@yansigit/opencodex 2.36.1-dev.20260829.50 → 2.36.2-dev.20260829.52

package/src/lib/provider-tls-profile.ts

@@ -21,6 +21,7 @@ interface WreqModule {
     browser: "chrome_142";
     os: "windows" | "macos" | "linux";
     proxy?: string;
+    resolve?: Record<string, string[]>;
   }): Promise<WreqTransport>;
   fetch(input: string | URL | Request, init?: Record<string, unknown>): Promise<unknown>;
 }
@@ -46,6 +47,8 @@ const defaultRuntime: ProviderTlsRuntimeForTest = {
 let runtime = defaultRuntime;
 const statusByProvider = new Map<string, { status: ProviderTlsProfileStatus; fingerprint: string }>();
 const transports = new Map<string, Promise<InitializedTransport | undefined>>();
+const requestTransports = new Set<WreqTransport>();
+let modulePromise: Promise<WreqModule | undefined> | undefined;
 let shutdownDetach: (() => void) | undefined;
 let fallbackWarned = false;
 
@@ -92,7 +95,7 @@ function safeProviderTlsError(error: unknown): Error {
 function warnFallbackOnce(): void {
   if (fallbackWarned) return;
   fallbackWarned = true;
-  console.warn("[opencodex] Antigravity TLS profile requested → fallback to Bun fetch; native transport initialization failed");
+  console.warn("[opencodex] Antigravity TLS profile request blocked: native transport initialization failed");
 }
 
 function emulationOs(): "windows" | "macos" | "linux" {
@@ -184,10 +187,13 @@ function registerShutdownHook(): void {
   shutdownDetach = registerOptionalShutdownHook("provider-tls-profile", () => {
     const pending = [...transports.values()];
     transports.clear();
+    const scoped = [...requestTransports];
+    requestTransports.clear();
     shutdownDetach = undefined;
     for (const transport of pending) {
       void transport.then(value => value?.transport.close()).catch(() => undefined);
     }
+    for (const transport of scoped) void transport.close().catch(() => undefined);
   });
 }
 
@@ -202,7 +208,8 @@ async function getTransport(proxy: string | undefined): Promise<InitializedTrans
   const pending = (async () => {
     let transport: WreqTransport | undefined;
     try {
-      const module = await runtime.importWreq();
+      const module = await getWreqModule();
+      if (!module) return undefined;
       transport = await module.createTransport({
         browser: "chrome_142",
         os: emulationOs(),
@@ -219,6 +226,69 @@ async function getTransport(proxy: string | undefined): Promise<InitializedTrans
   return pending;
 }
 
+function getWreqModule(): Promise<WreqModule | undefined> {
+  modulePromise ??= runtime.importWreq().catch(() => undefined);
+  return modulePromise;
+}
+
+async function getPinnedRequestTransport(
+  hostname: string,
+  addresses: string[],
+): Promise<InitializedTransport | undefined> {
+  let transport: WreqTransport | undefined;
+  try {
+    const module = await getWreqModule();
+    if (!module) return undefined;
+    transport = await module.createTransport({
+      browser: "chrome_142",
+      os: emulationOs(),
+      resolve: { [hostname]: addresses },
+    });
+    requestTransports.add(transport);
+    registerShutdownHook();
+    return { module, transport };
+  } catch {
+    if (transport) await transport.close().catch(() => undefined);
+    return undefined;
+  }
+}
+
+function closeTransportWithResponse(response: Response, transport: WreqTransport): Response {
+  const close = () => {
+    if (!requestTransports.delete(transport)) return;
+    void transport.close().catch(() => undefined);
+  };
+  if (!response.body) {
+    close();
+    return response;
+  }
+  const reader = response.body.getReader();
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const chunk = await reader.read();
+        if (chunk.done) {
+          close();
+          controller.close();
+        } else {
+          controller.enqueue(chunk.value);
+        }
+      } catch (error) {
+        close();
+        controller.error(error);
+      }
+    },
+    async cancel(reason) {
+      try { await reader.cancel(reason); } finally { close(); }
+    },
+  });
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
 export function providerTlsFetch(
   providerName: string,
   provider: Pick<OcxProviderConfig, "adapter" | "authMode" | "googleMode" | "baseUrl" | "tlsProfile">,
@@ -237,27 +307,34 @@ export function providerTlsFetch(
   if (!profileIsSupported(providerName, provider)) {
     setStatus(providerName, provider, "fallback");
     warnFallbackOnce();
-    return bunFetch;
+    return (async () => {
+      throw safeProviderTlsError(new Error("configured native transport profile is not valid for this provider"));
+    }) as unknown as typeof globalThis.fetch;
   }
   return (async (input: string | URL | Request, init?: RequestInit): Promise<Response> => {
     const url = typeof input === "string" || input instanceof URL ? input : input.url;
-    if (!isCanonicalAntigravityUrl(url)) return bunFetch(input, init);
+    if (!isCanonicalAntigravityUrl(url)) {
+      throw safeProviderTlsError(new Error("configured native transport profile refused a noncanonical destination"));
+    }
     const proxy = proxyForUrl(url);
     // A direct profiled request must pass the same public-destination gate as the
     // ordinary provider executor before wreq can send its bearer-bearing request.
     // Proxied requests deliberately leave peer selection to the configured proxy,
     // matching providerOutbound's proxy boundary (and its inability to pin a peer).
-    if (!proxy) {
-      await (runtime.resolveDestination ?? resolvePublicAddresses)(String(url), {
+    const parsed = new URL(String(url));
+    const resolved = !proxy
+      ? await (runtime.resolveDestination ?? resolvePublicAddresses)(String(url), {
         context: "Antigravity profile URL",
         allowPrivateNetwork: false,
-      });
-    }
-    const initialized = await getTransport(proxy);
+      })
+      : undefined;
+    const initialized = resolved
+      ? await getPinnedRequestTransport(parsed.hostname, resolved.addresses.map(address => address.address))
+      : await getTransport(proxy);
     if (!initialized) {
       setStatus(providerName, provider, "fallback");
       warnFallbackOnce();
-      return bunFetch(input, { ...init, redirect: "manual" });
+      throw safeProviderTlsError(new Error("native transport initialization failed"));
     }
     setStatus(providerName, provider, "active");
     const wreqInit = {
@@ -268,8 +345,12 @@ export function providerTlsFetch(
       redirect: "manual" as const,
     };
     try {
-      return await initialized.module.fetch(input, wreqInit) as Response;
+      const response = await initialized.module.fetch(input, wreqInit) as Response;
+      return resolved ? closeTransportWithResponse(response, initialized.transport) : response;
     } catch (error) {
+      if (resolved && requestTransports.delete(initialized.transport)) {
+        void initialized.transport.close().catch(() => undefined);
+      }
       // Native errors are post-dispatch failures. Redact at this boundary and
       // never replay through Bun, since generation may already have started.
       throw safeProviderTlsError(error);
@@ -280,6 +361,7 @@ export function providerTlsFetch(
 export function setProviderTlsRuntimeForTest(next: ProviderTlsRuntimeForTest | undefined): void {
   if (next === undefined) {
     runtime = defaultRuntime;
+    modulePromise = undefined;
     return;
   }
   // Test callers normally replace only the native module. Keep those tests
@@ -294,11 +376,15 @@ export function setProviderTlsRuntimeForTest(next: ProviderTlsRuntimeForTest | u
     }),
     ...next,
   };
+  modulePromise = undefined;
 }
 
 export function resetProviderTlsProfileForTests(): void {
   for (const pending of transports.values()) void pending.then(value => value?.transport.close()).catch(() => undefined);
   transports.clear();
+  for (const transport of requestTransports) void transport.close().catch(() => undefined);
+  requestTransports.clear();
+  modulePromise = undefined;
   shutdownDetach?.();
   shutdownDetach = undefined;
   statusByProvider.clear();

package/src/lib/server-tls.ts

@@ -0,0 +1,47 @@
+import { accessSync, constants, statSync } from "node:fs";
+import type { OcxConfig, OcxServerTlsConfig } from "../types";
+
+export function serverTlsConfigError(value: unknown): string | null {
+  if (value === undefined) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return "tls must be an object or omitted";
+  const tls = value as Record<string, unknown>;
+  const fields = ["certFile", "keyFile", "publicOrigin"] as const;
+  const unknown = Object.keys(tls).find(field => !(fields as readonly string[]).includes(field));
+  if (unknown) return `tls.${unknown} is not a supported field`;
+  for (const field of fields) {
+    if (typeof tls[field] !== "string" || tls[field].trim() !== tls[field] || !tls[field]) {
+      return `tls.${field} must be a non-empty trimmed string`;
+    }
+  }
+  try {
+    const url = new URL(tls.publicOrigin as string);
+    if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.origin !== tls.publicOrigin) {
+      return "tls.publicOrigin must be an exact HTTPS origin without credentials, path, query, or fragment";
+    }
+  } catch {
+    return "tls.publicOrigin must be an exact HTTPS origin without credentials, path, query, or fragment";
+  }
+  return null;
+}
+
+export function assertServerTlsFiles(tls: OcxServerTlsConfig): void {
+  for (const [label, path] of [["certificate", tls.certFile], ["private key", tls.keyFile]] as const) {
+    try {
+      accessSync(path, constants.R_OK);
+      if (!statSync(path).isFile()) throw new Error("not a regular file");
+    } catch {
+      throw new Error(`TLS ${label} is not a readable regular file: ${path}`);
+    }
+  }
+}
+
+function clientHost(hostname: string | undefined): string {
+  const host = hostname?.trim() || "127.0.0.1";
+  if (host === "0.0.0.0" || host === "::" || host === "[::]") return "127.0.0.1";
+  return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+}
+
+export function canonicalServerOrigin(config: Pick<OcxConfig, "hostname" | "tls">, port: number): string {
+  if (config.tls) return config.tls.publicOrigin;
+  return `http://${clientHost(config.hostname)}:${port}`;
+}

package/src/lib/test-provider-fetch.ts

@@ -0,0 +1,6 @@
+/** Legacy fixture seam, inert unless the repository test preload explicitly arms it. */
+export function testProviderFetch(provider: object): typeof globalThis.fetch | undefined {
+  if ((globalThis as Record<PropertyKey, unknown>)[Symbol.for("opencodex.test.provider-fetch")] !== true) return undefined;
+  const candidate = (provider as { fetch?: unknown }).fetch;
+  return typeof candidate === "function" ? candidate as typeof globalThis.fetch : undefined;
+}

package/src/lib/test-server-start.ts

@@ -0,0 +1,5 @@
+/** Test-only listener seam, inert unless the repository test preload explicitly arms it. */
+export function allowPlaintextRemoteForTests(): boolean {
+  return process.env.OCX_TEST_HOME_GUARD === "1"
+    && (globalThis as Record<PropertyKey, unknown>)[Symbol.for("opencodex.test.plaintext-remote")] === true;
+}

package/src/lib/upstream-retry.ts

@@ -17,7 +17,7 @@
 import { clearableDeadline } from "./abort";
 
 // 1 initial + 2 retries: the pool may hold more than one stale socket.
-const RESET_RETRY_MAX_ATTEMPTS = 3;
+const RESET_RETRY_MAX_ATTEMPTS = 1;
 const RESET_RETRY_BASE_DELAY_MS = 150;
 const RESET_RETRY_MAX_DELAY_MS = 1_000;
 
@@ -240,11 +240,15 @@ export interface ResetRetryOptions {
   /** Short host/path label for the retry warn log (no secrets/query strings). */
   label?: string;
   attempts?: number;
+  /** Shared replay allowance across sends in one logical generation. */
+  replayBudget?: { remaining: number };
 }
 
 export interface TransientRetryOptions extends ResetRetryOptions {
   /** Test seam: per-attempt slow budget override (defaults to TRANSIENT_RETRY_SLOW_ATTEMPT_MS). */
   slowAttemptMs?: number;
+  /** Opt in to replaying transient 5xx responses (up to three total sends). */
+  replayTransientFailures?: boolean;
 }
 
 export type UpstreamSendRecovery = "connection-reset" | "transient-5xx";
@@ -330,7 +334,7 @@ export async function fetchWithResetRetry(
         if (sawReset) throw new UpstreamRetryEvidenceError([], err, true);
         throw err;
       }
-      if (attempt === attempts - 1) throw err;
+      if (attempt === attempts - 1 || (opts.replayBudget && opts.replayBudget.remaining <= 0)) throw err;
       sawReset = true;
       lastError = err;
       console.warn(
@@ -340,6 +344,7 @@ export async function fetchWithResetRetry(
         baseDelayMs: RESET_RETRY_BASE_DELAY_MS,
         maxDelayMs: RESET_RETRY_MAX_DELAY_MS,
       }), opts.abortSignal);
+      if (opts.replayBudget) opts.replayBudget.remaining -= 1;
     }
   }
   throw lastError ?? new Error("upstream fetch failed");
@@ -359,34 +364,43 @@ export async function fetchWithTransientRetry(
   doFetch: ReplayableFetch,
   opts: TransientRetryOptions = {},
 ): Promise<Response> {
-  const attempts = Math.max(1, opts.attempts ?? TRANSIENT_RETRY_MAX_ATTEMPTS);
+  const attempts = Math.max(1, opts.attempts ?? (opts.replayTransientFailures ? TRANSIENT_RETRY_MAX_ATTEMPTS : 1));
   const slowAttemptMs = opts.slowAttemptMs ?? TRANSIENT_RETRY_SLOW_ATTEMPT_MS;
   const transientStatuses: number[] = [];
   let attemptStart = Date.now();
-  let res = await fetchWithResetRetry(doFetch, opts);
-  for (let attempt = 0; attempt < attempts - 1; attempt++) {
-    if (res.ok || !isTransientUpstreamStatus(res.status)) return res;
-    if (opts.abortSignal?.aborted) return res;
-    if (Date.now() - attemptStart > slowAttemptMs) return res;
-    console.warn(
-      `[upstream-retry] transient ${res.status}${opts.label ? ` (${opts.label})` : ""} — retrying (${attempt + 2}/${attempts})`,
-    );
-    const delay = retryBackoffDelayMs(attempt, {
-      baseDelayMs: TRANSIENT_RETRY_BASE_DELAY_MS,
-      maxDelayMs: TRANSIENT_RETRY_MAX_DELAY_MS,
-      headers: res.headers,
-    });
-    cancelResponseBodyBestEffort(res);
-    await sleepWithAbort(delay, opts.abortSignal);
-    attemptStart = Date.now();
-    transientStatuses.push(res.status);
+  let sawReset = false;
+  let resetSeen = false;
+  let lastError: unknown;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    if (opts.abortSignal?.aborted) throw abortError(opts.abortSignal);
     try {
-      res = await fetchWithResetRetry(doFetch, opts, "transient-5xx");
+      const res = await doFetch(attempt === 0 ? undefined : (sawReset ? "connection-reset" : "transient-5xx"));
+      if (res.ok || !isTransientUpstreamStatus(res.status) || attempt === attempts - 1
+        || opts.abortSignal?.aborted || Date.now() - attemptStart > slowAttemptMs
+        || (opts.replayBudget && opts.replayBudget.remaining <= 0)) return res;
+      console.warn(`[upstream-retry] transient ${res.status}${opts.label ? ` (${opts.label})` : ""} — retrying (${attempt + 2}/${attempts})`);
+      const delay = retryBackoffDelayMs(attempt, { baseDelayMs: TRANSIENT_RETRY_BASE_DELAY_MS, maxDelayMs: TRANSIENT_RETRY_MAX_DELAY_MS, headers: res.headers });
+      cancelResponseBodyBestEffort(res);
+      await sleepWithAbort(delay, opts.abortSignal);
+      if (opts.replayBudget) opts.replayBudget.remaining -= 1;
+      transientStatuses.push(res.status);
+      sawReset = false;
+      attemptStart = Date.now();
     } catch (err) {
-      // Keep the prior 5xx evidence attached: the origin already responded, so
-      // this rejection is not pre-connection and must not classify as neutral.
-      throw new UpstreamRetryEvidenceError(transientStatuses, err);
+      if (opts.abortSignal?.aborted) throw err;
+      if (!isConnectionResetError(err)) {
+        if (transientStatuses.length || resetSeen) throw new UpstreamRetryEvidenceError(transientStatuses, err, resetSeen);
+        throw err;
+      }
+      if (attempt === attempts - 1 || (opts.replayBudget && opts.replayBudget.remaining <= 0)) throw err;
+      sawReset = true;
+      resetSeen = true;
+      lastError = err;
+      console.warn(`[upstream-retry] connection reset${opts.label ? ` (${opts.label})` : ""} — retrying (${attempt + 2}/${attempts})`);
+      await sleepWithAbort(retryBackoffDelayMs(attempt, { baseDelayMs: RESET_RETRY_BASE_DELAY_MS, maxDelayMs: RESET_RETRY_MAX_DELAY_MS }), opts.abortSignal);
+      if (opts.replayBudget) opts.replayBudget.remaining -= 1;
+      attemptStart = Date.now();
     }
   }
-  return res;
+  throw lastError ?? new Error("upstream fetch failed");
 }

package/src/oauth/anthropic.ts

@@ -2,6 +2,7 @@
 import { OAuthCallbackFlow } from "./callback-server";
 import { generatePKCE } from "./pkce";
 import type { LocalTokenImportMode, OAuthController, OAuthCredentials } from "./types";
+import { oauthFetch } from "./transport";
 
 const CLIENT_ID = atob("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl");
 const AUTHORIZE_URL = "https://claude.ai/oauth/authorize";
@@ -46,7 +47,7 @@ export class AnthropicTokenError extends Error {
 }
 
 async function postJson(url: string, body: Record<string, string | number>): Promise<string> {
-  const response = await fetch(url, {
+  const response = await oauthFetch(url, {
     method: "POST",
     headers: { "Content-Type": "application/json", Accept: "application/json" },
     body: JSON.stringify(body),
@@ -62,7 +63,7 @@ async function postJson(url: string, body: Record<string, string | number>): Pro
       // Best-effort only: malformed error bodies remain structured by HTTP status.
     }
     throw new AnthropicTokenError(
-      `Anthropic OAuth HTTP ${response.status}: ${responseBody}`,
+      `Anthropic OAuth HTTP ${response.status}`,
       response.status,
       oauthError,
     );
@@ -74,7 +75,7 @@ function parseTokenResponse(responseBody: string): AnthropicTokenResponse {
   try {
     return JSON.parse(responseBody) as AnthropicTokenResponse;
   } catch {
-    throw new Error(`Anthropic OAuth returned invalid JSON: ${responseBody.slice(0, 200)}`);
+    throw new Error("Anthropic OAuth returned invalid JSON");
   }
 }
 

package/src/oauth/chatgpt.ts

@@ -1,6 +1,7 @@
 import { OAuthCallbackFlow } from "./callback-server";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { generatePKCE } from "./pkce";
+import { oauthFetch } from "./transport";
 
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTH_URL = "https://auth.openai.com/oauth/authorize";
@@ -107,7 +108,7 @@ export class ChatGPTOAuthFlow extends OAuthCallbackFlow {
 
   async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
     if (!this.#verifier) throw new Error("ChatGPT PKCE verifier not initialized");
-    const resp = await fetch(TOKEN_URL, {
+    const resp = await oauthFetch(TOKEN_URL, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
       body: new URLSearchParams({
@@ -130,7 +131,10 @@ function safeErrorDescription(resp: Response): Promise<string> {
   return resp.text().catch(() => "").then(text => {
     try {
       const parsed = JSON.parse(text) as { error?: string; error_description?: string };
-      return [parsed.error, parsed.error_description].filter(Boolean).join(": ") || `HTTP ${resp.status}`;
+      const code = typeof parsed.error === "string" && /^(?:access_denied|expired_token|invalid_client|invalid_grant|invalid_request|temporarily_unavailable|unauthorized_client|unsupported_grant_type)$/.test(parsed.error)
+        ? parsed.error
+        : undefined;
+      return code ?? `HTTP ${resp.status}`;
     } catch { return `HTTP ${resp.status}`; }
   });
 }
@@ -144,7 +148,7 @@ export async function loginChatGPT(ctrl: OAuthController, opts?: { forceLogin?:
 // Note: uses form-urlencoded per OAuth 2.0 spec (RFC 6749 §6).
 // Codex-rs uses JSON for refresh — intentional divergence; both accepted by auth.openai.com.
 export async function refreshChatGPTToken(refreshToken: string): Promise<OAuthCredentials> {
-  const resp = await fetch(TOKEN_URL, {
+  const resp = await oauthFetch(TOKEN_URL, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({

package/src/oauth/command-code.ts

@@ -2,6 +2,7 @@ import type { OAuthController, OAuthCredentials } from "./types";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { parseCallbackInput } from "./callback-server";
+import { oauthFetch } from "./transport";
 
 const COMMAND_CODE_STUDIO_URL = "https://commandcode.ai";
 const COMMAND_CODE_CALLBACK_PORT = 5959;
@@ -43,7 +44,7 @@ async function importLocalCommandCodeAuth(signal?: AbortSignal): Promise<OAuthCr
   if (typeof parsed.apiKey !== "string" || parsed.apiKey.length === 0) return undefined;
   let accountId: string | undefined;
   try {
-    const response = await fetch("https://api.commandcode.ai/alpha/whoami", {
+    const response = await oauthFetch("https://api.commandcode.ai/alpha/whoami", {
       headers: { Authorization: `Bearer ${parsed.apiKey}`, Accept: "application/json" },
       signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000),
     });
@@ -129,7 +130,7 @@ function createCallbackServer(state: string): {
 /** Validate a raw pasted Command Code API key and return the validated identity. */
 async function validatePastedApiKey(apiKey: string): Promise<{ userId: string; userName: string } | undefined> {
   try {
-    const response = await fetch("https://api.commandcode.ai/alpha/whoami", {
+    const response = await oauthFetch("https://api.commandcode.ai/alpha/whoami", {
       headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
       signal: AbortSignal.timeout(10_000),
     });

package/src/oauth/cursor.ts

@@ -9,6 +9,7 @@
  */
 import { generatePKCE } from "./pkce";
 import type { OAuthController, OAuthCredentials } from "./types";
+import { oauthFetch } from "./transport";
 
 const CURSOR_LOGIN_URL = "https://cursor.com/loginDeepControl";
 const CURSOR_POLL_URL = "https://api2.cursor.sh/auth/poll";
@@ -132,7 +133,7 @@ export async function pollCursorAuth(
 
     try {
       const url = `${CURSOR_POLL_URL}?uuid=${encodeURIComponent(uuid)}&verifier=${encodeURIComponent(verifier)}`;
-      const response = await fetch(url, { signal });
+      const response = await oauthFetch(url, { signal });
 
       if (response.status === 404) {
         consecutiveErrors = 0;
@@ -215,7 +216,7 @@ export async function refreshCursorToken(refresh: string, signal?: AbortSignal):
     if (signal?.aborted) throw signal.reason ?? new Error("Cursor token refresh aborted");
     let response: Response;
     try {
-      response = await fetch(CURSOR_REFRESH_URL, {
+      response = await oauthFetch(CURSOR_REFRESH_URL, {
         method: "POST",
         headers: { Authorization: `Bearer ${refresh}`, "Content-Type": "application/json" },
         body: "{}",

package/src/oauth/github-copilot.ts

@@ -5,6 +5,7 @@
  * This is an unofficial bridge — GitHub may tighten or revoke access. See registry note.
  */
 import type { OAuthController, OAuthCredentials } from "./types";
+import { oauthFetch } from "./transport";
 
 /** VS Code's public GitHub OAuth app — required for copilot_internal/v2/token to succeed. */
 export const GITHUB_COPILOT_OAUTH_CLIENT_ID = "Iv1.b507a08c87ecfe98";
@@ -149,7 +150,7 @@ async function requestDeviceAuthorization(signal?: AbortSignal): Promise<{
   expiresInMs: number;
   intervalMs: number;
 }> {
-  const response = await fetch(DEVICE_CODE_URL, {
+  const response = await oauthFetch(DEVICE_CODE_URL, {
     method: "POST",
     headers: {
       Accept: "application/json",
@@ -194,7 +195,7 @@ async function pollGithubDeviceToken(
     // cadence violation GitHub may answer with slow_down.
     await sleep(waitMs, signal);
     if (Date.now() >= deadline) break;
-    const response = await fetch(ACCESS_TOKEN_URL, {
+    const response = await oauthFetch(ACCESS_TOKEN_URL, {
       method: "POST",
       headers: {
         Accept: "application/json",
@@ -211,6 +212,7 @@ async function pollGithubDeviceToken(
         ? AbortSignal.any([signal, AbortSignal.timeout(Math.max(MIN_POLL_MS, deadline - Date.now()))])
         : AbortSignal.timeout(Math.max(MIN_POLL_MS, deadline - Date.now())),
     });
+    if (signal?.aborted) throw new Error("Login cancelled");
     const payload = (await response.json().catch(() => ({}))) as GithubTokenResponse;
     if (response.ok && payload.access_token) {
       // Classic OAuth apps issue a non-expiring `gho_` access token with NO refresh token;
@@ -245,7 +247,7 @@ async function pollGithubDeviceToken(
 }
 
 async function refreshGithubAccessToken(refreshToken: string, signal?: AbortSignal): Promise<{ access: string; refresh: string }> {
-  const response = await fetch(ACCESS_TOKEN_URL, {
+  const response = await oauthFetch(ACCESS_TOKEN_URL, {
     method: "POST",
     headers: {
       Accept: "application/json",
@@ -283,7 +285,7 @@ async function exchangeCopilotToken(githubAccessToken: string, signal?: AbortSig
   expires: number;
   apiBaseUrl: string;
 }> {
-  const response = await fetch(COPILOT_TOKEN_URL, {
+  const response = await oauthFetch(COPILOT_TOKEN_URL, {
     method: "GET",
     headers: {
       ...GITHUB_COPILOT_EDITOR_HEADERS,
@@ -316,7 +318,7 @@ async function fetchGithubIdentityOnce(githubAccessToken: string, signal?: Abort
   email?: string;
   accountId?: string;
 }> {
-  const response = await fetch(GITHUB_USER_URL, {
+  const response = await oauthFetch(GITHUB_USER_URL, {
     headers: {
       Accept: "application/vnd.github+json",
       Authorization: `Bearer ${githubAccessToken}`,

package/src/oauth/google-antigravity.ts

@@ -13,6 +13,7 @@ import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-ser
 import { generatePKCE } from "./pkce";
 import type { OAuthController, OAuthCredentials } from "./types";
 import { antigravityUserAgent, ANTIGRAVITY_IDE_VERSION } from "../adapters/client-fingerprint";
+import { oauthFetch } from "./transport";
 
 const CLIENT_ID = process.env.GOOGLE_ANTIGRAVITY_CLIENT_ID
   || "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
@@ -96,7 +97,7 @@ function emailFromToken(accessToken: string, idToken: string | undefined): strin
 }
 
 async function postToken(body: Record<string, string>, signal?: AbortSignal): Promise<GoogleTokenPayload> {
-  const response = await fetch(TOKEN_ENDPOINT, {
+  const response = await oauthFetch(TOKEN_ENDPOINT, {
     method: "POST",
     headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams(body).toString(),
@@ -132,7 +133,7 @@ function extractProjectId(data: Record<string, unknown> | undefined): string | u
 }
 
 async function loadCodeAssistProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
-  const response = await fetch(`${PROD_API}/${API_VERSION}:loadCodeAssist`, {
+  const response = await oauthFetch(`${PROD_API}/${API_VERSION}:loadCodeAssist`, {
     method: "POST",
     headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent() },
     body: JSON.stringify({ metadata: { ideType: "ANTIGRAVITY" } }),
@@ -149,7 +150,7 @@ async function onboardProject(
   const sleep = sleepForTests ?? defaultSleep;
   for (let attempt = 0; attempt < ONBOARD_ATTEMPTS; attempt++) {
     if (signal?.aborted) throw signal.reason ?? new Error("Antigravity onboarding aborted");
-    const response = await fetch(`${DAILY_API}/${API_VERSION}:onboardUser`, {
+    const response = await oauthFetch(`${DAILY_API}/${API_VERSION}:onboardUser`, {
       method: "POST",
       headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent() },
       // `ide_version` is a version, not a User-Agent. `antigravityUserAgent()` returns the whole
@@ -295,7 +296,7 @@ export async function validateAntigravityImportCredential(
   signal?: AbortSignal,
 ): Promise<OAuthCredentials> {
   const credential = await refreshAntigravityToken(refreshToken, signal);
-  const response = await fetch(USERINFO_ENDPOINT, {
+  const response = await oauthFetch(USERINFO_ENDPOINT, {
     method: "GET",
     headers: { Accept: "application/json", Authorization: `Bearer ${credential.access}` },
     signal: requestSignal(signal),