@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/lib/bun-path-runtime.mjs

@@ -1,5 +1,5 @@
 import { spawnSync } from "node:child_process";
-import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { accessSync, constants, lstatSync, readlinkSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { posix, win32 } from "node:path";
 import { performance } from "node:perf_hooks";
@@ -7,6 +7,7 @@ import { isRealBunBinary } from "./bun-binary-validator.mjs";
 
 const STABLE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 const MAX_VERSION_BYTES = 4096;
+const MAX_SYMLINK_EXPANSIONS = 40;
 const IDENTITY_PROBE = "process.stdout.write(String(typeof Bun==='object'&&Bun.version))";
 
 function stableVersion(value) {
@@ -17,6 +18,62 @@ function stableVersion(value) {
   return numbers.every(Number.isSafeInteger) ? numbers : null;
 }
 
+function trustedPosixCandidate(candidate, canonical, io) {
+  const lstat = io.lstat ?? lstatSync;
+  const readlink = io.readlink ?? readlinkSync;
+  const uid = io.geteuid?.() ?? process.geteuid?.();
+  if (!Number.isSafeInteger(uid) || uid < 0) return false;
+
+  const walk = path => {
+    let pending = path.slice(1).split("/");
+    let current = "/";
+    let expansions = 0;
+    while (pending.length) {
+      const [component, ...remaining] = pending;
+      pending = remaining;
+      if (!component || component === ".") continue;
+      if (component === "..") {
+        current = posix.dirname(current);
+        continue;
+      }
+      const entry = posix.join(current, component);
+      const info = lstat(entry);
+      if (!Number.isSafeInteger(info.uid) || (info.uid !== 0 && info.uid !== uid)) return null;
+      if (info.isSymbolicLink()) {
+        if (++expansions > MAX_SYMLINK_EXPANSIONS) return null;
+        const target = readlink(entry);
+        pending = target.startsWith("/")
+          ? [...target.slice(1).split("/"), ...pending]
+          : [
+            ...(current === "/" ? [] : current.slice(1).split("/")),
+            ...target.split("/"),
+            ...pending,
+          ];
+        current = "/";
+        continue;
+      }
+      if (remaining.length || pending.length) {
+        // No writable-ancestor exemption: a shared sticky directory passes its own
+        // ownership check but lets another user replace a child entry between the
+        // ancestry walk and the exec probe, substituting an unvalidated binary.
+        if (!info.isDirectory() || (info.mode & 0o022) !== 0) return null;
+      } else if (!info.isFile() || (info.mode & 0o022) !== 0) {
+        return null;
+      }
+      current = entry;
+    }
+    return current;
+  };
+
+  const resolved = walk(candidate);
+  if (!resolved || (io.realpath ?? realpathSync.native)(resolved) !== canonical) return false;
+  const parent = lstat(posix.dirname(canonical));
+  return parent.isDirectory()
+    && Number.isSafeInteger(parent.uid)
+    && (parent.uid === 0 || parent.uid === uid)
+    && (parent.mode & 0o022) === 0;
+}
+
 /** Discover the first absolute PATH Bun passing version-policy and identity checks. */
 export function findPathBun({
   env = process.env, platform = process.platform, pinnedVersion,
@@ -54,14 +111,16 @@ export function findPathBun({
     if (now() >= end) break;
     if (!directory || !absolute(directory)) continue;
     try {
-      const path = realpath(paths.join(directory, platform === "win32" ? "bun.exe" : "bun"));
+      const candidatePath = paths.join(directory, platform === "win32" ? "bun.exe" : "bun");
+      const path = realpath(candidatePath);
       if (!absolute(path)) continue;
+      if (platform !== "win32" && !trustedPosixCandidate(candidatePath, path, io)) continue;
       const identity = platform === "win32" ? path.toLowerCase() : path;
       if (seen.has(identity)) continue;
       seen.add(identity);
       const file = stat(path);
       if (!file.isFile()) continue;
-      if (platform !== "win32" && ((file.mode & 0o022) || (stat(paths.dirname(path)).mode & 0o022))) continue;
+      if (platform !== "win32" && (file.mode & 0o022)) continue;
       access(path, constants.X_OK);
       if (!validate(path)) continue;
       const version = probe(path, ["--version"]);

package/src/lib/codex-restart-contract.ts

@@ -36,6 +36,10 @@ export interface CodexAppServerStateResponse {
  * The desktop half of a restart. Scalar-only for the same reason as the rest of this
  * contract: pid lists and a closed-vocabulary reason, never a command line or an OS
  * error message, both of which routinely embed a path or a username.
+ *
+ * `reason: "picker_current"` means the shell was deliberately left running because it
+ * launched after the current catalog was written, so only the app-servers restarted and
+ * the operator's unsaved client state was kept (#4761).
  */
 export interface CodexDesktopRestartSummary {
   attempted: boolean;
@@ -43,8 +47,17 @@ export interface CodexDesktopRestartSummary {
   surviving: number[];
   relaunch: "started" | "skipped";
   reason?: string;
+  /**
+   * Why the desktop was or was not restarted: `stale` (the shell predates the bound
+   * catalog, or this request rebound it) and `unknown` (the evidence was unreadable) both
+   * take the full restart. Absent on a proxy older than #4761.
+   */
+  pickerState?: CodexDesktopPickerState;
 }
 
+export type CodexDesktopPickerState = "current" | "stale" | "unknown" | "not_running";
+const DESKTOP_PICKER_STATES: readonly string[] = ["current", "stale", "unknown", "not_running"];
+
 /** POST response. All four arrays are pid lists — never command lines. */
 export interface CodexRestartResponse {
   success: boolean;
@@ -130,6 +143,8 @@ export function isCodexRestartResponse(value: unknown): value is CodexRestartRes
     if (!isPidList(d.stopped) || !isPidList(d.surviving)) return false;
     if (d.relaunch !== "started" && d.relaunch !== "skipped") return false;
     if (d.reason !== undefined && typeof d.reason !== "string") return false;
+    if (d.pickerState !== undefined
+      && (typeof d.pickerState !== "string" || !DESKTOP_PICKER_STATES.includes(d.pickerState))) return false;
     // A started relaunch cannot have left anything behind: the ladder refuses to
     // relaunch beside a survivor precisely so a second shell never appears.
     if (d.relaunch === "started" && (d.surviving as number[]).length > 0) return false;

package/src/lib/desktop-proxy-route.ts

@@ -0,0 +1,30 @@
+import { configuredOutboundFetch, effectiveProxyFor, noProxyMatches, type ProxyEnvMap, type ProxyCapableRequestInit } from "./proxy-env";
+
+/** Bind both native desktop transports to one explicit route; never fall back after failure. */
+export function desktopProxyFor(url: URL, env: ProxyEnvMap = process.env): string | false {
+  if (noProxyMatches(url, env)) return false;
+  const key = url.protocol === "https:" ? "HTTPS_PROXY" : "HTTP_PROXY";
+  let selected = effectiveProxyFor(url, env);
+  // Unlike an implicit Bun route, this transport explicitly binds HTTP(S) CONNECT.
+  // A malformed scheme-specific setting still refuses instead of falling through.
+  if (!selected && url.protocol === "https:" && !(env[key]?.trim() || env[key.toLowerCase()]?.trim())) {
+    const all = env.ALL_PROXY?.trim() || env.all_proxy?.trim();
+    if (all) {
+      let parsed: URL; try { parsed = new URL(all); } catch { throw new Error("desktop_egress_proxy_invalid"); }
+      if (["http:", "https:"].includes(parsed.protocol)) selected = all;
+    }
+  }
+  if (selected) {
+    const proxy = new URL(selected);
+    if (!["http:", "https:", "socks5:", "socks5h:"].includes(proxy.protocol) || !proxy.hostname
+      || proxy.search || proxy.hash || proxy.pathname !== "" && proxy.pathname !== "/") throw new Error("desktop_egress_proxy_invalid");
+    return selected;
+  }
+  // An explicit but unsupported route must not quietly become direct desktop traffic.
+  if ([env[key], env[key.toLowerCase()], env.ALL_PROXY, env.all_proxy].some(value => value?.trim())) throw new Error("desktop_egress_proxy_invalid");
+  return false;
+}
+export function desktopOutboundFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+  const url = new URL(input instanceof Request ? input.url : String(input));
+  return configuredOutboundFetch(input, { ...init, proxy: desktopProxyFor(url) } as ProxyCapableRequestInit);
+}

package/src/lib/desktop-upstream-tunnel.ts

@@ -0,0 +1,72 @@
+import { connect as tcpConnect, type Socket } from "node:net";
+import { connect as tlsConnect, type TLSSocket } from "node:tls";
+import { desktopProxyFor } from "./desktop-proxy-route";
+import { dialTunnel, type OpaqueProxyRoute } from "./opaque-proxy-tunnel";
+
+// The shared opaque dialer owns proxy framing; this caller owns fixed-target
+// TLS and bounds the entire connection, including the target TLS handshake.
+export interface DesktopTunnelOptions {
+  proxy?: string | false;
+  signal?: AbortSignal;
+  timeoutMs?: number;
+  /** Isolated test peers; production always uses verified TLS to chatgpt.com:443. */
+  target?: { host: string; port: number };
+  ca?: string;
+  proxyCa?: string;
+}
+const fail = () => new Error("desktop_upstream_connection_failed");
+function waitConnected(socket: Socket, event: "connect" | "secureConnect", signal: AbortSignal): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const dispose = () => { socket.off(event, done); socket.off("error", failure); socket.off("close", failure); signal.removeEventListener("abort", failure); };
+    const done = () => { dispose(); resolve(); };
+    const failure = () => { dispose(); reject(fail()); };
+    socket.once(event, done); socket.once("error", failure); socket.once("close", failure);
+    signal.addEventListener("abort", failure, { once: true }); if (signal.aborted) failure();
+  });
+}
+/** Fixed-destination TLS dial for native desktop upgraded sockets. No logs or direct fallback. */
+export async function dialDesktopUpstream(options: DesktopTunnelOptions = {}): Promise<TLSSocket> {
+  const timeout = options.timeoutMs ?? 10000;
+  if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > 30000) throw fail();
+  const cancel = new AbortController(), timer = setTimeout(() => cancel.abort(), timeout);
+  const signal = options.signal ? AbortSignal.any([options.signal, cancel.signal]) : cancel.signal;
+  const sockets = new Set<Socket>();
+  const own = <T extends Socket>(socket: T): T => { sockets.add(socket); socket.on("error", () => {}); return socket; };
+  const destroy = () => { for (const socket of sockets) socket.destroy(); };
+  signal.addEventListener("abort", destroy, { once: true });
+  try {
+    if (signal.aborted) throw fail();
+    const proxy = options.proxy === undefined ? desktopProxyFor(new URL("https://chatgpt.com")) : options.proxy;
+    const target = options.target ?? { host: "chatgpt.com", port: 443 };
+    let raw: Socket;
+    if (proxy === false) {
+      raw = own(tcpConnect(target)); await waitConnected(raw, "connect", signal);
+    } else {
+      const url = new URL(proxy), protocol = url.protocol;
+      if (!["http:", "https:", "socks5:", "socks5h:"].includes(protocol) || !url.hostname || url.search || url.hash || url.pathname !== "" && url.pathname !== "/") throw fail();
+      const host = url.hostname.replace(/^\[|\]$/g, ""), port = Number(url.port) || (protocol === "https:" ? 443 : protocol.startsWith("socks") ? 1080 : 80);
+      const credentials = url.username || url.password
+        ? { username: decodeURIComponent(url.username), password: decodeURIComponent(url.password) }
+        : {};
+      const endpoint = { host, port, ...credentials };
+      const route: OpaqueProxyRoute = protocol === "https:"
+        ? { ...endpoint, kind: "https", proxyCa: options.proxyCa }
+        : { ...endpoint, kind: protocol.slice(0, -1) as "http" | "socks5" | "socks5h" };
+      const authority = `${target.host.includes(":") ? `[${target.host}]` : target.host}:${target.port}`;
+      // The route resolver remains authoritative; a failed proxy never becomes DIRECT.
+      raw = own(await dialTunnel(authority, route, { signal, timeoutMs: timeout, maxHeaderBytes: 65536 }));
+    }
+    if (signal.aborted || raw.destroyed) throw fail();
+    // This consumer historically closes its writable side after peer EOF. The
+    // shared opaque transport preserves half-closes for callers that need them.
+    raw.allowHalfOpen = false;
+    const secured = own(tlsConnect({ socket: raw, servername: "chatgpt.com", ca: options.ca, rejectUnauthorized: true, ALPNProtocols: ["http/1.1"] }));
+    // The CONNECT reader paused its stream before handing buffered bytes back. Bun's
+    // TLS-over-TLS path needs the outer TLS stream explicitly resumed for the new handshake.
+    raw.resume();
+    await waitConnected(secured, "secureConnect", signal);
+    if (signal.aborted) throw fail();
+    return secured;
+  } catch { destroy(); throw fail(); }
+  finally { clearTimeout(timer); signal.removeEventListener("abort", destroy); }
+}

package/src/lib/empty-tool-catalog.ts

@@ -0,0 +1,62 @@
+import { normalizeDeclaredToolName, type AdapterEvent } from "../types";
+import { UNDECLARED_TOOL_CALL_ERROR_CODE } from "./errors";
+import { releaseTranslatedEvent, type TranslatorBudget } from "./translator-budget";
+import { releaseCompactionCiphertextLease } from "../responses/compaction";
+
+/** Snapshot of current-turn declarations when an explicit empty catalog activates enforcement. */
+export interface ClientToolCatalogRestriction {
+  declaredToolNames: ReadonlySet<string>;
+  bareCustomToolNames: ReadonlySet<string>;
+}
+
+export function emptyToolCatalogRefusal(
+  event: AdapterEvent,
+  catalog: ClientToolCatalogRestriction | undefined,
+): Extract<AdapterEvent, { type: "error" }> | undefined {
+  if (!catalog) return;
+  if (event.type === "tool_call_start") {
+    const name = normalizeDeclaredToolName(event.name, catalog.declaredToolNames, undefined, catalog.bareCustomToolNames);
+    if (catalog.declaredToolNames.has(name)) return;
+  } else if (catalog.declaredToolNames.size !== 0
+    || (event.type !== "tool_call_delta" && event.type !== "tool_call_end")) return;
+  return {
+    type: "error", status: 502, errorType: "upstream_error", code: UNDECLARED_TOOL_CALL_ERROR_CODE,
+    message: "routed provider emitted a client tool call outside the current request's explicit tool catalog",
+  };
+}
+
+/** Runs after hosted tool loops, before client delivery and continuation-state folding. */
+export async function* guardEmptyToolCatalogStream(
+  events: AsyncIterable<AdapterEvent>,
+  catalog: ClientToolCatalogRestriction | undefined,
+  budget: TranslatorBudget,
+): AsyncGenerator<AdapterEvent> {
+  for await (const event of events) {
+    const refusal = emptyToolCatalogRefusal(event, catalog);
+    if (refusal) {
+      releaseTranslatedEvent(event, budget);
+      releaseCompactionCiphertextLease(event, budget);
+    }
+    yield refusal ?? event;
+    if (refusal) return;
+  }
+}
+
+export function guardEmptyToolCatalogEvents(
+  events: AdapterEvent[],
+  catalog: ClientToolCatalogRestriction | undefined,
+  budget: TranslatorBudget,
+): AdapterEvent[] {
+  if (!catalog) return events;
+  const index = events.findIndex(event => emptyToolCatalogRefusal(event, catalog) !== undefined);
+  if (index < 0) return events;
+  const refusal = emptyToolCatalogRefusal(events[index]!, catalog)!;
+  for (const event of events.slice(index)) {
+    if ((event.type === "done" || event.type === "incomplete" || event.type === "error") && event.usage) {
+      refusal.usage = event.usage;
+    }
+    releaseTranslatedEvent(event, budget);
+    releaseCompactionCiphertextLease(event, budget);
+  }
+  return [...events.slice(0, index), refusal];
+}

package/src/lib/errors.ts

@@ -18,6 +18,13 @@ export const ENCRYPTED_FUNCTION_OUTPUT_REJECTION =
  */
 export const SEND_BUDGET_EXHAUSTED_CODE = "request_send_budget_exhausted";
 export const SPEND_LEDGER_STORAGE_UNAVAILABLE_CODE = "spend_ledger_storage_unavailable";
+/**
+ * Wire code for the undeclared-tool guard's deterministic refusal. Endpoint translators
+ * read it to keep the refusal non-retryable instead of folding it into the transient
+ * upstream-error class. Declared here rather than in the guard module because the shared
+ * envelope formatter decides whether the identity survives serialization.
+ */
+export const UNDECLARED_TOOL_CALL_ERROR_CODE = "undeclared_tool_call";
 
 /** First nonblank string across the canonical upstream error paths, in priority order. */
 export function upstreamErrorMessageFromPayload(payload: unknown): string | undefined {
@@ -643,10 +650,22 @@ export function adapterFailureFromMessage(message: string): { httpStatus: number
   return { httpStatus, error };
 }
 
+/** A declared client refusal: retrying the identical request cannot change the verdict. */
+const CLIENT_ERROR_STATUS: Record<string, 400 | 401 | 403 | 404> = {
+  invalid_request_error: 400,
+  authentication_error: 401,
+  permission_error: 403,
+  not_found_error: 404,
+};
+
 /** Narrow structured classes carried through a synthesized bare-error terminal. */
 export function recognizedUpstreamError(error: { type?: unknown; code?: unknown }):
-  { type: string; code: string; httpStatus: 429 | 503 } | undefined {
+  { type: string; code: string; httpStatus: 400 | 401 | 403 | 404 | 429 | 503 } | undefined {
   const code = typeof error.code === "string" ? error.code : undefined;
+  const clientClass = code ?? (typeof error.type === "string" ? error.type : undefined);
+  if (clientClass !== undefined && Object.hasOwn(CLIENT_ERROR_STATUS, clientClass)) {
+    return { type: clientClass, code: clientClass, httpStatus: CLIENT_ERROR_STATUS[clientClass] };
+  }
   // An explicit unknown code must not gain a recognized class from its type or copy.
   if (code !== undefined && !["rate_limit_exceeded", "rate_limit_error", "server_is_overloaded", "overloaded_error"].includes(code)) return undefined;
   if (code === "rate_limit_exceeded" || code === "rate_limit_error"
@@ -673,8 +692,13 @@ export function httpStatusFromTerminalError(error: {
   if (isCyberPolicyCode(error.code) || (error.message ? isCyberPolicyMessage(error.message) : false)) {
     return 400;
   }
+  const message = error.message ?? "";
   const recognized = recognizedUpstreamError(error);
-  if (recognized) return recognized.httpStatus;
+  // Client-closed messages often arrive as invalid_request_error after classifyError, so a
+  // recognized 400 yields to the client-closed check below; every other class keeps its order.
+  if (recognized && !(recognized.httpStatus === 400 && message && isClientClosedMessage(message))) {
+    return recognized.httpStatus;
+  }
   if (error.type === "rate_limit_error" || error.code === "rate_limit_exceeded") return 429;
   if (error.type === "authentication_error" || error.code === "invalid_api_key") return 401;
   if (
@@ -686,7 +710,6 @@ export function httpStatusFromTerminalError(error: {
   if (error.type === "server_error" && error.code === "server_is_overloaded") return 503;
   // Client-closed messages often arrive as invalid_request_error after classifyError; check message
   // before treating every invalid_request_error as HTTP 400.
-  const message = error.message ?? "";
   if (message && isClientClosedMessage(message)) return 499;
   if (error.type === "invalid_request_error") return 400;
   if (error.type === "proxy_error") return 500;

package/src/lib/gcp-adc.ts

@@ -2,6 +2,10 @@
  * Application Default Credentials (ADC) resolution for Vertex AI.
  *
  * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:
+ *   0. A `gcp-sa:<account>` reference (the provider's active key resolving to one) → the Service
+ *      Account / authorized_user JSON stored in the OS credential store under that account
+ *      (`keychain:<account>` secret, written by the key-store save path when the user pastes a
+ *      credential JSON directly into the API-key slot). See resolveGcpCredentialMarker.
  *   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT
  *      exchange) or `type: "authorized_user"` (refresh-token exchange).
  *   2. gcloud user ADC (`CLOUDSDK_CONFIG`, else `%APPDATA%\gcloud` on Windows, else
@@ -18,6 +22,8 @@ import { Buffer } from "node:buffer";
 import * as os from "node:os";
 import * as path from "node:path";
 import { readFileSync, existsSync, statSync } from "node:fs";
+import { GCP_CREDENTIAL_MARKER_PREFIX, providerKeychainEntry } from "../providers/api-key-resolve";
+export { isGcpCredentialMaterial } from "./gcp-credential-input";
 import {
   captureConfigGeneration,
   sweepExpiredOnWrite,
@@ -36,6 +42,50 @@ const TOKEN_TIMEOUT_MS = 15_000;
 const TOKEN_ATTEMPTS = 3;
 const TOKEN_RETRY_BASE_MS = 300;
 
+/**
+ * Reference prefix stored in `provider.apiKey` (and `apiKeyPool` entries) when the user pastes a
+ * GCP credential JSON directly into an API-key slot. The secret JSON lives in the OS credential
+ * store under the same service the `keychain:` references use; only the marker is persisted to
+ * `config.json`. The leaf reference prefix also identifies already-stored material for migration.
+ */
+export { GCP_CREDENTIAL_MARKER_PREFIX } from "../providers/api-key-resolve";
+
+/** Extract a marker account; malformed explicit markers never opt into host ADC. */
+export function gcpCredentialMarkerAccount(value: string | undefined): string | undefined {
+  if (typeof value !== "string" || !value.startsWith(GCP_CREDENTIAL_MARKER_PREFIX)) return undefined;
+  const account = value.slice(GCP_CREDENTIAL_MARKER_PREFIX.length);
+  if (!account.trim()) throw new Error("GCP credential marker requires a non-empty account");
+  return account;
+}
+
+/**
+ * Whether a pasted API-key value is in fact a GCP credential JSON. Used by the save path to
+ * divert JSON material out of the literal-key flow before it reaches `config.json`. Deliberately
+ * strict: only a `type` field with a known ADC credential type counts, so a user's literal API
+ * key that happens to start with `{` is never eaten.
+ */
+export function parseGcpCredentialJson(value: string): AdcFileCredentials | undefined {
+  const trimmed = (value ?? "").trim();
+  if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) return undefined;
+  try {
+    const parsed = JSON.parse(trimmed) as Record<string, unknown>;
+    if (parsed?.type === "service_account") {
+      if (typeof parsed.client_email !== "string" || !parsed.client_email.trim()) return undefined;
+      if (typeof parsed.private_key !== "string" || !parsed.private_key.trim()) return undefined;
+      return parsed as unknown as AdcFileCredentials;
+    }
+    if (parsed?.type === "authorized_user") {
+      if (typeof parsed.client_id !== "string" || !parsed.client_id.trim()) return undefined;
+      if (typeof parsed.client_secret !== "string" || !parsed.client_secret.trim()) return undefined;
+      if (typeof parsed.refresh_token !== "string" || !parsed.refresh_token.trim()) return undefined;
+      return parsed as unknown as AdcFileCredentials;
+    }
+    return undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 interface CachedToken {
   token: string;
   expiresAtMs: number;
@@ -81,7 +131,10 @@ export function sweepExpiredGcpAdcTokens(now = Date.now()): number {
 
 export function reconcileGcpAdcTokens(context: GenerationContext): number {
   if (context.generation <= lastReconciledGeneration) return 0;
-  const currentSource = currentAdcSourceKey();
+  // The periodic sweep registration has no request context, so no marker is active here: markers
+  // travel per-request via getVertexAccessToken(options.markerAccount), and a marker-token cache
+  // entry whose account no longer resolves is simply pruned by this sweep when it expires.
+  const currentSource = currentAdcSourceKey(undefined);
   let removed = 0;
   for (const source of tokenCache.keys()) {
     if (source === currentSource) continue;
@@ -131,7 +184,29 @@ function readJsonFile<T>(filePath: string): T | undefined {
   return JSON.parse(readFileSync(filePath, "utf8")) as T;
 }
 
-function loadAdcCredentials(): { source: string; creds: AdcFileCredentials } | undefined {
+/**
+ * Read the credential JSON for a `gcp-sa:<account>` marker from the OS credential store. Uses the
+ * same service name and the same injectable entry factory as the `keychain:` API-key references
+ * (api-key-resolve.providerKeychainEntry), so one probe surface and one test seam cover both.
+ * Mirrors `readKeychain`'s fail-closed policy: an unreadable entry yields no credential (the
+ * caller surfaces the failure instead of silently falling through to the next ADC source).
+ */
+function readMarkerCredential(account: string): AdcFileCredentials | undefined {
+  try {
+    const raw = providerKeychainEntry(account).getPassword();
+    if (typeof raw !== "string" || !raw.trim()) return undefined;
+    return parseGcpCredentialJson(raw);
+  } catch {
+    return undefined;
+  }
+}
+
+function loadAdcCredentials(markerAccount: string | undefined): { source: string; creds: AdcFileCredentials } | undefined {
+  if (markerAccount) {
+    const creds = readMarkerCredential(markerAccount);
+    if (!creds) throw new Error("GCP credential marker is set but its credential could not be read from the OS credential store");
+    return { source: `marker:${markerAccount}`, creds };
+  }
   const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
   if (gacPath) {
     const creds = readJsonFile<AdcFileCredentials>(gacPath);
@@ -148,9 +223,10 @@ function loadAdcCredentials(): { source: string; creds: AdcFileCredentials } | u
  * The cache key for the source the NEXT resolve would use, computed cheaply (no network). Lets the
  * cache return a token only when it still matches the active credential source, so an in-process
  * change to GOOGLE_APPLICATION_CREDENTIALS (or the user ADC file) does not keep serving a stale
- * token from a different source. Falls back to "metadata" when no file/env ADC is present.
+ * token from a different source. Falls back to "metadata" when no marker/file/env ADC is present.
  */
-function currentAdcSourceKey(): string {
+function currentAdcSourceKey(markerAccount: string | undefined): string {
+  if (markerAccount) return `marker:${markerAccount}`;
   const gacPath = process.env.GOOGLE_APPLICATION_CREDENTIALS;
   if (gacPath) return fileSourceTag("gac", gacPath);
   const userPath = userAdcPath();
@@ -279,8 +355,8 @@ async function fetchMetadataToken(signal: AbortSignal | undefined, fetchImpl: Fe
   }
 }
 
-async function resolveAccessTokenUncached(signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<{ source: string; token: TokenResponse }> {
-  const adc = loadAdcCredentials();
+async function resolveAccessTokenUncached(markerAccount: string | undefined, signal: AbortSignal | undefined, fetchImpl: FetchImpl): Promise<{ source: string; token: TokenResponse }> {
+  const adc = loadAdcCredentials(markerAccount);
   if (adc) {
     const token = adc.creds.type === "service_account"
       ? await exchangeJwtForToken(adc.creds, signal, fetchImpl)
@@ -295,14 +371,25 @@ async function resolveAccessTokenUncached(signal: AbortSignal | undefined, fetch
 }
 
 /** Returns a Bearer access token for the `Authorization` header on Vertex AI calls (cached + refreshed). */
-export async function getVertexAccessToken(options?: { signal?: AbortSignal; fetch?: FetchImpl }): Promise<string> {
+export async function getVertexAccessToken(options?: { signal?: AbortSignal; fetch?: FetchImpl; markerAccount?: string }): Promise<string> {
+  // The marker travels as an argument, never as process-global state: a module-level "active
+  // marker" written by the router would race across concurrent requests for different providers
+  // and could resolve one provider's Vertex call with another provider's service account. The
+  // adapter passes `gcpCredentialMarkerAccount(provider.apiKey)` per request instead.
+  const markerAccount = options?.markerAccount;
   const fetchImpl = options?.fetch ?? globalThis.fetch.bind(globalThis);
   const skew = getRefreshSkewMs();
   const now = Date.now();
 
   // Only serve a cached token that matches the source the next resolve would actually use; prune
   // expired or now-stale (different-source) entries so a credential-source change is honored.
-  const expectedSource = currentAdcSourceKey();
+  const expectedSource = currentAdcSourceKey(markerAccount);
+  // A cached bearer token is usable only while the explicitly selected store entry remains
+  // readable. Removal or a locked store must fail closed before the cache can return it.
+  if (markerAccount && !readMarkerCredential(markerAccount)) {
+    tokenCache.delete(expectedSource);
+    throw new Error("GCP credential marker is set but its credential could not be read from the OS credential store");
+  }
   const writerGeneration = captureConfigGeneration();
   for (const [source, cached] of tokenCache) {
     if (source === expectedSource && cached.expiresAtMs - skew > now) return cached.token;
@@ -317,7 +404,7 @@ export async function getVertexAccessToken(options?: { signal?: AbortSignal; fet
 
   const promise = (async () => {
     try {
-      const { source, token } = await resolveAccessTokenUncached(options?.signal, fetchImpl);
+      const { source, token } = await resolveAccessTokenUncached(markerAccount, options?.signal, fetchImpl);
       const expiresAtMs = Date.now() + Math.max(0, token.expires_in * 1000);
       if (writerGeneration >= lastReconciledGeneration || liveSources.has(source)) {
         tokenCache.set(source, { token: token.access_token, expiresAtMs });

package/src/lib/gcp-credential-input.ts

@@ -0,0 +1,12 @@
+/** Structured JSON is never literal key material; malformed GCP text is also refused. */
+export function isGcpCredentialMaterial(value: string): boolean {
+  const credentialField = /\b(?:service_account|authorized_user|external_account|private_key|refresh_token|client_secret)\b|-----BEGIN [A-Z ]*PRIVATE KEY-----/;
+  if (/[\[\{"']/.test(value) && credentialField.test(value)) return true;
+  // Reject structured carriers outright rather than recursively guessing their credential shape.
+  // This includes quoted/array/object wrappers with arbitrarily escaped or nested JSON inside.
+  try {
+    const parsed: unknown = JSON.parse(value);
+    return typeof parsed === "string" || (parsed !== null && typeof parsed === "object");
+  }
+  catch { return false; }
+}

package/src/lib/lab-live-route-production.ts

@@ -72,6 +72,11 @@ export async function buildLabProviderAuthHeaders(
       && configuredAnthropicInstance(config, routeContext.providerId) !== routeContext.providerId) {
       throw new TransportError("auth_blocked", "anthropic instance unavailable");
     }
+    // The DSH account token is sent only by its own adapter to its pinned endpoint; the generic
+    // probe transport would use another endpoint and auth scheme.
+    if (routeContext.providerId === "dsh-account") {
+      throw new TransportError("auth_blocked", "dsh-account probes are not supported");
+    }
     try {
       const snapshot = await getValidAccessTokenSnapshot(routeContext.providerId);
       headers.Authorization = `Bearer ${snapshot.accessToken}`;

package/src/lib/local-internal-call-capability.ts

@@ -0,0 +1,55 @@
+/**
+ * Process-local internal-call capability.
+ *
+ * Some requests ARE the proxy itself talking to its own data plane: the advisor sidecar's
+ * loopback consultation is the first user. Such a request must be recognized as INTERNAL without
+ * trusting anything the client controls. A client-supplied header value is not evidence — any
+ * external caller can send it — and neither is the peer address: a public listener reached
+ * through Docker, WSL, a tunnel, or port forwarding can present as loopback on the last hop, as
+ * the local-management attestation notes.
+ *
+ * The authority is therefore process-owned: a 256-bit random value minted once per process, kept
+ * in memory only. It is never written to config or disk, never logged, never returned by the
+ * management API, never placed in usage or request metadata, and never forwarded upstream. A new
+ * process mints a new value, so a token captured from an older process is worthless. Comparison
+ * is timing-safe and shape-checked, reusing the same secret shape as the local attestation
+ * module.
+ *
+ * The same primitive is what the vision-describe fence would need for the same reason; wiring
+ * that surface is deliberately left out of this change (recorded as a pre-existing analogous
+ * issue) so the change stays scoped.
+ */
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { isLocalAttestationSecret } from "./local-management-attestation";
+
+/** Header an internal sidecar presents on its own loopback request. */
+export const ADVISOR_INTERNAL_CAPABILITY_HEADER = "x-opencodex-advisor-internal";
+
+let processCapability: string | null = null;
+
+/**
+ * The current process's internal-call capability. Minted lazily on first use (one random draw,
+ * no I/O), so an install that never enables the advisor never generates one.
+ */
+export function internalCallCapability(): string {
+  if (processCapability === null) processCapability = randomBytes(32).toString("base64url");
+  return processCapability;
+}
+
+/** Test seam: install a deterministic value, or `null` to force a fresh mint. */
+export function setInternalCallCapabilityForTests(value: string | null): void {
+  processCapability = value;
+}
+
+/**
+ * True only when the supplied header value IS this process's capability. Shape-checked first so
+ * a malformed value cannot reach the comparison, then compared in constant time.
+ */
+export function isInternalCallCapability(supplied: string | null | undefined): boolean {
+  if (typeof supplied !== "string" || !isLocalAttestationSecret(supplied)) return false;
+  if (processCapability === null) return false;
+  const expected = processCapability;
+  const suppliedBytes = Buffer.from(supplied);
+  const expectedBytes = Buffer.from(expected);
+  return suppliedBytes.length === expectedBytes.length && timingSafeEqual(suppliedBytes, expectedBytes);
+}