@bitkyc08/opencodex 2.77.0 → 2.78.0

package/src/adapters/ollama-native.ts

@@ -71,7 +71,7 @@ interface PendingToolCall {
   namespace?: string;
   wireName: string;
   order: number;
-  result?: OcxMessage & { role: "toolResult" };
+  results: Array<OcxMessage & { role: "toolResult" }>;
 }
 
 interface PendingToolBatch {
@@ -307,7 +307,7 @@ function assistantTextThinkingAndCalls(message: OcxAssistantMessage): {
  * Build native replay messages without mutating the parsed history. Keep tool results
  * beside their originating batch, deferring intervening conversation until settlement.
  * Reserve replayed call IDs for response translation and mark missing results explicitly.
- * @throws When call IDs are invalid or results are orphaned, duplicated, or mismatched.
+ * @throws When call IDs are invalid or results are orphaned or mismatched.
  */
 function buildNativeMessages(
   parsed: OcxParsedRequest,
@@ -324,6 +324,7 @@ function buildNativeMessages(
   // owned by this adapter/request lifecycle rather than process-global state.
   reservedToolCallIds.clear();
   let pending: PendingToolBatch | undefined;
+  const issuedCalls = new Map<string, PendingToolCall>();
   // Codex records mid-turn injections (a PostToolUse hook verdict, a context notice) between an
   // assistant tool call and that call's own tool result. Native Ollama needs the call and its
   // results adjacent, so those conversational messages wait here instead of closing the batch
@@ -341,10 +342,9 @@ function buildNativeMessages(
   const flushPending = (): void => {
     if (!pending) return;
     for (const call of pending.calls) {
-      if (!call.result) {
-        // No result exists anywhere in the replayed history: the turn was interrupted, or the
-        // result never reached it. State exactly that instead of inventing an outcome, and keep
-        // the conversation replayable.
+      if (call.results.length === 0) {
+        // No result was available when this batch settled. A later notification is carried
+        // separately, not used to invent an outcome at this earlier conversation boundary.
         messages.push({
           role: "tool",
           tool_call_id: call.id,
@@ -356,13 +356,18 @@ function buildNativeMessages(
         });
         continue;
       }
-      const translated = contentToNative(call.result.content, "tool result");
+      // A code-mode cell can yield, then notify repeatedly. Join once at settlement rather
+      // than repeatedly copying an ever-growing result, and never mutate the source history.
+      const fragments = call.results.map(result => ({
+        ...contentToNative(result.content, "tool result"), isError: result.isError,
+      }));
+      const images = fragments.flatMap(fragment => fragment.images ?? []);
       messages.push({
         role: "tool",
         tool_call_id: call.id,
         tool_name: call.wireName,
-        content: translated.content,
-        ...(translated.images ? { images: translated.images } : {}),
+        content: fragments.map(fragment => `${fragment.isError ? "ERROR: " : ""}${fragment.content}`).join("\n"),
+        ...(images.length ? { images } : {}),
       });
     }
     pending = undefined;
@@ -371,21 +376,30 @@ function buildNativeMessages(
 
   for (const message of parsed.context.messages) {
     if (message.role === "toolResult") {
-      if (!pending) {
-        throw new Error(`ollama-native orphan tool result ${message.toolCallId || "<missing-id>"}`);
-      }
-      const call = pending.byId.get(message.toolCallId);
+      const call = issuedCalls.get(message.toolCallId);
       if (!call) {
-        throw new Error(`ollama-native tool result ${message.toolCallId || "<missing-id>"} has no originating call`);
-      }
-      if (call.result) {
-        throw new Error(`ollama-native duplicate tool result for ${message.toolCallId}`);
+        throw new Error(pending
+          ? `ollama-native tool result ${message.toolCallId || "<missing-id>"} has no originating call`
+          : `ollama-native orphan tool result ${message.toolCallId || "<missing-id>"}`);
       }
       if (call.name !== message.toolName || call.namespace !== message.toolNamespace) {
         throw new Error(`ollama-native tool result ${message.toolCallId} names the wrong originating tool`);
       }
-      call.result = message;
-      pending.unresolvedCount--;
+      if (pending?.byId.has(call.id)) {
+        if (call.results.length === 0) pending.unresolvedCount--;
+        call.results.push(message);
+      } else {
+        // Reopening a settled batch would split a later call/result pair. Keep known late
+        // output explicitly attributed as conversation text instead of dropping it or
+        // fabricating another executable call. Unknown/mismatched identities still fail above.
+        const translated = contentToNative(message.content, "late tool result");
+        const late: OllamaNativeMessage = { role: "user",
+          content: `[ocx] additional output for previously issued tool "${call.wireName}" (${call.id}):\n${message.isError ? "ERROR: " : ""}${translated.content}`,
+          ...(translated.images ? { images: translated.images } : {}),
+        };
+        if (pending) deferred.push(late);
+        else messages.push(late);
+      }
       continue;
     }
 
@@ -450,8 +464,10 @@ function buildNativeMessages(
             namespace: call.namespace,
             wireName,
             order: index,
+            results: [],
           };
           wireCalls.push(pendingCall);
+          issuedCalls.set(call.id, pendingCall);
           return {
             type: "function" as const,
             id: call.id,

package/src/claude/intercept/client-hello.ts

@@ -0,0 +1,103 @@
+/**
+ * Reads the ALPN offer from a TLS ClientHello without terminating TLS.
+ *
+ * The picker listener uses it to send a client that offers `h2` to its HTTP/2 server and every
+ * other client to its HTTP/1.1 server. The ClientHello is reassembled from as many plaintext
+ * handshake records as it spans (RFC 8446 5.1 allows any split), within fixed byte and record
+ * limits. This is a routing hint, not validation: parsing stops at the ALPN decision, and the TLS
+ * server that receives the replayed bytes validates the handshake. Anything the parser cannot read
+ * up to that decision returns false, which keeps that client on HTTP/1.1, the behaviour before
+ * HTTP/2 existed here.
+ */
+
+/** Wire bytes the front reads before deciding; a real ClientHello is far smaller. */
+export const CLIENT_HELLO_MAX_BYTES = 64 * 1024;
+/** Handshake records one ClientHello may span. */
+export const CLIENT_HELLO_MAX_RECORDS = 16;
+
+const RECORD_HEADER_BYTES = 5;
+const RECORD_HANDSHAKE = 0x16;
+const MAX_RECORD_PAYLOAD = 16_384;
+const HANDSHAKE_CLIENT_HELLO = 0x01;
+const EXTENSION_ALPN = 0x0010;
+
+/**
+ * Whether the ClientHello at the start of `data` offers `h2` in ALPN. Returns null while more
+ * bytes are needed to decide, and false for anything else (not TLS, malformed, over a limit).
+ */
+export function clientHelloOffersH2(data: Uint8Array): boolean | null {
+  const handshake: Uint8Array[] = [];
+  let handshakeBytes = 0;
+  let at = 0;
+  for (let records = 0; ; records++) {
+    if (handshakeBytes >= 4) {
+      const first = concat(handshake, 4);
+      if (first[0] !== HANDSHAKE_CLIENT_HELLO) return false;
+      const needed = 4 + ((first[1]! << 16) | (first[2]! << 8) | first[3]!);
+      if (needed > CLIENT_HELLO_MAX_BYTES) return false;
+      if (handshakeBytes >= needed) return helloOffersH2(concat(handshake, needed).subarray(4));
+    }
+    if (records >= CLIENT_HELLO_MAX_RECORDS || at >= CLIENT_HELLO_MAX_BYTES) return false;
+    if (data.length < at + RECORD_HEADER_BYTES) return null;
+    if (data[at] !== RECORD_HANDSHAKE || data[at + 1] !== 0x03) return false;
+    const length = (data[at + 3]! << 8) | data[at + 4]!;
+    if (length === 0 || length > MAX_RECORD_PAYLOAD) return false;
+    const end = at + RECORD_HEADER_BYTES + length;
+    if (end > CLIENT_HELLO_MAX_BYTES) return false;
+    if (data.length < end) return null;
+    handshake.push(data.subarray(at + RECORD_HEADER_BYTES, end));
+    handshakeBytes += length;
+    at = end;
+  }
+}
+
+function concat(parts: readonly Uint8Array[], bytes: number): Uint8Array {
+  const out = new Uint8Array(bytes);
+  let offset = 0;
+  for (const part of parts) {
+    if (offset >= bytes) break;
+    const take = part.subarray(0, bytes - offset);
+    out.set(take, offset);
+    offset += take.length;
+  }
+  return out;
+}
+
+function helloOffersH2(hello: Uint8Array): boolean {
+  let at = 2 + 32; // legacy_version, random
+  const skip = (lengthBytes: 1 | 2): boolean => {
+    if (at + lengthBytes > hello.length) return false;
+    const length = lengthBytes === 1 ? hello[at]! : (hello[at]! << 8) | hello[at + 1]!;
+    at += lengthBytes + length;
+    return at <= hello.length;
+  };
+  if (!skip(1) || !skip(2) || !skip(1)) return false; // session id, cipher suites, compression
+  if (at + 2 > hello.length) return false; // no extensions block: no ALPN
+  const extensionsEnd = at + 2 + ((hello[at]! << 8) | hello[at + 1]!);
+  if (extensionsEnd > hello.length) return false;
+  at += 2;
+  // Unknown and GREASE extensions are skipped by their declared length, in any order.
+  while (at + 4 <= extensionsEnd) {
+    const type = (hello[at]! << 8) | hello[at + 1]!;
+    const length = (hello[at + 2]! << 8) | hello[at + 3]!;
+    const body = at + 4;
+    if (body + length > extensionsEnd) return false;
+    if (type === EXTENSION_ALPN) return alpnListOffersH2(hello.subarray(body, body + length));
+    at = body + length;
+  }
+  return false;
+}
+
+function alpnListOffersH2(extension: Uint8Array): boolean {
+  if (extension.length < 2) return false;
+  const end = 2 + ((extension[0]! << 8) | extension[1]!);
+  if (end > extension.length) return false;
+  for (let at = 2; at < end;) {
+    const length = extension[at]!;
+    const name = at + 1;
+    if (length === 0 || name + length > end) return false;
+    if (length === 2 && extension[name] === 0x68 && extension[name + 1] === 0x32) return true; // "h2"
+    at = name + length;
+  }
+  return false;
+}

package/src/claude/intercept/model-bindings.ts

@@ -113,7 +113,7 @@ export function parseInterceptBindingPatch(body: unknown): InterceptBindingPatch
     if (!set || typeof set !== "object" || Array.isArray(set)) return { error: "set must be an object of picker id to route" };
     const entries: Record<string, string> = {};
     for (const [id, route] of Object.entries(set as Record<string, unknown>)) {
-      if (!isInterceptBindingId(id)) return { error: `invalid picker id: ${id} (expected a claude- model id)` };
+      if (!isInterceptBindingId(id)) return { error: "invalid picker id (expected a claude- model id)" };
       if (!isInterceptBindingRoute(route)) return { error: `invalid route for ${id}` };
       entries[id] = route;
     }
@@ -137,7 +137,8 @@ export function applyInterceptBindingPatch(
 ): InterceptBindingPatchResult {
   const next: Record<string, string> = { ...current };
   for (const [id, route] of Object.entries(patch.set ?? {})) {
-    if (!availableRoutes.has(route)) return { ok: false, error: `route is not available: ${route}` };
+    // A rejected route is not echoed: whatever sits in that position may be a misplaced credential.
+    if (!availableRoutes.has(route)) return { ok: false, error: "route is not available (see ocx claude desktop show)" };
     next[id] = route;
   }
   for (const id of patch.remove ?? []) delete next[id];

package/src/claude/intercept/picker-listener.ts

@@ -1,11 +1,24 @@
 /**
- * HTTP/1.1 TLS terminator for claude.ai. Only the bounded bootstrap response is
- * held; all other HTTP bodies and upgraded sockets relay as streams.
+ * TLS terminator for claude.ai.
+ *
+ * The listener port is a plain TCP front that reads each connection's TLS ClientHello and splices
+ * it, unterminated, to one of two loopback servers. A client offering `h2` (Chromium's ordinary
+ * requests) reaches an HTTP/2 server, so Desktop multiplexes every claude.ai request over one
+ * connection as it does against Anthropic's own edge. When this listener spoke only HTTP/1.1,
+ * Desktop's long-lived SSE subscriptions took all six of Chromium's per-origin connections and every
+ * later claude.ai request queued in the client until it timed out (#6511). Everything else (no ALPN,
+ * HTTP/1.1 only, WebSocket connections, a ClientHello the front cannot read) reaches the native
+ * HTTP/1.1 server, unchanged. Upstream is one HTTP/1.1 request per client request on both paths.
+ * Only the bounded bootstrap response is held; other bodies and upgraded sockets relay as streams.
  */
+import { createSecureServer } from "node:http2";
+import type { Http2ServerRequest, Http2ServerResponse, ServerHttp2Session } from "node:http2";
 import { createServer, request as httpsRequest } from "node:https";
 import type { IncomingMessage, ServerResponse } from "node:http";
+import { createServer as createTcpServer, connect as tcpConnect, type Server as TcpServer, type Socket } from "node:net";
 import { connect as tlsConnect } from "node:tls";
 import type { Duplex } from "node:stream";
+import { clientHelloOffersH2 } from "./client-hello";
 import type { PemKeyPair } from "./local-ca";
 import {
   BOOTSTRAP_MAX_ENCODED_BYTES, isPickerBootstrapRequest, narrowBootstrapAcceptEncoding,
@@ -19,15 +32,45 @@ export interface PickerListenerOptions {
   upstream?: { host: string; port: number; servername: string; ca?: string };
   /** Test seam: encoded bootstrap cap; production uses BOOTSTRAP_MAX_ENCODED_BYTES. */
   maxEncodedBytes?: number;
+  /** Test seam: concurrent upstream requests; production uses PICKER_MAX_ACTIVE_UPSTREAMS. */
+  maxActiveUpstreams?: number;
   log?: (line: string) => void;
 }
 export interface PickerListenerHandle { port: number; close(): Promise<void> }
 
+// Browser session cookies can exceed the HTTP compatibility layer's 16 KiB default.
+// Keep both sides bounded, while allowing ordinary desktop session headers through.
+export const PICKER_MAX_HEADER_BYTES = 64 * 1024;
+/**
+ * Upstream requests in flight across the listener. HTTP/2 lets one connection open many streams,
+ * and each relays as its own upstream connection, so the budget caps that fan-out well above what
+ * Desktop uses (a handful of SSE subscriptions plus bursts of ordinary calls).
+ */
+export const PICKER_MAX_ACTIVE_UPSTREAMS = 256;
+/** Advertised per HTTP/2 connection; Chromium queues further requests rather than failing them. */
+export const PICKER_MAX_CONCURRENT_STREAMS = 100;
+/** A connection that has not sent a complete ClientHello by then is dropped. */
+const CLIENT_HELLO_TIMEOUT_MS = 10_000;
+
 const HOP_HEADERS = new Set([
   "connection", "keep-alive", "proxy-connection", "proxy-authenticate", "proxy-authorization",
   "te", "trailer", "transfer-encoding", "upgrade",
 ]);
 
+type RelayRequest = IncomingMessage | Http2ServerRequest;
+type RelayResponse = ServerResponse | Http2ServerResponse;
+
+const METHOD_TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const ORIGIN_FORM_TARGET = /^\/[\x21-\x7e]*$/;
+
+/**
+ * HTTP/2 carries method and path as header values, which Bun accepts more loosely than an
+ * HTTP/1.1 request line can express. Only a method token and an origin-form target relay.
+ */
+export function isRelayableH2Target(method: string | undefined, path: string | undefined): boolean {
+  return method !== undefined && path !== undefined && METHOD_TOKEN.test(method) && ORIGIN_FORM_TARGET.test(path);
+}
+
 function filteredHeaders(raw: readonly string[], omit: ReadonlySet<string> = new Set()): string[] {
   const named = new Set<string>();
   for (let i = 0; i + 1 < raw.length; i += 2) {
@@ -61,15 +104,98 @@ function contentEncoding(raw: readonly string[]): string | undefined {
   return undefined;
 }
 
+/**
+ * Request headers for the HTTP/1.1 upstream. An HTTP/2 request has pseudo-headers instead of a
+ * request line, names its origin in `:authority` (which replaces any Host, RFC 9113 8.3.1) and
+ * may split Cookie into crumbs (8.2.3); HTTP/1.1 needs one Host and one Cookie header.
+ */
+function upstreamRequestHeaders(req: RelayRequest, omit: ReadonlySet<string>): string[] {
+  if (req.httpVersionMajor !== 2) return filteredHeaders(req.rawHeaders, omit);
+  const rest: string[] = [];
+  const cookies: string[] = [];
+  let authority: string | undefined;
+  let host: string | undefined;
+  for (let i = 0; i + 1 < req.rawHeaders.length; i += 2) {
+    const name = req.rawHeaders[i]!.toLowerCase();
+    const value = req.rawHeaders[i + 1]!;
+    if (name === ":authority") authority = value;
+    else if (name === "host") host = value;
+    else if (name === "cookie") cookies.push(value);
+    else if (!name.startsWith(":")) rest.push(req.rawHeaders[i]!, value);
+  }
+  const headers = filteredHeaders(rest, omit);
+  headers.unshift("Host", authority ?? host ?? "claude.ai");
+  if (cookies.length > 0) headers.push("Cookie", cookies.join("; "));
+  return headers;
+}
+
+function listenLoopback(server: TcpServer): Promise<number> {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      const address = server.address();
+      if (!address || typeof address === "string") reject(new Error("picker listener has no port"));
+      else resolve(address.port);
+    });
+  });
+}
+
+function closeServer(server: TcpServer): Promise<void> {
+  return new Promise(resolve => {
+    if (!server.listening) { resolve(); return; }
+    server.close(() => resolve());
+  });
+}
+
 export async function startPickerListener(options: PickerListenerOptions): Promise<PickerListenerHandle> {
   const upstream = options.upstream ?? { host: "claude.ai", port: 443, servername: "claude.ai" };
   const cap = options.maxEncodedBytes ?? BOOTSTRAP_MAX_ENCODED_BYTES;
+  const maxActiveUpstreams = options.maxActiveUpstreams ?? PICKER_MAX_ACTIVE_UPSTREAMS;
+  let activeUpstreams = 0;
   const upgrades = new Set<Duplex>();
-  const server = createServer({ cert: options.leaf.certPem, key: options.leaf.keyPem, ALPNProtocols: ["http/1.1"] });
+  const spliced = new Set<Socket>();
+  const h2Sockets = new Set<Duplex>();
+  const sessions = new Set<ServerHttp2Session>();
+  const server = createServer({ cert: options.leaf.certPem, key: options.leaf.keyPem, ALPNProtocols: ["http/1.1"], maxHeaderSize: PICKER_MAX_HEADER_BYTES });
+  // ALPN h2 only; no enableConnectProtocol, so Chromium opens WebSockets as HTTP/1.1 connections,
+  // which the front sends to `server`. An over-budget header block is refused natively per stream
+  // (Bun counts name + value + 32 bytes per field) before the request handler runs.
+  const h2Server = createSecureServer({
+    cert: options.leaf.certPem, key: options.leaf.keyPem,
+    settings: { maxHeaderListSize: PICKER_MAX_HEADER_BYTES, maxConcurrentStreams: PICKER_MAX_CONCURRENT_STREAMS },
+  });
+  // Track sockets from accept (a handshake that never completes too) and after TLS, so a forced
+  // shutdown reaches every one of them.
+  for (const event of ["connection", "secureConnection"] as const) {
+    h2Server.on(event, (socket: Duplex) => {
+      h2Sockets.add(socket);
+      socket.once("close", () => h2Sockets.delete(socket));
+    });
+  }
+  h2Server.on("session", (session: ServerHttp2Session) => {
+    sessions.add(session);
+    session.once("close", () => sessions.delete(session));
+    options.log?.("picker session h2");
+  });
 
-  server.on("request", (req: IncomingMessage, res: ServerResponse) => {
+  const relay = (req: RelayRequest, relayRes: RelayResponse) => {
+    // The HTTP/2 compat response has every ServerResponse member used here; only writeHead's
+    // reason phrase differs, and sendHead branches on it.
+    const res = relayRes as ServerResponse;
+    const h2 = req.httpVersionMajor === 2;
+    // Refusals answer with an empty response and a fixed log line that carries no request data.
+    const refuse = (status: 400 | 503) => {
+      res.writeHead(status, { "Content-Length": "0" });
+      res.end();
+      options.log?.(`picker request refused ${status}`);
+    };
+    if (h2 && !isRelayableH2Target(req.method, req.url)) { refuse(400); return; }
+    if (activeUpstreams >= maxActiveUpstreams) { refuse(503); return; }
     const method = req.method ?? "GET";
-    const pathname = new URL(req.url ?? "/", "https://claude.ai").pathname;
+    let pathname: string;
+    // A target like "//[" reads as an authority and throws; refuse it like any unrelayable target.
+    try { pathname = new URL(req.url ?? "/", "https://claude.ai").pathname; } catch { refuse(400); return; }
     const bootstrap = isPickerBootstrapRequest(method, pathname);
     const category = bootstrap ? "bootstrap" : "other";
     let logged = false;
@@ -77,66 +203,100 @@ export async function startPickerListener(options: PickerListenerOptions): Promi
       if (!logged) options.log?.(`picker ${method} ${category} ${status}`);
       logged = true;
     };
+    // Set once the client side closes before the response finished: the upstream error that
+    // tearing it down raises is then expected, not a relay failure to answer or log.
+    let clientGone = false;
     const fail = () => {
+      if (clientGone) return;
       if (res.headersSent) res.destroy();
       else { res.writeHead(502, { "Content-Length": "0" }); res.end(); log(502); }
     };
     const omit = bootstrap ? new Set(["accept-encoding"]) : new Set<string>();
-    const headers = filteredHeaders(req.rawHeaders, omit);
+    const headers = upstreamRequestHeaders(req, omit);
     if (bootstrap) headers.push("Accept-Encoding", narrowBootstrapAcceptEncoding());
-    const upReq = httpsRequest({
-      host: upstream.host, port: upstream.port, servername: upstream.servername,
-      ca: upstream.ca, rejectUnauthorized: true, agent: false,
-      method, path: req.url, headers,
-    }, upRes => {
-      const status = upRes.statusCode ?? 502;
-      const originalHeaders = filteredHeaders(upRes.rawHeaders);
-      const sendHead = (raw: string[]) => {
-        if (res.headersSent) return;
-        res.writeHead(status, upRes.statusMessage, raw);
-        log(status);
-      };
-      upRes.on("error", fail);
-      if (!bootstrap || status !== 200 || !hasJsonContentType(upRes.rawHeaders)) {
-        sendHead(originalHeaders);
-        upRes.pipe(res);
-        return;
-      }
-      const held: Buffer[] = [];
-      let size = 0;
-      let handedOff = false;
-      const onData = (chunk: Buffer) => {
-        if (size + chunk.length > cap) {
-          upRes.pause();
-          upRes.off("data", onData);
-          handedOff = true;
+    let upReq: ReturnType<typeof httpsRequest>;
+    try {
+      // The HTTP/1.1 client validates the method, path and header values synchronously.
+      upReq = httpsRequest({
+        host: upstream.host, port: upstream.port, servername: upstream.servername,
+        ca: upstream.ca, rejectUnauthorized: true, agent: false,
+        method, path: req.url, headers, maxHeaderSize: PICKER_MAX_HEADER_BYTES,
+        }, upRes => {
+        const status = upRes.statusCode ?? 502;
+        const originalHeaders = filteredHeaders(upRes.rawHeaders);
+        const sendHead = (raw: string[]) => {
+          if (res.headersSent) return;
+          // HTTP/2 has no reason phrase; its compat writeHead takes the same flat raw header array.
+          if (h2) (relayRes as Http2ServerResponse).writeHead(status, raw as unknown as Record<string, string>);
+          else res.writeHead(status, upRes.statusMessage, raw);
+          log(status);
+        };
+        upRes.on("error", fail);
+        if (!bootstrap || status !== 200 || !hasJsonContentType(upRes.rawHeaders)) {
           sendHead(originalHeaders);
-          for (const part of held) res.write(part);
-          res.write(chunk);
           upRes.pipe(res);
           return;
         }
-        held.push(chunk);
-        size += chunk.length;
-      };
-      upRes.on("data", onData);
-      upRes.once("end", () => {
-        if (handedOff) return;
-        const original = Buffer.concat(held, size);
-        let outcome = "unchanged";
-        const rewritten = rewriteBootstrapBody(original, contentEncoding(upRes.rawHeaders), options.models(), result => {
-          outcome = result.kind === "rewritten" ? `rewritten(+${result.added})` : `unchanged:${result.reason}`;
+        const held: Buffer[] = [];
+        let size = 0;
+        let handedOff = false;
+        const onData = (chunk: Buffer) => {
+          if (size + chunk.length > cap) {
+            upRes.pause();
+            upRes.off("data", onData);
+            handedOff = true;
+            sendHead(originalHeaders);
+            for (const part of held) res.write(part);
+            res.write(chunk);
+            upRes.pipe(res);
+            return;
+          }
+          held.push(chunk);
+          size += chunk.length;
+        };
+        upRes.on("data", onData);
+        upRes.once("end", () => {
+          if (handedOff) return;
+          const original = Buffer.concat(held, size);
+          let outcome = "unchanged";
+          const rewritten = rewriteBootstrapBody(original, contentEncoding(upRes.rawHeaders), options.models(), result => {
+            outcome = result.kind === "rewritten" ? `rewritten(+${result.added})` : `unchanged:${result.reason}`;
+          });
+          sendHead(rewritten === null ? originalHeaders : rewrittenHeaders(originalHeaders, rewritten.length));
+          options.log?.(`picker ${method} bootstrap ${outcome}`);
+          res.end(rewritten ?? original);
         });
-        sendHead(rewritten === null ? originalHeaders : rewrittenHeaders(originalHeaders, rewritten.length));
-        options.log?.(`picker ${method} bootstrap ${outcome}`);
-        res.end(rewritten ?? original);
       });
+    } catch {
+      refuse(400);
+      return;
+    }
+    // One budget slot per upstream request, released once by whichever end finishes first.
+    activeUpstreams++;
+    let released = false;
+    const release = () => { if (!released) { released = true; activeUpstreams--; } };
+    upReq.once("close", release);
+    res.once("close", release);
+    if (h2) (req as Http2ServerRequest).stream.once("close", release);
+    upReq.on("error", error => {
+      if ((error as NodeJS.ErrnoException).code === "HPE_HEADER_OVERFLOW") {
+        options.log?.(`picker ${method} ${category} upstream:headers-too-large`);
+      }
+      fail();
     });
-    upReq.on("error", fail);
     req.on("error", () => upReq.destroy());
-    res.on("close", () => { if (!res.writableEnded) upReq.destroy(); });
+    const onClientClose = () => {
+      if (!res.writableEnded) clientGone = true;
+      upReq.destroy();
+    };
+    res.on("close", () => { if (!res.writableEnded) onClientClose(); });
+    // Bun's compat response skips its close event for a HEAD reset before end(); the stream's own
+    // close always fires. Destroying an upstream request that already completed is a no-op.
+    if (h2) (req as Http2ServerRequest).stream.once("close", onClientClose);
     req.pipe(upReq);
-  });
+  };
+  server.on("request", relay);
+  h2Server.on("request", relay);
 
   server.on("upgrade", (req, client, head) => {
     const method = req.method ?? "GET";
@@ -190,24 +350,77 @@ export async function startPickerListener(options: PickerListenerOptions): Promi
     client.once("close", () => { upgrades.delete(client); target.destroy(); });
   });
 
+  let http1Port = 0;
+  let h2Port = 0;
+  // The front never terminates TLS: it reads the ClientHello, then splices the untouched bytes
+  // to the chosen server through a loopback socket, so both directions keep stream backpressure.
+  // Ownership: `spliced` holds every front and bridge socket from accept until close; close()
+  // destroys them, the h2 sessions and their TLS sockets, and the HTTP/1.1 server's connections.
+  let closing = false;
+  const front = createTcpServer(client => {
+    if (closing) { client.destroy(); return; }
+    spliced.add(client);
+    client.once("close", () => spliced.delete(client));
+    client.on("error", () => client.destroy());
+    // An absolute deadline: trickled bytes cannot hold an unfinished ClientHello open.
+    const deadline = setTimeout(() => client.destroy(), CLIENT_HELLO_TIMEOUT_MS);
+    client.once("close", () => clearTimeout(deadline));
+    let head: Buffer = Buffer.alloc(0);
+    const onData = (chunk: Buffer) => {
+      head = head.length === 0 ? chunk : Buffer.concat([head, chunk]);
+      const offersH2 = clientHelloOffersH2(head);
+      if (offersH2 === null) return;
+      client.off("data", onData);
+      // Paused, a FIN or later bytes wait in the readable buffer and follow `head` once piped.
+      client.pause();
+      clearTimeout(deadline);
+      const inner = tcpConnect({ host: "127.0.0.1", port: offersH2 ? h2Port : http1Port });
+      spliced.add(inner);
+      const teardown = () => { client.destroy(); inner.destroy(); };
+      inner.on("error", teardown);
+      client.on("error", teardown);
+      // pipe() forwards each FIN after the queued bytes; a side that closes without having ended
+      // its peer (reset, dial failure) tears the peer down instead of leaving it open.
+      inner.once("close", () => { spliced.delete(inner); if (!client.writableEnded) client.destroy(); });
+      client.once("close", () => { if (!inner.writableEnded) inner.destroy(); });
+      inner.once("connect", () => {
+        inner.setNoDelay(true);
+        client.setNoDelay(true);
+        // Every byte read during the peek (ClientHello and anything coalesced after it), once.
+        inner.write(head);
+        client.pipe(inner);
+        inner.pipe(client);
+        client.resume();
+      });
+    };
+    client.on("data", onData);
+  });
+
+  const servers: TcpServer[] = [server, h2Server, front];
+  // One forced shutdown for close() and for a failed start, shared by concurrent callers: destroy
+  // every tracked socket and session (a graceful HTTP/2 close would wait on open SSE streams
+  // forever), force the HTTP/1.1 server's connections closed while its native handle still exists
+  // (Bun's close() drops it), then stop accepting and wait for the servers to report closed.
+  let stopped: Promise<void> | null = null;
+  const shutdown = () => {
+    stopped ??= (async () => {
+      closing = true;
+      for (const socket of upgrades) socket.destroy();
+      for (const socket of spliced) socket.destroy();
+      for (const session of sessions) session.destroy();
+      for (const socket of h2Sockets) socket.destroy();
+      server.closeAllConnections();
+      await Promise.all(servers.map(closeServer));
+    })();
+    return stopped;
+  };
   try {
-    await new Promise<void>((resolve, reject) => {
-      server.once("error", reject);
-      server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(); });
-    });
+    http1Port = await listenLoopback(server);
+    h2Port = await listenLoopback(h2Server);
+    const port = await listenLoopback(front);
+    return { port, close: shutdown };
   } catch (error) {
-    server.close();
+    await shutdown();
     throw error;
   }
-  const address = server.address();
-  if (!address || typeof address === "string") throw new Error("picker listener has no port");
-  return {
-    port: address.port,
-    async close() {
-      for (const socket of upgrades) socket.destroy();
-      const closed = new Promise<void>((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
-      server.closeAllConnections();
-      await closed;
-    },
-  };
 }