codex-multi-auth 2.17.2 → 2.17.3

package/dist/lib/runtime/native-binding-lock.d.ts

@@ -1,3 +1,2 @@
 /** Shared across CLI processes: protect the native provider check and desktop auth write. */
 export declare function withNativeBindingLock<T>(configPath: string, action: () => Promise<T>): Promise<T>;
-//# sourceMappingURL=native-binding-lock.d.ts.map

package/dist/lib/runtime/native-client-auth.d.ts

@@ -1,3 +1,2 @@
 /** Trust the exact local desktop credential, never claims from the incoming bearer. */
 export declare function isNativeClientToken(bearer: string, now: number, read?: () => Promise<string>): Promise<boolean>;
-//# sourceMappingURL=native-client-auth.d.ts.map

package/dist/lib/runtime/native-provider-config.d.ts

@@ -1,4 +1,3 @@
 export { hasNativeProviderConfig } from "../runtime-constants.js";
 export declare function rewriteNativeProviderConfig(content: string, baseUrl: string): string;
 export declare function restoreNativeProviderConfig(content: string, original: string): string;
-//# sourceMappingURL=native-provider-config.d.ts.map

package/dist/lib/runtime/native-rate-limits.d.ts

@@ -7,6 +7,8 @@ export interface NativeUsageAuth {
     codexCliMirror?: CodexCliMirror;
 }
 type Method = 'account/rateLimits/read' | 'account/rateLimitResetCredit/consume';
+/** @internal Native usage needs the desktop backend when it is installed. */
+export declare function resolveNativeUsageCommand(platform?: NodeJS.Platform): string[];
 /** One bounded native RPC session in an isolated home. No refresh token, API key,
  * global configuration, or desktop auth changes are available to this process. */
 export declare function nativeRateLimitsRpc(auth: NativeUsageAuth, method: Method, params: Record<string, unknown>, options?: {
@@ -15,4 +17,3 @@ export declare function nativeRateLimitsRpc(auth: NativeUsageAuth, method: Metho
     timeoutMs?: number;
 }): Promise<unknown>;
 export {};
-//# sourceMappingURL=native-rate-limits.d.ts.map

package/dist/lib/runtime/native-rate-limits.js

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { existsSync, promises as fs } from 'node:fs';
+import { accessSync, constants, existsSync, promises as fs, statSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { isAbsolute, join } from 'node:path';
 import { codexCliAccountIdFor } from '../auth/token-utils.js';
@@ -18,7 +18,8 @@ async function sweepStaleHomes(root) {
         catch { /* Another process owns or already removed it. */ }
     }));
 }
-function nativeCommand() {
+/** @internal Native usage needs the desktop backend when it is installed. */
+export function resolveNativeUsageCommand(platform = process.platform) {
     const override = process.env.CODEX_MULTI_AUTH_USAGE_CODEX_BIN?.trim();
     if (override) {
         if (!isAbsolute(override) || !existsSync(override))
@@ -26,9 +27,25 @@ function nativeCommand() {
         return [override];
     }
     // Prefer the desktop backend whose protocol supplies the native usage UI.
-    const bundled = '/Applications/ChatGPT.app/Contents/Resources/codex';
-    if (process.platform === 'darwin' && existsSync(bundled))
-        return [bundled];
+    const bundled = [
+        '/Applications/ChatGPT.app/Contents/Resources/codex-cli/bin/codex',
+        '/Applications/ChatGPT.app/Contents/Resources/codex',
+    ];
+    if (platform === 'darwin') {
+        const executable = bundled.find(path => {
+            try {
+                if (!statSync(path).isFile())
+                    return false;
+                accessSync(path, constants.X_OK);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (executable)
+            return [executable];
+    }
     try {
         return [process.execPath, createRequire(import.meta.url).resolve('@openai/codex/bin/codex.js')];
     }
@@ -41,7 +58,7 @@ function nativeCommand() {
 export async function nativeRateLimitsRpc(auth, method, params, options = {}) {
     if (!auth.accessToken || !auth.accountId || auth.expiresAt <= Date.now() + 30000)
         throw Error('Native usage requires a fresh account access token');
-    const command = options.command ?? nativeCommand();
+    const command = options.command ?? resolveNativeUsageCommand();
     const executable = command[0];
     if (!executable)
         throw Error('Native usage backend unavailable');

package/dist/lib/runtime/preemptive-quota.d.ts

@@ -10,4 +10,3 @@ export declare function applyRuntimePreemptiveQuotaSettings<TConfig>(pluginConfi
     getPreemptiveQuotaRemainingPercent7d: (config: TConfig) => number;
     getPreemptiveQuotaMaxDeferralMs: (config: TConfig) => number;
 }): void;
-//# sourceMappingURL=preemptive-quota.d.ts.map

package/dist/lib/runtime/quota-headers.d.ts

@@ -4,4 +4,3 @@ export type ParsedCodexQuotaSnapshot = Omit<CodexQuotaSnapshot, "model">;
 export declare function parseResetAtMs(headers: Headers, prefix: string): number | undefined;
 export declare function parseCodexQuotaSnapshot(headers: Headers, status: number): ParsedCodexQuotaSnapshot | null;
 export declare function formatCodexQuotaLine(snapshot: Pick<CodexQuotaSnapshot, "status" | "planType" | "activeLimit" | "primary" | "secondary">): string;
-//# sourceMappingURL=quota-headers.d.ts.map

package/dist/lib/runtime/quota-probe.d.ts

@@ -15,4 +15,3 @@ export declare function fetchRuntimeCodexQuotaSnapshot(params: {
         message?: string;
     };
 }): Promise<CodexQuotaSnapshot>;
-//# sourceMappingURL=quota-probe.d.ts.map

package/dist/lib/runtime/quota-settings.d.ts

@@ -11,4 +11,3 @@ export declare function applyPreemptiveQuotaSettingsFromConfig(pluginConfig: Ret
     getPreemptiveQuotaMaxDeferralMs: (config: ReturnType<typeof import("../config.js").loadPluginConfig>) => number;
 }): void;
 export declare function resolveUiRuntimeFromConfig(loadPluginConfig: () => ReturnType<typeof import("../config.js").loadPluginConfig>, applyUiRuntimeFromConfig: (pluginConfig: ReturnType<typeof import("../config.js").loadPluginConfig>) => ReturnType<typeof import("../ui/runtime.js").getUiRuntimeOptions>): ReturnType<typeof import("../ui/runtime.js").getUiRuntimeOptions>;
-//# sourceMappingURL=quota-settings.d.ts.map

package/dist/lib/runtime/refresh-guardian-entry.d.ts

@@ -29,4 +29,3 @@ export declare function ensureRefreshGuardianEntry<TGuardian>(params: {
     refreshGuardian: TGuardian | null;
     refreshGuardianConfigKey: string | null;
 };
-//# sourceMappingURL=refresh-guardian-entry.d.ts.map

package/dist/lib/runtime/refresh-guardian.d.ts

@@ -21,4 +21,3 @@ export declare function ensureRuntimeRefreshGuardian<TConfig, TGuardian extends
     configKey: string | null;
     cleanupRegistered: boolean;
 };
-//# sourceMappingURL=refresh-guardian.d.ts.map

package/dist/lib/runtime/request-init.d.ts

@@ -2,4 +2,3 @@ export declare function normalizeRuntimeRequestInit(requestInput: Request | stri
 export declare function parseRuntimeRequestBody(body: unknown, deps: {
     logWarn: (message: string) => void;
 }): Promise<Record<string, unknown>>;
-//# sourceMappingURL=request-init.d.ts.map

package/dist/lib/runtime/reset-credit-routing.d.ts

@@ -38,4 +38,3 @@ export declare function applyConfirmedReset(options: {
     now: number;
 }): boolean;
 export {};
-//# sourceMappingURL=reset-credit-routing.d.ts.map

package/dist/lib/runtime/reset-credits.d.ts

@@ -98,4 +98,3 @@ export declare class ResetCreditService {
     private automaticLocked;
 }
 export {};
-//# sourceMappingURL=reset-credits.d.ts.map

package/dist/lib/runtime/response-output-history.d.ts

@@ -14,4 +14,3 @@ export declare class ResponseOutputHistory {
 /** A replay must carry each tool call before its corresponding result. */
 export declare function hasOrphanToolResult(input: unknown): boolean;
 export {};
-//# sourceMappingURL=response-output-history.d.ts.map

package/dist/lib/runtime/responses-websocket.d.ts

@@ -28,4 +28,3 @@ export declare class ResponsesWebSocketGateway {
     private serve;
     close(): void;
 }
-//# sourceMappingURL=responses-websocket.d.ts.map

package/dist/lib/runtime/resume-picker.d.ts

@@ -38,4 +38,3 @@ export declare function pickResumeThread(options: ResumePickerOptions, deps?: {
     select: (items: MenuItem<Choice>[], options: import("../ui/select.js").SelectOptions<Choice>) => Promise<Choice | null>;
 }): Promise<string | null>;
 export {};
-//# sourceMappingURL=resume-picker.d.ts.map

package/dist/lib/runtime/rotation-account-selection.d.ts

@@ -64,4 +64,3 @@ export declare function chooseAccount(params: {
      */
     allowPinnedCooldown?: boolean;
 }): ManagedAccount | null;
-//# sourceMappingURL=rotation-account-selection.d.ts.map

package/dist/lib/runtime/rotation-proxy-state.d.ts

@@ -101,4 +101,3 @@ export interface RotationProxyState extends RotationProxyStateInit {
 export declare function createRotationProxyState(init: RotationProxyStateInit): RotationProxyState;
 /** @internal */
 export declare function recoverStaleRuntimeState(state: RotationProxyState): Promise<AccountManager | null>;
-//# sourceMappingURL=rotation-proxy-state.d.ts.map

package/dist/lib/runtime/rotation-server-types.d.ts

@@ -106,4 +106,3 @@ export interface RuntimeRotationAccountIdentity {
     accountId: string | null;
     updatedAt: number;
 }
-//# sourceMappingURL=rotation-server-types.d.ts.map

package/dist/lib/runtime/rotation-storage-meta.d.ts

@@ -37,4 +37,3 @@ export declare function resetPinCacheForTesting(): void;
  * spinning up the full proxy. See issue #474.
  */
 export declare function maybeInvalidateAffinityFromDisk(sessionAffinityStore: SessionAffinityStore | null, lastObservedGeneration: number, storagePath?: string): number;
-//# sourceMappingURL=rotation-storage-meta.d.ts.map

package/dist/lib/runtime/rotation-token-refresh.d.ts

@@ -22,4 +22,3 @@ export declare function ensureFreshAccessToken(params: {
     retryable: boolean;
     invalidated?: boolean;
 }>;
-//# sourceMappingURL=rotation-token-refresh.d.ts.map

package/dist/lib/runtime/runtime-capability-failures.d.ts

@@ -11,4 +11,3 @@ export declare class RuntimeCapabilityFailures {
     record(credential: string, model: string, kind: CapabilityFailure, effort?: string, tier?: string): void;
     supports(credential: string, model: string, effort?: string, tier?: string): boolean;
 }
-//# sourceMappingURL=runtime-capability-failures.d.ts.map

package/dist/lib/runtime/runtime-current-account.d.ts

@@ -50,4 +50,3 @@ export declare function resolveRuntimeCurrentAccount(storage: AccountStorageV3,
 export declare function resolveAccountCurrentMarkers(index: number, storedCurrentIndex: number, runtimeCurrent: RuntimeCurrentAccountSelection | null): AccountCurrentMarker[];
 export declare function isDisplayCurrentAccount(index: number, storedCurrentIndex: number, runtimeCurrent: RuntimeCurrentAccountSelection | null): boolean;
 export {};
-//# sourceMappingURL=runtime-current-account.d.ts.map

package/dist/lib/runtime/runtime-observability.d.ts

@@ -81,4 +81,3 @@ export declare function recordRuntimeReset(reason: string): void;
 export declare function recordRuntimeAccountRecovery(index: number): void;
 export declare function loadPersistedRuntimeObservabilitySnapshot(): Promise<RuntimeObservabilitySnapshot | null>;
 export {};
-//# sourceMappingURL=runtime-observability.d.ts.map

package/dist/lib/runtime/runtime-services.d.ts

@@ -58,4 +58,3 @@ export declare function ensureSessionAffinityState<TStore extends SessionAffinit
     sessionAffinityConfigKey: string | null;
 };
 export {};
-//# sourceMappingURL=runtime-services.d.ts.map

package/dist/lib/runtime/session-affinity-entry.d.ts

@@ -27,4 +27,3 @@ export declare function ensureSessionAffinityEntry<TStore>(params: {
     sessionAffinityStore: TStore | null;
     sessionAffinityConfigKey: string | null;
 };
-//# sourceMappingURL=session-affinity-entry.d.ts.map

package/dist/lib/runtime/session-recovery.d.ts

@@ -5,4 +5,3 @@ export declare function createRuntimeSessionRecoveryHook(deps: {
     directory: string;
     autoResume: boolean;
 }): import("../recovery.js").SessionRecoveryHook | null;
-//# sourceMappingURL=session-recovery.d.ts.map

package/dist/lib/runtime/status-marker.d.ts

@@ -1,3 +1,2 @@
 import type { UiRuntimeOptions } from "../ui/runtime.js";
 export declare function getRuntimeStatusMarker(ui: UiRuntimeOptions, status: "ok" | "warning" | "error"): string;
-//# sourceMappingURL=status-marker.d.ts.map

package/dist/lib/runtime/storage-scope.d.ts

@@ -10,4 +10,3 @@ export declare function applyAccountStorageScopeFromConfig(pluginConfig: ReturnT
     setStoragePath: (path: string | null) => void;
     cwd: () => string;
 }): void;
-//# sourceMappingURL=storage-scope.d.ts.map

package/dist/lib/runtime/subscription-first-use.d.ts

@@ -7,4 +7,3 @@ export declare class FirstUseProbeError extends Error {
 }
 /** Consume the already-open tiny response, never start a second request. */
 export declare function finishSubscriptionFirstUse(response: Response, timeoutMs: number): Promise<void>;
-//# sourceMappingURL=subscription-first-use.d.ts.map

package/dist/lib/runtime/subscription-quota-event.d.ts

@@ -3,4 +3,3 @@ import type { QuotaSchedulerSnapshot } from "../preemptive-quota-scheduler.js";
 export declare function readSubscriptionQuotaEvent(event: unknown, now: number): (QuotaSchedulerSnapshot & {
     planType?: string;
 }) | null;
-//# sourceMappingURL=subscription-quota-event.d.ts.map

package/dist/lib/runtime/subscription-quota-order.d.ts

@@ -14,4 +14,3 @@ export declare function subscriptionQuotaPreference(entry: QuotaCacheEntry | nul
 export declare function usesSubscriptionReserve(preference: SubscriptionQuotaPreference | undefined): boolean;
 /** Negative means a should be used first. Equal hints leave existing health/affinity scoring intact. */
 export declare function compareSubscriptionQuota(a: SubscriptionQuotaPreference, b: SubscriptionQuotaPreference): number;
-//# sourceMappingURL=subscription-quota-order.d.ts.map

package/dist/lib/runtime/toast.d.ts

@@ -13,4 +13,3 @@ export declare function showRuntimeToast(client: {
     title?: string;
     duration?: number;
 }): Promise<void>;
-//# sourceMappingURL=toast.d.ts.map

package/dist/lib/runtime/ui-runtime-entry.d.ts

@@ -4,4 +4,3 @@ export declare function resolveUiRuntimeEntry(params: {
     resolveUiRuntimeFromConfig: (loadPluginConfig: () => ReturnType<typeof import("../config.js").loadPluginConfig>, applyUiRuntimeFromConfig: (pluginConfig: ReturnType<typeof import("../config.js").loadPluginConfig>) => UiRuntimeOptions) => UiRuntimeOptions;
     applyUiRuntimeFromConfig: (pluginConfig: ReturnType<typeof import("../config.js").loadPluginConfig>) => UiRuntimeOptions;
 }): UiRuntimeOptions;
-//# sourceMappingURL=ui-runtime-entry.d.ts.map

package/dist/lib/runtime/ui-runtime.d.ts

@@ -6,4 +6,3 @@ export declare function applyUiRuntimeFromConfig(pluginConfig: ReturnType<typeof
     glyphMode: ReturnType<typeof getCodexTuiGlyphMode>;
 }) => UiRuntimeOptions): UiRuntimeOptions;
 export declare function getStatusMarker(ui: UiRuntimeOptions, status: "ok" | "warning" | "error"): string;
-//# sourceMappingURL=ui-runtime.d.ts.map

package/dist/lib/runtime/verify-flagged.d.ts

@@ -45,4 +45,3 @@ export declare function verifyRuntimeFlaggedAccounts(deps: {
     now?: () => number;
 }): Promise<void>;
 export {};
-//# sourceMappingURL=verify-flagged.d.ts.map

package/dist/lib/runtime/workspace-model-scopes.d.ts

@@ -12,4 +12,3 @@ export declare function workspaceModelScopes(account: ManagedAccount): {
     workspaceIndex: number;
     enabled: boolean;
 }[];
-//# sourceMappingURL=workspace-model-scopes.d.ts.map

package/dist/lib/runtime-constants.d.ts

@@ -35,4 +35,3 @@ export declare function listRuntimeHelperOwnerPaths(baseDir: string, entries: re
 /** Marker shared by config binding and desktop-auth sync protection. */
 export declare const NATIVE_PROVIDER_BEGIN = "# codex-multi-auth native provider begin";
 export declare function hasNativeProviderConfig(content: string): boolean;
-//# sourceMappingURL=runtime-constants.d.ts.map

package/dist/lib/runtime-paths.d.ts

@@ -55,4 +55,3 @@ export declare function getCodexLogDir(): string;
  * @returns The filesystem path for the legacy directory (e.g. `/home/alice/.codex`).
  */
 export declare function getLegacyCodexDir(): string;
-//# sourceMappingURL=runtime-paths.d.ts.map

package/dist/lib/runtime-rotation-proxy.d.ts

@@ -7,6 +7,7 @@ export type { PinnedUnavailableErrorBody } from "./request/rate-limit-decision.j
 export { chooseAccount } from "./runtime/rotation-account-selection.js";
 export { maybeInvalidateAffinityFromDisk, readPinnedAccountIndexFromDisk, readStorageMetaFromDisk, resetPinCacheForTesting, } from "./runtime/rotation-storage-meta.js";
 export type { StorageMeta } from "./runtime/rotation-storage-meta.js";
+export { resetRuntimePolicyCacheForTests } from "./policy/runtime-policy-cache.js";
 /** @internal Stable identity key for in-memory quota snapshots across reloads. */
 /**
  * Quota-scheduler key prefix identifying ONE account across every family and
@@ -47,4 +48,3 @@ export declare function resolveModelCapacityRetryMs(env?: NodeJS.ProcessEnv): nu
  */
 export declare function normalizeForcedAccountIndex(value: number | string | null | undefined): number | null;
 export declare function startRuntimeRotationProxy(options: RuntimeRotationProxyOptions): Promise<RuntimeRotationProxyServer>;
-//# sourceMappingURL=runtime-rotation-proxy.d.ts.map

package/dist/lib/runtime-rotation-proxy.js

@@ -54,6 +54,7 @@ import { isRecord, sleep } from "./utils.js";
 export { buildPinnedUnavailableErrorBody, buildTokenInvalidationBody, } from "./request/rate-limit-decision.js";
 export { chooseAccount } from "./runtime/rotation-account-selection.js";
 export { maybeInvalidateAffinityFromDisk, readPinnedAccountIndexFromDisk, readStorageMetaFromDisk, resetPinCacheForTesting, } from "./runtime/rotation-storage-meta.js";
+export { resetRuntimePolicyCacheForTests } from "./policy/runtime-policy-cache.js";
 const DEFAULT_HOST = "127.0.0.1";
 function isLoopbackHost(host) {
     const normalized = host.trim().toLowerCase();
@@ -87,6 +88,102 @@ function toUrlHost(host) {
     const bare = stripIpv6Brackets(host);
     return bare.includes(":") ? `[${bare}]` : bare;
 }
+/**
+ * True only for a NUMERIC loopback literal, as `new URL().hostname` reports it.
+ *
+ * Duplicates the wrapper's predicate (scripts/codex.js) at library level — a
+ * hostname like "localhost" is deliberately NOT enough: it is resolved by the
+ * OS at connect time, so an /etc/hosts or Windows hosts entry can point it at
+ * a routable address, and the upstream request carries the managed OAuth
+ * bearer token and the request body. WHATWG URL always reports an IPv6 host in
+ * its bracketed form, so `::1` is only ever seen here as `[::1]`.
+ */
+function isNumericLoopbackUrlHostname(hostname) {
+    if (hostname === "[::1]") {
+        return true;
+    }
+    const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(hostname);
+    if (!ipv4) {
+        return false;
+    }
+    const octets = ipv4.slice(1).map((part) => Number(part));
+    if (octets.some((octet) => !Number.isInteger(octet) || octet > 255)) {
+        return false;
+    }
+    // The whole 127.0.0.0/8 block is loopback, not just 127.0.0.1.
+    return octets[0] === 127;
+}
+/**
+ * Whether the raw URL text carries an explicit `:port` (mirrors the wrapper).
+ *
+ * `new URL()` erases a port that matches the scheme default, so
+ * `http://127.0.0.1:80/x` reports `parsed.port === ""` and a `!parsed.port`
+ * check would reject a perfectly valid, explicitly-ported loopback URL.
+ */
+function urlHasExplicitPort(raw) {
+    const withoutScheme = raw.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "");
+    const authority = withoutScheme.split(/[/?#]/, 1)[0] ?? "";
+    // Strip userinfo first, or a password containing ':' reads as a port.
+    const hostAndPort = authority.slice(authority.lastIndexOf("@") + 1);
+    if (hostAndPort.startsWith("[")) {
+        const close = hostAndPort.indexOf("]");
+        return close !== -1 && /^:\d+$/.test(hostAndPort.slice(close + 1));
+    }
+    const colon = hostAndPort.indexOf(":");
+    return colon !== -1 && /^:\d+$/.test(hostAndPort.slice(colon));
+}
+/**
+ * Library-boundary enforcement for the upstream the proxy forwards managed
+ * OAuth Bearer tokens to (runtime-proxy trust boundary).
+ *
+ * `options.upstreamBaseUrl` is a library input: callers are not all the
+ * wrapper, so the env-var validation in scripts/codex.js does not protect this
+ * boundary. A non-https or non-loopback value would exfiltrate account tokens
+ * to whatever host it names. The policy mirrors the wrapper exactly: https is
+ * always allowed, while http is accepted only for the documented dev path — a
+ * NUMERIC loopback host (127.0.0.0/8 or [::1], never a name) with an explicit
+ * port — and no URL may carry credentials, a query, or a fragment.
+ */
+function assertAllowedUpstreamBaseUrl(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new CodexValidationError(`Runtime rotation proxy upstreamBaseUrl is not a valid absolute URL.`, { field: "upstreamBaseUrl", expected: "an https URL, or an http URL on a numeric loopback host with an explicit port" });
+    }
+    const isDevLoopback = parsed.protocol === "http:" &&
+        isNumericLoopbackUrlHostname(parsed.hostname.toLowerCase()) &&
+        Boolean(parsed.port || urlHasExplicitPort(raw));
+    if ((parsed.protocol !== "https:" && !isDevLoopback) ||
+        parsed.username ||
+        parsed.password ||
+        parsed.search ||
+        parsed.hash) {
+        throw new CodexValidationError(`Runtime rotation proxy refuses upstreamBaseUrl "${raw}". ` +
+            "It forwards managed OAuth tokens: use https, or http only on a " +
+            "numeric loopback host (127.0.0.0/8 or [::1]; a name such as " +
+            '"localhost" can resolve off-host) with an explicit port, and no ' +
+            "credentials, query, or fragment.", {
+            field: "upstreamBaseUrl",
+            expected: "an https URL, or an http URL on a numeric loopback host with an explicit port",
+            context: { upstreamBaseUrl: raw },
+        });
+    }
+}
+/**
+ * Whether a fetch rejection is undici refusing to follow a redirect.
+ *
+ * The upstream fetch runs `redirect: "error"` so a 3xx can never re-send the
+ * managed Bearer token to an arbitrary host. Instead of a Response, fetch
+ * rejects with `TypeError("fetch failed")` whose `cause` is the network error
+ * `unexpected redirect` (see undici's httpNetworkOrCacheFetch). Check the cause
+ * level and the bare message so a custom fetchImpl delivering the same network
+ * error unwrapped classifies identically.
+ */
+function isRedirectRejection(error) {
+    return [error, error?.cause].some((candidate) => candidate instanceof Error && candidate.message === "unexpected redirect");
+}
 // Structured logger for the default-on runtime proxy (errors-logging-01,
 // runtime-proxy-04). Previously the 1900-LOC proxy had zero logger integration;
 // failures surfaced only as a last-write-wins status.lastError string. Logs are
@@ -746,6 +843,13 @@ export async function startRuntimeRotationProxy(options) {
     const bindHost = toBindHost(host);
     const urlHost = toUrlHost(host);
     const port = options.port ?? 0;
+    // Library-boundary trust enforcement: the wrapper validates the env override,
+    // but options.upstreamBaseUrl reaches here from any caller — and Bearer
+    // tokens are forwarded to whatever host it names. https always passes; http
+    // is allowed only for the documented numeric-loopback dev path.
+    if (options.upstreamBaseUrl !== undefined) {
+        assertAllowedUpstreamBaseUrl(options.upstreamBaseUrl);
+    }
     const upstreamBaseUrl = options.upstreamBaseUrl ?? CODEX_BASE_URL;
     const clientApiKey = typeof options.clientApiKey === "string" &&
         options.clientApiKey.trim().length > 0
@@ -2030,6 +2134,11 @@ async function handleRequestInner(state, req, res, traceId) {
                     method: context.method,
                     headers: outboundHeaders,
                     signal: fetchAbortController.signal,
+                    // Redirect pinning: never follow an upstream redirect — a 3xx from
+                    // a compromised or misconfigured endpoint would re-send the
+                    // managed Bearer token to an arbitrary host. Matches the model
+                    // catalog fetch above.
+                    redirect: "error",
                 };
                 if (context.method === "POST") {
                     upstreamRequestInit.body = context.body;
@@ -2062,6 +2171,30 @@ async function handleRequestInner(state, req, res, traceId) {
                     error: transportError,
                 });
                 refundConsumedPoolToken(refreshed.account);
+                // A redirect rejection is upstream configuration, not a transport
+                // outage or an account-health signal: the 3xx arrived (so the path
+                // works and no generation started), the Bearer token never reached
+                // the redirect target, and every managed account would hit the
+                // same redirect — cooling + rotating here would drain the pool on
+                // one endpoint fault. This also covers the WebSocket httpFetch
+                // fallback: SocketSession preserves init, so a refused-upgrade
+                // turn on API/ZDR credentials can reject this way. Fail the
+                // request in place and leave account state untouched.
+                if (isRedirectRejection(error)) {
+                    writeJson(res, 502, {
+                        error: {
+                            code: "upstream_redirect_rejected",
+                            message: "Upstream endpoint attempted a redirect; redirects are never followed.",
+                        },
+                    });
+                    await usageRecorder.record({
+                        outcome: "failure",
+                        statusCode: 502,
+                        errorCode: "upstream_redirect_rejected",
+                        account: refreshed.account,
+                    });
+                    return;
+                }
                 // A timeout may occur after generation; do not retry within this request.
                 if (isImageRequest) {
                     writeJson(res, 502, {