Audit native transports and retain secure export diagnostics

apps/server/ai-gateway.mjs

@@ -16,18 +16,19 @@ export function approvedAIEndpoint(policy,config){
 }
 export async function runApprovedAI({store,config,deviceId,policy,prompt,signal}){
  return traceOperation('ai.gateway',{policyVersion:policy.version,bytes:Buffer.byteLength(prompt)},async()=>{
-  const controller=new AbortController();
-  const cancel=()=>controller.abort();
+  const controller=new AbortController();let cancellationError;
+  const abortWith=error=>{cancellationError??=error;controller.abort();};
+  const cancel=()=>abortWith(rejected(403,'AI authorization changed during processing','ai-authorization-changed'));
   signal?.addEventListener('abort',cancel,{once:true});
   if(signal?.aborted)cancel();
   function assertCurrent(){
    const active=store.db.prepare('SELECT id FROM devices WHERE id=? AND revoked=0').get(deviceId);
    const policyChanged=active&&!isDeepStrictEqual(store.effectivePolicy(deviceId),policy);
    if(controller.signal.aborted||!active||Date.parse(policy.expiresAt)<=Date.now()||policyChanged){
-    controller.abort();throw rejected(policyChanged?409:403,'AI authorization changed during processing','ai-authorization-changed');
+    abortWith(rejected(policyChanged?409:403,'AI authorization changed during processing','ai-authorization-changed'));throw cancellationError;
    }
   }
-  const deadline=setTimeout(()=>controller.abort(),60000);
+  const deadline=setTimeout(()=>abortWith(rejected(504,'AI request timed out','ai-request-timeout')),60000);
   const monitor=setInterval(()=>{try{assertCurrent();}catch{/* Abort pending provider work; release checks report the fixed failure. */}},100);
   monitor.unref();deadline.unref();
   try{
@@ -62,7 +63,7 @@ export async function runApprovedAI({store,config,deviceId,policy,prompt,signal}
    const output=await traceOperation('ai.inspect.output',{bytes:Buffer.byteLength(answer),policyVersion:policy.version},()=>scan(answer));store.event(deviceId,'ai.output-decision',{...output,policyVersion:policy.version});
    if(output.decision==='block'){store.event(deviceId,'ai.output-block',{ruleId:output.ruleId,policyVersion:policy.version});throw rejected(403,'AI response blocked by company policy',output.ruleId);}
    assertCurrent();return answer;
-  }catch(e){store.event(deviceId,'ai.failure',{policyVersion:policy.version});throw e;}
+  }catch(e){store.event(deviceId,'ai.failure',{policyVersion:policy.version});throw cancellationError||e;}
   finally{clearTimeout(deadline);clearInterval(monitor);signal?.removeEventListener('abort',cancel);controller.abort();}
  });
 }