feat(transport): add opt-in Antigravity TLS profile

[yansigit]

Summary

• Add an opt-in tlsProfile: "antigravity-browser" transport for the canonical Google Antigravity OAuth provider, while leaving every unconfigured provider on Bun's existing fetch path.
• Restrict both configuration and runtime dispatch to the canonical HTTPS Cloud Code hosts, preserve abort identity and configured proxy routing, keep redirects manual, and redact transport failures.
• Load wreq-js@2.3.1 only inside the opted-in request path and expose a bounded disabled/active/failed status for management diagnostics.
• Document the provider setting and cover canonical-origin enforcement, dependency isolation, proxy pass-through/fail-closed behavior, status transitions, and transport boundaries.

Dependency/security context: wreq-js is an optional dependency with no install scripts or build hook. It is dynamically imported only after the exact provider/profile gate succeeds. The profile never activates during normal startup or for an omitted setting. Independent review verified origin pinning, manual redirects, proxy fail-closed behavior, abort preservation, error redaction, and the core/Lab boundary. Explicit maintainer security review is requested because this changes authenticated outbound transport and adds a dependency.

Verification

• bun test tests/providers/provider-runtime-fetch.test.ts tests/providers/provider-tls-profile.test.ts tests/responses/responses-fetch-helpers-boundary.test.ts tests/lab/core-lab-boundary.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts — 46 passed.
• bun run test:changed — 15,992 passed / 12 skipped / 0 failed at merge base bc973cf22.
• bun run test — 19,952 passed / 15 skipped / 0 failed, followed by every required serial gate passing at exact published head 0d38947ed.
• bun run typecheck — passed.
• bun run privacy:scan — passed.
• git diff --check — passed.
• (cd docs-site && bun install --frozen-lockfile && bun run build) — passed (425 pages).

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Co-authored-by: SB Yoon 44089734+yansigit@users.noreply.github.com

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json, src/server/auth-cors.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: bun.lock, package.json, src/server/auth-cors.ts.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@yansigit Tick the boxes once your local CI is green, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[yansigit]

The intake failure is the expected unsponsored_surface gate: this PR intentionally adds the optional wreq-js dependency and changes authenticated outbound TLS transport. Removing the dependency would remove the feature, so this should not be bypassed or rewritten as a no-dependency change. The dependency has no install/build scripts, is dynamically imported only after the exact opt-in Antigravity gate, and the full security/dependency analysis plus test evidence is in the PR description. Please apply the repository-required maintainer-sponsored label only if that review is satisfactory; until then the PR should remain draft and hygiene-blocked.

[lidge-jun]

리뷰 · 우선순위 48 / 80

이 PR은 캐논 Google Antigravity OAuth 목적지에서만 쓰는 옵트인 브라우저 흉내 TLS 프로필(tlsProfile: "antigravity-browser")을 넣습니다. 선택 의존성 wreq-js@2.3.1을 optionalDependencies로 추가하고, src/lib/provider-tls-profile.ts가 동적 import로 불러 호스트·어댑터·oauth·cloud-code-assist·HTTPS 캐논 호스트가 아니면 설정 단계에서 거절합니다. providerFetch(src/server/responses/fetch-helpers.ts)가 이름이 있을 때 이 래퍼를 끼웁니다. 리다이렉트는 manual, 설정 프록시를 못 지키면 fail-closed, 에러 메시지는 redact합니다.

지금 dev에는 이런 TLS 프로필 필드가 없고, Antigravity는 기존 Google 어댑터·Bun fetch로 갑니다. 테스트는 캐논 URL·잘못된 프로필·proxy 보존·시크릿 redact·fetch-helpers import 경계를 커버합니다. checklist 4/4는 채워져 있지만 hygiene가 unsponsored_surface로 막혀 intake: hygiene-blocked 상태입니다(경로: bun.lock, package.json, src/server/auth-cors.ts). 작성자도 “의존성을 빼면 기능이 사라지니 maintainer-sponsored가 필요하다”고 게이트 댓글에 적어 두었습니다.

우선순위 48인 이유다. 현장 TLS/지문 문제가 있으면 가치 있지만, release-244 로드맵 non-goal(새 프로바이더·광범위 인증 실험 자제)과 겹치는 선택 네이티브 의존성 + 인증 출구라 열차 앞자리가 아닙니다. enforce-target도 실패( draft 유지)입니다. 설계의 fail-closed·호스트 화이트리스트·동적 import는 방향이 맞지만, 메인테이너가 의존성 공급망·브라우저 프로필 고정값(chrome_142/windows)·프록시 의미론을 직접 보고 스폰서하기 전에는 Ready/머지하면 안 됩니다.

경로/심볼 - package.json / bun.lock wreq-js - optional native. unsponsored_surface 트리거
경로/심볼 - src/lib/provider-tls-profile.ts providerTlsFetch - 캐논 호스트만, proxy fallback이면 throw
경로 - src/server/responses/fetch-helpers.ts providerFetch - providerName 있을 때 TLS 래퍼 삽입
경로 - src/server/auth-cors.ts tlsProfile: "editor" - 관리 필드 정책. 인증 표면으로 hygiene에 잡힘
경로 - tests/providers/provider-tls-profile.test.ts - 단위는 충분. live Antigravity 증거는 본문/후속에 맡김

메인테이너의 판단이 필요한 지점

• maintainer-sponsored를 줄지(의존성·TLS 흉내 보안 리뷰 통과 여부)
• release-244 이후 별도 트랙으로 둘지, Antigravity 쿼터/계정 이슈와 묶을지
• 브라우저/OS 프로필 고정값이 업스트림 정책 변경에 얼마나 취약한지, 설정으로 열지

너의 추천
지금은 머지하지 마세요. hygiene 스폰서 리뷰를 먼저 하세요. 스폰서·보안 OK면 draft Ready 후 dev에 넣되, task-input/kiro 열차보다 뒤로 두세요. types/config 대분할 close-don't-rebase는 아니고, 의존성·auth 표면 게이트가 진짜 블로커입니다.

이 댓글은 grok-bot이 작성했습니다