opencode-ufr 0.2.8 → 0.2.10

package/src/daemon/router.ts

@@ -115,6 +115,155 @@ export class Router {
     return this.jsonOut(slot.at, body, group, res, max, signal)
   }
 
+  /**
+   * One raw upstream call for local scripts (context probes, pdf2md): the same
+   * central key rotation and soft rate limiting as chat — the caller waits for
+   * a key slot instead of being told to back off — but no fallback chain, no
+   * context-hub hop and no reasoning retry. The caller gets exactly the model
+   * it asked for, with UFR's status and body passed through verbatim: a context
+   * probe needs the 400 body that names the limit, and a transcription needs
+   * the model it chose, not a fallback. Non-streaming by design.
+   */
+  async handleRelay(body: Record<string, unknown>, signal?: AbortSignal): Promise<Response> {
+    this.active++
+    try {
+      return await this.relayOnce(body, signal)
+    } finally {
+      this.active--
+    }
+  }
+
+  private async relayOnce(body: Record<string, unknown>, signal?: AbortSignal): Promise<Response> {
+    this.active++ // a long-lived relay must be visible in the status inFlight count
+    try {
+      return await this.relay(body, signal)
+    } finally {
+      this.active--
+    }
+  }
+
+  private async relay(body: Record<string, unknown>, signal?: AbortSignal): Promise<Response> {
+    const t0 = this.d.now()
+    if (body.stream === true) {
+      return errorResponse(400, "invalid_request", "/v1/_relay is non-streaming — use /v1/chat/completions for streams")
+    }
+    const requested = typeof body.model === "string" ? body.model.trim() : ""
+    if (!requested) return errorResponse(400, "invalid_request", "body.model is required")
+    const cat = this.d.catalog()
+    const group = resolveModel(cat, requested)
+
+    if (!this.d.breakers.get(group).allow().allowed) {
+      return this.fail(t0, group, null, 0, false, "upstream_circuit_open",
+        errorResponse(429, "upstream_circuit_open",
+          `UFR is refusing ${group} right now; the gateway waits instead of hammering it`,
+          this.d.breakers.get(group).retryAfterMs()))
+    }
+
+    const slot = this.d.pool.reserve()
+    if (slot.verdict === "reject") {
+      // allow() above may have consumed a half-open probe that now never gets
+      // an outcome — resolve it so the ladder doesn't escalate on a probe timeout.
+      this.d.breakers.get(group).onOtherFailure()
+      return this.fail(t0, group, null, 0, false, "upstream_pool_cap",
+        errorResponse(429, "upstream_pool_cap", `hourly cap of ${this.d.config.limits.poolPerHour} requests reached`, slot.waitMs))
+    }
+    if (slot.waitMs > 0) {
+      try {
+        await this.d.sleep(slot.waitMs, signal)
+      } catch {
+        this.d.pool.release(slot.at)
+        this.d.breakers.get(group).onOtherFailure()
+        return this.fail(t0, group, null, 0, false, "client_closed",
+          errorResponse(499, "client_closed", "client went away while waiting for a slot"))
+      }
+    }
+
+    const k = this.d.keys.acquire()
+    if (k.kind === "none") {
+      this.d.breakers.get(group).onOtherFailure()
+      if (k.reason === "no_keys") {
+        return this.fail(t0, group, null, 0, true, "no_keys",
+          errorResponse(401, "no_keys", "no valid UFR API key configured — reconnect the Uni Freiburg integration in opencode's /connect"))
+      }
+      // exhausted or all_tried (relay excludes nothing, so all_tried cannot happen — belt and braces)
+      return this.fail(t0, group, null, 0, true, "key_pool_exhausted",
+        errorResponse(429, "key_pool_exhausted",
+          `every UFR key is at its limit of ${this.d.config.limits.keyRpm} requests per ${this.d.config.limits.keyWindowS} s`, k.retryAfterMs))
+    }
+    if (k.waitMs > 0) {
+      try {
+        await this.d.sleep(k.waitMs, signal)
+      } catch {
+        this.d.keys.release(k.alias, k.at)
+        this.d.breakers.get(group).onOtherFailure()
+        return this.fail(t0, group, null, 0, true, "client_closed",
+          errorResponse(499, "client_closed", "client went away while waiting for a key"))
+      }
+    }
+
+    let r: UpstreamResult
+    try {
+      r = await callUpstream({
+        transport: this.d.transport,
+        baseUrl: this.d.config.upstream.baseUrl,
+        key: k.secret,
+        body: { ...body, model: group },
+        timeoutMs: this.d.config.upstream.requestTimeoutS * 1000,
+        signal,
+        stream: false,
+      })
+    } catch (e) {
+      this.d.breakers.get(group).onOtherFailure() // the call's outcome never came back
+      if (signal?.aborted) {
+        return this.fail(t0, group, k.alias, 1, true, "client_closed",
+          errorResponse(499, "client_closed", "client went away"))
+      }
+      return this.fail(t0, group, k.alias, 1, true, "transport_unreachable",
+        errorResponse(503, "transport_unreachable", `UFR call failed (${e instanceof Error ? e.message : String(e)})`))
+    }
+    switch (r.kind) {
+      case "ok": {
+        this.d.breakers.get(group).onSuccess()
+        this.d.onUpstream?.(true, "")
+        const text = await r.response.text()
+        let json: unknown
+        try {
+          json = JSON.parse(text)
+        } catch {
+          // Not JSON — pass it through untouched rather than failing a call UFR answered.
+          this.record(t0, group, k.alias, 200, null, 1, null, true)
+          return new Response(text, { status: 200, headers: { "content-type": r.response.headers.get("content-type") ?? "application/json" } })
+        }
+        this.record(t0, group, k.alias, 200, usageOf(json), 1, null, true)
+        return Response.json(json)
+      }
+      case "rate_limited":
+        // A wall on the exact model the script asked for — honest breaker signal.
+        this.d.keys.onRateLimited(k.alias, group)
+        this.d.breakers.get(group).onRateLimited()
+        this.record(t0, group, k.alias, 429, null, 1, "upstream_rate_limited", true)
+        return new Response(r.body, { status: 429, headers: { "content-type": "application/json" } })
+      case "auth_invalid":
+        this.d.keys.onInvalid(k.alias)
+        this.d.breakers.get(group).onOtherFailure()
+        this.record(t0, group, k.alias, r.status, null, 1, "upstream_auth_invalid", true)
+        return new Response(r.body, { status: r.status, headers: { "content-type": "application/json" } })
+      case "context_overflow":
+        // UFR's own 400 naming the limit — the reason scripts use the relay. Not a wall.
+        this.d.breakers.get(group).onOtherFailure()
+        this.record(t0, group, k.alias, r.status, null, 1, "context_overflow", true)
+        return new Response(r.body, { status: r.status, headers: { "content-type": "application/json" } })
+      case "unreachable":
+        this.d.breakers.get(group).onOtherFailure()
+        this.d.onUpstream?.(false, r.message)
+        return this.fail(t0, group, k.alias, 1, true, "transport_unreachable", errorResponse(503, "transport_unreachable", r.message))
+      case "error":
+        this.d.breakers.get(group).onOtherFailure()
+        this.record(t0, group, k.alias, r.status, null, 1, `upstream_${r.status}`, true)
+        return new Response(r.body, { status: r.status, headers: { "content-type": r.contentType } })
+    }
+  }
+
   /** Upstream calls for one client request: other key, next model, context hub. */
   private async loop(
     body: Record<string, unknown>,
@@ -164,10 +313,11 @@ export class Router {
       if (k.kind === "none") {
         if (k.reason === "no_keys") {
           breakers.get(model).onOtherFailure() // model's probe (if any) got no outcome
-          return fail(401, "no_keys", "no valid UFR API key configured — run `ufr keys add <alias>`")
+          return fail(401, "no_keys", "no valid UFR API key configured — reconnect the Uni Freiburg integration in opencode's /connect")
         }
         if (k.reason === "exhausted") {
           breakers.get(model).onOtherFailure() // model's probe (if any) got no outcome
+          if (rateLimitedHere) giveUp(model) // the wall counts toward the breaker threshold even here
           return fail(429, "key_pool_exhausted",
             `every UFR key is at its limit of ${config.limits.keyRpm} requests per ${config.limits.keyWindowS} s`, k.retryAfterMs)
         }
@@ -190,7 +340,12 @@ export class Router {
       lastKey = k.alias
       const upstreamBody: Record<string, unknown> = { ...body, model }
       if (stream) {
-        upstreamBody.stream_options = { ...((body.stream_options as Record<string, unknown> | undefined) ?? {}), include_usage: true }
+        // Only spread a real object — a client sending stream_options as a
+        // string (or array) would otherwise be spread into garbage upstream.
+        const so = body.stream_options
+        const opts =
+          typeof so === "object" && so !== null && !Array.isArray(so) ? (so as Record<string, unknown>) : {}
+        upstreamBody.stream_options = { ...opts, include_usage: true }
       }
       // Bun's fetch does not propagate a body reader's cancel() into aborting the
       // underlying request — give streaming attempts their own controller so
@@ -277,30 +432,73 @@ export class Router {
   }
 
   private async jsonOut(ts: number, body: Record<string, unknown>, group: string, res: LoopOk, max: number, signal?: AbortSignal): Promise<Response> {
-    let json: unknown = await res.response.json()
+    let json: unknown
+    try {
+      json = await res.response.json()
+    } catch {
+      // A malformed 200 must not escape handleChat as Bun's default 500 with the
+      // pool slot never released — turn it into an honest error and give the slot
+      // back (poolAdmitted false: the released slot must not seed a phantom
+      // admission in the window rebuilt from stats after a restart).
+      this.d.pool.release(ts)
+      if (signal?.aborted) {
+        // A client abort during the body transfer also rejects json() — that is
+        // not bad upstream JSON: the call really happened, so record it as the
+        // client's doing, in the same shape as the other client-abort paths.
+        return this.fail(ts, res.model, res.keyAlias, res.attempts, false, "client_closed",
+          errorResponse(499, "client_closed", "client went away while the response body was transferred"))
+      }
+      return this.fail(ts, res.model, res.keyAlias, res.attempts, false, "upstream_bad_json",
+        errorResponse(502, "upstream_bad_json", "UFR answered 200 with a body that is not valid JSON"))
+    }
     let usage = usageOf(json)
     let cost = usage ? costUsd(this.priceOf(res.model), usage.prompt, usage.completion) : null
     let attempts = res.attempts
     let model = res.model
     let keyAlias = res.keyAlias
+    let retryErrorType: string | null = null
     if (isReasoningStarved(json) && attempts < max) {
-      const retry = await this.loop({ ...body, reasoning_effort: "none" }, group, res.model, false, max - attempts, signal)
-      attempts += retry.attempts
-      if (retry.ok) {
-        const again: unknown = await retry.response.json()
-        const u2 = usageOf(again)
-        // Price each call at the model it was actually answered by — a retry that
-        // falls back must not price the first call at the fallback's rate.
-        cost = addCost(cost, u2 ? costUsd(this.priceOf(retry.model), u2.prompt, u2.completion) : null)
-        usage = addUsage(usage, u2)
-        if (!isReasoningStarved(again)) {
-          json = again
-          model = retry.model
-          keyAlias = retry.keyAlias
+      // The retry is a real upstream call, so it takes a pool slot under the same
+      // acquire/wait/abort semantics as the main path — it must not evade the
+      // poolPerHour cap. When the pool cannot give one (rejected, or the client
+      // went away while waiting), keep the starved answer instead of failing.
+      const slot = this.d.pool.reserve()
+      let mayRetry = slot.verdict !== "reject"
+      if (mayRetry && slot.waitMs > 0) {
+        try {
+          await this.d.sleep(slot.waitMs, signal)
+        } catch {
+          this.d.pool.release(slot.at)
+          mayRetry = false
+        }
+      }
+      if (mayRetry) {
+        const retry = await this.loop({ ...body, reasoning_effort: "none" }, group, res.model, false, max - attempts, signal)
+        attempts += retry.attempts
+        if (retry.ok) {
+          try {
+            const again: unknown = await retry.response.json()
+            const u2 = usageOf(again)
+            // Price each call at the model it was actually answered by — a retry that
+            // falls back must not price the first call at the fallback's rate.
+            cost = addCost(cost, u2 ? costUsd(this.priceOf(retry.model), u2.prompt, u2.completion) : null)
+            usage = addUsage(usage, u2)
+            if (!isReasoningStarved(again)) {
+              json = again
+              model = retry.model
+              keyAlias = retry.keyAlias
+            }
+          } catch {
+            retryErrorType = "reasoning_retry_failed"
+          }
+        } else {
+          // The client still gets the starved 200 (intended graceful degradation),
+          // but the failed retry must show in stats instead of a clean errorType null.
+          retryErrorType = "reasoning_retry_failed"
         }
       }
     }
-    this.record(ts, model, keyAlias, 200, usage, attempts, null, true, cost)
+    this.record(ts, model, keyAlias, 200, usage, attempts, retryErrorType, true, cost)
     return Response.json(json)
   }
 

package/src/daemon/server.ts

@@ -8,8 +8,12 @@ export type ServerDeps = {
   router: Router
   models: () => unknown[]
   status: () => unknown
+  /** Raw UFR model list + bundled models.json — for scripts that probe every model. */
+  catalogData?: () => { ufr: unknown; file: unknown } | null
   onActivity: () => void
   onShutdown: () => void
+  /** True once stop() began: new work is fast-failed while in-flight requests drain. */
+  draining?: () => boolean
 }
 
 export function startServer(d: ServerDeps): { port: number; stop: () => void } {
@@ -27,6 +31,14 @@ export function startServer(d: ServerDeps): { port: number; stop: () => void } {
       }
       d.onActivity()
       const route = `${req.method} ${url.pathname}`
+      // Once stop() began, fast-fail new chat/relay work instead of admitting
+      // requests the drain grace period would tear down at the deadline.
+      // /health, /v1/_status and friends keep answering during the drain.
+      if ((route === "POST /v1/chat/completions" || route === "POST /v1/_relay") && d.draining?.()) {
+        return errorResponse(503, "draining", "the gateway is shutting down — retry shortly")
+      }
+      // Dashboard polling of _status must not reset the idle timer — only real work does.
+      if (route === "GET /v1/_status") return Response.json(d.status())
       if (route === "GET /v1/models") return Response.json({ object: "list", data: d.models() })
       if (route === "POST /v1/chat/completions") {
         srv.timeout(req, 0) // glm-5.2 can think for minutes before the first byte
@@ -41,14 +53,34 @@ export function startServer(d: ServerDeps): { port: number; stop: () => void } {
         }
         return d.router.handleChat(body as Record<string, unknown>, req.signal)
       }
+      if (route === "POST /v1/_relay") {
+        // Scripts (context probes, pdf2md): one raw upstream call through the
+        // central key rotation and soft rate limiting. Streams live forever.
+        srv.timeout(req, 0)
+        let body: unknown
+        try {
+          body = await req.json()
+        } catch {
+          return errorResponse(400, "invalid_request", "body must be JSON")
+        }
+        if (typeof body !== "object" || body === null || Array.isArray(body)) {
+          return errorResponse(400, "invalid_request", "body must be a JSON object")
+        }
+        return d.router.handleRelay(body as Record<string, unknown>, req.signal)
+      }
+      if (route === "GET /v1/_catalog") return Response.json(d.catalogData?.() ?? null)
       if (route === "POST /v1/_client/heartbeat") return Response.json({ ok: true })
-      if (route === "GET /v1/_status") return Response.json(d.status())
       if (route === "POST /v1/_shutdown") {
         setTimeout(d.onShutdown, 20)
         return Response.json({ ok: true })
       }
       return errorResponse(404, "not_found", `no route ${route}`)
     },
+    // Uncaught throws from the fetch handler (status(), models(), handleChat
+    // internals): answer in the gateway's JSON error shape instead of Bun's
+    // default HTML 500. Responses already returned — including streams, which
+    // surface their own errors — never reach this handler.
+    error: (e) => errorResponse(500, "internal_error", `gateway error: ${e instanceof Error ? e.message : String(e)}`),
   })
   return { port: server.port as number, stop: () => server.stop(true) }
 }

package/src/daemon/stats.ts

@@ -60,7 +60,8 @@ export class Stats {
 
   /** Admission times for rebuilding the pool window after a restart. */
   poolAdmissionsSince(sinceTs: number): number[] {
-    const rows = this.db.query("SELECT ts FROM requests WHERE pool_admitted = 1 AND ts > ? ORDER BY ts").all(sinceTs) as { ts: number }[]
+    // ts >= like spendByKeySince/summary — "since" is inclusive everywhere
+    const rows = this.db.query("SELECT ts FROM requests WHERE pool_admitted = 1 AND ts >= ? ORDER BY ts").all(sinceTs) as { ts: number }[]
     return rows.map((r) => r.ts)
   }
 
@@ -86,6 +87,17 @@ export class Stats {
     return { byModel: q("model"), byKey: q("COALESCE(key_alias, '-')") }
   }
 
+  /** Request and token totals in a window, for the live rates in /v1/_status. */
+  rates(sinceTs: number): { requests: number; promptTokens: number; completionTokens: number } {
+    return this.db
+      .query(
+        `SELECT COUNT(*) AS requests, COALESCE(SUM(prompt_tokens), 0) AS promptTokens,
+           COALESCE(SUM(completion_tokens), 0) AS completionTokens
+         FROM requests WHERE ts >= ?`,
+      )
+      .get(sinceTs) as { requests: number; promptTokens: number; completionTokens: number }
+  }
+
   prune(beforeTs: number): number {
     return this.db.query("DELETE FROM requests WHERE ts < ?").run(beforeTs).changes
   }

package/src/daemon/upstream.ts

@@ -21,8 +21,17 @@ export async function callUpstream(o: {
   signal?: AbortSignal
   stream: boolean
 }): Promise<UpstreamResult> {
-  const timeout = AbortSignal.timeout(o.timeoutMs)
-  const signal = o.signal ? AbortSignal.any([o.signal, timeout]) : timeout
+  // The timeout guards time-to-first-byte: it aborts only until UFR answers
+  // with response headers, then is cleared so a long SSE body can stream well
+  // past it — a stream longer than requestTimeoutS must not be killed
+  // mid-generation (the client's own signal still aborts via the composed
+  // signal). Non-streaming calls keep the whole-request guarantee in practice:
+  // UFR sends its JSON body immediately after the headers, so a slow generation
+  // stalls the headers too; a body stalling after that is the caller's signal's
+  // job (it composes into the same signal).
+  const ttfb = new AbortController()
+  const signal = o.signal ? AbortSignal.any([o.signal, ttfb.signal]) : ttfb.signal
+  const timer = setTimeout(() => ttfb.abort(), o.timeoutMs)
   let res: Response
   try {
     res = await o.transport.fetch(`${o.baseUrl}/chat/completions`, {
@@ -37,8 +46,9 @@ export async function callUpstream(o: {
       redirect: "manual",
     })
   } catch (e) {
+    clearTimeout(timer)
     if (o.signal?.aborted) throw e
-    if (timeout.aborted) {
+    if (ttfb.signal.aborted) {
       const message = `UFR did not answer within ${Math.round(o.timeoutMs / 1000)} s`
       return {
         kind: "error",
@@ -49,6 +59,7 @@ export async function callUpstream(o: {
     }
     return { kind: "unreachable", message: `cannot reach UFR (${(e as Error).message}) — are you connected to the uni VPN?` }
   }
+  clearTimeout(timer) // headers are in — the body may now stream indefinitely
   const type = res.headers.get("content-type") ?? ""
   if (res.status >= 300 && res.status < 400) {
     // Not proof of the VPN wall (ruling R12): only UFR's HTML page below is.

package/src/daemon/vpn/fortinet.ts

@@ -8,6 +8,7 @@
 
 import tls from "node:tls"
 
+import { ipv4Parse } from "./ip"
 import { PppSession, type PppConfig, type PppOptions } from "./ppp"
 
 // -- framing -----------------------------------------------------------------
@@ -232,48 +233,46 @@ export type TunnelConfig = {
 }
 
 function attr(xml: string, tag: string, attribute: string): string | null {
-  const re = new RegExp(`<${tag}[^>]*\\b${attribute}=["']([^"']*)["']`, "i")
-  return re.exec(xml)?.[1] ?? null
+  // The attribute must live INSIDE the requested tag: <tag … attribute="value" …>.
+  // (?![\w-]) keeps longer tag names (dtls-config-x) from matching; the leading \s
+  // keeps attribute-name suffixes (x-ipv4) from matching. Order, whitespace around
+  // "=" and quote style all vary; tag and attribute names are case-insensitive.
+  const re = new RegExp(`<${tag}(?![\\w-])[^>]*?\\s${attribute}\\s*=\\s*(["'])([^"'>]*)\\1`, "i")
+  return re.exec(xml)?.[2] ?? null
+}
+
+/** A positive number, else the fallback ("" → 0 and NaN would silently kill the DPD keepalive). */
+function positiveNumber(v: string | null, fallback: number): number {
+  const n = v === null ? Number.NaN : Number(v)
+  return Number.isFinite(n) && n > 0 ? n : fallback
 }
 
 export function parseTunnelConfig(xml: string): TunnelConfig {
   if (!/<sslvpn-tunnel/i.test(xml)) {
     throw new VpnAuthError("tunnel config: response is not a sslvpn-tunnel document (session dead?)")
   }
+  const innerIp = attr(xml, "assigned-addr", "ipv4") ?? ""
+  try {
+    ipv4Parse(innerIp)
+  } catch {
+    throw new VpnAuthError(`tunnel config: invalid inner ip "${innerIp}"`)
+  }
   const dns = [...xml.matchAll(/<dns[^>]*\bip=["']([^"']*)["']/gi)].map((m) => m[1]!)
   const routes = [...xml.matchAll(/<addr[^>]*\bip=["']([^"']*)["'][^>]*\bmask=["']([^"']*)["']/gi)].map((m) => ({ ip: m[1]!, mask: m[2]! }))
   return {
-    innerIp: attr(xml, "assigned-addr", "ipv4") ?? "",
+    innerIp,
     dns,
-    dpdS: Number(attr(xml, "dtls-config", "heartbeat-interval") ?? "10"),
+    dpdS: positiveNumber(attr(xml, "dtls-config", "heartbeat-interval"), 10),
     idleTimeoutS: Number(attr(xml, "idle-timeout", "val") ?? "0"),
     authTimeoutS: Number(attr(xml, "auth-timeout", "val") ?? "0"),
     routes,
   }
 }
 
-export async function fetchTunnelConfig(o: {
-  gateway: string
-  cookie: string
-  fetch?: typeof fetch
-}): Promise<TunnelConfig> {
-  const f = o.fetch ?? fetch
-  const res = await f(`${o.gateway.replace(/\/$/, "")}/remote/fortisslvpn_xml?dual_stack=1`, {
-    headers: { "User-Agent": FORTI_UA, Cookie: o.cookie },
-    redirect: "manual",
-  })
-  const text = await res.text().catch(() => "")
-  if (res.status !== 200 || /\/remote\/login/.test(res.headers.get("location") ?? "")) {
-    throw new VpnAuthError("tunnel config fetch failed — session invalid (HTTP " + res.status + ")")
-  }
-  return parseTunnelConfig(text)
-}
-
 // -- the tunnel ----------------------------------------------------------------
 
 export type TunnelHandle = {
   readonly config: TunnelConfig
-  readonly ppp: PppSession
   /** Clean teardown: PPP TERMREQ, close TLS, logout. */
   close(): Promise<void>
 }
@@ -288,6 +287,8 @@ export async function openTunnel(o: {
   onIp: (datagram: Uint8Array) => void
   pppOptions?: PppOptions
   log?: (msg: string) => void
+  /** Extra CA certs for tls.connect (tests against a local TLS peer). */
+  ca?: string
 }): Promise<TunnelHandle> {
   const log = o.log ?? (() => {})
   const url = new URL(o.gateway)
@@ -333,7 +334,11 @@ export async function openTunnel(o: {
         if (nl === -1) return // wait for more
         const size = parseInt(bodyBuf.subarray(pos, nl).toString(), 16)
         if (Number.isNaN(size)) return fail("broken chunked body in tunnel config response")
-        if (size === 0) { rest = bodyBuf.subarray(pos + 5); break } // skip "0\r\n\r\n"
+        if (size === 0) {
+          if (bodyBuf.length < pos + 5) return // wait for the full "0\r\n\r\n" terminator
+          rest = bodyBuf.subarray(pos + 5)
+          break
+        }
         if (bodyBuf.length < pos + nl + 2 + size + 2) return // wait for more
         out = Buffer.concat([out, bodyBuf.subarray(nl + 2, nl + 2 + size)])
         pos = nl + 2 + size + 2
@@ -345,9 +350,19 @@ export async function openTunnel(o: {
       body = httpBuf.subarray(bodyStart, bodyStart + cl)
       rest = httpBuf.subarray(bodyStart + cl)
     }
-    if (status !== 200) return fail(`tunnel config request failed (HTTP ${status}) — session invalid?`)
-    if (status === 200 && /\/remote\/login/i.test(head)) return fail("tunnel config redirected to login — session invalid")
-    config = parseTunnelConfig((body as Buffer).toString())
+    if (status !== 200) {
+      if (status >= 300 && status < 400) return fail("tunnel config redirected to login — session invalid")
+      return fail(`tunnel config request failed (HTTP ${status}) — session invalid?`)
+    }
+    if (/\/remote\/login/i.test(head)) return fail("tunnel config redirected to login — session invalid")
+    // Bun silently swallows exceptions thrown in socket data handlers — an escaping
+    // parse error would stall the tunnel to the establish timeout with zero log
+    // output. Every parse failure must go through fail().
+    try {
+      config = parseTunnelConfig((body as Buffer).toString())
+    } catch (e) {
+      return fail(`tunnel config invalid: ${(e as Error).message}`)
+    }
     log(`tunnel config: inner ip ${config.innerIp}, dns ${config.dns.join(", ") || "none"}, dpd ${config.dpdS}s`)
     // switch into tunnel phase: leftover bytes belong to the tunnel response
     httpBuf = Buffer.from(rest as Buffer)
@@ -414,6 +429,7 @@ export async function openTunnel(o: {
     servername: host,
     ALPNProtocols: ["http/1.1"], // the tunnel speaks HTTP/1.1 then switches to PPP frames
     rejectUnauthorized: true,
+    ...(o.ca ? { ca: o.ca } : {}),
   })
   socket.on("data", (chunk: Buffer) => {
     if (closed) return
@@ -466,9 +482,6 @@ export async function openTunnel(o: {
     get config(): TunnelConfig {
       return config ?? { innerIp: "", dns: [], dpdS: 10, idleTimeoutS: 0, authTimeoutS: 0, routes: [] }
     },
-    get ppp(): PppSession {
-      return ppp!
-    },
     close,
   }
 }