@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/lib/errors.ts

@@ -18,7 +18,7 @@ export const ENCRYPTED_FUNCTION_OUTPUT_REJECTION =
  */
 export const SEND_BUDGET_EXHAUSTED_CODE = "request_send_budget_exhausted";
 
-/** Canonical human-readable message paths used by Responses upstream failures. */
+/** First nonblank string across the canonical upstream error paths, in priority order. */
 export function upstreamErrorMessageFromPayload(payload: unknown): string | undefined {
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) return undefined;
   const json = payload as {
@@ -31,14 +31,14 @@ export function upstreamErrorMessageFromPayload(payload: unknown): string | unde
       incomplete_details?: { message?: unknown };
     };
   };
-  const message = json.error?.message
-    ?? json.last_error?.message
-    ?? json.response?.error?.message
-    ?? json.response?.incomplete_details?.message
+  const messages = [json.error?.message,
+    json.last_error?.message,
+    json.response?.error?.message,
+    json.response?.incomplete_details?.message,
     // The Responses stream error event carries a flat message (type/code/message),
     // unlike the response.failed envelope the branches above already cover.
-    ?? (json.type === "error" ? json.message : undefined);
-  return typeof message === "string" ? message : undefined;
+    json.type === "error" ? json.message : undefined];
+  return messages.find((message): message is string => typeof message === "string" && message.trim().length > 0);
 }
 
 /** OpenAI / Codex hard block for high-risk cybersecurity activity (HTTP 400 or mid-stream). */

package/src/lib/jsonc.ts

@@ -108,3 +108,16 @@ export function canonicalizeJsonc(text: string): string {
 export function parseJsonc(text: string): unknown {
   return JSON.parse(canonicalizeJsonc(text));
 }
+
+/**
+ * True when the text carries a `//` or block comment outside a string. A writer that
+ * re-serializes the document would drop those, so it checks this before writing.
+ * An unterminated block comment counts as a comment.
+ */
+export function hasJsoncComments(text: string): boolean {
+  try {
+    return stripJsonComments(text) !== text;
+  } catch {
+    return true;
+  }
+}

package/src/lib/local-chat-completion.ts

@@ -0,0 +1,144 @@
+/**
+ * One non-streaming chat completion through this proxy's own /v1/chat/completions.
+ *
+ * The way opencodex makes a model call of its own: the request goes back through the router like
+ * any client's, so every provider the user has configured is reachable and none needs its own
+ * client here. The routed vision describer and the Codex role sizing both send through it.
+ *
+ * Destination: the unauthenticated loopback listener when one is enabled, otherwise the bind
+ * address (#4236), resolved by localInferenceDestination rather than composing 127.0.0.1 by hand.
+ * Admission: localAdmissionToken (env token, hardened service token file, first apiKeys entry),
+ * sent as x-opencodex-api-key and never Authorization, because an admission secret in a
+ * forwardable header is a forwarding hazard. Never the admin token.
+ */
+import type { OcxConfig } from "../types";
+import { localAdmissionToken, localInferenceDestination } from "./local-destinations";
+import { signalWithTimeout, cancelBodyOnAbort } from "./abort";
+import { readBoundedResponseBytes } from "./bounded-body";
+import { redactSecretString } from "./redact";
+import { sidecarEnter } from "./sidecar-tracker";
+import { configuredPort } from "../server/auth-cors";
+
+export type LocalChatConfig = Pick<OcxConfig, "port" | "hostname" | "apiKeys" | "unauthenticatedLoopbackListener">;
+
+export interface LocalChatCompletionRequest {
+  readonly config: LocalChatConfig;
+  readonly body: Record<string, unknown>;
+  /** Names the caller in error text and logs, e.g. "routed describe". */
+  readonly label: string;
+  /** Log prefix and sidecar breadcrumb, e.g. "vision". */
+  readonly logTag: string;
+  readonly timeoutMs: number;
+  readonly maxResponseBytes: number;
+  /**
+   * Count raw bytes while reading and cancel the body at the bound. Unset keeps the routed
+   * describer's bound: the whole body is read, then its UTF-16 length is compared.
+   */
+  readonly boundWhileStreaming?: boolean;
+  readonly headers?: Record<string, string>;
+  readonly abortSignal?: AbortSignal;
+  /** Test seam; production always self-fetches the resolved local destination. */
+  readonly baseUrlOverride?: string;
+}
+
+export type LocalChatCompletionOutcome = { text: string; error?: string };
+
+function destination(config: Pick<OcxConfig, "port" | "hostname" | "unauthenticatedLoopbackListener">) {
+  // config.port can be 0 (ephemeral bind, tests) or stale after a live port override; the
+  // server records its ACTUAL bound port via setCorsOrigin at startup, so prefer that when
+  // config carries no positive port. configuredPort() is itself 0 when _corsOrigin has no
+  // explicit port (a default-port origin), so the literal default has to backstop it or the
+  // composed URL names port 0 and the self-fetch cannot connect.
+  const port = config.port && config.port > 0
+    ? config.port
+    : Number(configuredPort()) || 10_100;
+  return localInferenceDestination(config, port);
+}
+
+export function localChatCompletionBaseUrl(
+  config: Pick<OcxConfig, "port" | "hostname" | "unauthenticatedLoopbackListener">,
+): string {
+  return destination(config).origin;
+}
+
+export async function postLocalChatCompletion(request: LocalChatCompletionRequest): Promise<LocalChatCompletionOutcome> {
+  const { config, label, logTag } = request;
+  const headers: Record<string, string> = { "Content-Type": "application/json", ...request.headers };
+  const admission = localAdmissionToken(config);
+  if (admission) headers["x-opencodex-api-key"] = admission;
+  // A bind that demands admission with no resolvable credential would return 401 with a body
+  // the caller reports as a failure; naming the cause once is the difference between "it is
+  // broken" and a fixable configuration note.
+  if (!admission && !request.baseUrlOverride && destination(config).requiresAdmissionToken) {
+    console.warn(
+      `[${logTag}] ${label} has no opencodex data-plane credential for `
+      + `${localChatCompletionBaseUrl(config)} — the self-fetch will be refused.`,
+    );
+  }
+
+  const linkedSignal = signalWithTimeout(request.timeoutMs, request.abortSignal);
+  const sidecarExit = sidecarEnter(logTag);
+  const t0 = Date.now();
+  try {
+    const res = await fetch(`${request.baseUrlOverride ?? localChatCompletionBaseUrl(config)}/v1/chat/completions`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ ...request.body, stream: false }),
+      signal: linkedSignal.signal,
+      redirect: "manual",
+    });
+    const detachBodyGuard = cancelBodyOnAbort(res.body, linkedSignal.signal);
+    try {
+      let raw: string;
+      if (request.boundWhileStreaming) {
+        const read = await readBoundedResponseBytes(res, { maxBytes: request.maxResponseBytes, signal: linkedSignal.signal });
+        if (read.oversized) return { text: "", error: `${label} response exceeded byte bound` };
+        raw = new TextDecoder().decode(read.bytes);
+      } else {
+        raw = await res.text();
+        if (raw.length > request.maxResponseBytes) {
+          return { text: "", error: `${label} response exceeded byte bound` };
+        }
+      }
+      if (!res.ok) {
+        return { text: "", error: `${label} HTTP ${res.status}: ${redactSecretString(raw.slice(0, 200))}` };
+      }
+      let payload: unknown;
+      try { payload = JSON.parse(raw); } catch {
+        return { text: "", error: `${label} returned non-JSON` };
+      }
+      const content = extractChatContent(payload);
+      if (!content) return { text: "", error: `${label} returned no text` };
+      return { text: content };
+    } finally {
+      detachBodyGuard();
+    }
+  } catch (e) {
+    const kind = e instanceof Error && e.name === "TimeoutError" ? "timeout" : "connect_error";
+    console.warn(`[${logTag}] ${label} ${kind} (${Date.now() - t0}ms)`);
+    return { text: "", error: redactSecretString(e instanceof Error ? e.message : String(e)) };
+  } finally {
+    sidecarExit();
+    linkedSignal.cleanup();
+  }
+}
+
+function extractChatContent(payload: unknown): string | undefined {
+  if (!payload || typeof payload !== "object") return undefined;
+  const choices = (payload as { choices?: unknown }).choices;
+  if (!Array.isArray(choices) || choices.length === 0) return undefined;
+  const message = (choices[0] as { message?: unknown })?.message;
+  if (!message || typeof message !== "object") return undefined;
+  const content = (message as { content?: unknown }).content;
+  if (typeof content === "string" && content.trim().length > 0) return content;
+  // Some adapters emit content parts; join text parts.
+  if (Array.isArray(content)) {
+    const joined = content
+      .map(part => (part && typeof part === "object" && typeof (part as { text?: unknown }).text === "string"
+        ? (part as { text: string }).text
+        : ""))
+      .join("");
+    if (joined.trim().length > 0) return joined;
+  }
+  return undefined;
+}

package/src/lib/provider-outbound.ts

@@ -1,3 +1,4 @@
+import { isIP } from "node:net";
 import type { OcxProviderConfig } from "../types";
 import {
   assessUrlDestination,
@@ -30,6 +31,73 @@ export interface ProviderOutboundDependencies {
   isCanonicalUrl?: (name: string, url: string) => boolean;
   /** Recheck caller-owned credential authority after DNS and immediately before transport. */
   beforeSend?: () => boolean;
+  /**
+   * Caller opt-in for a cleartext `http:` POST to a self-hosted service. Honoured only when the
+   * URL host is exactly `localhost` or an address literal in the narrow local allowlist
+   * (`localCleartextAddressAllowed`) AND the provider row itself sets `allowPrivateNetwork: true`
+   * (a registry default does not count). Every resolved answer must stay inside the same
+   * allowlist, and a proxied route is refused, so the cleartext body never leaves the host or
+   * LAN. Every other destination keeps the HTTPS-only POST gate. Defaults to refusing.
+   */
+  allowLocalCleartextPost?: boolean;
+}
+
+function ipv4Octets(address: string): number[] | null {
+  return isIP(address) === 4 ? address.split(".").map(Number) : null;
+}
+
+function ipv6Hextets(address: string): number[] | null {
+  if (isIP(address) !== 6 || address.includes("%")) return null;
+  let text = address.toLowerCase();
+  const lastColon = text.lastIndexOf(":");
+  const embedded = ipv4Octets(text.slice(lastColon + 1));
+  if (text.slice(lastColon + 1).includes(".")) {
+    if (!embedded) return null;
+    const [a, b, c, d] = embedded as [number, number, number, number];
+    text = `${text.slice(0, lastColon + 1)}${((a << 8) | b).toString(16)}:${((c << 8) | d).toString(16)}`;
+  }
+  const [head = "", tail] = text.split("::");
+  const headParts = head ? head.split(":") : [];
+  const tailParts = tail ? tail.split(":") : [];
+  const fill = tail === undefined ? 0 : 8 - headParts.length - tailParts.length;
+  const parts = [...headParts, ...Array<string>(Math.max(0, fill)).fill("0"), ...tailParts];
+  return parts.length === 8 ? parts.map(part => Number.parseInt(part, 16)) : null;
+}
+
+/**
+ * The only addresses a cleartext provider POST may reach: IPv4 loopback 127/8, IPv4-mapped
+ * loopback ::ffff:127.0.0.0/104, ::1, RFC 1918 (10/8, 172.16/12, 192.168/16), and IPv6 ULA
+ * fc00::/7. Deliberately narrower than the private-network classification: CGNAT 100.64/10,
+ * NAT64 64:ff9b:1::/48, benchmark, documentation, multicast/broadcast, link-local, metadata and
+ * unspecified addresses never qualify.
+ */
+export function localCleartextAddressAllowed(address: string): boolean {
+  const v4 = ipv4Octets(address);
+  if (v4) {
+    const [a, b] = v4 as [number, number];
+    return a === 127 || a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168);
+  }
+  const v6 = ipv6Hextets(address);
+  if (!v6) return false;
+  if (v6.slice(0, 7).every(part => part === 0) && v6[7] === 1) return true;
+  if (v6.slice(0, 5).every(part => part === 0) && v6[5] === 0xffff && (v6[6]! >> 8) === 127) return true;
+  return (v6[0]! & 0xfe00) === 0xfc00;
+}
+
+function unbracketedHostname(url: URL): string {
+  const host = url.hostname;
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+
+function localCleartextPostAllowed(
+  provider: ProviderOutboundConfig,
+  url: URL,
+  dependencies: ProviderOutboundDependencies,
+): boolean {
+  if (dependencies.allowLocalCleartextPost !== true || url.protocol !== "http:") return false;
+  if (provider.allowPrivateNetwork !== true) return false;
+  const host = unbracketedHostname(url);
+  return host === "localhost" || localCleartextAddressAllowed(host);
 }
 
 export class ProviderOutboundPolicyError extends Error {
@@ -167,14 +235,21 @@ async function providerOutboundRequest(
     if (dependencies.beforeSend?.() === false) throw new ProviderOutboundSendCancelledError("provider credential changed before send");
   };
   const postUrl = method === "POST" ? new URL(url) : undefined;
-  if (postUrl?.protocol !== undefined && postUrl.protocol !== "https:") {
+  if (postUrl?.protocol !== undefined && postUrl.protocol !== "https:"
+    && !localCleartextPostAllowed(provider, postUrl, dependencies)) {
     throw new ProviderOutboundPolicyError("provider POST URL must use HTTPS");
   }
+  // Only reachable after the narrow opt-in above admitted it.
+  const localCleartextPost = postUrl?.protocol === "http:";
   // A provider entry keeps unknown configuration keys, so `fetch` can arrive as a value the
   // operator wrote into the file rather than an executor a caller attached. Calling that would
   // throw inside discovery and fail the provider for a reason nothing in its configuration
   // explains; the built-in transport is what a configured value means.
   if (typeof provider.fetch === "function") {
+    // An executor resolves names itself, so a cleartext POST through one must name an address.
+    if (localCleartextPost && !isIP(unbracketedHostname(postUrl!))) {
+      throw new ProviderOutboundPolicyError("a cleartext provider POST through a caller-supplied executor must use an address literal");
+    }
     // A caller-owned executor decides its own transport, so a provider egress route cannot be
     // applied to it. Refusing is the only honest answer: running the executor anyway would send
     // the request by whatever route that executor picked while the configuration says otherwise.
@@ -231,6 +306,13 @@ async function providerOutboundRequest(
   const proxyApplies = egress.kind === "inherit"
     ? globalProxy !== null && !noProxyMatches(parsed)
     : providerProxy !== null;
+  // A cleartext body must go straight to the local peer: a proxy (global or provider route, and
+  // the DNS-failure proxy degradation below, which needs one) would carry it off-host unencrypted.
+  if (localCleartextPost && proxyApplies) {
+    throw new ProviderOutboundPolicyError(
+      `a cleartext provider POST cannot use an outbound proxy; add ${normalizeProxyHostname(parsed.hostname)} to NO_PROXY`,
+    );
+  }
   const isCanonicalUrl = dependencies.isCanonicalUrl ?? (() => false);
   // The IPv6 fake-IP gate keeps its stricter documented condition — a
   // scheme-matched variable or a SOCKS5 ALL_PROXY, never a non-SOCKS
@@ -306,6 +388,10 @@ async function providerOutboundRequest(
       `provider URL resolves to a private-network destination; add ${hostname} to NO_PROXY before using allowPrivateNetwork with an outbound proxy`,
     );
   }
+  if (localCleartextPost
+    && !resolved.addresses.every(answer => localCleartextAddressAllowed(answer.address))) {
+    throw new ProviderOutboundPolicyError("a cleartext provider POST resolved outside the local address allowlist");
+  }
   const requestOptions = {
     headers: init.headers,
     rejectUnauthorized: true,

package/src/lib/provider-runtime-fetch.ts

@@ -0,0 +1,23 @@
+import type { OcxProviderConfig } from "../types";
+
+export const RUNTIME_PROVIDER_FETCH = Symbol("opencodex.provider.runtime-fetch");
+
+export interface RuntimeProviderFetch {
+  providerName: string;
+  origins: readonly string[];
+  fetch: typeof globalThis.fetch;
+}
+
+/** Return only an explicitly injected executor matching the provider and exact destination origin. */
+export function runtimeProviderFetch(
+  provider: OcxProviderConfig,
+  providerName: string | undefined,
+): typeof globalThis.fetch | undefined {
+  const runtime = (provider as OcxProviderConfig & { [RUNTIME_PROVIDER_FETCH]?: RuntimeProviderFetch })[RUNTIME_PROVIDER_FETCH];
+  if (!runtime || runtime.providerName !== providerName) return undefined;
+  try {
+    return runtime.origins.includes(new URL(provider.baseUrl).origin) ? runtime.fetch : undefined;
+  } catch {
+    return undefined;
+  }
+}

package/src/lib/provider-tls-profile.ts

@@ -0,0 +1,221 @@
+import type { OcxProviderConfig } from "../types";
+import { redactSecretString } from "./redact";
+import { runtimeProviderFetch } from "./provider-runtime-fetch";
+import { markEgressTransparentExecutor } from "./provider-egress";
+import {
+  outboundProxyConfigured,
+  proxyEnvPresent,
+  resolveProxyRoute,
+  socks5ProxyFromEnv,
+  type ProxyEnvMap,
+} from "./proxy-env";
+
+export type ProviderTlsProfile = "antigravity-browser";
+/**
+ * `pending` means the profile is configured and valid but no request has used it yet; the
+ * dashboard must not report a configured profile as `disabled` before its first send.
+ */
+export type ProviderTlsProfileStatus = "disabled" | "pending" | "active" | "failed";
+export const ANTIGRAVITY_TLS_HOSTS = new Set([
+  "daily-cloudcode-pa.googleapis.com",
+  "cloudcode-pa.googleapis.com",
+]);
+type TlsRuntime = {
+  fetch(input: string | URL | Request, init?: RequestInit): Promise<Response>;
+  resolveProxyRoute?: typeof resolveProxyRoute;
+  env?: ProxyEnvMap;
+};
+let status = new Map<string, ProviderTlsProfileStatus>();
+let runtime: TlsRuntime | undefined;
+
+export function isCanonicalAntigravityUrl(input: string | URL): boolean {
+  try {
+    const url = new URL(input);
+    return (
+      url.protocol === "https:" &&
+      (url.port === "" || url.port === "443") &&
+      !url.username &&
+      !url.password &&
+      ANTIGRAVITY_TLS_HOSTS.has(url.hostname.toLowerCase())
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function providerTlsProfileConfigError(
+  providerName: string,
+  provider: Pick<
+    OcxProviderConfig,
+    "adapter" | "authMode" | "googleMode" | "baseUrl" | "tlsProfile"
+  >,
+): string | null {
+  if (provider.tlsProfile === undefined) return null;
+  if (provider.tlsProfile !== "antigravity-browser")
+    return "tlsProfile must be antigravity-browser";
+  if (
+    providerName !== "google-antigravity" ||
+    provider.adapter !== "google" ||
+    provider.authMode !== "oauth" ||
+    provider.googleMode !== "cloud-code-assist" ||
+    !isCanonicalAntigravityUrl(provider.baseUrl)
+  ) {
+    return "tlsProfile antigravity-browser requires the canonical Google Antigravity OAuth destination";
+  }
+  return null;
+}
+
+export function getProviderTlsProfileStatus(
+  name: string,
+  configured?: boolean,
+): ProviderTlsProfileStatus {
+  const recorded = status.get(name);
+  if (configured === undefined) return recorded ?? "disabled";
+  if (!configured) return "disabled";
+  return recorded === undefined || recorded === "disabled" ? "pending" : recorded;
+}
+
+/** The `/api/providers` fragment for a configured profile; empty when the provider has none. */
+export function providerTlsProfileDiagnostic(
+  name: string,
+  provider: Pick<OcxProviderConfig, "tlsProfile">,
+): { tlsProfile?: { profile: ProviderTlsProfile; status: ProviderTlsProfileStatus } } {
+  if (provider.tlsProfile === undefined) return {};
+  return { tlsProfile: { profile: provider.tlsProfile, status: getProviderTlsProfileStatus(name, true) } };
+}
+
+export function resetProviderTlsProfileForTests(): void {
+  status = new Map();
+  runtime = undefined;
+}
+
+export function setProviderTlsRuntimeForTest(
+  next: TlsRuntime | undefined,
+): void {
+  runtime = next;
+}
+
+function preserveTransportError(error: unknown): Error {
+  // A configured proxy URL can carry user:pass@, and the native transport may echo it. The
+  // shared redactor does not mask URL userinfo, so strip it here before the message travels.
+  const message = redactSecretString(
+    error instanceof Error ? error.message : "provider TLS transport failed",
+  ).replace(/\/\/[^/@\s]+@/g, "//<redacted>@");
+  const name = error instanceof Error ? error.name : "Error";
+  if (name === "AbortError" || name === "TimeoutError")
+    return new DOMException(message, name);
+  const wrapped = new Error(message);
+  wrapped.name = name;
+  return wrapped;
+}
+
+/** Proxy schemes the native TLS transport can carry for a route decided elsewhere. */
+const TLS_PROXY_PROTOCOLS = new Set(["http:", "https:", "socks5:", "socks5h:"]);
+
+function requireDirect(env: ProxyEnvMap): Record<string, never> {
+  // The native transport reads HTTP_PROXY/HTTPS_PROXY/ALL_PROXY itself whenever no proxy option
+  // is given, and it has no per-request "direct" switch. A direct route is therefore only
+  // honoured when no proxy variable exists at all; otherwise omitting the option would send the
+  // credential through the environment proxy the operator routed this request away from.
+  if (outboundProxyConfigured(env)) {
+    throw new Error("provider TLS profile cannot force a direct connection while a proxy environment variable is set");
+  }
+  return {};
+}
+
+/**
+ * The proxy option expressing this send's route on the native transport, or a refusal.
+ *
+ * `sendWithConnectionPolicy` resolves the per-provider egress (`providers.<name>.proxy` /
+ * `noProxy`) and passes it as `init.proxy`: a URL, `false` for direct, or absent when the
+ * provider inherits the global environment route.
+ */
+function tlsProxyOption(init: RequestInit | undefined, destination: string | URL): { proxy?: string } {
+  const env = runtime?.env ?? process.env;
+  const decided = init !== undefined && Object.hasOwn(init, "proxy")
+    ? (init as RequestInit & { proxy?: unknown }).proxy
+    : undefined;
+  if (typeof decided === "string") {
+    let protocol: string;
+    try {
+      protocol = new URL(decided).protocol;
+    } catch {
+      throw new Error("provider TLS profile cannot preserve configured proxy semantics");
+    }
+    if (!TLS_PROXY_PROTOCOLS.has(protocol)) {
+      throw new Error("provider TLS profile cannot preserve configured proxy semantics");
+    }
+    return { proxy: decided };
+  }
+  if (decided === false) return requireDirect(env);
+  const route = (runtime?.resolveProxyRoute ?? resolveProxyRoute)(new URL(destination), env);
+  if (route.kind === "fallback") {
+    // `resolveProxyRoute` only classifies HTTP(S) proxies; an inherited ALL_PROXY of socks5://
+    // or socks5h:// is the route the ordinary outbound path takes through socks5ProxyFromEnv().
+    // Carry that same route when no HTTPS-specific variable outranks it, instead of refusing
+    // every Antigravity send for an operator whose only global proxy is SOCKS.
+    const socks = proxyEnvPresent("HTTPS_PROXY", env) ? undefined : socks5ProxyFromEnv(env);
+    if (socks) return { proxy: socks.trim() };
+    throw new Error("provider TLS profile cannot preserve configured proxy semantics");
+  }
+  if (route.kind === "proxy") return { proxy: route.proxy };
+  return requireDirect(env);
+}
+
+export function providerTlsFetch(
+  name: string,
+  provider: Pick<
+    OcxProviderConfig,
+    "adapter" | "authMode" | "googleMode" | "baseUrl" | "tlsProfile"
+  >,
+  fallback: typeof globalThis.fetch,
+): typeof globalThis.fetch {
+  if (provider.tlsProfile === undefined) {
+    status.set(name, "disabled");
+    return fallback;
+  }
+  if (providerTlsProfileConfigError(name, provider)) {
+    status.set(name, "failed");
+    return (async () => {
+      throw new Error("invalid provider TLS profile");
+    }) as unknown as typeof globalThis.fetch;
+  }
+  // Transparent to provider egress: the route decided at the physical send arrives as
+  // `init.proxy` and is either carried by the native transport or refused below.
+  return markEgressTransparentExecutor((async (input, init) => {
+    const destination =
+      typeof input === "string" || input instanceof URL ? input : input.url;
+    if (!isCanonicalAntigravityUrl(destination)) {
+      status.set(name, "failed");
+      throw new Error("provider TLS profile refused noncanonical destination");
+    }
+    try {
+      const configured = runtimeProviderFetch(
+        provider as OcxProviderConfig,
+        name,
+      );
+      const proxyOption = tlsProxyOption(init, destination);
+      const mod =
+        configured === undefined
+          ? runtime ?? ((await import("wreq-js")) as unknown as TlsRuntime)
+          : undefined;
+      const { proxy: _decidedRoute, ...rest } = (init ?? {}) as RequestInit & { proxy?: unknown };
+      const response = await (configured ?? mod!.fetch)(input, {
+        ...rest,
+        redirect: "manual",
+        browser: "chrome_142",
+        os: "windows",
+        ...proxyOption,
+      } as RequestInit & { browser: string; os: string });
+      status.set(name, "active");
+      return response;
+    } catch (error) {
+      if (init?.signal?.aborted && error === init.signal.reason) {
+        // A caller cancellation says nothing about the profile's health.
+        throw error;
+      }
+      status.set(name, "failed");
+      throw preserveTransportError(error);
+    }
+  }) as typeof globalThis.fetch);
+}

package/src/lib/request-execution-budget.ts

@@ -79,6 +79,14 @@ export interface DispatchIntent {
    * second charge. Charging both is how a four-send cap silently becomes a two-send cap.
    */
   readonly countedExternally?: boolean;
+  /**
+   * True when the caller's request was rebuilt onto a different destination by an
+   * authorized mid-flight change (e.g. Kiro's reset-triggered account rebuild).
+   * The physical destination is still recorded, but the move is not a failover
+   * decision: it must not consume the request's single target transition or
+   * alternate-target allowance, which belong to the actual endpoint fallback.
+   */
+  readonly rebasedTarget?: boolean;
 }
 
 export interface SingleUseDispatchPermit {
@@ -316,10 +324,12 @@ function createRequestExecutionBudgetWithLedger(
       const changesTarget = lastTargetKey !== undefined && lastTargetKey !== intent.targetKey;
       const isAlternateTarget = changesTarget || intent.sendClass === "account-failover"
         || intent.sendClass === "combo-failover";
-      if (isAlternateTarget && changesTarget && targetTransitions >= policy.maxTargetTransitions) {
+      const chargesTransition = changesTarget && intent.rebasedTarget !== true;
+      const chargesAlternateTarget = isAlternateTarget && intent.rebasedTarget !== true;
+      if (isAlternateTarget && chargesTransition && targetTransitions >= policy.maxTargetTransitions) {
         return { allowed: false, reason: "target-transition-exhausted" };
       }
-      if (isAlternateTarget && alternateTargetSends >= policy.maxAlternateTargetSends) {
+      if (chargesAlternateTarget && alternateTargetSends >= policy.maxAlternateTargetSends) {
         return { allowed: false, reason: "alternate-target-exhausted" };
       }
 
@@ -349,8 +359,8 @@ function createRequestExecutionBudgetWithLedger(
       counter.spent += 1;
       if (intent.countedExternally === true) counter.pendingExternalSends += 1;
       if (drawsReserve) reserveSpent = true;
-      if (isAlternateTarget) alternateTargetSends += 1;
-      if (changesTarget) targetTransitions += 1;
+      if (chargesAlternateTarget) alternateTargetSends += 1;
+      if (chargesTransition) targetTransitions += 1;
       lastTargetKey = intent.targetKey;
 
       let settled: "open" | "used" | "released" = "open";
@@ -386,8 +396,8 @@ function createRequestExecutionBudgetWithLedger(
             counter.spent -= 1;
             observer?.refund();
             if (drawsReserve) reserveSpent = false;
-            if (isAlternateTarget) alternateTargetSends -= 1;
-            if (changesTarget) targetTransitions -= 1;
+            if (chargesAlternateTarget) alternateTargetSends -= 1;
+            if (chargesTransition) targetTransitions -= 1;
             lastTargetKey = previousTargetKey;
           },
         },