0sec-cli 0.24.0 → 0.25.0

package/chunks/{chunk-EYBMTELO.js → chunk-EIONVEFN.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-BIJPMYFA.js";
+} from "./chunk-3T5R7P4T.js";
 import {
   MESSAGE_CACHE_BREAKPOINTS,
   planMessageBreakpoints,
@@ -13,7 +13,42 @@ import {
 } from "./chunk-RS4MAN3Q.js";
 import {
   VERSION
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-S3B6HFSM.js";
+
+// packages/core/dist/runtime/request-admission.js
+var LOCAL_ADMISSION_LIMIT = "LOCAL_REQUEST_ADMISSION_LIMIT:";
+var LOCAL_ADMISSION_UNAVAILABLE = "LOCAL_REQUEST_ADMISSION_UNAVAILABLE:";
+function parseRequestAdmission(catalog, model) {
+  const data = catalog?.data;
+  const row = Array.isArray(data) ? data.find((r) => r?.id === model) : void 0;
+  const c = row?.request_admission;
+  const integer = (n) => Number.isSafeInteger(n) && Number(n) >= 0;
+  if (!c || c.schema !== "0-inference-request-admission-v1" || c.counting !== "utf8_json_body_plus_framing" || !integer(c.max_body_bytes) || c.max_body_bytes < 1 || !(c.max_serialized_input_bytes === null || integer(c.max_serialized_input_bytes) && c.max_serialized_input_bytes > 0) || !integer(c.framing?.base_bytes) || !integer(c.framing?.per_message_bytes) || !integer(c.framing?.per_tool_bytes)) {
+    throw new Error("Gateway request admission contract is missing or invalid; no inference request sent");
+  }
+  return {
+    maxBodyBytes: c.max_body_bytes,
+    maxSerializedInputBytes: c.max_serialized_input_bytes,
+    baseBytes: c.framing.base_bytes,
+    perMessageBytes: c.framing.per_message_bytes,
+    perToolBytes: c.framing.per_tool_bytes
+  };
+}
+function assertRequestAdmission(body, contract) {
+  const value = JSON.parse(body);
+  const messages = value.messages ?? value.input;
+  const bytes = Buffer.byteLength(body, "utf8");
+  const inputBytes = bytes + contract.baseBytes + contract.perMessageBytes * (Array.isArray(messages) ? messages.length : 1) + contract.perToolBytes * (Array.isArray(value.tools) ? value.tools.length : 0);
+  if (bytes > contract.maxBodyBytes || contract.maxSerializedInputBytes !== null && inputBytes > contract.maxSerializedInputBytes) {
+    throw new Error(`${LOCAL_ADMISSION_LIMIT} body=${bytes}, input=${inputBytes}; exceeds gateway byte limit before dispatch`);
+  }
+}
+function isLocalAdmissionLimit(error) {
+  return error?.startsWith(LOCAL_ADMISSION_LIMIT) === true;
+}
+function isLocalAdmissionFailure(error) {
+  return isLocalAdmissionLimit(error) || error?.startsWith(LOCAL_ADMISSION_UNAVAILABLE) === true;
+}
 
 // packages/core/dist/agent/feature-presets.js
 var FP_MOAT_FLAGS = [
@@ -2253,7 +2288,7 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
       throw new Error(`${source} is unsupported: ${pinnedProviderRaw}`);
     }
     const provider = pinnedProviderRaw;
-    const model = preferredModel ?? env2["ZERO_MODEL"] ?? (provider === "azure" ? env2.AZURE_OPENAI_MODEL ?? parseCodexAzureConfig(env2).model : void 0) ?? (configProvider !== void 0 ? DEFAULT_PROVIDER_MODELS[provider] : void 0);
+    const model = preferredModel ?? env2["ZERO_MODEL"] ?? (provider === "azure" ? env2.AZURE_OPENAI_MODEL ?? parseCodexAzureConfig(env2).model : provider === "openai" ? env2.OPENAI_MODEL : void 0) ?? (configProvider !== void 0 ? DEFAULT_PROVIDER_MODELS[provider] : void 0);
     if (model === void 0 || model === "") {
       if (provider === "azure")
         throw new Error("Choose an Azure deployment model in Connections to finish setup.");
@@ -2291,7 +2326,7 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
       provider: "openai",
       apiKey: configApiKey,
       baseUrl: "https://api.openai.com/v1",
-      defaultModel: DEFAULT_OPENAI_MODEL,
+      defaultModel: env2.OPENAI_MODEL ?? DEFAULT_OPENAI_MODEL,
       wireApi: openAICompatibleWireApi(env2, "OPENAI_WIRE_API")
     };
   }
@@ -2415,7 +2450,7 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
         provider: "openai",
         apiKey: env2.OPENAI_API_KEY,
         baseUrl: env2.OPENAI_BASE_URL ?? "https://api.openai.com/v1",
-        defaultModel: DEFAULT_OPENAI_MODEL,
+        defaultModel: env2.OPENAI_MODEL ?? DEFAULT_OPENAI_MODEL,
         wireApi: openAICompatibleWireApi(env2, "OPENAI_WIRE_API")
       };
     default:
@@ -2477,7 +2512,7 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
       provider: "openai",
       apiKey: openaiKey,
       baseUrl: env2.OPENAI_BASE_URL ?? "https://api.openai.com/v1",
-      defaultModel: DEFAULT_OPENAI_MODEL,
+      defaultModel: env2.OPENAI_MODEL ?? DEFAULT_OPENAI_MODEL,
       wireApi: openAICompatibleWireApi(env2, "OPENAI_WIRE_API")
     };
   }
@@ -2587,7 +2622,10 @@ var LlmApiRuntime = class _LlmApiRuntime {
   config;
   // Not readonly: a live provider switch re-freezes env from the new account.
   env;
+  requestAdmission;
+  requestAdmissionIdentity;
   codexAuthState;
+  grantedProviderTransport;
   workbenchProviderProxy;
   geminiAuthState;
   provider;
@@ -2622,6 +2660,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
       };
       this.env = inherited.env;
       this.workbenchProviderProxy = inherited.workbenchProviderProxy;
+      this.grantedProviderTransport = inherited.grantedProviderTransport;
       this.provider = inherited.provider;
       this.apiKey = inherited.apiKey;
       this.baseUrl = inherited.baseUrl;
@@ -2660,7 +2699,33 @@ var LlmApiRuntime = class _LlmApiRuntime {
       ...config,
       ...config.agentModels ? { agentModels: Object.freeze({ ...config.agentModels }) } : {}
     };
+    this.grantedProviderTransport = config.providerTransport;
+    if (config.providerTransport) {
+      const grant = config.providerTransport;
+      if (grant.provider !== "chatgpt-codex" || config.provider && config.provider !== grant.provider || !config.model || !grant.models.includes(config.model))
+        throw new Error("Model is outside the explicit provider transport grant");
+      for (const model of Object.values(config.agentModels ?? {}))
+        if (model !== "auto" && !grant.models.includes(model))
+          throw new Error("Worker model is outside the explicit provider transport grant");
+      this.env = Object.freeze({ ZERO_SKIP_PROVIDER_BANNER: "1" });
+      this.workbenchProviderProxy = void 0;
+      this.azureConfig = parseCodexAzureConfig({});
+      this.fallbackChain = [];
+      this.fallbackIndex = 0;
+      this.provider = grant.provider;
+      this.apiKey = "";
+      this.baseUrl = "https://provider-relay.invalid";
+      this.wireApi = "responses";
+      this.model = config.model;
+      this.codexAuthState = void 0;
+      this.geminiAuthState = void 0;
+      this.reasoningEffort = void 0;
+      this.serverCompactionTokens = config.serverCompactionTokens === void 0 ? void 0 : Math.max(1e3, config.serverCompactionTokens);
+      return;
+    }
     this.env = Object.freeze({ ...process.env, ...config.env });
+    this.requestAdmission = void 0;
+    this.requestAdmissionIdentity = void 0;
     this.workbenchProviderProxy = resolveWorkbenchProviderProxy(this.env);
     this.azureConfig = parseCodexAzureConfig(this.env);
     this.fallbackChain = (this.workbenchProviderProxy ? [] : getFallbackChain(this.env)).map((entry) => ({
@@ -2709,6 +2774,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
   }
   /** Non-secret identity for preferences scoped to the captured connection. */
   connectionIdentity() {
+    if (this.grantedProviderTransport)
+      return this.grantedProviderTransport.identity;
     let identity;
     if (this.provider === "chatgpt-codex") {
       const state = this.codexAuthState;
@@ -2765,7 +2832,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
     const state = this.codexAuthState;
     if (this.provider !== "chatgpt-codex" || !state)
       throw new Error("No active Codex subscription");
-    const { loadCodexModelCatalog } = await import("./codex-models-FQPCWRPC.js");
+    const { loadCodexModelCatalog } = await import("./codex-models-KCUIVS3R.js");
     return loadCodexModelCatalog({ signal, resolveCredentials: () => refreshChatGptCodexAuthState(state) });
   }
   /** Discover endpoint inventory; Cline explicitly marks its public catalog provenance. */
@@ -2796,7 +2863,12 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * model / provider / role map with zero session teardown. Undefined fields
    * preserve the current state, except a provider change resets an omitted model.
    */
+  useGrantedProviderTransport(transport, selection = {}) {
+    this.applyConfiguration({ ...this.config, apiKey: void 0, env: {}, providerTransport: transport, provider: transport.provider, model: selection.model ?? this.model, ...selection });
+  }
   reconfigure(sel) {
+    if (this.grantedProviderTransport && (sel.provider && sel.provider !== this.grantedProviderTransport.provider || sel.model && !this.grantedProviderTransport.models.includes(sel.model) || Object.values(sel.agentModels ?? {}).some((model) => model !== "auto" && !this.grantedProviderTransport.models.includes(model))))
+      throw new Error("Selection is outside the explicit provider transport grant");
     const providerChanged = sel.provider !== void 0 && sel.provider !== this.provider;
     if (providerChanged) {
       const merged = {
@@ -2864,6 +2936,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * failover chain uses — including auth-only providers (chatgpt-codex OAuth).
    */
   accessibleProviders() {
+    if (this.grantedProviderTransport)
+      return [this.grantedProviderTransport.provider];
     if (this.workbenchProviderProxy)
       return ["chatgpt-codex"];
     const out = [];
@@ -2882,6 +2956,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * provider has creds, so this is a helpful starting set, not the whole bound.
    */
   accessibleModels() {
+    if (this.grantedProviderTransport)
+      return [...this.grantedProviderTransport.models];
     if (this.workbenchProviderProxy)
       return [this.workbenchProviderProxy.model];
     const models = /* @__PURE__ */ new Set();
@@ -2901,6 +2977,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * accessible defaults as a fallback for ids the router does not pattern-match.
    */
   isModelAccessible(model) {
+    if (this.grantedProviderTransport)
+      return this.grantedProviderTransport.models.includes(model);
     if (this.workbenchProviderProxy)
       return this.accessibleModels().includes(model);
     if (providerForModel(model, this.env) !== void 0)
@@ -3183,6 +3261,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
         for (const block of message.content) {
           if (block.type === "text") {
             parts.push({ text: block.text });
+          } else if (block.type === "image") {
+            parts.push({ inlineData: { mimeType: block.mediaType, data: block.data } });
           } else if (block.type === "tool_use") {
             toolNames.set(block.id, block.name);
             upstreamCallIds.set(block.id, block.id);
@@ -3401,27 +3481,68 @@ Missing: ${missing.join("; ")}
    * Headers are re-resolved per attempt (via ensureFreshHeaders → OAuth
    * refresh) so a token that rotated during the wait is picked up.
    */
+  async gatewayRequestAdmission(signal) {
+    if (this.workbenchProviderProxy)
+      throw new Error(`${LOCAL_ADMISSION_UNAVAILABLE} gateway admission cannot use a workbench proxy; no inference request sent`);
+    const model = this.model;
+    const baseUrl = this.baseUrl;
+    const identity = JSON.stringify([this.provider, baseUrl, model, this.wireApi]);
+    if (!this.requestAdmission || this.requestAdmissionIdentity !== identity) {
+      this.requestAdmissionIdentity = identity;
+      const pending = (async () => {
+        try {
+          const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/models`, {
+            headers: await this.ensureFreshHeaders(),
+            signal,
+            redirect: "error"
+          });
+          if (!response.ok)
+            throw new Error(`${LOCAL_ADMISSION_UNAVAILABLE} catalog HTTP ${response.status}; no inference request sent`);
+          return parseRequestAdmission(await response.json(), model);
+        } catch (error) {
+          if (error instanceof Error && error.message.startsWith(LOCAL_ADMISSION_UNAVAILABLE))
+            throw error;
+          throw new Error(`${LOCAL_ADMISSION_UNAVAILABLE} catalog unavailable or invalid; no inference request sent`);
+        }
+      })();
+      this.requestAdmission = pending;
+      void pending.catch(() => {
+        if (this.requestAdmission === pending && this.requestAdmissionIdentity === identity) {
+          this.requestAdmission = void 0;
+          this.requestAdmissionIdentity = void 0;
+        }
+      });
+    }
+    return this.requestAdmission;
+  }
   async postWithRetry(bodyFactory, signal, abort) {
     let waited429Ms = 0;
     let waitedOtherMs = 0;
     for (let attempt = 0; ; attempt++) {
       abort?.throwIfCancelled();
+      const body = bodyFactory();
+      if (this.env["ZERO_REQUIRE_REQUEST_ADMISSION"] === "1") {
+        assertRequestAdmission(body, await this.gatewayRequestAdmission(signal));
+      }
       let res;
       try {
-        res = this.workbenchProviderProxy ? await fetch(this.workbenchProviderProxy.url, {
+        res = this.grantedProviderTransport ? await this.grantedProviderTransport.request({ provider: "chatgpt-codex", model: this.model, body }, signal) : this.workbenchProviderProxy ? await fetch(this.workbenchProviderProxy.url, {
           method: "POST",
           redirect: "error",
           headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ provider: this.provider, model: this.model, body: bodyFactory() }),
+          body: JSON.stringify({ provider: this.provider, model: this.model, body }),
           signal
         }) : await fetch(this.buildUrl(), {
           method: "POST",
           headers: await this.ensureFreshHeaders(),
-          body: bodyFactory(),
+          body,
           signal
         });
       } catch (error) {
         abort?.throwIfCancelled();
+        if (this.env["ZERO_REQUIRE_RETRY_SAFE_RECEIPT"] === "1") {
+          throw new Error(`${this.providerLabel} request outcome may be unknown. Automatic replay is disabled`, { cause: error });
+        }
         const cause = error instanceof Error ? error.cause : void 0;
         const causeCode = cause && typeof cause === "object" && "code" in cause && typeof cause.code === "string" ? cause.code : "unknown";
         const causeHost = cause && typeof cause === "object" && "hostname" in cause && typeof cause.hostname === "string" ? `@${cause.hostname}` : "";
@@ -3445,6 +3566,10 @@ Missing: ${missing.join("; ")}
           cause: error
         });
       }
+      if (!res.ok && this.env["ZERO_REQUIRE_RETRY_SAFE_RECEIPT"] === "1" && res.headers.get("x-0-retry-safe") !== "1") {
+        await res.body?.cancel();
+        throw new Error(`${this.providerLabel} gateway HTTP ${res.status}; request outcome may be unknown. Automatic replay is disabled`);
+      }
       if (res.ok || !isRetryableHttpStatus(res.status)) {
         return res;
       }
@@ -3542,14 +3667,14 @@ Missing: ${missing.join("; ")}
     if (context?.signal?.aborted) {
       return { output: "", exitCode: null, timedOut: false, durationMs: 0, error: "API execution cancelled." };
     }
-    if (this.workbenchProviderProxy) {
+    if (this.grantedProviderTransport || this.workbenchProviderProxy) {
       const result = await this.executeNative(context?.systemPrompt ?? "", [
         { role: "user", content: [{ type: "text", text: prompt }] }
       ], [], void 0, context?.signal);
       return {
         output: result.content.filter((block) => block.type === "text").map((block) => block.text).join("\n"),
         exitCode: result.cancelled ? null : result.stopReason === "error" ? 1 : 0,
-        timedOut: false,
+        timedOut: result.timedOut === true,
         durationMs: Date.now() - start,
         usage: result.usage,
         error: result.error
@@ -3689,7 +3814,7 @@ Missing: ${missing.join("; ")}
         };
       }
       const msg = err instanceof Error ? err.message : String(err);
-      const timedOut = msg.includes("abort") || msg.includes("timeout");
+      const timedOut = controller.signal.aborted || msg.includes("abort") || msg.includes("timeout");
       return {
         output: "",
         exitCode: 1,
@@ -3720,6 +3845,11 @@ Missing: ${missing.join("; ")}
     let attempt = 0;
     for (attempt = 1; attempt <= maxAttempts; attempt++) {
       result = await this.executeNativeAttempt(system, messages, tools, callbacks, signal);
+      if (isLocalAdmissionFailure(result.error))
+        return result;
+      if (this.env["ZERO_REQUIRE_RETRY_SAFE_RECEIPT"] === "1" && (result.stopReason === "error" || result.error)) {
+        return { ...result, error: `${result.error ?? "Incomplete gateway response"}. Request outcome may be unknown. Automatic replay is disabled` };
+      }
       if (attempt >= maxAttempts || !shouldRetryNativeStream(result) || signal?.aborted)
         break;
       const backoff = streamRetryBackoffMs(attempt);
@@ -3755,6 +3885,10 @@ Missing: ${missing.join("; ")}
           const chatMessages = [];
           chatMessages.push({ role: "system", content: system });
           for (const m of messages) {
+            if (m.role === "user" && m.content.some((block) => block.type === "image") && m.content.every((block) => block.type === "text" || block.type === "image")) {
+              chatMessages.push({ role: "user", content: m.content.map((block) => block.type === "image" ? { type: "image_url", image_url: { url: `data:${block.mediaType};base64,${block.data}` } } : { type: "text", text: block.type === "text" ? block.text : "" }) });
+              continue;
+            }
             const pendingToolCalls = [];
             let pendingAssistantText = null;
             const flushAssistant = () => {
@@ -3779,6 +3913,9 @@ Missing: ${missing.join("; ")}
                   flushAssistant();
                   chatMessages.push({ role: m.role, content: block.text });
                 }
+              } else if (block.type === "image") {
+                flushAssistant();
+                chatMessages.push({ role: m.role, content: [{ type: "image_url", image_url: { url: `data:${block.mediaType};base64,${block.data}` } }] });
               } else if (block.type === "tool_use") {
                 pendingToolCalls.push({
                   id: block.id,
@@ -3836,6 +3973,8 @@ Missing: ${missing.join("; ")}
             for (const block of m.content) {
               if (block.type === "text") {
                 textBlocks.push({ type: textType, text: block.text });
+              } else if (block.type === "image") {
+                textBlocks.push({ type: "input_image", image_url: `data:${block.mediaType};base64,${block.data}` });
               } else if (block.type === "tool_use") {
                 if (textBlocks.length > 0) {
                   input.push({ role: m.role, content: [...textBlocks] });
@@ -3991,6 +4130,8 @@ Missing: ${missing.join("; ")}
               content: m.content.map((block) => {
                 if (block.type === "text")
                   return { type: "text", text: block.text };
+                if (block.type === "image")
+                  return { type: "image", source: { type: "base64", media_type: block.mediaType, data: block.data } };
                 if (block.type === "tool_use") {
                   return { type: "tool_use", id: block.id, name: block.name, input: block.input };
                 }
@@ -4169,6 +4310,14 @@ Missing: ${missing.join("; ")}
       };
     } catch (err) {
       clearTimeout(timer);
+      if (err instanceof Error && isLocalAdmissionFailure(err.message))
+        return {
+          content: [],
+          stopReason: "error",
+          durationMs: Date.now() - start,
+          error: err.message,
+          ...call.operatorAborted() ? { cancelled: true } : {}
+        };
       if (err instanceof OperatorAbortError || call.operatorAborted()) {
         return this.cancelledResult(start);
       }
@@ -4181,11 +4330,12 @@ Missing: ${missing.join("; ")}
         };
       }
       const msg = err instanceof Error ? err.message : String(err);
-      const timedOut = msg.includes("abort") || msg.includes("timeout");
+      const timedOut = controller.signal.aborted || msg.includes("abort") || msg.includes("timeout");
       return {
         content: [{ type: "text", text: "" }],
         stopReason: "error",
         durationMs: Date.now() - start,
+        ...timedOut ? { timedOut: true } : {},
         error: timedOut ? `${this.providerLabel} API request timed out` : `${this.providerLabel} API error: ${msg}`
       };
     } finally {
@@ -4202,6 +4352,17 @@ Missing: ${missing.join("; ")}
         error: `${this.providerLabel} API error: missing response body`
       };
     }
+    let cancellationRequested = false;
+    const cancelReader = () => {
+      if (cancellationRequested)
+        return;
+      cancellationRequested = true;
+      try {
+        void reader.cancel().catch(() => {
+        });
+      } catch {
+      }
+    };
     const idleTimeoutMs = opts?.idleTimeoutMs ?? llmStreamIdleTimeoutMs();
     const eventIdleTimeoutMs = opts?.eventIdleTimeoutMs ?? llmStreamEventIdleTimeoutMs();
     let lastEventAt = Date.now();
@@ -4240,11 +4401,12 @@ Missing: ${missing.join("; ")}
           // for a body that is buffered, mocked, or already fully delivered.
           ...operatorSignal && detach ? [
             new Promise((_resolve, reject) => {
+              const abortError = () => opts?.abort?.operatorAborted() ? new OperatorAbortError() : new DOMException("Request deadline aborted the stream", "AbortError");
               if (operatorSignal.aborted) {
-                reject(new OperatorAbortError());
+                reject(abortError());
                 return;
               }
-              operatorSignal.addEventListener("abort", () => reject(new OperatorAbortError()), { once: true, signal: detach.signal });
+              operatorSignal.addEventListener("abort", () => reject(abortError()), { once: true, signal: detach.signal });
             })
           ] : []
         ]);
@@ -4295,17 +4457,11 @@ Missing: ${missing.join("; ")}
         chunk = await readBounded();
       } catch (err) {
         if (err instanceof OperatorAbortError || opts?.abort?.operatorAborted()) {
-          try {
-            await reader.cancel();
-          } catch {
-          }
+          cancelReader();
           throw err instanceof OperatorAbortError ? err : new OperatorAbortError();
         }
         if (stalled) {
-          try {
-            await reader.cancel();
-          } catch {
-          }
+          cancelReader();
           const secs = Math.round(stallIdleMs / 1e3);
           diag.warn("stream_stalled", `${this.providerLabel} stream stalled \u2014 no SSE events for ${secs}s (server hold; aborting call)`, {
             provider: this.providerLabel,
@@ -4319,6 +4475,7 @@ Missing: ${missing.join("; ")}
             error: `${this.providerLabel} stream stalled \u2014 no SSE events for ${secs}s (server accepted but held the stream; transient)`
           };
         }
+        cancelReader();
         throw err;
       }
       const { done, value } = chunk;
@@ -4358,6 +4515,10 @@ Missing: ${missing.join("; ")}
         if (eventTypes.size < 32)
           eventTypes.add(identifier(type) ?? "unrecognized");
         const terminal = type === "response.completed" || this.provider === "openrouter" && type === "response.done";
+        if (completedResponse && (type === "response.output_text.delta" || type === "response.content_part.delta" || type === "response.output_item.added" || type === "response.output_item.done" || type === "response.reasoning_summary_text.delta" || type === "response.reasoning_summary_text.done")) {
+          streamFailure = { event: type, status: null, code: "output_after_completion", errorType: null, reason: null };
+          break responses;
+        }
         if (terminal || type === "response.failed" || type === "response.incomplete" || type === "error") {
           const response = event.response && typeof event.response === "object" && !Array.isArray(event.response) ? event.response : void 0;
           const usage = response?.usage;
@@ -4430,11 +4591,22 @@ Missing: ${missing.join("; ")}
           continue;
         }
       }
+      if (completedResponse)
+        break;
     }
+    if (completedResponse || outputCapResponse || streamFailure)
+      cancelReader();
     emitThinking(true);
+    if (!outputCapResponse && opts?.abort?.operatorAborted()) {
+      cancelReader();
+      return { ...this.cancelledResult(start), ...responseUsage ? { usage: responseUsage } : {} };
+    }
+    if (opts?.abort?.signal.aborted && !opts.abort.operatorAborted()) {
+      cancelReader();
+      throw new DOMException("Request deadline aborted the stream", "AbortError");
+    }
     if (outputCapResponse) {
-      void reader.cancel().catch(() => {
-      });
+      cancelReader();
       const finalOutput = Array.isArray(outputCapResponse.output) ? outputCapResponse.output : [];
       const output = finalOutput.length > 0 ? finalOutput : streamedOutputItems;
       let finalText = "";
@@ -4474,8 +4646,7 @@ Missing: ${missing.join("; ")}
     }
     if (!completedResponse || streamFailure) {
       if (streamFailure) {
-        void reader.cancel().catch(() => {
-        });
+        cancelReader();
       }
       appendNativeTrace({
         kind: "native-response-stream-error",
@@ -4558,6 +4729,12 @@ Missing: ${missing.join("; ")}
       thinkingText = reasoningSummaries.join("\n");
       emitThinking(true);
     }
+    if (opts?.abort?.operatorAborted()) {
+      return { ...this.cancelledResult(start), ...responseUsage ? { usage: responseUsage } : {} };
+    }
+    if (opts?.abort?.signal.aborted) {
+      throw new DOMException("Request deadline aborted the stream", "AbortError");
+    }
     return {
       content,
       stopReason: content.some((item) => item.type === "tool_use") ? "tool_use" : "end_turn",
@@ -4578,7 +4755,7 @@ Missing: ${missing.join("; ")}
     };
   }
   async isAvailable() {
-    if (this.workbenchProviderProxy)
+    if (this.grantedProviderTransport || this.workbenchProviderProxy)
       return true;
     if (this.provider === "chatgpt-codex") {
       return this.codexAuthState !== void 0;
@@ -4588,6 +4765,8 @@ Missing: ${missing.join("; ")}
 };
 
 export {
+  isLocalAdmissionLimit,
+  isLocalAdmissionFailure,
   FEATURE_PRESETS,
   resolveFeaturePreset,
   applyFeaturePreset,