@bman654/clodex 2.11.1 → 2.11.3

package/dist/cli.js

@@ -382,7 +382,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.11.1",
+  version: "2.11.3",
   publishConfig: {
     access: "public"
   },
@@ -856,21 +856,31 @@ async function sleepMs(ms) {
 }
 
 // src/oauth/refresh-http.ts
-var OAUTH_REFRESH_TIMEOUT_MS = 3e4;
-async function postOAuthRefresh(url, body, options) {
-  const isJson = options.contentType === "json";
+var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
+async function withOAuthRequestTimeout(operation, timeoutMs = OAUTH_REQUEST_TIMEOUT_MS) {
   const abortController = new AbortController();
   const timeout = setTimeout(() => {
     abortController.abort(new DOMException(
       "The operation was aborted due to timeout",
       "TimeoutError"
     ));
-  }, OAUTH_REFRESH_TIMEOUT_MS);
+  }, timeoutMs);
   timeout.unref();
   try {
+    return await operation(abortController.signal);
+  } finally {
+    clearTimeout(timeout);
+    if (!abortController.signal.aborted) {
+      abortController.abort(new Error("OAuth request completed"));
+    }
+  }
+}
+async function postOAuthRefresh(url, body, options) {
+  const isJson = options.contentType === "json";
+  return withOAuthRequestTimeout(async (signal) => {
     const response = await fetch(url, {
       method: "POST",
-      signal: abortController.signal,
+      signal,
       headers: {
         "Content-Type": isJson ? "application/json" : "application/x-www-form-urlencoded",
         Accept: "application/json",
@@ -892,9 +902,7 @@ async function postOAuthRefresh(url, body, options) {
       throw new Error(`${options.errorPrefix}${status}${detail ? `: ${detail}` : ""}`);
     }
     return await response.json();
-  } finally {
-    clearTimeout(timeout);
-  }
+  });
 }
 
 // src/oauth/callback-server.ts
@@ -1007,6 +1015,9 @@ var OAUTH_POLLING_SAFETY_MARGIN_MS = 3e3;
 var DEVICE_CODE_DEFAULT_EXPIRES_MS = 5 * 60 * 1e3;
 var BROWSER_CALLBACK_PORTS = [1455, 1457];
 var BROWSER_CALLBACK_PATH = "/auth/callback";
+function isTimeoutError(error) {
+  return error instanceof Error && error.name === "TimeoutError";
+}
 function extractOpenAiAccountId(tokens) {
   const token = tokens.id_token ?? tokens.access_token;
   if (!token) return void 0;
@@ -1020,18 +1031,30 @@ function extractOpenAiAccountId(tokens) {
   }
 }
 async function requestOpenAiDeviceCode() {
-  const response = await fetch(`${ISSUER}/api/accounts/deviceauth/usercode`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "User-Agent": `clodex/${VERSION}`
-    },
-    body: JSON.stringify({ client_id: CLIENT_ID })
-  });
-  if (!response.ok) {
-    throw new Error("Failed to initiate OpenAI device authorization");
+  try {
+    return await withOAuthRequestTimeout(async (signal) => {
+      const response = await fetch(`${ISSUER}/api/accounts/deviceauth/usercode`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "User-Agent": `clodex/${VERSION}`
+        },
+        body: JSON.stringify({ client_id: CLIENT_ID }),
+        signal
+      });
+      if (!response.ok) {
+        throw new Error("Failed to initiate OpenAI device authorization");
+      }
+      return await response.json();
+    });
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      throw new Error("OpenAI device authorization timed out while requesting a sign-in code", {
+        cause: error
+      });
+    }
+    throw error;
   }
-  return response.json();
 }
 function openAiDeviceCodeUrl() {
   return `${ISSUER}/codex/device`;
@@ -1041,41 +1064,65 @@ async function pollOpenAiDeviceCodeToken(deviceData, opts) {
   const now = opts?.now ?? (() => Date.now());
   const intervalMs = Math.max(parseInt(deviceData.interval, 10) || 5, 1) * 1e3;
   const deadline = now() + positiveSecondsToMs(deviceData.expires_in, DEVICE_CODE_DEFAULT_EXPIRES_MS);
+  const remainingPollTimeoutMs = () => Math.min(OAUTH_REQUEST_TIMEOUT_MS, Math.max(0, deadline - now()));
+  const waitForNextPoll = () => sleep(Math.min(intervalMs + OAUTH_POLLING_SAFETY_MARGIN_MS, Math.max(0, deadline - now())));
   while (now() < deadline) {
-    const response = await fetch(`${ISSUER}/api/accounts/deviceauth/token`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "User-Agent": `clodex/${VERSION}`
-      },
-      body: JSON.stringify({
-        device_auth_id: deviceData.device_auth_id,
-        user_code: deviceData.user_code
-      })
-    });
-    if (response.ok) {
-      const data = await response.json();
-      const tokenResponse = await fetch(`${ISSUER}/oauth/token`, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          grant_type: "authorization_code",
-          code: data.authorization_code,
-          redirect_uri: `${ISSUER}/deviceauth/callback`,
-          client_id: CLIENT_ID,
-          code_verifier: data.code_verifier
-        }).toString()
-      });
-      if (!tokenResponse.ok) {
-        throw new Error(`OpenAI token exchange failed (${tokenResponse.status})`);
+    const pollTimeoutMs = remainingPollTimeoutMs();
+    if (pollTimeoutMs <= 0) break;
+    let result;
+    try {
+      result = await withOAuthRequestTimeout(async (signal) => {
+        const response = await fetch(`${ISSUER}/api/accounts/deviceauth/token`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "User-Agent": `clodex/${VERSION}`
+          },
+          body: JSON.stringify({
+            device_auth_id: deviceData.device_auth_id,
+            user_code: deviceData.user_code
+          }),
+          signal
+        });
+        const data = response.ok ? await response.json() : void 0;
+        return { status: response.status, data };
+      }, pollTimeoutMs);
+    } catch (error) {
+      if (!isTimeoutError(error)) throw error;
+      if (now() >= deadline) break;
+      await waitForNextPoll();
+      continue;
+    }
+    if (result.data) {
+      let tokens;
+      try {
+        tokens = await postOAuthRefresh(
+          `${ISSUER}/oauth/token`,
+          new URLSearchParams({
+            grant_type: "authorization_code",
+            code: result.data.authorization_code,
+            redirect_uri: `${ISSUER}/deviceauth/callback`,
+            client_id: CLIENT_ID,
+            code_verifier: result.data.code_verifier
+          }),
+          {
+            contentType: "form",
+            errorPrefix: "OpenAI token exchange failed",
+            includeStatus: true
+          }
+        );
+      } catch (error) {
+        if (isTimeoutError(error)) {
+          throw new Error("OpenAI token exchange timed out", { cause: error });
+        }
+        throw error;
       }
-      const tokens = await tokenResponse.json();
       return { tokens, accountId: extractOpenAiAccountId(tokens) };
     }
-    if (response.status !== 403 && response.status !== 404) {
-      throw new Error(`OpenAI device authorization failed (${response.status})`);
+    if (result.status !== 403 && result.status !== 404) {
+      throw new Error(`OpenAI device authorization failed (${result.status})`);
     }
-    await sleep(Math.min(intervalMs + OAUTH_POLLING_SAFETY_MARGIN_MS, Math.max(0, deadline - now())));
+    await waitForNextPoll();
   }
   throw new Error("OpenAI device authorization timed out");
 }
@@ -7792,6 +7839,23 @@ function clampRetryAfterSeconds(value) {
   }
   return Math.min(Math.round(value), MAX_RETRY_AFTER_SECONDS);
 }
+function clampAiSdkRetryAfterSeconds(value) {
+  return Math.min(clampRetryAfterSeconds(value), MAX_RETRY_AFTER_SECONDS - 1);
+}
+var RETRY_AFTER_PARAM_PREFIX = "clodex_retry_after:";
+function retryAfterProvenanceParam(provenance) {
+  return provenance.source === "default" ? `${RETRY_AFTER_PARAM_PREFIX}default` : `${RETRY_AFTER_PARAM_PREFIX}upstream:${String(provenance.rawSeconds)}`;
+}
+function retryAfterProvenanceFromParam(value) {
+  if (value === `${RETRY_AFTER_PARAM_PREFIX}default`) return { source: "default" };
+  if (typeof value !== "string" || !value.startsWith(`${RETRY_AFTER_PARAM_PREFIX}upstream:`)) {
+    return void 0;
+  }
+  const rawValue = value.slice(`${RETRY_AFTER_PARAM_PREFIX}upstream:`.length);
+  if (rawValue.length === 0) return void 0;
+  const rawSeconds = Number(rawValue);
+  return Number.isFinite(rawSeconds) ? { source: "upstream", rawSeconds } : void 0;
+}
 function retryAfterFromText(message) {
   if (typeof message !== "string") return void 0;
   const match = /retry after (\d+)s\b/i.exec(message);
@@ -7993,7 +8057,8 @@ function upstreamHttpStatus(err, message) {
   if (message.includes("HTTP 400")) return 400;
   return 500;
 }
-function anthropicErrorType(status) {
+function anthropicErrorType(status, transportCode) {
+  if (transportCode === "websocket_transport_error") return "overloaded_error";
   switch (status) {
     case 400:
       return "invalid_request_error";
@@ -8291,8 +8356,11 @@ var WsUpgradePacer = class {
   }
   /**
    * Resolves when this request may open a new connection, or resolves to a
-   * refusal the caller must report as a retryable rate limit. Callers that
-   * reuse an existing connection must not call this at all.
+   * refusal the caller must report as a retryable rate limit. A caller that can
+   * already reuse an existing connection must not call this at all; one that
+   * discovers a reusable connection only after being admitted must hand the
+   * token back through `release` instead of holding it for a socket it never
+   * opened.
    */
   async admit(signal) {
     if (!this.enabled) return { kind: "admitted", waitedMs: 0 };
@@ -8310,7 +8378,14 @@ var WsUpgradePacer = class {
         )
       };
     }
-    if (reservation.waitMs <= 0) return { kind: "admitted", waitedMs: 0 };
+    if (reservation.waitMs <= 0) {
+      return {
+        kind: "admitted",
+        waitedMs: 0,
+        queued: false,
+        release: this.releaser(reservation.consumed)
+      };
+    }
     const startedAt = this.now();
     try {
       await this.sleep(reservation.waitMs, signal);
@@ -8318,7 +8393,28 @@ var WsUpgradePacer = class {
       this.refund(reservation.consumed);
       throw error;
     }
-    return { kind: "admitted", waitedMs: Math.max(0, this.now() - startedAt) };
+    return {
+      kind: "admitted",
+      // A clock moved backwards during the wait would otherwise report this
+      // request as never queued at all.
+      waitedMs: Math.max(0, this.now() - startedAt),
+      queued: true,
+      release: this.releaser(reservation.consumed)
+    };
+  }
+  /**
+   * One-shot refund for an admission whose caller opened nothing. Guarded
+   * because a second call would mint a token the bucket never charged, which
+   * is the one way a refund can raise the sustained rate instead of correcting
+   * it.
+   */
+  releaser(consumed) {
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      this.refund(consumed);
+    };
   }
   reserve(now) {
     const elapsed = Math.max(0, now - this.lastRefillAt);
@@ -8691,7 +8787,11 @@ function warnToolArgumentNormalizationGap(gap, log12) {
     emitParentNotice("clodex: warning: further tool-argument normalization warnings suppressed.");
   }
 }
-function continuationMismatchDetails(entry, payload, log12, warnOnGap = false) {
+function continuationMismatchDetails(entry, payload, log12, warnOnGap = false, deferWarnings) {
+  const raise = (warn) => {
+    if (deferWarnings) deferWarnings.push(warn);
+    else warn();
+  };
   const full = inputArray(payload);
   const prefix = [...entry.requestInput ?? [], ...entry.expectedAssistant ?? []];
   const comparable = Math.min(full.length, prefix.length);
@@ -8705,7 +8805,7 @@ function continuationMismatchDetails(entry, payload, log12, warnOnGap = false) {
   const expected = mismatch < prefix.length ? prefix[mismatch] : void 0;
   const actual = mismatch < full.length ? full[mismatch] : void 0;
   const reasoningGap = reasoningNormalizationGap(expected, actual);
-  if (reasoningGap && warnOnGap) warnReasoningNormalizationGap(reasoningGap, log12);
+  if (reasoningGap && warnOnGap) raise(() => warnReasoningNormalizationGap(reasoningGap, log12));
   let gapExpected = expected;
   if (conversationItemKind(expected) === "reasoning" && conversationItemKind(actual) === "function_call") {
     for (let index = mismatch; index < prefix.length; index += 1) {
@@ -8727,7 +8827,8 @@ function continuationMismatchDetails(entry, payload, log12, warnOnGap = false) {
   } catch {
   }
   if (toolArgumentGap?.equalAfterStrip === true) {
-    if (warnOnGap) warnToolArgumentNormalizationGap(toolArgumentGap, log12);
+    const gap = toolArgumentGap;
+    if (warnOnGap) raise(() => warnToolArgumentNormalizationGap(gap, log12));
   } else if (toolArgumentGap && warnOnGap) {
     try {
       log12?.(`tool argument mismatch beyond the strip rule: ${String(toolArgumentGap.tool)}`);
@@ -9176,11 +9277,16 @@ function deleteEntry(entry, closeSocket = true) {
     }
   }
 }
-function failContext(entry, ctx, message, diagnosticDetails, statusCode, retryAfterSeconds) {
+function failContext(entry, ctx, message, diagnosticDetails, statusCode, retryAfter) {
   if (ctx.closed || entry.current !== ctx) return;
+  const retryAfterSeconds = retryAfter === void 0 ? void 0 : clampRetryAfterSeconds(retryAfter.seconds);
   entry.debug(`fail: ${message}`);
   emitResponseErrorDiagnostic(entry, ctx, {
     ...diagnosticDetails,
+    ...retryAfter !== void 0 ? {
+      retryAfterSource: retryAfter.source,
+      ..."rawSeconds" in retryAfter ? { rawRetryAfterSeconds: retryAfter.rawSeconds } : {}
+    } : {},
     ...diagnosticTextFingerprint("errorMessage", message)
   });
   flushPending(ctx);
@@ -9191,7 +9297,7 @@ function failContext(entry, ctx, message, diagnosticDetails, statusCode, retryAf
       type: statusCode === void 0 ? "transport_error" : anthropicErrorType(statusCode),
       code: statusCode === void 0 ? "websocket_transport_error" : String(statusCode),
       message,
-      param: null,
+      param: retryAfter === void 0 ? null : retryAfterProvenanceParam(retryAfter),
       ...retryAfterSeconds !== void 0 ? { retry_after_seconds: retryAfterSeconds } : {}
     }
   });
@@ -9390,7 +9496,8 @@ function handleSocketMessage(entry, data) {
   const previousMissing = errorCode === "previous_response_not_found";
   const willRetry = previousMissing && ctx.continued && !ctx.retried && !ctx.emittedModelData;
   if (errorCode === "websocket_connection_limit_reached" && !ctx.emittedModelData) {
-    const retryAfterSeconds = clampRetryAfterSeconds(responseRetryAfterSeconds(event));
+    const rawRetryAfterSeconds = responseRetryAfterSeconds(event);
+    const retryAfterSeconds = clampRetryAfterSeconds(rawRetryAfterSeconds);
     failContext(
       entry,
       ctx,
@@ -9402,7 +9509,7 @@ function handleSocketMessage(entry, data) {
         retryAfterSeconds
       },
       429,
-      retryAfterSeconds
+      rawRetryAfterSeconds === void 0 ? { seconds: retryAfterSeconds, source: "default" } : { seconds: retryAfterSeconds, source: "upstream", rawSeconds: rawRetryAfterSeconds }
     );
     return;
   }
@@ -9427,7 +9534,12 @@ function handleSocketMessage(entry, data) {
   }
   if (errorStatus !== void 0) {
     const statedRetryAfter = errorStatus === 429 ? responseRetryAfterSeconds(event) : void 0;
-    const retryAfterSeconds = statedRetryAfter === void 0 ? void 0 : clampRetryAfterSeconds(statedRetryAfter);
+    const retryAfter = statedRetryAfter === void 0 ? void 0 : {
+      seconds: clampRetryAfterSeconds(statedRetryAfter),
+      source: "upstream",
+      rawSeconds: statedRetryAfter
+    };
+    const retryAfterSeconds = retryAfter?.seconds;
     const reason = responseErrorMessage(event) ?? `OpenAI rejected the request (HTTP ${errorStatus})`;
     failContext(
       entry,
@@ -9447,7 +9559,7 @@ function handleSocketMessage(entry, data) {
         ...retryAfterSeconds !== void 0 ? { retryAfterSeconds } : {}
       },
       errorStatus,
-      retryAfterSeconds
+      retryAfter
     );
     return;
   }
@@ -9461,7 +9573,13 @@ function handleSocketMessage(entry, data) {
     const classified = numericOrNamed !== void 0 || discriminator ? frameStatusCode(numericOrNamed, discriminator) : 500;
     const statusCode = classified !== 500 ? classified : settledReason ? 400 : 502;
     const usageLimited = statusCode === 429;
-    const retryAfterSeconds = usageLimited && responseRetryAfterSeconds(event) !== void 0 ? clampRetryAfterSeconds(responseRetryAfterSeconds(event)) : void 0;
+    const rawRetryAfterSeconds = usageLimited ? responseRetryAfterSeconds(event) : void 0;
+    const retryAfter = rawRetryAfterSeconds === void 0 ? void 0 : {
+      seconds: clampRetryAfterSeconds(rawRetryAfterSeconds),
+      source: "upstream",
+      rawSeconds: rawRetryAfterSeconds
+    };
+    const retryAfterSeconds = retryAfter?.seconds;
     failContext(
       entry,
       ctx,
@@ -9480,7 +9598,7 @@ function handleSocketMessage(entry, data) {
         ...diagnosticTextFingerprint("upstreamMessage", responseErrorMessage(event))
       },
       statusCode,
-      retryAfterSeconds
+      retryAfter
     );
     return;
   }
@@ -9586,15 +9704,14 @@ function createConnection(WebSocket, wsUrl, headers, persistent, key, options, d
       return;
     }
     if (statusCode === 403) {
-      const retryAfterSeconds = clampRetryAfterSeconds(
-        numericRetryAfterHeader(response.headers["retry-after"])
-      );
+      const rawRetryAfterSeconds = numericRetryAfterHeader(response.headers["retry-after"]);
+      const retryAfterSeconds = clampRetryAfterSeconds(rawRetryAfterSeconds);
       failContext(entry, ctx, `OpenAI edge throttled the Responses WebSocket upgrade (HTTP 403); retry after ${retryAfterSeconds}s`, {
         source: "unexpected_response",
         httpStatusCode: statusCode,
         mappedStatusCode: 429,
         retryAfterSeconds
-      }, 429, retryAfterSeconds);
+      }, 429, rawRetryAfterSeconds === void 0 ? { seconds: retryAfterSeconds, source: "default" } : { seconds: retryAfterSeconds, source: "upstream", rawSeconds: rawRetryAfterSeconds });
       return;
     }
     failContext(entry, ctx, `WebSocket upgrade failed (HTTP ${statusCode})`, {
@@ -9687,18 +9804,25 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
     const diagnosticCorrelation = diagnosticContext.getStore();
     let now = resolvedOptions.now();
     const evictions = cleanupExpiredConnections(now);
-    const candidates = partitionKey ? connectionEntries(partitionKey) : [];
-    const idleCandidates = candidates.filter((entry) => !entry.inFlight);
-    const clientItems = idleCandidates.length ? canonicalItemStrings(inputArray(payload)) : [];
-    const matches = idleCandidates.map((entry) => ({ entry, match: continuationMatch(entry, payload, clientItems) })).filter((candidate) => candidate.match !== void 0).sort((left, right) => left.match.delta.length - right.match.delta.length || (left.match.mode === right.match.mode ? 0 : left.match.mode === "exact" ? -1 : 1));
+    const scanForHeads = () => {
+      const scanned = partitionKey ? connectionEntries(partitionKey) : [];
+      const idle = scanned.filter((entry) => !entry.inFlight);
+      const clientItems = idle.length ? canonicalItemStrings(inputArray(payload)) : [];
+      return {
+        candidates: scanned,
+        idleCandidates: idle,
+        matches: idle.map((entry) => ({ entry, match: continuationMatch(entry, payload, clientItems) })).filter((candidate) => candidate.match !== void 0).sort((left, right) => left.match.delta.length - right.match.delta.length || (left.match.mode === right.match.mode ? 0 : left.match.mode === "exact" ? -1 : 1))
+      };
+    };
+    let { candidates, idleCandidates, matches } = scanForHeads();
     let selected = matches[0]?.entry;
-    const selectedMatch = matches[0]?.match;
-    const selectedDelta = selectedMatch?.delta;
+    let selectedMatch = matches[0]?.match;
+    let selectedDelta = selectedMatch?.delta;
     const diagnosticEntry = selected ?? [...idleCandidates].sort((left, right) => right.lastUsedAt - left.lastUsedAt)[0] ?? candidates[0];
     debug(
       `lookup key=${debugKey(partitionKey)} prompt=${debugKey(promptFingerprint)} hit=${candidates.length > 0} heads=${candidates.length} active_connections=${connectionCount()}`
     );
-    const promptChanges = changedPromptFields(diagnosticEntry?.promptFieldHashes, promptFieldHashes);
+    let promptChanges = changedPromptFields(diagnosticEntry?.promptFieldHashes, promptFieldHashes);
     if (promptChanges.length) debug(`prompt fields changed: ${promptChanges.join(",")}`);
     if (promptChanges.includes("instructions")) {
       const summary = instructionChangeSummary(diagnosticEntry?.instructionsSnapshot, instructionsSnapshot);
@@ -9710,35 +9834,49 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
     let promotedConnectionId;
     let decision;
     let candidateMismatchDetails;
-    if (selected && selectedDelta) {
-      sendPayload = { ...payload, input: selectedDelta, previous_response_id: selected.responseId };
+    const deferredMismatchWarnings = [];
+    const flushMismatchWarnings = () => {
+      for (const warn of deferredMismatchWarnings) warn();
+      deferredMismatchWarnings.length = 0;
+    };
+    const continueOnHead = (entry, match) => {
+      sendPayload = { ...payload, input: match.delta, previous_response_id: entry.responseId };
       continued = true;
-      if (selected.generation === "nursery") {
+      if (entry.generation === "nursery") {
         evictions.push(...evictOldestIdleGeneration(
           "established",
           resolvedOptions.maxConnections,
           "established_lru_cap"
         ));
-        selected.generation = "established";
-        promotedConnectionId = selected.debugId;
+        entry.generation = "established";
+        promotedConnectionId = entry.debugId;
       }
-      decision = "continuation";
       debug(
-        `continuing chain with ${selectedDelta.length} incremental input item(s)` + (selectedMatch.mode === "omitted_reasoning" ? " after accepting omitted reasoning" : "")
+        `continuing chain with ${match.delta.length} incremental input item(s)` + (match.mode === "omitted_reasoning" ? " after accepting omitted reasoning" : "")
       );
+      return "continuation";
+    };
+    if (selected && selectedDelta) {
+      decision = continueOnHead(selected, selectedMatch);
     } else if (candidates.some((entry) => entry.inFlight)) {
       selected = void 0;
       persistent = false;
       decision = "parallel_isolated";
       debug("parallel request using an isolated socket");
     } else if (diagnosticEntry) {
-      const diagnosticMismatch = continuationMismatchDetails(diagnosticEntry, payload, debug, true);
+      const diagnosticMismatch = continuationMismatchDetails(
+        diagnosticEntry,
+        payload,
+        debug,
+        true,
+        deferredMismatchWarnings
+      );
       candidateMismatchDetails = /* @__PURE__ */ new Map([[diagnosticEntry, diagnosticMismatch]]);
       for (const candidate of candidates) {
         if (candidate === diagnosticEntry) continue;
         candidateMismatchDetails.set(
           candidate,
-          continuationMismatchDetails(candidate, payload, debug, true)
+          continuationMismatchDetails(candidate, payload, debug, true, deferredMismatchWarnings)
         );
       }
       debug(
@@ -9757,6 +9895,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       decision = "unpartitioned_socket";
     }
     let pacingWaitedMs;
+    let pacingRescanOutcome;
     if (!selected) {
       const pacer = options.pacer ?? sharedWsUpgradePacer();
       const pacingStartedAt = resolvedOptions.now();
@@ -9770,6 +9909,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
           decision,
           waitedMs: Math.max(0, resolvedOptions.now() - pacingStartedAt)
         }, diagnosticCorrelation);
+        flushMismatchWarnings();
         throw error;
       }
       if (admission.kind === "refused") {
@@ -9783,6 +9923,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
           requiredWaitMs: admission.requiredWaitMs,
           retryAfterSeconds: admission.retryAfterSeconds
         }, diagnosticCorrelation);
+        flushMismatchWarnings();
         return pacedRefusalResponse(admission.retryAfterSeconds);
       }
       if (admission.waitedMs > 0) {
@@ -9797,12 +9938,42 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       }
       now = resolvedOptions.now();
       evictions.push(...cleanupExpiredConnections(now));
-      if (persistent && partitionKey && connectionEntries(partitionKey).some((entry) => entry.inFlight)) {
+      if (admission.queued ?? admission.waitedMs > 0) {
+        const rescan = scanForHeads();
+        const rematched = rescan.matches[0];
+        if (rematched) {
+          ({ candidates, idleCandidates, matches } = rescan);
+          selected = rematched.entry;
+          selectedMatch = rematched.match;
+          selectedDelta = rematched.match.delta;
+          persistent = Boolean(partitionKey);
+          promptChanges = changedPromptFields(rematched.entry.promptFieldHashes, promptFieldHashes);
+          decision = continueOnHead(rematched.entry, rematched.match);
+          pacingRescanOutcome = "continuation";
+          debug("continuing a chain head that freed up during the pacing wait");
+          if (promptChanges.length) debug(`prompt fields changed: ${promptChanges.join(",")}`);
+          admission.release?.();
+        } else {
+          pacingRescanOutcome = "no_change";
+        }
+      }
+      if (!selected && persistent && partitionKey && connectionEntries(partitionKey).some((entry) => entry.inFlight)) {
         persistent = false;
         decision = "parallel_isolated";
         debug("parallel request using an isolated socket after pacing");
+        if (pacingRescanOutcome === "no_change") pacingRescanOutcome = "parallel_isolated";
       }
     }
+    let suppressedMismatchWarnings;
+    if (selected && deferredMismatchWarnings.length) {
+      suppressedMismatchWarnings = deferredMismatchWarnings.length;
+      debug(
+        `suppressed ${suppressedMismatchWarnings} arrival mismatch warning(s) after continuing a head that freed up during the pacing wait`
+      );
+      deferredMismatchWarnings.length = 0;
+    } else {
+      flushMismatchWarnings();
+    }
     if (!selected && persistent) {
       evictions.push(...evictOldestIdleGeneration(
         "nursery",
@@ -9845,6 +10016,8 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       promotedConnectionId,
       createdConnectionId: selected ? void 0 : nextConnectionDebugId,
       ...pacingWaitedMs !== void 0 ? { pacingWaitedMs } : {},
+      ...pacingRescanOutcome !== void 0 ? { pacingRescanOutcome } : {},
+      ...suppressedMismatchWarnings !== void 0 ? { suppressedMismatchWarnings } : {},
       createdGeneration: selected ? void 0 : persistent ? "nursery" : "isolated",
       incrementalInputItems: selectedDelta?.length,
       heads: candidates.map((entry) => ({
@@ -10928,6 +11101,28 @@ function sendJson(res, status, body) {
   res.writeHead(status, { "Content-Type": "application/json" });
   res.end(json);
 }
+var RESPONSE_COMPLETED = /* @__PURE__ */ Symbol.for("clodex.responseCompleted");
+var ResponseCompleted = class extends Error {
+  [RESPONSE_COMPLETED] = true;
+  constructor() {
+    super("Response completed");
+    this.name = "ResponseCompleted";
+  }
+};
+function clientDisconnected(signal) {
+  if (!signal.aborted) return false;
+  const reason = signal.reason;
+  return !(typeof reason === "object" && reason !== null && RESPONSE_COMPLETED in reason);
+}
+function watchClientDisconnect(res) {
+  const controller = new AbortController();
+  res.once("close", () => {
+    controller.abort(
+      res.writableFinished ? new ResponseCompleted() : new Error("Client disconnected")
+    );
+  });
+  return controller;
+}
 
 // src/server/vendor-mask.ts
 function reverseSegment(value) {
@@ -11412,7 +11607,23 @@ function resolveUpstreamTools(tools, messages) {
 }
 
 // src/upstream-attempts.ts
-import { RetryError as RetryError2, wrapLanguageModel as wrapLanguageModel2 } from "ai";
+import { APICallError as APICallError2, RetryError as RetryError2, wrapLanguageModel as wrapLanguageModel2 } from "ai";
+function restoreSyntheticRetryAfterHeader(error) {
+  if (!APICallError2.isInstance(error) || error.statusCode !== 429) return;
+  const headers = error.responseHeaders;
+  if (!headers || headers["retry-after"] !== void 0 || headers["retry-after-ms"] !== void 0) return;
+  const rawFrame = error.data;
+  if (!rawFrame || typeof rawFrame !== "object" || rawFrame.type !== "error") return;
+  const frame = providerErrorFrame(rawFrame);
+  if (frame?.retryAfterSeconds === void 0) return;
+  const nestedError = rawFrame.error;
+  const provenance = retryAfterProvenanceFromParam(
+    nestedError && typeof nestedError === "object" ? nestedError.param : void 0
+  );
+  if (provenance?.source !== "upstream") return;
+  if (provenance.rawSeconds < 0 || provenance.rawSeconds > MAX_RETRY_AFTER_SECONDS) return;
+  headers["retry-after"] = String(clampAiSdkRetryAfterSeconds(provenance.rawSeconds));
+}
 function trackUpstreamAttempts(model) {
   if (typeof model === "string") {
     return { model, deadlineError: (timeoutError) => timeoutError };
@@ -11426,6 +11637,7 @@ function trackUpstreamAttempts(model) {
       failedAttempts.length = 0;
       return result;
     } catch (error) {
+      restoreSyntheticRetryAfterHeader(error);
       failedAttempts.push(error);
       waitingToRetry = true;
       throw error;
@@ -12082,9 +12294,10 @@ async function writeAnthropicStream(stream, modelId, write, log12, observer, too
       case "error": {
         const e = part.error;
         const errMsg = e?.message || (typeof part.error === "string" ? part.error : JSON.stringify(e?.data ?? part.error));
-        const errorType = anthropicErrorType(upstreamHttpStatus(part.error, errMsg));
+        const transportCode = sdkUpstreamErrorDetails(part.error)?.transportCode;
+        const errorType = anthropicErrorType(upstreamHttpStatus(part.error, errMsg), transportCode);
         log12?.(() => `sdk stream error (${errorType}): ${errMsg}`);
-        closeOpen();
+        if (!(transportCode === "websocket_transport_error" && openType === "thinking")) closeOpen();
         throw part.error instanceof Error || part.error && typeof part.error === "object" ? part.error : new Error(errMsg);
       }
       default:
@@ -12526,14 +12739,7 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
         anthropicError(res, 401, "Invalid proxy token");
         return;
       }
-      const clientAbort = new AbortController();
-      const abortForClientDisconnect = () => {
-        if (!clientAbort.signal.aborted) clientAbort.abort(new Error("Client disconnected"));
-      };
-      req.once("aborted", abortForClientDisconnect);
-      res.once("close", () => {
-        if (!res.writableFinished) abortForClientDisconnect();
-      });
+      const clientAbort = watchClientDisconnect(res);
       let anthropicBody;
       try {
         const raw = await readBody(req);
@@ -12613,7 +12819,7 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
             signal: clientAbort.signal
           });
         } catch (err) {
-          if (clientAbort.signal.aborted) return;
+          if (clientDisconnected(clientAbort.signal)) return;
           const message = err instanceof UpstreamUnreachableError ? err.message : String(err);
           plog(() => `anthropic token-count error: ${message}`);
           anthropicError(res, 502, message);
@@ -12674,7 +12880,7 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
             }) : void 0
           });
         } catch (err) {
-          if (clientAbort.signal.aborted) return;
+          if (clientDisconnected(clientAbort.signal)) return;
           const message = err instanceof UpstreamUnreachableError ? err.message : String(err);
           plog(() => `anthropic-passthrough error: ${message}`);
           anthropicError(res, 502, message);
@@ -12814,7 +13020,7 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
         };
         let sdkAttempt = 0;
         const handleSdkError = async (err) => {
-          if (clientAbort.signal.aborted) {
+          if (clientDisconnected(clientAbort.signal)) {
             translationLifecycle?.cancel();
             return "cancelled";
           }
@@ -12870,7 +13076,7 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
               contextLengthExceeded ? relayRequestId ?? randomUUID3() : void 0
             );
           } else {
-            const errorType = anthropicErrorType(upstreamStatus);
+            const errorType = anthropicErrorType(upstreamStatus, details?.transportCode);
             res.write(`event: error
 data: ${JSON.stringify({
               type: "error",
@@ -15119,9 +15325,9 @@ function buildDynamicOAuthModel(entry, seedById, codexCatalog) {
   };
 }
 async function fetchJsonWithAuth(url, accessToken, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
     const response = await fetch(url, {
       headers: {
         Accept: "application/json",
@@ -15129,7 +15335,7 @@ async function fetchJsonWithAuth(url, accessToken, timeoutMs) {
         "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
       },
       signal: controller.signal
-    }).finally(() => clearTimeout(timer));
+    });
     if (!response.ok) {
       const detail = await response.text().then((t) => t.slice(0, 200)).catch(() => "");
       return { body: null, error: `HTTP ${response.status}${detail ? `: ${detail}` : ""}` };
@@ -15137,6 +15343,11 @@ async function fetchJsonWithAuth(url, accessToken, timeoutMs) {
     return { body: await response.json() };
   } catch (err) {
     return { body: null, error: err instanceof Error ? err.message : String(err) };
+  } finally {
+    clearTimeout(timer);
+    if (!controller.signal.aborted) {
+      controller.abort(new Error("OpenAI catalog request completed"));
+    }
   }
 }
 async function refreshOpenAiOAuthModels(accessToken) {
@@ -17224,10 +17435,11 @@ async function collectOpenAiStream(stream) {
   }
   return collected;
 }
-function startUpstreamBudget(model, streaming) {
+function startUpstreamBudget(model, streaming, clientSignal) {
   const { idleTimeoutMs, totalTimeoutMs, maxRetries } = upstreamRequestBudget();
   const attempts = trackUpstreamAttempts(model);
   const abort = new AbortController();
+  const stopForwardingAbort = forwardAbortSignal(clientSignal, abort);
   const idleError = () => attempts.deadlineError(new Error(
     `no data received from provider for ${Math.round(idleTimeoutMs / 1e3)}s`
   ));
@@ -17248,6 +17460,7 @@ function startUpstreamBudget(model, streaming) {
       idleTimer = setTimeout(() => abort.abort(idleError()), idleTimeoutMs);
     },
     close: () => {
+      stopForwardingAbort();
       if (idleTimer !== void 0) clearTimeout(idleTimer);
       clearTimeout(totalTimer);
       if (!abort.signal.aborted) abort.abort();
@@ -17269,7 +17482,7 @@ async function* watchOpenAiStream(stream, budget) {
 async function generateOpenAiResponse(model, params, responseModelId, options) {
   let result;
   const streaming = options?.forceStream === true;
-  const budget = startUpstreamBudget(model, streaming);
+  const budget = startUpstreamBudget(model, streaming, options?.abortSignal);
   try {
     if (streaming) {
       const { stream } = streamText2({
@@ -17322,8 +17535,8 @@ async function generateOpenAiResponse(model, params, responseModelId, options) {
     }
   };
 }
-async function streamOpenAiResponse(model, params, responseModelId, onChunk) {
-  const budget = startUpstreamBudget(model, true);
+async function streamOpenAiResponse(model, params, responseModelId, onChunk, options) {
+  const budget = startUpstreamBudget(model, true, options?.abortSignal);
   try {
     const { stream } = streamText2({
       model: budget.model,
@@ -17499,6 +17712,7 @@ async function routeRequest(req, res, options, modelCache, plog) {
   }
 }
 async function handleAnthropicMessages(req, res, options, modelCache, plog) {
+  const clientAbort = watchClientDisconnect(res);
   const body = await readJson(req);
   if (!body) {
     sendJson(res, 400, { error: { message: "Invalid JSON body" } });
@@ -17572,28 +17786,34 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
       rejectedAccessToken
     ) : void 0;
     plog(() => `anthropic-passthrough \u2192 ${messagesUrl} oauth=${isOAuth} stream=${clientWantsStream}`);
-    await relayAnthropicMessages(res, messagesUrl, forwardBody, apiKey, clientWantsStream, {
-      inboundBeta: effectiveBeta,
-      authType,
-      log: (message) => plog(message),
-      claudeCodeSessionId,
-      extraHeaders: model.headers,
-      refreshToken,
-      onTokenRefreshed: (refreshed) => {
-        model.apiKey = refreshed;
-      },
-      // Echo the exact requested id when it differs from the upstream id, so
-      // clients that key context windows on the response model still resolve.
-      responseModelOverride: typeof body.model === "string" && body.model !== upstreamModelId(model) ? body.model : void 0,
-      onUpstreamError: options.inferenceLogPath ? (statusCode, errorContent) => writeInferenceResponseErrorLog(options.inferenceLogPath, {
-        requestId,
-        modelId: body.model,
-        provider: inferenceProvider(model),
-        route: "passthrough",
-        statusCode,
-        errorContent
-      }) : void 0
-    });
+    try {
+      await relayAnthropicMessages(res, messagesUrl, forwardBody, apiKey, clientWantsStream, {
+        inboundBeta: effectiveBeta,
+        authType,
+        log: (message) => plog(message),
+        claudeCodeSessionId,
+        extraHeaders: model.headers,
+        refreshToken,
+        onTokenRefreshed: (refreshed) => {
+          model.apiKey = refreshed;
+        },
+        signal: clientAbort.signal,
+        // Echo the exact requested id when it differs from the upstream id, so
+        // clients that key context windows on the response model still resolve.
+        responseModelOverride: typeof body.model === "string" && body.model !== upstreamModelId(model) ? body.model : void 0,
+        onUpstreamError: options.inferenceLogPath ? (statusCode, errorContent) => writeInferenceResponseErrorLog(options.inferenceLogPath, {
+          requestId,
+          modelId: body.model,
+          provider: inferenceProvider(model),
+          route: "passthrough",
+          statusCode,
+          errorContent
+        }) : void 0
+      });
+    } catch (err) {
+      if (clientDisconnected(clientAbort.signal)) return;
+      throw err;
+    }
     return;
   }
   if (model.modelFormat === "openai") {
@@ -17672,6 +17892,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
           await withResponsesWebSocketDiagnosticContext(
             { requestId, claudeSessionId },
             () => streamAnthropicResponse(languageModel, params, responseModelId, writeStreamChunk, void 0, {
+              abortSignal: clientAbort.signal,
               initialInputTokens: estimateAnthropicInputTokens(body),
               onPromptTokens: (total) => reportPricingBoundaryCrossing({
                 modelKey: model.id,
@@ -17688,6 +17909,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
             { requestId, claudeSessionId },
             () => generateAnthropicResponse(languageModel, params, responseModelId, {
               forceStream: openAiOAuth,
+              abortSignal: clientAbort.signal,
               onPromptTokens: (total) => reportPricingBoundaryCrossing({
                 modelKey: model.id,
                 modelLabel: model.name || model.id,
@@ -17700,6 +17922,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
         }
         break;
       } catch (err) {
+        if (clientDisconnected(clientAbort.signal)) break;
         const message = formatUpstreamError(err);
         const details = sdkUpstreamErrorDetails(err);
         const candidateStatus = details?.statusCode ?? upstreamHttpStatus(err, message);
@@ -17736,7 +17959,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
             sendJson(res, status === 500 ? 502 : status, { error: { message: clientMessage } });
           }
         } else {
-          const errorType = anthropicErrorType(status);
+          const errorType = anthropicErrorType(status, details?.transportCode);
           res.write(`event: error
 data: ${JSON.stringify({
             type: "error",
@@ -17755,6 +17978,7 @@ data: ${JSON.stringify({
   sendJson(res, 400, { error: { message: `Unsupported model format: ${model.modelFormat}` } });
 }
 async function handleAnthropicCountTokens(req, res, options, plog) {
+  const clientAbort = watchClientDisconnect(res);
   const body = await readJson(req);
   if (!body) {
     sendJson(res, 400, { error: { message: "Invalid JSON body" } });
@@ -17805,18 +18029,25 @@ async function handleAnthropicCountTokens(req, res, options, plog) {
   ) : void 0;
   const countTokensUrl = `${model.baseUrl}/v1/messages/count_tokens`;
   plog(() => `anthropic-count-tokens \u2192 ${countTokensUrl} oauth=${isOAuth}`);
-  await relayAnthropicMessages(res, countTokensUrl, forwardBody, apiKey, false, {
-    inboundBeta,
-    authType,
-    log: (message) => plog(message),
-    extraHeaders: model.headers,
-    refreshToken,
-    onTokenRefreshed: (refreshed) => {
-      model.apiKey = refreshed;
-    }
-  });
+  try {
+    await relayAnthropicMessages(res, countTokensUrl, forwardBody, apiKey, false, {
+      inboundBeta,
+      authType,
+      log: (message) => plog(message),
+      extraHeaders: model.headers,
+      refreshToken,
+      onTokenRefreshed: (refreshed) => {
+        model.apiKey = refreshed;
+      },
+      signal: clientAbort.signal
+    });
+  } catch (err) {
+    if (clientDisconnected(clientAbort.signal)) return;
+    throw err;
+  }
 }
 async function handleOpenAIChatCompletions(req, res, options, modelCache, plog) {
+  const clientAbort = watchClientDisconnect(res);
   const body = await readJson(req);
   if (!body) {
     sendJson(res, 400, { error: { message: "Invalid JSON body" } });
@@ -17857,21 +18088,27 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
       options.apiKey,
       rejectedAccessToken
     ) : void 0;
-    await relayAnthropicMessages(res, completionsUrl, forwardBody, apiKey2, Boolean(body.stream), {
-      authType: model.authType ?? "api",
-      extraHeaders: model.headers,
-      refreshToken,
-      onTokenRefreshed: (refreshed) => {
-        model.apiKey = refreshed;
-      },
-      onUpstreamError: options.inferenceLogPath ? (statusCode, errorContent) => writeInferenceResponseErrorLog(options.inferenceLogPath, {
-        modelId: body.model,
-        provider: inferenceProvider(model),
-        route: "passthrough",
-        statusCode,
-        errorContent
-      }) : void 0
-    });
+    try {
+      await relayAnthropicMessages(res, completionsUrl, forwardBody, apiKey2, Boolean(body.stream), {
+        authType: model.authType ?? "api",
+        extraHeaders: model.headers,
+        refreshToken,
+        onTokenRefreshed: (refreshed) => {
+          model.apiKey = refreshed;
+        },
+        signal: clientAbort.signal,
+        onUpstreamError: options.inferenceLogPath ? (statusCode, errorContent) => writeInferenceResponseErrorLog(options.inferenceLogPath, {
+          modelId: body.model,
+          provider: inferenceProvider(model),
+          route: "passthrough",
+          statusCode,
+          errorContent
+        }) : void 0
+      });
+    } catch (err) {
+      if (clientDisconnected(clientAbort.signal)) return;
+      throw err;
+    }
     return;
   }
   const npm = model.npm || (model.modelFormat === "anthropic" ? "@ai-sdk/anthropic" : void 0);
@@ -17923,15 +18160,21 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
           }
           res.write(chunk);
         };
-        await streamOpenAiResponse(languageModel, params, responseModelId, writeStreamChunk);
+        await streamOpenAiResponse(languageModel, params, responseModelId, writeStreamChunk, {
+          abortSignal: clientAbort.signal
+        });
         if (!res.headersSent) writeStreamChunk("");
         res.end();
       } else {
-        const response = await generateOpenAiResponse(languageModel, params, responseModelId, { forceStream: openAiOAuth });
+        const response = await generateOpenAiResponse(languageModel, params, responseModelId, {
+          forceStream: openAiOAuth,
+          abortSignal: clientAbort.signal
+        });
         sendJson(res, 200, response);
       }
       break;
     } catch (err) {
+      if (clientDisconnected(clientAbort.signal)) break;
       const message = formatUpstreamError(err);
       const details = sdkUpstreamErrorDetails(err);
       const candidateStatus = details?.statusCode ?? upstreamHttpStatus(err, message);
@@ -18146,6 +18389,7 @@ import * as p9 from "@clack/prompts";
 import * as http2 from "http";
 import * as https from "https";
 import * as net from "net";
+import { PassThrough } from "stream";
 import { randomUUID as randomUUID6 } from "crypto";
 import { URL as URL2 } from "url";
 import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
@@ -18456,7 +18700,7 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
     let settled = false;
     let responseEnded = false;
     let failed = false;
-    let clientDisconnected = false;
+    let clientDisconnected2 = false;
     const writeLifecycle = (event, extra = {}) => {
       if (!lifecycle) return;
       writeInferenceResponseLifecycleLog(lifecycle.logPath, {
@@ -18498,7 +18742,7 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
     const errorType = (err) => err.code ?? err.name;
     let upstream;
     let attempt = 0;
-    const isRetryableUpstreamFailure = (err, request3) => attempt <= retryBudget && !headersReceived && !failed && !clientDisconnected && !isLocalShutdown() && request3.reusedSocket === true && err.code === RETRYABLE_PASSTHROUGH_CODE;
+    const isRetryableUpstreamFailure = (err, request3) => attempt <= retryBudget && !headersReceived && !failed && !clientDisconnected2 && !isLocalShutdown() && request3.reusedSocket === true && err.code === RETRYABLE_PASSTHROUGH_CODE;
     const sendAttempt = () => {
       attempt += 1;
       const request3 = https.request({
@@ -18537,7 +18781,7 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
           done();
         });
         upstreamRes.once("error", (err) => {
-          if (clientDisconnected || failed) {
+          if (clientDisconnected2 || failed) {
             done();
             return;
           }
@@ -18561,7 +18805,7 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
       });
       upstream = request3;
       request3.once("error", (err) => {
-        if (clientDisconnected) {
+        if (clientDisconnected2) {
           done();
           return;
         }
@@ -18609,7 +18853,7 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
     };
     res.once("finish", () => {
       stopProgress();
-      if (failed || clientDisconnected) return;
+      if (failed || clientDisconnected2) return;
       const now = Date.now();
       writeLifecycle("response_completed", {
         statusCode,
@@ -18623,7 +18867,7 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
     res.once("close", () => {
       stopProgress();
       if (res.writableFinished || failed) return;
-      clientDisconnected = true;
+      clientDisconnected2 = true;
       const now = Date.now();
       writeLifecycle("response_client_disconnected", {
         statusCode,
@@ -18652,7 +18896,7 @@ function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http2.req
     let chunks = 0;
     let adapterEnded = false;
     let failed = false;
-    let clientDisconnected = false;
+    let clientDisconnected2 = false;
     let adapterResponse;
     let upstream;
     const writeLifecycle = (event, extra = {}) => {
@@ -18690,7 +18934,7 @@ function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http2.req
     };
     res.once("finish", () => {
       stopProgress();
-      if (failed || clientDisconnected) return;
+      if (failed || clientDisconnected2) return;
       const now = Date.now();
       writeLifecycle("response_completed", {
         statusCode,
@@ -18703,7 +18947,7 @@ function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http2.req
     res.once("close", () => {
       stopProgress();
       if (res.writableFinished || failed) return;
-      clientDisconnected = true;
+      clientDisconnected2 = true;
       const now = Date.now();
       writeLifecycle("response_client_disconnected", {
         statusCode,
@@ -18720,7 +18964,7 @@ function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http2.req
       resolve3();
     });
     const failAdapterRequest = (err, failureSource) => {
-      if (clientDisconnected) {
+      if (clientDisconnected2) {
         resolve3();
         return;
       }
@@ -18778,7 +19022,7 @@ function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http2.req
       });
       copyResponse(upstreamRes, res, void 0, lifecycle ? (usage) => writeLifecycle("response_usage", usage) : void 0);
       const failAdapterResponse = (err, failureSource) => {
-        if (clientDisconnected) {
+        if (clientDisconnected2) {
           resolve3();
           return;
         }
@@ -18833,6 +19077,97 @@ function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http2.req
     upstream.end(rawBody);
   });
 }
+function forwardAnthropicUpgrade(req, clientSocket, head, origin, rejectUnauthorized, agent, sockets) {
+  if (clientSocket._httpMessage) {
+    clientSocket.destroy();
+    return;
+  }
+  const clientData = new PassThrough();
+  clientSocket.pipe(clientData);
+  let responseStarted = false;
+  let upgradedSocket;
+  const upstream = https.request({
+    protocol: "https:",
+    hostname: origin.hostname,
+    port: origin.port || 443,
+    method: req.method,
+    path: req.url,
+    headers: requestHeadersWithoutProxyHeaders(req),
+    servername: net.isIP(origin.hostname) ? void 0 : origin.hostname,
+    rejectUnauthorized,
+    agent
+  });
+  const fail = () => {
+    if (clientSocket.destroyed) return;
+    if (responseStarted) {
+      clientSocket.destroy();
+      return;
+    }
+    responseStarted = true;
+    clientSocket.end(
+      "HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\nContent-Length: 0\r\n\r\n",
+      () => clientSocket.destroy()
+    );
+  };
+  clientSocket.once("error", () => clientSocket.destroy());
+  clientSocket.once("end", () => {
+    if (!responseStarted) clientSocket.destroy();
+  });
+  clientSocket.once("close", () => {
+    clientData.destroy();
+    upstream.destroy();
+    upgradedSocket?.destroy();
+  });
+  upstream.once("socket", (socket) => {
+    if (clientSocket.destroyed) socket.destroy();
+  });
+  upstream.once("error", fail);
+  upstream.once("close", () => {
+    if (!responseStarted) fail();
+  });
+  upstream.once("response", (upstreamRes) => {
+    if (clientSocket.destroyed) {
+      upstreamRes.destroy();
+      return;
+    }
+    responseStarted = true;
+    const response = new http2.ServerResponse(req);
+    response.shouldKeepAlive = false;
+    response.assignSocket(clientSocket);
+    clientSocket.on("drain", () => response.emit("drain"));
+    response.once("error", () => clientSocket.destroy());
+    response.once("finish", () => clientSocket.end(() => clientSocket.destroy()));
+    copyResponse(upstreamRes, response);
+  });
+  upstream.once("upgrade", (upstreamRes, socket, upstreamHead) => {
+    if (clientSocket.destroyed) {
+      socket.destroy();
+      return;
+    }
+    responseStarted = true;
+    upgradedSocket = socket;
+    sockets.add(socket);
+    socket.once("error", () => clientSocket.destroy());
+    socket.once("close", () => {
+      sockets.delete(socket);
+      clientSocket.destroy();
+    });
+    const headers = [
+      `HTTP/${upstreamRes.httpVersion} ${upstreamRes.statusCode} ${upstreamRes.statusMessage}`
+    ];
+    for (let i = 0; i < upstreamRes.rawHeaders.length; i += 2) {
+      headers.push(`${upstreamRes.rawHeaders[i]}: ${upstreamRes.rawHeaders[i + 1]}`);
+    }
+    clientSocket.write(Buffer.from(`${headers.join("\r\n")}\r
+\r
+`, "latin1"));
+    if (upstreamHead.length > 0) clientSocket.write(upstreamHead);
+    if (head.length > 0) socket.write(head);
+    clientData.pipe(socket);
+    socket.pipe(clientSocket);
+  });
+  upstream.end();
+}
 function forwardPlainHttp(req, res) {
   let target;
   try {
@@ -19049,6 +19384,17 @@ async function startHttpProxy(options) {
     );
   });
   const sockets = /* @__PURE__ */ new Set();
+  mitmServer.on("upgrade", (req, socket, head) => {
+    forwardAnthropicUpgrade(
+      req,
+      socket,
+      head,
+      anthropicOrigin,
+      options.anthropicRejectUnauthorized ?? true,
+      anthropicAgent,
+      sockets
+    );
+  });
   const proxyServer = http2.createServer(forwardPlainHttp);
   proxyServer.on("connection", (socket) => {
     sockets.add(socket);