fix(oci): close transport review gaps

Author: Bill Leoutsakos

apps/sim/lib/internal/oci/client.server.test.ts

@@ -587,6 +587,22 @@ describe('credential-bound OCI client', () => {
     expect(mocks.secureFetch).toHaveBeenCalledOnce()
   })
 
+  it('retries the bounded transport timeout', async () => {
+    mocks.secureFetch
+      .mockRejectedValueOnce(new Error('Request timed out after 9000ms'))
+      .mockResolvedValueOnce(secureResponse({ status: 200 }))
+    const { client, endpoint } = await createPreparedClient()
+    await client.request({
+      endpoint,
+      method: 'GET',
+      encodedPath: '/v1/test',
+      retry: { kind: 'safe', maxAttempts: 2 },
+      timeoutMs: 10_000,
+      maxResponseBytes: 1024,
+    })
+    expect(mocks.secureFetch).toHaveBeenCalledTimes(2)
+  })
+
   it('discards provider messages and exposes only safe status and request IDs', async () => {
     const opaqueProviderSecret = 'opaque-diagnostic-secret-7f3a'
     mocks.secureFetch.mockResolvedValueOnce(
@@ -729,6 +745,37 @@ describe('credential-bound OCI client', () => {
     ).rejects.toMatchObject({ code: 'invalid_endpoint' })
   })
 
+  it('prepares discovery from the retained safe Location header', async () => {
+    const policy = createOciDiscoveredEndpointPolicy({
+      serviceId: OCI_SERVICE_ID,
+      serviceName: 'database',
+      hostnameTemplate: 'regional',
+      responsePolicy: STATIC_POLICY,
+      source: { kind: 'header', name: 'location' },
+    })
+    const { client, endpoint } = await createPreparedClient()
+    mocks.secureFetch.mockResolvedValueOnce(
+      secureResponse({
+        headers: {
+          location: 'https://resource.database.us-ashburn-1.oraclecloud.com',
+          'x-provider-secret': 'hidden',
+        },
+      })
+    )
+    const response = await client.request({
+      endpoint,
+      method: 'GET',
+      encodedPath: '/v1/test',
+      responseHeaders: ['location'],
+      timeoutMs: 10_000,
+      maxResponseBytes: 1024,
+    })
+    expect((await client.prepareDiscoveredEndpoint(policy, response)).origin).toBe(
+      'https://resource.database.us-ashburn-1.oraclecloud.com'
+    )
+    expect(response.headers).not.toHaveProperty('x-provider-secret')
+  })
+
   it('propagates caller abort without leaking a transport failure', async () => {
     const controller = new AbortController()
     mocks.secureFetch.mockImplementationOnce(

apps/sim/lib/internal/oci/client.server.ts

@@ -591,9 +591,12 @@ async function readFailureCode(
 }
 
 function isRetryableTransportFailure(error: unknown): boolean {
-  if (!error || typeof error !== 'object') return false
+  if (!(error instanceof Error)) return false
   const code = (error as { code?: unknown }).code
-  return typeof code === 'string' && RETRYABLE_TRANSPORT_CODES.has(code)
+  return (
+    (typeof code === 'string' && RETRYABLE_TRANSPORT_CODES.has(code)) ||
+    /^Request timed out after \d+ms$/.test(error.message)
+  )
 }
 
 function extractDiscoveredOrigin(

apps/sim/lib/internal/oci/endpoints.test.ts

@@ -113,14 +113,14 @@ describe('OCI endpoint policies', () => {
       serviceName: 'database',
       hostnameTemplate: 'regional',
       responsePolicy: staticPolicy,
-      source: { kind: 'header', name: 'Endpoint' },
+      source: { kind: 'header', name: 'location' },
       allowRegionalHost: true,
     })
     expect(
       resolveDiscoveredOciEndpoint(policy, region, 'https://database.us-ashburn-1.oraclecloud.com')
         .origin
     ).toBe('https://database.us-ashburn-1.oraclecloud.com')
-    expect(policy.source).toEqual({ kind: 'header', name: 'endpoint' })
+    expect(policy.source).toEqual({ kind: 'header', name: 'location' })
     expect(Object.isFrozen(policy.source)).toBe(true)
   })
 
@@ -158,5 +158,14 @@ describe('OCI endpoint policies', () => {
         source: { kind: 'json', path: ['endpoint'] },
       })
     ).toThrow('same owning service')
+    expect(() =>
+      createOciDiscoveredEndpointPolicy({
+        serviceId: OCI_SERVICE_ID,
+        serviceName: 'database',
+        hostnameTemplate: 'regional',
+        responsePolicy: staticPolicy,
+        source: { kind: 'header', name: 'x-custom-endpoint' } as never,
+      })
+    ).toThrow('safe Location')
   })
 })

apps/sim/lib/internal/oci/endpoints.ts

@@ -38,7 +38,7 @@ export interface OciStaticEndpointPolicy {
 }
 
 export type OciDiscoverySource =
-  | { readonly kind: 'header'; readonly name: string }
+  | { readonly kind: 'header'; readonly name: 'location' }
   | { readonly kind: 'json'; readonly path: readonly string[] }
 
 export interface OciDiscoveredEndpointPolicy {
@@ -214,8 +214,8 @@ function assertHostnameTemplate(value: OciHostnameTemplate): void {
 
 function assertDiscoverySource(source: OciDiscoverySource): void {
   if (source.kind === 'header') {
-    if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(source.name)) {
-      throw new Error('OCI discovery header name is invalid')
+    if (source.name !== 'location') {
+      throw new Error('OCI discovery header must be the safe Location response header')
     }
     return
   }
@@ -266,7 +266,7 @@ export function createOciDiscoveredEndpointPolicy(params: {
   const source =
     params.source.kind === 'json'
       ? Object.freeze({ ...params.source, path: Object.freeze([...params.source.path]) })
-      : Object.freeze({ ...params.source, name: params.source.name.toLowerCase() })
+      : Object.freeze({ ...params.source })
   return Object.freeze({
     kind: 'authenticated-discovery',
     serviceId: params.serviceId,