@ixo/oracle-runtime-workers 0.13.0 → 0.15.0

package/src/index.ts

@@ -16,6 +16,7 @@
 import {
   createRuntimeCore,
   listModels,
+  type DecisionAdapter,
   type RuntimeCoreOptions,
   type RuntimeCore,
 } from './core';
@@ -27,8 +28,17 @@ import {
   type OracleWorkerHooks,
 } from './do/user-oracle-do';
 import { MatrixGatewayDO } from './matrix/gateway-do';
-import { createShell, gateway, type PluginRoute } from './shell/app';
+import {
+  createShell,
+  gateway,
+  type ListModelsOptions,
+  type PluginRoute,
+} from './shell/app';
 import type { RouteExclusion } from './shell/auth';
+import { artifactSweepIntervalMs } from './artifacts/config';
+import { sweepExpiredArtifacts } from './artifacts/sweep';
+import { feedbackConfigFromEnv } from './feedback/config';
+import { LinearFeedbackSink } from './feedback/linear-sink';
 
 export * from './plugin-api';
 export * from './plugins';
@@ -46,7 +56,7 @@ export {
   createUserOracleDO,
   type OracleWorkerHooks,
 } from './do/user-oracle-do';
-export { createShell } from './shell/app';
+export { createShell, type ListModelsOptions } from './shell/app';
 export { authenticate } from './shell/auth';
 export {
   createRuntimeCore,
@@ -62,6 +72,64 @@ export {
   type RuntimeCore,
   type RuntimeCoreOptions,
 } from './core';
+// --- bounded semantic decisions --------------------------------------------
+// `defineDecision` and the plugin-facing types come with `./plugin-api` above.
+export {
+  AmbiguousDecisionProviderError,
+  CloudflareJevDecisionAdapter,
+  DECISION_PROVIDERS,
+  DecisionNotApplicableError,
+  DecisionProviderNotFoundError,
+  DecisionProviderRegistry,
+  DecisionProviderRouter,
+  DecisionProviderUnavailableError,
+  DecisionRegistry,
+  DecisionRuntime,
+  HOST_DECISION_PROVIDER_ID,
+  JevDecisionError,
+  OpenRouterJevDecisionAdapter,
+  StaleDecisionSubjectError,
+  UNAVAILABLE_DECISION_EVALUATOR,
+  WorkersAiJevDecisionAdapter,
+  assertFinalDecisionSubjectUnchanged,
+  canonicalizeFinalDecisionSubject,
+  createDecisionAuthorityReceipt,
+  createDecisionExecutionReceipt,
+  decisionProviderEnvShape,
+  digestFinalDecisionSubject,
+  measureDecisionQuestionIsolation,
+  resolveDecisionAdapter,
+  type CloudflareJevAdapterOptions,
+  type DecisionApplicability,
+  type DecisionAuthorityReceipt,
+  type DecisionCalibrationProvenance,
+  type DecisionEvaluator,
+  type DecisionExecution,
+  type DecisionExecutionReceipt,
+  type DecisionJudgmentMethod,
+  type DecisionJudgmentProvenance,
+  type DecisionLookup,
+  type DecisionProviderConfigIssue,
+  type DecisionProviderName,
+  type DecisionProviderPolicy,
+  type DecisionProviderProvenance,
+  type DecisionProviderRegistration,
+  type DecisionProviderResolution,
+  type DecisionProviderSelection,
+  type DecisionQuestionIsolationObservation,
+  type DecisionQuestionIsolationReport,
+  type DecisionRuntimeLogger,
+  type FinalDecisionSubject,
+  type FinalDecisionSubjectBinding,
+  type FinalDecisionSubjectValue,
+  type JevProviderName,
+  type OpenRouterJevAdapterOptions,
+  type RegisteredDecision,
+  type ResolveDecisionAdapterOptions,
+  type ResolveDecisionAdapterResult,
+  type WorkersAiBinding,
+  type WorkersAiJevAdapterOptions,
+} from './core';
 export {
   NEBIUS_BASE_URL,
   NEBIUS_MODEL_MAP,
@@ -74,6 +142,12 @@ export {
   type ResolveLangsmithTracingArgs,
 } from './core/llm';
 
+// --- task adapters -----------------------------------------------------------
+export {
+  agentWakeFromTaskRecord,
+  portableWorkFromTaskRecord,
+} from './tasks/spec';
+
 // --- per-room JWE secrets ---------------------------------------------------
 export { decryptJwe, encryptJwe, parseJwk, type JWK } from './secrets/jwe';
 export { decryptWithPin } from './secrets/pin-cipher';
@@ -107,9 +181,16 @@ export {
   type WorkersByoServiceOptions,
 } from './llm/byo-service';
 export { handleByoRequest } from './llm/byo-routes';
+export {
+  ByoModelFallbackChatModel,
+  ByoModelFallbackState,
+  type ByoModelFallbackFields,
+} from './llm/byo-model-fallback';
 export {
   BYO_FALLBACK_KIND,
   buildByoFallbackNotice,
+  isModelUnavailableError,
+  type ByoFallbackNoticeOptions,
   type ByoFallbackNoticePayload,
   type ByoFallbackReason,
 } from './llm/provider-error';
@@ -145,15 +226,39 @@ export interface CreateOracleWorkerOptions {
    * the merged manifest is validated like an authored one.
    */
   manifestOverrides?: RuntimeCoreOptions['manifestOverrides'];
+  /**
+   * Single host-supplied Decision adapter, registered as provider `host`.
+   * Wins over the `DECISION_PROVIDER` env configuration; without any
+   * provider, every `ctx.decisions` call rejects as unavailable. Mutually
+   * exclusive with `decisionProviders`.
+   */
+  decisionAdapter?: DecisionAdapter;
+  /**
+   * Host-configured Decision providers, registered beside the env-selected
+   * one (id = the `DECISION_PROVIDER` value). Adapters are built once per
+   * oracle, outside any `env`; a provider that needs a Worker binding comes
+   * from `DECISION_PROVIDER`.
+   */
+  decisionProviders?: RuntimeCoreOptions['decisionProviders'];
+  /**
+   * Default and exact per-Decision routes over the registered providers. The
+   * env-selected provider is the default unless this names another.
+   */
+  decisionProviderPolicy?: RuntimeCoreOptions['decisionProviderPolicy'];
   /** Extra host routes mounted on the shell. */
   routes?: PluginRoute[];
   /** Host routes exempt from UCAN auth. */
   authExcludedRoutes?: RouteExclusion[];
   /**
    * Overrides for the model catalog exposed on `GET /models`. Default: the
-   * curated catalog with live OpenRouter prices (`listModels`).
+   * curated catalog with live OpenRouter prices (`listModels`). The second
+   * argument carries the request's `waitUntil` (for background work such as
+   * a price refresh); an override may ignore it.
    */
-  listModels?: (env: OracleWorkerEnv) => unknown | Promise<unknown>;
+  listModels?: (
+    env: OracleWorkerEnv,
+    options?: ListModelsOptions,
+  ) => unknown | Promise<unknown>;
   /**
    * Host hooks for the per-turn agent build — the Node runtime's
    * `opts.hooks.getRoomTitle` / `safetyModel`, resolved per turn against the
@@ -195,6 +300,9 @@ export function createOracleWorker(
         features: opts.features,
         manifestOverrides: opts.manifestOverrides,
         env,
+        decisionAdapter: opts.decisionAdapter,
+        decisionProviders: opts.decisionProviders,
+        decisionProviderPolicy: opts.decisionProviderPolicy,
         logger: console,
       });
       cores.set(env, core);
@@ -207,17 +315,23 @@ export function createOracleWorker(
     let app = apps.get(env);
     if (!app) {
       const core = coreFor(env);
+      // Validated with the core: half-configured feedback fails the boot.
+      const feedback = feedbackConfigFromEnv(env);
       app = createShell({
         routes: [...core.pluginRoutes, ...(opts.routes ?? [])],
         authExcludedRoutes: [
           ...core.authExcludedRoutes,
           ...(opts.authExcludedRoutes ?? []),
         ],
-        listModels: opts.listModels ?? ((e) => listModels(e)),
+        listModels: opts.listModels ?? ((e, options) => listModels(e, options)),
         banner: {
           name: opts.config.name,
           description: opts.config.description,
         },
+        feedback: feedback && {
+          config: feedback,
+          sink: new LinearFeedbackSink(feedback.linear),
+        },
       });
       apps.set(env, app);
     }
@@ -246,7 +360,25 @@ export function createOracleWorker(
     scheduled: async (_event, env) => {
       // Cron safety net: if the gateway's keep-alive loop ever died, this
       // restarts it. Declare a `triggers.crons` entry (e.g. every 5 minutes).
-      await gateway(env).ensureStarted();
+      // A failed keep-alive must not stop the sweep, and is rethrown after it
+      // so the cron invocation still reports the failure.
+      let keepAlive: { error: unknown } | undefined;
+      try {
+        await gateway(env).ensureStarted();
+      } catch (error) {
+        keepAlive = { error };
+      }
+      // The sweep throttles itself to one R2 read per tick between sweeps and
+      // contains its own errors (it logs them and never throws).
+      if (env.ARTIFACT_BUCKET)
+        await sweepExpiredArtifacts({
+          bucket: env.ARTIFACT_BUCKET,
+          intervalMs: artifactSweepIntervalMs(env, (message) =>
+            console.warn(message),
+          ),
+          log: console,
+        });
+      if (keepAlive) throw keepAlive.error;
     },
   };
 }

package/src/llm/byo-adapter.ts

@@ -11,13 +11,23 @@
  *
  * The credential is captured in this closure only; it never appears on the
  * request context, graph state, or trace metadata.
+ *
+ * Every BYO model it hands out is wrapped in `ByoModelFallbackChatModel`:
+ * a model the provider refuses (`isModelUnavailableError`) is answered by
+ * the platform model for the rest of the turn, behind a `byo_fallback`
+ * notice. The refusal state lives in this adapter, so it is per turn.
  */
 
 import type { BaseChatModel } from '@langchain/core/language_models/chat_models';
 import type { ChatOpenAIFields, Logger, ModelRole } from '../plugin-api/types';
 import type { LlmAdapter } from '../core/runtime-context';
+import { NOOP_LOGGER } from '../core/utils';
 import { byoModelForRole, type ByoCredential } from './byo-catalog';
 import { createByoChatModel, type ChatGptBackendConfig } from './byo-client';
+import {
+  ByoModelFallbackChatModel,
+  ByoModelFallbackState,
+} from './byo-model-fallback';
 
 export interface ByoTurnResolution {
   credential: ByoCredential;
@@ -32,6 +42,7 @@ export function createByoLlmAdapter(
   turn: ByoTurnResolution,
   logger?: Logger,
 ): LlmAdapter {
+  const fallbackState = new ByoModelFallbackState();
   return {
     get(role: ModelRole, params?: ChatOpenAIFields): BaseChatModel {
       const modelId = byoModelForRole(
@@ -46,13 +57,23 @@ export function createByoLlmAdapter(
       // Strip a caller-supplied `model` (for `main` it carries the `byo:` id,
       // which is not a wire id) — the translated id wins.
       const { model: _model, ...rest } = params ?? {};
-      return createByoChatModel({
-        credential: turn.credential,
+      // Wrapped even after a refusal this turn: the wrapper then goes straight
+      // to the platform model and attributes that model's failures to the
+      // platform, not to the user's account.
+      return new ByoModelFallbackChatModel({
+        provider: turn.credential.provider,
         modelId,
-        role,
-        chatGptBackend: turn.chatGptBackend,
-        params: rest,
-        logger,
+        byo: createByoChatModel({
+          credential: turn.credential,
+          modelId,
+          role,
+          chatGptBackend: turn.chatGptBackend,
+          params: rest,
+          logger,
+        }),
+        platform: () => platform.get(role, rest),
+        state: fallbackState,
+        logger: logger ?? NOOP_LOGGER,
       });
     },
   };

package/src/llm/byo-catalog.ts

@@ -98,6 +98,19 @@ export const BYO_PROVIDER_INFO: Record<ByoProvider, ByoProviderInfo> = {
  * after the token exchange. Stored in the canonical user↔oracle room, so the
  * credential is account-level for this oracle, not per-session.
  */
+/**
+ * The room-secret namespace reserved for the runtime's own LLM credentials:
+ * every `BYO_SECRET_NAMES` entry, and any provider added later. Plugins never
+ * see a secret under it (`createSecretsAdapter`) — above all the sandbox,
+ * which forwards what it sees to code the model writes.
+ */
+export const BYO_SECRET_PREFIX = 'BYO_LLM_';
+
+/** A room secret only the runtime itself may read (a BYO LLM credential). */
+export function isRuntimeOnlySecret(name: string): boolean {
+  return name.startsWith(BYO_SECRET_PREFIX);
+}
+
 export const BYO_SECRET_NAMES: Record<ByoProvider, string> = {
   chatgpt: 'BYO_LLM_CHATGPT_OAUTH',
   openai: 'BYO_LLM_OPENAI_API_KEY',

package/src/llm/byo-model-fallback.ts

@@ -0,0 +1,248 @@
+/**
+ * Call-time fallback for a BYO model the user's provider refuses.
+ *
+ * The pre-turn checks (`WorkersByoService.resolveForTurn`) cannot know
+ * whether the provider serves the selected model: the ChatGPT backend answers
+ * an immediate `400` with an empty body for a model id the subscription does
+ * not offer, and only the first real request finds out. This wrapper stands
+ * in for the BYO chat model: when its call fails that way before the
+ * provider produced any output, it announces the fallback once (an
+ * `on_custom_event` named `byo_fallback`, which the SSE producer writes as
+ * the same `error`-channel notice the pre-turn fallbacks send) and answers
+ * the very same call on the platform model. The refusal is remembered for
+ * the rest of the turn (`ByoModelFallbackState`, one per adapter, i.e. per
+ * turn): every later call to that model id goes to the platform model
+ * directly. Other BYO model ids of the turn (the helper roles' models) stay
+ * on the user's account. Nothing is persisted across turns. A failure of the
+ * answering platform model is marked (`markPlatformFallbackFailure`) so the
+ * SSE classification blames — and redacts — the platform, not the user's
+ * account.
+ *
+ * Delegation runs at the `_streamResponseChunks` / `_generate` level, inside
+ * this wrapper's own run, so callbacks, metering and the stream events see
+ * one model call whichever model answered it.
+ */
+
+import type { CallbackManagerForLLMRun } from '@langchain/core/callbacks/manager';
+import type {
+  BaseLanguageModelInput,
+  ToolDefinition,
+} from '@langchain/core/language_models/base';
+import {
+  BaseChatModel,
+  type BaseChatModelCallOptions,
+  type BindToolsInput,
+} from '@langchain/core/language_models/chat_models';
+import type { ModelProfile } from '@langchain/core/language_models/profile';
+import type { AIMessageChunk, BaseMessage } from '@langchain/core/messages';
+import type { ChatGenerationChunk, ChatResult } from '@langchain/core/outputs';
+import type { Runnable } from '@langchain/core/runnables';
+import { convertToOpenAITool } from '@langchain/core/utils/function_calling';
+import type { Logger } from '../plugin-api/types';
+import type { ByoProvider } from './byo-catalog';
+import {
+  BYO_FALLBACK_KIND,
+  buildByoFallbackNotice,
+  classifyLlmError,
+  isModelUnavailableError,
+  markPlatformFallbackFailure,
+} from './provider-error';
+
+/** Turn-scoped record of the BYO model ids the provider refused. */
+export class ByoModelFallbackState {
+  private readonly refused = new Set<string>();
+
+  isRefused(modelId: string): boolean {
+    return this.refused.has(modelId);
+  }
+
+  /** Records a refusal; `true` only the first time for this model id. */
+  markRefused(modelId: string): boolean {
+    if (this.refused.has(modelId)) return false;
+    this.refused.add(modelId);
+    return true;
+  }
+}
+
+export interface ByoModelFallbackCallOptions extends BaseChatModelCallOptions {
+  /** Tools in OpenAI function format (see `bindTools`). */
+  tools?: ToolDefinition[] | BindToolsInput[];
+  strict?: boolean;
+}
+
+export interface ByoModelFallbackFields {
+  provider: ByoProvider;
+  /** Provider-native id of the wrapped BYO model. */
+  modelId: string;
+  /** The user's BYO model for this role. */
+  byo: BaseChatModel;
+  /** Builds the platform model for the same role (called at most once). */
+  platform: () => BaseChatModel;
+  state: ByoModelFallbackState;
+  logger: Logger;
+}
+
+export class ByoModelFallbackChatModel extends BaseChatModel<ByoModelFallbackCallOptions> {
+  private readonly fields: ByoModelFallbackFields;
+  private platformModel: BaseChatModel | undefined;
+
+  static lc_name(): string {
+    return 'ByoModelFallbackChatModel';
+  }
+
+  constructor(fields: ByoModelFallbackFields) {
+    super({});
+    this.fields = fields;
+  }
+
+  /** The provider-native id this wrapper stands in for. */
+  get modelId(): string {
+    return this.fields.modelId;
+  }
+
+  /** The user's own model this wrapper calls first. */
+  get byoModel(): BaseChatModel {
+    return this.fields.byo;
+  }
+
+  private platform(): BaseChatModel {
+    this.platformModel ??= this.fields.platform();
+    return this.platformModel;
+  }
+
+  /** The model a call starting now goes to. */
+  private active(): BaseChatModel {
+    return this.fields.state.isRefused(this.fields.modelId)
+      ? this.platform()
+      : this.fields.byo;
+  }
+
+  /** Read by the base constructor, before the fields exist — a constant. */
+  _llmType(): string {
+    return 'byo-model-fallback';
+  }
+
+  override get profile(): ModelProfile {
+    return this.active().profile;
+  }
+
+  override invocationParams(options?: this['ParsedCallOptions']): unknown {
+    return this.active().invocationParams(options);
+  }
+
+  override getLsParams(options: this['ParsedCallOptions']) {
+    return this.active().getLsParams(options);
+  }
+
+  /**
+   * Tools travel as call options in OpenAI function format — the format
+   * `ChatOpenAI.bindTools` produces and both of its request converters
+   * (Chat Completions and Responses) accept — so the same bound call can be
+   * answered by either model. `strict` stays a call option, applied by the
+   * answering model exactly as its own `bindTools` would. Provider-specific
+   * tool kinds that only `ChatOpenAI.bindTools` special-cases on a LangChain
+   * tool (`metadata.customTool`, `extras.providerToolDefinition`,
+   * `extras.defer_loading`) become plain functions here; the runtime binds
+   * none of them. Plain OpenAI tool objects pass through unchanged.
+   */
+  override bindTools(
+    tools: BindToolsInput[],
+    kwargs?: Partial<ByoModelFallbackCallOptions>,
+  ): Runnable<
+    BaseLanguageModelInput,
+    AIMessageChunk,
+    ByoModelFallbackCallOptions
+  > {
+    return this.withConfig({
+      tools: tools.map((tool) => convertToOpenAITool(tool)),
+      ...kwargs,
+    });
+  }
+
+  /**
+   * A refusal: announce it once per model id per turn, log it, and remember
+   * it so every later call goes to the platform model.
+   */
+  private async fallBack(
+    error: unknown,
+    runManager: CallbackManagerForLLMRun | undefined,
+  ): Promise<void> {
+    const { provider, modelId, state, logger } = this.fields;
+    if (!state.markRefused(modelId)) return;
+    const status = classifyLlmError(error).status;
+    logger.warn(
+      `[byo] ${provider} refused model "${modelId}" (HTTP ${status ?? 'n/a'}): ${error instanceof Error ? error.message : String(error)} — this turn uses the platform model for it`,
+    );
+    await runManager?.handleCustomEvent(
+      BYO_FALLBACK_KIND,
+      buildByoFallbackNotice('model_unavailable', provider, { modelId }),
+    );
+  }
+
+  override async *_streamResponseChunks(
+    messages: BaseMessage[],
+    options: this['ParsedCallOptions'],
+    runManager?: CallbackManagerForLLMRun,
+  ): AsyncGenerator<ChatGenerationChunk> {
+    if (!this.fields.state.isRefused(this.fields.modelId)) {
+      let produced = false;
+      try {
+        for await (const chunk of this.fields.byo._streamResponseChunks(
+          messages,
+          options,
+          runManager,
+        )) {
+          produced = true;
+          yield chunk;
+        }
+        return;
+      } catch (error) {
+        if (
+          options.signal?.aborted ||
+          !isModelUnavailableError(error, { afterOutput: produced })
+        ) {
+          throw error;
+        }
+        await this.fallBack(error, runManager);
+      }
+    }
+    try {
+      yield* this.platform()._streamResponseChunks(
+        messages,
+        options,
+        runManager,
+      );
+    } catch (error) {
+      markPlatformFallbackFailure(error);
+      throw error;
+    }
+  }
+
+  /**
+   * The non-streamed path (no streaming handler on the call). A model that
+   * streams internally here reports tokens to handlers that do not forward
+   * them anywhere, so a refusal is always answered by the platform model.
+   */
+  async _generate(
+    messages: BaseMessage[],
+    options: this['ParsedCallOptions'],
+    runManager?: CallbackManagerForLLMRun,
+  ): Promise<ChatResult> {
+    if (!this.fields.state.isRefused(this.fields.modelId)) {
+      try {
+        return await this.fields.byo._generate(messages, options, runManager);
+      } catch (error) {
+        if (options.signal?.aborted || !isModelUnavailableError(error)) {
+          throw error;
+        }
+        await this.fallBack(error, runManager);
+      }
+    }
+    try {
+      return await this.platform()._generate(messages, options, runManager);
+    } catch (error) {
+      markPlatformFallbackFailure(error);
+      throw error;
+    }
+  }
+}

package/src/llm/byo-service.ts

@@ -106,6 +106,15 @@ export interface ByoProviderStatus {
 export interface ByoSecretsBackend {
   getIndex(roomId: string): Promise<Array<{ name: string; eventId: string }>>;
   getValues(roomId: string, names: string[]): Promise<Record<string, string>>;
+  /**
+   * Values for index entries already read with `getIndex`, without reading
+   * the index again. Optional: without it the service asks `getValues` for
+   * the entries' names.
+   */
+  getValuesFor?(
+    roomId: string,
+    index: ReadonlyArray<{ name: string; eventId: string }>,
+  ): Promise<Record<string, string>>;
   putSecret(roomId: string, name: string, value: string): Promise<void>;
   deleteSecret(roomId: string, name: string): Promise<void>;
 }
@@ -132,12 +141,23 @@ export interface WorkersByoServiceOptions {
   logger?: Logger;
   /** Fetch used for the ChatGPT-backend reachability probe (tests). */
   probeFetch?: typeof fetch;
+  /** Bound on the reachability probe (default `CHATGPT_PROBE_TIMEOUT_MS`). */
+  probeTimeoutMs?: number;
+  /** Bound on a key-validation call (default `KEY_CHECK_TIMEOUT_MS`). */
+  keyCheckTimeoutMs?: number;
   /** Where ChatGPT-subscription requests go (default: the real backend). */
   chatGptBackend?: ChatGptBackendConfig;
 }
 
 /** How long a ChatGPT-backend reachability verdict is trusted. */
 const CHATGPT_PROBE_TTL_MS = 10 * 60 * 1000;
+/**
+ * The probe runs at the start of a ChatGPT turn: a backend that does not
+ * answer within this is treated as reachable rather than holding the turn.
+ */
+const CHATGPT_PROBE_TIMEOUT_MS = 5_000;
+/** How long a "check my key" call waits on the provider. */
+const KEY_CHECK_TIMEOUT_MS = 10_000;
 
 const NOOP: Logger = {
   log: () => undefined,
@@ -173,6 +193,8 @@ export class WorkersByoService {
   /** Per-user refresh-failure cooldown (epoch-ms deadline). */
   private readonly refreshCooldownUntil = new Map<string, number>();
   private readonly probeFetch: typeof fetch;
+  private readonly probeTimeoutMs: number;
+  private readonly keyCheckTimeoutMs: number;
   readonly chatGptBackend: ChatGptBackendConfig;
   /** Last ChatGPT-backend reachability verdict (deployment-wide, not per user). */
   private chatGptProbe: { blocked: boolean; at: number } | null = null;
@@ -189,6 +211,8 @@ export class WorkersByoService {
     // method. Resolve the global at call time so the probe really runs.
     this.probeFetch =
       opts.probeFetch ?? ((input, init) => globalThis.fetch(input, init));
+    this.probeTimeoutMs = opts.probeTimeoutMs ?? CHATGPT_PROBE_TIMEOUT_MS;
+    this.keyCheckTimeoutMs = opts.keyCheckTimeoutMs ?? KEY_CHECK_TIMEOUT_MS;
     this.chatGptBackend = opts.chatGptBackend ?? DEFAULT_CHATGPT_BACKEND;
   }
 
@@ -201,8 +225,9 @@ export class WorkersByoService {
    * a failed turn with no reply, so probe once (a cheap GET the backend
    * answers with a JSON 404/405 when reachable) and trust the verdict for
    * `CHATGPT_PROBE_TTL_MS`. Only an HTML 403 counts as blocked — a network
-   * error or any JSON status is "reachable", so a probe hiccup never hides
-   * the user's own provider errors.
+   * error, a probe that times out (`CHATGPT_PROBE_TIMEOUT_MS`) or any JSON
+   * status is "reachable", so a probe hiccup never hides the user's own
+   * provider errors.
    */
   private async chatGptBackendBlocked(accessToken: string): Promise<boolean> {
     if (
@@ -222,6 +247,7 @@ export class WorkersByoService {
             Authorization: `Bearer ${accessToken}`,
             originator: 'codex_cli_rs',
           },
+          signal: AbortSignal.timeout(this.probeTimeoutMs),
         },
       );
       const type = res.headers.get('content-type') ?? '';
@@ -340,12 +366,20 @@ export class WorkersByoService {
     const roomId = await this.resolveRoomIdFn(userDid);
     if (!roomId) return {};
 
-    const index = await this.secrets.getIndex(roomId);
-    const byoNames = index
-      .map((entry) => entry.name)
-      .filter((name) => providerForSecretName(name) !== undefined);
+    // One read of the room's secret index when the backend can decrypt the
+    // entries already read; `getValues` would read the index again.
+    const byoEntries = (await this.secrets.getIndex(roomId)).filter(
+      (entry) => providerForSecretName(entry.name) !== undefined,
+    );
     const values =
-      byoNames.length > 0 ? await this.secrets.getValues(roomId, byoNames) : {};
+      byoEntries.length === 0
+        ? {}
+        : this.secrets.getValuesFor
+          ? await this.secrets.getValuesFor(roomId, byoEntries)
+          : await this.secrets.getValues(
+              roomId,
+              byoEntries.map((entry) => entry.name),
+            );
 
     const creds: ByoCredentialMap = {};
     for (const [name, value] of Object.entries(values)) {
@@ -789,7 +823,10 @@ export class WorkersByoService {
         credential.provider,
         credential.apiKey,
       );
-      const res = await fetch(url, { headers });
+      const res = await fetch(url, {
+        headers,
+        signal: AbortSignal.timeout(this.keyCheckTimeoutMs),
+      });
       if (res.ok) return { valid: true };
       return {
         valid: false,