@yansigit/opencodex 2.36.1 → 2.36.2-dev.20260829.53

package/src/generated/compatibility-version.json

@@ -10,7 +10,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "386cbf136df4cfea377839680ef5b85b3962298770bed851d7b6d37feac97909"
+      "sha256": "156bbb9f877255eab4dcfc8cd19e12f9a5a5af868c32cd46aa2665873afec641"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -42,7 +42,7 @@
     },
     {
       "path": "src/adapters/base.ts",
-      "sha256": "00e88baa1254946252302ddfb32445e2cd41ab583b13a37576a05c46ac6c00b8"
+      "sha256": "59018d233c0a70e7a613656a9e4ce5c3ab5208fe08f4e845ce211f0391f83b37"
     },
     {
       "path": "src/adapters/client-fingerprint.ts",
@@ -58,7 +58,7 @@
     },
     {
       "path": "src/adapters/command-code.ts",
-      "sha256": "ccd77fc6c00ca0010272b2338889ca1026324d634f86329c5b0c0f67d87ca402"
+      "sha256": "c2f9a925833acd4b2971b646b1581d017c7999ca5a8b0834952a817de4996684"
     },
     {
       "path": "src/adapters/cursor.ts",
@@ -258,7 +258,7 @@
     },
     {
       "path": "src/adapters/google-http.ts",
-      "sha256": "83768c8cd3368e55ba6cc2a36c0551fbc67fb94534d27c5bb27e3d7de2dcdf50"
+      "sha256": "179dc34fce6ea619ffe38404ab99351aacaa8b22170810177952f3779e6bcf12"
     },
     {
       "path": "src/adapters/google-tool-schema.ts",
@@ -274,7 +274,7 @@
     },
     {
       "path": "src/adapters/google.ts",
-      "sha256": "f3e4cf72d4fae4f41c33271bf4c2bded5a67b38b3576763e6a388549aaaee9d4"
+      "sha256": "eb65eaabbf50f09cc63e25cd182932a0349f3d20154fd28a7b8d072c6523426e"
     },
     {
       "path": "src/adapters/identity.ts",
@@ -550,7 +550,7 @@
     },
     {
       "path": "src/cli/dispatch.ts",
-      "sha256": "06d982ffba1599a6c8cd897144565b6d71053152b450fd87b76616c15662cedf"
+      "sha256": "ca099eb0448c5819a2068e6f03fdf4a721727730301c056c2ecea5d4b66a7761"
     },
     {
       "path": "src/cli/doctor.ts",
@@ -566,15 +566,15 @@
     },
     {
       "path": "src/cli/help.ts",
-      "sha256": "ef9c993e060dbc16abd858043ff774cda53cf2f4b9edd062279274a34f85e1a9"
+      "sha256": "ecc54bce59d6cb85e09c4c818fb67ea7b0b102e59af2b243218704f14e1c7685"
     },
     {
       "path": "src/cli/index.ts",
-      "sha256": "6c262f1430b49b24144722c34faa65d9fd56626aae43593cf21d838ffdeb5cca"
+      "sha256": "001dc7d88c130ceb9ba15a81ecb032b9f6da7bb668fa774f98761f5ab752b1b5"
     },
     {
       "path": "src/cli/init.ts",
-      "sha256": "ced149008c298c1167f8e710055ec5a293522e81dcc9e3bba2c8049dd32d3ec5"
+      "sha256": "4973aac25d36955b827c207d59a81e709ec165982537ecca0520ffbad931c816"
     },
     {
       "path": "src/cli/inspect.ts",
@@ -634,7 +634,7 @@
     },
     {
       "path": "src/cli/registry.ts",
-      "sha256": "a736410fb02d3e57f42c8bc017c85432c49e302c2c7a6d9b084c45f3b215d1b4"
+      "sha256": "53fa757386d8bd2bb14d32dc07a2a5ce91bc71052ad3baf04c5490ef5c39c2da"
     },
     {
       "path": "src/cli/replit-gateway-key-input.ts",
@@ -710,7 +710,7 @@
     },
     {
       "path": "src/codex/account-lifecycle.ts",
-      "sha256": "1cadb7614d15fa60dea718cfc9cf8845c86416054b16b1f93d52a579f0531c9a"
+      "sha256": "6b9032744db6b95f2ac0f1ebb92a568877ce6541643d111226cd0ff0e5c9a173"
     },
     {
       "path": "src/codex/account-namespace-match.ts",
@@ -926,7 +926,7 @@
     },
     {
       "path": "src/codex/inject.ts",
-      "sha256": "22fe9dc3b8fe3994b921ad619807b899e609834ea69e47c5b9494075327341a2"
+      "sha256": "99b541feae9e38c19d52a73a4734605b4db4c968bad8752be7f724776f294c2b"
     },
     {
       "path": "src/codex/injected-marker.ts",
@@ -1198,7 +1198,7 @@
     },
     {
       "path": "src/config.ts",
-      "sha256": "ab945b93888473c8165ca9cfe43b5ddca53c01d6de26b5c76b89903471aa7e24"
+      "sha256": "553f844ed9706069e237c02567e7e5b2b6bccb21de0d563e72c0b80758366e68"
     },
     {
       "path": "src/config/atomic-write.ts",
@@ -1214,7 +1214,7 @@
     },
     {
       "path": "src/config/process-state.ts",
-      "sha256": "0401a50d89603bab9d638b3e074989b6f07637511d3569833cfa96c916e00ce0"
+      "sha256": "b03935508769df6ccb55b893997b34bbb48e9efd1ce69093e255dff2e3ec5076"
     },
     {
       "path": "src/config/provider-name.ts",
@@ -1878,7 +1878,7 @@
     },
     {
       "path": "src/lib/bun-stream-caps.ts",
-      "sha256": "d2255a860bc9ea451abc7913cca76779c41656d35965d80ce10c63ad94e032aa"
+      "sha256": "dac6d3f1dc5a276ad33815d586f08a1e4481a187d9f3862f0f1b6b498249f24b"
     },
     {
       "path": "src/lib/codex-restart-contract.ts",
@@ -1982,7 +1982,7 @@
     },
     {
       "path": "src/lib/pinned-http.ts",
-      "sha256": "ac1cd748e53b16109aaae86194fddac88424b508f00bb2e7c7090869f58c9b22"
+      "sha256": "a363fbb9276b6b807c886c26a58710f6def807e800d0eec2811e7bf90fae3752"
     },
     {
       "path": "src/lib/privacy.ts",
@@ -1990,15 +1990,19 @@
     },
     {
       "path": "src/lib/process-control.ts",
-      "sha256": "1b48b8040679bcf0fd0128aaeee98bd354ae657663b207820b96bd8b573bfec1"
+      "sha256": "8e906a7a70625025658e6277a20bf2dd0dbf43f37ab3cbb46d5c7bb00ea26c87"
     },
     {
       "path": "src/lib/provider-outbound.ts",
-      "sha256": "a1c8576d95e888a92c0f3ae4ca6741e92848ee9bb7dfb4d71f6522108f8b4da2"
+      "sha256": "697a87707334d57da0eb41e70c8e0367778444cc37c670e7bd1b30ec75245c17"
+    },
+    {
+      "path": "src/lib/provider-runtime-fetch.ts",
+      "sha256": "3009c0cd8d142478dc5d0034150266cd03eceebe82eb9743f7417fb4cce7655a"
     },
     {
       "path": "src/lib/provider-tls-profile.ts",
-      "sha256": "4dc211524270f8e5b25febefaeb8eb496d2d455e95cb1b3392e79db47622084c"
+      "sha256": "80eebfde40c4fb08e78649bd00751cf3e0bf97474fd5cf7e41323cfbf1038bd5"
     },
     {
       "path": "src/lib/provider-url.ts",
@@ -2024,6 +2028,10 @@
       "path": "src/lib/server-resource-ownership.ts",
       "sha256": "8248c3758eccbc6abc9150fe041e89fb2d05f114f9fc26cb1fb70a6c3b7403ed"
     },
+    {
+      "path": "src/lib/server-tls.ts",
+      "sha256": "eb9db8a459e1ea7884fbb83a51ebc2c9e64d132ddd5543b20f63b90c63a3ea8d"
+    },
     {
       "path": "src/lib/service-secrets.ts",
       "sha256": "2294a011014c249adea0571a1b8e9ce51d76b7c59e654bf9795f360d7ee1b53e"
@@ -2056,6 +2064,14 @@
       "path": "src/lib/test-home-guard.ts",
       "sha256": "da554cdbad6dcadc4bfac238eea77e71629c53b28232017756d8546df92d9603"
     },
+    {
+      "path": "src/lib/test-provider-fetch.ts",
+      "sha256": "ee6111d9f7710be7341cf1fd7c9502c375277a0c1b26de0ccf76c7bd054d8529"
+    },
+    {
+      "path": "src/lib/test-server-start.ts",
+      "sha256": "bbd67095589096c185f22310bc581a0604eaa59e094d595149bfa1ccaa9507ae"
+    },
     {
       "path": "src/lib/token-estimate.ts",
       "sha256": "c90473299655c86ef0118f5a265a71c100bf92e52172d6464a16c8f6ea300ca5"
@@ -2078,7 +2094,7 @@
     },
     {
       "path": "src/lib/upstream-retry.ts",
-      "sha256": "520d6f4b0630d31fe3180055b80f60ae6c7e196b5eb6ecc2ab1181b911c91b9d"
+      "sha256": "61201107a882045f524f0739f45ddc1b3a17dce8b633337e78c634082e418c24"
     },
     {
       "path": "src/lib/win-exec.ts",
@@ -2158,7 +2174,7 @@
     },
     {
       "path": "src/oauth/anthropic.ts",
-      "sha256": "e09817a0f46855c12678bb919d01611f5815357ace010940c67533945a0eff62"
+      "sha256": "ecb556d5873dd001c32f5fd928106191744615c5486836aa5b0d80fbca3e4cdb"
     },
     {
       "path": "src/oauth/antigravity-routing.ts",
@@ -2170,11 +2186,11 @@
     },
     {
       "path": "src/oauth/chatgpt.ts",
-      "sha256": "96bb2c747effa78b35d8a7d8f61647ee3c190a852077e29cdc3d7b6a36dd8d1f"
+      "sha256": "afe0ab0ea17fba30567da47a810369882f6d2842e5c23cd2f001ca88ae863c8b"
     },
     {
       "path": "src/oauth/command-code.ts",
-      "sha256": "2894d55a6c2fc644f76a003897893e5fd833887e312b971b772ce1ee3f24a650"
+      "sha256": "aaff68e4240b6154ecf88ea4ca96469c26c77b79f462a75f81685642510246e9"
     },
     {
       "path": "src/oauth/cursor-routing.ts",
@@ -2182,7 +2198,7 @@
     },
     {
       "path": "src/oauth/cursor.ts",
-      "sha256": "afc515c357f5bc9f788c07e40a0a1fce6ef3d9887759906e5a48113a720d5673"
+      "sha256": "9b5225d7b195cd0ecc5da2bddcfaa30915110d8c9566c88ea813fe83aa32a5a1"
     },
     {
       "path": "src/oauth/generic-account-failover.ts",
@@ -2190,7 +2206,7 @@
     },
     {
       "path": "src/oauth/github-copilot.ts",
-      "sha256": "e0bfa9fa518ffc9b04ec81090540cf614ca217ca7ca3f356bc6f74efb6b1e38f"
+      "sha256": "f7b3dfb84a78733d5c90ca962d392d97d0cc74baf9934ab1e6f3dcaebf71abad"
     },
     {
       "path": "src/oauth/google-aistudio-auth.ts",
@@ -2198,7 +2214,7 @@
     },
     {
       "path": "src/oauth/google-antigravity.ts",
-      "sha256": "a5546286e647862c4b6be097495e10ec75ba0026f4c20ab8cb277c1d2697893d"
+      "sha256": "3ca27e7b3325efa6e01f0d499b49e4375184ad0a5299552282e46fc2784db69e"
     },
     {
       "path": "src/oauth/health.ts",
@@ -2210,11 +2226,11 @@
     },
     {
       "path": "src/oauth/key-providers.ts",
-      "sha256": "dde0a01280fc4b58fe0b58bb14e2a5efbaf417eaf6dd1ec4c163d50ad6681b84"
+      "sha256": "45636c0ce520a26111f8e2e84999b15c124a1cd9151a84ce693fcc77a7d67d5d"
     },
     {
       "path": "src/oauth/kimi.ts",
-      "sha256": "cbbd772bfcf74c1bf6357d494b1b87034c59fbc9ebeda0ccc93e31df431d4a30"
+      "sha256": "a1676c8db242db6295d2c0d6c4fc634cbbbdd8385d0563c520bd5f5fb43eab75"
     },
     {
       "path": "src/oauth/kiro-credentials.ts",
@@ -2222,7 +2238,7 @@
     },
     {
       "path": "src/oauth/kiro.ts",
-      "sha256": "81cf6027776e471bf1cfa5122b79e8fb8db7492e905f1521ebc7edcea7861231"
+      "sha256": "8ad77d0dcbf3621a345597bedb404b1ff3e090518d7f49e36d275120e307bc18"
     },
     {
       "path": "src/oauth/local-token-detect.ts",
@@ -2238,7 +2254,7 @@
     },
     {
       "path": "src/oauth/nous.ts",
-      "sha256": "49fb089b01a8a118e575069d2308912b7fd661ef882913193b0e9f4d8df28201"
+      "sha256": "d2f9b76fc83eec366a2d7e3f41c6082e06f4996790df9a3ad64797bc69e8c395"
     },
     {
       "path": "src/oauth/open-browser-choice.ts",
@@ -2256,13 +2272,17 @@
       "path": "src/oauth/token-guardian.ts",
       "sha256": "61ab6a126dfec880425247cbe1c09ae387777f5a44cadfd47a96f59b6faf3274"
     },
+    {
+      "path": "src/oauth/transport.ts",
+      "sha256": "7b169a87f47cbede9ef9a83e7509a89d469ddea4bd2a696947db72859ccbfff3"
+    },
     {
       "path": "src/oauth/types.ts",
       "sha256": "4d73927bc99a8363297d6e213fc076c498f524f9400c163e0e6a7c8bfc1a1fe6"
     },
     {
       "path": "src/oauth/xai.ts",
-      "sha256": "4dad067c9efba0a966621f94da96decc3b5bc35cf4e076536eced0abb9fa8c88"
+      "sha256": "180f3722ed6150f3bd7516e90793dc75957239ef983b5183be72d7f70120b192"
     },
     {
       "path": "src/providers/alibaba-region-backup.ts",
@@ -2430,7 +2450,7 @@
     },
     {
       "path": "src/providers/replit/probe.ts",
-      "sha256": "1b80b009dcaee74f418988465b98169f6fbd317797e9c3a1feef4dc2404be7bb"
+      "sha256": "de93c3d11ce2433769d9c476f438223c9e899739987680367241106990280602"
     },
     {
       "path": "src/providers/replit/setup.ts",
@@ -2458,7 +2478,7 @@
     },
     {
       "path": "src/providers/xai-transport.ts",
-      "sha256": "1ac6638465ad2b2a36603ee36aa53176474f9c6ca3253db0a43933ed7b20371d"
+      "sha256": "cae0b92dbabb22ebdfa3ede93b68234cf5159808297d31de7015a11fd6eedd50"
     },
     {
       "path": "src/reasoning-effort.ts",
@@ -2670,7 +2690,7 @@
     },
     {
       "path": "src/server/auth-cors.ts",
-      "sha256": "21cb735d7983be6e9f7666a887ea5c58509b32e4ea95cb6392720e9c6d6fc988"
+      "sha256": "3f99dc1c0ab291269b0c7b7e2dff56f41f80fe388a69c4a114de871029a074ed"
     },
     {
       "path": "src/server/background-lifecycle.ts",
@@ -2686,7 +2706,7 @@
     },
     {
       "path": "src/server/chat-native.ts",
-      "sha256": "9af301cd743f2501d271f083bb54e1f9bea10c11bb2ac6286542051ab442f6e8"
+      "sha256": "6581fb3a76b0e14d4f274494a0072cddd7f06f565ade314757bc3e1f0ae8a676"
     },
     {
       "path": "src/server/claude-messages.ts",
@@ -2718,7 +2738,7 @@
     },
     {
       "path": "src/server/index.ts",
-      "sha256": "748a821368960a58228937a15582cb05a087bcc438849d367dc74c05eb5dbf6c"
+      "sha256": "aac79178e0b42ac34c44a653e5ce8549872b940029fcb442b51ed1e1782c75fb"
     },
     {
       "path": "src/server/lifecycle.ts",
@@ -2770,11 +2790,11 @@
     },
     {
       "path": "src/server/management/config-routes.ts",
-      "sha256": "090f6f7ba1d80d2d23fc090134fa6dc4e7114a646d3c41dd4b08eb137255964a"
+      "sha256": "8c081f833a90272aece21bad4b24a422062bd60682bf758dd107337d8f3158b7"
     },
     {
       "path": "src/server/management/context.ts",
-      "sha256": "13dfe2bb83ddc157d53b5e5e9340a677d9a80fbf0209f63d8598a8e9da44f269"
+      "sha256": "5f848d9659be27b9be820a8d9ba35165cf158a32880031ce40a4422dc12e5ace"
     },
     {
       "path": "src/server/management/integration-routes.ts",
@@ -2814,7 +2834,7 @@
     },
     {
       "path": "src/server/management/provider-routes.ts",
-      "sha256": "7abf9c86655670bc2de1383577b85e1a4cac5e92447d2a77421820e3126a2d97"
+      "sha256": "de8acf5e2bae0daa09cbb5dc5c602ae469a1b149f9704faf3b6fe9a14bea945a"
     },
     {
       "path": "src/server/management/replit-provider-routes.ts",
@@ -2982,11 +3002,11 @@
     },
     {
       "path": "src/server/responses/compact.ts",
-      "sha256": "3b1027396757b2771702449bccd5f5ea9eb8826945fee0b8f6c8f1f98e9635e1"
+      "sha256": "6be3d086b7796426787120cc0e76e3a3f2aacddb841af389aee885a75622ea8b"
     },
     {
       "path": "src/server/responses/core.ts",
-      "sha256": "abdf102878d968d337a871bee32106f25cf3434a67d1e2669c1109b6bede9687"
+      "sha256": "5da1a9f0fe0f8fc397c50c099adb77360d532e40a87858a45489f61735a938d5"
     },
     {
       "path": "src/server/responses/empty-completion-guard.ts",
@@ -2998,7 +3018,7 @@
     },
     {
       "path": "src/server/responses/fetch-helpers.ts",
-      "sha256": "951153aa7dd15eeab8ec4d157013b246d1ae3116e91d7126d8ecd54bba4d538c"
+      "sha256": "68f46232edbdf21cf592793341817dddc92cd31631c458d0d600f3fe4d57266b"
     },
     {
       "path": "src/server/responses/input-admission.ts",
@@ -3074,7 +3094,7 @@
     },
     {
       "path": "src/server/ws-bridge.ts",
-      "sha256": "0f7ea03225ddd992fad14dab1dda99a3890a380061f99f0e94fb05efb33e421f"
+      "sha256": "8a15128a892fd89f7ed02f24489a2f3d417bb4c137f08cb3f52d4b94a303a5eb"
     },
     {
       "path": "src/service-manager-probe.ts",
@@ -3082,7 +3102,7 @@
     },
     {
       "path": "src/service.ts",
-      "sha256": "03739ace3f831125620b1653c0549d693e4ae67ebd6502604db439b86f38dc35"
+      "sha256": "37313ff096a4407ebf24d9d101dd68e7cd1e7243e4f3b1cba6650a390f7e71e3"
     },
     {
       "path": "src/sidecar/auth.ts",
@@ -3202,7 +3222,7 @@
     },
     {
       "path": "src/types.ts",
-      "sha256": "52a9a716b71144a484f6b4cd464fce8331860a24c0f852234bf6e0fec2f573c3"
+      "sha256": "a1e341023c239f28c0c576c368ebfc2cacc1ce27d8ef71afe28455d4cff5ae86"
     },
     {
       "path": "src/types/accounts.ts",
@@ -3210,11 +3230,11 @@
     },
     {
       "path": "src/types/config.ts",
-      "sha256": "2947399e84229ff915fbe1677b4b29ddefafbde0cf42a10bdb130460fa1715fd"
+      "sha256": "25dc149222b5fca494828091dfe47f835173b27c95320094a595295cd1bc06b7"
     },
     {
       "path": "src/types/provider.ts",
-      "sha256": "e937e0f60553ce3ac100343dff5f911516e667e96869e991c1a7017ed0262da4"
+      "sha256": "4b8412a256df4b69e8947c3e501c919dad20752fca63bc9cf3403eb02ff2c122"
     },
     {
       "path": "src/types/request.ts",

package/src/lib/bun-stream-caps.ts

@@ -106,11 +106,12 @@ export function selectEagerPath(
   version: string = Bun.version,
   minFixed: string | null = MIN_FIXED_BUN_VERSION,
 ): EagerRelayDecision | null {
-  if (platform !== "win32" && platform !== "darwin") {
+  if (platform !== "win32" && platform !== "darwin" && platform !== "linux") {
     return null;
   }
 
   const decision = decideEagerRelay(mode, version, minFixed);
+  if (platform === "linux") return decision;
   if (platform === "win32") return needsClientRewrite ? null : decision;
   return decision.reason === "config-eager" ? decision : null;
 }

package/src/lib/pinned-http.ts

@@ -173,7 +173,10 @@ function pinnedHttpRequest(
               failBody(new PinnedHttpError("output_byte_limit", `${context} exceeds ${maxBytes} byte cap`));
               return;
             }
-            try { controller.enqueue(buffer); } catch { /* closed */ }
+            try {
+              controller.enqueue(buffer);
+              if ((controller.desiredSize ?? 0) <= 0) response.pause();
+            } catch { /* closed */ }
           });
           response.on("end", () => {
             if (bodySettled) return;
@@ -184,6 +187,9 @@ function pinnedHttpRequest(
             failBody(error);
           });
         },
+        pull() {
+          response.resume();
+        },
         cancel() {
           req?.destroy();
         },

package/src/lib/process-control.ts

@@ -25,7 +25,7 @@ export function waitForExit(pid: number, timeoutMs: number): boolean {
 /** Injectable seams so the graceful-stop flow is unit-testable without a live proxy. */
 export interface GracefulStopIo {
   fetchFn?: typeof fetch;
-  readRuntime?: (pid: number) => { port: number; hostname?: string } | null;
+  readRuntime?: (pid: number) => { port: number; hostname?: string; origin?: string } | null;
   waitExit?: (pid: number, timeoutMs: number) => boolean;
   env?: Record<string, string | undefined>;
   exitTimeoutMs?: number;
@@ -75,7 +75,8 @@ export async function stopProxyGracefully(pid: number, io: GracefulStopIo = {}):
   if (token) headers["x-opencodex-api-key"] = token;
   const fetchFn = io.fetchFn ?? fetch;
   try {
-    const res = await fetchFn(`http://${gracefulStopHost(runtime.hostname)}:${runtime.port}/api/stop`, {
+    const baseUrl = runtime.origin ?? `http://${gracefulStopHost(runtime.hostname)}:${runtime.port}`;
+    const res = await fetchFn(`${baseUrl}/api/stop`, {
       method: "POST",
       headers,
       // Hung proxies with many CLOSE_WAIT clients can be slow to accept; give them

package/src/lib/provider-outbound.ts

@@ -7,20 +7,20 @@ import {
   resolvePublicAddresses,
 } from "./destination-policy";
 import { pinnedHttpGet, pinnedHttpPost } from "./pinned-http";
-import { noProxyMatches, outboundProxyConfigured, proxyForUrl } from "./proxy-env";
+import { proxyForUrl } from "./proxy-env";
 import { publicProviderBaseUrl } from "./provider-url";
 import { antigravityOAuthDestinationConfigError, isCanonicalAntigravityUrl, providerTlsFetch } from "./provider-tls-profile";
 import { waitForProviderRequestSlot } from "../providers/request-pacing";
+import { testProviderFetch } from "./test-provider-fetch";
 
 type ProviderGetInit = Omit<RequestInit, "body" | "method" | "redirect">;
 type ProviderPostInit = ProviderGetInit & { body: string };
-type ProviderOutboundConfig = Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork"> & Partial<Pick<OcxProviderConfig, "adapter" | "authMode" | "googleMode" | "tlsProfile">> & {
-  fetch?: typeof globalThis.fetch;
-};
+type ProviderOutboundConfig = Pick<OcxProviderConfig, "baseUrl" | "allowPrivateNetwork"> & Partial<Pick<OcxProviderConfig, "adapter" | "authMode" | "googleMode" | "tlsProfile">>;
 export interface ProviderOutboundDependencies {
   resolveAddresses?: typeof resolvePublicAddresses;
   pinnedGet?: typeof pinnedHttpGet;
   pinnedPost?: typeof pinnedHttpPost;
+  fetch?: typeof globalThis.fetch;
 }
 
 export class ProviderOutboundPolicyError extends Error {
@@ -31,10 +31,6 @@ function pickPinnedAddress(addresses: Array<{ address: string; family: number }>
   return addresses.find(address => address.family === 4) ?? addresses[0]!;
 }
 
-function configuredProxyFor(): boolean {
-  return outboundProxyConfigured();
-}
-
 function normalizeProxyHostname(hostname: string): string {
   const normalized = hostname.trim().toLowerCase().replace(/\.+$/, "");
   return normalized.startsWith("[") && normalized.endsWith("]")
@@ -48,7 +44,6 @@ function antigravityProfileFetch(
   url: string,
 ): typeof globalThis.fetch | undefined {
   if (name !== "google-antigravity"
-    || provider.fetch
     || provider.tlsProfile !== "antigravity-browser"
     || provider.adapter !== "google"
     || provider.authMode !== "oauth"
@@ -88,12 +83,41 @@ function warnProxyDnsDegradationOnce(): void {
 export async function providerRedirectError(response: Response, requestUrl: string): Promise<string | null> {
   if (response.status < 300 || response.status >= 400) return null;
   try { await response.body?.cancel(); } catch { /* ignore cancellation failures */ }
-  const location = response.headers.get("location");
-  let target = "the final upstream URL";
-  if (location) {
-    try { target = publicProviderBaseUrl(new URL(location, requestUrl).toString()); } catch { /* keep fallback */ }
+  return `provider at ${publicProviderBaseUrl(requestUrl)} returned ${response.status} redirect; configure the final provider URL directly`;
+}
+
+async function requireFinalProviderResponse(response: Response, requestUrl: string): Promise<Response> {
+  const redirectError = await providerRedirectError(response, requestUrl);
+  if (redirectError) throw new ProviderOutboundPolicyError(redirectError);
+  return response;
+}
+
+const CREDENTIAL_HEADERS = new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "x-api-key",
+  "x-goog-api-key",
+  "x-amz-security-token",
+  "x-opencodex-api-key",
+]);
+
+function hasCredentialHeader(headers: HeadersInit | undefined): boolean {
+  if (!headers) return false;
+  for (const name of new Headers(headers).keys()) {
+    const normalized = name.toLowerCase();
+    if (CREDENTIAL_HEADERS.has(normalized)
+      || /(?:^|-)(?:api-key|access-token|auth-token|security-token)$/.test(normalized)) return true;
+  }
+  return false;
+}
+
+function urlCarriesCredential(url: URL): boolean {
+  if (url.username || url.password) return true;
+  for (const name of url.searchParams.keys()) {
+    if (/^(?:api[-_]?key|access[-_]?token|auth(?:orization)?|password|secret|token)$/i.test(name)) return true;
   }
-  return `provider returned ${response.status} redirect to ${target}; configure the final provider URL directly`;
+  return false;
 }
 
 async function providerOutboundRequest(
@@ -113,8 +137,17 @@ async function providerOutboundRequest(
   if (postUrl?.protocol !== undefined && postUrl.protocol !== "https:") {
     throw new ProviderOutboundPolicyError("provider POST URL must use HTTPS");
   }
+  const parsed = postUrl ?? new URL(url);
+  if (method === "GET"
+    && parsed.protocol !== "https:"
+    && (hasCredentialHeader(init.headers) || urlCarriesCredential(parsed))) {
+    const destination = assessUrlDestination(url)?.kind;
+    if (destination !== "localhost" && destination !== "loopback") {
+      throw new ProviderOutboundPolicyError("credential-bearing provider GET URL must use HTTPS except for loopback");
+    }
+  }
   const profiledFetch = antigravityProfileFetch(name, provider, url);
-  const fetchOverride = provider.fetch ?? profiledFetch;
+  const fetchOverride = dependencies.fetch ?? testProviderFetch(provider) ?? profiledFetch;
   if (profiledFetch) {
     // Keep the profiled executor behind the same pre-dispatch DNS boundary as
     // the pinned path. A proxy owns peer selection, so match the existing
@@ -126,7 +159,10 @@ async function providerOutboundRequest(
         allowPrivateNetwork: false,
       });
     }
-    return fetchOverride!(url, { ...init, method, redirect: "manual" });
+    return requireFinalProviderResponse(
+      await fetchOverride!(url, { ...init, method, redirect: "manual" }),
+      url,
+    );
   }
   if (fetchOverride) {
     // A caller-owned executor cannot be peer-pinned here. This branch keeps literal/config
@@ -147,10 +183,12 @@ async function providerOutboundRequest(
       });
       if (destinationError) throw new ProviderOutboundPolicyError(destinationError);
     }
-    return fetchOverride(url, { ...init, method, redirect: "manual" });
+    return requireFinalProviderResponse(
+      await fetchOverride(url, { ...init, method, redirect: "manual" }),
+      url,
+    );
   }
-  const parsed = postUrl ?? new URL(url);
-  const proxyConfigured = configuredProxyFor();
+  const selectedProxy = proxyForUrl(parsed);
   const resolveAddresses = dependencies.resolveAddresses ?? resolvePublicAddresses;
   const pinnedGet = dependencies.pinnedGet ?? pinnedHttpGet;
   const pinnedPost = dependencies.pinnedPost ?? pinnedHttpPost;
@@ -166,7 +204,7 @@ async function providerOutboundRequest(
       // destination or being pin-connected to the fake-IP (credit #1748). A NO_PROXY
       // match is a direct route, so it keeps the benchmark answer rejected. Image/Lab
       // fetch never passes this flag.
-      allowBenchmarkAddresses: proxyConfigured && !noProxyMatches(parsed),
+      allowBenchmarkAddresses: selectedProxy !== undefined,
     });
   } catch (error) {
     const dnsResolutionFailed = error instanceof DestinationDnsResolutionError
@@ -174,16 +212,22 @@ async function providerOutboundRequest(
     if (!dnsResolutionFailed) {
       throw new ProviderOutboundPolicyError(error instanceof Error ? error.message : "provider destination was blocked");
     }
-    if (!proxyConfigured) throw error;
+    if (!selectedProxy) throw error;
     warnProxyBoundaryOnce();
     warnProxyDnsDegradationOnce();
-    return globalThis.fetch(url, { ...init, method, redirect: "manual" });
+    return requireFinalProviderResponse(
+      await globalThis.fetch(url, { ...init, method, redirect: "manual" }),
+      url,
+    );
   }
-  if (proxyConfigured && !resolved.privateNetwork) {
+  if (selectedProxy && !resolved.privateNetwork) {
     warnProxyBoundaryOnce();
-    return globalThis.fetch(url, { ...init, method, redirect: "manual" });
+    return requireFinalProviderResponse(
+      await globalThis.fetch(url, { ...init, method, redirect: "manual" }),
+      url,
+    );
   }
-  if (proxyConfigured && resolved.privateNetwork && !noProxyMatches(parsed)) {
+  if (selectedProxy && resolved.privateNetwork) {
     const hostname = normalizeProxyHostname(parsed.hostname);
     throw new Error(
       `provider URL resolves to a private-network destination; add ${hostname} to NO_PROXY before using allowPrivateNetwork with an outbound proxy`,
@@ -196,9 +240,15 @@ async function providerOutboundRequest(
   };
   const pinned = pickPinnedAddress(resolved.addresses);
   if (method === "POST") {
-    return pinnedPost(url, pinned, (init as ProviderPostInit).body, init.signal ?? undefined, requestOptions);
+    return requireFinalProviderResponse(
+      await pinnedPost(url, pinned, (init as ProviderPostInit).body, init.signal ?? undefined, requestOptions),
+      url,
+    );
   }
-  return pinnedGet(url, pinned, init.signal ?? undefined, requestOptions);
+  return requireFinalProviderResponse(
+    await pinnedGet(url, pinned, init.signal ?? undefined, requestOptions),
+    url,
+  );
 }
 
 export async function providerOutboundGet(