{"record":{"id":"03a1d2ddac5f1344","repo":"musistudio/claude-code-router","slug":"the-ccr-artifact-endpoint-attempted-a-redirect","errorCode":null,"errorMessage":"The CCR artifact endpoint attempted a redirect.","messagePattern":"The CCR artifact endpoint attempted a redirect\\.","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/agents/codex/media-preview-bridge.ts","lineNumber":305,"sourceCode":"  if (keys.length !== 1 || keys[0] !== \"token\" || !/^[A-Za-z0-9_-]{32}$/.test(token)) {\n    throw new Error(\"Artifact URL contains an invalid access token.\");\n  }\n  return { artifactId, url };\n}\n\nasync function loadCodexMediaArtifact(validated: ValidatedArtifactUrl, signal: AbortSignal): Promise<LoadedMediaArtifact> {\n  let response: Response;\n  try {\n    response = await fetch(validated.url, {\n      headers: { accept: \"image/*, video/*\" },\n      redirect: \"error\",\n      signal\n    });\n  } catch {\n    throw new Error(\"The CCR artifact request failed.\");\n  }\n  if (!response.ok) throw new Error(`The CCR artifact endpoint returned HTTP ${response.status}.`);\n  if (response.redirected) throw new Error(\"The CCR artifact endpoint attempted a redirect.\");\n  const declaredMimeType = (response.headers.get(\"content-type\") || \"\").split(\";\", 1)[0].trim().toLowerCase();\n  const declaredKind = mediaKind(declaredMimeType);\n  if (!declaredKind) throw new Error(\"The CCR artifact endpoint returned a non-media content type.\");\n  const maxBytes = declaredKind === \"video\" ? codexMediaPreviewMaxVideoBytes : codexMediaPreviewMaxImageBytes;\n  const declaredLength = Number(response.headers.get(\"content-length\") || \"0\");\n  if (declaredLength && (!Number.isSafeInteger(declaredLength) || declaredLength < 1 || declaredLength > maxBytes)) {\n    throw new Error(\"The CCR media artifact exceeds the inline preview size limit.\");\n  }\n  if (response.headers.get(\"content-encoding\") && response.headers.get(\"content-encoding\") !== \"identity\") {\n    throw new Error(\"Compressed CCR media artifacts are not accepted for inline preview.\");\n  }\n  if (!response.body) throw new Error(\"The CCR artifact response had no body.\");\n  const reader = response.body.getReader();\n  const chunks: Buffer[] = [];\n  let total = 0;\n  while (true) {\n    const part = await reader.read();\n    if (part.done) break;","sourceCodeStart":287,"sourceCodeEnd":323,"githubUrl":"https://github.com/musistudio/claude-code-router/blob/99f24806c6a2c660b16e53e95211c517448a6c90/packages/core/src/agents/codex/media-preview-bridge.ts#L287-L323","documentation":"Even though fetch was configured with redirect: 'error' (which normally makes redirects throw and produce error 50), some runtimes/servers can still yield a response flagged as redirected (e.g. non-standard redirect handling or a transparent proxy rewrite). This defensive check rejects any response whose final URL differs from the requested one.","triggerScenarios":"An intercepting proxy or service mesh silently rewrites the request to a different origin; a runtime whose fetch implementation follows redirects despite redirect: 'error'; an HTTP/2 server responding from a redirected location.","commonSituations":"Corporate proxies, local dev proxies (e.g. mitmproxy), or PaaS ingress layers that redirect artifact URLs; polyfilled fetch implementations (node-fetch versions with different redirect semantics) that follow redirects before the option is honored.","solutions":["Identify what is redirecting: fetch the URL manually with curl -v and inspect for 3xx or Location headers","Bypass or configure the proxy so the artifact URL is served directly","Ensure the runtime's fetch honors redirect: 'error' (upgrade Node >= 18 native fetch rather than a polyfill)","Use the final canonical URL of the artifact in the reference"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify the URL serves directly without a redirect before calling artifact()\nasync function isRedirectFree(url: string): Promise<boolean> {\n  const res = await fetch(url, { method: 'HEAD', redirect: 'error' });\n  return !res.redirected;\n}","typeGuard":"function isRedirectRejection(e: unknown): boolean {\n  return e instanceof Error && e.message.includes('attempted a redirect');\n}","tryCatchPattern":"try {\n  const media = await bridge.artifact(ref);\n} catch (e) {\n  if (isRedirectRejection(e)) return renderAsExternalLink(ref.url);\n  throw e;\n}","preventionTips":["Store canonical, non-redirecting artifact URLs","Avoid proxies that rewrite/redirect media requests","Use native fetch implementations that honor redirect: 'error'"],"tags":["redirect","security","fetch","codex"],"backgroundTag":"unexpected-http-redirect","analyzedSha":"99f24806c6a2c660b16e53e95211c517448a6c90","analyzedAt":"2026-08-27T04:11:01.184Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}