fix(retry): require explicit replay-safe opt-in for connection-reset retries

[luvs01]

Author status: redesign required

This remains a worthwhile retry-safety problem, but the original blanket opt-in patch is not review-ready against the current retry architecture. The replacement needs to preserve the shared send budget and provider retry policy while carrying ambiguous-send evidence through the outer recovery/failover boundary. Existing old-head tests do not establish that end-to-end property. Keep this PR as a redesign item; do not merge the old patch solely on its focused helper tests.

The implementation and test statements below describe the original patch and are historical evidence, not current review-readiness proof.

Motivation

• Prevent connection-reset retry wrappers from silently replaying non-idempotent upstream POSTs (model/sidecar calls) that may have already been processed by the origin.

Description

• Add an explicit replaySafe?: boolean flag to ResetRetryOptions and document that a pre-header rejection does not prove the origin did not process the request. (changed src/lib/upstream-retry.ts).
• Make fetchWithResetRetry perform a single attempt by default and only enable the multi-attempt reset-retry behavior when opts.replaySafe is true. (changed src/lib/upstream-retry.ts).
• Update tests to cover the new fail-closed default and preserve coverage for explicit replay-safe behavior and transport-attribution evidence handling. (updated tests/upstream-retry.test.ts and tests/issue-914-transport-attribution.test.ts).

Testing

• Ran bun run typecheck and it completed successfully.
• Ran focused test suites with bun test tests/upstream-retry.test.ts tests/upstream-transient-retry.test.ts tests/issue-914-transport-attribution.test.ts and all tests in those suites passed.
• Ran bun run privacy:scan and it passed; a full bun run test was attempted but encountered unrelated time/state-dependent test failures outside the retry changes, while the focused retry tests remained green.

---

Codex Task

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 5baa332b-c566-462c-88b5-68d495eca1bd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.

[luvs01]

상류에 현재 구조에 맞춰 재설계한 대체 PR을 게시했습니다: lidge-jun#4741

기존 초안의 일괄 재시도 횟수 제한은 옮기지 않았습니다. 실제 전송 횟수 예산과 공급자별 HTTP 재시도 정책을 유지하면서, 처리 여부가 불확실한 연결 종료의 재전송을 막고 adapter → combo → 오류 포맷터까지 재전송 금지 코드와 표시를 보존합니다.

집중 회귀 테스트, 타입 검사, 구조·개인정보·파일 크기 검사는 통과했습니다. 전체 테스트 검증이 아직 진행 중이므로 상류 PR은 draft로 게시했습니다. 이 PR은 원래의 설계 기록으로 그대로 남겨 두었습니다.

[luvs01]

Closing this tracking PR. The explicit replay-safe opt-in for connection resets work was reimplemented against current upstream dev and is being carried forward there, so keeping a second copy of the same change open here only splits review and rebase effort. Nothing in this branch is lost: the implementation, its regression coverage and the documentation all moved with it, and the remaining verification is happening on the branch that is actually up for review.