,11 +63,51 @@ export function isConnectionResetError(err: unknown): boolean {
     || msg.includes("connection reset by peer");
 }
 
-function retryDelayMs(attempt: number): number {
-  const exp = Math.min(RESET_RETRY_BASE_DELAY_MS * (2 ** attempt), RESET_RETRY_MAX_DELAY_MS);
+function retryAfterDelayMs(headers: Headers): number | undefined {
+  const raw = headers.get("retry-after")?.trim();
+  if (!raw) return undefined;
+  const seconds = Number(raw);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1000);
+  const dateMs = Date.parse(raw);
+  if (!Number.isFinite(dateMs)) return undefined;
+  return Math.max(0, dateMs - Date.now());
+}
+
+export function retryBackoffDelayMs(attempt: number, opts: RetryBackoffOptions): number {
+  const retryAfter = opts.headers ? retryAfterDelayMs(opts.headers) : undefined;
+  if (retryAfter !== undefined) return Math.min(retryAfter, opts.maxDelayMs);
+  const exp = Math.min(opts.baseDelayMs * (2 ** attempt), opts.maxDelayMs);
   return Math.floor(exp * (0.8 + Math.random() * 0.4));
 }
 
+export function cancelResponseBodyBestEffort(res: Response): void {
+  try {
+    const cancellation = res.body?.cancel();
+    if (cancellation) void cancellation.catch(() => {});
+  } catch {
+    // Cancellation is cleanup only; retries must not wait for or fail because of it.
+  }
+}
+
+export async function fetchWithAttemptDeadline(
+  url: string,
+  init: RequestInit,
+  timeoutMs: number,
+  abortSignal?: AbortSignal,
+): Promise<Response> {
+  const attemptTimeout = clearableDeadline(timeoutMs, abortSignal);
+  try {
+    return await fetch(url, {
+      ...init,
+      signal: attemptTimeout.signal,
+    });
+  } finally {
+    // Only the header timer is cleared. The composed signal still contains the parent, so a
+    // caller abort after headers continue to cancel consumption of the returned response body.
+    attemptTimeout.clear();
+  }
+}
+
 export interface ResetRetryOptions {
   abortSignal?: AbortSignal;
   /** Short host/path label for the retry warn log (no secrets/query strings). */
@@ -89,7 +136,10 @@ export async function fetchWithResetRetry(
       console.warn(
         `[upstream-retry] connection reset${opts.label ? ` (${opts.label})` : ""} — retrying (${attempt + 2}/${attempts})`,
       );
-      await sleepWithAbort(retryDelayMs(attempt), opts.abortSignal);
+      await sleepWithAbort(retryBackoffDelayMs(attempt, {
+        baseDelayMs: RESET_RETRY_BASE_DELAY_MS,
+        maxDelayMs: RESET_RETRY_MAX_DELAY_MS,
+      }), opts.abortSignal);
     }
   }
   throw lastError ?? new Error("upstream fetch failed");

package/src/lib/windows-secret-acl.ts

@@ -0,0 +1,173 @@
+/**
+ * Windows per-user NTFS ACL hardening for secret files and directories.
+ *
+ * On Windows, `chmod` only controls POSIX-style bits in the ACE list and does NOT remove
+ * inherited permissions from other users. Real per-user isolation requires icacls to:
+ *   1. Disable inheritance   (icacls path /inheritance:r)
+ *   2. Strip broad explicit grants by SID (Everyone, Users, Authenticated Users)
+ *   3. Grant the current user full control (icacls path /grant:r "CURRENTUSER:(F)")
+ *
+ * On non-Windows platforms the helpers fall through to the caller's existing chmod-based
+ * behaviour: they return ok:true without invoking any external process.
+ *
+ * Design:
+ *   hardenSecretPath(path, { required: false }) — non-fatal read-path mode.
+ *     Never throws. Returns { ok, diagnostics? }.
+ *   hardenSecretPath(path, { required: true })  — write-path mode.
+ *     Throws a sanitized error (no raw path) on Windows ACL failure.
+ *   hardenSecretDir  — same contract for directories.
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { env, platform } from "node:process";
+
+const hardenedDirectories = new Set<string>();
+const hardenedPaths = new Set<string>();
+
+export interface HardenResult {
+  ok: boolean;
+  diagnostics?: string;
+}
+
+export interface HardenOptions {
+  required: boolean;
+}
+
+/**
+ * Return the current Windows username from the environment.
+ * Falls back to USERDOMAIN\USERNAME if USERNAME alone is ambiguous.
+ * The value is used directly in icacls arguments, so it must be present.
+ */
+function currentWindowsUser(): string | undefined {
+  const username = env["USERNAME"];
+  const domain = env["USERDOMAIN"];
+  if (!username) return undefined;
+  // USERDOMAIN is the machine/domain name; USERNAME is the account name.
+  // icacls accepts "DOMAIN\User" or just "User" for local accounts.
+  return domain ? `${domain}\\${username}` : username;
+}
+
+/**
+ * Run icacls to harden a single file system entry.
+ * - Disables inheritance (keeps nothing: /inheritance:r)
+ * - Grants the current user Full Control
+ *
+ * We do NOT use a shell string; all arguments are passed as an array so no
+ * shell injection is possible even for paths with unusual characters.
+ *
+ * Throws the raw child_process error on failure (caller sanitizes).
+ */
+function runIcacls(targetPath: string, directory: boolean): void {
+  const user = currentWindowsUser();
+  if (!user) {
+    throw new Error("Cannot determine current Windows user for ACL hardening");
+  }
+
+  // Step 1: disable inheritance and remove inherited ACEs
+  execFileSync("icacls.exe", [targetPath, "/inheritance:r"], {
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5000,
+    shell: false,
+  });
+
+  // Step 2: remove broad explicit grants using stable SIDs (not localized names).
+  execFileSync("icacls.exe", [
+    targetPath,
+    "/remove:g",
+    "*S-1-1-0",
+    "*S-1-5-11",
+    "*S-1-5-32-545",
+  ], {
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5000,
+    shell: false,
+  });
+
+  // Step 3: grant current user full control.
+  const grant = directory ? `${user}:(OI)(CI)(F)` : `${user}:(F)`;
+  execFileSync("icacls.exe", [targetPath, "/grant:r", grant], {
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5000,
+    shell: false,
+  });
+}
+
+/**
+ * Sanitize an error from a failed ACL operation into a safe diagnostic string.
+ * The raw path must not appear in the returned string (it may contain
+ * sensitive username components or PII from the home directory path).
+ */
+function sanitizeDiagnostics(error: unknown): string {
+  // We do not expose the raw error message or any path-like fragments.
+  // Just describe what failed generically.
+  const code = error instanceof Error && "code" in error ? String((error as NodeJS.ErrnoException).code) : "";
+  const codePart = code ? ` (${code})` : "";
+  return `ACL hardening failed${codePart} — filesystem may not support per-user NTFS ACLs`;
+}
+
+/**
+ * Harden a single file path with per-user NTFS ACLs on Windows.
+ * On non-Windows platforms, returns ok:true immediately (caller owns chmod).
+ *
+ * @param targetPath  Absolute path to the file to harden.
+ * @param opts        { required: boolean } — required:true throws on failure.
+ */
+export function hardenSecretPath(targetPath: string, opts: HardenOptions): HardenResult {
+  // Skip for missing files — we cannot harden what does not exist yet.
+  if (!existsSync(targetPath)) {
+    return { ok: true };
+  }
+
+  // Non-Windows: no NTFS ACLs; caller handles chmod.
+  if (platform !== "win32") {
+    return { ok: true };
+  }
+
+  if (hardenedPaths.has(targetPath)) return { ok: true };
+
+  try {
+    runIcacls(targetPath, false);
+    hardenedPaths.add(targetPath);
+    return { ok: true };
+  } catch (err) {
+    const diagnostics = sanitizeDiagnostics(err);
+    if (opts.required) {
+      throw new Error(diagnostics);
+    }
+    return { ok: false, diagnostics };
+  }
+}
+
+/**
+ * Harden a directory path with per-user NTFS ACLs on Windows.
+ * On non-Windows platforms, returns ok:true immediately (caller owns chmod).
+ *
+ * @param targetPath  Absolute path to the directory to harden.
+ * @param opts        { required: boolean } — required:true throws on failure.
+ */
+export function hardenSecretDir(targetPath: string, opts: HardenOptions): HardenResult {
+  // Skip for missing directories — we cannot harden what does not exist yet.
+  if (!existsSync(targetPath)) {
+    return { ok: true };
+  }
+
+  // Non-Windows: no NTFS ACLs; caller handles chmod.
+  if (platform !== "win32") {
+    return { ok: true };
+  }
+
+  if (hardenedDirectories.has(targetPath)) return { ok: true };
+
+  try {
+    runIcacls(targetPath, true);
+    hardenedDirectories.add(targetPath);
+    return { ok: true };
+  } catch (err) {
+    const diagnostics = sanitizeDiagnostics(err);
+    if (opts.required) {
+      throw new Error(diagnostics);
+    }
+    return { ok: false, diagnostics };
+  }
+}

package/src/oauth/index.ts

@@ -12,6 +12,7 @@ import { loginAntigravity, refreshAntigravityToken } from "./google-antigravity"
 import { loginCursor, refreshCursorToken } from "./cursor";
 import { deriveOAuthDefaultModel, deriveOAuthProviderConfig } from "../providers/derive";
 import { effectiveGoogleMode } from "../providers/registry";
+import { resolveProviderTransport } from "../providers/xai-transport";
 
 const REFRESH_SKEW_MS = 60_000;
 const tokenRefreshes = new Map<string, Promise<string>>();
@@ -254,27 +255,28 @@ export async function resolveModelsAuthToken(name: string, prov: OcxProviderConf
  * response.
  */
 export function buildModelsRequest(prov: OcxProviderConfig, apiKey: string | undefined, providerName = ""): { url: string; headers: Record<string, string> } {
-  const headers: Record<string, string> = { ...(prov.headers ?? {}) };
-  if (effectiveGoogleMode(providerName, prov) === "ai-studio") {
+  const effectiveProvider = resolveProviderTransport(providerName, prov);
+  const headers: Record<string, string> = { ...(effectiveProvider.headers ?? {}) };
+  if (effectiveGoogleMode(providerName, effectiveProvider) === "ai-studio") {
     // Generative Language API: API key goes in x-goog-api-key (never Authorization: Bearer),
     // models live under /v1beta (v1 misses preview models), and pageSize maxes at 1000 —
     // enough to list everything without a pageToken loop. Vertex/antigravity keep the
     // generic branch (they fall back to their static model lists).
     if (apiKey) headers["x-goog-api-key"] = apiKey;
-    return { url: `${prov.baseUrl}/v1beta/models?pageSize=1000`, headers };
+    return { url: `${effectiveProvider.baseUrl}/v1beta/models?pageSize=1000`, headers };
   }
-  if (prov.adapter === "anthropic") {
+  if (effectiveProvider.adapter === "anthropic") {
     headers["anthropic-version"] = "2023-06-01";
-    if (prov.authMode === "oauth") {
+    if (effectiveProvider.authMode === "oauth") {
       headers["anthropic-beta"] = ANTHROPIC_OAUTH_BETA;
       if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
     } else if (apiKey) {
       headers["x-api-key"] = apiKey;
     }
-    return { url: `${prov.baseUrl}/v1/models?limit=1000`, headers };
+    return { url: `${effectiveProvider.baseUrl}/v1/models?limit=1000`, headers };
   }
   if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
-  return { url: `${prov.baseUrl}/models`, headers };
+  return { url: `${effectiveProvider.baseUrl}/models`, headers };
 }
 
 /**

package/src/oauth/store.ts

@@ -54,6 +54,7 @@ function persist(store: AuthStore): void {
   } else {
     try { chmodSync(dir, 0o700); } catch { /* best-effort on existing dir */ }
   }
+  hardenConfigDir();
   atomicWriteFile(authPath(), JSON.stringify(store, null, 2) + "\n");
 }
 

package/src/providers/registry.ts

@@ -18,6 +18,7 @@ export interface ProviderRegistryEntry {
   adapter: string;
   baseUrl: string;
   authKind: ProviderAuthKind;
+  allowPrivateNetworkByDefault?: boolean;
   keyOptional?: boolean;
   allowBaseUrlOverride?: boolean;
   modelSuffixBracketStrip?: boolean;
@@ -235,6 +236,11 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
     models: ["grok-4.5", "grok-4.3", "grok-4.20-multi-agent-0309", "grok-4.20-0309-reasoning", "grok-4.20-0309-non-reasoning", "grok-build-0.1", "grok-composer-2.5-fast"],
     defaultModel: "grok-4.5",
     noReasoningModels: ["grok-4.20-0309-non-reasoning", "grok-build-0.1", "grok-composer-2.5-fast"],
+    // Replay assistant reasoning_content for grok reasoning models: xAI documents dropped
+    // reasoning_content as the top cause of prompt-cache misses on multi-turn conversations
+    // (docs.x.ai prompt-caching/multi-turn, verified 2026-07-13 — devlog/_plan/260713_grok_caching).
+    // Models that never emit reasoning simply have no thinking parts to replay (no-op).
+    preserveReasoningContentModels: ["grok-4.5", "grok-4.3", "grok-4.20-multi-agent-0309", "grok-4.20-0309-reasoning"],
     // grok-4.5 reasoning is always-on with low/medium/high control (no off tier upstream).
     modelReasoningEfforts: { "grok-4.5": ["low", "medium", "high"] },
     modelContextWindows: {
@@ -436,9 +442,9 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   { id: "google-vertex", label: "Google Vertex AI", adapter: "google", baseUrl: "https://aiplatform.googleapis.com", authKind: "key", dashboardUrl: "https://console.cloud.google.com/vertex-ai", defaultModel: "gemini-3-pro", googleMode: "vertex", jawcodeBundle: "google", extraMetadataAliases: ["gemini-vertex"] },
   { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, defaultModel: "gemini-3.5-flash-low", modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
   { id: "azure-openai", label: "Azure OpenAI", adapter: "azure-openai", baseUrl: "https://{resource}.openai.azure.com/openai", authKind: "key", featured: true, dashboardUrl: "https://portal.azure.com" },
-  { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
-  { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
-  { id: "lm-studio", label: "LM Studio (local)", adapter: "openai-chat", baseUrl: "http://localhost:1234/v1", authKind: "local", allowBaseUrlOverride: true, featured: true, note: "Local — no key needed" },
+  { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
+  { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
+  { id: "lm-studio", label: "LM Studio (local)", adapter: "openai-chat", baseUrl: "http://localhost:1234/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — no key needed" },
   {
     id: "deepseek",
     label: "DeepSeek",
@@ -521,6 +527,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   {
     id: "litellm", label: "LiteLLM (self-hosted)", baseUrl: "http://localhost:4000/v1", adapter: "openai-chat", authKind: "key",
     dashboardUrl: "https://docs.litellm.ai/docs/proxy/quick_start",
+    allowPrivateNetworkByDefault: true,
     allowBaseUrlOverride: true,
     // A self-hosted proxy may legitimately run without a master key.
     keyOptional: true,

package/src/providers/xai-transport.ts

@@ -0,0 +1,89 @@
+import { createHash } from "node:crypto";
+import type { OcxProviderConfig } from "../types";
+
+/**
+ * xAI account OAuth and xAI API keys share a bearer shape but not a billing
+ * transport. OAuth represents the Grok CLI subscription entitlement, while a
+ * key represents the API team. Keep the saved provider preset compatible with
+ * the dashboard's "Use an API key instead" switch and resolve the transport at
+ * request time.
+ */
+export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
+
+/** Minimum-compatible official Grok CLI wire version verified with the proxy. */
+export const XAI_GROK_CLIENT_VERSION = "0.2.93";
+
+const XAI_GROK_CLI_HEADERS: Readonly<Record<string, string>> = {
+  "x-grok-client-identifier": "opencodex",
+  "x-grok-client-version": XAI_GROK_CLIENT_VERSION,
+  "x-xai-token-auth": "xai-grok-cli",
+};
+
+/**
+ * Sticky-routing hint for xAI's automatic prefix cache. xAI routes requests
+ * carrying the same `x-grok-conv-id` to the same server, which is where the
+ * prompt cache lives (docs.x.ai prompt-caching best-practices; verified
+ * 2026-07-13, devlog/_plan/260713_grok_caching). Codex clients send a stable
+ * per-conversation `prompt_cache_key`; hash it so the raw session id never
+ * leaves the proxy.
+ */
+export const XAI_CONV_ID_HEADER = "x-grok-conv-id";
+
+function hasHeaderCaseInsensitive(headers: Record<string, string> | undefined, name: string): boolean {
+  if (!headers) return false;
+  const target = name.toLowerCase();
+  return Object.keys(headers).some(key => key.toLowerCase() === target);
+}
+
+/** Drop default entries the user already overrides under any header-name casing. */
+function withoutUserOverridden(defaults: Readonly<Record<string, string>>, userHeaders: Record<string, string> | undefined): Record<string, string> {
+  if (!userHeaders) return { ...defaults };
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(defaults)) {
+    if (!hasHeaderCaseInsensitive(userHeaders, key)) out[key] = value;
+  }
+  return out;
+}
+
+export function deriveXaiConvId(promptCacheKey: string): string {
+  return createHash("sha256").update(promptCacheKey).digest("hex").slice(0, 32);
+}
+
+/**
+ * Resolve the effective xAI transport without mutating persisted config.
+ * User-provided headers are preserved and may advance the compatibility
+ * version without waiting for an opencodex release.
+ *
+ * `promptCacheKey` (the client's stable conversation key) additionally pins
+ * cache-affinity routing via `x-grok-conv-id` in BOTH auth modes. Blank or
+ * whitespace-only keys are ignored so unrelated requests can never collapse
+ * onto one shared conv id, and any user-configured header (any case) wins.
+ */
+export function resolveProviderTransport(
+  providerName: string,
+  provider: OcxProviderConfig,
+  promptCacheKey?: string,
+): OcxProviderConfig {
+  if (providerName !== "xai") return provider;
+  const cacheKey = promptCacheKey?.trim();
+  const convIdHeaders: Record<string, string> =
+    cacheKey && !hasHeaderCaseInsensitive(provider.headers, XAI_CONV_ID_HEADER)
+      ? { [XAI_CONV_ID_HEADER]: deriveXaiConvId(cacheKey) }
+      : {};
+  if (provider.authMode !== "oauth") {
+    if (Object.keys(convIdHeaders).length === 0) return provider;
+    return {
+      ...provider,
+      headers: { ...convIdHeaders, ...(provider.headers ?? {}) },
+    };
+  }
+  return {
+    ...provider,
+    baseUrl: XAI_GROK_CLI_BASE_URL,
+    headers: {
+      ...withoutUserOverridden(XAI_GROK_CLI_HEADERS, provider.headers),
+      ...convIdHeaders,
+      ...(provider.headers ?? {}),
+    },
+  };
+}

package/src/router.ts

@@ -1,5 +1,6 @@
 import type { OcxConfig, OcxProviderConfig } from "./types";
 import { hasOwnProvider, resolveEnvValue } from "./config";
+import { assertProviderDestinationAllowed } from "./lib/destination-policy";
 import { PROVIDER_REGISTRY } from "./providers/registry";
 
 interface RouteResult {
@@ -79,7 +80,10 @@ function mergeStringArrayRecord(
 
 function routedProviderConfig(providerName: string, provider: OcxProviderConfig): OcxProviderConfig {
   const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
-  if (!registryEntry) return { ...provider, apiKey: resolveEnvValue(provider.apiKey) };
+  if (!registryEntry) {
+    assertProviderDestinationAllowed(providerName, provider);
+    return { ...provider, apiKey: resolveEnvValue(provider.apiKey) };
+  }
   const canonicalAuthMode = registryEntry.authKind === "forward" || registryEntry.authKind === "oauth"
     ? registryEntry.authKind
     : provider.authMode === "forward" ? undefined : provider.authMode;
@@ -107,6 +111,7 @@ function routedProviderConfig(providerName: string, provider: OcxProviderConfig)
   const baseUrl = (registryBaseUrlIsTemplate || registryEntry.allowBaseUrlOverride) && userBaseUrlIsResolved
     ? userBaseUrl
     : registryEntry.baseUrl;
+  assertProviderDestinationAllowed(providerName, { baseUrl, allowPrivateNetwork: provider.allowPrivateNetwork });
 
   return {
     ...provider,

package/src/server/auth-cors.ts

@@ -5,6 +5,7 @@ import {
   providerBaseUrlConfigError,
   providerHeadersConfigError,
 } from "../config";
+import { providerDestinationConfigError } from "../lib/destination-policy";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
 let _corsOrigin = "http://localhost:10100";
@@ -156,6 +157,8 @@ export function requireApiAuth(req: Request, config: OcxConfig, kind: "managemen
 export function providerManagementConfigError(name: string, provider: OcxProviderConfig): string | null {
   const baseUrlError = providerBaseUrlConfigError(provider.baseUrl);
   if (baseUrlError) return `provider ${name} ${baseUrlError}`;
+  const destinationError = providerDestinationConfigError(name, provider);
+  if (destinationError) return `provider ${name} ${destinationError}`;
   const headersError = providerHeadersConfigError(provider.headers);
   if (headersError) return `provider ${name} ${headersError}`;
   if (provider.authMode === "forward") {
@@ -205,6 +208,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     for (const key of [
       "defaultModel",
       "disabled",
+      "allowPrivateNetwork",
       "authMode",
       "liveModels",
       "models",

package/src/server/claude-messages.ts

@@ -31,6 +31,21 @@ function isRec(v: unknown): v is Rec {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 
+/** Resolve Claude-only sidecar overrides without mutating the shared server config. */
+export function buildClaudeReplayConfig(config: OcxConfig): OcxConfig {
+  return {
+    ...config,
+    webSearchSidecar: {
+      ...config.webSearchSidecar,
+      ...config.claudeCode?.webSearchSidecar,
+    },
+    visionSidecar: {
+      ...config.visionSidecar,
+      ...config.claudeCode?.visionSidecar,
+    },
+  };
+}
+
 function claudeInboundDisabled(config: OcxConfig): Response | null {
   if (config.claudeCode?.enabled === false) {
     return anthropicErrorResponse(403, "Claude inbound is disabled (GUI: Claude ON toggle / config.claudeCode.enabled)", "permission_error");
@@ -178,15 +193,21 @@ async function anthropicNativePassthrough(
   });
   headers.set("content-type", "application/json");
 
+  const timeoutSignal = AbortSignal.timeout(config.connectTimeoutMs ?? 120_000);
+  const upstreamSignal = AbortSignal.any([req.signal, timeoutSignal]);
   let upstream: Response;
   try {
     upstream = await fetch(`${base}${pathname}${search}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body),
-      signal: req.signal,
+      signal: upstreamSignal,
     });
   } catch (err) {
+    if (timeoutSignal.aborted && upstreamSignal.reason === timeoutSignal.reason) {
+      finalize(504, { closeReason: "non_stream" });
+      return anthropicErrorResponse(504, "anthropic passthrough timed out waiting for response headers", "timeout_error");
+    }
     finalize(502, { closeReason: "non_stream" });
     return anthropicErrorResponse(502, `anthropic passthrough failed: ${err instanceof Error ? err.message : String(err)}`, "api_error");
   }
@@ -326,6 +347,15 @@ export async function handleClaudeMessages(
     const value = req.headers.get(name);
     if (value) headers.set(name, value);
   }
+  if (!nativeRoute) {
+    // Routed replays need main ChatGPT auth so OpenAI-backed sidecars remain reachable.
+    const { getMainAccountToken } = await import("../codex/main-account");
+    const token = getMainAccountToken();
+    if (token) {
+      headers.set("authorization", `Bearer ${token.accessToken}`);
+      headers.set("chatgpt-account-id", token.chatgptAccountId);
+    }
+  }
   if (nativeRoute) {
     // No forwarded ChatGPT auth exists on this surface. Attach the main codex login
     // (read-only auth.json token); account-pool rotation still overrides downstream.
@@ -362,7 +392,7 @@ export async function handleClaudeMessages(
     nativeLogged = true;
     addFinalRequestLog(logIds.requestId, logIds.start, logCtx, status, meta);
   };
-  const upstream = await handleResponses(internalReq, config, logCtx, {
+  const upstream = await handleResponses(internalReq, buildClaudeReplayConfig(config), logCtx, {
     abortSignal: req.signal,
     onNativePassthroughTerminal: status => finalizeNativeLog(httpStatusForTerminalStatus(status), { terminalStatus: status, closeReason: "terminal" }),
     onNativePassthroughCancel: () => finalizeNativeLog(499, { closeReason: "client_cancel" }),