feat(transport): add opt-in Antigravity TLS profile

[yansigit]

Summary

• Add an opt-in tlsProfile: "antigravity-browser" transport for the canonical Google Antigravity OAuth provider, while leaving every unconfigured provider on Bun's existing fetch path.
• Restrict both configuration and runtime dispatch to the canonical HTTPS Cloud Code hosts, preserve abort identity and configured proxy routing, keep redirects manual, and redact transport failures.
• Load wreq-js@2.3.1 only inside the opted-in request path and expose a bounded disabled/active/failed status for management diagnostics.
• Document the provider setting and cover canonical-origin enforcement, dependency isolation, proxy pass-through/fail-closed behavior, status transitions, and transport boundaries.

Dependency/security context: wreq-js is an optional dependency with no install scripts or build hook. It is dynamically imported only after the exact provider/profile gate succeeds. The profile never activates during normal startup or for an omitted setting. Independent review verified origin pinning, manual redirects, proxy fail-closed behavior, abort preservation, error redaction, and the core/Lab boundary. Explicit maintainer security review is requested because this changes authenticated outbound transport and adds a dependency.

Verification

• bun test tests/providers/provider-runtime-fetch.test.ts tests/providers/provider-tls-profile.test.ts tests/responses/responses-fetch-helpers-boundary.test.ts tests/lab/core-lab-boundary.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts — 46 passed.
• bun run test:changed — 15,992 passed / 12 skipped / 0 failed at merge base bc973cf22.
• bun run test — 19,952 passed / 15 skipped / 0 failed, followed by every required serial gate passing at exact published head 0d38947ed.
• bun run typecheck — passed.
• bun run privacy:scan — passed.
• git diff --check — passed.
• (cd docs-site && bun install --frozen-lockfile && bun run build) — passed (425 pages).

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked.

• All CI tests are green on my local testing.
• I pushed my PR to the latest dev commit.
• I resolved all correct Codex and CodeRabbit findings.
• My PR is ready for review.

Co-authored-by: SB Yoon 44089734+yansigit@users.noreply.github.com

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json, src/server/auth-cors.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json, src/server/auth-cors.ts.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[yansigit]

The intake failure is the expected unsponsored_surface gate: this PR intentionally adds the optional wreq-js dependency and changes authenticated outbound TLS transport. Removing the dependency would remove the feature, so this should not be bypassed or rewritten as a no-dependency change. The dependency has no install/build scripts, is dynamically imported only after the exact opt-in Antigravity gate, and the full security/dependency analysis plus test evidence is in the PR description. Please apply the repository-required maintainer-sponsored label only if that review is satisfactory; until then the PR should remain draft and hygiene-blocked.

[lidge-jun]

리뷰 · 우선순위 48 / 80

이 PR은 캐논 Google Antigravity OAuth 목적지에서만 쓰는 옵트인 브라우저 흉내 TLS 프로필(tlsProfile: "antigravity-browser")을 넣습니다. 선택 의존성 wreq-js@2.3.1을 optionalDependencies로 추가하고, src/lib/provider-tls-profile.ts가 동적 import로 불러 호스트·어댑터·oauth·cloud-code-assist·HTTPS 캐논 호스트가 아니면 설정 단계에서 거절합니다. providerFetch(src/server/responses/fetch-helpers.ts)가 이름이 있을 때 이 래퍼를 끼웁니다. 리다이렉트는 manual, 설정 프록시를 못 지키면 fail-closed, 에러 메시지는 redact합니다.

지금 dev에는 이런 TLS 프로필 필드가 없고, Antigravity는 기존 Google 어댑터·Bun fetch로 갑니다. 테스트는 캐논 URL·잘못된 프로필·proxy 보존·시크릿 redact·fetch-helpers import 경계를 커버합니다. checklist 4/4는 채워져 있지만 hygiene가 unsponsored_surface로 막혀 intake: hygiene-blocked 상태입니다(경로: bun.lock, package.json, src/server/auth-cors.ts). 작성자도 “의존성을 빼면 기능이 사라지니 maintainer-sponsored가 필요하다”고 게이트 댓글에 적어 두었습니다.

우선순위 48인 이유다. 현장 TLS/지문 문제가 있으면 가치 있지만, release-244 로드맵 non-goal(새 프로바이더·광범위 인증 실험 자제)과 겹치는 선택 네이티브 의존성 + 인증 출구라 열차 앞자리가 아닙니다. enforce-target도 실패( draft 유지)입니다. 설계의 fail-closed·호스트 화이트리스트·동적 import는 방향이 맞지만, 메인테이너가 의존성 공급망·브라우저 프로필 고정값(chrome_142/windows)·프록시 의미론을 직접 보고 스폰서하기 전에는 Ready/머지하면 안 됩니다.

경로/심볼 - package.json / bun.lock wreq-js - optional native. unsponsored_surface 트리거
경로/심볼 - src/lib/provider-tls-profile.ts providerTlsFetch - 캐논 호스트만, proxy fallback이면 throw
경로 - src/server/responses/fetch-helpers.ts providerFetch - providerName 있을 때 TLS 래퍼 삽입
경로 - src/server/auth-cors.ts tlsProfile: "editor" - 관리 필드 정책. 인증 표면으로 hygiene에 잡힘
경로 - tests/providers/provider-tls-profile.test.ts - 단위는 충분. live Antigravity 증거는 본문/후속에 맡김

메인테이너의 판단이 필요한 지점

• maintainer-sponsored를 줄지(의존성·TLS 흉내 보안 리뷰 통과 여부)
• release-244 이후 별도 트랙으로 둘지, Antigravity 쿼터/계정 이슈와 묶을지
• 브라우저/OS 프로필 고정값이 업스트림 정책 변경에 얼마나 취약한지, 설정으로 열지

너의 추천
지금은 머지하지 마세요. hygiene 스폰서 리뷰를 먼저 하세요. 스폰서·보안 OK면 draft Ready 후 dev에 넣되, task-input/kiro 열차보다 뒤로 두세요. types/config 대분할 close-don't-rebase는 아니고, 의존성·auth 표면 게이트가 진짜 블로커입니다.

이 댓글은 grok-bot이 작성했습니다