@yansigit/opencodex 2.36.1 → 2.36.2-dev.20260829.53

package/src/oauth/key-providers.ts

@@ -2,6 +2,7 @@ import type { OcxProviderConfig } from "../types";
 import { deriveKeyLoginMap, enrichProviderFromRegistry, type DerivedKeyLoginProvider } from "../providers/derive";
 import { resolveProviderModelDiscoveryUrl } from "../providers/model-discovery";
 import { parseGoogleCookieJar, validateAiStudioCookies } from "./google-aistudio-auth";
+import { providerOutboundGet, providerOutboundPost, type ProviderOutboundDependencies } from "../lib/provider-outbound";
 
 /**
  * API-key "login" providers: not OAuth — the flow opens the provider's dashboard so the user can
@@ -72,6 +73,7 @@ export async function validateApiKey(
   providerName: string,
   provider: KeyLoginProvider,
   key: string,
+  dependencies: Pick<ProviderOutboundDependencies, "fetch"> = {},
 ): Promise<boolean | "unknown"> {
   try {
     // A public model catalog cannot prove that the supplied key is valid. Returning unknown keeps
@@ -80,17 +82,15 @@ export async function validateApiKey(
 
     if (provider.adapter === "anthropic") {
       const base = provider.baseUrl.replace(/\/v1\/?$/, "");
-      const res = await fetch(`${base}/v1/messages`, {
-        method: "POST",
+      const res = await providerOutboundPost(providerName, provider, `${base}/v1/messages`, {
         headers: anthropicKeyValidationHeaders(provider, key),
+        signal: AbortSignal.timeout(8_000),
         body: JSON.stringify({
           model: provider.defaultModel ?? "claude-haiku-4-5",
           max_tokens: 1,
           messages: [{ role: "user", content: "ping" }],
         }),
-        redirect: "error",
-        signal: AbortSignal.timeout(8000),
-      });
+      }, dependencies);
       if (res.ok) return true;
       if (res.status === 401 || res.status === 403) return false;
       return "unknown";
@@ -106,11 +106,10 @@ export async function validateApiKey(
     if (provider.adapter === "google" && (provider.googleMode ?? "ai-studio") === "ai-studio") {
       // Generative Language API rejects Bearer-wrapped API keys; probe models.list with the
       // documented x-goog-api-key header instead (pageSize=1 — validation only needs a 200).
-      const res = await fetch(`${provider.baseUrl}/v1beta/models?pageSize=1`, {
+      const res = await providerOutboundGet(providerName, provider, `${provider.baseUrl}/v1beta/models?pageSize=1`, {
         headers: { "x-goog-api-key": key },
-        redirect: "error",
-        signal: AbortSignal.timeout(8000),
-      });
+        signal: AbortSignal.timeout(8_000),
+      }, dependencies);
       if (res.ok) return true;
       if (res.status === 400 || res.status === 401 || res.status === 403) return false;
       return "unknown";
@@ -127,11 +126,10 @@ export async function validateApiKey(
       provider.baseUrl,
       `${provider.baseUrl}/models`,
     );
-    const res = await fetch(modelsUrl, {
+    const res = await providerOutboundGet(providerName, configuredProvider, modelsUrl, {
       headers: { Authorization: `Bearer ${key}` },
-      redirect: "error",
-      signal: AbortSignal.timeout(8000),
-    });
+      signal: AbortSignal.timeout(8_000),
+    }, dependencies);
     if (res.ok) return true;
     if (res.status === 401 || res.status === 403) return false;
     return "unknown";

package/src/oauth/kimi.ts

@@ -6,6 +6,7 @@ import { randomUUID } from "node:crypto";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { getConfigDir } from "../config";
 import type { OAuthController, OAuthCredentials } from "./types";
+import { oauthFetch } from "./transport";
 
 const CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
 const DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
@@ -129,13 +130,13 @@ function getKimiCommonHeaders(): Record<string, string> {
 async function requestDeviceAuthorization(): Promise<{
   userCode: string; deviceCode: string; verificationUriComplete: string; expiresInMs: number; intervalMs: number;
 }> {
-  const response = await fetch(`${resolveOAuthHost()}/api/oauth/device_authorization`, {
+  const response = await oauthFetch(`${resolveOAuthHost()}/api/oauth/device_authorization`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded", ...getKimiCommonHeaders() },
     body: new URLSearchParams({ client_id: CLIENT_ID }),
   });
   if (!response.ok) {
-    throw new Error(`Kimi device authorization failed: ${response.status} ${await response.text()}`);
+    throw new Error(`Kimi device authorization failed: ${response.status}`);
   }
   const payload = (await response.json()) as DeviceAuthorizationResponse;
   if (!payload.user_code || !payload.device_code || !payload.verification_uri) {
@@ -184,7 +185,7 @@ async function pollForToken(deviceCode: string, intervalMs: number, expiresInMs:
   let waitMs = Math.max(1000, intervalMs);
   while (Date.now() < deadline) {
     if (signal?.aborted) throw new Error("Login cancelled");
-    const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
+    const response = await oauthFetch(`${resolveOAuthHost()}/api/oauth/token`, {
       method: "POST",
       headers: { "Content-Type": "application/x-www-form-urlencoded", ...getKimiCommonHeaders() },
       body: new URLSearchParams({ client_id: CLIENT_ID, device_code: deviceCode, grant_type: "urn:ietf:params:oauth:grant-type:device_code" }),
@@ -202,7 +203,7 @@ async function pollForToken(deviceCode: string, intervalMs: number, expiresInMs:
     }
     if (error === "expired_token") throw new Error("Kimi device authorization expired");
     if (error === "access_denied") throw new Error("Kimi device authorization denied");
-    throw new Error(`Kimi device flow failed: ${error ?? response.status}${payload.error_description ? `: ${payload.error_description}` : ""}`);
+    throw new Error(`Kimi device flow failed (${response.status})`);
   }
   throw new Error("Kimi device flow timed out");
 }
@@ -222,14 +223,14 @@ export async function loginKimi(ctrl: OAuthController): Promise<OAuthCredentials
 }
 
 export async function refreshKimiToken(refreshToken: string): Promise<OAuthCredentials> {
-  const response = await fetch(`${resolveOAuthHost()}/api/oauth/token`, {
+  const response = await oauthFetch(`${resolveOAuthHost()}/api/oauth/token`, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded", ...getKimiCommonHeaders() },
     body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: CLIENT_ID }),
   });
   if (!response.ok) {
     const payload = (await response.json().catch(() => undefined)) as TokenResponse | undefined;
-    throw new Error(`Kimi token refresh failed: ${response.status}${payload?.error_description ? `: ${payload.error_description}` : ""}`);
+    throw new Error(`Kimi token refresh failed: ${response.status}`);
   }
   return parseTokenPayload((await response.json()) as TokenResponse, refreshToken);
 }

package/src/oauth/kiro.ts

@@ -29,6 +29,7 @@ import {
 import { homedir } from "node:os";
 import { getAccountSet, saveAccountCredential } from "./store";
 import { KIRO_BUILDER_ID_SERVICE_PROFILE_ARN } from "../adapters/kiro-constants";
+import { oauthFetch } from "./transport";
 
 const DEFAULT_REGION = "us-east-1";
 const REFRESH_URL = "https://prod.{region}.auth.desktop.kiro.dev/refreshToken";
@@ -548,7 +549,7 @@ function kiroRefreshSignal(signal?: AbortSignal): AbortSignal {
 
 async function refreshKiroDesktopToken(refresh: string, signal?: AbortSignal, metadata?: KiroOAuthMetadata): Promise<OAuthCredentials> {
   const region = resolveKiroRegion(metadata);
-  const res = await fetch(REFRESH_URL.replace("{region}", region), {
+  const res = await oauthFetch(REFRESH_URL.replace("{region}", region), {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ refreshToken: refresh }),
@@ -584,7 +585,7 @@ async function refreshAwsSsoOidcToken(
   const clientSecret = metadata?.clientSecret;
   if (!clientId || !clientSecret) return refreshKiroDesktopToken(refresh, signal, metadata);
   const region = resolveKiroRegion(metadata);
-  const run = async (refreshToken: string): Promise<Response> => fetch(OIDC_URL.replace("{region}", region), {
+  const run = async (refreshToken: string): Promise<Response> => oauthFetch(OIDC_URL.replace("{region}", region), {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({

package/src/oauth/nous.ts

@@ -40,6 +40,7 @@ import type { OAuthController, OAuthCredentials } from "./types";
 import { getAuthStorePath } from "./store";
 import { atomicWriteFile, hardenConfigDir, hardenExistingSecret } from "../config";
 import { BOUNDED_BODY_MAX_BYTES, readBoundedResponseBytes } from "../lib/bounded-body";
+import { oauthFetch } from "./transport";
 
 export const NOUS_PORTAL_BASE_URL = "https://portal.nousresearch.com";
 export const NOUS_INFERENCE_BASE_URL = "https://inference-api.nousresearch.com/v1";
@@ -535,7 +536,7 @@ async function requestDeviceAuthorization(signal?: AbortSignal): Promise<{
   intervalMs: number;
 }> {
   const effectiveSignal = requestSignal(signal);
-  const response = await fetch(`${resolvePortalBaseUrl()}/api/oauth/device/code`, {
+  const response = await oauthFetch(`${resolvePortalBaseUrl()}/api/oauth/device/code`, {
     method: "POST",
     headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
@@ -593,7 +594,7 @@ async function pollForToken(
     let response: Response;
     const effectiveSignal = requestSignal(signal);
     try {
-      response = await fetch(`${resolvePortalBaseUrl()}/api/oauth/token`, {
+      response = await oauthFetch(`${resolvePortalBaseUrl()}/api/oauth/token`, {
         method: "POST",
         headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
@@ -646,8 +647,7 @@ async function pollForToken(
     // Unknown OAuth error: report it from the parsed payload, not by
     // re-reading the (already consumed) response body.
     if (error) {
-      const detail = typeof payload.error_description === "string" ? `: ${payload.error_description}` : "";
-      throw new NousTokenError(response.status, String(error), `Nous Portal device authorization failed (${error})${detail}`);
+      throw new NousTokenError(response.status, String(error), `Nous Portal device authorization failed (${response.status})`);
     }
     throw tokenErrorFromPayload(response.status, payload);
   }
@@ -717,7 +717,7 @@ export async function refreshNousToken(refreshToken: string, signal?: AbortSigna
   let response: Response;
   const effectiveSignal = requestSignal(signal);
   try {
-    response = await fetch(`${baseUrl}/api/oauth/token`, {
+    response = await oauthFetch(`${baseUrl}/api/oauth/token`, {
       method: "POST",
       headers: {
         Accept: "application/json",

package/src/oauth/transport.ts

@@ -0,0 +1,77 @@
+const OAUTH_TIMEOUT_MS = 30_000;
+const MAX_OAUTH_RESPONSE_BYTES = 1024 * 1024;
+
+export class OAuthTransportError extends Error {
+  override readonly name = "OAuthTransportError";
+}
+
+async function boundedResponse(response: Response, signal: AbortSignal): Promise<Response> {
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > MAX_OAUTH_RESPONSE_BYTES) {
+    try { await response.body?.cancel(); } catch { /* ignore cancellation failures */ }
+    throw new OAuthTransportError("OAuth response exceeded 1 MiB");
+  }
+  if (!response.body) return response;
+  const reader = response.body.getReader();
+  const abort = () => { void reader.cancel(signal.reason).catch(() => undefined); };
+  if (signal.aborted) abort();
+  else signal.addEventListener("abort", abort, { once: true });
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_OAUTH_RESPONSE_BYTES) {
+        await reader.cancel().catch(() => undefined);
+        throw new OAuthTransportError("OAuth response exceeded 1 MiB");
+      }
+      chunks.push(value);
+    }
+  } finally {
+    signal.removeEventListener("abort", abort);
+    reader.releaseLock();
+  }
+  const body = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+export async function oauthFetch(
+  input: string | URL | Request,
+  init: RequestInit = {},
+  executor: typeof globalThis.fetch = globalThis.fetch,
+): Promise<Response> {
+  let url: URL;
+  try {
+    url = input instanceof Request ? new URL(input.url) : new URL(String(input));
+  } catch {
+    throw new OAuthTransportError("OAuth endpoint is invalid");
+  }
+  if (url.username || url.password) throw new OAuthTransportError("OAuth endpoint must not contain credentials");
+  if (url.protocol !== "https:") throw new OAuthTransportError("OAuth endpoint must use HTTPS");
+  const timeout = AbortSignal.timeout(OAUTH_TIMEOUT_MS);
+  const signal = init.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
+  try {
+    const response = await executor(input, { ...init, redirect: "manual", signal });
+    if (response.status >= 300 && response.status < 400) {
+      try { await response.body?.cancel(); } catch { /* ignore cancellation failures */ }
+      throw new OAuthTransportError(`OAuth endpoint refused the request (HTTP ${response.status})`);
+    }
+    return await boundedResponse(response, signal);
+  } catch (error) {
+    if (error instanceof OAuthTransportError) throw error;
+    if (init.signal?.aborted) throw init.signal.reason;
+    if (timeout.aborted) throw timeout.reason;
+    throw new OAuthTransportError("OAuth request failed");
+  }
+}

package/src/oauth/xai.ts

@@ -2,6 +2,7 @@
 import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
 import { generatePKCE } from "./pkce";
 import type { LocalTokenImportMode, OAuthController, OAuthCredentials } from "./types";
+import { oauthFetch } from "./transport";
 
 const XAI_OAUTH_ISSUER = "https://auth.x.ai";
 export const XAI_OAUTH_DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
@@ -54,12 +55,12 @@ function validateXaiEndpoint(rawUrl: string): string {
 }
 
 export async function discoverXaiOAuthEndpoints(signal?: AbortSignal): Promise<XaiDiscovery> {
-  const response = await fetch(XAI_OAUTH_DISCOVERY_URL, {
+  const response = await oauthFetch(XAI_OAUTH_DISCOVERY_URL, {
     headers: { Accept: "application/json" },
     signal: requestSignal(signal),
   });
   if (!response.ok) {
-    throw new Error(`xAI OAuth discovery failed: ${response.status} ${await response.text()}`);
+    throw new Error(`xAI OAuth discovery failed: ${response.status}`);
   }
 
   const payload = (await response.json()) as XaiDiscoveryPayload;
@@ -96,14 +97,14 @@ export class XaiTokenRequestError extends Error { constructor(public readonly st
 export interface XaiTokenRetryDeps { sleep?:(ms:number)=>Promise<void>; random?:()=>number }
 function isAbortError(error:unknown):boolean{return error instanceof DOMException&&error.name==="AbortError";}
 function retryDelay(attempt:number,retryAfter:string|null,random:()=>number):number{const base=attempt===1?100:250,j=Math.round(base*(.75+random()*.5)),seconds=retryAfter!==null&&/^\d+$/.test(retryAfter)?Number(retryAfter):0;return Math.min(2000,Math.max(j,seconds*1000));}
-async function readTokenError(response:Response):Promise<XaiTokenRequestError>{let oauthError:string|undefined,detail="";try{const body=await response.json() as {error?:unknown;error_description?:unknown};if(typeof body.error==="string")oauthError=body.error;if(typeof body.error_description==="string")detail=body.error_description;}catch{}const suffix=detail?`: ${detail}`:oauthError?`: ${oauthError}`:"";return new XaiTokenRequestError(response.status,oauthError,`xAI token request failed: ${response.status}${suffix}`);}
+async function readTokenError(response:Response):Promise<XaiTokenRequestError>{let oauthError:string|undefined;try{const body=await response.json() as {error?:unknown};if(typeof body.error==="string"&&/^(?:access_denied|expired_token|invalid_client|invalid_grant|invalid_request|temporarily_unavailable|unauthorized_client|unsupported_grant_type)$/.test(body.error))oauthError=body.error;}catch{oauthError=undefined;}return new XaiTokenRequestError(response.status,oauthError,`xAI token request failed: ${response.status}`);}
 export async function postXaiToken(
   tokenEndpoint: string,
   body: Record<string, string>,
   signal?: AbortSignal, deps:XaiTokenRetryDeps={},
 ): Promise<XaiTokenPayload> {
  const sleep=deps.sleep??(ms=>Bun.sleep(ms)),random=deps.random??Math.random;let last:unknown;
- for(let attempt=1;attempt<=3;attempt++){let response:Response;try{response=await fetch(tokenEndpoint, {
+ for(let attempt=1;attempt<=3;attempt++){let response:Response;try{response=await oauthFetch(tokenEndpoint, {
     method: "POST",
     headers: {
       Accept: "application/json",

package/src/providers/replit/probe.ts

@@ -1,4 +1,4 @@
-import { providerOutboundGet, providerRedirectError } from "../../lib/provider-outbound";
+import { ProviderOutboundPolicyError, providerOutboundGet, providerRedirectError } from "../../lib/provider-outbound";
 import { extractProviderModelItems, readBoundedDiscoveryJson } from "../model-discovery";
 import type { OcxProviderConfig } from "../../types";
 import {
@@ -41,6 +41,11 @@ function probeProviderStub(origin: ValidatedReplitOrigin): ProbeProviderConfig {
   };
 }
 
+function probeFailureCategory(error: unknown): "redirect_rejected" | "timeout" | "internal" {
+  if (error instanceof ProviderOutboundPolicyError && / returned 3\d\d redirect;/.test(error.message)) return "redirect_rejected";
+  return error instanceof DOMException && error.name === "TimeoutError" ? "timeout" : "internal";
+}
+
 async function cancelResponseBody(response: Response): Promise<void> {
   try {
     await response.body?.cancel();
@@ -96,7 +101,7 @@ export async function probeReplitGateway(
     return {
       ok: false,
       stage: "healthz",
-      category: error instanceof DOMException && error.name === "TimeoutError" ? "timeout" : "internal",
+      category: probeFailureCategory(error),
       error: error instanceof Error ? error.message : "healthz probe failed",
       latencyMs: Date.now() - healthzStarted,
     };
@@ -132,7 +137,7 @@ export async function probeReplitGateway(
     return {
       ok: false,
       stage: "models",
-      category: error instanceof DOMException && error.name === "TimeoutError" ? "timeout" : "internal",
+      category: probeFailureCategory(error),
       error: error instanceof Error ? error.message : "models probe failed",
       latencyMs: Date.now() - modelsStarted,
     };

package/src/providers/xai-transport.ts

@@ -1,6 +1,8 @@
 import { createHash, randomUUID } from "node:crypto";
 import type { OcxProviderConfig } from "../types";
 import { resolveGithubCopilotTransport } from "./github-copilot-transport";
+import { testProviderFetch } from "../lib/test-provider-fetch";
+import { RUNTIME_PROVIDER_FETCH, type RuntimeProviderFetch } from "../lib/provider-runtime-fetch";
 
 export const XAI_GROK_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
 
@@ -46,6 +48,7 @@ export const XAI_CONV_ID_HEADER = XAI_GROK_COMPATIBILITY.headers.conversationId;
 export type OcxProviderTransport = OcxProviderConfig & {
   /** Request executor used only at runtime; never persisted. */
   fetch?: typeof globalThis.fetch;
+  [RUNTIME_PROVIDER_FETCH]?: RuntimeProviderFetch;
 };
 
 const XAI_GROK_CLI_HEADERS: Readonly<Record<string, string>> = {
@@ -156,14 +159,25 @@ export function resolveProviderTransport(
   // transient retries reuse one id so the upstream can dedupe them. A rotated key resolves a
   // fresh transport, which gets its own id.
   const requestId = configuredRequestId ?? randomUUID();
-  const baseFetch = provider.fetch ?? globalThis.fetch;
+  const baseFetch = testProviderFetch(provider) ?? globalThis.fetch;
   const attemptFetch = ((input, init) =>
     baseFetch(input, withGeneratedRequestId(init, requestId, stableHeaders))) as typeof globalThis.fetch;
 
-  return {
+  const resolved = {
     ...provider,
     ...(provider.authMode === "oauth" ? { baseUrl: XAI_GROK_CLI_BASE_URL } : {}),
     headers,
     fetch: attemptFetch,
   };
+  // Enumerable symbols survive runtime provider spreads (credential/key rotation), while
+  // JSON serialization still cannot persist or accept them from configuration.
+  Object.defineProperty(resolved, RUNTIME_PROVIDER_FETCH, {
+    value: {
+      providerName: "xai",
+      origins: ["https://api.x.ai", "https://cli-chat-proxy.grok.com"],
+      fetch: attemptFetch,
+    },
+    enumerable: true,
+  });
+  return resolved;
 }

package/src/server/auth-cors.ts

@@ -1,4 +1,5 @@
 import { timingSafeEqual } from "node:crypto";
+import { assertServerTlsFiles, serverTlsConfigError } from "../lib/server-tls";
 import { formatErrorResponse } from "../bridge";
 import {
   codexAutoStartEnabled,
@@ -294,7 +295,10 @@ export function requestPolicyView(config: OcxConfig, bindHostname: string): Requ
   };
 }
 
-export function assertServerAuthConfig(config: OcxConfig): void {
+export function assertServerAuthConfig(
+  config: OcxConfig,
+  options: { allowPlaintextRemoteForTests?: boolean } = {},
+): void {
   const hasConfiguredDataCredential = !!configuredApiAuthToken(config)
     || (config.apiKeys ?? []).some(entry => !!entry.key.trim());
   if (isApiAuthRequired(config) && !hasConfiguredDataCredential) {
@@ -302,6 +306,12 @@ export function assertServerAuthConfig(config: OcxConfig): void {
       "A data-plane credential (OPENCODEX_API_AUTH_TOKEN or config.apiKeys) is required when binding opencodex to a non-loopback hostname",
     );
   }
+  const tlsError = serverTlsConfigError(config.tls);
+  if (tlsError) throw new Error(`Invalid server TLS configuration: ${tlsError}`);
+  if (isApiAuthRequired(config) && !config.tls && !options.allowPlaintextRemoteForTests) {
+    throw new Error("Native TLS is required when binding opencodex to a non-loopback hostname; configure tls.certFile, tls.keyFile, and tls.publicOrigin or bind to loopback behind a TLS tunnel");
+  }
+  if (config.tls) assertServerTlsFiles(config.tls);
 }
 
 function secretEquals(actual: string, expected: string | undefined): boolean {
@@ -607,6 +617,9 @@ export function providerManagementConfigError(name: unknown, provider: unknown):
     // it before it reaches the management API response.
     return `provider ${JSON.stringify(redactSecretString(name))} ${retryOn429Error}`;
   }
+  if (raw.replayTransientFailures !== undefined && typeof raw.replayTransientFailures !== "boolean") {
+    return `provider ${JSON.stringify(redactSecretString(name))} replayTransientFailures must be a boolean`;
+  }
   const requestPacingError = requestPacingConfigError(raw.requestPacing);
   if (requestPacingError) {
     return `provider ${JSON.stringify(redactSecretString(name))} ${requestPacingError}`;
@@ -733,6 +746,7 @@ export function safeConfigDTO(config: OcxConfig): unknown {
       "defaultAliases",
       "disabled",
       "allowPrivateNetwork",
+      "replayTransientFailures",
       "authMode",
       "googleMode",
       "apiKeyTransport",

package/src/server/chat-native.ts

@@ -20,7 +20,7 @@ import { resolveClientRetryAfter } from "../lib/retry-after";
 import { isModelTextOnly } from "../vision";
 import {
   applyUpstreamRecoveryInit,
-  fetchWithResetRetry,
+  fetchWithTransientRetry,
   prepareSameTarget429Wait,
   type UpstreamSendRecovery,
 } from "../lib/upstream-retry";
@@ -202,9 +202,10 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
     return fail(400, error instanceof Error ? error.message : String(error), "invalid_request_error");
   }
 
+  const replayBudget = activeProvider.replayTransientFailures ? { remaining: 2 } : undefined;
   const send = async (request: AdapterRequest, recovery?: "rate-limit-429" | "key-429"): Promise<Response> => {
     try {
-      return await fetchWithResetRetry(
+      return await fetchWithTransientRetry(
         (transportRecovery?: UpstreamSendRecovery) => {
           noteAttemptSend(attempt, logCtx.usageLogInputTokens, transportRecovery ?? recovery);
           return fetchWithHeaderTimeout(
@@ -223,7 +224,12 @@ export async function handleNativeChatCompletions(options: HandleNativeChatOptio
             }),
           );
         },
-        { abortSignal: upstream.signal, label: safeHostLabel(request.url) },
+        {
+          abortSignal: upstream.signal,
+          label: safeHostLabel(request.url),
+          replayTransientFailures: activeProvider.replayTransientFailures,
+          replayBudget,
+        },
       );
     } finally {
       request.releaseBodyObservation?.();