@evomap/evolver 1.84.0 → 1.84.2

package/src/proxy/router/messages_route.js

@@ -0,0 +1,242 @@
+'use strict';
+
+// /v1/messages handler for Phase C. Three pipeline stages wrap _proxyAnthropic:
+//   1. extract stateless features  (router/features.js)
+//   2. pickForTurn → tier → concrete model (router/model_router.js + DEFAULT_TIER_MODELS)
+//   3. rewriteModel preserving cache_control breakpoints (router/cache_passthrough.js)
+//
+// Each stage has its own fallback so a single bad input never breaks the
+// passthrough: classifier throw → forward unmodified; rewriter throw →
+// forward unmodified; upstream 5xx on a router-rewritten request → one
+// retry with the client's original model (a one-hub/prism-style gateway
+// may return 503 "no channel" for a tier-target model the upstream isn't
+// configured for; falling back to the original model is more useful than
+// a hard 503). All other non-2xx is relayed verbatim — we don't fabricate
+// SSE error frames. Telemetry-style log lines record which fallback fired
+// so the realized-vs-projected delta is measurable post-merge.
+
+const { pickForTurn } = require('./model_router');
+const { rewriteModel } = require('./cache_passthrough');
+const { extractFeatures } = require('./features');
+
+const DEFAULT_TIER_MODELS = Object.freeze({
+  cheap: 'claude-haiku-4-5',
+  mid: 'claude-sonnet-4-6',
+  expensive: 'claude-opus-4-7',
+});
+
+function resolveTierModels() {
+  return {
+    cheap: process.env.EVOMAP_MODEL_CHEAP || DEFAULT_TIER_MODELS.cheap,
+    mid: process.env.EVOMAP_MODEL_MID || DEFAULT_TIER_MODELS.mid,
+    expensive: process.env.EVOMAP_MODEL_EXPENSIVE || DEFAULT_TIER_MODELS.expensive,
+  };
+}
+
+function buildMessagesHandler({ anthropicProxy, logger, routerEnabled } = {}) {
+  if (typeof anthropicProxy !== 'function') {
+    throw new Error('buildMessagesHandler requires anthropicProxy(path, body, opts)');
+  }
+  const log = logger || console;
+  // Phase C slice 6: flag is read at handler construction (proxy start), not
+  // per-request — flipping the env var requires a proxy restart, fine for an
+  // MVP feature flag. Explicit boolean override wins so tests stay hermetic.
+  const enabled = typeof routerEnabled === 'boolean'
+    ? routerEnabled
+    : process.env.EVOMAP_ROUTER_ENABLED === '1';
+
+  return async ({ body, headers }) => {
+    const inboundHeaders = headers || {};
+    // x-api-key is satisfied by either the inbound header OR a proxy-side
+    // ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN env (token mediation, see
+    // _proxyAnthropic). The proxy server itself has already auth-checked
+    // `Authorization: Bearer <proxy_token>` before reaching this handler.
+    const hasInboundKey = !!inboundHeaders['x-api-key'];
+    const hasProxyEnvCreds = !!(process.env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_AUTH_TOKEN);
+    if (!hasInboundKey && !hasProxyEnvCreds) {
+      throw Object.assign(new Error('x-api-key required'), { statusCode: 401 });
+    }
+
+    const originalModel = body && typeof body.model === 'string' ? body.model : null;
+    let chosenModel = originalModel;
+    let decisionTier = null;
+    let decisionReason = null;
+    let fallback = null;
+
+    if (enabled) {
+      try {
+        const features = extractFeatures(body);
+        const decision = pickForTurn({
+          features,
+          router_state: { history: [], pinned: null },
+          config: { default_tier: 'mid', disable: false, hard_pin_after_plan: false },
+        });
+        decisionTier = decision.tier;
+        decisionReason = decision.reason;
+        const tierModel = resolveTierModels()[decision.tier];
+        if (tierModel) chosenModel = tierModel;
+      } catch (err) {
+        fallback = 'classifier_error';
+        log.warn?.(JSON.stringify({
+          event: 'router_fallback',
+          reason: 'classifier_error',
+          original_model: originalModel,
+          would_have_been: null,
+          error: err.message,
+        }));
+      }
+
+    }
+
+    let outboundBody = body;
+    if (enabled && chosenModel && chosenModel !== originalModel) {
+      try {
+        outboundBody = rewriteModel(body, chosenModel);
+      } catch (err) {
+        fallback = fallback || 'rewrite_error';
+        log.warn?.(JSON.stringify({
+          event: 'router_fallback',
+          reason: 'rewrite_error',
+          original_model: originalModel,
+          would_have_been: chosenModel,
+          error: err.message,
+        }));
+        outboundBody = body;
+        chosenModel = originalModel;
+      }
+    }
+
+    if (enabled) {
+      log.log?.(JSON.stringify({
+        event: 'router_decision',
+        tier: decisionTier,
+        reason: decisionReason,
+        original_model: originalModel,
+        chosen_model: chosenModel,
+        escalation_skipped: false,
+        fallback,
+      }));
+    }
+
+    const upstream = await anthropicProxy('/v1/messages', outboundBody, {
+      inboundHeaders,
+    });
+
+    if (upstream.stream) {
+      const forwardHeaders = {};
+      const ct = upstream.headers && upstream.headers['content-type'];
+      if (ct) forwardHeaders['Content-Type'] = ct;
+      return {
+        status: upstream.status,
+        stream: upstream.stream,
+        headers: forwardHeaders,
+      };
+    }
+
+    // First upstream returned non-stream. If it's a 5xx on a router-rewritten
+    // request, retry once with the client's original model. This covers the
+    // common one-hub/prism case where the chosen tier model has no channel
+    // configured — a hard 503 is worse for the caller than a slightly more
+    // expensive successful response. The retry may come back streaming when
+    // the client originally sent stream:true (the first attempt errored out
+    // as JSON before any SSE flowed, so streaming the second attempt is
+    // still safe). The result-shape branch below handles both cases.
+    let finalUpstream = upstream;
+    if (
+      enabled
+      && upstream.status >= 500
+      && chosenModel
+      && chosenModel !== originalModel
+    ) {
+      log.warn?.(JSON.stringify({
+        event: 'router_fallback',
+        reason: 'upstream_5xx_retry',
+        original_model: originalModel,
+        would_have_been: chosenModel,
+        upstream_status: upstream.status,
+      }));
+      // Drain the first upstream's body before retrying. fetch Response
+      // bodies are single-read streams; if the retry succeeds, finalUpstream
+      // moves to the retry response and the original `upstream` body is
+      // never consumed, so undici keeps the underlying TCP socket pinned
+      // in the awaiting-body state. Under sustained 5xx storms from the
+      // rewritten model (the exact scenario this branch targets), every
+      // successful retry leaks one socket out of the pool.
+      //
+      // We don't need the parsed body — text() reads the full body before
+      // returning, which is enough to release the socket. If the retry
+      // throws, finalUpstream stays pointing at the (now-drained) upstream
+      // and the .text() at line 195 short-circuits on the empty Response
+      // — but that loses the original 503 body, so cache it here too and
+      // restore it on the throw path.
+      let drainedFirst = '';
+      if (upstream.text) {
+        try { drainedFirst = await upstream.text(); } catch { /* socket already gone */ }
+      }
+      try {
+        const retryBody = rewriteModel(body, originalModel);
+        finalUpstream = await anthropicProxy('/v1/messages', retryBody, {
+          inboundHeaders,
+        });
+      } catch (err) {
+        // Replay the drained first response so the caller still sees the
+        // original 503 + body, not an empty stream.
+        finalUpstream = {
+          status: upstream.status,
+          headers: upstream.headers,
+          stream: null,
+          text: () => drainedFirst,
+        };
+        log.warn?.(JSON.stringify({
+          event: 'router_fallback',
+          reason: 'upstream_5xx_retry_failed',
+          original_model: originalModel,
+          would_have_been: chosenModel,
+          error: err.message,
+        }));
+      }
+    }
+
+    if (finalUpstream.stream) {
+      const forwardHeaders = {};
+      const ct = finalUpstream.headers && finalUpstream.headers['content-type'];
+      if (ct) forwardHeaders['Content-Type'] = ct;
+      return {
+        status: finalUpstream.status,
+        stream: finalUpstream.stream,
+        headers: forwardHeaders,
+      };
+    }
+    // Upstream is normally JSON, but a misconfigured local gateway (prism
+    // without a route configured), a CDN 4xx page, or a load balancer 502
+    // can return text/plain or HTML. Read the body as text (single
+    // consumption — fetch Response bodies cannot be read twice) and parse
+    // ourselves; on parse failure, wrap the raw text in an {error} envelope
+    // so the client gets the real upstream status + a readable body
+    // instead of a 500 "Unexpected non-whitespace character".
+    // Default to {} not null: src/proxy/server/http.js wraps results as
+    // `result.body || result`, and a falsy body would serialize the entire
+    // internal {status, body} envelope to the client.
+    let respBody = {};
+    let raw = '';
+    if (finalUpstream.text) {
+      try { raw = await finalUpstream.text(); } catch { /* ignore */ }
+    }
+    if (raw.length > 0) {
+      try {
+        respBody = JSON.parse(raw);
+      } catch {
+        respBody = { error: raw };
+        log.warn?.(JSON.stringify({
+          event: 'router_fallback',
+          reason: 'upstream_non_json',
+          upstream_status: finalUpstream.status,
+          preview: raw.slice(0, 200),
+        }));
+      }
+    }
+    return { status: finalUpstream.status, body: respBody };
+  };
+}
+
+module.exports = { buildMessagesHandler, DEFAULT_TIER_MODELS, resolveTierModels };

package/src/proxy/router/model_router.js

@@ -0,0 +1,113 @@
+'use strict';
+
+// Phase C of the EvoX multi-tier router. The authoritative algorithm
+// lives in Rust at
+//   evox/crates/evox-agent-core/src/model_router.rs
+// and ships a generated JSON fixture at
+//   evox/crates/evox-agent-core/tests/fixtures/model_router_cases.json
+// A vendored copy of that fixture (test/fixtures/model_router_cases.json)
+// pins this port byte-for-byte; CI diffs against a regenerated copy so
+// silent drift turns red.
+//
+// Why a fresh module under src/proxy/router/ and not a fold into an
+// existing router-ish helper: src/proxy/ has no prior router/classifier
+// concept (mailbox/, sync/, task/, extensions/, lifecycle/ all sit at a
+// different layer). A first-class subdir is the cheapest place to grow
+// the Phase C pieces (cache_passthrough, anthropic egress) without
+// muddying the proxy core.
+
+const REASONS = Object.freeze({
+  ROUTER_DISABLED: 'router_disabled',
+  HARD_PINNED: 'hard_pinned',
+  GENE_HINT: 'gene_hint',
+  POST_TOOL_RESULT_SYNTHESIS: 'post_tool_result_synthesis',
+  USER_REQUESTED_PLANNING: 'user_requested_planning',
+  HIGH_TOOL_USE_DENSITY: 'high_tool_use_density',
+  TRIVIAL_LOOKUP: 'trivial_lookup',
+  DEFAULT_TIER: 'default_tier',
+  ESCALATED_FROM_HISTORY: 'escalated_from_history',
+});
+
+const TIER_ORDER = Object.freeze({ cheap: 0, mid: 1, expensive: 2 });
+
+function tierStepUp(tier) {
+  if (tier === 'cheap') return 'mid';
+  if (tier === 'mid') return 'expensive';
+  return 'expensive';
+}
+
+function classify(features, config) {
+  // Parity invariant with model_router.rs:340 — branch order matters.
+  // post_tool_result_synthesis must win over high_tool_use_density when
+  // both signal: the synthesis turn is just summarising tool output.
+  if (
+    features.last_user_is_tool_result_only &&
+    features.last_assistant_stop_reason === 'ToolUse'
+  ) {
+    return ['cheap', REASONS.POST_TOOL_RESULT_SYNTHESIS];
+  }
+  if (features.user_requested_planning) {
+    return ['expensive', REASONS.USER_REQUESTED_PLANNING];
+  }
+  if (features.last_assistant_tool_call_count > 3) {
+    return ['expensive', REASONS.HIGH_TOOL_USE_DENSITY];
+  }
+  if (features.user_simple_lookup) {
+    return ['cheap', REASONS.TRIVIAL_LOOKUP];
+  }
+  return [config.default_tier, REASONS.DEFAULT_TIER];
+}
+
+function maybeEscalate(base, history) {
+  // Stalled-turn signal from model_router.rs:373: the last decision
+  // produced <50 output tokens with no tool call. Bump one tier up,
+  // never above expensive, and never weaker than what classify chose.
+  if (!history || history.length === 0) return [base, null];
+  const last = history[history.length - 1];
+  const stalled = last.output_tokens < 50 && !last.had_tool_call;
+  if (!stalled) return [base, null];
+  if (last.tier === 'expensive') return [base, null];
+  const target = tierStepUp(last.tier);
+  if (TIER_ORDER[target] > TIER_ORDER[base]) {
+    return [target, last.tier];
+  }
+  return [base, null];
+}
+
+function pickForTurn(input) {
+  const { features, router_state, config } = input;
+  const geneHint = input.gene_hint;
+
+  if (config.disable) {
+    return {
+      tier: config.default_tier,
+      reason: REASONS.ROUTER_DISABLED,
+      escalated_from: null,
+    };
+  }
+  if (config.hard_pin_after_plan && router_state && router_state.pinned) {
+    return {
+      tier: router_state.pinned,
+      reason: REASONS.HARD_PINNED,
+      escalated_from: null,
+    };
+  }
+  if (geneHint) {
+    return {
+      tier: geneHint,
+      reason: REASONS.GENE_HINT,
+      escalated_from: null,
+    };
+  }
+  const [baseTier, baseReason] = classify(features, config);
+  const history = router_state ? router_state.history : [];
+  const [escalatedTier, escalatedFrom] = maybeEscalate(baseTier, history);
+  const reason = escalatedFrom !== null ? REASONS.ESCALATED_FROM_HISTORY : baseReason;
+  return {
+    tier: escalatedTier,
+    reason,
+    escalated_from: escalatedFrom,
+  };
+}
+
+module.exports = { pickForTurn, REASONS };

package/src/proxy/server/http.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const crypto = require('crypto');
 const http = require('http');
 const { writeSettings, readSettings, clearSettings, clearIfStale } = require('./settings');
 
@@ -89,10 +90,12 @@ class ProxyHttpServer {
     this.actualPort = null;
     this.logger = logger || console;
     this.server = null;
+    this.token = null;
   }
 
   async start() {
     clearIfStale();
+    this.token = crypto.randomBytes(32).toString('hex');
     this.server = http.createServer((req, res) => this._handleRequest(req, res));
 
     let port = this.basePort;
@@ -106,10 +109,11 @@ class ProxyHttpServer {
             url,
             pid: process.pid,
             started_at: new Date().toISOString(),
+            token: this.token,
           },
         });
         this.logger.log(`[proxy] HTTP server listening on ${url}`);
-        return { port, url };
+        return { port, url, token: this.token };
       }
       port++;
     }
@@ -125,6 +129,17 @@ class ProxyHttpServer {
   }
 
   async _handleRequest(req, res) {
+    const authHeader = req.headers['authorization'] || '';
+    const provided = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : '';
+    const expBuf = Buffer.from(this.token || '', 'utf8');
+    const provBuf = Buffer.from(provided, 'utf8');
+    const valid = this.token &&
+      provBuf.length === expBuf.length &&
+      crypto.timingSafeEqual(provBuf, expBuf);
+    if (!valid) {
+      return sendJson(res, 401, { error: 'Unauthorized' });
+    }
+
     const url = new URL(req.url, `http://127.0.0.1:${this.actualPort}`);
     const routeKey = `${req.method} ${url.pathname}`;
 
@@ -139,13 +154,100 @@ class ProxyHttpServer {
     try {
       const body = (req.method === 'POST' || req.method === 'PUT') ? await parseBody(req) : {};
       const query = Object.fromEntries(url.searchParams);
-      const result = await handler({ body, query, params });
-      sendJson(res, result.status || 200, result.body || result);
+      const headers = req.headers;
+      const result = await handler({ body, query, params, headers });
+      if (result && result.stream) {
+        await this._streamResponse(res, result);
+      } else {
+        sendJson(res, result.status || 200, result.body || result);
+      }
     } catch (err) {
       this.logger.error(`[proxy] ${routeKey} error:`, err.message);
-      sendJson(res, err.statusCode || 500, {
-        error: err.message || 'Internal error',
-      });
+      if (res.headersSent) {
+        try { res.end(); } catch { /* ignore */ }
+      } else {
+        sendJson(res, err.statusCode || 500, {
+          error: err.message || 'Internal error',
+        });
+      }
+    }
+  }
+
+  // SSE / pass-through streaming path used by /v1/messages (slice 5).
+  // `result.stream` may be any async iterable yielding Buffer or string
+  // chunks (Web ReadableStream from fetch, or a Node Readable). Headers
+  // default to text/event-stream so Anthropic-style SSE bytes piped
+  // through reach the client unmodified. The caller owns producing
+  // correctly-framed SSE; this method only relays bytes.
+  async _streamResponse(res, result) {
+    const headers = Object.assign({
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      'Connection': 'keep-alive',
+    }, result.headers || {});
+    res.writeHead(result.status || 200, headers);
+
+    // Browsers, network blips, and Ctrl-C all close the SSE socket mid-stream.
+    // If we await `drain` without watching for `close`, the drain event never
+    // fires on a destroyed socket and this coroutine hangs forever — which
+    // also pins the upstream fetch body open (real Anthropic socket leak, not
+    // just coroutine leak). For Web ReadableStream upstreams we read via an
+    // explicit reader so cancellation can go through the same lock; for sync
+    // generators / Node Readables we fall back to for-await.
+    const stream = result.stream;
+    const reader = stream && typeof stream.getReader === 'function' ? stream.getReader() : null;
+
+    let clientGone = false;
+    const onClose = () => {
+      clientGone = true;
+      if (reader) {
+        reader.cancel().catch(() => { /* upstream already settled */ });
+      } else if (stream && typeof stream.destroy === 'function') {
+        try { stream.destroy(); } catch { /* ignore */ }
+      }
+    };
+    res.once('close', onClose);
+
+    const awaitBackpressure = () => new Promise((resolve) => {
+      let settled = false;
+      const onDrain = () => {
+        if (settled) return;
+        settled = true;
+        res.off('close', onCloseInner);
+        resolve();
+      };
+      const onCloseInner = () => {
+        if (settled) return;
+        settled = true;
+        res.off('drain', onDrain);
+        resolve();
+      };
+      res.once('drain', onDrain);
+      res.once('close', onCloseInner);
+    });
+
+    try {
+      if (reader) {
+        for (;;) {
+          const { value, done } = await reader.read();
+          if (done || clientGone) break;
+          if (!res.write(value)) {
+            await awaitBackpressure();
+            if (clientGone) break;
+          }
+        }
+      } else {
+        for await (const chunk of stream) {
+          if (clientGone) break;
+          if (!res.write(chunk)) {
+            await awaitBackpressure();
+            if (clientGone) break;
+          }
+        }
+      }
+    } finally {
+      res.off('close', onClose);
+      try { res.end(); } catch { /* socket may already be destroyed */ }
     }
   }
 

package/src/proxy/server/routes.js

@@ -3,8 +3,8 @@
 const { PROXY_PROTOCOL_VERSION, SCHEMA_VERSION } = require('../mailbox/store');
 
 function buildRoutes(store, proxyHandlers, taskMonitor, extensions) {
-  const { dmHandler, skillUpdater, getHubMailboxStatus, sessionHandler } = extensions || {};
-  return {
+  const { dmHandler, skillUpdater, getHubMailboxStatus, sessionHandler, messagesHandler } = extensions || {};
+  const routes = {
     // -- Mailbox --
     'POST /mailbox/send': async ({ body }) => {
       if (!body.type) throw Object.assign(new Error('type is required'), { statusCode: 400 });
@@ -458,6 +458,16 @@ function buildRoutes(store, proxyHandlers, taskMonitor, extensions) {
       return { body: result };
     },
   };
+
+  // Phase C: only register /v1/messages when the proxy was built with a
+  // messages handler (i.e. _proxyAnthropic is available). Slice 5 wires it
+  // unconditionally so the route exists on every proxy startup; slice 6 adds
+  // EVOMAP_ROUTER_ENABLED behavior inside the handler.
+  if (messagesHandler) {
+    routes['POST /v1/messages'] = messagesHandler;
+  }
+
+  return routes;
 }
 
 module.exports = { buildRoutes };

package/src/proxy/server/settings.js

@@ -4,34 +4,52 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-const SETTINGS_DIR = path.join(os.homedir(), '.evolver');
-const SETTINGS_FILE = path.join(SETTINGS_DIR, 'settings.json');
+// Settings paths are resolved on every call rather than snapshotted at module
+// load. Tests run in parallel by default (`node --test`); when multiple test
+// files exercise the proxy server, each one starting writes
+// `~/.evolver/settings.json` and the sibling webui observer would read those
+// bytes back and report mode='proxy_only' instead of the expected 'idle'.
+// Lazy resolution lets a test set EVOLVER_SETTINGS_DIR to a temp dir before
+// calling start()/readSettings() and stay isolated from concurrent workers.
+function getSettingsDir() {
+  return process.env.EVOLVER_SETTINGS_DIR || path.join(os.homedir(), '.evolver');
+}
+
+function getSettingsFile() {
+  return path.join(getSettingsDir(), 'settings.json');
+}
 
 function readSettings() {
   try {
-    if (fs.existsSync(SETTINGS_FILE)) {
-      return JSON.parse(fs.readFileSync(SETTINGS_FILE, 'utf8'));
+    const file = getSettingsFile();
+    if (fs.existsSync(file)) {
+      return JSON.parse(fs.readFileSync(file, 'utf8'));
     }
   } catch {}
   return {};
 }
 
 function writeSettings(data) {
-  if (!fs.existsSync(SETTINGS_DIR)) {
-    fs.mkdirSync(SETTINGS_DIR, { recursive: true });
+  const dir = getSettingsDir();
+  const file = getSettingsFile();
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
   }
   const current = readSettings();
   const merged = { ...current, ...data };
-  fs.writeFileSync(SETTINGS_FILE, JSON.stringify(merged, null, 2), 'utf8');
+  fs.writeFileSync(file, JSON.stringify(merged, null, 2), { encoding: 'utf8', mode: 0o600 });
+  // mode: 0o600 only applies on creation; explicitly chmod to tighten pre-existing files
+  try { fs.chmodSync(file, 0o600); } catch {}
   return merged;
 }
 
 function clearSettings() {
   try {
-    if (fs.existsSync(SETTINGS_FILE)) {
+    const file = getSettingsFile();
+    if (fs.existsSync(file)) {
       const current = readSettings();
       delete current.proxy;
-      fs.writeFileSync(SETTINGS_FILE, JSON.stringify(current, null, 2), 'utf8');
+      fs.writeFileSync(file, JSON.stringify(current, null, 2), 'utf8');
     }
   } catch {}
 }
@@ -61,4 +79,19 @@ function getProxyUrl() {
   return settings.proxy?.url || null;
 }
 
-module.exports = { readSettings, writeSettings, clearSettings, clearIfStale, isStaleProxy, getProxyUrl, SETTINGS_DIR, SETTINGS_FILE };
+function getProxyToken() {
+  const settings = readSettings();
+  return settings.proxy?.token || null;
+}
+
+module.exports = {
+  readSettings,
+  writeSettings,
+  clearSettings,
+  clearIfStale,
+  isStaleProxy,
+  getProxyUrl,
+  getProxyToken,
+  getSettingsDir,
+  getSettingsFile,
+};

package/src/proxy/sync/inbound.js

@@ -2,6 +2,7 @@
 
 const { PROXY_PROTOCOL_VERSION } = require('../mailbox/store');
 const { AuthError } = require('../lifecycle/manager');
+const { hubFetch } = require('../../gep/hubFetch');
 
 const DEFAULT_POLL_INTERVAL_ACTIVE = 10_000;
 const DEFAULT_POLL_INTERVAL_IDLE = 60_000;
@@ -22,7 +23,7 @@ class InboundSync {
 
     try {
       const senderId = this.store.getState('node_id');
-      const res = await fetch(endpoint, {
+      const res = await hubFetch(endpoint, {
         method: 'POST',
         headers: this.getHeaders(),
         body: JSON.stringify({ sender_id: senderId, proxy_protocol_version: PROXY_PROTOCOL_VERSION, cursor, limit }),
@@ -82,7 +83,7 @@ class InboundSync {
 
     try {
       const senderId = this.store.getState('node_id');
-      await fetch(endpoint, {
+      await hubFetch(endpoint, {
         method: 'POST',
         headers: this.getHeaders(),
         body: JSON.stringify({ sender_id: senderId, message_ids: delivered.map(m => m.id) }),

package/src/proxy/sync/outbound.js

@@ -2,6 +2,7 @@
 
 const { PROXY_PROTOCOL_VERSION } = require('../mailbox/store');
 const { AuthError } = require('../lifecycle/manager');
+const { hubFetch } = require('../../gep/hubFetch');
 
 const MAX_BATCH = 50;
 const MAX_RETRIES = 10;
@@ -22,7 +23,7 @@ class OutboundSync {
 
     try {
       const senderId = this.store.getState('node_id');
-      const res = await fetch(endpoint, {
+      const res = await hubFetch(endpoint, {
         method: 'POST',
         headers: this.getHeaders(),
         body: JSON.stringify({