@bitkyc08/opencodex 2.7.9-preview.20260712 → 2.7.9-preview.20260712.2

package/src/config.ts

@@ -3,9 +3,41 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSy
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import * as z from "zod/v4";
+import { hardenSecretDir, hardenSecretPath } from "./lib/windows-secret-acl";
+import { providerDestinationConfigError } from "./lib/destination-policy";
 import type { OcxConfig } from "./types";
 
 let _atomicSeq = 0;
+
+interface AtomicRenameIO {
+  platform: NodeJS.Platform;
+  rename: (source: string, destination: string) => void;
+  sleep: (milliseconds: number) => void;
+}
+
+export function renameAtomicFile(
+  source: string,
+  destination: string,
+  io: AtomicRenameIO = {
+    platform: process.platform,
+    rename: renameSync,
+    sleep: Bun.sleepSync,
+  },
+): void {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      io.rename(source, destination);
+      return;
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      const transientWindowsError = io.platform === "win32"
+        && (code === "EBUSY" || code === "EPERM" || code === "EACCES");
+      if (!transientWindowsError || attempt >= 2) throw error;
+      io.sleep(25 * (attempt + 1));
+    }
+  }
+}
+
 /**
  * Write a file atomically (temp + rename) so concurrent writers — e.g. `ocx stop` and the
  * proxy's own shutdown handler both restoring Codex — can never leave a half-written file.
@@ -13,7 +45,7 @@ let _atomicSeq = 0;
 export function atomicWriteFile(path: string, content: string): void {
   const tmp = `${path}.ocx.${process.pid}.${++_atomicSeq}.tmp`;
   writeFileSync(tmp, content, { encoding: "utf-8", mode: 0o600 });
-  renameSync(tmp, path);
+  renameAtomicFile(tmp, path);
 }
 
 /**
@@ -54,6 +86,7 @@ const warnedConfigFallbacks = new Set<string>();
 const providerConfigSchema = z.object({
   adapter: z.string().min(1),
   baseUrl: z.string().min(1),
+  allowPrivateNetwork: z.boolean().optional(),
 }).passthrough();
 
 const RESERVED_PROVIDER_NAMES = new Set(["__proto__", "prototype", "constructor"]);
@@ -128,6 +161,15 @@ const configSchema = z.object({
         path: ["providers", name, "baseUrl"],
         message: baseUrlError,
       });
+    } else {
+      const destinationError = providerDestinationConfigError(name, provider);
+      if (destinationError) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["providers", name, "baseUrl"],
+          message: destinationError,
+        });
+      }
     }
     const headersError = providerHeadersConfigError((provider as { headers?: unknown }).headers);
     if (headersError) {
@@ -178,15 +220,20 @@ export function hardenConfigDir(): void {
   const dir = getConfigDir();
   if (existsSync(dir)) {
     try { chmodSync(dir, 0o700); } catch { /* best-effort */ }
+    if (process.platform === "win32") {
+      hardenSecretDir(dir, { required: false });
+    }
   }
 }
 
 export function hardenExistingSecret(path: string): void {
   if (existsSync(path)) {
     try { chmodSync(path, 0o600); } catch { /* best-effort */ }
+    if (process.platform === "win32") {
+      hardenSecretPath(path, { required: false });
+    }
   }
 }
-
 export function loadConfig(): OcxConfig {
   const dir = getConfigDir();
   const configPath = getConfigPath();
@@ -305,7 +352,11 @@ export function saveConfig(config: OcxConfig): void {
   } else {
     try { chmodSync(dir, 0o700); } catch { /* best-effort on existing dir */ }
   }
-  atomicWriteFile(getConfigPath(), JSON.stringify(config, null, 2) + "\n");
+  if (process.platform === "win32") {
+    hardenSecretDir(dir, { required: true });
+  }
+  const configPath = getConfigPath();
+  atomicWriteFile(configPath, JSON.stringify(config, null, 2) + "\n");
 }
 
 export function websocketsEnabled(config: Pick<OcxConfig, "websockets">): boolean {

package/src/lib/destination-policy.ts

@@ -0,0 +1,167 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { getProviderRegistryEntry } from "../providers/registry";
+import type { OcxProviderConfig } from "../types";
+
+const BLOCKED_METADATA_HOSTS = new Set([
+  "instance-data.ec2.internal",
+  "metadata.azure.internal",
+  "metadata.google.internal",
+]);
+
+const BLOCKED_METADATA_IPV4 = new Set([
+  "100.100.100.200",
+  "169.254.169.254",
+  "169.254.170.2",
+]);
+
+const BLOCKED_METADATA_IPV6 = new Set([
+  "fd00:ec2::254",
+]);
+
+type DestinationKind =
+  | "public"
+  | "hostname"
+  | "localhost"
+  | "loopback"
+  | "private"
+  | "link-local"
+  | "unspecified"
+  | "metadata";
+
+interface DestinationAssessment {
+  kind: DestinationKind;
+  detail: string;
+}
+
+function normalizeHostname(hostname: string): string {
+  const trimmed = hostname.trim().toLowerCase().replace(/\.+$/, "");
+  return trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+}
+
+function parseIpv4(hostname: string): number[] | null {
+  const parts = hostname.split(".");
+  if (parts.length !== 4) return null;
+  const octets = parts.map(part => Number(part));
+  return octets.every(octet => Number.isInteger(octet) && octet >= 0 && octet <= 255) ? octets : null;
+}
+
+function classifyIpv4(hostname: string): DestinationAssessment {
+  if (BLOCKED_METADATA_IPV4.has(hostname)) return { kind: "metadata", detail: "blocked metadata endpoint" };
+  const octets = parseIpv4(hostname);
+  if (!octets) return { kind: "public", detail: "public IP" };
+  const [a, b, c] = octets;
+  if (a === 127) return { kind: "loopback", detail: "loopback address" };
+  if (a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 100 && b >= 64 && b <= 127)) {
+    return { kind: "private", detail: "private-network address" };
+  }
+  if (a === 169 && b === 254) return { kind: "link-local", detail: "link-local address" };
+  if (a === 0) return { kind: "unspecified", detail: "unspecified address" };
+  // Reserved / non-public ranges (review finding, PR #96): protocol-assignment,
+  // documentation, benchmark, multicast, and reserved-future space never name a
+  // legitimate provider endpoint.
+  if (a === 192 && b === 0 && (c === 0 || c === 2)) return { kind: "private", detail: "reserved address" };
+  if (a === 198 && (b === 18 || b === 19)) return { kind: "private", detail: "benchmark address" };
+  if (a === 198 && b === 51 && c === 100) return { kind: "private", detail: "documentation address" };
+  if (a === 203 && b === 0 && c === 113) return { kind: "private", detail: "documentation address" };
+  if (a >= 224) return { kind: "private", detail: "multicast/reserved address" };
+  return { kind: "public", detail: "public IP" };
+}
+
+function firstIpv6Hextet(hostname: string): number | null {
+  const head = hostname.split(":")[0];
+  if (!head) return 0;
+  const parsed = Number.parseInt(head, 16);
+  return Number.isNaN(parsed) ? null : parsed;
+}
+
+function classifyIpv6(hostname: string): DestinationAssessment {
+  if (BLOCKED_METADATA_IPV6.has(hostname)) return { kind: "metadata", detail: "blocked metadata endpoint" };
+  const mappedIpv4 = hostname.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i)?.[1];
+  if (mappedIpv4) return classifyIpv4(mappedIpv4);
+  if (hostname === "::1") return { kind: "loopback", detail: "loopback address" };
+  if (hostname === "::") return { kind: "unspecified", detail: "unspecified address" };
+  const hextet = firstIpv6Hextet(hostname);
+  if (hextet === null) return { kind: "public", detail: "public IP" };
+  if (hextet >= 0xfc00 && hextet <= 0xfdff) return { kind: "private", detail: "private-network address" };
+  if (hextet >= 0xfe80 && hextet <= 0xfebf) return { kind: "link-local", detail: "link-local address" };
+  return { kind: "public", detail: "public IP" };
+}
+
+function assessDestination(baseUrl: string): DestinationAssessment | null {
+  try {
+    const parsed = new URL(baseUrl.trim());
+    const hostname = normalizeHostname(parsed.hostname);
+    if (!hostname) return null;
+    if (BLOCKED_METADATA_HOSTS.has(hostname)) return { kind: "metadata", detail: "blocked metadata endpoint" };
+    if (hostname === "localhost" || hostname.endsWith(".localhost")) {
+      return { kind: "localhost", detail: "localhost destination" };
+    }
+    const ipKind = isIP(hostname);
+    if (ipKind === 4) return classifyIpv4(hostname);
+    if (ipKind === 6) return classifyIpv6(hostname);
+    return { kind: "hostname", detail: "hostname destination" };
+  } catch {
+    return null;
+  }
+}
+
+function registryAllowsPrivateNetwork(name: string): boolean {
+  return getProviderRegistryEntry(name)?.allowPrivateNetworkByDefault === true;
+}
+
+export function providerDestinationConfigError(name: string, provider: Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork">): string | null {
+  const assessment = assessDestination(provider.baseUrl);
+  if (!assessment) return null;
+  if (assessment.kind === "public" || assessment.kind === "hostname") return null;
+  if (assessment.kind === "metadata") return "baseUrl targets a blocked metadata endpoint";
+  if (registryAllowsPrivateNetwork(name)) return null;
+  if (provider.allowPrivateNetwork === true) return null;
+  return `baseUrl points to a ${assessment.detail}; set allowPrivateNetwork:true only for intentionally local/self-hosted providers`;
+}
+
+export function assertProviderDestinationAllowed(name: string, provider: Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork">): void {
+  const error = providerDestinationConfigError(name, provider);
+  if (error) throw new Error(`provider ${name} ${error}`);
+}
+
+/**
+ * Async companion to {@link providerDestinationConfigError} for hostname destinations:
+ * resolves A/AAAA records and classifies every address, so a hostname that points at
+ * loopback/private/metadata space is caught at provider write time (review finding,
+ * PR #96 — the sync path must stay literal-only because the router hot path and
+ * config load are synchronous). DNS failures return null: config-time validation is
+ * advisory and must not hard-fail offline startups. DNS rebinding after validation is
+ * a recorded residual for this loopback proxy (devlog 260712_pr_batch_landing 000).
+ */
+export async function providerDestinationResolvedError(
+  name: string,
+  provider: Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork">,
+): Promise<string | null> {
+  const syncError = providerDestinationConfigError(name, provider);
+  if (syncError) return syncError;
+  let hostname: string;
+  try {
+    hostname = normalizeHostname(new URL(provider.baseUrl.trim()).hostname);
+  } catch {
+    return null;
+  }
+  if (!hostname || isIP(hostname) !== 0 || hostname === "localhost" || hostname.endsWith(".localhost")) {
+    return null; // literals and localhost are fully handled by the sync path
+  }
+  if (registryAllowsPrivateNetwork(name) || provider.allowPrivateNetwork === true) return null;
+  let addresses: { address: string }[];
+  try {
+    addresses = await lookup(hostname, { all: true, verbatim: true });
+  } catch {
+    return null; // unresolvable now ≠ malicious; the provider simply won't connect
+  }
+  for (const { address } of addresses) {
+    const ipKind = isIP(address);
+    const assessment = ipKind === 4 ? classifyIpv4(address) : ipKind === 6 ? classifyIpv6(normalizeHostname(address)) : null;
+    if (!assessment || assessment.kind === "public") continue;
+    if (assessment.kind === "metadata") return `baseUrl hostname ${hostname} resolves to a blocked metadata endpoint (${address})`;
+    return `baseUrl hostname ${hostname} resolves to a ${assessment.detail} (${address}); set allowPrivateNetwork:true only for intentionally local/self-hosted providers`;
+  }
+  return null;
+}

package/src/lib/injection-debug-log.ts

@@ -0,0 +1,34 @@
+/** In-memory ring buffer of multi-agent guidance-injection / effort-cap log lines.
+ *
+ * Injection debug lines were previously console-only, so the GUI had an "Injection log"
+ * toggle with nothing to display. This buffer mirrors the provider debug buffer so the
+ * management API and GUI can tail injection lines the same way. Callers keep their own
+ * `isInjectionDebugEnabled()` guard; this module only stores what it is given. */
+
+import type { DebugLogEntry } from "./debug-log-buffer";
+
+const MAX_LINES = 2_000;
+const buffer: DebugLogEntry[] = [];
+let nextSeq = 1;
+
+/** Append a line to the injection buffer and echo it to the server console. */
+export function injectionDebugLog(line: string): void {
+  const entry: DebugLogEntry = { seq: nextSeq++, at: Date.now(), line };
+  buffer.push(entry);
+  if (buffer.length > MAX_LINES) buffer.splice(0, buffer.length - MAX_LINES);
+  console.log(line);
+}
+
+export function getInjectionDebugLogEntries(options?: { after?: number; limit?: number }): DebugLogEntry[] {
+  const after = options?.after ?? 0;
+  const limit = options?.limit ?? 500;
+  const filtered = after > 0 ? buffer.filter(entry => entry.seq > after) : buffer;
+  if (filtered.length <= limit) return filtered;
+  return filtered.slice(-limit);
+}
+
+/** Test isolation. */
+export function resetInjectionDebugLogBufferForTests(): void {
+  buffer.length = 0;
+  nextSeq = 1;
+}

package/src/lib/upstream-retry.ts

@@ -14,12 +14,19 @@
  * MUST stay a leaf module: imports nothing from server.ts or adapters (kiro-retry imports
  * the shared abort helpers from here).
  */
+import { clearableDeadline } from "./abort";
 
 // 1 initial + 2 retries: the pool may hold more than one stale socket.
 const RESET_RETRY_MAX_ATTEMPTS = 3;
 const RESET_RETRY_BASE_DELAY_MS = 150;
 const RESET_RETRY_MAX_DELAY_MS = 1_000;
 
+export interface RetryBackoffOptions {
+  baseDelayMs: number;
+  maxDelayMs: number;
+  headers?: Headers;
+}
+
 export function abortError(signal?: AbortSignal): unknown {
   return signal?.reason ?? new DOMException("The operation was aborted", "AbortError");
 }
@@ -56,11 +63,51 @@ export function isConnectionResetError(err: unknown): boolean {
     || msg.includes("connection reset by peer");
 }
 
-function retryDelayMs(attempt: number): number {
-  const exp = Math.min(RESET_RETRY_BASE_DELAY_MS * (2 ** attempt), RESET_RETRY_MAX_DELAY_MS);
+function retryAfterDelayMs(headers: Headers): number | undefined {
+  const raw = headers.get("retry-after")?.trim();
+  if (!raw) return undefined;
+  const seconds = Number(raw);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1000);
+  const dateMs = Date.parse(raw);
+  if (!Number.isFinite(dateMs)) return undefined;
+  return Math.max(0, dateMs - Date.now());
+}
+
+export function retryBackoffDelayMs(attempt: number, opts: RetryBackoffOptions): number {
+  const retryAfter = opts.headers ? retryAfterDelayMs(opts.headers) : undefined;
+  if (retryAfter !== undefined) return Math.min(retryAfter, opts.maxDelayMs);
+  const exp = Math.min(opts.baseDelayMs * (2 ** attempt), opts.maxDelayMs);
   return Math.floor(exp * (0.8 + Math.random() * 0.4));
 }
 
+export function cancelResponseBodyBestEffort(res: Response): void {
+  try {
+    const cancellation = res.body?.cancel();
+    if (cancellation) void cancellation.catch(() => {});
+  } catch {
+    // Cancellation is cleanup only; retries must not wait for or fail because of it.
+  }
+}
+
+export async function fetchWithAttemptDeadline(
+  url: string,
+  init: RequestInit,
+  timeoutMs: number,
+  abortSignal?: AbortSignal,
+): Promise<Response> {
+  const attemptTimeout = clearableDeadline(timeoutMs, abortSignal);
+  try {
+    return await fetch(url, {
+      ...init,
+      signal: attemptTimeout.signal,
+    });
+  } finally {
+    // Only the header timer is cleared. The composed signal still contains the parent, so a
+    // caller abort after headers continue to cancel consumption of the returned response body.
+    attemptTimeout.clear();
+  }
+}
+
 export interface ResetRetryOptions {
   abortSignal?: AbortSignal;
   /** Short host/path label for the retry warn log (no secrets/query strings). */
@@ -89,7 +136,10 @@ export async function fetchWithResetRetry(
       console.warn(
         `[upstream-retry] connection reset${opts.label ? ` (${opts.label})` : ""} — retrying (${attempt + 2}/${attempts})`,
       );
-      await sleepWithAbort(retryDelayMs(attempt), opts.abortSignal);
+      await sleepWithAbort(retryBackoffDelayMs(attempt, {
+        baseDelayMs: RESET_RETRY_BASE_DELAY_MS,
+        maxDelayMs: RESET_RETRY_MAX_DELAY_MS,
+      }), opts.abortSignal);
     }
   }
   throw lastError ?? new Error("upstream fetch failed");

package/src/lib/windows-secret-acl.ts

@@ -0,0 +1,173 @@
+/**
+ * Windows per-user NTFS ACL hardening for secret files and directories.
+ *
+ * On Windows, `chmod` only controls POSIX-style bits in the ACE list and does NOT remove
+ * inherited permissions from other users. Real per-user isolation requires icacls to:
+ *   1. Disable inheritance   (icacls path /inheritance:r)
+ *   2. Strip broad explicit grants by SID (Everyone, Users, Authenticated Users)
+ *   3. Grant the current user full control (icacls path /grant:r "CURRENTUSER:(F)")
+ *
+ * On non-Windows platforms the helpers fall through to the caller's existing chmod-based
+ * behaviour: they return ok:true without invoking any external process.
+ *
+ * Design:
+ *   hardenSecretPath(path, { required: false }) — non-fatal read-path mode.
+ *     Never throws. Returns { ok, diagnostics? }.
+ *   hardenSecretPath(path, { required: true })  — write-path mode.
+ *     Throws a sanitized error (no raw path) on Windows ACL failure.
+ *   hardenSecretDir  — same contract for directories.
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { env, platform } from "node:process";
+
+const hardenedDirectories = new Set<string>();
+const hardenedPaths = new Set<string>();
+
+export interface HardenResult {
+  ok: boolean;
+  diagnostics?: string;
+}
+
+export interface HardenOptions {
+  required: boolean;
+}
+
+/**
+ * Return the current Windows username from the environment.
+ * Falls back to USERDOMAIN\USERNAME if USERNAME alone is ambiguous.
+ * The value is used directly in icacls arguments, so it must be present.
+ */
+function currentWindowsUser(): string | undefined {
+  const username = env["USERNAME"];
+  const domain = env["USERDOMAIN"];
+  if (!username) return undefined;
+  // USERDOMAIN is the machine/domain name; USERNAME is the account name.
+  // icacls accepts "DOMAIN\User" or just "User" for local accounts.
+  return domain ? `${domain}\\${username}` : username;
+}
+
+/**
+ * Run icacls to harden a single file system entry.
+ * - Disables inheritance (keeps nothing: /inheritance:r)
+ * - Grants the current user Full Control
+ *
+ * We do NOT use a shell string; all arguments are passed as an array so no
+ * shell injection is possible even for paths with unusual characters.
+ *
+ * Throws the raw child_process error on failure (caller sanitizes).
+ */
+function runIcacls(targetPath: string, directory: boolean): void {
+  const user = currentWindowsUser();
+  if (!user) {
+    throw new Error("Cannot determine current Windows user for ACL hardening");
+  }
+
+  // Step 1: disable inheritance and remove inherited ACEs
+  execFileSync("icacls.exe", [targetPath, "/inheritance:r"], {
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5000,
+    shell: false,
+  });
+
+  // Step 2: remove broad explicit grants using stable SIDs (not localized names).
+  execFileSync("icacls.exe", [
+    targetPath,
+    "/remove:g",
+    "*S-1-1-0",
+    "*S-1-5-11",
+    "*S-1-5-32-545",
+  ], {
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5000,
+    shell: false,
+  });
+
+  // Step 3: grant current user full control.
+  const grant = directory ? `${user}:(OI)(CI)(F)` : `${user}:(F)`;
+  execFileSync("icacls.exe", [targetPath, "/grant:r", grant], {
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5000,
+    shell: false,
+  });
+}
+
+/**
+ * Sanitize an error from a failed ACL operation into a safe diagnostic string.
+ * The raw path must not appear in the returned string (it may contain
+ * sensitive username components or PII from the home directory path).
+ */
+function sanitizeDiagnostics(error: unknown): string {
+  // We do not expose the raw error message or any path-like fragments.
+  // Just describe what failed generically.
+  const code = error instanceof Error && "code" in error ? String((error as NodeJS.ErrnoException).code) : "";
+  const codePart = code ? ` (${code})` : "";
+  return `ACL hardening failed${codePart} — filesystem may not support per-user NTFS ACLs`;
+}
+
+/**
+ * Harden a single file path with per-user NTFS ACLs on Windows.
+ * On non-Windows platforms, returns ok:true immediately (caller owns chmod).
+ *
+ * @param targetPath  Absolute path to the file to harden.
+ * @param opts        { required: boolean } — required:true throws on failure.
+ */
+export function hardenSecretPath(targetPath: string, opts: HardenOptions): HardenResult {
+  // Skip for missing files — we cannot harden what does not exist yet.
+  if (!existsSync(targetPath)) {
+    return { ok: true };
+  }
+
+  // Non-Windows: no NTFS ACLs; caller handles chmod.
+  if (platform !== "win32") {
+    return { ok: true };
+  }
+
+  if (hardenedPaths.has(targetPath)) return { ok: true };
+
+  try {
+    runIcacls(targetPath, false);
+    hardenedPaths.add(targetPath);
+    return { ok: true };
+  } catch (err) {
+    const diagnostics = sanitizeDiagnostics(err);
+    if (opts.required) {
+      throw new Error(diagnostics);
+    }
+    return { ok: false, diagnostics };
+  }
+}
+
+/**
+ * Harden a directory path with per-user NTFS ACLs on Windows.
+ * On non-Windows platforms, returns ok:true immediately (caller owns chmod).
+ *
+ * @param targetPath  Absolute path to the directory to harden.
+ * @param opts        { required: boolean } — required:true throws on failure.
+ */
+export function hardenSecretDir(targetPath: string, opts: HardenOptions): HardenResult {
+  // Skip for missing directories — we cannot harden what does not exist yet.
+  if (!existsSync(targetPath)) {
+    return { ok: true };
+  }
+
+  // Non-Windows: no NTFS ACLs; caller handles chmod.
+  if (platform !== "win32") {
+    return { ok: true };
+  }
+
+  if (hardenedDirectories.has(targetPath)) return { ok: true };
+
+  try {
+    runIcacls(targetPath, true);
+    hardenedDirectories.add(targetPath);
+    return { ok: true };
+  } catch (err) {
+    const diagnostics = sanitizeDiagnostics(err);
+    if (opts.required) {
+      throw new Error(diagnostics);
+    }
+    return { ok: false, diagnostics };
+  }
+}

package/src/oauth/store.ts

@@ -54,6 +54,7 @@ function persist(store: AuthStore): void {
   } else {
     try { chmodSync(dir, 0o700); } catch { /* best-effort on existing dir */ }
   }
+  hardenConfigDir();
   atomicWriteFile(authPath(), JSON.stringify(store, null, 2) + "\n");
 }
 

package/src/providers/registry.ts

@@ -18,6 +18,7 @@ export interface ProviderRegistryEntry {
   adapter: string;
   baseUrl: string;
   authKind: ProviderAuthKind;
+  allowPrivateNetworkByDefault?: boolean;
   keyOptional?: boolean;
   allowBaseUrlOverride?: boolean;
   modelSuffixBracketStrip?: boolean;
@@ -436,9 +437,9 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   { id: "google-vertex", label: "Google Vertex AI", adapter: "google", baseUrl: "https://aiplatform.googleapis.com", authKind: "key", dashboardUrl: "https://console.cloud.google.com/vertex-ai", defaultModel: "gemini-3-pro", googleMode: "vertex", jawcodeBundle: "google", extraMetadataAliases: ["gemini-vertex"] },
   { id: "google-antigravity", label: "Google Antigravity", adapter: "google", baseUrl: "https://daily-cloudcode-pa.googleapis.com", authKind: "oauth", dashboardUrl: "https://antigravity.google", models: ANTIGRAVITY_MODELS, defaultModel: "gemini-3.5-flash-low", modelContextWindows: ANTIGRAVITY_MODEL_CONTEXT_WINDOWS, googleMode: "cloud-code-assist", jawcodeBundle: "google", extraMetadataAliases: ["antigravity", "gemini-antigravity"] },
   { id: "azure-openai", label: "Azure OpenAI", adapter: "azure-openai", baseUrl: "https://{resource}.openai.azure.com/openai", authKind: "key", featured: true, dashboardUrl: "https://portal.azure.com" },
-  { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
-  { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
-  { id: "lm-studio", label: "LM Studio (local)", adapter: "openai-chat", baseUrl: "http://localhost:1234/v1", authKind: "local", allowBaseUrlOverride: true, featured: true, note: "Local — no key needed" },
+  { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
+  { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — key usually blank" },
+  { id: "lm-studio", label: "LM Studio (local)", adapter: "openai-chat", baseUrl: "http://localhost:1234/v1", authKind: "local", allowPrivateNetworkByDefault: true, allowBaseUrlOverride: true, featured: true, note: "Local — no key needed" },
   {
     id: "deepseek",
     label: "DeepSeek",
@@ -521,6 +522,7 @@ export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
   {
     id: "litellm", label: "LiteLLM (self-hosted)", baseUrl: "http://localhost:4000/v1", adapter: "openai-chat", authKind: "key",
     dashboardUrl: "https://docs.litellm.ai/docs/proxy/quick_start",
+    allowPrivateNetworkByDefault: true,
     allowBaseUrlOverride: true,
     // A self-hosted proxy may legitimately run without a master key.
     keyOptional: true,

package/src/router.ts

@@ -1,5 +1,6 @@
 import type { OcxConfig, OcxProviderConfig } from "./types";
 import { hasOwnProvider, resolveEnvValue } from "./config";
+import { assertProviderDestinationAllowed } from "./lib/destination-policy";
 import { PROVIDER_REGISTRY } from "./providers/registry";
 
 interface RouteResult {
@@ -79,7 +80,10 @@ function mergeStringArrayRecord(
 
 function routedProviderConfig(providerName: string, provider: OcxProviderConfig): OcxProviderConfig {
   const registryEntry = PROVIDER_REGISTRY.find(entry => entry.id === providerName);
-  if (!registryEntry) return { ...provider, apiKey: resolveEnvValue(provider.apiKey) };
+  if (!registryEntry) {
+    assertProviderDestinationAllowed(providerName, provider);
+    return { ...provider, apiKey: resolveEnvValue(provider.apiKey) };
+  }
   const canonicalAuthMode = registryEntry.authKind === "forward" || registryEntry.authKind === "oauth"
     ? registryEntry.authKind
     : provider.authMode === "forward" ? undefined : provider.authMode;
@@ -107,6 +111,7 @@ function routedProviderConfig(providerName: string, provider: OcxProviderConfig)
   const baseUrl = (registryBaseUrlIsTemplate || registryEntry.allowBaseUrlOverride) && userBaseUrlIsResolved
     ? userBaseUrl
     : registryEntry.baseUrl;
+  assertProviderDestinationAllowed(providerName, { baseUrl, allowPrivateNetwork: provider.allowPrivateNetwork });
 
   return {
     ...provider,

package/src/server/auth-cors.ts

@@ -5,6 +5,7 @@ import {
   providerBaseUrlConfigError,
   providerHeadersConfigError,
 } from "../config";
+import { providerDestinationConfigError } from "../lib/destination-policy";
 import type { OcxConfig, OcxProviderConfig } from "../types";
 
 let _corsOrigin = "http://localhost:10100";
@@ -156,6 +157,8 @@ export function requireApiAuth(req: Request, config: OcxConfig, kind: "managemen
 export function providerManagementConfigError(name: string, provider: OcxProviderConfig): string | null {
   const baseUrlError = providerBaseUrlConfigError(provider.baseUrl);
   if (baseUrlError) return `provider ${name} ${baseUrlError}`;
+  const destinationError = providerDestinationConfigError(name, provider);
+  if (destinationError) return `provider ${name} ${destinationError}`;
   const headersError = providerHeadersConfigError(provider.headers);
   if (headersError) return `provider ${name} ${headersError}`;
   if (provider.authMode === "forward") {
@@ -205,6 +208,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
     for (const key of [
       "defaultModel",
       "disabled",
+      "allowPrivateNetwork",
       "authMode",
       "liveModels",
       "models",