@iislee/opencodex 2.11.0 → 2.31.0

package/src/server/live.ts

@@ -19,24 +19,34 @@
  * - `GET /v1/live/{callId}` — Frameless
  * - `GET /v1/realtime/calls/{callId}` — path-form join
  * - `GET /v1/realtime?call_id=` — Realtime v1/v2 join
+ *
+ * Inbound standalone session WebSocket (no call-create; codex-rs `thread/realtime/start`
+ * with the standalone WebSocket transport — the desktop voice path since 0.147.x):
+ * - `GET /v1/realtime?intent=quicksilver&model=` — Realtime v1 standalone
+ * - `GET /v1/realtime?model=` — RealtimeV2 standalone (no intent)
+ * - `GET /v1/live?model=` — Frameless standalone
  */
 import { appendFileSync } from "node:fs";
 import { formatErrorResponse } from "../bridge";
 import {
   CodexAccountCooldownError,
+  codexMainProfileDrainingResponse,
   cooldownErrorResponse,
   CodexAuthContextError,
+  CodexMainProfileDrainingError,
   CodexPoolAuthenticationError,
   CodexThreadAffinityExpiredError,
 } from "../codex/auth-context";
 import { formatCodexProviderForLog } from "../codex/routing";
-import { signalWithTimeout } from "../lib/abort";
+import { cancelBodyOnAbort, signalWithTimeout } from "../lib/abort";
 import { sidecarEnter } from "../lib/sidecar-tracker";
 import type { OcxConfig } from "../types";
 import { resolveFirstUsableOpenAiSidecar, selectOpenAiImagesProvider } from "../providers/openai-sidecar";
 import { ForwardAdmissionCredentialError, validateForwardAdmissionCredential } from "./auth-cors";
 import type { RequestLogContext } from "./request-log";
 import { codexLogAccountId } from "./responses";
+import type { AdmissionLease } from "../lib/admission";
+import { codexAccountSelectionForTurn } from "./lifecycle";
 
 /** Voice call create can wait on SDP negotiation; bound a hung upstream. */
 const LIVE_UPSTREAM_TIMEOUT_MS = 120_000;
@@ -137,10 +147,59 @@ function clientProtocolHeaders(reqHeaders: Headers): Record<string, string> {
 
 const LIVE_CALL_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
 
+/**
+ * Credential-shaped query keys never forwarded upstream on a standalone realtime
+ * relay. Auth on the upstream socket is proxy-owned (headers resolved by
+ * `resolveLiveRelay`); a caller that puts `access_token=`/`api_key=`/... in the
+ * URL must not get it relayed to the configured upstream. Compared case-folded on
+ * both the raw and percent-decoded key. Everything else — `intent`, `model`,
+ * duplicates, protocol extensions — passes through verbatim, matching codex-rs
+ * client behavior of constructing those fields itself.
+ */
+const STANDALONE_QUERY_DENYLIST = new Set([
+  "access_token",
+  "api_key",
+  "apikey",
+  "token",
+  "key",
+  "authorization",
+  "auth",
+  "signature",
+  "sig",
+]);
+
+/**
+ * Filter a raw query string (no leading `?`) for standalone upstream relay: drop
+ * denylisted credential-shaped pairs, preserve the rest byte-for-byte (including
+ * ordering, duplicates, noncanonical encodings, and bare keys).
+ */
+export function sanitizeStandaloneRealtimeQuery(rawQuery: string): string {
+  if (!rawQuery) return "";
+  const kept: string[] = [];
+  for (const pair of rawQuery.split("&")) {
+    const eq = pair.indexOf("=");
+    const rawKey = eq === -1 ? pair : pair.slice(0, eq);
+    let decodedKey = rawKey;
+    try {
+      decodedKey = decodeURIComponent(rawKey);
+    } catch {
+      // Leave undecodable keys as-is; the raw comparison still applies.
+    }
+    if (STANDALONE_QUERY_DENYLIST.has(rawKey.toLowerCase()) || STANDALONE_QUERY_DENYLIST.has(decodedKey.toLowerCase())) {
+      console.warn(`[live] standalone realtime relay dropping credential-shaped query param: ${decodedKey}`);
+      continue;
+    }
+    kept.push(pair);
+  }
+  return kept.join("&");
+}
+
 export type LiveSidebandTarget =
   | { style: "frameless-path"; callId: string }
   | { style: "realtime-calls-path"; callId: string }
-  | { style: "realtime-query"; callId: string };
+  | { style: "realtime-query"; callId: string }
+  | { style: "realtime-standalone"; query: string }
+  | { style: "frameless-standalone"; query: string };
 
 export type LiveRelayTarget = {
   headers: Record<string, string>;
@@ -164,7 +223,7 @@ export function keyedLiveUrl(baseUrl: string): string {
 }
 
 export function forwardLiveUrl(baseUrl: string, usesBackendShape: boolean): string {
-  const root = baseUrl.replace(/\/$/, "");
+  const root = baseUrl.replace(/\/+$/, "");
   if (usesBackendShape) return withAvasQuery(`${root}/realtime/calls`);
   // Frameless API shape posts to /live without the AVAS query (codex RealtimeCallClient).
   return `${root}/live`;
@@ -176,13 +235,17 @@ function httpsToWss(httpUrl: string): string {
   return httpUrl;
 }
 
-export function parseLiveSidebandTarget(pathname: string, searchParams: URLSearchParams): LiveSidebandTarget | null {
+export function parseLiveSidebandTarget(pathname: string, searchParams: URLSearchParams, rawQuery = ""): LiveSidebandTarget | null {
   const liveMatch = pathname.match(/^\/v1\/live\/([^/]+)\/?$/);
   if (liveMatch) {
     const callId = decodeURIComponent(liveMatch[1]!);
     if (!LIVE_CALL_ID_RE.test(callId)) return null;
     return { style: "frameless-path", callId };
   }
+  // Standalone Frameless session (no call-create): `GET /v1/live?model=`.
+  if (pathname === "/v1/live" || pathname === "/v1/live/") {
+    return { style: "frameless-standalone", query: sanitizeStandaloneRealtimeQuery(rawQuery) };
+  }
   const callsMatch = pathname.match(/^\/v1\/realtime\/calls\/([^/]+)\/?$/);
   if (callsMatch) {
     const callId = decodeURIComponent(callsMatch[1]!);
@@ -190,9 +253,17 @@ export function parseLiveSidebandTarget(pathname: string, searchParams: URLSearc
     return { style: "realtime-calls-path", callId };
   }
   if (pathname === "/v1/realtime" || pathname === "/v1/realtime/") {
-    const callId = searchParams.get("call_id")?.trim() ?? "";
-    if (!LIVE_CALL_ID_RE.test(callId)) return null;
-    return { style: "realtime-query", callId };
+    // A present-but-invalid `call_id` is a malformed join, not a standalone
+    // session — keep rejecting it instead of silently changing the request's
+    // meaning.
+    if (searchParams.has("call_id")) {
+      const callId = searchParams.get("call_id")?.trim() ?? "";
+      if (!LIVE_CALL_ID_RE.test(callId)) return null;
+      return { style: "realtime-query", callId };
+    }
+    // Standalone Realtime session (codex-rs thread/realtime/start, WebSocket
+    // transport): v1 sends `intent=quicksilver&model=`, v2 sends `model=` only.
+    return { style: "realtime-standalone", query: sanitizeStandaloneRealtimeQuery(rawQuery) };
   }
   return null;
 }
@@ -203,8 +274,12 @@ export function parseLiveSidebandTarget(pathname: string, searchParams: URLSearc
  */
 function isLoopbackHost(hostname: string): boolean {
   const lower = hostname.toLowerCase();
+  const ipv4 = lower.split(".");
+  const ipv4Loopback = ipv4.length === 4
+    && ipv4[0] === "127"
+    && ipv4.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255);
   return lower === "localhost" || lower.endsWith(".localhost")
-    || lower === "127.0.0.1" || lower.startsWith("127.")
+    || ipv4Loopback
     || lower === "::1" || lower === "[::1]";
 }
 
@@ -278,6 +353,12 @@ export function buildLiveSidebandUpstreamWsUrl(
   if (target.style === "frameless-path") {
     return httpsToWss(`${sidebandRoot}/live/${target.callId}`);
   }
+  if (target.style === "frameless-standalone") {
+    return httpsToWss(`${sidebandRoot}/live${target.query ? `?${target.query}` : ""}`);
+  }
+  if (target.style === "realtime-standalone") {
+    return httpsToWss(`${sidebandRoot}/realtime${target.query ? `?${target.query}` : ""}`);
+  }
   if (target.style === "realtime-calls-path") {
     return httpsToWss(`${sidebandRoot}/realtime/calls/${target.callId}`);
   }
@@ -356,8 +437,18 @@ export async function readBodyCapped(
       }
       chunks.push(value);
     }
+  } catch (err) {
+    // A read that throws leaves the stream neither drained nor cancelled, and releasing the
+    // lock alone hands back an unsettled body. Cancel first, then rethrow so the caller's
+    // existing classification (client abort / timeout / connect error) is unchanged. The
+    // cancel itself can reject with the stream's stored error — that is expected and must not
+    // mask the original failure, so it is swallowed here.
+    await reader.cancel(err).catch(() => {});
+    throw err;
   } finally {
     try {
+      // Always release: `reader.cancel()` does NOT drop the lock, and holding it would leave
+      // the stream permanently locked for any later consumer (audit R-WP5-2).
       reader.releaseLock();
     } catch {
       // already released / cancelled
@@ -409,6 +500,7 @@ export async function resolveLiveRelay(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<LiveRelayTarget | Response> {
   try {
     validateForwardAdmissionCredential(req.headers, config);
@@ -433,7 +525,9 @@ export async function resolveLiveRelay(
   let forwardAuthError: Response | undefined;
   if (candidates.forwardCandidates.length > 0) {
     try {
-      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config);
+      forward = await resolveFirstUsableOpenAiSidecar(candidates.forwardCandidates, req.headers, config, {
+        beginCodexAccountSelection: codexAccountSelectionForTurn(turnAdmissionLease),
+      });
       if (forward) {
         logCtx.provider = formatCodexProviderForLog(
           forward.providerName,
@@ -444,6 +538,8 @@ export async function resolveLiveRelay(
     } catch (err) {
       if (err instanceof CodexAccountCooldownError) {
         forwardAuthError = cooldownErrorResponse(err);
+      } else if (err instanceof CodexMainProfileDrainingError) {
+        forwardAuthError = codexMainProfileDrainingResponse();
       } else if (err instanceof CodexThreadAffinityExpiredError) {
         forwardAuthError = formatErrorResponse(
           409,
@@ -506,13 +602,14 @@ export async function handleLive(
   req: Request,
   config: OcxConfig,
   logCtx: RequestLogContext,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<Response> {
   const inboundContentType = req.headers.get("content-type") ?? "application/octet-stream";
   const inboundBodyOrError = await readRequestBodyCapped(req, LIVE_REQUEST_MAX_BYTES);
   if (inboundBodyOrError instanceof Response) return inboundBodyOrError;
   const inboundBody = inboundBodyOrError;
 
-  const relay = await resolveLiveRelay(req, config, logCtx);
+  const relay = await resolveLiveRelay(req, config, logCtx, turnAdmissionLease);
   if (relay instanceof Response) return relay;
 
   const headers: Record<string, string> = { ...relay.headers };
@@ -532,7 +629,12 @@ export async function handleLive(
       outboundContentType = rewritten.contentType;
     }
   } else {
-    url = keyedLiveUrl(relay.providerBaseUrl);
+    // Frameless API-shape call-create posts to `{base}/live` without the AVAS
+    // query (openai/codex RealtimeCallClient, realtime_call.rs); only the
+    // realtime/calls inbound shape keeps the legacy keyed AVAS endpoint.
+    url = new URL(req.url).pathname === "/v1/live"
+      ? forwardLiveUrl(relay.providerBaseUrl, /* usesBackendShape */ false)
+      : keyedLiveUrl(relay.providerBaseUrl);
   }
 
   headers["content-type"] = outboundContentType;
@@ -545,15 +647,31 @@ export async function handleLive(
       headers,
       body: outboundBody,
       signal: linkedSignal.signal,
+      // Credential-bearing: do not follow a cross-origin 3xx. Bun strips `Authorization`
+      // across origins but forwards nonstandard headers such as `chatgpt-account-id`,
+      // `session_id`, and `x-codex-turn-metadata` to the redirect target.
+      redirect: "manual",
     });
     // Record every completed upstream response before body size handling so account health /
     // cooldown still updates when we reject an oversized payload.
     relay.recordOutcome?.(upstreamResponse.status);
-    const payload = await readBodyCapped(
-      upstreamResponse.body,
-      LIVE_RESPONSE_MAX_BYTES,
-      total => `live response too large (${total} bytes)`,
-    );
+    // Settle the body on abort before the reader attaches. Without this, a client cancel or the
+    // linked timeout landing between fetch resolution and `readBodyCapped`'s `getReader()`
+    // leaves Bun's internal read rejection orphaned off the awaited path, where no caller
+    // try/catch can intercept it (src/lib/abort.ts). The guard covers the window BEFORE the
+    // reader exists; once a reader holds the lock only the reader can cancel, which is why
+    // readBodyCapped also cancels on a failed read. Found while investigating #1419.
+    const detachBodyGuard = cancelBodyOnAbort(upstreamResponse.body, linkedSignal.signal);
+    let payload: ArrayBuffer | Response;
+    try {
+      payload = await readBodyCapped(
+        upstreamResponse.body,
+        LIVE_RESPONSE_MAX_BYTES,
+        total => `live response too large (${total} bytes)`,
+      );
+    } finally {
+      detachBodyGuard();
+    }
     if (payload instanceof Response) return payload;
     const relayHeaders: Record<string, string> = {};
     for (const name of LIVE_RELAY_HEADERS) {
@@ -587,8 +705,9 @@ export async function resolveLiveSidebandUpgrade(
   config: OcxConfig,
   logCtx: RequestLogContext,
   target: LiveSidebandTarget,
+  turnAdmissionLease?: AdmissionLease,
 ): Promise<{ headers: Record<string, string>; upstreamWsUrl: string; recordOutcome?: LiveRelayTarget["recordOutcome"] } | Response> {
-  const relay = await resolveLiveRelay(req, config, logCtx);
+  const relay = await resolveLiveRelay(req, config, logCtx, turnAdmissionLease);
   if (relay instanceof Response) return relay;
   return {
     headers: relay.headers,

package/src/server/local-management-read-client.ts

@@ -0,0 +1,90 @@
+import { readRuntimePort, type RuntimePortState } from "../config";
+import { createLocalAttestationChallenge } from "../lib/local-management-attestation";
+import {
+  LOCAL_MANAGEMENT_CAPABILITY_HEADER,
+  LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER,
+  LOCAL_MANAGEMENT_CAPABILITY_TTL_MS,
+  LOCAL_MANAGEMENT_EXPECTED_PID_HEADER,
+  LOCAL_MANAGEMENT_NONCE_HEADER,
+  createLocalManagementReadCapability,
+  type LocalManagementReadPath,
+} from "../lib/local-management-capability";
+import { directLocalHttpFetch } from "./direct-local-http";
+import { probeHostname, type LiveProxy } from "./proxy-liveness";
+
+export type LocalManagementReadResult =
+  | { kind: "response"; response: Response; targetPid: number }
+  | { kind: "unavailable"; reason: "unattested-target" | "runtime-mismatch" | "capability-unavailable" | "transport" };
+
+export interface LocalManagementReadDeps {
+  fetchImpl?: typeof fetch;
+  readRuntime?: (pid: number) => RuntimePortState | null;
+  createNonce?: () => string;
+  now?: () => number;
+}
+
+export interface LocalManagementReadRequestDeps extends LocalManagementReadDeps {
+  timeoutMs?: number;
+}
+
+/**
+ * Read one exact local management endpoint without sending a reusable admin credential.
+ *
+ * The runtime record is the protected source of the per-process key. The server proves
+ * it owns that key by accepting a single-use capability bound to this GET, path, PID,
+ * port, and short expiry.
+ */
+export async function fetchBoundLocalManagementRead(
+  target: LiveProxy,
+  path: LocalManagementReadPath,
+  deps: LocalManagementReadRequestDeps = {},
+): Promise<LocalManagementReadResult> {
+  if (
+    target.source !== "runtime"
+    || target.pid === null
+    || !Number.isSafeInteger(target.pid)
+    || target.pid <= 0
+  ) {
+    return { kind: "unavailable", reason: "unattested-target" };
+  }
+  const readRuntime = deps.readRuntime ?? readRuntimePort;
+  const runtime = readRuntime(target.pid);
+  if (
+    !runtime?.attestationSecret
+    || runtime.pid !== target.pid
+    || runtime.port !== target.port
+  ) {
+    return { kind: "unavailable", reason: "runtime-mismatch" };
+  }
+
+  const nonce = (deps.createNonce ?? createLocalAttestationChallenge)();
+  const expiresAt = (deps.now ?? Date.now)() + LOCAL_MANAGEMENT_CAPABILITY_TTL_MS;
+  const capability = createLocalManagementReadCapability(
+    runtime.attestationSecret,
+    nonce,
+    "GET",
+    path,
+    target.pid,
+    target.port,
+    expiresAt,
+  );
+  if (!capability) return { kind: "unavailable", reason: "capability-unavailable" };
+
+  try {
+    const response = await (deps.fetchImpl ?? directLocalHttpFetch)(
+      `http://${probeHostname(target.hostname)}:${target.port}${path}`,
+      {
+        headers: {
+          [LOCAL_MANAGEMENT_EXPECTED_PID_HEADER]: String(target.pid),
+          [LOCAL_MANAGEMENT_NONCE_HEADER]: nonce,
+          [LOCAL_MANAGEMENT_CAPABILITY_EXPIRES_AT_HEADER]: String(expiresAt),
+          [LOCAL_MANAGEMENT_CAPABILITY_HEADER]: capability,
+        },
+        signal: AbortSignal.timeout(deps.timeoutMs ?? 4_000),
+      },
+    );
+    return { kind: "response", response, targetPid: target.pid };
+  } catch {
+    return { kind: "unavailable", reason: "transport" };
+  }
+}

package/src/server/local-provider-reload-client.ts

@@ -0,0 +1,137 @@
+import { readRuntimePort, type RuntimePortState } from "../config";
+import {
+  LOCAL_ATTESTATION_CHALLENGE_HEADER,
+  LOCAL_ATTESTATION_PROOF_HEADER,
+  createLocalAttestationChallenge,
+  verifyLocalAttestationProof,
+} from "../lib/local-management-attestation";
+import {
+  LOCAL_PROVIDER_RELOAD_CAPABILITY_HEADER,
+  LOCAL_PROVIDER_RELOAD_CAPABILITY_TTL_MS,
+  LOCAL_PROVIDER_RELOAD_CAPABILITY_VERSION,
+  LOCAL_PROVIDER_RELOAD_EXPECTED_PID_HEADER,
+  LOCAL_PROVIDER_RELOAD_EXPIRES_AT_HEADER,
+  LOCAL_PROVIDER_RELOAD_METHOD,
+  LOCAL_PROVIDER_RELOAD_NAME_HEADER,
+  LOCAL_PROVIDER_RELOAD_NONCE_HEADER,
+  LOCAL_PROVIDER_RELOAD_PATH,
+  createLocalProviderReloadCapability,
+  isLocalProviderReloadName,
+} from "../lib/local-provider-reload-contract";
+import { directLocalHttpFetch } from "./direct-local-http";
+import { isOpencodexHealthz, probeHostname, type HealthzIdentity, type LiveProxy } from "./proxy-liveness";
+
+export type LocalProviderReloadResult =
+  | { kind: "reloaded" }
+  | { kind: "unavailable"; reason: "invalid-name" | "unattested-target" | "runtime-mismatch" | "attestation" | "capability" | "transport" | "rejected" };
+
+export interface LocalProviderReloadDeps {
+  fetchImpl?: typeof fetch;
+  readRuntime?: (pid: number) => RuntimePortState | null;
+  createNonce?: () => string;
+  now?: () => number;
+  timeoutMs?: number;
+}
+
+const LOCAL_PROVIDER_RELOAD_TIMEOUT_MS = 10_000;
+
+/**
+ * Ask the exact runtime proxy to reload one already-persisted provider.
+ *
+ * No provider object, API key, OAuth token, custom header, or reusable management
+ * credential crosses the socket. The request is bodyless and its one-shot capability
+ * binds the provider name to the attested process, method, path, PID, port, and expiry.
+ */
+export async function requestBoundLocalProviderReload(
+  target: LiveProxy,
+  name: string,
+  deps: LocalProviderReloadDeps = {},
+): Promise<LocalProviderReloadResult> {
+  if (!isLocalProviderReloadName(name)) return { kind: "unavailable", reason: "invalid-name" };
+  if (target.source !== "runtime" || target.pid === null || target.pid <= 0) {
+    return { kind: "unavailable", reason: "unattested-target" };
+  }
+  const readRuntime = deps.readRuntime ?? readRuntimePort;
+  const runtime = readRuntime(target.pid);
+  if (
+    !runtime?.attestationSecret
+    || runtime.pid !== target.pid
+    || runtime.port !== target.port
+  ) {
+    return { kind: "unavailable", reason: "runtime-mismatch" };
+  }
+
+  const fetchImpl = deps.fetchImpl ?? directLocalHttpFetch;
+  const timeoutMs = deps.timeoutMs ?? LOCAL_PROVIDER_RELOAD_TIMEOUT_MS;
+  const nonce = (deps.createNonce ?? createLocalAttestationChallenge)();
+  const baseUrl = `http://${probeHostname(target.hostname)}:${target.port}`;
+  let proofResponse: Response;
+  try {
+    proofResponse = await fetchImpl(`${baseUrl}/healthz`, {
+      headers: { [LOCAL_ATTESTATION_CHALLENGE_HEADER]: nonce },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch {
+    return { kind: "unavailable", reason: "transport" };
+  }
+  const body = await proofResponse.json().catch(() => null) as HealthzIdentity | null;
+  if (
+    !proofResponse.ok
+    || !isOpencodexHealthz(body)
+    || body?.pid !== target.pid
+    || body?.port !== target.port
+    || body?.providerReloadCapability !== LOCAL_PROVIDER_RELOAD_CAPABILITY_VERSION
+    || !verifyLocalAttestationProof(
+      runtime.attestationSecret,
+      nonce,
+      target.pid,
+      target.port,
+      proofResponse.headers.get(LOCAL_ATTESTATION_PROOF_HEADER),
+    )
+  ) {
+    return { kind: "unavailable", reason: "attestation" };
+  }
+
+  const currentRuntime = readRuntime(target.pid);
+  if (
+    !currentRuntime?.attestationSecret
+    || currentRuntime.pid !== runtime.pid
+    || currentRuntime.port !== runtime.port
+    || currentRuntime.hostname !== runtime.hostname
+    || currentRuntime.attestationSecret !== runtime.attestationSecret
+  ) {
+    return { kind: "unavailable", reason: "runtime-mismatch" };
+  }
+
+  const expiresAt = (deps.now ?? Date.now)() + LOCAL_PROVIDER_RELOAD_CAPABILITY_TTL_MS;
+  const capability = createLocalProviderReloadCapability(
+    runtime.attestationSecret,
+    nonce,
+    LOCAL_PROVIDER_RELOAD_METHOD,
+    LOCAL_PROVIDER_RELOAD_PATH,
+    name,
+    target.pid,
+    target.port,
+    expiresAt,
+  );
+  if (!capability) return { kind: "unavailable", reason: "capability" };
+
+  try {
+    const response = await fetchImpl(`${baseUrl}${LOCAL_PROVIDER_RELOAD_PATH}`, {
+      method: LOCAL_PROVIDER_RELOAD_METHOD,
+      headers: {
+        [LOCAL_PROVIDER_RELOAD_EXPECTED_PID_HEADER]: String(target.pid),
+        [LOCAL_PROVIDER_RELOAD_NONCE_HEADER]: nonce,
+        [LOCAL_PROVIDER_RELOAD_EXPIRES_AT_HEADER]: String(expiresAt),
+        [LOCAL_PROVIDER_RELOAD_NAME_HEADER]: name,
+        [LOCAL_PROVIDER_RELOAD_CAPABILITY_HEADER]: capability,
+      },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    return response.ok
+      ? { kind: "reloaded" }
+      : { kind: "unavailable", reason: "rejected" };
+  } catch {
+    return { kind: "unavailable", reason: "transport" };
+  }
+}