fix(proxy): isolate TLS sessions by account (#9837)

Co-authored-by: Antigravity Agent (via Agisota) <agisota@users.noreply.github.com>
This commit is contained in:
agisota
2026-08-10 09:24:51 +03:00
committed by GitHub
parent 2e6c151902
commit b80afbb74f
9 changed files with 2025 additions and 213 deletions

View File

@@ -529,6 +529,15 @@ export async function executeChatWithBreaker({
)
);
const tlsTrackingIdentity = {
provider,
sessionScope: credentials.connectionId,
};
// Track whenever direct TLS is possible. proxyFetch decides against wreq only
// after resolving NO_PROXY/local bypasses, so predicting from proxyInfo here
// would drop the account scope when a configured proxy resolves to direct.
const tlsFingerprintActive = isTlsFingerprintActive(provider);
if (isShadowTraffic) {
if (!bypassCircuitBreaker && breaker && !breaker.canExecute()) {
const retryAfterMs = breaker.getRetryAfterMs();
@@ -542,8 +551,8 @@ export async function executeChatWithBreaker({
};
}
if (!proxyInfo?.proxy && isTlsFingerprintActive()) {
const tracked = await runWithTlsTracking(chatFn);
if (tlsFingerprintActive) {
const tracked = await runWithTlsTracking(tlsTrackingIdentity, chatFn);
return { result: tracked.result, tlsFingerprintUsed: tracked.tlsFingerprintUsed };
}
@@ -552,8 +561,8 @@ export async function executeChatWithBreaker({
}
if (bypassCircuitBreaker) {
if (!proxyInfo?.proxy && isTlsFingerprintActive()) {
const tracked = await runWithTlsTracking(chatFn);
if (tlsFingerprintActive) {
const tracked = await runWithTlsTracking(tlsTrackingIdentity, chatFn);
return { result: tracked.result, tlsFingerprintUsed: tracked.tlsFingerprintUsed };
}
@@ -561,8 +570,10 @@ export async function executeChatWithBreaker({
return { result, tlsFingerprintUsed: false };
}
if (!proxyInfo?.proxy && isTlsFingerprintActive()) {
const tracked = await breaker.execute(async () => runWithTlsTracking(chatFn));
if (tlsFingerprintActive) {
const tracked = await breaker.execute(async () =>
runWithTlsTracking(tlsTrackingIdentity, chatFn)
);
return { result: tracked.result, tlsFingerprintUsed: tracked.tlsFingerprintUsed };
}