sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-lb/combined-catalog/persistence.js

@@ -0,0 +1,207 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { BRIDGE_ACTIVE_GENERATION_FILENAME, BRIDGE_ACTIVE_GENERATION_SCHEMA } from './contracts.js';
+import { safeErrorCode, unique } from './shared.js';
+import { assertPrivateDirectory, catalogObservationGeneration, emptyCatalog, emptyRouteIndex, fsyncDirectory, generationBundleLayout, isPrivateRegular, readVerifiedPair, restoreSnapshot, snapshot, stagePrivateFile, verifyStagedPair } from './storage.js';
+import { writeTextAtomic } from '../../fsx.js';
+import { withFileLock } from '../../locks/file-lock.js';
+export async function stageCombinedBridgeCatalog(input) {
+    const previous = await readActiveCombinedBridgeCatalog(input.catalogPath, input.routeIndexPath);
+    const layout = generationBundleLayout(input.catalogPath, input.routeIndexPath, input.build);
+    if (!layout.ok) {
+        return stagingFailure(layout.pointerPath, previous, layout.blockers);
+    }
+    if (!input.build.ok) {
+        return stagingFailure(layout.pointerPath, previous, unique(input.build.blockers.length > 0
+            ? input.build.blockers
+            : ['combined_catalog_build_not_verified']));
+    }
+    const catalogText = `${JSON.stringify(input.build.catalog, null, 2)}\n`;
+    const routeText = `${JSON.stringify(input.build.route_index, null, 2)}\n`;
+    const tempBundle = `${layout.bundleDirectory}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`;
+    const tempCatalog = path.join(tempBundle, layout.catalogFilename);
+    const tempRouteIndex = path.join(tempBundle, layout.routeIndexFilename);
+    try {
+        await fs.mkdir(layout.generationsRoot, { recursive: true, mode: 0o700 });
+        await assertPrivateDirectory(layout.generationsRoot);
+        await fs.mkdir(tempBundle, { recursive: false, mode: 0o700 });
+        await Promise.all([
+            stagePrivateFile(tempCatalog, catalogText),
+            stagePrivateFile(tempRouteIndex, routeText)
+        ]);
+        await verifyStagedPair(tempCatalog, tempRouteIndex, input.build.catalog.generation, input.build.route_index.generation);
+        await fsyncDirectory(tempBundle);
+        const existingBundle = await fs.lstat(layout.bundleDirectory).catch(() => null);
+        if (existingBundle) {
+            if (!existingBundle.isDirectory() || existingBundle.isSymbolicLink()) {
+                throw new Error('combined_catalog_generation_bundle_invalid');
+            }
+            await assertPrivateDirectory(layout.bundleDirectory);
+            const existing = await readVerifiedPair(layout.catalogPath, layout.routeIndexPath);
+            if (existing.catalog.generation !== input.build.catalog.generation
+                || existing.route_index.generation !== input.build.route_index.generation) {
+                throw new Error('combined_catalog_generation_bundle_mismatch');
+            }
+        }
+        else {
+            await fs.rename(tempBundle, layout.bundleDirectory);
+            await fsyncDirectory(layout.generationsRoot);
+        }
+        const pointer = {
+            schema: BRIDGE_ACTIVE_GENERATION_SCHEMA,
+            catalog_generation: input.build.catalog.generation,
+            route_index_generation: input.build.route_index.generation,
+            observation_generation: catalogObservationGeneration(input.build.catalog),
+            bundle_directory: path.relative(layout.parentDirectory, layout.bundleDirectory),
+            catalog_filename: layout.catalogFilename,
+            route_index_filename: layout.routeIndexFilename
+        };
+        return {
+            schema: 'sks.bridge-combined-catalog-staging.v1',
+            staged: true,
+            generation: input.build.catalog.generation,
+            previous_generation: previous.ok ? previous.catalog.generation : null,
+            catalog_path: layout.catalogPath,
+            route_index_path: layout.routeIndexPath,
+            pointer_path: layout.pointerPath,
+            pointer_text: `${JSON.stringify(pointer, null, 2)}\n`,
+            blockers: []
+        };
+    }
+    catch (error) {
+        return stagingFailure(layout.pointerPath, previous, [safeErrorCode(error, 'combined_catalog_staging_failed')]);
+    }
+    finally {
+        await fs.rm(tempBundle, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+export async function activateCombinedBridgeCatalog(input) {
+    const staged = await stageCombinedBridgeCatalog(input);
+    if (!staged.staged || !staged.pointer_text) {
+        return activationResult(staged, false, null, staged.catalog_path, staged.route_index_path, staged.blockers);
+    }
+    const pointerText = staged.pointer_text;
+    return withFileLock({
+        lockPath: `${path.resolve(staged.pointer_path)}.lock`,
+        timeoutMs: 10_000,
+        staleMs: 60_000
+    }, async () => {
+        const priorPointer = await snapshot(staged.pointer_path);
+        try {
+            await input.testHooks?.afterCatalogRename?.();
+            await input.testHooks?.beforeRouteIndexRename?.();
+            await writeTextAtomic(staged.pointer_path, pointerText, { mode: 0o600 });
+            await fsyncDirectory(path.dirname(staged.pointer_path));
+            const activated = await readActiveCombinedBridgeCatalog(input.catalogPath, input.routeIndexPath);
+            if (!activated.ok
+                || activated.catalog.generation !== input.build.catalog.generation
+                || activated.route_index.generation !== input.build.route_index.generation) {
+                throw new Error('combined_catalog_activation_verification_failed');
+            }
+            return activationResult(staged, true, staged.generation, staged.catalog_path, staged.route_index_path, []);
+        }
+        catch (error) {
+            const rollbackBlockers = [];
+            try {
+                await restoreSnapshot(staged.pointer_path, priorPointer);
+            }
+            catch {
+                rollbackBlockers.push('combined_catalog_previous_generation_restore_failed');
+            }
+            const restored = rollbackBlockers.length === 0
+                ? await readActiveCombinedBridgeCatalog(input.catalogPath, input.routeIndexPath)
+                : null;
+            return activationResult(staged, false, null, restored?.ok ? restored.catalog_path : null, restored?.ok ? restored.route_index_path : null, unique([safeErrorCode(error, 'combined_catalog_activation_failed'), ...rollbackBlockers]));
+        }
+    });
+}
+export async function readActiveCombinedBridgeCatalog(catalogPath, routeIndexPath) {
+    const parentDirectory = path.dirname(path.resolve(catalogPath));
+    const pointerPath = path.join(parentDirectory, BRIDGE_ACTIVE_GENERATION_FILENAME);
+    try {
+        if (path.dirname(path.resolve(routeIndexPath)) !== parentDirectory) {
+            throw new Error('combined_catalog_paths_must_share_directory');
+        }
+        const pointerStat = await fs.lstat(pointerPath).catch(() => null);
+        if (!pointerStat) {
+            const direct = await readVerifiedPair(path.resolve(catalogPath), path.resolve(routeIndexPath));
+            return {
+                ...direct,
+                catalog_path: path.resolve(catalogPath),
+                route_index_path: path.resolve(routeIndexPath),
+                pointer_path: pointerPath
+            };
+        }
+        if (!isPrivateRegular(pointerStat))
+            throw new Error('combined_catalog_active_pointer_insecure');
+        const pointer = JSON.parse(await fs.readFile(pointerPath, 'utf8'));
+        if (pointer.schema !== BRIDGE_ACTIVE_GENERATION_SCHEMA) {
+            throw new Error('combined_catalog_active_pointer_schema_invalid');
+        }
+        const generationsRoot = path.join(parentDirectory, '.sks-bridge-generations');
+        const bundleDirectory = path.resolve(parentDirectory, pointer.bundle_directory);
+        const expectedBundleDirectory = path.join(generationsRoot, pointer.observation_generation
+            ? `${pointer.catalog_generation}.${pointer.route_index_generation}.${pointer.observation_generation}`
+            : `${pointer.catalog_generation}.${pointer.route_index_generation}`);
+        if (bundleDirectory !== expectedBundleDirectory
+            || !bundleDirectory.startsWith(`${generationsRoot}${path.sep}`)
+            || pointer.catalog_filename !== path.basename(catalogPath)
+            || pointer.route_index_filename !== path.basename(routeIndexPath)
+            || path.dirname(path.resolve(bundleDirectory, pointer.catalog_filename)) !== bundleDirectory
+            || path.dirname(path.resolve(bundleDirectory, pointer.route_index_filename)) !== bundleDirectory) {
+            throw new Error('combined_catalog_active_pointer_path_invalid');
+        }
+        await assertPrivateDirectory(generationsRoot);
+        await assertPrivateDirectory(bundleDirectory);
+        const activeCatalogPath = path.join(bundleDirectory, pointer.catalog_filename);
+        const activeRouteIndexPath = path.join(bundleDirectory, pointer.route_index_filename);
+        const pair = await readVerifiedPair(activeCatalogPath, activeRouteIndexPath);
+        if (pair.catalog.generation !== pointer.catalog_generation
+            || pair.route_index.generation !== pointer.route_index_generation) {
+            throw new Error('combined_catalog_active_pointer_generation_mismatch');
+        }
+        return {
+            ...pair,
+            catalog_path: activeCatalogPath,
+            route_index_path: activeRouteIndexPath,
+            pointer_path: pointerPath
+        };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            catalog: emptyCatalog(),
+            route_index: emptyRouteIndex(),
+            catalog_path: null,
+            route_index_path: null,
+            pointer_path: pointerPath,
+            blockers: [safeErrorCode(error, 'combined_catalog_active_generation_missing')]
+        };
+    }
+}
+function stagingFailure(pointerPath, previous, blockers) {
+    return {
+        schema: 'sks.bridge-combined-catalog-staging.v1',
+        staged: false,
+        generation: null,
+        previous_generation: previous.ok ? previous.catalog.generation : null,
+        catalog_path: previous.ok ? previous.catalog_path : null,
+        route_index_path: previous.ok ? previous.route_index_path : null,
+        pointer_path: pointerPath,
+        pointer_text: null,
+        blockers
+    };
+}
+function activationResult(staged, activated, generation, catalogPath, routeIndexPath, blockers) {
+    return {
+        schema: 'sks.bridge-combined-catalog-activation.v1',
+        activated,
+        generation,
+        previous_generation: staged.previous_generation,
+        catalog_path: catalogPath,
+        route_index_path: routeIndexPath,
+        pointer_path: staged.pointer_path,
+        blockers
+    };
+}

package/dist/core/codex-lb/combined-catalog/shared.js

@@ -0,0 +1,12 @@
+export function safeErrorCode(error, fallback) {
+    const message = error instanceof Error ? error.message : String(error || '');
+    return /^[a-z0-9_:-]{1,160}$/i.test(message) ? message : fallback;
+}
+export function compareModels(left, right) {
+    return left.public_id.localeCompare(right.public_id)
+        || left.provider_id.localeCompare(right.provider_id)
+        || left.upstream_model.localeCompare(right.upstream_model);
+}
+export function unique(values) {
+    return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))];
+}

package/dist/core/codex-lb/combined-catalog/storage.js

@@ -0,0 +1,171 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildBridgeRouteIndex, routeIndexMatchesGeneration, sha256Stable } from '../route-index.js';
+import { writeTextAtomic } from '../../fsx.js';
+import { BRIDGE_ACTIVE_GENERATION_FILENAME, COMBINED_BRIDGE_CATALOG_SCHEMA } from './contracts.js';
+import { unique } from './shared.js';
+export function generationBundleLayout(catalogPath, routeIndexPath, build) {
+    const resolvedCatalog = path.resolve(catalogPath);
+    const resolvedRoute = path.resolve(routeIndexPath);
+    const parentDirectory = path.dirname(resolvedCatalog);
+    const generationsRoot = path.join(parentDirectory, '.sks-bridge-generations');
+    const generationName = `${build.catalog.generation}.${build.route_index.generation}.${catalogObservationGeneration(build.catalog)}`;
+    const bundleDirectory = path.join(generationsRoot, generationName);
+    const catalogFilename = path.basename(resolvedCatalog);
+    const routeIndexFilename = path.basename(resolvedRoute);
+    const blockers = unique([
+        ...(path.dirname(resolvedRoute) === parentDirectory ? [] : ['combined_catalog_paths_must_share_directory']),
+        ...(catalogFilename !== routeIndexFilename ? [] : ['combined_catalog_paths_must_be_distinct']),
+        ...(/^[a-f0-9]{64}\.[a-f0-9]{64}\.[a-f0-9]{64}$/.test(generationName) ? [] : ['combined_catalog_generation_invalid'])
+    ]);
+    return {
+        ok: blockers.length === 0,
+        parentDirectory,
+        generationsRoot,
+        bundleDirectory,
+        catalogFilename,
+        routeIndexFilename,
+        catalogPath: path.join(bundleDirectory, catalogFilename),
+        routeIndexPath: path.join(bundleDirectory, routeIndexFilename),
+        pointerPath: path.join(parentDirectory, BRIDGE_ACTIVE_GENERATION_FILENAME),
+        blockers
+    };
+}
+export async function readVerifiedPair(catalogPath, routeIndexPath) {
+    const [catalogStat, routeStat] = await Promise.all([fs.lstat(catalogPath), fs.lstat(routeIndexPath)]);
+    if (!isPrivateRegular(catalogStat) || !isPrivateRegular(routeStat)) {
+        throw new Error('combined_catalog_active_file_insecure');
+    }
+    const [catalog, routeIndex] = await Promise.all([
+        fs.readFile(catalogPath, 'utf8').then((text) => JSON.parse(text)),
+        fs.readFile(routeIndexPath, 'utf8').then((text) => JSON.parse(text))
+    ]);
+    const validCatalog = catalog.schema === COMBINED_BRIDGE_CATALOG_SCHEMA
+        && catalog.digest === catalog.generation
+        && sha256Stable({ models: catalog.models }) === catalog.digest
+        && validProviderStatuses(catalog.provider_statuses);
+    const validRoute = routeIndexMatchesGeneration(routeIndex, routeIndex.generation);
+    const providerBindingsValid = validCatalog && ['codex-lb', 'openrouter'].every((providerId) => catalog.provider_statuses[providerId].generation === routeIndex.providers[providerId].catalog_generation);
+    if (!validCatalog || !validRoute || !providerBindingsValid) {
+        throw new Error('combined_catalog_active_generation_invalid');
+    }
+    return { ok: true, catalog, route_index: routeIndex, blockers: [] };
+}
+export async function stagePrivateFile(file, text) {
+    await fs.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    const handle = await fs.open(file, 'wx', 0o600);
+    try {
+        await handle.writeFile(text, 'utf8');
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function verifyStagedPair(catalogPath, routePath, catalogGeneration, routeGeneration) {
+    const [catalog, route] = await Promise.all([
+        fs.readFile(catalogPath, 'utf8').then((text) => JSON.parse(text)),
+        fs.readFile(routePath, 'utf8').then((text) => JSON.parse(text))
+    ]);
+    if (catalog.generation !== catalogGeneration || route.generation !== routeGeneration) {
+        throw new Error('combined_catalog_staged_generation_mismatch');
+    }
+    if (sha256Stable({ models: catalog.models }) !== catalog.digest
+        || !routeIndexMatchesGeneration(route, routeGeneration)) {
+        throw new Error('combined_catalog_staged_digest_mismatch');
+    }
+}
+export async function snapshot(file) {
+    try {
+        return { exists: true, text: await fs.readFile(file, 'utf8') };
+    }
+    catch {
+        return { exists: false, text: '' };
+    }
+}
+export async function restoreSnapshot(file, prior) {
+    if (prior.exists)
+        await writeTextAtomic(file, prior.text, { mode: 0o600 });
+    else
+        await fs.rm(file, { force: true });
+}
+export async function fsyncDirectory(directory) {
+    const handle = await fs.open(directory, 'r');
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function assertPrivateDirectory(directory) {
+    const stat = await fs.lstat(directory);
+    const expectedUid = typeof process.getuid === 'function' ? process.getuid() : null;
+    if (!stat.isDirectory()
+        || stat.isSymbolicLink()
+        || (expectedUid !== null && Number(stat.uid) !== expectedUid)
+        || (process.platform !== 'win32' && (Number(stat.mode) & 0o777) !== 0o700)) {
+        throw new Error('combined_catalog_generation_directory_insecure');
+    }
+}
+export function isPrivateRegular(stat) {
+    return stat.isFile()
+        && !stat.isSymbolicLink()
+        && (typeof process.getuid !== 'function' || Number(stat.uid) === process.getuid())
+        && (process.platform === 'win32' || (Number(stat.mode) & 0o777) === 0o600);
+}
+export function emptyCatalog() {
+    const digest = sha256Stable({ models: [] });
+    return {
+        schema: COMBINED_BRIDGE_CATALOG_SCHEMA,
+        generation: digest,
+        created_at: new Date(0).toISOString(),
+        digest,
+        models: [],
+        provider_statuses: {
+            'codex-lb': emptyProviderStatus('codex-lb'),
+            openrouter: emptyProviderStatus('openrouter')
+        }
+    };
+}
+export function emptyRouteIndex() {
+    return buildBridgeRouteIndex({
+        models: [],
+        providers: {
+            'codex-lb': { catalog_generation: null, credential_fingerprint: null, state: 'unknown' },
+            openrouter: { catalog_generation: null, credential_fingerprint: null, state: 'unknown' }
+        },
+        created_at: new Date(0).toISOString()
+    }).route_index;
+}
+export function catalogObservationGeneration(catalog) {
+    return sha256Stable(catalog.provider_statuses);
+}
+function validProviderStatuses(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const rows = value;
+    return ['codex-lb', 'openrouter'].every((providerId) => {
+        const row = rows[providerId];
+        return Boolean(row
+            && row.schema === 'sks.catalog-sync-state.v2'
+            && row.provider_id === providerId
+            && (row.expires_at === null || Number.isFinite(Date.parse(row.expires_at))));
+    });
+}
+function emptyProviderStatus(providerId) {
+    return {
+        schema: 'sks.catalog-sync-state.v2',
+        provider_id: providerId,
+        state: 'not_started',
+        source: providerId === 'codex-lb' ? 'gateway' : 'openrouter',
+        generation: null,
+        digest: null,
+        model_count: 0,
+        checked_at: null,
+        expires_at: null,
+        blockers: [],
+        warnings: [],
+        recovery_action: null
+    };
+}

package/dist/core/codex-lb/combined-catalog.js

@@ -0,0 +1,12 @@
+import os from 'node:os';
+import path from 'node:path';
+export { BRIDGE_ACTIVE_GENERATION_FILENAME, BRIDGE_ACTIVE_GENERATION_SCHEMA, BRIDGE_ROUTE_INDEX_FILENAME, COMBINED_BRIDGE_CATALOG_FILENAME, COMBINED_BRIDGE_CATALOG_SCHEMA } from './combined-catalog/contracts.js';
+export { buildCombinedBridgeCatalog } from './combined-catalog/builder.js';
+export { activateCombinedBridgeCatalog, readActiveCombinedBridgeCatalog, stageCombinedBridgeCatalog } from './combined-catalog/persistence.js';
+import { BRIDGE_ROUTE_INDEX_FILENAME, COMBINED_BRIDGE_CATALOG_FILENAME } from './combined-catalog/contracts.js';
+export function combinedBridgeCatalogPath(codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex')) {
+    return path.join(path.resolve(codexHome), 'sks', COMBINED_BRIDGE_CATALOG_FILENAME);
+}
+export function bridgeRouteIndexPath(codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex')) {
+    return path.join(path.resolve(codexHome), 'sks', BRIDGE_ROUTE_INDEX_FILENAME);
+}

package/dist/core/codex-lb/desktop-bridge/client.js

@@ -1,4 +1,4 @@
-import { readDesktopBridgeState } from './state.js';
+import { isDesktopBridgeStateFresh, readDesktopBridgeState } from './state.js';
 import { safeBridgeErrorCode } from './security.js';
 export const desktopBridgeProcessExists = (pid) => {
     try {
@@ -30,5 +30,8 @@ export async function getDesktopBridgeStatus(input) {
     if (!processExists(state.pid)) {
         return { status: 'stale', state, blocker: 'bridge_process_not_running' };
     }
+    if (!isDesktopBridgeStateFresh(state)) {
+        return { status: 'stale', state, blocker: 'bridge_state_stale' };
+    }
     return { status: 'running', state };
 }

package/dist/core/codex-lb/desktop-bridge/header-policy.js

@@ -1,106 +1,87 @@
 import { rewriteLocationHeader } from './location-rewrite.js';
 import { DesktopBridgeError } from './types.js';
-const HOP_BY_HOP = new Set([
-    'connection',
-    'keep-alive',
-    'proxy-authenticate',
-    'proxy-authorization',
-    'te',
-    'trailer',
-    'transfer-encoding',
-    'upgrade',
+const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade']);
+const INTERNAL_PREFIX = 'x-sks-';
+const REQUEST_HEADER_ALLOWLIST = new Set([
+    'accept', 'accept-encoding', 'cache-control', 'content-encoding', 'content-length', 'content-type',
+]);
+const CODEX_LOCAL_HEADERS = new Set([
+    'thread-id', 'session-id', 'x-client-request-id', 'x-codex-installation-id',
+    'x-codex-turn-metadata', 'x-codex-window-id', 'originator',
 ]);
 const NEVER_FORWARD_FROM_CLIENT = new Set([
-    'authorization',
-    'cookie',
-    'forwarded',
-    'proxy-authorization',
-    'x-codex-lb-api-key',
-    'x-forwarded-for',
-    'x-forwarded-host',
-    'x-forwarded-port',
-    'x-forwarded-proto',
-    'x-real-ip',
-    'x-sks-child-model',
-    'x-sks-child-policy-hash',
-    'x-sks-child-request',
-    'x-sks-parent-snapshot-hash',
-    'x-sks-provider-mode',
-    'x-sks-session-id',
+    'authorization', 'cookie', 'forwarded', 'proxy-authorization', 'x-api-key', 'x-codex-lb-api-key',
+    'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-port', 'x-forwarded-proto', 'x-real-ip',
 ]);
 const NEVER_FORWARD_TO_CLIENT = new Set([
-    'authorization',
-    'cookie',
-    'proxy-authenticate',
-    'proxy-authorization',
-    'set-cookie',
-    'x-codex-lb-api-key',
+    'authorization', 'cookie', 'proxy-authenticate', 'proxy-authorization', 'set-cookie', 'x-api-key', 'x-codex-lb-api-key',
+]);
+const OPENROUTER_CLIENT_HEADERS = new Set(['http-referer', 'x-title']);
+const WEBSOCKET_HEADER_ALLOWLIST = new Set([
+    'sec-websocket-key', 'sec-websocket-version', 'sec-websocket-protocol', 'sec-websocket-extensions',
 ]);
 function connectionTokens(inbound) {
-    const raw = inbound.connection;
-    const values = Array.isArray(raw) ? raw : raw ? [raw] : [];
-    return new Set(values.flatMap((value) => value.split(',')).map((value) => value.trim().toLowerCase()).filter(Boolean));
+    const values = Array.isArray(inbound.connection) ? inbound.connection : inbound.connection ? [inbound.connection] : [];
+    return new Set(values.flatMap((v) => v.split(',')).map((v) => v.trim().toLowerCase()).filter(Boolean));
 }
-function injectGatewayCredential(result, gatewayKey, transport) {
-    if (transport === 'x-codex-lb-api-key') {
-        result['x-codex-lb-api-key'] = gatewayKey;
-        return;
+function injectCredential(result, providerId, transport, credential) {
+    if (credential.provider_id !== providerId || !credential.value || /[\r\n\0]/.test(credential.value)) {
+        throw new DesktopBridgeError('bridge_provider_credential_invalid');
     }
-    result.authorization = `Bearer ${gatewayKey}`;
+    if (providerId === 'openrouter' && transport !== 'openrouter-bearer')
+        throw new DesktopBridgeError('bridge_provider_auth_transport_mismatch');
+    if (providerId === 'codex-lb' && transport === 'openrouter-bearer')
+        throw new DesktopBridgeError('bridge_provider_auth_transport_mismatch');
+    if (transport === 'x-codex-lb-api-key')
+        result['x-codex-lb-api-key'] = credential.value;
+    else
+        result.authorization = `Bearer ${credential.value}`;
 }
-export function buildUpstreamHeaders(inbound, config, upstreamHost) {
+export function buildProviderUpstreamHeaders(inbound, context, upstreamHost) {
     const result = {};
-    const dynamicHopByHop = connectionTokens(inbound);
     for (const [rawName, rawValue] of Object.entries(inbound)) {
         if (rawValue === undefined)
             continue;
         const name = rawName.toLowerCase();
-        if (HOP_BY_HOP.has(name) || dynamicHopByHop.has(name))
-            continue;
-        if (NEVER_FORWARD_FROM_CLIENT.has(name) || name === 'host')
+        const providerAllowed = context.providerId === 'openrouter' && OPENROUTER_CLIENT_HEADERS.has(name);
+        if (!REQUEST_HEADER_ALLOWLIST.has(name) && !providerAllowed)
             continue;
         result[name] = rawValue;
     }
     result.host = upstreamHost;
-    injectGatewayCredential(result, config.gatewayKey, config.gatewayAuthTransport);
+    injectCredential(result, context.providerId, context.authTransport, context.credential);
     return result;
 }
-export function buildWebSocketHeaders(inbound, config, upstreamHost) {
-    const result = buildUpstreamHeaders(inbound, config, upstreamHost);
+export function buildProviderWebSocketHeaders(inbound, context, upstreamHost) {
+    const result = buildProviderUpstreamHeaders(inbound, context, upstreamHost);
     for (const [rawName, rawValue] of Object.entries(inbound)) {
         if (rawValue === undefined)
             continue;
         const name = rawName.toLowerCase();
-        if (name === 'connection' || name === 'upgrade' || name.startsWith('sec-websocket-')) {
+        if (WEBSOCKET_HEADER_ALLOWLIST.has(name))
             result[name] = rawValue;
-        }
     }
     result.connection = 'Upgrade';
     result.upgrade = 'websocket';
     return result;
 }
-export function rewriteResponseHeaders(inbound, config, localOrigin) {
+export function rewriteResponseHeaders(inbound, providerBaseUrl, localOrigin) {
     const result = {};
-    const dynamicHopByHop = connectionTokens(inbound);
+    const dynamic = connectionTokens(inbound);
     for (const [rawName, rawValue] of Object.entries(inbound)) {
         if (rawValue === undefined)
             continue;
         const name = rawName.toLowerCase();
-        if (HOP_BY_HOP.has(name) || dynamicHopByHop.has(name) || NEVER_FORWARD_TO_CLIENT.has(name))
-            continue;
-        if (name.startsWith('access-control-'))
+        if (HOP_BY_HOP.has(name) || dynamic.has(name) || NEVER_FORWARD_TO_CLIENT.has(name) || name.startsWith('access-control-'))
             continue;
         if (name === 'location') {
-            if (Array.isArray(rawValue) && rawValue.length !== 1) {
+            const values = Array.isArray(rawValue) ? rawValue : [rawValue];
+            if (values.length !== 1 || !values[0])
                 throw new DesktopBridgeError('bridge_location_header_invalid');
-            }
-            const location = Array.isArray(rawValue) ? rawValue[0] : rawValue;
-            if (!location)
-                throw new DesktopBridgeError('bridge_location_header_invalid');
-            result.location = rewriteLocationHeader(location, config.remoteBaseUrl, localOrigin);
-            continue;
+            result.location = rewriteLocationHeader(values[0], providerBaseUrl, localOrigin);
         }
-        result[name] = rawValue;
+        else
+            result[name] = rawValue;
     }
     return result;
 }
@@ -108,5 +89,9 @@ export function isRedactedHeaderName(name) {
     const normalized = name.toLowerCase();
     return NEVER_FORWARD_FROM_CLIENT.has(normalized)
         || NEVER_FORWARD_TO_CLIENT.has(normalized)
-        || normalized === 'set-cookie';
+        || CODEX_LOCAL_HEADERS.has(normalized)
+        || normalized.startsWith(INTERNAL_PREFIX);
+}
+export function redactHeaderValue(name, value) {
+    return isRedactedHeaderName(name) ? '[REDACTED]' : String(value ?? '');
 }