@dianshuv/copilot-api 0.11.4 → 0.13.0

package/dist/main.mjs

@@ -3,16 +3,13 @@ import { defineCommand, runMain } from "citty";
 import consola from "consola";
 import fs from "node:fs/promises";
 import os from "node:os";
-import path, { dirname, join } from "node:path";
+import path from "node:path";
 import { getProxyForUrl } from "proxy-from-env";
 import { Agent, ProxyAgent, setGlobalDispatcher } from "undici";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import clipboard from "clipboardy";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { serve } from "srvx";
 import { PostHog } from "posthog-node";
-import { execSync } from "node:child_process";
-import process$1 from "node:process";
 import pc from "picocolors";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
@@ -478,6 +475,56 @@ async function getGitHubUser() {
 	return await response.json();
 }
 
+//#endregion
+//#region src/lib/tui/request-timings.ts
+/** Canonical phase keys — the Map keys double as TrackedRequest field names. */
+const TIMING = {
+	TOKENIZE: "tokenizeMs",
+	TOKENIZE_COLD: "tokenizeColdMs",
+	UPSTREAM_TTFB: "upstreamTtfbMs",
+	LIMITER_RETRIES: "limiterRetries"
+};
+const storage = new AsyncLocalStorage();
+/** Run `fn` with a fresh per-request timings store available ambiently. */
+function runWithTimings(fn) {
+	const timings = /* @__PURE__ */ new Map();
+	return storage.run(timings, () => fn(timings));
+}
+/** The current request's timings store, if running inside `runWithTimings`. */
+function getTimings() {
+	return storage.getStore();
+}
+/**
+* Add `ms` to the named phase on the current (or given) timings store.
+* Accumulates: the same phase recorded multiple times sums (e.g. tokenize
+* running several passes within one request). No-op when no store is active.
+*/
+function addTiming(phase, ms, store = storage.getStore()) {
+	if (!store) return;
+	store.set(phase, (store.get(phase) ?? 0) + ms);
+}
+/** Time a sync fn and accumulate its duration under `phase`; returns its result. */
+function timeSync(phase, fn) {
+	const start = performance.now();
+	try {
+		return fn();
+	} finally {
+		addTiming(phase, performance.now() - start);
+	}
+}
+/**
+* Project a collected timings Map onto the PhaseTimings shape so it can be
+* spread straight onto a tracker RequestUpdate. Values are rounded to whole ms
+* (limiterRetries is already integer, so rounding is a no-op there).
+*/
+function timingsToUpdate(timings) {
+	const out = {};
+	if (!timings) return out;
+	const writable = out;
+	for (const [key, value] of timings) writable[key] = Math.round(value);
+	return out;
+}
+
 //#endregion
 //#region src/lib/fetch-retry.ts
 const RETRYABLE_CAUSE_CODES = new Set([
@@ -521,7 +568,9 @@ async function fetchWithRetry(input, init, options) {
 	let networkAttempts = 0;
 	for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) try {
 		networkAttempts++;
+		const fetchStart = performance.now();
 		const response = await fetch(input, currentInit);
+		const ttfbMs = performance.now() - fetchStart;
 		if (response.status === 401 && !authRefreshed && options?.onUnauthorized) {
 			const refreshed = await tryRefreshAuth(options.onUnauthorized);
 			if (refreshed) {
@@ -533,6 +582,7 @@ async function fetchWithRetry(input, init, options) {
 				continue;
 			}
 		}
+		addTiming(TIMING.UPSTREAM_TTFB, ttfbMs);
 		annotateRetryMeta(response, networkAttempts, authRefreshed);
 		return response;
 	} catch (error) {
@@ -782,45 +832,6 @@ async function logUser() {
 	consola.info(`Logged in as ${user.login}`);
 }
 
-//#endregion
-//#region src/auth.ts
-async function runAuth(options) {
-	if (options.verbose) {
-		consola.level = 5;
-		consola.info("Verbose logging enabled");
-	}
-	state.showToken = options.showToken;
-	initProxyFromEnv();
-	await ensurePaths();
-	await setupGitHubToken({ force: true });
-	consola.success("GitHub token written to", PATHS.GITHUB_TOKEN_PATH);
-}
-const auth = defineCommand({
-	meta: {
-		name: "auth",
-		description: "Run GitHub auth flow without running the server"
-	},
-	args: {
-		verbose: {
-			alias: "v",
-			type: "boolean",
-			default: false,
-			description: "Enable verbose logging"
-		},
-		"show-token": {
-			type: "boolean",
-			default: false,
-			description: "Show GitHub token on auth"
-		}
-	},
-	run({ args }) {
-		return runAuth({
-			verbose: args.verbose,
-			showToken: args["show-token"]
-		});
-	}
-});
-
 //#endregion
 //#region src/services/github/get-copilot-usage.ts
 const getCopilotUsage = async () => {
@@ -829,43 +840,6 @@ const getCopilotUsage = async () => {
 	return await response.json();
 };
 
-//#endregion
-//#region src/check-usage.ts
-const checkUsage = defineCommand({
-	meta: {
-		name: "check-usage",
-		description: "Show current GitHub Copilot usage/quota information"
-	},
-	async run() {
-		initProxyFromEnv();
-		await ensurePaths();
-		await setupGitHubToken();
-		try {
-			const usage = await getCopilotUsage();
-			const premium = usage.quota_snapshots.premium_interactions;
-			const premiumTotal = premium.entitlement;
-			const premiumUsed = premiumTotal - premium.remaining;
-			const premiumPercentUsed = premiumTotal > 0 ? premiumUsed / premiumTotal * 100 : 0;
-			const premiumPercentRemaining = premium.percent_remaining;
-			function summarizeQuota(name, snap) {
-				if (!snap) return `${name}: N/A`;
-				const total = snap.entitlement;
-				const used = total - snap.remaining;
-				const percentUsed = total > 0 ? used / total * 100 : 0;
-				const percentRemaining = snap.percent_remaining;
-				return `${name}: ${used}/${total} used (${percentUsed.toFixed(1)}% used, ${percentRemaining.toFixed(1)}% remaining)`;
-			}
-			const premiumLine = `Premium: ${premiumUsed}/${premiumTotal} used (${premiumPercentUsed.toFixed(1)}% used, ${premiumPercentRemaining.toFixed(1)}% remaining)`;
-			const chatLine = summarizeQuota("Chat", usage.quota_snapshots.chat);
-			const completionsLine = summarizeQuota("Completions", usage.quota_snapshots.completions);
-			consola.box(`Copilot Usage (plan: ${usage.copilot_plan})\nQuota resets: ${usage.quota_reset_date}\n\nQuotas:\n  ${premiumLine}\n  ${chatLine}\n  ${completionsLine}`);
-		} catch (err) {
-			consola.error("Failed to fetch Copilot usage:", err);
-			process.exit(1);
-		}
-	}
-});
-
 //#endregion
 //#region src/debug.ts
 async function getPackageVersion() {
@@ -1008,6 +982,45 @@ const debug = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/login.ts
+async function runLogin(options) {
+	if (options.verbose) {
+		consola.level = 5;
+		consola.info("Verbose logging enabled");
+	}
+	state.showToken = options.showToken;
+	initProxyFromEnv();
+	await ensurePaths();
+	await setupGitHubToken({ force: true });
+	consola.success("GitHub token written to", PATHS.GITHUB_TOKEN_PATH);
+}
+const login = defineCommand({
+	meta: {
+		name: "login",
+		description: "Run GitHub auth flow without running the server"
+	},
+	args: {
+		verbose: {
+			alias: "v",
+			type: "boolean",
+			default: false,
+			description: "Enable verbose logging"
+		},
+		"show-token": {
+			type: "boolean",
+			default: false,
+			description: "Show GitHub token on auth"
+		}
+	},
+	run({ args }) {
+		return runLogin({
+			verbose: args.verbose,
+			showToken: args["show-token"]
+		});
+	}
+});
+
 //#endregion
 //#region src/logout.ts
 async function runLogout() {
@@ -1033,2004 +1046,1693 @@ const logout = defineCommand({
 });
 
 //#endregion
-//#region src/patch-claude-code.ts
-const SUPPORTED_VERSIONS = {
-	v2a: {
-		min: "2.0.0",
-		max: "2.1.10"
-	},
-	v2b: { min: "2.1.11" }
-};
-const PATTERNS = {
-	funcOriginal: /function HR\(A\)\{if\(A\.includes\("\[1m\]"\)\)return 1e6;return 200000\}/,
-	funcPatched: /function HR\(A\)\{if\(A\.includes\("\[1m\]"\)\)return 1e6;return \d+\}/,
-	variable: /var ([A-Za-z_$]\w*)=(\d+)(?=,\w+=20000,)/
-};
-/**
-* Parse semver version string to comparable parts
-*/
-function parseVersion(version) {
-	return version.split(".").map((n) => Number.parseInt(n, 10) || 0);
-}
-/**
-* Compare two semver versions
-* Returns: -1 if a < b, 0 if a == b, 1 if a > b
-*/
-function compareVersions(a, b) {
-	const partsA = parseVersion(a);
-	const partsB = parseVersion(b);
-	const len = Math.max(partsA.length, partsB.length);
-	for (let i = 0; i < len; i++) {
-		const numA = partsA[i] || 0;
-		const numB = partsB[i] || 0;
-		if (numA < numB) return -1;
-		if (numA > numB) return 1;
+//#region package.json
+var version = "0.13.0";
+
+//#endregion
+//#region src/lib/event-loop-lag.ts
+const PROBE_INTERVAL_MS = 500;
+const REPORT_EVERY = 20;
+const WARN_LAG_MS = 50;
+let timer$1 = null;
+let expectedNext = 0;
+let maxLagMs = 0;
+let sumLagMs = 0;
+let samples = 0;
+function startEventLoopLagMonitor() {
+	if (timer$1) return;
+	expectedNext = performance.now() + PROBE_INTERVAL_MS;
+	timer$1 = setInterval(() => {
+		const now = performance.now();
+		const lag = Math.max(0, now - expectedNext);
+		expectedNext = now + PROBE_INTERVAL_MS;
+		maxLagMs = Math.max(maxLagMs, lag);
+		sumLagMs += lag;
+		samples++;
+		if (samples < REPORT_EVERY) return;
+		const avg = sumLagMs / samples;
+		const max = maxLagMs;
+		if (max >= WARN_LAG_MS) consola.warn(`[event-loop] lag avg=${avg.toFixed(1)}ms max=${max.toFixed(1)}ms (blocked thread)`);
+		else consola.debug(`[event-loop] lag avg=${avg.toFixed(1)}ms max=${max.toFixed(1)}ms`);
+		maxLagMs = 0;
+		sumLagMs = 0;
+		samples = 0;
+	}, PROBE_INTERVAL_MS);
+	if (typeof timer$1.unref === "function") timer$1.unref();
+}
+function stopEventLoopLagMonitor() {
+	if (timer$1) {
+		clearInterval(timer$1);
+		timer$1 = null;
 	}
-	return 0;
-}
-function getPatternTypeForVersion(version) {
-	if (compareVersions(version, SUPPORTED_VERSIONS.v2a.min) >= 0 && compareVersions(version, SUPPORTED_VERSIONS.v2a.max) <= 0) return "func";
-	if (compareVersions(version, SUPPORTED_VERSIONS.v2b.min) >= 0) return "variable";
-	return null;
 }
+
+//#endregion
+//#region src/lib/history-ws.ts
 /**
-* Get supported version range string for error messages
+* WebSocket support for History API.
+* Enables real-time updates when new requests are recorded.
 */
-function getSupportedRangeString() {
-	return `${SUPPORTED_VERSIONS.v2a.min}-${SUPPORTED_VERSIONS.v2a.max}, ${SUPPORTED_VERSIONS.v2b.min}+`;
+const clients = /* @__PURE__ */ new Set();
+function addClient(ws) {
+	clients.add(ws);
+	const msg = {
+		type: "connected",
+		data: { clientCount: clients.size },
+		timestamp: Date.now()
+	};
+	ws.send(JSON.stringify(msg));
 }
-/**
-* Get Claude Code version from package.json
-*/
-function getClaudeCodeVersion(cliPath) {
-	try {
-		const packageJsonPath = join(dirname(cliPath), "package.json");
-		if (!existsSync(packageJsonPath)) return null;
-		const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-		if (typeof packageJson === "object" && packageJson !== null && "version" in packageJson && typeof packageJson.version === "string") return packageJson.version;
-		return null;
-	} catch {
-		return null;
-	}
+function removeClient(ws) {
+	clients.delete(ws);
 }
-/**
-* Search volta tools directory for Claude Code
-*/
-function findInVoltaTools(voltaHome) {
-	const paths = [];
-	const packagesPath = join(voltaHome, "tools", "image", "packages", "@anthropic-ai", "claude-code", "lib", "node_modules", "@anthropic-ai", "claude-code", "cli.js");
-	if (existsSync(packagesPath)) paths.push(packagesPath);
-	const toolsDir = join(voltaHome, "tools", "image", "node");
-	if (existsSync(toolsDir)) try {
-		for (const version of readdirSync(toolsDir)) {
-			const claudePath = join(toolsDir, version, "lib", "node_modules", "@anthropic-ai", "claude-code", "cli.js");
-			if (existsSync(claudePath)) paths.push(claudePath);
-		}
-	} catch {}
-	return paths;
-}
-/**
-* Find all Claude Code CLI paths by checking common locations
-*/
-function findAllClaudeCodePaths() {
-	const possiblePaths = [];
-	const home = process.env.HOME || "";
-	const voltaHome = process.env.VOLTA_HOME || join(home, ".volta");
-	if (existsSync(voltaHome)) possiblePaths.push(...findInVoltaTools(voltaHome));
-	const npmPrefix = process.env.npm_config_prefix;
-	if (npmPrefix) possiblePaths.push(join(npmPrefix, "lib", "node_modules", "@anthropic-ai", "claude-code", "cli.js"));
-	const globalPaths = [
-		join(home, ".npm-global", "lib", "node_modules"),
-		"/usr/local/lib/node_modules",
-		"/usr/lib/node_modules"
-	];
-	for (const base of globalPaths) possiblePaths.push(join(base, "@anthropic-ai", "claude-code", "cli.js"));
-	const bunGlobal = join(home, ".bun", "install", "global");
-	if (existsSync(bunGlobal)) possiblePaths.push(join(bunGlobal, "node_modules", "@anthropic-ai", "claude-code", "cli.js"));
-	return [...new Set(possiblePaths.filter((p) => existsSync(p)))];
+function getClientCount() {
+	return clients.size;
 }
-/**
-* Get installation info for a CLI path
-*/
-function getInstallationInfo(cliPath) {
-	return {
-		path: cliPath,
-		version: getClaudeCodeVersion(cliPath),
-		limit: getCurrentLimit(readFileSync(cliPath, "utf8"))
-	};
+function closeAllClients() {
+	for (const client of clients) try {
+		client.close(1001, "Server shutting down");
+	} catch {}
+	clients.clear();
 }
-function getCurrentLimitInfo(content) {
-	const varMatch = content.match(PATTERNS.variable);
-	if (varMatch) return {
-		limit: Number.parseInt(varMatch[2], 10),
-		varName: varMatch[1]
-	};
-	const funcMatch = content.match(PATTERNS.funcPatched);
-	if (funcMatch) {
-		const limitMatch = funcMatch[0].match(/return (\d+)\}$/);
-		return limitMatch ? { limit: Number.parseInt(limitMatch[1], 10) } : null;
+function broadcast(message) {
+	const data = JSON.stringify(message);
+	for (const client of clients) try {
+		if (client.readyState === WebSocket.OPEN) client.send(data);
+		else clients.delete(client);
+	} catch (error) {
+		consola.debug("WebSocket send failed, removing client:", error);
+		clients.delete(client);
 	}
-	return null;
 }
-/**
-* Get current context limit from Claude Code (legacy wrapper)
-*/
-function getCurrentLimit(content) {
-	return getCurrentLimitInfo(content)?.limit ?? null;
+function notifyEntryAdded(summary) {
+	if (clients.size === 0) return;
+	broadcast({
+		type: "entry_added",
+		data: summary,
+		timestamp: Date.now()
+	});
 }
-/**
-* Check if Claude Code version is supported for patching
-*/
-function checkVersionSupport(cliPath) {
-	const version = getClaudeCodeVersion(cliPath);
-	if (!version) return {
-		supported: false,
-		version: null,
-		patternType: null,
-		error: "Could not detect Claude Code version"
-	};
-	const patternType = getPatternTypeForVersion(version);
-	if (!patternType) return {
-		supported: false,
-		version,
-		patternType: null,
-		error: `Version ${version} is not supported. Supported: ${getSupportedRangeString()}`
-	};
-	return {
-		supported: true,
-		version,
-		patternType
-	};
+function notifyEntryUpdated(summary) {
+	if (clients.size === 0) return;
+	broadcast({
+		type: "entry_updated",
+		data: summary,
+		timestamp: Date.now()
+	});
 }
-/**
-* Patch Claude Code to use a different context limit
-*/
-function patchClaudeCode(cliPath, newLimit) {
-	const content = readFileSync(cliPath, "utf8");
-	const versionCheck = checkVersionSupport(cliPath);
-	if (!versionCheck.supported) {
-		consola.error(versionCheck.error);
-		return "failed";
-	}
-	consola.info(`Claude Code version: ${versionCheck.version}`);
-	const limitInfo = getCurrentLimitInfo(content);
-	if (limitInfo?.limit === newLimit) return "already_patched";
-	let newContent;
-	if (versionCheck.patternType === "variable") {
-		if (!limitInfo?.varName) {
-			consola.error("Could not detect variable name for patching");
-			return "failed";
-		}
-		newContent = content.replace(PATTERNS.variable, `var ${limitInfo.varName}=${newLimit}`);
-	} else {
-		const replacement = `function HR(A){if(A.includes("[1m]"))return 1e6;return ${newLimit}}`;
-		const pattern = PATTERNS.funcOriginal.test(content) ? PATTERNS.funcOriginal : PATTERNS.funcPatched;
-		newContent = content.replace(pattern, replacement);
-	}
-	writeFileSync(cliPath, newContent);
-	return "success";
+function notifyStatsUpdated(stats) {
+	if (clients.size === 0) return;
+	broadcast({
+		type: "stats_updated",
+		data: stats,
+		timestamp: Date.now()
+	});
 }
-/**
-* Restore Claude Code to original 200k limit
-*/
-function restoreClaudeCode(cliPath) {
-	const content = readFileSync(cliPath, "utf8");
-	const versionCheck = checkVersionSupport(cliPath);
-	if (!versionCheck.supported) {
-		consola.error(versionCheck.error);
-		return false;
-	}
-	consola.info(`Claude Code version: ${versionCheck.version}`);
-	const limitInfo = getCurrentLimitInfo(content);
-	if (limitInfo?.limit === 2e5) {
-		consola.info("Already at original 200000 limit");
-		return true;
-	}
-	let newContent;
-	if (versionCheck.patternType === "variable") {
-		if (!limitInfo?.varName) {
-			consola.error("Could not detect variable name for restoring");
-			return false;
-		}
-		newContent = content.replace(PATTERNS.variable, `var ${limitInfo.varName}=200000`);
-	} else newContent = content.replace(PATTERNS.funcPatched, "function HR(A){if(A.includes(\"[1m]\"))return 1e6;return 200000}");
-	writeFileSync(cliPath, newContent);
-	return true;
+function notifyHistoryCleared() {
+	if (clients.size === 0) return;
+	broadcast({
+		type: "history_cleared",
+		data: null,
+		timestamp: Date.now()
+	});
 }
-function showStatus(cliPath, currentLimit) {
-	const version = getClaudeCodeVersion(cliPath);
-	if (version) consola.info(`Claude Code version: ${version}`);
-	if (currentLimit === null) {
-		consola.warn("Could not detect current limit - CLI may have been updated");
-		consola.info("Look for a variable like 'var XXX=200000' followed by ',YYY=20000,' in cli.js");
-	} else if (currentLimit === 2e5) consola.info("Status: Original (200k context window)");
-	else consola.info(`Status: Patched (${currentLimit} context window)`);
+function notifySessionDeleted(sessionId) {
+	if (clients.size === 0) return;
+	broadcast({
+		type: "session_deleted",
+		data: { sessionId },
+		timestamp: Date.now()
+	});
 }
-const patchClaude = defineCommand({
-	meta: {
-		name: "patch-claude",
-		description: "Patch Claude Code's context window limit to match Copilot's limits"
-	},
-	args: {
-		limit: {
-			alias: "l",
-			type: "string",
-			default: "128000",
-			description: "Context window limit in tokens (default: 128000 for Copilot)"
-		},
-		restore: {
-			alias: "r",
-			type: "boolean",
-			default: false,
-			description: "Restore original 200k limit"
-		},
-		path: {
-			alias: "p",
-			type: "string",
-			description: "Path to Claude Code cli.js (auto-detected if not specified)"
-		},
-		status: {
-			alias: "s",
-			type: "boolean",
-			default: false,
-			description: "Show current patch status without modifying"
-		}
-	},
-	async run({ args }) {
-		let cliPath;
-		if (args.path) {
-			cliPath = args.path;
-			if (!existsSync(cliPath)) {
-				consola.error(`File not found: ${cliPath}`);
-				process.exit(1);
-			}
-		} else {
-			const installations = findAllClaudeCodePaths();
-			if (installations.length === 0) {
-				consola.error("Could not find Claude Code installation");
-				consola.info("Searched in: volta, npm global, bun global");
-				consola.info("Use --path to specify the path to cli.js manually");
-				process.exit(1);
-			}
-			if (installations.length === 1) cliPath = installations[0];
-			else {
-				consola.info(`Found ${installations.length} Claude Code installations:`);
-				const options = installations.map((path) => {
-					const info = getInstallationInfo(path);
-					let status = "unknown";
-					if (info.limit === 2e5) status = "original";
-					else if (info.limit) status = `patched: ${info.limit}`;
-					return {
-						label: `v${info.version ?? "?"} (${status}) - ${path}`,
-						value: path
-					};
-				});
-				const selected = await consola.prompt("Select installation to patch:", {
-					type: "select",
-					options
-				});
-				if (typeof selected === "symbol") process.exit(0);
-				cliPath = selected;
-			}
-		}
-		consola.info(`Claude Code path: ${cliPath}`);
-		const currentLimit = getCurrentLimit(readFileSync(cliPath, "utf8"));
-		if (args.status) {
-			showStatus(cliPath, currentLimit);
-			return;
-		}
-		if (args.restore) {
-			if (restoreClaudeCode(cliPath)) consola.success("Restored to original 200k limit");
-			else {
-				consola.error("Failed to restore - pattern not found");
-				consola.info("Claude Code may have been updated to a new version");
-				process.exit(1);
-			}
-			return;
-		}
-		const limit = Number.parseInt(args.limit, 10);
-		if (Number.isNaN(limit) || limit < 1e3) {
-			consola.error("Invalid limit value. Must be a number >= 1000");
-			process.exit(1);
-		}
-		const result = patchClaudeCode(cliPath, limit);
-		if (result === "success") {
-			consola.success(`Patched context window: ${currentLimit ?? 2e5} → ${limit}`);
-			consola.info("Note: You may need to re-run this after Claude Code updates");
-		} else if (result === "already_patched") consola.success(`Already patched with limit ${limit}`);
-		else {
-			consola.error("Failed to patch - pattern not found");
-			consola.info("Claude Code may have been updated to a new version");
-			process.exit(1);
-		}
-	}
-});
 
 //#endregion
-//#region package.json
-var version = "0.11.4";
-
-//#endregion
-//#region src/lib/adaptive-rate-limiter.ts
-const DEFAULT_CONFIG$1 = {
-	baseRetryIntervalSeconds: 10,
-	maxRetryIntervalSeconds: 120,
-	requestIntervalSeconds: 10,
-	recoveryTimeoutMinutes: 10,
-	consecutiveSuccessesForRecovery: 5,
-	gradualRecoverySteps: [
-		5,
-		2,
-		1,
-		0
-	]
+//#region src/lib/history.ts
+function generateId$1() {
+	return Date.now().toString(36) + Math.random().toString(36).slice(2, 9);
+}
+const historyState = {
+	enabled: false,
+	entries: [],
+	sessions: /* @__PURE__ */ new Map(),
+	currentSessionId: "",
+	maxEntries: 1e3,
+	sessionTimeoutMs: 1800 * 1e3
 };
-/**
-* Adaptive rate limiter that switches between normal, rate-limited, and recovering modes
-* based on API responses.
-*/
-var AdaptiveRateLimiter = class {
-	config;
-	mode = "normal";
-	queue = [];
-	processing = false;
-	rateLimitedAt = null;
-	consecutiveSuccesses = 0;
-	lastRequestTime = 0;
-	/** Current step in gradual recovery (index into gradualRecoverySteps) */
-	recoveryStepIndex = 0;
-	constructor(config = {}) {
-		this.config = {
-			...DEFAULT_CONFIG$1,
-			...config
-		};
-	}
-	/**
-	* Execute a request with adaptive rate limiting.
-	* Returns a promise that resolves when the request succeeds.
-	* The request will be retried automatically on 429 errors.
-	*/
-	async execute(fn) {
-		if (this.mode === "normal") return this.executeInNormalMode(fn);
-		if (this.mode === "recovering") return this.executeInRecoveringMode(fn);
-		return this.enqueue(fn);
-	}
-	/**
-	* Check if an error is a rate limit error (429) and extract Retry-After if available
-	*/
-	isRateLimitError(error) {
-		if (error && typeof error === "object") {
-			if ("status" in error && error.status === 429) return {
-				isRateLimit: true,
-				retryAfter: this.extractRetryAfter(error)
-			};
-			if ("responseText" in error && typeof error.responseText === "string") try {
-				const parsed = JSON.parse(error.responseText);
-				if (parsed && typeof parsed === "object" && "error" in parsed && parsed.error && typeof parsed.error === "object" && "code" in parsed.error && parsed.error.code === "rate_limited") return { isRateLimit: true };
-			} catch {}
+const entryIndex = /* @__PURE__ */ new Map();
+function initHistory(enabled, maxEntries) {
+	historyState.enabled = enabled;
+	historyState.maxEntries = maxEntries;
+	historyState.entries = [];
+	historyState.sessions = /* @__PURE__ */ new Map();
+	historyState.currentSessionId = enabled ? generateId$1() : "";
+	entryIndex.clear();
+}
+function isHistoryEnabled() {
+	return historyState.enabled;
+}
+function getCurrentSession(endpoint) {
+	const now = Date.now();
+	if (historyState.currentSessionId) {
+		const session = historyState.sessions.get(historyState.currentSessionId);
+		if (session && now - session.lastActivity < historyState.sessionTimeoutMs) {
+			session.lastActivity = now;
+			return historyState.currentSessionId;
 		}
-		return { isRateLimit: false };
-	}
-	/**
-	* Extract Retry-After value from error response
-	*/
-	extractRetryAfter(error) {
-		if (!error || typeof error !== "object") return void 0;
-		if ("responseText" in error && typeof error.responseText === "string") try {
-			const parsed = JSON.parse(error.responseText);
-			if (parsed && typeof parsed === "object" && "retry_after" in parsed && typeof parsed.retry_after === "number") return parsed.retry_after;
-			if (parsed && typeof parsed === "object" && "error" in parsed && parsed.error && typeof parsed.error === "object" && "retry_after" in parsed.error && typeof parsed.error.retry_after === "number") return parsed.error.retry_after;
-		} catch {}
 	}
-	/**
-	* Execute in normal mode - full speed
-	*/
-	async executeInNormalMode(fn) {
-		try {
-			return {
-				result: await fn(),
-				queueWaitMs: 0
-			};
-		} catch (error) {
-			const { isRateLimit, retryAfter } = this.isRateLimitError(error);
-			if (isRateLimit) {
-				this.enterRateLimitedMode();
-				return this.enqueue(fn, retryAfter);
-			}
-			throw error;
+	const sessionId = generateId$1();
+	historyState.currentSessionId = sessionId;
+	historyState.sessions.set(sessionId, {
+		id: sessionId,
+		startTime: now,
+		lastActivity: now,
+		requestCount: 0,
+		totalInputTokens: 0,
+		totalOutputTokens: 0,
+		models: [],
+		endpoint
+	});
+	return sessionId;
+}
+function recordRequest(endpoint, request) {
+	if (!historyState.enabled) return "";
+	const sessionId = getCurrentSession(endpoint);
+	const session = historyState.sessions.get(sessionId);
+	if (!session) return "";
+	const entry = {
+		id: generateId$1(),
+		sessionId,
+		timestamp: Date.now(),
+		endpoint,
+		request: {
+			model: request.model,
+			messages: request.messages,
+			stream: request.stream,
+			tools: request.tools,
+			max_tokens: request.max_tokens,
+			temperature: request.temperature,
+			system: request.system
 		}
+	};
+	historyState.entries.push(entry);
+	entryIndex.set(entry.id, entry);
+	session.requestCount++;
+	if (!session.models.includes(request.model)) session.models.push(request.model);
+	if (request.tools && request.tools.length > 0) {
+		if (!session.toolsUsed) session.toolsUsed = [];
+		for (const tool of request.tools) if (!session.toolsUsed.includes(tool.name)) session.toolsUsed.push(tool.name);
 	}
-	/**
-	* Execute in recovering mode - gradual speedup
-	*/
-	async executeInRecoveringMode(fn) {
-		const startTime = Date.now();
-		const currentInterval = this.config.gradualRecoverySteps[this.recoveryStepIndex] ?? 0;
-		if (currentInterval > 0) {
-			const elapsedMs = Date.now() - this.lastRequestTime;
-			const requiredMs = currentInterval * 1e3;
-			if (this.lastRequestTime > 0 && elapsedMs < requiredMs) {
-				const waitMs = requiredMs - elapsedMs;
-				await this.sleep(waitMs);
-			}
-		}
-		this.lastRequestTime = Date.now();
-		try {
-			const result = await fn();
-			this.recoveryStepIndex++;
-			if (this.recoveryStepIndex >= this.config.gradualRecoverySteps.length) this.completeRecovery();
-			else {
-				const nextInterval = this.config.gradualRecoverySteps[this.recoveryStepIndex] ?? 0;
-				consola.info(`[RateLimiter] Recovery step ${this.recoveryStepIndex}/${this.config.gradualRecoverySteps.length} (next interval: ${nextInterval}s)`);
-			}
-			return {
-				result,
-				queueWaitMs: Date.now() - startTime
-			};
-		} catch (error) {
-			const { isRateLimit, retryAfter } = this.isRateLimitError(error);
-			if (isRateLimit) {
-				consola.warn("[RateLimiter] Hit rate limit during recovery, returning to rate-limited mode");
-				this.enterRateLimitedMode();
-				return this.enqueue(fn, retryAfter);
-			}
-			throw error;
+	while (historyState.maxEntries > 0 && historyState.entries.length > historyState.maxEntries) {
+		const removed = historyState.entries.shift();
+		if (removed) {
+			entryIndex.delete(removed.id);
+			if (historyState.entries.filter((e) => e.sessionId === removed.sessionId).length === 0) historyState.sessions.delete(removed.sessionId);
 		}
 	}
-	/**
-	* Enter rate-limited mode
-	*/
-	enterRateLimitedMode() {
-		if (this.mode === "rate-limited") return;
-		this.mode = "rate-limited";
-		this.rateLimitedAt = Date.now();
-		this.consecutiveSuccesses = 0;
-		consola.warn(`[RateLimiter] Entering rate-limited mode. Requests will be queued with exponential backoff (base: ${this.config.baseRetryIntervalSeconds}s).`);
-	}
-	/**
-	* Check if we should try to recover to normal mode
-	*/
-	shouldAttemptRecovery() {
-		if (this.consecutiveSuccesses >= this.config.consecutiveSuccessesForRecovery) {
-			consola.info(`[RateLimiter] ${this.consecutiveSuccesses} consecutive successes. Starting gradual recovery.`);
-			return true;
-		}
-		if (this.rateLimitedAt) {
-			if (Date.now() - this.rateLimitedAt >= this.config.recoveryTimeoutMinutes * 60 * 1e3) {
-				consola.info(`[RateLimiter] ${this.config.recoveryTimeoutMinutes} minutes elapsed. Starting gradual recovery.`);
-				return true;
-			}
+	notifyEntryAdded({
+		id: entry.id,
+		endpoint,
+		model: request.model,
+		stream: request.stream,
+		timestamp: entry.timestamp
+	});
+	return entry.id;
+}
+function recordResponse(id, response, durationMs) {
+	if (!historyState.enabled || !id) return;
+	const entry = entryIndex.get(id);
+	if (entry) {
+		entry.response = response;
+		entry.durationMs = durationMs;
+		const session = historyState.sessions.get(entry.sessionId);
+		if (session) {
+			session.totalInputTokens += response.usage.input_tokens;
+			session.totalOutputTokens += response.usage.output_tokens;
+			session.lastActivity = Date.now();
 		}
-		return false;
-	}
-	/**
-	* Start gradual recovery mode
-	*/
-	startGradualRecovery() {
-		this.mode = "recovering";
-		this.recoveryStepIndex = 0;
-		this.rateLimitedAt = null;
-		this.consecutiveSuccesses = 0;
-		const firstInterval = this.config.gradualRecoverySteps[0] ?? 0;
-		consola.info(`[RateLimiter] Starting gradual recovery (${this.config.gradualRecoverySteps.length} steps, first interval: ${firstInterval}s)`);
-	}
-	/**
-	* Complete recovery to normal mode
-	*/
-	completeRecovery() {
-		this.mode = "normal";
-		this.recoveryStepIndex = 0;
-		consola.success("[RateLimiter] Recovery complete. Full speed enabled.");
-	}
-	/**
-	* Enqueue a request for later execution
-	*/
-	enqueue(fn, retryAfterSeconds) {
-		return new Promise((resolve, reject) => {
-			const request = {
-				execute: fn,
-				resolve,
-				reject,
-				retryCount: 0,
-				retryAfterSeconds,
-				enqueuedAt: Date.now()
-			};
-			this.queue.push(request);
-			if (this.queue.length > 1) {
-				const position = this.queue.length;
-				const estimatedWait = (position - 1) * this.config.requestIntervalSeconds;
-				consola.info(`[RateLimiter] Request queued (position ${position}, ~${estimatedWait}s wait)`);
-			}
-			this.processQueue();
+		notifyEntryUpdated({
+			id: entry.id,
+			endpoint: entry.endpoint,
+			model: response.model,
+			success: response.success,
+			durationMs,
+			inputTokens: response.usage.input_tokens,
+			outputTokens: response.usage.output_tokens
+		});
+		notifyStatsUpdated({
+			totalRequests: historyState.entries.length,
+			totalInputTokens: session?.totalInputTokens ?? 0,
+			totalOutputTokens: session?.totalOutputTokens ?? 0
 		});
 	}
-	/**
-	* Calculate retry interval with exponential backoff
-	*/
-	calculateRetryInterval(request) {
-		if (request.retryAfterSeconds !== void 0 && request.retryAfterSeconds > 0) return request.retryAfterSeconds;
-		const backoff = this.config.baseRetryIntervalSeconds * Math.pow(2, request.retryCount);
-		return Math.min(backoff, this.config.maxRetryIntervalSeconds);
-	}
-	/**
-	* Process the queue
-	*/
-	async processQueue() {
-		if (this.processing) return;
-		this.processing = true;
-		while (this.queue.length > 0) {
-			const request = this.queue[0];
-			if (this.shouldAttemptRecovery()) this.startGradualRecovery();
-			const elapsedMs = Date.now() - this.lastRequestTime;
-			const requiredMs = (request.retryCount > 0 ? this.calculateRetryInterval(request) : this.config.requestIntervalSeconds) * 1e3;
-			if (this.lastRequestTime > 0 && elapsedMs < requiredMs) {
-				const waitMs = requiredMs - elapsedMs;
-				const waitSec = Math.ceil(waitMs / 1e3);
-				consola.info(`[RateLimiter] Waiting ${waitSec}s before next request...`);
-				await this.sleep(waitMs);
-			}
-			this.lastRequestTime = Date.now();
-			try {
-				const result = await request.execute();
-				this.queue.shift();
-				this.consecutiveSuccesses++;
-				request.retryAfterSeconds = void 0;
-				const queueWaitMs = Date.now() - request.enqueuedAt;
-				request.resolve({
-					result,
-					queueWaitMs
-				});
-				if (this.mode === "rate-limited") consola.info(`[RateLimiter] Request succeeded (${this.consecutiveSuccesses}/${this.config.consecutiveSuccessesForRecovery} for recovery)`);
-			} catch (error) {
-				const { isRateLimit, retryAfter } = this.isRateLimitError(error);
-				if (isRateLimit) {
-					request.retryCount++;
-					request.retryAfterSeconds = retryAfter;
-					this.consecutiveSuccesses = 0;
-					this.rateLimitedAt = Date.now();
-					const nextInterval = this.calculateRetryInterval(request);
-					const source = retryAfter ? "server Retry-After" : "exponential backoff";
-					consola.warn(`[RateLimiter] Request failed with 429 (retry #${request.retryCount}). Retrying in ${nextInterval}s (${source})...`);
-				} else {
-					this.queue.shift();
-					request.reject(error);
-				}
-			}
-		}
-		this.processing = false;
-	}
-	sleep(ms) {
-		return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function getHistory(options = {}) {
+	const { page = 1, limit = 50, model, endpoint, status, from, to, search, sessionId } = options;
+	let filtered = [...historyState.entries];
+	if (sessionId) filtered = filtered.filter((e) => e.sessionId === sessionId);
+	if (model) {
+		const modelLower = model.toLowerCase();
+		filtered = filtered.filter((e) => e.request.model.toLowerCase().includes(modelLower) || e.response?.model.toLowerCase().includes(modelLower));
 	}
-	/**
-	* Reject all currently queued requests during shutdown.
-	* Returns the number of requests that were rejected.
-	*/
-	rejectQueued() {
-		const count = this.queue.length;
-		for (const request of this.queue) request.reject(/* @__PURE__ */ new Error("Server is shutting down"));
-		this.queue = [];
-		return count;
+	if (endpoint) filtered = filtered.filter((e) => e.endpoint === endpoint);
+	let effectiveStatus = status;
+	const legacySuccess = options.success;
+	if (!effectiveStatus && legacySuccess !== void 0) effectiveStatus = legacySuccess ? "success" : "error";
+	switch (effectiveStatus) {
+		case "success":
+			filtered = filtered.filter((e) => e.response?.success === true);
+			break;
+		case "error":
+			filtered = filtered.filter((e) => e.response !== void 0 && !e.response.success);
+			break;
+		case "pending":
+			filtered = filtered.filter((e) => !e.response);
+			break;
+		default: break;
 	}
-	/**
-	* Get current status for debugging/monitoring
-	*/
-	getStatus() {
-		return {
-			mode: this.mode,
-			queueLength: this.queue.length,
-			consecutiveSuccesses: this.consecutiveSuccesses,
-			rateLimitedAt: this.rateLimitedAt
-		};
+	if (from) filtered = filtered.filter((e) => e.timestamp >= from);
+	if (to) filtered = filtered.filter((e) => e.timestamp <= to);
+	if (search) {
+		const searchLower = search.toLowerCase();
+		filtered = filtered.filter((e) => {
+			const msgMatch = e.request.messages.some((m) => {
+				if (typeof m.content === "string") return m.content.toLowerCase().includes(searchLower);
+				if (Array.isArray(m.content)) return m.content.some((c) => c.text && c.text.toLowerCase().includes(searchLower));
+				return false;
+			});
+			const respMatch = e.response?.content && typeof e.response.content.content === "string" && e.response.content.content.toLowerCase().includes(searchLower);
+			const toolMatch = e.response?.toolCalls?.some((t) => t.name.toLowerCase().includes(searchLower));
+			const sysMatch = e.request.system?.toLowerCase().includes(searchLower);
+			return msgMatch || respMatch || toolMatch || sysMatch;
+		});
 	}
-};
-let rateLimiterInstance = null;
-/**
-* Initialize the adaptive rate limiter with configuration
-*/
-function initAdaptiveRateLimiter(config = {}) {
-	rateLimiterInstance = new AdaptiveRateLimiter(config);
-	const baseRetry = config.baseRetryIntervalSeconds ?? DEFAULT_CONFIG$1.baseRetryIntervalSeconds;
-	const maxRetry = config.maxRetryIntervalSeconds ?? DEFAULT_CONFIG$1.maxRetryIntervalSeconds;
-	const interval = config.requestIntervalSeconds ?? DEFAULT_CONFIG$1.requestIntervalSeconds;
-	const recovery = config.recoveryTimeoutMinutes ?? DEFAULT_CONFIG$1.recoveryTimeoutMinutes;
-	const successes = config.consecutiveSuccessesForRecovery ?? DEFAULT_CONFIG$1.consecutiveSuccessesForRecovery;
-	const steps = config.gradualRecoverySteps ?? DEFAULT_CONFIG$1.gradualRecoverySteps;
-	consola.info(`[RateLimiter] Initialized (backoff: ${baseRetry}s-${maxRetry}s, interval: ${interval}s, recovery: ${recovery}min or ${successes} successes, gradual: [${steps.join("s, ")}s])`);
+	filtered.sort((a, b) => b.timestamp - a.timestamp);
+	const total = filtered.length;
+	const totalPages = Math.ceil(total / limit);
+	const start = (page - 1) * limit;
+	return {
+		entries: filtered.slice(start, start + limit),
+		total,
+		page,
+		limit,
+		totalPages
+	};
 }
-/**
-* Get the rate limiter instance
-*/
-function getAdaptiveRateLimiter() {
-	return rateLimiterInstance;
+function getEntry(id) {
+	return entryIndex.get(id);
 }
-/**
-* Execute a request with adaptive rate limiting.
-* If rate limiter is not initialized, executes immediately.
-* Returns the result along with queue wait time.
-*/
-async function executeWithAdaptiveRateLimit(fn) {
-	if (!rateLimiterInstance) return {
-		result: await fn(),
-		queueWaitMs: 0
+function getSessions() {
+	const sessions = Array.from(historyState.sessions.values()).sort((a, b) => b.lastActivity - a.lastActivity);
+	return {
+		sessions,
+		total: sessions.length
 	};
-	return rateLimiterInstance.execute(fn);
 }
-
-//#endregion
-//#region src/lib/auth-gate.ts
-/**
-* Auth gate — the inbound authentication decision point for the proxy.
-*
-* Protects this proxy's *inbound* surface with a configured **Proxy API key**
-* (NOT the outbound GitHub OAuth token or Copilot token). The decision logic
-* is expressed as pure functions so it can be unit-tested without booting the
-* server or reaching upstream.
-*/
-/**
-* Extract candidate presented credential values from request headers.
-*
-* Two header shapes are read, and **both** contribute candidates when present
-* (compare-all-present) so neither is silently ignored in favor of the other —
-* a later any-match over the candidates decides acceptance:
-*  - `Authorization`: the scheme prefix is stripped case-insensitively
-*    (`Bearer ` / `bearer ` …) because the scheme is case-insensitive per
-*    RFC 7235, while the secret itself is case-sensitive. A bare value with no
-*    scheme prefix is tolerated and returned verbatim.
-*  - `x-api-key` (Issue 02): the Anthropic-native header. Taken verbatim — no
-*    scheme stripping (a value that happens to start with `Bearer ` is kept
-*    as-is).
-*
-* Order is `[Authorization, x-api-key]` for any present header; absent headers
-* contribute nothing.
-*/
-function extractCredentials(headers) {
-	const candidates = [];
-	const authorization = headers.get("authorization");
-	if (authorization !== null) candidates.push(authorization.replace(/^Bearer\s+/i, ""));
-	const apiKey = headers.get("x-api-key");
-	if (apiKey !== null) candidates.push(apiKey);
-	return candidates;
+function getSession(id) {
+	return historyState.sessions.get(id);
 }
-/**
-* Hard-coded exemption set: the liveness (`/`) and readiness (`/health`)
-* endpoints are reachable without a key so container orchestration probes are
-* never blocked. Everything else is protected (fail-closed) — unknown / future
-* routes default to protected.
-*
-* Matching is by **exact path**, with a trailing slash tolerated (so `/health/`
-* is exempt too) and `/` itself handled explicitly. Prefix matching is
-* deliberately avoided: `/healthz` or `/health/extra` must NOT be exempt. The
-* server registers a matching `/health/` route, so an exempt `/health/` request
-* resolves to the readiness handler rather than 404ing.
-*/
-function isExemptPath(path) {
-	if (path === "/") return true;
-	return (path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path) === "/health";
+function getSessionEntries(sessionId) {
+	return historyState.entries.filter((e) => e.sessionId === sessionId).sort((a, b) => a.timestamp - b.timestamp);
 }
-/**
-* Compute the fixed-length sha256 digest (32 bytes) of the configured key.
-* The configured key is trimmed before hashing (config-side trim).
-*/
-function digestConfiguredKey(configuredKey) {
-	return createHash("sha256").update(configuredKey.trim()).digest();
+function clearHistory() {
+	historyState.entries = [];
+	historyState.sessions = /* @__PURE__ */ new Map();
+	historyState.currentSessionId = generateId$1();
+	entryIndex.clear();
+	notifyHistoryCleared();
 }
-/**
-* Constant-time membership test: does any presented candidate match the
-* configured key?
-*
-* Each candidate is sha256'd to a fixed 32-byte digest and compared against the
-* configured digest. Hashing to a fixed length sidesteps the `RangeError` that
-* `crypto.timingSafeEqual` throws on length-mismatched buffers, so a
-* wrong-length presented value yields `false` rather than throwing.
-*/
-function matchesConfiguredKey(configuredDigest, candidates) {
-	return candidates.some((candidate) => {
-		return timingSafeEqual(createHash("sha256").update(candidate).digest(), configuredDigest);
-	});
+function deleteSession(sessionId) {
+	if (!historyState.sessions.has(sessionId)) return false;
+	const removedEntries = historyState.entries.filter((e) => e.sessionId === sessionId);
+	historyState.entries = historyState.entries.filter((e) => e.sessionId !== sessionId);
+	for (const e of removedEntries) entryIndex.delete(e.id);
+	historyState.sessions.delete(sessionId);
+	if (historyState.currentSessionId === sessionId) historyState.currentSessionId = generateId$1();
+	notifySessionDeleted(sessionId);
+	return true;
 }
-/**
-* Resolve the inbound Proxy API key from its two operator-facing sources,
-* applying the precedence + normalization contract (Issue 03):
-*
-*  - `--api-key` flag (`flag`) and `COPILOT_API_KEY` env (`env`) are each
-*    **trimmed first**; a trimmed-empty source (`""`, whitespace, or
-*    `undefined`) counts as **not provided**.
-*  - When both provide a non-empty value, the **flag wins** (env ignored).
-*  - When only one provides a non-empty value, that one is used.
-*  - When neither does, `key` is `undefined` and `source` is `"none"` → auth
-*    stays disabled (same as the no-`--api-key` default).
-*
-* Pure: it reads nothing from `process.env` itself (the caller passes the env
-* value in), so it is fully unit-testable and the precedence logic is decoupled
-* from how the values are sourced.
-*/
-function resolveProxyApiKey(sources) {
-	const flag = sources.flag?.trim() ?? "";
-	if (flag !== "") return {
-		key: flag,
-		source: "flag"
-	};
-	const env = sources.env?.trim() ?? "";
-	if (env !== "") return {
-		key: env,
-		source: "env"
+function getStats() {
+	const entries = historyState.entries;
+	const modelDist = {};
+	const endpointDist = {};
+	const hourlyActivity = {};
+	let totalInput = 0;
+	let totalOutput = 0;
+	let totalDuration = 0;
+	let durationCount = 0;
+	let successCount = 0;
+	let failCount = 0;
+	for (const entry of entries) {
+		const model = entry.response?.model || entry.request.model;
+		modelDist[model] = (modelDist[model] || 0) + 1;
+		endpointDist[entry.endpoint] = (endpointDist[entry.endpoint] || 0) + 1;
+		const hour = new Date(entry.timestamp).toISOString().slice(0, 13);
+		hourlyActivity[hour] = (hourlyActivity[hour] || 0) + 1;
+		if (entry.response) {
+			if (entry.response.success) successCount++;
+			else failCount++;
+			totalInput += entry.response.usage.input_tokens;
+			totalOutput += entry.response.usage.output_tokens;
+		}
+		if (entry.durationMs) {
+			totalDuration += entry.durationMs;
+			durationCount++;
+		}
+	}
+	const recentActivity = Object.entries(hourlyActivity).sort(([a], [b]) => a.localeCompare(b)).slice(-24).map(([hour, count]) => ({
+		hour,
+		count
+	}));
+	const now = Date.now();
+	let activeSessions = 0;
+	for (const session of historyState.sessions.values()) if (now - session.lastActivity < historyState.sessionTimeoutMs) activeSessions++;
+	return {
+		totalRequests: entries.length,
+		successfulRequests: successCount,
+		failedRequests: failCount,
+		totalInputTokens: totalInput,
+		totalOutputTokens: totalOutput,
+		averageDurationMs: durationCount > 0 ? totalDuration / durationCount : 0,
+		modelDistribution: modelDist,
+		endpointDistribution: endpointDist,
+		recentActivity,
+		activeSessions
 	};
+}
+function getTokenStats() {
+	const models = {};
+	const timeline = [];
+	for (const entry of historyState.entries) {
+		if (!entry.response) continue;
+		const model = entry.response.model || entry.request.model;
+		const inputTokens = entry.response.usage.input_tokens;
+		const outputTokens = entry.response.usage.output_tokens;
+		const existing = models[model];
+		if (existing) {
+			existing.inputTokens += inputTokens;
+			existing.outputTokens += outputTokens;
+			existing.requestCount++;
+		} else models[model] = {
+			inputTokens,
+			outputTokens,
+			requestCount: 1
+		};
+		timeline.push({
+			timestamp: entry.timestamp,
+			model,
+			inputTokens,
+			outputTokens
+		});
+	}
+	timeline.sort((a, b) => a.timestamp - b.timestamp);
 	return {
-		key: void 0,
-		source: "none"
+		models,
+		timeline
 	};
 }
+function getHistoryEntryCount() {
+	return historyState.entries.length;
+}
+function getHistoryMaxEntries() {
+	return historyState.maxEntries;
+}
+function setHistoryMaxEntries(max) {
+	historyState.maxEntries = max;
+}
 /**
-* Resolve the hostname the server will *actually* bind to, decided at the CLI
-* edge with flag-over-env precedence and a **safe loopback default** — the same
-* flag-over-env shape this codebase already uses to reconcile a CLI flag with
-* its env twin (`--api-key`/`COPILOT_API_KEY`, `--github-token`/`GH_TOKEN`).
-*
-*  - `--host` flag wins when present; otherwise the `HOST` env; otherwise the
-*    default `127.0.0.1`.
-*  - The default is **loopback, not all-interfaces**: an unconfigured instance
-*    must not expose `/token` (which echoes the plaintext Copilot token) and the
-*    otherwise-unauthenticated API to the whole network. Binding every interface
-*    is now an explicit opt-in — pass `--host 0.0.0.0` (or `HOST=0.0.0.0`).
-*  - **flag vs env asymmetry on a blank value** (the security-critical part): an
-*    explicit `--host` flag is the operator's deliberate choice, so a blank flag
-*    (`--host ""` / whitespace) is taken as the wildcard-bind escape hatch and
-*    canonicalized to an explicit `0.0.0.0` (rather than left as `""` to lean on
-*    srvx's undocumented empty-string handling). But a *set-but-blank* `HOST` env
-*    (`HOST=`, or `HOST=$UNSET` in a shell / compose where the var is unset →
-*    empty — NOT a deliberate keystroke) is accidental plumbing, so it is treated
-*    as **not provided** and falls through to the loopback default. This mirrors
-*    `resolveProxyApiKey` trimming `""` to not-provided, so an empty `HOST` can't
-*    silently reopen the all-interfaces-unauthenticated exposure the loopback
-*    default exists to prevent.
-*  - **Both sources are trimmed**: a padded `--host " 10.0.0.5 "` or
-*    `HOST=" 10.0.0.5 "` would otherwise reach the socket bind verbatim and fail
-*    with `ENOTFOUND`. Trimming also decides blank-ness for the rules above.
-*
-* `env` is passed in (not read here) to keep the function pure and unit-testable.
+* Evict the oldest `count` entries from the history store.
+* Returns the actual number of entries evicted.
 */
-function resolveBindHost(flag, env) {
-	if (flag !== void 0) {
-		const trimmed = flag.trim();
-		return trimmed === "" ? "0.0.0.0" : trimmed;
-	}
-	const envTrimmed = env?.trim() ?? "";
-	if (envTrimmed !== "") return envTrimmed;
-	return "127.0.0.1";
+function evictOldestEntries(count) {
+	if (count <= 0) return 0;
+	const actual = Math.min(count, historyState.entries.length);
+	const removed = historyState.entries.splice(0, actual);
+	for (const e of removed) entryIndex.delete(e.id);
+	for (const entry of removed) if (!historyState.entries.some((e) => e.sessionId === entry.sessionId)) historyState.sessions.delete(entry.sessionId);
+	return actual;
 }
-/**
-* Resolve the address the server will *actually* bind to for the startup banner
-* (Issue 04).
-*
-* Mirrors srvx's own host resolution EXACTLY so the banner reports the TRUE bind
-* rather than a guess that could diverge from what srvx passes to the runtime.
-* srvx computes `hostname = opts.hostname ?? process.env.HOST` (a raw nullish
-* coalesce — no trimming, no empty-string special-casing), and start.ts passes
-* `hostname: options.host`. So:
-*   - an explicit `--host` (even `""` / whitespace) is what srvx uses verbatim —
-*     it does NOT fall back to HOST once `opts.hostname` is a non-null string;
-*   - only an absent (`undefined`) `--host` lets srvx fall back to `HOST`;
-*   - when the coalesced value is `undefined` or empty, the runtime binds all
-*     interfaces, which we report as the explicit `0.0.0.0` so a wide-open bind
-*     is unmistakable (srvx renders the same bind as "localhost (all
-*     interfaces)").
-*
-* Critically, the resolved non-empty value is returned VERBATIM (not trimmed):
-* srvx hands the runtime exactly that string, so the banner must report exactly
-* that string — trimming here would make the banner claim a different address
-* than the one actually bound. `env` is passed in (not read) to keep the
-* function pure and unit-testable.
-*/
-function resolveBindAddress(host, env) {
-	const resolved = host ?? env;
-	if (resolved === void 0 || resolved === "") return "0.0.0.0";
-	return resolved;
+function exportHistory(format = "json") {
+	if (format === "json") return JSON.stringify({
+		sessions: Array.from(historyState.sessions.values()),
+		entries: historyState.entries
+	}, null, 2);
+	const headers = [
+		"id",
+		"session_id",
+		"timestamp",
+		"endpoint",
+		"request_model",
+		"message_count",
+		"stream",
+		"success",
+		"response_model",
+		"input_tokens",
+		"output_tokens",
+		"duration_ms",
+		"stop_reason",
+		"error"
+	];
+	const rows = historyState.entries.map((e) => [
+		e.id,
+		e.sessionId,
+		new Date(e.timestamp).toISOString(),
+		e.endpoint,
+		e.request.model,
+		e.request.messages.length,
+		e.request.stream,
+		e.response?.success ?? "",
+		e.response?.model ?? "",
+		e.response?.usage.input_tokens ?? "",
+		e.response?.usage.output_tokens ?? "",
+		e.durationMs ?? "",
+		e.response?.stop_reason ?? "",
+		e.response?.error ?? ""
+	]);
+	return [headers.join(","), ...rows.map((r) => r.join(","))].join("\n");
 }
+
+//#endregion
+//#region src/lib/history-memory-pressure.ts
 /**
-* Resolve the CLIENT-FACING host for generated configs and viewer links
-* (Issue 04), derived from the SAME srvx host resolution as the banner so the
-* two never disagree about what was bound — and formatted as a valid URL
-* authority so the links actually parse.
-*
-* Two differences from {@link resolveBindAddress}:
-*  - All-interfaces rendering: a wildcard bind (`0.0.0.0` / `::` / `[::]` /
-*    empty) is not a connectable target, so it maps to `localhost` for URLs a
-*    client will actually dial (matching srvx's "localhost (all interfaces)"
-*    presentation). A narrowed bind (e.g. `127.0.0.1`, `192.168.1.10`, an IPv6
-*    address) is kept so generated links point at the real interface — fixing
-*    the prior bug where setting `HOST` (with `--host` omitted) yielded
-*    `http://localhost:<port>` links the narrowed bind wasn't listening on.
-*  - IPv6 bracketing: a literal IPv6 host (contains `:`) is wrapped in `[...]`,
-*    exactly as srvx's own `fmtURL` does, so `http://[2001:db8::1]:<port>` is a
-*    valid authority rather than the unparseable `http://2001:db8::1:<port>`.
+* Memory pressure monitor — proactively evicts old history entries
+* when heap usage approaches the V8 heap limit, preventing OOM crashes.
 *
-* Returns a host token ready to drop into `http://<token>:<port>`.
+* Graduated response:
+*   75–80%  Warning: log only, no eviction
+*   80–90%  High: evict entries, reduce maxEntries by 25%
+*   90%+    Critical: aggressive eviction, reduce maxEntries by 50%
 */
-function resolveClientHost(host, env) {
-	const bind = resolveBindAddress(host, env);
-	if (bind === "0.0.0.0" || bind === "::" || bind === "[::]") return "localhost";
-	if (bind.includes(":") && !bind.startsWith("[")) return `[${bind}]`;
-	return bind;
+const CHECK_INTERVAL_MS = 3e4;
+const WARN_THRESHOLD = .75;
+const EVICT_THRESHOLD = .8;
+const CRITICAL_THRESHOLD = .9;
+const WARN_LOG_COOLDOWN_MS = 3e5;
+let resolvedHeapLimit = null;
+let timer = null;
+let lastWarningTime = 0;
+let totalEvictedCount = 0;
+async function resolveHeapLimit() {
+	if (resolvedHeapLimit !== null) return resolvedHeapLimit;
+	let limit;
+	try {
+		limit = (await import("node:v8")).getHeapStatistics().heap_size_limit;
+	} catch {
+		limit = 512 * 1024 * 1024;
+	}
+	resolvedHeapLimit = limit;
+	return limit;
 }
-/**
-* Build the inbound-auth startup banner lines (Issue 04).
-*
-* Returns the human-readable lines the proxy prints at boot so operators can see,
-* at a glance, the security posture of *this* instance:
-*  - auth ON  → `认证开启`, plus the key's origin (`flag` / `env`), plus the real
-*    bind address.
-*  - auth OFF → `认证关闭`, plus the real bind address (so a careless all-
-*    interfaces bind without auth is visible).
-*
-* The configured key value is **never** an input here, so it can never leak into
-* the banner — the function only knows the *source* tag, not the secret. Pure
-* (string in → strings out) so the banner copy is pinned by unit tests.
-*/
-function buildStartupAuthLines(params) {
-	const { source, bindAddress } = params;
-	return [source === "none" ? `Inbound auth: 认证关闭 (no proxy API key configured)` : `Inbound auth: 认证开启 (source: ${source})`, `Binding to: ${bindAddress}`];
+function formatMB(bytes) {
+	return `${Math.round(bytes / 1024 / 1024)}MB`;
 }
-/**
-* The env var Claude Code reads for its inbound credential, and the placeholder
-* value the `--claude-code` setup always embeds for it. Exported so the
-* generated env script (src/start.ts) and the auth hint below reference the SAME
-* literals — changing the placeholder or the var name in one place can't silently
-* desync the other (the hint would otherwise keep naming a string the generated
-* command no longer contains).
-*/
-const CLAUDE_CODE_AUTH_TOKEN_ENV = "ANTHROPIC_AUTH_TOKEN";
-const CLAUDE_CODE_AUTH_TOKEN_PLACEHOLDER = "dummy";
-/**
-* Build the auth-aware hint lines for the `--claude-code` setup (Issue 05).
-*
-* The generated env script ALWAYS sets `ANTHROPIC_AUTH_TOKEN="dummy"` — a real
-* key is deliberately never embedded, so the secret can't land in the clipboard
-* or shell history. When inbound auth is ON, that placeholder won't authenticate
-* against this proxy, so the operator must replace it. This builder returns the
-* visible hint that tells them which variable to change:
-*  - auth OFF (`source === "none"`) → no hint (today's behavior, unchanged).
-*  - auth ON  (`flag` / `env`)      → a one-line hint naming
-*    `ANTHROPIC_AUTH_TOKEN` as the field to set to the proxy API key value.
-*
-* Like {@link buildStartupAuthLines}, the key value is **never** an input here —
-* the builder only knows the `source` tag — so it is structurally impossible for
-* the secret to leak into the hint. Pure (tag in → strings out) so the copy is
-* pinned by unit tests.
-*/
-function buildClaudeCodeAuthHint(source) {
-	if (source === "none") return [];
-	return [`Inbound auth is ON: replace ${CLAUDE_CODE_AUTH_TOKEN_ENV}="${CLAUDE_CODE_AUTH_TOKEN_PLACEHOLDER}" with your proxy API key value before using Claude Code.`];
+function formatPct(ratio) {
+	return `${Math.round(ratio * 100)}%`;
 }
-/**
-* Configure the proxy API key on global state from a raw configured value.
-*
-* The value is trimmed; a trimmed-empty value (or `undefined`) is treated as
-* "not provided" → auth stays disabled. Otherwise the precomputed digest is
-* stored on state (presence === enabled). Returns whether auth is enabled.
-*
-* The `--api-key` flag and `COPILOT_API_KEY` env source are reconciled upstream
-* by `resolveProxyApiKey` (flag-over-env precedence, Issue 03); this function
-* receives only the already-resolved value.
-*/
-function configureProxyApiKey(rawKey) {
-	const trimmed = rawKey?.trim() ?? "";
-	if (trimmed === "") {
-		state.proxyApiKeyDigest = void 0;
-		return false;
+async function checkMemoryPressure() {
+	const heapLimit = await resolveHeapLimit();
+	const { heapUsed } = process.memoryUsage();
+	const ratio = heapUsed / heapLimit;
+	if (ratio < WARN_THRESHOLD) return;
+	const currentEntries = getHistoryEntryCount();
+	if (currentEntries <= state.historyMinEntries) {
+		if (ratio >= EVICT_THRESHOLD && Date.now() - lastWarningTime > WARN_LOG_COOLDOWN_MS) {
+			lastWarningTime = Date.now();
+			consola.warn(`[memory] Heap ${formatMB(heapUsed)}/${formatMB(heapLimit)} (${formatPct(ratio)}) — only ${currentEntries} history entries remain. Consider increasing --max-old-space-size`);
+		}
+		return;
 	}
-	state.proxyApiKeyDigest = digestConfiguredKey(trimmed);
-	return true;
+	if (ratio < EVICT_THRESHOLD) {
+		if (Date.now() - lastWarningTime > WARN_LOG_COOLDOWN_MS) {
+			lastWarningTime = Date.now();
+			consola.warn(`[memory] Heap ${formatMB(heapUsed)}/${formatMB(heapLimit)} (${formatPct(ratio)}) — approaching limit, ${currentEntries} history entries in memory`);
+		}
+		return;
+	}
+	lastWarningTime = Date.now();
+	const currentMax = getHistoryMaxEntries();
+	const newMaxEntries = ratio >= CRITICAL_THRESHOLD ? Math.max(state.historyMinEntries, Math.floor(currentMax * .5)) : Math.max(state.historyMinEntries, Math.floor(currentMax * .75));
+	const evictCount = Math.max(0, currentEntries - newMaxEntries);
+	if (evictCount <= 0) return;
+	const evicted = evictOldestEntries(evictCount);
+	totalEvictedCount += evicted;
+	if (newMaxEntries < currentMax) setHistoryMaxEntries(newMaxEntries);
+	const afterHeapUsed = process.memoryUsage().heapUsed;
+	consola.warn(`[memory] Evicted ${evicted} history entries due to memory pressure (heap: ${formatMB(heapUsed)} → ${formatMB(afterHeapUsed)}/${formatMB(heapLimit)}, entries: ${currentEntries} → ${currentEntries - evicted}, max: ${newMaxEntries})`);
+	globalThis.gc?.();
 }
-/**
-* Path → auth-family selector (Issue 02).
-*
-* The Anthropic-native surface is `/v1/messages` and its `count_tokens`
-* subpath; both map to the Anthropic family so a native Anthropic client gets
-* the `authentication_error` body. Everything else — including every other
-* `/v1/…` endpoint and any unknown / future route — defaults to the OpenAI
-* family.
-*
-* Matching is by **exact path** (a trailing slash tolerated), deliberately not
-* a prefix test: the shared `/v1/` prefix must not sweep OpenAI-style endpoints
-* into the Anthropic family, and `/v1/messages-extra` or a deeper unexpected
-* subpath must not be misclassified either. This mirrors `isExemptPath`'s
-* exact-with-trailing-slash convention.
-*/
-function selectFamily(path) {
-	const normalized = path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
-	if (normalized === "/v1/messages" || normalized === "/v1/messages/count_tokens") return "anthropic";
-	return "openai";
+function startMemoryPressureMonitor() {
+	if (timer) return;
+	timer = setInterval(() => {
+		checkMemoryPressure().catch((error) => {
+			consola.error("[memory] Error in memory pressure check:", error);
+		});
+	}, CHECK_INTERVAL_MS);
+	if ("unref" in timer) timer.unref();
 }
-/**
-* OpenAI-family 401 response body. The literal field values are pinned by the
-* ADR so OpenAI-compatible SDKs recognize the failure as an auth error. The
-* same body is returned whether credentials were missing or wrong (no oracle).
-*/
-function unauthorizedOpenAIBody() {
-	return { error: {
-		message: "Invalid API key provided.",
-		type: "invalid_request_error",
-		code: "invalid_api_key",
-		param: null
-	} };
-}
-/**
-* Anthropic-family 401 response body (Issue 02). Shape is pinned so Anthropic
-* SDKs (and Claude Code via `/v1/messages`) recognize the failure as an auth
-* error: a top-level `{type:"error", error:{type:"authentication_error",
-* message}}`. As with the OpenAI body, missing and wrong credentials return the
-* identical body (no oracle).
-*/
-function unauthorizedAnthropicBody() {
-	return {
-		type: "error",
-		error: {
-			type: "authentication_error",
-			message: "Invalid API key provided."
-		}
-	};
-}
-/**
-* Global fail-closed authentication middleware.
-*
-* Registered after the request logger and CORS but before route dispatch.
-* Behavior:
-*  - Disabled (no configured digest) → pass through unchanged (default).
-*  - Exempt path (`/`, `/health`) → pass through.
-*  - CORS preflight `OPTIONS` on a protected path → pass through so browser
-*    preflight isn't mistaken for a 401 (blocking it surfaces as an opaque CORS
-*    error, very hard to diagnose). Scoped to *actual* preflights — an
-*    `OPTIONS` carrying `Access-Control-Request-Method` — rather than any
-*    `OPTIONS`, so the bypass surface can't silently widen. Preflights carry no
-*    protected payload, so this doesn't weaken fail-closed.
-*  - Otherwise require a valid Proxy API key; on failure return 401 with a
-*    `WWW-Authenticate: Bearer` header and a **family-appropriate** body —
-*    Anthropic-family (`/v1/messages*`) gets the `authentication_error` shape,
-*    everything else the OpenAI `invalid_api_key` shape (Issue 02). The family
-*    only selects the body shape; it does not change what is protected. Missing
-*    and wrong credentials return the field-identical body for that family.
-*/
-function authGate() {
-	return async (c, next) => {
-		const configuredDigest = state.proxyApiKeyDigest;
-		if (!configuredDigest) return next();
-		if (isExemptPath(c.req.path)) return next();
-		if (c.req.method === "OPTIONS" && c.req.raw.headers.get("access-control-request-method") !== null) return next();
-		if (matchesConfiguredKey(configuredDigest, extractCredentials(c.req.raw.headers))) return next();
-		c.header("WWW-Authenticate", "Bearer");
-		if (selectFamily(c.req.path) === "anthropic") return c.json(unauthorizedAnthropicBody(), 401);
-		return c.json(unauthorizedOpenAIBody(), 401);
-	};
+function stopMemoryPressureMonitor() {
+	if (timer) {
+		clearInterval(timer);
+		timer = null;
+	}
 }
 
 //#endregion
-//#region src/lib/context/request.ts
-let idCounter = 0;
-function createRequestContext(opts) {
-	const id = `req_${Date.now()}_${++idCounter}`;
-	const startTime = Date.now();
-	const onEvent = opts.onEvent;
-	let _state = "pending";
-	let _originalRequest = null;
-	let _response = null;
-	let settled = false;
-	function emit(event) {
-		try {
-			onEvent(event);
-		} catch {}
+//#region src/lib/posthog.ts
+let client = null;
+let distinctId = "";
+function initPostHog(apiKey) {
+	if (!apiKey) return;
+	try {
+		client = new PostHog(apiKey, {
+			host: "https://us.i.posthog.com",
+			flushAt: 20,
+			flushInterval: 1e4
+		});
+		distinctId = createHash("sha256").update(os.hostname() + os.userInfo().username).digest("hex");
+	} catch (error) {
+		consola.warn("Failed to initialize PostHog:", error instanceof Error ? error.message : error);
+		client = null;
 	}
-	const ctx = {
-		id,
-		tuiLogId: opts.tuiLogId,
-		startTime,
-		endpoint: opts.endpoint,
-		get state() {
-			return _state;
-		},
-		get durationMs() {
-			return Date.now() - startTime;
-		},
-		get settled() {
-			return settled;
-		},
-		get originalRequest() {
-			return _originalRequest;
-		},
-		get response() {
-			return _response;
-		},
-		setOriginalRequest(req) {
-			_originalRequest = req;
-			emit({
-				type: "updated",
-				context: ctx,
-				field: "originalRequest"
-			});
-		},
-		transition(newState) {
-			const previousState = _state;
-			_state = newState;
-			emit({
-				type: "state_changed",
-				context: ctx,
-				previousState
-			});
-		},
-		complete(response) {
-			if (settled) return;
-			settled = true;
-			_response = response;
-			_state = "completed";
-			emit({
-				type: "completed",
-				context: ctx,
-				entry: ctx.toHistoryEntry()
-			});
-		},
-		fail(model, error) {
-			if (settled) return;
-			settled = true;
-			_response = {
-				success: false,
-				model,
-				usage: {
-					input_tokens: 0,
-					output_tokens: 0
-				},
-				error: error instanceof Error ? error.message : String(error),
-				content: null
-			};
-			_state = "failed";
-			emit({
-				type: "failed",
-				context: ctx,
-				entry: ctx.toHistoryEntry()
-			});
-		},
-		toHistoryEntry() {
-			const entry = {
-				id,
-				endpoint: opts.endpoint,
-				timestamp: startTime,
-				durationMs: Date.now() - startTime,
-				request: {
-					model: _originalRequest?.model,
-					messages: _originalRequest?.messages,
-					stream: _originalRequest?.stream,
-					tools: _originalRequest?.tools,
-					system: _originalRequest?.system
-				}
-			};
-			if (_response) entry.response = _response;
-			return entry;
-		}
+}
+function isPostHogEnabled() {
+	return client !== null;
+}
+function captureRequest(params) {
+	if (!client) return;
+	const properties = {
+		model: params.model,
+		input_tokens: params.inputTokens,
+		output_tokens: params.outputTokens,
+		duration_ms: params.durationMs,
+		success: params.success,
+		stream: params.stream,
+		tool_count: params.toolCount
 	};
-	return ctx;
+	if (params.reasoningTokens !== void 0) properties.reasoning_tokens = params.reasoningTokens;
+	if (params.stopReason !== void 0) properties.stop_reason = params.stopReason;
+	if (params.status !== void 0) properties.status = params.status;
+	if (params.copilotErrorCode !== void 0) properties.copilot_error_code = params.copilotErrorCode;
+	if (params.errorPhase !== void 0) properties.error_phase = params.errorPhase;
+	if (params.endpoint !== void 0) properties.endpoint = params.endpoint;
+	if (params.attempt !== void 0) properties.attempt = params.attempt;
+	if (params.errorName !== void 0) properties.error_name = params.errorName;
+	if (params.errorCode !== void 0) properties.error_code = params.errorCode;
+	if (params.causeName !== void 0) properties.cause_name = params.causeName;
+	if (params.causeCode !== void 0) properties.cause_code = params.causeCode;
+	if (params.errorMessage !== void 0) properties.error_message = params.errorMessage;
+	client.capture({
+		distinctId,
+		event: "copilot_api_request",
+		properties
+	});
+}
+async function shutdownPostHog() {
+	if (!client) return;
+	try {
+		await client.shutdown();
+	} catch (error) {
+		consola.warn("Failed to flush PostHog events:", error instanceof Error ? error.message : error);
+	}
 }
 
 //#endregion
-//#region src/lib/context/manager.ts
-/**
-* RequestContextManager — Active request management
-*
-* Manages all in-flight RequestContext instances. Publishes events for
-* WebSocket push and history persistence.
-*/
-let _manager = null;
-function initRequestContextManager(staleMaxAgeSec) {
-	_manager = createRequestContextManager(staleMaxAgeSec);
-	return _manager;
+//#region src/lib/shutdown.ts
+const DRAIN_POLL_INTERVAL_MS = 500;
+const DRAIN_PROGRESS_INTERVAL_MS = 5e3;
+let serverInstance = null;
+let _isShuttingDown = false;
+let shutdownResolve = null;
+let shutdownAbortController = null;
+function getIsShuttingDown() {
+	return _isShuttingDown;
 }
-const REAPER_INTERVAL_MS = 6e4;
-const DEFAULT_STALE_MAX_AGE_SEC = 600;
-function createRequestContextManager(staleMaxAgeSec) {
-	const maxAgeSec = staleMaxAgeSec ?? DEFAULT_STALE_MAX_AGE_SEC;
-	const activeContexts = /* @__PURE__ */ new Map();
-	const listeners = /* @__PURE__ */ new Set();
-	let reaperTimer = null;
-	function runReaperOnce() {
-		if (maxAgeSec <= 0) return;
-		const maxAgeMs = maxAgeSec * 1e3;
-		for (const [id, ctx] of activeContexts) if (ctx.durationMs > maxAgeMs) {
-			consola.warn(`[context] Force-failing stale request ${id} (endpoint: ${ctx.endpoint}, model: ${ctx.originalRequest?.model ?? "unknown"}, state: ${ctx.state}, age: ${Math.round(ctx.durationMs / 1e3)}s, max: ${maxAgeSec}s)`);
-			ctx.fail(ctx.originalRequest?.model ?? "unknown", /* @__PURE__ */ new Error(`Request exceeded maximum age of ${maxAgeSec}s (stale context reaper)`));
+function setServerInstance(server) {
+	serverInstance = server;
+}
+function formatActiveRequestsSummary(requests) {
+	const now = Date.now();
+	const lines = requests.map((req) => {
+		const age = Math.round((now - req.startTime) / 1e3);
+		const model = req.model || "unknown";
+		const tags = req.tags?.length ? ` [${req.tags.join(", ")}]` : "";
+		return `  ${req.method} ${req.path} ${model} (${req.status}, ${age}s)${tags}`;
+	});
+	return `Waiting for ${requests.length} active request(s):\n${lines.join("\n")}`;
+}
+async function drainActiveRequests(timeoutMs, tracker, opts) {
+	const pollInterval = opts?.pollIntervalMs ?? DRAIN_POLL_INTERVAL_MS;
+	const progressInterval = opts?.progressIntervalMs ?? DRAIN_PROGRESS_INTERVAL_MS;
+	const deadline = Date.now() + timeoutMs;
+	let lastProgressLog = 0;
+	while (Date.now() < deadline) {
+		const active = tracker.getActiveRequests();
+		if (active.length === 0) return "drained";
+		const now = Date.now();
+		if (now - lastProgressLog >= progressInterval) {
+			lastProgressLog = now;
+			consola.info(formatActiveRequestsSummary(active));
 		}
+		await new Promise((resolve) => setTimeout(resolve, pollInterval));
 	}
-	function startReaper() {
-		if (reaperTimer) return;
-		reaperTimer = setInterval(runReaperOnce, REAPER_INTERVAL_MS);
+	return "timeout";
+}
+async function gracefulShutdown(signal, deps) {
+	const tracker = deps?.tracker;
+	const server = deps?.server ?? serverInstance;
+	const rateLimiter = deps?.rateLimiter !== void 0 ? deps.rateLimiter : getAdaptiveRateLimiter();
+	const stopRefresh = deps?.stopTokenRefreshFn ?? (() => {});
+	const closeWsClients = deps?.closeAllClientsFn ?? closeAllClients;
+	const getWsCount = deps?.getClientCountFn ?? getClientCount;
+	const gracefulWaitMs = deps?.gracefulWaitMs ?? state.shutdownGracefulWait * 1e3;
+	const abortWaitMs = deps?.abortWaitMs ?? state.shutdownAbortWait * 1e3;
+	const drainOpts = {
+		pollIntervalMs: deps?.drainPollIntervalMs ?? DRAIN_POLL_INTERVAL_MS,
+		progressIntervalMs: deps?.drainProgressIntervalMs ?? DRAIN_PROGRESS_INTERVAL_MS
+	};
+	_isShuttingDown = true;
+	shutdownAbortController = new AbortController();
+	consola.info(`Received ${signal}, shutting down gracefully...`);
+	try {
+		deps?.contextManager?.stopReaper();
+	} catch {}
+	stopMemoryPressureMonitor();
+	stopEventLoopLagMonitor();
+	stopRefresh();
+	const wsClients = getWsCount();
+	if (wsClients > 0) {
+		closeWsClients();
+		consola.info(`Disconnected ${wsClients} WebSocket client(s)`);
 	}
-	function stopReaper() {
-		if (reaperTimer) {
-			clearInterval(reaperTimer);
-			reaperTimer = null;
-		}
+	if (rateLimiter) {
+		const rejected = rateLimiter.rejectQueued();
+		if (rejected > 0) consola.info(`Rejected ${rejected} queued request(s) from rate limiter`);
 	}
-	function emit(event) {
-		for (const listener of listeners) try {
-			listener(event);
-		} catch {}
+	if (server) {
+		server.close(false).catch((error) => {
+			consola.error("Error stopping listener:", error);
+		});
+		consola.info("Stopped accepting new connections");
 	}
-	function handleContextEvent(rawEvent) {
-		const { type, context } = rawEvent;
-		switch (type) {
-			case "state_changed":
-				if (rawEvent.previousState) emit({
-					type: "state_changed",
-					context,
-					previousState: rawEvent.previousState
-				});
-				break;
-			case "updated":
-				if (rawEvent.field) emit({
-					type: "updated",
-					context,
-					field: rawEvent.field
-				});
-				break;
-			case "completed":
-				if (rawEvent.entry) emit({
-					type: "completed",
-					context,
-					entry: rawEvent.entry
-				});
-				activeContexts.delete(context.id);
-				break;
-			case "failed":
-				if (rawEvent.entry) emit({
-					type: "failed",
-					context,
-					entry: rawEvent.entry
-				});
-				activeContexts.delete(context.id);
-				break;
-			default: break;
+	if (tracker) {
+		const activeCount = tracker.getActiveRequests().length;
+		if (activeCount > 0) {
+			consola.info(`Phase 2: Waiting up to ${gracefulWaitMs / 1e3}s for ${activeCount} active request(s)...`);
+			try {
+				if (await drainActiveRequests(gracefulWaitMs, tracker, drainOpts) === "drained") {
+					consola.info("All requests completed naturally");
+					await finalize(tracker);
+					return;
+				}
+			} catch (error) {
+				consola.error("Error during Phase 2 drain:", error);
+			}
+			const remaining = tracker.getActiveRequests().length;
+			consola.info(`Phase 3: Sending abort signal to ${remaining} remaining request(s), waiting up to ${abortWaitMs / 1e3}s...`);
+			shutdownAbortController.abort();
+			try {
+				if (await drainActiveRequests(abortWaitMs, tracker, drainOpts) === "drained") {
+					consola.info("All requests completed after abort signal");
+					await finalize(tracker);
+					return;
+				}
+			} catch (error) {
+				consola.error("Error during Phase 3 drain:", error);
+			}
+			const forceRemaining = tracker.getActiveRequests().length;
+			consola.warn(`Phase 4: Force-closing ${forceRemaining} remaining request(s)`);
+			if (server) try {
+				await server.close(true);
+			} catch (error) {
+				consola.error("Error force-closing server:", error);
+			}
 		}
+		await finalize(tracker);
+	} else {
+		await shutdownPostHog();
+		consola.info("Shutdown complete");
+		shutdownResolve?.();
 	}
-	return {
-		create(opts) {
-			const ctx = createRequestContext({
-				endpoint: opts.endpoint,
-				tuiLogId: opts.tuiLogId,
-				onEvent: handleContextEvent
-			});
-			activeContexts.set(ctx.id, ctx);
-			emit({
-				type: "created",
-				context: ctx
-			});
-			return ctx;
-		},
-		get(id) {
-			return activeContexts.get(id);
-		},
-		getAll() {
-			return Array.from(activeContexts.values());
-		},
-		get activeCount() {
-			return activeContexts.size;
-		},
-		on(_event, listener) {
-			listeners.add(listener);
-		},
-		off(_event, listener) {
-			listeners.delete(listener);
-		},
-		startReaper,
-		stopReaper,
-		_runReaperOnce: runReaperOnce
-	};
 }
-
-//#endregion
-//#region src/lib/hidden-models.ts
-/**
-* Hardcoded list of GitHub Copilot model ids that are hidden from listing
-* endpoints (the /v1/models response, the startup ASCII banner, and the
-* --claude-code interactive prompts), unless `--show-all-models` is passed.
-*
-* Note: this is a DISPLAY filter only. Explicit POSTs to handler endpoints
-* with a hidden id are NOT rejected — they pass through to upstream verbatim.
-*
-* Bumping the list requires a code change + release. No env var, no config
-* file, no CLI append interface.
-*/
-const HIDDEN_MODEL_IDS = new Set([
-	"gpt-3.5-turbo",
-	"gpt-3.5-turbo-0613",
-	"gpt-4",
-	"gpt-4-0613",
-	"gpt-4-0125-preview",
-	"gpt-4o",
-	"gpt-4o-mini",
-	"gpt-4-o-preview",
-	"gpt-4o-2024-05-13",
-	"gpt-4o-2024-08-06",
-	"gpt-4o-2024-11-20",
-	"gpt-4o-mini-2024-07-18",
-	"gpt-4.1",
-	"gpt-4.1-2025-04-14",
-	"gpt-41-copilot",
-	"gpt-5-mini",
-	"gpt-5.3-codex",
-	"gpt-5.4",
-	"text-embedding-ada-002",
-	"text-embedding-3-small",
-	"text-embedding-3-small-inference",
-	"gemini-2.5-pro",
-	"gemini-3-flash-preview",
-	"claude-opus-4.5",
-	"claude-opus-4.6",
-	"claude-opus-4.7-high",
-	"claude-opus-4.7-xhigh",
-	"claude-sonnet-4.5",
-	"mai-code-1-flash-internal",
-	"trajectory-compaction"
-]);
-function isHiddenModel(id, showAll) {
-	if (showAll) return false;
-	return HIDDEN_MODEL_IDS.has(id);
+async function finalize(tracker) {
+	await shutdownPostHog();
+	tracker.destroy();
+	consola.info("Shutdown complete");
+	shutdownResolve?.();
+}
+function setupShutdownHandlers() {
+	const handler = (signal) => {
+		if (_isShuttingDown) {
+			consola.warn("Second signal received, forcing immediate exit");
+			process.exit(1);
+		}
+		gracefulShutdown(signal).catch((error) => {
+			consola.error("Fatal error during shutdown:", error);
+			shutdownResolve?.();
+			process.exit(1);
+		});
+	};
+	process.on("SIGINT", () => handler("SIGINT"));
+	process.on("SIGTERM", () => handler("SIGTERM"));
 }
 
 //#endregion
-//#region src/lib/history-ws.ts
+//#region src/lib/adaptive-rate-limiter.ts
+const DEFAULT_CONFIG$1 = {
+	baseRetryIntervalSeconds: 1,
+	maxRetryIntervalSeconds: 60,
+	maxRetries: 8
+};
 /**
-* WebSocket support for History API.
-* Enables real-time updates when new requests are recorded.
+* Per-request adaptive rate limiter. Retries the calling request on 429 with
+* exponential backoff without blocking any other in-flight request.
 */
-const clients = /* @__PURE__ */ new Set();
-function addClient(ws) {
-	clients.add(ws);
-	const msg = {
-		type: "connected",
-		data: { clientCount: clients.size },
-		timestamp: Date.now()
-	};
-	ws.send(JSON.stringify(msg));
-}
-function removeClient(ws) {
-	clients.delete(ws);
-}
-function getClientCount() {
-	return clients.size;
-}
-function closeAllClients() {
-	for (const client of clients) try {
-		client.close(1001, "Server shutting down");
-	} catch {}
-	clients.clear();
-}
-function broadcast(message) {
-	const data = JSON.stringify(message);
-	for (const client of clients) try {
-		if (client.readyState === WebSocket.OPEN) client.send(data);
-		else clients.delete(client);
-	} catch (error) {
-		consola.debug("WebSocket send failed, removing client:", error);
-		clients.delete(client);
-	}
-}
-function notifyEntryAdded(summary) {
-	if (clients.size === 0) return;
-	broadcast({
-		type: "entry_added",
-		data: summary,
-		timestamp: Date.now()
-	});
-}
-function notifyEntryUpdated(summary) {
-	if (clients.size === 0) return;
-	broadcast({
-		type: "entry_updated",
-		data: summary,
-		timestamp: Date.now()
-	});
-}
-function notifyStatsUpdated(stats) {
-	if (clients.size === 0) return;
-	broadcast({
-		type: "stats_updated",
-		data: stats,
-		timestamp: Date.now()
-	});
-}
-function notifyHistoryCleared() {
-	if (clients.size === 0) return;
-	broadcast({
-		type: "history_cleared",
-		data: null,
-		timestamp: Date.now()
-	});
-}
-function notifySessionDeleted(sessionId) {
-	if (clients.size === 0) return;
-	broadcast({
-		type: "session_deleted",
-		data: { sessionId },
-		timestamp: Date.now()
-	});
-}
-
-//#endregion
-//#region src/lib/history.ts
-function generateId$1() {
-	return Date.now().toString(36) + Math.random().toString(36).slice(2, 9);
-}
-const historyState = {
-	enabled: false,
-	entries: [],
-	sessions: /* @__PURE__ */ new Map(),
-	currentSessionId: "",
-	maxEntries: 1e3,
-	sessionTimeoutMs: 1800 * 1e3
-};
-const entryIndex = /* @__PURE__ */ new Map();
-function initHistory(enabled, maxEntries) {
-	historyState.enabled = enabled;
-	historyState.maxEntries = maxEntries;
-	historyState.entries = [];
-	historyState.sessions = /* @__PURE__ */ new Map();
-	historyState.currentSessionId = enabled ? generateId$1() : "";
-	entryIndex.clear();
-}
-function isHistoryEnabled() {
-	return historyState.enabled;
-}
-function getCurrentSession(endpoint) {
-	const now = Date.now();
-	if (historyState.currentSessionId) {
-		const session = historyState.sessions.get(historyState.currentSessionId);
-		if (session && now - session.lastActivity < historyState.sessionTimeoutMs) {
-			session.lastActivity = now;
-			return historyState.currentSessionId;
-		}
+var AdaptiveRateLimiter = class {
+	config;
+	constructor(config = {}) {
+		this.config = {
+			...DEFAULT_CONFIG$1,
+			...config
+		};
 	}
-	const sessionId = generateId$1();
-	historyState.currentSessionId = sessionId;
-	historyState.sessions.set(sessionId, {
-		id: sessionId,
-		startTime: now,
-		lastActivity: now,
-		requestCount: 0,
-		totalInputTokens: 0,
-		totalOutputTokens: 0,
-		models: [],
-		endpoint
-	});
-	return sessionId;
-}
-function recordRequest(endpoint, request) {
-	if (!historyState.enabled) return "";
-	const sessionId = getCurrentSession(endpoint);
-	const session = historyState.sessions.get(sessionId);
-	if (!session) return "";
-	const entry = {
-		id: generateId$1(),
-		sessionId,
-		timestamp: Date.now(),
-		endpoint,
-		request: {
-			model: request.model,
-			messages: request.messages,
-			stream: request.stream,
-			tools: request.tools,
-			max_tokens: request.max_tokens,
-			temperature: request.temperature,
-			system: request.system
+	/**
+	* Execute a request, retrying ONLY this request on 429 with exponential
+	* backoff. Never blocks other concurrent requests.
+	*/
+	async execute(fn) {
+		let attempt = 0;
+		let backoffMs = 0;
+		for (;;) try {
+			const result = await fn();
+			if (attempt > 0) addTiming(TIMING.LIMITER_RETRIES, attempt);
+			return {
+				result,
+				queueWaitMs: backoffMs
+			};
+		} catch (error) {
+			const { isRateLimit, retryAfter } = this.isRateLimitError(error);
+			if (!isRateLimit || attempt >= this.config.maxRetries || getIsShuttingDown()) throw error;
+			attempt++;
+			const delayMs = retryAfter !== void 0 && retryAfter > 0 ? retryAfter * 1e3 : this.withJitter(this.backoffSeconds(attempt) * 1e3);
+			backoffMs += delayMs;
+			await this.sleep(delayMs);
 		}
-	};
-	historyState.entries.push(entry);
-	entryIndex.set(entry.id, entry);
-	session.requestCount++;
-	if (!session.models.includes(request.model)) session.models.push(request.model);
-	if (request.tools && request.tools.length > 0) {
-		if (!session.toolsUsed) session.toolsUsed = [];
-		for (const tool of request.tools) if (!session.toolsUsed.includes(tool.name)) session.toolsUsed.push(tool.name);
 	}
-	while (historyState.maxEntries > 0 && historyState.entries.length > historyState.maxEntries) {
-		const removed = historyState.entries.shift();
-		if (removed) {
-			entryIndex.delete(removed.id);
-			if (historyState.entries.filter((e) => e.sessionId === removed.sessionId).length === 0) historyState.sessions.delete(removed.sessionId);
+	/**
+	* Check if an error is a rate limit error (429) and extract Retry-After if available.
+	*/
+	isRateLimitError(error) {
+		if (error && typeof error === "object") {
+			if ("status" in error && error.status === 429) return {
+				isRateLimit: true,
+				retryAfter: this.extractRetryAfter(error)
+			};
+			if ("responseText" in error && typeof error.responseText === "string") try {
+				const parsed = JSON.parse(error.responseText);
+				if (parsed && typeof parsed === "object" && "error" in parsed && parsed.error && typeof parsed.error === "object" && "code" in parsed.error && parsed.error.code === "rate_limited") return { isRateLimit: true };
+			} catch {}
 		}
+		return { isRateLimit: false };
 	}
-	notifyEntryAdded({
-		id: entry.id,
-		endpoint,
-		model: request.model,
-		stream: request.stream,
-		timestamp: entry.timestamp
-	});
-	return entry.id;
-}
-function recordResponse(id, response, durationMs) {
-	if (!historyState.enabled || !id) return;
-	const entry = entryIndex.get(id);
-	if (entry) {
-		entry.response = response;
-		entry.durationMs = durationMs;
-		const session = historyState.sessions.get(entry.sessionId);
-		if (session) {
-			session.totalInputTokens += response.usage.input_tokens;
-			session.totalOutputTokens += response.usage.output_tokens;
-			session.lastActivity = Date.now();
-		}
-		notifyEntryUpdated({
-			id: entry.id,
-			endpoint: entry.endpoint,
-			model: response.model,
-			success: response.success,
-			durationMs,
-			inputTokens: response.usage.input_tokens,
-			outputTokens: response.usage.output_tokens
-		});
-		notifyStatsUpdated({
-			totalRequests: historyState.entries.length,
-			totalInputTokens: session?.totalInputTokens ?? 0,
-			totalOutputTokens: session?.totalOutputTokens ?? 0
-		});
+	/**
+	* Extract Retry-After value from error response.
+	*/
+	extractRetryAfter(error) {
+		if (!error || typeof error !== "object") return void 0;
+		if ("responseText" in error && typeof error.responseText === "string") try {
+			const parsed = JSON.parse(error.responseText);
+			if (parsed && typeof parsed === "object" && "retry_after" in parsed && typeof parsed.retry_after === "number") return parsed.retry_after;
+			if (parsed && typeof parsed === "object" && "error" in parsed && parsed.error && typeof parsed.error === "object" && "retry_after" in parsed.error && typeof parsed.error.retry_after === "number") return parsed.error.retry_after;
+		} catch {}
 	}
-}
-function getHistory(options = {}) {
-	const { page = 1, limit = 50, model, endpoint, status, from, to, search, sessionId } = options;
-	let filtered = [...historyState.entries];
-	if (sessionId) filtered = filtered.filter((e) => e.sessionId === sessionId);
-	if (model) {
-		const modelLower = model.toLowerCase();
-		filtered = filtered.filter((e) => e.request.model.toLowerCase().includes(modelLower) || e.response?.model.toLowerCase().includes(modelLower));
+	/** Exponential backoff (seconds) for the given retry attempt, capped. */
+	backoffSeconds(attempt) {
+		const backoff = this.config.baseRetryIntervalSeconds * 2 ** (attempt - 1);
+		return Math.min(backoff, this.config.maxRetryIntervalSeconds);
 	}
-	if (endpoint) filtered = filtered.filter((e) => e.endpoint === endpoint);
-	let effectiveStatus = status;
-	const legacySuccess = options.success;
-	if (!effectiveStatus && legacySuccess !== void 0) effectiveStatus = legacySuccess ? "success" : "error";
-	switch (effectiveStatus) {
-		case "success":
-			filtered = filtered.filter((e) => e.response?.success === true);
-			break;
-		case "error":
-			filtered = filtered.filter((e) => e.response !== void 0 && !e.response.success);
-			break;
-		case "pending":
-			filtered = filtered.filter((e) => !e.response);
-			break;
-		default: break;
+	/** Apply ±20% jitter so simultaneous retries don't hammer upstream in lockstep. */
+	withJitter(ms) {
+		const factor = .8 + Math.random() * .4;
+		return Math.round(ms * factor);
 	}
-	if (from) filtered = filtered.filter((e) => e.timestamp >= from);
-	if (to) filtered = filtered.filter((e) => e.timestamp <= to);
-	if (search) {
-		const searchLower = search.toLowerCase();
-		filtered = filtered.filter((e) => {
-			const msgMatch = e.request.messages.some((m) => {
-				if (typeof m.content === "string") return m.content.toLowerCase().includes(searchLower);
-				if (Array.isArray(m.content)) return m.content.some((c) => c.text && c.text.toLowerCase().includes(searchLower));
-				return false;
-			});
-			const respMatch = e.response?.content && typeof e.response.content.content === "string" && e.response.content.content.toLowerCase().includes(searchLower);
-			const toolMatch = e.response?.toolCalls?.some((t) => t.name.toLowerCase().includes(searchLower));
-			const sysMatch = e.request.system?.toLowerCase().includes(searchLower);
-			return msgMatch || respMatch || toolMatch || sysMatch;
+	sleep(ms) {
+		return new Promise((resolve) => {
+			const timer = setTimeout(resolve, ms);
+			if (typeof timer.unref === "function") timer.unref();
 		});
 	}
-	filtered.sort((a, b) => b.timestamp - a.timestamp);
-	const total = filtered.length;
-	const totalPages = Math.ceil(total / limit);
-	const start = (page - 1) * limit;
-	return {
-		entries: filtered.slice(start, start + limit),
-		total,
-		page,
-		limit,
-		totalPages
+	/**
+	* No global queue in per-request mode, so there is nothing to reject. Retained
+	* for the shutdown call site (returns 0 = nothing drained).
+	*/
+	rejectQueued() {
+		return 0;
+	}
+};
+let rateLimiterInstance = null;
+/**
+* Initialize the adaptive rate limiter with configuration.
+*/
+function initAdaptiveRateLimiter(config = {}) {
+	rateLimiterInstance = new AdaptiveRateLimiter(config);
+	const resolved = {
+		...DEFAULT_CONFIG$1,
+		...config
 	};
+	consola.info(`[RateLimiter] Initialized (per-request backoff: ${resolved.baseRetryIntervalSeconds}s-${resolved.maxRetryIntervalSeconds}s, max ${resolved.maxRetries} retries)`);
 }
-function getEntry(id) {
-	return entryIndex.get(id);
+/**
+* Get the rate limiter instance.
+*/
+function getAdaptiveRateLimiter() {
+	return rateLimiterInstance;
 }
-function getSessions() {
-	const sessions = Array.from(historyState.sessions.values()).sort((a, b) => b.lastActivity - a.lastActivity);
-	return {
-		sessions,
-		total: sessions.length
+/**
+* Execute a request with adaptive rate limiting. If the limiter is not
+* initialized, executes immediately. Returns the result along with backoff wait.
+*/
+async function executeWithAdaptiveRateLimit(fn) {
+	if (!rateLimiterInstance) return {
+		result: await fn(),
+		queueWaitMs: 0
 	};
+	return rateLimiterInstance.execute(fn);
 }
-function getSession(id) {
-	return historyState.sessions.get(id);
+
+//#endregion
+//#region src/lib/auth-gate.ts
+/**
+* Auth gate — the inbound authentication decision point for the proxy.
+*
+* Protects this proxy's *inbound* surface with a configured **Proxy API key**
+* (NOT the outbound GitHub OAuth token or Copilot token). The decision logic
+* is expressed as pure functions so it can be unit-tested without booting the
+* server or reaching upstream.
+*/
+/**
+* Extract candidate presented credential values from request headers.
+*
+* Two header shapes are read, and **both** contribute candidates when present
+* (compare-all-present) so neither is silently ignored in favor of the other —
+* a later any-match over the candidates decides acceptance:
+*  - `Authorization`: the scheme prefix is stripped case-insensitively
+*    (`Bearer ` / `bearer ` …) because the scheme is case-insensitive per
+*    RFC 7235, while the secret itself is case-sensitive. A bare value with no
+*    scheme prefix is tolerated and returned verbatim.
+*  - `x-api-key` (Issue 02): the Anthropic-native header. Taken verbatim — no
+*    scheme stripping (a value that happens to start with `Bearer ` is kept
+*    as-is).
+*
+* Order is `[Authorization, x-api-key]` for any present header; absent headers
+* contribute nothing.
+*/
+function extractCredentials(headers) {
+	const candidates = [];
+	const authorization = headers.get("authorization");
+	if (authorization !== null) candidates.push(authorization.replace(/^Bearer\s+/i, ""));
+	const apiKey = headers.get("x-api-key");
+	if (apiKey !== null) candidates.push(apiKey);
+	return candidates;
 }
-function getSessionEntries(sessionId) {
-	return historyState.entries.filter((e) => e.sessionId === sessionId).sort((a, b) => a.timestamp - b.timestamp);
+/**
+* Hard-coded exemption set: the liveness (`/`) and readiness (`/health`)
+* endpoints are reachable without a key so container orchestration probes are
+* never blocked. Everything else is protected (fail-closed) — unknown / future
+* routes default to protected.
+*
+* Matching is by **exact path**, with a trailing slash tolerated (so `/health/`
+* is exempt too) and `/` itself handled explicitly. Prefix matching is
+* deliberately avoided: `/healthz` or `/health/extra` must NOT be exempt. The
+* server registers a matching `/health/` route, so an exempt `/health/` request
+* resolves to the readiness handler rather than 404ing.
+*/
+function isExemptPath(path) {
+	if (path === "/") return true;
+	return (path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path) === "/health";
 }
-function clearHistory() {
-	historyState.entries = [];
-	historyState.sessions = /* @__PURE__ */ new Map();
-	historyState.currentSessionId = generateId$1();
-	entryIndex.clear();
-	notifyHistoryCleared();
+/**
+* Compute the fixed-length sha256 digest (32 bytes) of the configured key.
+* The configured key is trimmed before hashing (config-side trim).
+*/
+function digestConfiguredKey(configuredKey) {
+	return createHash("sha256").update(configuredKey.trim()).digest();
 }
-function deleteSession(sessionId) {
-	if (!historyState.sessions.has(sessionId)) return false;
-	const removedEntries = historyState.entries.filter((e) => e.sessionId === sessionId);
-	historyState.entries = historyState.entries.filter((e) => e.sessionId !== sessionId);
-	for (const e of removedEntries) entryIndex.delete(e.id);
-	historyState.sessions.delete(sessionId);
-	if (historyState.currentSessionId === sessionId) historyState.currentSessionId = generateId$1();
-	notifySessionDeleted(sessionId);
-	return true;
+/**
+* Constant-time membership test: does any presented candidate match the
+* configured key?
+*
+* Each candidate is sha256'd to a fixed 32-byte digest and compared against the
+* configured digest. Hashing to a fixed length sidesteps the `RangeError` that
+* `crypto.timingSafeEqual` throws on length-mismatched buffers, so a
+* wrong-length presented value yields `false` rather than throwing.
+*/
+function matchesConfiguredKey(configuredDigest, candidates) {
+	return candidates.some((candidate) => {
+		return timingSafeEqual(createHash("sha256").update(candidate).digest(), configuredDigest);
+	});
 }
-function getStats() {
-	const entries = historyState.entries;
-	const modelDist = {};
-	const endpointDist = {};
-	const hourlyActivity = {};
-	let totalInput = 0;
-	let totalOutput = 0;
-	let totalDuration = 0;
-	let durationCount = 0;
-	let successCount = 0;
-	let failCount = 0;
-	for (const entry of entries) {
-		const model = entry.response?.model || entry.request.model;
-		modelDist[model] = (modelDist[model] || 0) + 1;
-		endpointDist[entry.endpoint] = (endpointDist[entry.endpoint] || 0) + 1;
-		const hour = new Date(entry.timestamp).toISOString().slice(0, 13);
-		hourlyActivity[hour] = (hourlyActivity[hour] || 0) + 1;
-		if (entry.response) {
-			if (entry.response.success) successCount++;
-			else failCount++;
-			totalInput += entry.response.usage.input_tokens;
-			totalOutput += entry.response.usage.output_tokens;
-		}
-		if (entry.durationMs) {
-			totalDuration += entry.durationMs;
-			durationCount++;
-		}
-	}
-	const recentActivity = Object.entries(hourlyActivity).sort(([a], [b]) => a.localeCompare(b)).slice(-24).map(([hour, count]) => ({
-		hour,
-		count
-	}));
-	const now = Date.now();
-	let activeSessions = 0;
-	for (const session of historyState.sessions.values()) if (now - session.lastActivity < historyState.sessionTimeoutMs) activeSessions++;
-	return {
-		totalRequests: entries.length,
-		successfulRequests: successCount,
-		failedRequests: failCount,
-		totalInputTokens: totalInput,
-		totalOutputTokens: totalOutput,
-		averageDurationMs: durationCount > 0 ? totalDuration / durationCount : 0,
-		modelDistribution: modelDist,
-		endpointDistribution: endpointDist,
-		recentActivity,
-		activeSessions
+/**
+* Resolve the inbound Proxy API key from its two operator-facing sources,
+* applying the precedence + normalization contract (Issue 03):
+*
+*  - `--api-key` flag (`flag`) and `COPILOT_API_KEY` env (`env`) are each
+*    **trimmed first**; a trimmed-empty source (`""`, whitespace, or
+*    `undefined`) counts as **not provided**.
+*  - When both provide a non-empty value, the **flag wins** (env ignored).
+*  - When only one provides a non-empty value, that one is used.
+*  - When neither does, `key` is `undefined` and `source` is `"none"` → auth
+*    stays disabled (same as the no-`--api-key` default).
+*
+* Pure: it reads nothing from `process.env` itself (the caller passes the env
+* value in), so it is fully unit-testable and the precedence logic is decoupled
+* from how the values are sourced.
+*/
+function resolveProxyApiKey(sources) {
+	const flag = sources.flag?.trim() ?? "";
+	if (flag !== "") return {
+		key: flag,
+		source: "flag"
+	};
+	const env = sources.env?.trim() ?? "";
+	if (env !== "") return {
+		key: env,
+		source: "env"
 	};
-}
-function getTokenStats() {
-	const models = {};
-	const timeline = [];
-	for (const entry of historyState.entries) {
-		if (!entry.response) continue;
-		const model = entry.response.model || entry.request.model;
-		const inputTokens = entry.response.usage.input_tokens;
-		const outputTokens = entry.response.usage.output_tokens;
-		const existing = models[model];
-		if (existing) {
-			existing.inputTokens += inputTokens;
-			existing.outputTokens += outputTokens;
-			existing.requestCount++;
-		} else models[model] = {
-			inputTokens,
-			outputTokens,
-			requestCount: 1
-		};
-		timeline.push({
-			timestamp: entry.timestamp,
-			model,
-			inputTokens,
-			outputTokens
-		});
-	}
-	timeline.sort((a, b) => a.timestamp - b.timestamp);
 	return {
-		models,
-		timeline
+		key: void 0,
+		source: "none"
 	};
 }
-function getHistoryEntryCount() {
-	return historyState.entries.length;
-}
-function getHistoryMaxEntries() {
-	return historyState.maxEntries;
-}
-function setHistoryMaxEntries(max) {
-	historyState.maxEntries = max;
-}
 /**
-* Evict the oldest `count` entries from the history store.
-* Returns the actual number of entries evicted.
+* Resolve the hostname the server will *actually* bind to, decided at the CLI
+* edge with flag-over-env precedence and a **safe loopback default** — the same
+* flag-over-env shape this codebase already uses to reconcile a CLI flag with
+* its env twin (`--api-key`/`COPILOT_API_KEY`, `--github-token`/`GH_TOKEN`).
+*
+*  - `--host` flag wins when present; otherwise the `HOST` env; otherwise the
+*    default `127.0.0.1`.
+*  - The default is **loopback, not all-interfaces**: an unconfigured instance
+*    must not expose `/token` (which echoes the plaintext Copilot token) and the
+*    otherwise-unauthenticated API to the whole network. Binding every interface
+*    is now an explicit opt-in — pass `--host 0.0.0.0` (or `HOST=0.0.0.0`).
+*  - **flag vs env asymmetry on a blank value** (the security-critical part): an
+*    explicit `--host` flag is the operator's deliberate choice, so a blank flag
+*    (`--host ""` / whitespace) is taken as the wildcard-bind escape hatch and
+*    canonicalized to an explicit `0.0.0.0` (rather than left as `""` to lean on
+*    srvx's undocumented empty-string handling). But a *set-but-blank* `HOST` env
+*    (`HOST=`, or `HOST=$UNSET` in a shell / compose where the var is unset →
+*    empty — NOT a deliberate keystroke) is accidental plumbing, so it is treated
+*    as **not provided** and falls through to the loopback default. This mirrors
+*    `resolveProxyApiKey` trimming `""` to not-provided, so an empty `HOST` can't
+*    silently reopen the all-interfaces-unauthenticated exposure the loopback
+*    default exists to prevent.
+*  - **Both sources are trimmed**: a padded `--host " 10.0.0.5 "` or
+*    `HOST=" 10.0.0.5 "` would otherwise reach the socket bind verbatim and fail
+*    with `ENOTFOUND`. Trimming also decides blank-ness for the rules above.
+*
+* `env` is passed in (not read here) to keep the function pure and unit-testable.
 */
-function evictOldestEntries(count) {
-	if (count <= 0) return 0;
-	const actual = Math.min(count, historyState.entries.length);
-	const removed = historyState.entries.splice(0, actual);
-	for (const e of removed) entryIndex.delete(e.id);
-	for (const entry of removed) if (!historyState.entries.some((e) => e.sessionId === entry.sessionId)) historyState.sessions.delete(entry.sessionId);
-	return actual;
-}
-function exportHistory(format = "json") {
-	if (format === "json") return JSON.stringify({
-		sessions: Array.from(historyState.sessions.values()),
-		entries: historyState.entries
-	}, null, 2);
-	const headers = [
-		"id",
-		"session_id",
-		"timestamp",
-		"endpoint",
-		"request_model",
-		"message_count",
-		"stream",
-		"success",
-		"response_model",
-		"input_tokens",
-		"output_tokens",
-		"duration_ms",
-		"stop_reason",
-		"error"
-	];
-	const rows = historyState.entries.map((e) => [
-		e.id,
-		e.sessionId,
-		new Date(e.timestamp).toISOString(),
-		e.endpoint,
-		e.request.model,
-		e.request.messages.length,
-		e.request.stream,
-		e.response?.success ?? "",
-		e.response?.model ?? "",
-		e.response?.usage.input_tokens ?? "",
-		e.response?.usage.output_tokens ?? "",
-		e.durationMs ?? "",
-		e.response?.stop_reason ?? "",
-		e.response?.error ?? ""
-	]);
-	return [headers.join(","), ...rows.map((r) => r.join(","))].join("\n");
+function resolveBindHost(flag, env) {
+	if (flag !== void 0) {
+		const trimmed = flag.trim();
+		return trimmed === "" ? "0.0.0.0" : trimmed;
+	}
+	const envTrimmed = env?.trim() ?? "";
+	if (envTrimmed !== "") return envTrimmed;
+	return "127.0.0.1";
 }
-
-//#endregion
-//#region src/lib/history-memory-pressure.ts
 /**
-* Memory pressure monitor — proactively evicts old history entries
-* when heap usage approaches the V8 heap limit, preventing OOM crashes.
+* Resolve the address the server will *actually* bind to for the startup banner
+* (Issue 04).
 *
-* Graduated response:
-*   75–80%  Warning: log only, no eviction
-*   80–90%  High: evict entries, reduce maxEntries by 25%
-*   90%+    Critical: aggressive eviction, reduce maxEntries by 50%
+* Mirrors srvx's own host resolution EXACTLY so the banner reports the TRUE bind
+* rather than a guess that could diverge from what srvx passes to the runtime.
+* srvx computes `hostname = opts.hostname ?? process.env.HOST` (a raw nullish
+* coalesce — no trimming, no empty-string special-casing), and start.ts passes
+* `hostname: options.host`. So:
+*   - an explicit `--host` (even `""` / whitespace) is what srvx uses verbatim —
+*     it does NOT fall back to HOST once `opts.hostname` is a non-null string;
+*   - only an absent (`undefined`) `--host` lets srvx fall back to `HOST`;
+*   - when the coalesced value is `undefined` or empty, the runtime binds all
+*     interfaces, which we report as the explicit `0.0.0.0` so a wide-open bind
+*     is unmistakable (srvx renders the same bind as "localhost (all
+*     interfaces)").
+*
+* Critically, the resolved non-empty value is returned VERBATIM (not trimmed):
+* srvx hands the runtime exactly that string, so the banner must report exactly
+* that string — trimming here would make the banner claim a different address
+* than the one actually bound. `env` is passed in (not read) to keep the
+* function pure and unit-testable.
 */
-const CHECK_INTERVAL_MS = 3e4;
-const WARN_THRESHOLD = .75;
-const EVICT_THRESHOLD = .8;
-const CRITICAL_THRESHOLD = .9;
-const WARN_LOG_COOLDOWN_MS = 3e5;
-let resolvedHeapLimit = null;
-let timer = null;
-let lastWarningTime = 0;
-let totalEvictedCount = 0;
-async function resolveHeapLimit() {
-	if (resolvedHeapLimit !== null) return resolvedHeapLimit;
-	let limit;
-	try {
-		limit = (await import("node:v8")).getHeapStatistics().heap_size_limit;
-	} catch {
-		limit = 512 * 1024 * 1024;
-	}
-	resolvedHeapLimit = limit;
-	return limit;
+function resolveBindAddress(host, env) {
+	const resolved = host ?? env;
+	if (resolved === void 0 || resolved === "") return "0.0.0.0";
+	return resolved;
 }
-function formatMB(bytes) {
-	return `${Math.round(bytes / 1024 / 1024)}MB`;
+/**
+* Resolve the CLIENT-FACING host for generated configs and viewer links
+* (Issue 04), derived from the SAME srvx host resolution as the banner so the
+* two never disagree about what was bound — and formatted as a valid URL
+* authority so the links actually parse.
+*
+* Two differences from {@link resolveBindAddress}:
+*  - All-interfaces rendering: a wildcard bind (`0.0.0.0` / `::` / `[::]` /
+*    empty) is not a connectable target, so it maps to `localhost` for URLs a
+*    client will actually dial (matching srvx's "localhost (all interfaces)"
+*    presentation). A narrowed bind (e.g. `127.0.0.1`, `192.168.1.10`, an IPv6
+*    address) is kept so generated links point at the real interface — fixing
+*    the prior bug where setting `HOST` (with `--host` omitted) yielded
+*    `http://localhost:<port>` links the narrowed bind wasn't listening on.
+*  - IPv6 bracketing: a literal IPv6 host (contains `:`) is wrapped in `[...]`,
+*    exactly as srvx's own `fmtURL` does, so `http://[2001:db8::1]:<port>` is a
+*    valid authority rather than the unparseable `http://2001:db8::1:<port>`.
+*
+* Returns a host token ready to drop into `http://<token>:<port>`.
+*/
+function resolveClientHost(host, env) {
+	const bind = resolveBindAddress(host, env);
+	if (bind === "0.0.0.0" || bind === "::" || bind === "[::]") return "localhost";
+	if (bind.includes(":") && !bind.startsWith("[")) return `[${bind}]`;
+	return bind;
 }
-function formatPct(ratio) {
-	return `${Math.round(ratio * 100)}%`;
+/**
+* Build the inbound-auth startup banner lines (Issue 04).
+*
+* Returns the human-readable lines the proxy prints at boot so operators can see,
+* at a glance, the security posture of *this* instance:
+*  - auth ON  → `认证开启`, plus the key's origin (`flag` / `env`), plus the real
+*    bind address.
+*  - auth OFF → `认证关闭`, plus the real bind address (so a careless all-
+*    interfaces bind without auth is visible).
+*
+* The configured key value is **never** an input here, so it can never leak into
+* the banner — the function only knows the *source* tag, not the secret. Pure
+* (string in → strings out) so the banner copy is pinned by unit tests.
+*/
+function buildStartupAuthLines(params) {
+	const { source, bindAddress } = params;
+	return [source === "none" ? `Inbound auth: 认证关闭 (no proxy API key configured)` : `Inbound auth: 认证开启 (source: ${source})`, `Binding to: ${bindAddress}`];
 }
-async function checkMemoryPressure() {
-	const heapLimit = await resolveHeapLimit();
-	const { heapUsed } = process.memoryUsage();
-	const ratio = heapUsed / heapLimit;
-	if (ratio < WARN_THRESHOLD) return;
-	const currentEntries = getHistoryEntryCount();
-	if (currentEntries <= state.historyMinEntries) {
-		if (ratio >= EVICT_THRESHOLD && Date.now() - lastWarningTime > WARN_LOG_COOLDOWN_MS) {
-			lastWarningTime = Date.now();
-			consola.warn(`[memory] Heap ${formatMB(heapUsed)}/${formatMB(heapLimit)} (${formatPct(ratio)}) — only ${currentEntries} history entries remain. Consider increasing --max-old-space-size`);
-		}
-		return;
-	}
-	if (ratio < EVICT_THRESHOLD) {
-		if (Date.now() - lastWarningTime > WARN_LOG_COOLDOWN_MS) {
-			lastWarningTime = Date.now();
-			consola.warn(`[memory] Heap ${formatMB(heapUsed)}/${formatMB(heapLimit)} (${formatPct(ratio)}) — approaching limit, ${currentEntries} history entries in memory`);
-		}
-		return;
+/**
+* Configure the proxy API key on global state from a raw configured value.
+*
+* The value is trimmed; a trimmed-empty value (or `undefined`) is treated as
+* "not provided" → auth stays disabled. Otherwise the precomputed digest is
+* stored on state (presence === enabled). Returns whether auth is enabled.
+*
+* The `--api-key` flag and `COPILOT_API_KEY` env source are reconciled upstream
+* by `resolveProxyApiKey` (flag-over-env precedence, Issue 03); this function
+* receives only the already-resolved value.
+*/
+function configureProxyApiKey(rawKey) {
+	const trimmed = rawKey?.trim() ?? "";
+	if (trimmed === "") {
+		state.proxyApiKeyDigest = void 0;
+		return false;
 	}
-	lastWarningTime = Date.now();
-	const currentMax = getHistoryMaxEntries();
-	const newMaxEntries = ratio >= CRITICAL_THRESHOLD ? Math.max(state.historyMinEntries, Math.floor(currentMax * .5)) : Math.max(state.historyMinEntries, Math.floor(currentMax * .75));
-	const evictCount = Math.max(0, currentEntries - newMaxEntries);
-	if (evictCount <= 0) return;
-	const evicted = evictOldestEntries(evictCount);
-	totalEvictedCount += evicted;
-	if (newMaxEntries < currentMax) setHistoryMaxEntries(newMaxEntries);
-	const afterHeapUsed = process.memoryUsage().heapUsed;
-	consola.warn(`[memory] Evicted ${evicted} history entries due to memory pressure (heap: ${formatMB(heapUsed)} → ${formatMB(afterHeapUsed)}/${formatMB(heapLimit)}, entries: ${currentEntries} → ${currentEntries - evicted}, max: ${newMaxEntries})`);
-	globalThis.gc?.();
-}
-function startMemoryPressureMonitor() {
-	if (timer) return;
-	timer = setInterval(() => {
-		checkMemoryPressure().catch((error) => {
-			consola.error("[memory] Error in memory pressure check:", error);
-		});
-	}, CHECK_INTERVAL_MS);
-	if ("unref" in timer) timer.unref();
+	state.proxyApiKeyDigest = digestConfiguredKey(trimmed);
+	return true;
 }
-function stopMemoryPressureMonitor() {
-	if (timer) {
-		clearInterval(timer);
-		timer = null;
-	}
+/**
+* Path → auth-family selector (Issue 02).
+*
+* The Anthropic-native surface is `/v1/messages` and its `count_tokens`
+* subpath; both map to the Anthropic family so a native Anthropic client gets
+* the `authentication_error` body. Everything else — including every other
+* `/v1/…` endpoint and any unknown / future route — defaults to the OpenAI
+* family.
+*
+* Matching is by **exact path** (a trailing slash tolerated), deliberately not
+* a prefix test: the shared `/v1/` prefix must not sweep OpenAI-style endpoints
+* into the Anthropic family, and `/v1/messages-extra` or a deeper unexpected
+* subpath must not be misclassified either. This mirrors `isExemptPath`'s
+* exact-with-trailing-slash convention.
+*/
+function selectFamily(path) {
+	const normalized = path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+	if (normalized === "/v1/messages" || normalized === "/v1/messages/count_tokens") return "anthropic";
+	return "openai";
 }
-
-//#endregion
-//#region src/lib/posthog.ts
-let client = null;
-let distinctId = "";
-function initPostHog(apiKey) {
-	if (!apiKey) return;
-	try {
-		client = new PostHog(apiKey, {
-			host: "https://us.i.posthog.com",
-			flushAt: 20,
-			flushInterval: 1e4
-		});
-		distinctId = createHash("sha256").update(os.hostname() + os.userInfo().username).digest("hex");
-	} catch (error) {
-		consola.warn("Failed to initialize PostHog:", error instanceof Error ? error.message : error);
-		client = null;
-	}
+/**
+* OpenAI-family 401 response body. The literal field values are pinned by the
+* ADR so OpenAI-compatible SDKs recognize the failure as an auth error. The
+* same body is returned whether credentials were missing or wrong (no oracle).
+*/
+function unauthorizedOpenAIBody() {
+	return { error: {
+		message: "Invalid API key provided.",
+		type: "invalid_request_error",
+		code: "invalid_api_key",
+		param: null
+	} };
 }
-function isPostHogEnabled() {
-	return client !== null;
+/**
+* Anthropic-family 401 response body (Issue 02). Shape is pinned so Anthropic
+* SDKs (and Claude Code via `/v1/messages`) recognize the failure as an auth
+* error: a top-level `{type:"error", error:{type:"authentication_error",
+* message}}`. As with the OpenAI body, missing and wrong credentials return the
+* identical body (no oracle).
+*/
+function unauthorizedAnthropicBody() {
+	return {
+		type: "error",
+		error: {
+			type: "authentication_error",
+			message: "Invalid API key provided."
+		}
+	};
 }
-function captureRequest(params) {
-	if (!client) return;
-	const properties = {
-		model: params.model,
-		input_tokens: params.inputTokens,
-		output_tokens: params.outputTokens,
-		duration_ms: params.durationMs,
-		success: params.success,
-		stream: params.stream,
-		tool_count: params.toolCount
+/**
+* Global fail-closed authentication middleware.
+*
+* Registered after the request logger and CORS but before route dispatch.
+* Behavior:
+*  - Disabled (no configured digest) → pass through unchanged (default).
+*  - Exempt path (`/`, `/health`) → pass through.
+*  - CORS preflight `OPTIONS` on a protected path → pass through so browser
+*    preflight isn't mistaken for a 401 (blocking it surfaces as an opaque CORS
+*    error, very hard to diagnose). Scoped to *actual* preflights — an
+*    `OPTIONS` carrying `Access-Control-Request-Method` — rather than any
+*    `OPTIONS`, so the bypass surface can't silently widen. Preflights carry no
+*    protected payload, so this doesn't weaken fail-closed.
+*  - Otherwise require a valid Proxy API key; on failure return 401 with a
+*    `WWW-Authenticate: Bearer` header and a **family-appropriate** body —
+*    Anthropic-family (`/v1/messages*`) gets the `authentication_error` shape,
+*    everything else the OpenAI `invalid_api_key` shape (Issue 02). The family
+*    only selects the body shape; it does not change what is protected. Missing
+*    and wrong credentials return the field-identical body for that family.
+*/
+function authGate() {
+	return async (c, next) => {
+		const configuredDigest = state.proxyApiKeyDigest;
+		if (!configuredDigest) return next();
+		if (isExemptPath(c.req.path)) return next();
+		if (c.req.method === "OPTIONS" && c.req.raw.headers.get("access-control-request-method") !== null) return next();
+		if (matchesConfiguredKey(configuredDigest, extractCredentials(c.req.raw.headers))) return next();
+		c.header("WWW-Authenticate", "Bearer");
+		if (selectFamily(c.req.path) === "anthropic") return c.json(unauthorizedAnthropicBody(), 401);
+		return c.json(unauthorizedOpenAIBody(), 401);
 	};
-	if (params.reasoningTokens !== void 0) properties.reasoning_tokens = params.reasoningTokens;
-	if (params.stopReason !== void 0) properties.stop_reason = params.stopReason;
-	if (params.status !== void 0) properties.status = params.status;
-	if (params.copilotErrorCode !== void 0) properties.copilot_error_code = params.copilotErrorCode;
-	if (params.errorPhase !== void 0) properties.error_phase = params.errorPhase;
-	if (params.endpoint !== void 0) properties.endpoint = params.endpoint;
-	if (params.attempt !== void 0) properties.attempt = params.attempt;
-	if (params.errorName !== void 0) properties.error_name = params.errorName;
-	if (params.errorCode !== void 0) properties.error_code = params.errorCode;
-	if (params.causeName !== void 0) properties.cause_name = params.causeName;
-	if (params.causeCode !== void 0) properties.cause_code = params.causeCode;
-	if (params.errorMessage !== void 0) properties.error_message = params.errorMessage;
-	client.capture({
-		distinctId,
-		event: "copilot_api_request",
-		properties
-	});
 }
-async function shutdownPostHog() {
-	if (!client) return;
-	try {
-		await client.shutdown();
-	} catch (error) {
-		consola.warn("Failed to flush PostHog events:", error instanceof Error ? error.message : error);
+
+//#endregion
+//#region src/lib/context/request.ts
+let idCounter = 0;
+function createRequestContext(opts) {
+	const id = `req_${Date.now()}_${++idCounter}`;
+	const startTime = Date.now();
+	const onEvent = opts.onEvent;
+	let _state = "pending";
+	let _originalRequest = null;
+	let _response = null;
+	let settled = false;
+	function emit(event) {
+		try {
+			onEvent(event);
+		} catch {}
 	}
+	const ctx = {
+		id,
+		tuiLogId: opts.tuiLogId,
+		startTime,
+		endpoint: opts.endpoint,
+		get state() {
+			return _state;
+		},
+		get durationMs() {
+			return Date.now() - startTime;
+		},
+		get settled() {
+			return settled;
+		},
+		get originalRequest() {
+			return _originalRequest;
+		},
+		get response() {
+			return _response;
+		},
+		setOriginalRequest(req) {
+			_originalRequest = req;
+			emit({
+				type: "updated",
+				context: ctx,
+				field: "originalRequest"
+			});
+		},
+		transition(newState) {
+			const previousState = _state;
+			_state = newState;
+			emit({
+				type: "state_changed",
+				context: ctx,
+				previousState
+			});
+		},
+		complete(response) {
+			if (settled) return;
+			settled = true;
+			_response = response;
+			_state = "completed";
+			emit({
+				type: "completed",
+				context: ctx,
+				entry: ctx.toHistoryEntry()
+			});
+		},
+		fail(model, error) {
+			if (settled) return;
+			settled = true;
+			_response = {
+				success: false,
+				model,
+				usage: {
+					input_tokens: 0,
+					output_tokens: 0
+				},
+				error: error instanceof Error ? error.message : String(error),
+				content: null
+			};
+			_state = "failed";
+			emit({
+				type: "failed",
+				context: ctx,
+				entry: ctx.toHistoryEntry()
+			});
+		},
+		toHistoryEntry() {
+			const entry = {
+				id,
+				endpoint: opts.endpoint,
+				timestamp: startTime,
+				durationMs: Date.now() - startTime,
+				request: {
+					model: _originalRequest?.model,
+					messages: _originalRequest?.messages,
+					stream: _originalRequest?.stream,
+					tools: _originalRequest?.tools,
+					system: _originalRequest?.system
+				}
+			};
+			if (_response) entry.response = _response;
+			return entry;
+		}
+	};
+	return ctx;
 }
 
 //#endregion
-//#region src/lib/shell.ts
-function getShell() {
-	const { platform, ppid, env } = process$1;
-	if (platform === "win32") {
-		try {
-			if (execSync(`wmic process get ParentProcessId,Name | findstr "${ppid}"`, { stdio: "pipe" }).toString().toLowerCase().includes("powershell.exe")) return "powershell";
-		} catch {
-			return "cmd";
+//#region src/lib/context/manager.ts
+/**
+* RequestContextManager — Active request management
+*
+* Manages all in-flight RequestContext instances. Publishes events for
+* WebSocket push and history persistence.
+*/
+let _manager = null;
+function initRequestContextManager(staleMaxAgeSec) {
+	_manager = createRequestContextManager(staleMaxAgeSec);
+	return _manager;
+}
+const REAPER_INTERVAL_MS = 6e4;
+const DEFAULT_STALE_MAX_AGE_SEC = 600;
+function createRequestContextManager(staleMaxAgeSec) {
+	const maxAgeSec = staleMaxAgeSec ?? DEFAULT_STALE_MAX_AGE_SEC;
+	const activeContexts = /* @__PURE__ */ new Map();
+	const listeners = /* @__PURE__ */ new Set();
+	let reaperTimer = null;
+	function runReaperOnce() {
+		if (maxAgeSec <= 0) return;
+		const maxAgeMs = maxAgeSec * 1e3;
+		for (const [id, ctx] of activeContexts) if (ctx.durationMs > maxAgeMs) {
+			consola.warn(`[context] Force-failing stale request ${id} (endpoint: ${ctx.endpoint}, model: ${ctx.originalRequest?.model ?? "unknown"}, state: ${ctx.state}, age: ${Math.round(ctx.durationMs / 1e3)}s, max: ${maxAgeSec}s)`);
+			ctx.fail(ctx.originalRequest?.model ?? "unknown", /* @__PURE__ */ new Error(`Request exceeded maximum age of ${maxAgeSec}s (stale context reaper)`));
 		}
-		return "cmd";
-	} else {
-		const shellPath = env.SHELL;
-		if (shellPath) {
-			if (shellPath.endsWith("zsh")) return "zsh";
-			if (shellPath.endsWith("fish")) return "fish";
-			if (shellPath.endsWith("bash")) return "bash";
+	}
+	function startReaper() {
+		if (reaperTimer) return;
+		reaperTimer = setInterval(runReaperOnce, REAPER_INTERVAL_MS);
+	}
+	function stopReaper() {
+		if (reaperTimer) {
+			clearInterval(reaperTimer);
+			reaperTimer = null;
 		}
-		return "sh";
 	}
-}
-/**
-* Generates a copy-pasteable script to set multiple environment variables
-* and run a subsequent command.
-* @param {EnvVars} envVars - An object of environment variables to set.
-* @param {string} commandToRun - The command to run after setting the variables.
-* @returns {string} The formatted script string.
-*/
-function generateEnvScript(envVars, commandToRun = "") {
-	const shell = getShell();
-	const filteredEnvVars = Object.entries(envVars).filter(([, value]) => value !== void 0);
-	let commandBlock;
-	switch (shell) {
-		case "powershell":
-			commandBlock = filteredEnvVars.map(([key, value]) => `$env:${key} = "${value.replaceAll("\"", "`\"")}"`).join("; ");
-			break;
-		case "cmd":
-			commandBlock = filteredEnvVars.map(([key, value]) => `set ${key}=${value}`).join(" & ");
-			break;
-		case "fish":
-			commandBlock = filteredEnvVars.map(([key, value]) => `set -gx ${key} "${value.replaceAll("\"", String.raw`\"`)}"`).join("; ");
-			break;
-		default: {
-			const assignments = filteredEnvVars.map(([key, value]) => `${key}="${value.replaceAll("\"", String.raw`\"`)}"`).join(" ");
-			commandBlock = filteredEnvVars.length > 0 ? `export ${assignments}` : "";
-			break;
+	function emit(event) {
+		for (const listener of listeners) try {
+			listener(event);
+		} catch {}
+	}
+	function handleContextEvent(rawEvent) {
+		const { type, context } = rawEvent;
+		switch (type) {
+			case "state_changed":
+				if (rawEvent.previousState) emit({
+					type: "state_changed",
+					context,
+					previousState: rawEvent.previousState
+				});
+				break;
+			case "updated":
+				if (rawEvent.field) emit({
+					type: "updated",
+					context,
+					field: rawEvent.field
+				});
+				break;
+			case "completed":
+				if (rawEvent.entry) emit({
+					type: "completed",
+					context,
+					entry: rawEvent.entry
+				});
+				activeContexts.delete(context.id);
+				break;
+			case "failed":
+				if (rawEvent.entry) emit({
+					type: "failed",
+					context,
+					entry: rawEvent.entry
+				});
+				activeContexts.delete(context.id);
+				break;
+			default: break;
 		}
 	}
-	if (commandBlock && commandToRun) return `${commandBlock}${shell === "cmd" ? " & " : " && "}${commandToRun}`;
-	return commandBlock || commandToRun;
+	return {
+		create(opts) {
+			const ctx = createRequestContext({
+				endpoint: opts.endpoint,
+				tuiLogId: opts.tuiLogId,
+				onEvent: handleContextEvent
+			});
+			activeContexts.set(ctx.id, ctx);
+			emit({
+				type: "created",
+				context: ctx
+			});
+			return ctx;
+		},
+		get(id) {
+			return activeContexts.get(id);
+		},
+		getAll() {
+			return Array.from(activeContexts.values());
+		},
+		get activeCount() {
+			return activeContexts.size;
+		},
+		on(_event, listener) {
+			listeners.add(listener);
+		},
+		off(_event, listener) {
+			listeners.delete(listener);
+		},
+		startReaper,
+		stopReaper,
+		_runReaperOnce: runReaperOnce
+	};
 }
 
 //#endregion
-//#region src/lib/shutdown.ts
-const DRAIN_POLL_INTERVAL_MS = 500;
-const DRAIN_PROGRESS_INTERVAL_MS = 5e3;
-let serverInstance = null;
-let _isShuttingDown = false;
-let shutdownResolve = null;
-let shutdownAbortController = null;
-function getIsShuttingDown() {
-	return _isShuttingDown;
-}
-function setServerInstance(server) {
-	serverInstance = server;
-}
-function formatActiveRequestsSummary(requests) {
-	const now = Date.now();
-	const lines = requests.map((req) => {
-		const age = Math.round((now - req.startTime) / 1e3);
-		const model = req.model || "unknown";
-		const tags = req.tags?.length ? ` [${req.tags.join(", ")}]` : "";
-		return `  ${req.method} ${req.path} ${model} (${req.status}, ${age}s)${tags}`;
-	});
-	return `Waiting for ${requests.length} active request(s):\n${lines.join("\n")}`;
+//#region src/lib/hidden-models.ts
+/**
+* Hardcoded list of GitHub Copilot model ids that are hidden from listing
+* endpoints (the /v1/models response, the startup ASCII banner, and the
+* --claude-code interactive prompts), unless `--show-all-models` is passed.
+*
+* Note: this is a DISPLAY filter only. Explicit POSTs to handler endpoints
+* with a hidden id are NOT rejected — they pass through to upstream verbatim.
+*
+* Bumping the list requires a code change + release. No env var, no config
+* file, no CLI append interface.
+*/
+const HIDDEN_MODEL_IDS = new Set([
+	"gpt-3.5-turbo",
+	"gpt-3.5-turbo-0613",
+	"gpt-4",
+	"gpt-4-0613",
+	"gpt-4-0125-preview",
+	"gpt-4o",
+	"gpt-4o-mini",
+	"gpt-4-o-preview",
+	"gpt-4o-2024-05-13",
+	"gpt-4o-2024-08-06",
+	"gpt-4o-2024-11-20",
+	"gpt-4o-mini-2024-07-18",
+	"gpt-4.1",
+	"gpt-4.1-2025-04-14",
+	"gpt-41-copilot",
+	"gpt-5-mini",
+	"gpt-5.3-codex",
+	"gpt-5.4",
+	"text-embedding-ada-002",
+	"text-embedding-3-small",
+	"text-embedding-3-small-inference",
+	"gemini-2.5-pro",
+	"gemini-3-flash-preview",
+	"claude-opus-4.5",
+	"claude-opus-4.6",
+	"claude-opus-4.7-high",
+	"claude-opus-4.7-xhigh",
+	"claude-sonnet-4.5",
+	"mai-code-1-flash-internal",
+	"trajectory-compaction"
+]);
+function isHiddenModel(id, showAll) {
+	if (showAll) return false;
+	return HIDDEN_MODEL_IDS.has(id);
 }
-async function drainActiveRequests(timeoutMs, tracker, opts) {
-	const pollInterval = opts?.pollIntervalMs ?? DRAIN_POLL_INTERVAL_MS;
-	const progressInterval = opts?.progressIntervalMs ?? DRAIN_PROGRESS_INTERVAL_MS;
-	const deadline = Date.now() + timeoutMs;
-	let lastProgressLog = 0;
-	while (Date.now() < deadline) {
-		const active = tracker.getActiveRequests();
-		if (active.length === 0) return "drained";
-		const now = Date.now();
-		if (now - lastProgressLog >= progressInterval) {
-			lastProgressLog = now;
-			consola.info(formatActiveRequestsSummary(active));
-		}
-		await new Promise((resolve) => setTimeout(resolve, pollInterval));
+
+//#endregion
+//#region src/lib/tokenizer.ts
+const ENCODING_MAP = {
+	o200k_base: () => import("gpt-tokenizer/encoding/o200k_base"),
+	cl100k_base: () => import("gpt-tokenizer/encoding/cl100k_base"),
+	p50k_base: () => import("gpt-tokenizer/encoding/p50k_base"),
+	p50k_edit: () => import("gpt-tokenizer/encoding/p50k_edit"),
+	r50k_base: () => import("gpt-tokenizer/encoding/r50k_base")
+};
+const encodingCache = /* @__PURE__ */ new Map();
+const encodingInflight = /* @__PURE__ */ new Map();
+/**
+* Calculate tokens for tool calls
+*/
+const calculateToolCallsTokens = (toolCalls, encoder, constants) => {
+	let tokens = 0;
+	for (const toolCall of toolCalls) {
+		tokens += constants.funcInit;
+		tokens += encoder.encode(JSON.stringify(toolCall)).length;
+	}
+	tokens += constants.funcEnd;
+	return tokens;
+};
+/**
+* Calculate tokens for content parts
+*/
+const calculateContentPartsTokens = (contentParts, encoder) => {
+	let tokens = 0;
+	for (const part of contentParts) if (part.type === "image_url") tokens += encoder.encode(part.image_url.url).length + 85;
+	else if (part.text) tokens += encoder.encode(part.text).length;
+	return tokens;
+};
+/**
+* Calculate tokens for a single message
+*/
+const calculateMessageTokens = (message, encoder, constants) => {
+	const tokensPerMessage = 3;
+	const tokensPerName = 1;
+	let tokens = tokensPerMessage;
+	for (const [key, value] of Object.entries(message)) {
+		if (typeof value === "string") tokens += encoder.encode(value).length;
+		if (key === "name") tokens += tokensPerName;
+		if (key === "tool_calls") tokens += calculateToolCallsTokens(value, encoder, constants);
+		if (key === "content" && Array.isArray(value)) tokens += calculateContentPartsTokens(value, encoder);
 	}
-	return "timeout";
-}
-async function gracefulShutdown(signal, deps) {
-	const tracker = deps?.tracker;
-	const server = deps?.server ?? serverInstance;
-	const rateLimiter = deps?.rateLimiter !== void 0 ? deps.rateLimiter : getAdaptiveRateLimiter();
-	const stopRefresh = deps?.stopTokenRefreshFn ?? (() => {});
-	const closeWsClients = deps?.closeAllClientsFn ?? closeAllClients;
-	const getWsCount = deps?.getClientCountFn ?? getClientCount;
-	const gracefulWaitMs = deps?.gracefulWaitMs ?? state.shutdownGracefulWait * 1e3;
-	const abortWaitMs = deps?.abortWaitMs ?? state.shutdownAbortWait * 1e3;
-	const drainOpts = {
-		pollIntervalMs: deps?.drainPollIntervalMs ?? DRAIN_POLL_INTERVAL_MS,
-		progressIntervalMs: deps?.drainProgressIntervalMs ?? DRAIN_PROGRESS_INTERVAL_MS
-	};
-	_isShuttingDown = true;
-	shutdownAbortController = new AbortController();
-	consola.info(`Received ${signal}, shutting down gracefully...`);
+	return tokens;
+};
+/**
+* Calculate tokens using custom algorithm
+*/
+const calculateTokens = (messages, encoder, constants) => {
+	if (messages.length === 0) return 0;
+	let numTokens = 0;
+	for (const message of messages) numTokens += calculateMessageTokens(message, encoder, constants);
+	numTokens += 3;
+	return numTokens;
+};
+/**
+* Get the corresponding encoder module based on encoding type. Resolved
+* encoders are cached; concurrent first-loads are de-duplicated via the
+* in-flight map; and the cold BPE-table import is timed under TOKENIZE_COLD so
+* a first-request stall is distinguishable from steady-state encode cost.
+*/
+const getEncodeChatFunction = async (encoding) => {
+	const cached = encodingCache.get(encoding);
+	if (cached) return cached;
+	const inflight = encodingInflight.get(encoding);
+	if (inflight) return inflight;
+	const loader = encoding in ENCODING_MAP ? ENCODING_MAP[encoding] : ENCODING_MAP.o200k_base;
+	const loadPromise = (async () => {
+		const start = performance.now();
+		const mod = await loader();
+		addTiming(TIMING.TOKENIZE_COLD, performance.now() - start);
+		encodingCache.set(encoding, mod);
+		return mod;
+	})();
+	encodingInflight.set(encoding, loadPromise);
 	try {
-		deps?.contextManager?.stopReaper();
-	} catch {}
-	stopMemoryPressureMonitor();
-	stopRefresh();
-	const wsClients = getWsCount();
-	if (wsClients > 0) {
-		closeWsClients();
-		consola.info(`Disconnected ${wsClients} WebSocket client(s)`);
+		return await loadPromise;
+	} finally {
+		encodingInflight.delete(encoding);
 	}
-	if (rateLimiter) {
-		const rejected = rateLimiter.rejectQueued();
-		if (rejected > 0) consola.info(`Rejected ${rejected} queued request(s) from rate limiter`);
+};
+/**
+* Pre-load the default encoder at startup so the first burst of concurrent
+* requests doesn't pay the cold BPE-table import on the shared event loop.
+*/
+async function warmupTokenizer() {
+	await getEncodeChatFunction("o200k_base");
+}
+/**
+* Get tokenizer type from model information
+*/
+const getTokenizerFromModel = (model) => {
+	return model.capabilities?.tokenizer || "o200k_base";
+};
+/**
+* Count tokens in a text string using the model's tokenizer.
+* This is a simple wrapper for counting tokens in plain text.
+*/
+const countTextTokens = async (text, model) => {
+	const encoder = await getEncodeChatFunction(getTokenizerFromModel(model));
+	return timeSync(TIMING.TOKENIZE, () => encoder.encode(text).length);
+};
+/**
+* Get model-specific constants for token calculation.
+* These values are empirically determined based on OpenAI's function calling token overhead.
+* - funcInit: Tokens for initializing a function definition
+* - propInit: Tokens for initializing the properties section
+* - propKey: Tokens per property key
+* - enumInit: Token adjustment when enum is present (negative because type info is replaced)
+* - enumItem: Tokens per enum value
+* - funcEnd: Tokens for closing the function definition
+*/
+const getModelConstants = (model) => {
+	return model.id === "gpt-3.5-turbo" || model.id === "gpt-4" ? {
+		funcInit: 10,
+		propInit: 3,
+		propKey: 3,
+		enumInit: -3,
+		enumItem: 3,
+		funcEnd: 12
+	} : {
+		funcInit: 7,
+		propInit: 3,
+		propKey: 3,
+		enumInit: -3,
+		enumItem: 3,
+		funcEnd: 12
+	};
+};
+/**
+* Calculate tokens for a single parameter
+*/
+const calculateParameterTokens = (key, prop, context) => {
+	const { encoder, constants } = context;
+	let tokens = constants.propKey;
+	if (typeof prop !== "object" || prop === null) return tokens;
+	const param = prop;
+	const paramName = key;
+	const paramType = param.type || "string";
+	let paramDesc = param.description || "";
+	if (param.enum && Array.isArray(param.enum)) {
+		tokens += constants.enumInit;
+		for (const item of param.enum) {
+			tokens += constants.enumItem;
+			tokens += encoder.encode(String(item)).length;
+		}
 	}
-	if (server) {
-		server.close(false).catch((error) => {
-			consola.error("Error stopping listener:", error);
-		});
-		consola.info("Stopped accepting new connections");
+	if (paramDesc.endsWith(".")) paramDesc = paramDesc.slice(0, -1);
+	const line = `${paramName}:${paramType}:${paramDesc}`;
+	tokens += encoder.encode(line).length;
+	const excludedKeys = new Set([
+		"type",
+		"description",
+		"enum"
+	]);
+	for (const propertyName of Object.keys(param)) if (!excludedKeys.has(propertyName)) {
+		const propertyValue = param[propertyName];
+		const propertyText = typeof propertyValue === "string" ? propertyValue : JSON.stringify(propertyValue);
+		tokens += encoder.encode(`${propertyName}:${propertyText}`).length;
 	}
-	if (tracker) {
-		const activeCount = tracker.getActiveRequests().length;
-		if (activeCount > 0) {
-			consola.info(`Phase 2: Waiting up to ${gracefulWaitMs / 1e3}s for ${activeCount} active request(s)...`);
-			try {
-				if (await drainActiveRequests(gracefulWaitMs, tracker, drainOpts) === "drained") {
-					consola.info("All requests completed naturally");
-					await finalize(tracker);
-					return;
-				}
-			} catch (error) {
-				consola.error("Error during Phase 2 drain:", error);
-			}
-			const remaining = tracker.getActiveRequests().length;
-			consola.info(`Phase 3: Sending abort signal to ${remaining} remaining request(s), waiting up to ${abortWaitMs / 1e3}s...`);
-			shutdownAbortController.abort();
-			try {
-				if (await drainActiveRequests(abortWaitMs, tracker, drainOpts) === "drained") {
-					consola.info("All requests completed after abort signal");
-					await finalize(tracker);
-					return;
-				}
-			} catch (error) {
-				consola.error("Error during Phase 3 drain:", error);
-			}
-			const forceRemaining = tracker.getActiveRequests().length;
-			consola.warn(`Phase 4: Force-closing ${forceRemaining} remaining request(s)`);
-			if (server) try {
-				await server.close(true);
-			} catch (error) {
-				consola.error("Error force-closing server:", error);
-			}
+	return tokens;
+};
+/**
+* Calculate tokens for function parameters
+*/
+const calculateParametersTokens = (parameters, encoder, constants) => {
+	if (!parameters || typeof parameters !== "object") return 0;
+	const params = parameters;
+	let tokens = 0;
+	for (const [key, value] of Object.entries(params)) if (key === "properties") {
+		const properties = value;
+		if (Object.keys(properties).length > 0) {
+			tokens += constants.propInit;
+			for (const propKey of Object.keys(properties)) tokens += calculateParameterTokens(propKey, properties[propKey], {
+				encoder,
+				constants
+			});
 		}
-		await finalize(tracker);
 	} else {
-		await shutdownPostHog();
-		consola.info("Shutdown complete");
-		shutdownResolve?.();
+		const paramText = typeof value === "string" ? value : JSON.stringify(value);
+		tokens += encoder.encode(`${key}:${paramText}`).length;
 	}
-}
-async function finalize(tracker) {
-	await shutdownPostHog();
-	tracker.destroy();
-	consola.info("Shutdown complete");
-	shutdownResolve?.();
-}
-function setupShutdownHandlers() {
-	const handler = (signal) => {
-		if (_isShuttingDown) {
-			consola.warn("Second signal received, forcing immediate exit");
-			process.exit(1);
-		}
-		gracefulShutdown(signal).catch((error) => {
-			consola.error("Fatal error during shutdown:", error);
-			shutdownResolve?.();
-			process.exit(1);
-		});
-	};
-	process.on("SIGINT", () => handler("SIGINT"));
-	process.on("SIGTERM", () => handler("SIGTERM"));
-}
+	return tokens;
+};
+/**
+* Calculate tokens for a single tool
+*/
+const calculateToolTokens = (tool, encoder, constants) => {
+	let tokens = constants.funcInit;
+	const func = tool.function;
+	const fName = func.name;
+	let fDesc = func.description || "";
+	if (fDesc.endsWith(".")) fDesc = fDesc.slice(0, -1);
+	const line = fName + ":" + fDesc;
+	tokens += encoder.encode(line).length;
+	if (typeof func.parameters === "object" && func.parameters !== null) tokens += calculateParametersTokens(func.parameters, encoder, constants);
+	return tokens;
+};
+/**
+* Calculate token count for tools based on model
+*/
+const numTokensForTools = (tools, encoder, constants) => {
+	let funcTokenCount = 0;
+	for (const tool of tools) funcTokenCount += calculateToolTokens(tool, encoder, constants);
+	funcTokenCount += constants.funcEnd;
+	return funcTokenCount;
+};
+/**
+* Calculate the token count of messages.
+* Uses the tokenizer specified by the GitHub Copilot API model info.
+* All models (including Claude) use GPT tokenizers (o200k_base or cl100k_base).
+*/
+const getTokenCount = async (payload, model) => {
+	const encoder = await getEncodeChatFunction(getTokenizerFromModel(model));
+	return timeSync(TIMING.TOKENIZE, () => {
+		const simplifiedMessages = payload.messages;
+		const inputMessages = simplifiedMessages.filter((msg) => msg.role !== "assistant");
+		const outputMessages = simplifiedMessages.filter((msg) => msg.role === "assistant");
+		const constants = getModelConstants(model);
+		let inputTokens = calculateTokens(inputMessages, encoder, constants);
+		if (payload.tools && payload.tools.length > 0) inputTokens += numTokensForTools(payload.tools, encoder, constants);
+		const outputTokens = calculateTokens(outputMessages, encoder, constants);
+		return {
+			input: inputTokens,
+			output: outputTokens
+		};
+	});
+};
 
 //#endregion
 //#region src/lib/tui/console-renderer.ts
@@ -3154,7 +2856,7 @@ var ConsoleRenderer = class {
 	* Format a complete log line with colored parts
 	*/
 	formatLogLine(parts) {
-		const { prefix, time, method, path, model, status, duration, tokens, queueWait, extra, isError, isDim } = parts;
+		const { prefix, time, method, path, model, status, duration, tokens, queueWait, phases, extra, isError, isDim } = parts;
 		if (isDim) {
 			const modelPart = model ? ` ${model}` : "";
 			const extraPart = extra ? ` ${extra}` : "";
@@ -3168,6 +2870,7 @@ var ConsoleRenderer = class {
 		if (duration) result += ` ${pc.yellow(duration)}`;
 		if (queueWait) result += ` ${pc.dim(`(queued ${queueWait})`)}`;
 		if (tokens) result += ` ${pc.blue(tokens)}`;
+		if (phases) result += ` ${pc.dim(phases)}`;
 		if (extra) result += isError ? pc.red(extra) : extra;
 		return result;
 	}
@@ -3188,6 +2891,19 @@ var ConsoleRenderer = class {
 		if (request.resolvedModel) return `${request.model} -> ${request.resolvedModel}`;
 		return request.model;
 	}
+	/**
+	* Compact per-phase timing breakdown for the complete line, e.g.
+	* "tok=86ms ttfb=120ms". Only non-zero phases are shown, so a request that
+	* skipped a phase stays terse.
+	*/
+	formatPhases(request) {
+		const parts = [];
+		if (request.tokenizeMs) parts.push(`tok=${formatDuration(Math.round(request.tokenizeMs))}`);
+		if (request.tokenizeColdMs) parts.push(`tok+=${formatDuration(Math.round(request.tokenizeColdMs))}`);
+		if (request.upstreamTtfbMs) parts.push(`ttfb=${formatDuration(Math.round(request.upstreamTtfbMs))}`);
+		if (request.limiterRetries) parts.push(`retries=${request.limiterRetries}`);
+		return parts.length > 0 ? parts.join(" ") : void 0;
+	}
 	onRequestStart(request) {
 		this.activeRequests.set(request.id, request);
 		if (this.showActive && consola.level >= 5) {
@@ -3236,6 +2952,7 @@ var ConsoleRenderer = class {
 			duration: formatDuration(request.durationMs ?? 0),
 			queueWait,
 			tokens,
+			phases: this.formatPhases(request),
 			extra: isError && request.error ? `: ${request.error}` : void 0,
 			isError,
 			isDim: request.isHistoryAccess
@@ -3255,7 +2972,7 @@ var ConsoleRenderer = class {
 //#endregion
 //#region src/lib/tui/tracker.ts
 function generateId() {
-	return Date.now().toString(36) + Math.random().toString(36).slice(2, 6);
+	return randomUUID();
 }
 var RequestTracker = class {
 	requests = /* @__PURE__ */ new Map();
@@ -3286,6 +3003,7 @@ var RequestTracker = class {
 			status: "executing",
 			isHistoryAccess: options.isHistoryAccess
 		};
+		if (this.requests.has(id)) consola.warn(`[tracker] request id collision, overwriting in-flight: ${id}`);
 		this.requests.set(id, request);
 		this.renderer?.onRequestStart(request);
 		return id;
@@ -3305,6 +3023,10 @@ var RequestTracker = class {
 		if (update.error !== void 0) request.error = update.error;
 		if (update.queuePosition !== void 0) request.queuePosition = update.queuePosition;
 		if (update.queueWaitMs !== void 0) request.queueWaitMs = update.queueWaitMs;
+		for (const key of Object.values(TIMING)) {
+			const value = update[key];
+			if (value !== void 0) request[key] = value;
+		}
 		this.renderer?.onRequestUpdate(id, update);
 	}
 	/**
@@ -3397,35 +3119,39 @@ const requestTracker = new RequestTracker();
 function tuiLogger() {
 	return async (c, next) => {
 		if (getIsShuttingDown()) return c.json({ error: "Server is shutting down" }, 503);
-		const method = c.req.method;
-		const path = c.req.path;
-		const isHistoryAccess = path.startsWith("/history");
-		const trackingId = requestTracker.startRequest({
-			method,
-			path,
-			model: "",
-			isHistoryAccess
-		});
-		c.set("trackingId", trackingId);
-		try {
-			await next();
-			if ((c.res.headers.get("content-type") ?? "").includes("text/event-stream")) return;
-			const status = c.res.status;
-			const inputTokens = c.res.headers.get("x-input-tokens");
-			const outputTokens = c.res.headers.get("x-output-tokens");
-			const model = c.res.headers.get("x-model");
-			if (model) {
-				const request = requestTracker.getRequest(trackingId);
-				if (request) request.model = model;
+		return runWithTimings(async () => {
+			const method = c.req.method;
+			const path = c.req.path;
+			const isHistoryAccess = path.startsWith("/history");
+			const trackingId = requestTracker.startRequest({
+				method,
+				path,
+				model: "",
+				isHistoryAccess
+			});
+			c.set("trackingId", trackingId);
+			try {
+				await next();
+				if ((c.res.headers.get("content-type") ?? "").includes("text/event-stream")) return;
+				const status = c.res.status;
+				const inputTokens = c.res.headers.get("x-input-tokens");
+				const outputTokens = c.res.headers.get("x-output-tokens");
+				const model = c.res.headers.get("x-model");
+				if (model) {
+					const request = requestTracker.getRequest(trackingId);
+					if (request) request.model = model;
+				}
+				requestTracker.updateRequest(trackingId, timingsToUpdate(getTimings()));
+				requestTracker.completeRequest(trackingId, status, inputTokens && outputTokens ? {
+					inputTokens: Number.parseInt(inputTokens, 10),
+					outputTokens: Number.parseInt(outputTokens, 10)
+				} : void 0);
+			} catch (error) {
+				requestTracker.updateRequest(trackingId, timingsToUpdate(getTimings()));
+				requestTracker.failRequest(trackingId, error instanceof Error ? error.message : "Unknown error");
+				throw error;
 			}
-			requestTracker.completeRequest(trackingId, status, inputTokens && outputTokens ? {
-				inputTokens: Number.parseInt(inputTokens, 10),
-				outputTokens: Number.parseInt(outputTokens, 10)
-			} : void 0);
-		} catch (error) {
-			requestTracker.failRequest(trackingId, error instanceof Error ? error.message : "Unknown error");
-			throw error;
-		}
+		});
 	};
 }
 
@@ -3471,218 +3197,6 @@ function removeSystemReminderTags(text) {
 	return result;
 }
 
-//#endregion
-//#region src/lib/tokenizer.ts
-const ENCODING_MAP = {
-	o200k_base: () => import("gpt-tokenizer/encoding/o200k_base"),
-	cl100k_base: () => import("gpt-tokenizer/encoding/cl100k_base"),
-	p50k_base: () => import("gpt-tokenizer/encoding/p50k_base"),
-	p50k_edit: () => import("gpt-tokenizer/encoding/p50k_edit"),
-	r50k_base: () => import("gpt-tokenizer/encoding/r50k_base")
-};
-const encodingCache = /* @__PURE__ */ new Map();
-/**
-* Calculate tokens for tool calls
-*/
-const calculateToolCallsTokens = (toolCalls, encoder, constants) => {
-	let tokens = 0;
-	for (const toolCall of toolCalls) {
-		tokens += constants.funcInit;
-		tokens += encoder.encode(JSON.stringify(toolCall)).length;
-	}
-	tokens += constants.funcEnd;
-	return tokens;
-};
-/**
-* Calculate tokens for content parts
-*/
-const calculateContentPartsTokens = (contentParts, encoder) => {
-	let tokens = 0;
-	for (const part of contentParts) if (part.type === "image_url") tokens += encoder.encode(part.image_url.url).length + 85;
-	else if (part.text) tokens += encoder.encode(part.text).length;
-	return tokens;
-};
-/**
-* Calculate tokens for a single message
-*/
-const calculateMessageTokens = (message, encoder, constants) => {
-	const tokensPerMessage = 3;
-	const tokensPerName = 1;
-	let tokens = tokensPerMessage;
-	for (const [key, value] of Object.entries(message)) {
-		if (typeof value === "string") tokens += encoder.encode(value).length;
-		if (key === "name") tokens += tokensPerName;
-		if (key === "tool_calls") tokens += calculateToolCallsTokens(value, encoder, constants);
-		if (key === "content" && Array.isArray(value)) tokens += calculateContentPartsTokens(value, encoder);
-	}
-	return tokens;
-};
-/**
-* Calculate tokens using custom algorithm
-*/
-const calculateTokens = (messages, encoder, constants) => {
-	if (messages.length === 0) return 0;
-	let numTokens = 0;
-	for (const message of messages) numTokens += calculateMessageTokens(message, encoder, constants);
-	numTokens += 3;
-	return numTokens;
-};
-/**
-* Get the corresponding encoder module based on encoding type
-*/
-const getEncodeChatFunction = async (encoding) => {
-	if (encodingCache.has(encoding)) {
-		const cached = encodingCache.get(encoding);
-		if (cached) return cached;
-	}
-	const supportedEncoding = encoding;
-	if (!(supportedEncoding in ENCODING_MAP)) {
-		const fallbackModule = await ENCODING_MAP.o200k_base();
-		encodingCache.set(encoding, fallbackModule);
-		return fallbackModule;
-	}
-	const encodingModule = await ENCODING_MAP[supportedEncoding]();
-	encodingCache.set(encoding, encodingModule);
-	return encodingModule;
-};
-/**
-* Get tokenizer type from model information
-*/
-const getTokenizerFromModel = (model) => {
-	return model.capabilities?.tokenizer || "o200k_base";
-};
-/**
-* Count tokens in a text string using the model's tokenizer.
-* This is a simple wrapper for counting tokens in plain text.
-*/
-const countTextTokens = async (text, model) => {
-	return (await getEncodeChatFunction(getTokenizerFromModel(model))).encode(text).length;
-};
-/**
-* Get model-specific constants for token calculation.
-* These values are empirically determined based on OpenAI's function calling token overhead.
-* - funcInit: Tokens for initializing a function definition
-* - propInit: Tokens for initializing the properties section
-* - propKey: Tokens per property key
-* - enumInit: Token adjustment when enum is present (negative because type info is replaced)
-* - enumItem: Tokens per enum value
-* - funcEnd: Tokens for closing the function definition
-*/
-const getModelConstants = (model) => {
-	return model.id === "gpt-3.5-turbo" || model.id === "gpt-4" ? {
-		funcInit: 10,
-		propInit: 3,
-		propKey: 3,
-		enumInit: -3,
-		enumItem: 3,
-		funcEnd: 12
-	} : {
-		funcInit: 7,
-		propInit: 3,
-		propKey: 3,
-		enumInit: -3,
-		enumItem: 3,
-		funcEnd: 12
-	};
-};
-/**
-* Calculate tokens for a single parameter
-*/
-const calculateParameterTokens = (key, prop, context) => {
-	const { encoder, constants } = context;
-	let tokens = constants.propKey;
-	if (typeof prop !== "object" || prop === null) return tokens;
-	const param = prop;
-	const paramName = key;
-	const paramType = param.type || "string";
-	let paramDesc = param.description || "";
-	if (param.enum && Array.isArray(param.enum)) {
-		tokens += constants.enumInit;
-		for (const item of param.enum) {
-			tokens += constants.enumItem;
-			tokens += encoder.encode(String(item)).length;
-		}
-	}
-	if (paramDesc.endsWith(".")) paramDesc = paramDesc.slice(0, -1);
-	const line = `${paramName}:${paramType}:${paramDesc}`;
-	tokens += encoder.encode(line).length;
-	const excludedKeys = new Set([
-		"type",
-		"description",
-		"enum"
-	]);
-	for (const propertyName of Object.keys(param)) if (!excludedKeys.has(propertyName)) {
-		const propertyValue = param[propertyName];
-		const propertyText = typeof propertyValue === "string" ? propertyValue : JSON.stringify(propertyValue);
-		tokens += encoder.encode(`${propertyName}:${propertyText}`).length;
-	}
-	return tokens;
-};
-/**
-* Calculate tokens for function parameters
-*/
-const calculateParametersTokens = (parameters, encoder, constants) => {
-	if (!parameters || typeof parameters !== "object") return 0;
-	const params = parameters;
-	let tokens = 0;
-	for (const [key, value] of Object.entries(params)) if (key === "properties") {
-		const properties = value;
-		if (Object.keys(properties).length > 0) {
-			tokens += constants.propInit;
-			for (const propKey of Object.keys(properties)) tokens += calculateParameterTokens(propKey, properties[propKey], {
-				encoder,
-				constants
-			});
-		}
-	} else {
-		const paramText = typeof value === "string" ? value : JSON.stringify(value);
-		tokens += encoder.encode(`${key}:${paramText}`).length;
-	}
-	return tokens;
-};
-/**
-* Calculate tokens for a single tool
-*/
-const calculateToolTokens = (tool, encoder, constants) => {
-	let tokens = constants.funcInit;
-	const func = tool.function;
-	const fName = func.name;
-	let fDesc = func.description || "";
-	if (fDesc.endsWith(".")) fDesc = fDesc.slice(0, -1);
-	const line = fName + ":" + fDesc;
-	tokens += encoder.encode(line).length;
-	if (typeof func.parameters === "object" && func.parameters !== null) tokens += calculateParametersTokens(func.parameters, encoder, constants);
-	return tokens;
-};
-/**
-* Calculate token count for tools based on model
-*/
-const numTokensForTools = (tools, encoder, constants) => {
-	let funcTokenCount = 0;
-	for (const tool of tools) funcTokenCount += calculateToolTokens(tool, encoder, constants);
-	funcTokenCount += constants.funcEnd;
-	return funcTokenCount;
-};
-/**
-* Calculate the token count of messages.
-* Uses the tokenizer specified by the GitHub Copilot API model info.
-* All models (including Claude) use GPT tokenizers (o200k_base or cl100k_base).
-*/
-const getTokenCount = async (payload, model) => {
-	const encoder = await getEncodeChatFunction(getTokenizerFromModel(model));
-	const simplifiedMessages = payload.messages;
-	const inputMessages = simplifiedMessages.filter((msg) => msg.role !== "assistant");
-	const outputMessages = simplifiedMessages.filter((msg) => msg.role === "assistant");
-	const constants = getModelConstants(model);
-	let inputTokens = calculateTokens(inputMessages, encoder, constants);
-	if (payload.tools && payload.tools.length > 0) inputTokens += numTokensForTools(payload.tools, encoder, constants);
-	const outputTokens = calculateTokens(outputMessages, encoder, constants);
-	return {
-		input: inputTokens,
-		output: outputTokens
-	};
-};
-
 //#endregion
 //#region src/lib/auto-truncate-openai.ts
 /**
@@ -4636,13 +4150,14 @@ function updateTrackerStatus(trackingId, status) {
 	requestTracker.updateRequest(trackingId, { status });
 }
 /** Complete TUI tracking and send PostHog analytics */
-function completeTracking(trackingId, inputTokens, outputTokens, queueWaitMs, reasoningTokens, analytics) {
+function completeTracking(trackingId, inputTokens, outputTokens, queueWaitMs, reasoningTokens, analytics, timings) {
 	if (!trackingId) return;
 	requestTracker.updateRequest(trackingId, {
 		inputTokens,
 		outputTokens,
 		queueWaitMs,
-		reasoningTokens
+		reasoningTokens,
+		...timingsToUpdate(timings)
 	});
 	requestTracker.completeRequest(trackingId, 200, {
 		inputTokens,
@@ -4688,7 +4203,8 @@ function createEntryContext(args) {
 			historyId: recordRequest(args.endpoint, args.buildHistoryRequest(payload)),
 			trackingId,
 			startTime,
-			requestedModel
+			requestedModel,
+			timings: getTimings()
 		}
 	};
 }
@@ -4944,7 +4460,7 @@ async function handleStreamingResponse$1(opts) {
 			durationMs: Date.now() - ctx.startTime,
 			stopReason: acc.finishReason || void 0,
 			toolCount: payload.tools?.length ?? 0
-		});
+		}, ctx.timings);
 	} catch (error) {
 		recordStreamError({
 			acc,
@@ -7399,8 +6915,9 @@ const SSE_PING = ": ping\n\n";
 /**
 * Grace period before opening a keepalive stream. Normal upstream responses
 * resolve sub-second (response headers arrive immediately, the body is not
-* buffered); only a request queued behind the rate limiter takes >=10s. 3s
-* cleanly separates the two — a request still pending after 3s is queued.
+* buffered); only a request retrying behind the rate limiter's backoff stays
+* pending for seconds. 3s cleanly separates the two — a request still pending
+* after 3s is backing off.
 */
 const RATE_LIMIT_GRACE_MS = 3e3;
 /**
@@ -8887,7 +8404,7 @@ async function handleDirectAnthropicStreamingResponse(opts) {
 			durationMs: Date.now() - ctx.startTime,
 			stopReason: acc.stopReason || void 0,
 			toolCount: anthropicPayload.tools?.length ?? 0
-		});
+		}, ctx.timings);
 	} catch (error) {
 		consola.error("Direct Anthropic stream error:", formatError(error));
 		recordStreamError({
@@ -9132,7 +8649,7 @@ async function handleStreamingResponse(opts) {
 			durationMs: Date.now() - ctx.startTime,
 			stopReason: acc.stopReason || void 0,
 			toolCount: anthropicPayload.tools?.length ?? 0
-		});
+		}, ctx.timings);
 	} catch (error) {
 		consola.error("Stream error:", formatError(error));
 		recordStreamError({
@@ -9724,7 +9241,7 @@ const handleResponses = async (c) => {
 							stream: true,
 							durationMs: Date.now() - startTime,
 							toolCount: tools.length
-						});
+						}, ctx.timings);
 					} else if (streamErrorMessage) {
 						recordResponse(historyId, {
 							success: false,
@@ -9736,8 +9253,8 @@ const handleResponses = async (c) => {
 							error: streamErrorMessage,
 							content: null
 						}, Date.now() - startTime);
-						completeTracking(trackingId, 0, 0, queueWaitMs);
-					} else completeTracking(trackingId, 0, 0, queueWaitMs);
+						completeTracking(trackingId, 0, 0, queueWaitMs, void 0, void 0, ctx.timings);
+					} else completeTracking(trackingId, 0, 0, queueWaitMs, void 0, void 0, ctx.timings);
 				} catch (error) {
 					recordStreamError({
 						acc: { model: finalResult?.model || model },
@@ -9770,7 +9287,7 @@ const handleResponses = async (c) => {
 			stream: false,
 			durationMs: Date.now() - startTime,
 			toolCount: tools.length
-		});
+		}, ctx.timings);
 		consola.debug("Forwarding native Responses result:", JSON.stringify(result).slice(-400));
 		return c.json(echoResponseBody(result, ctx));
 	} catch (error) {
@@ -9925,7 +9442,6 @@ function formatModelInfo(model) {
 async function runServer(options) {
 	consola.info(`copilot-api v${version}`);
 	configureProxyApiKey(options.apiKey);
-	if (options.proxyEnv) initProxyFromEnv();
 	if (options.verbose) {
 		consola.level = 5;
 		consola.info("Verbose logging enabled");
@@ -9939,34 +9455,12 @@ async function runServer(options) {
 		process.exit(1);
 	}
 	if (options.accountType !== "individual") consola.info(`Using ${options.accountType} plan GitHub account`);
-	state.manualApprove = options.manual;
-	state.showToken = options.showToken;
-	state.showAllModels = options.showAllModels;
-	if (options.showAllModels) consola.warn("--show-all-models: hidden model blacklist is BYPASSED for this run");
-	state.autoTruncate = options.autoTruncate;
-	state.compressToolResults = options.compressToolResults;
-	state.redirectAnthropic = options.redirectAnthropic;
-	state.stripServerTools = options.stripServerTools;
-	state.contextEditingMode = options.contextEditing;
-	state.timezoneOffset = options.timezoneOffset;
-	if (options.rateLimit) initAdaptiveRateLimiter({
-		baseRetryIntervalSeconds: options.retryInterval,
-		requestIntervalSeconds: options.requestInterval,
-		recoveryTimeoutMinutes: options.recoveryTimeout,
-		consecutiveSuccessesForRecovery: options.consecutiveSuccesses
-	});
+	if (options.rateLimit) initAdaptiveRateLimiter();
 	else consola.info("Rate limiting disabled");
-	if (!options.autoTruncate) consola.info("Auto-truncate disabled");
-	if (options.compressToolResults) consola.info("Tool result compression enabled");
-	if (options.redirectAnthropic) consola.info("Anthropic API redirect enabled (using OpenAI translation)");
-	if (options.stripServerTools) consola.info("Server-side tools will be stripped from requests");
-	if (options.contextEditing !== "off") consola.info(`Context editing mode: ${options.contextEditing}`);
-	initHistory(options.history, options.historyLimit);
-	if (options.history) {
-		const limitText = options.historyLimit === 0 ? "unlimited" : `max ${options.historyLimit}`;
-		consola.info(`History recording enabled (${limitText} entries)`);
-		startMemoryPressureMonitor();
-	}
+	initHistory(true, 1e3);
+	consola.info("History recording enabled (max 1000 entries)");
+	startMemoryPressureMonitor();
+	startEventLoopLagMonitor();
 	if (options.posthogKey) {
 		initPostHog(options.posthogKey);
 		if (isPostHogEnabled()) consola.info("PostHog analytics enabled");
@@ -9987,48 +9481,17 @@ async function runServer(options) {
 		consola.error(error instanceof Error ? error.message : String(error));
 		process.exit(1);
 	}
+	await warmupTokenizer();
 	const allModels = state.models?.data ?? [];
 	if (allModels.length === 0) {
 		consola.error(`Upstream returned zero models for account type "${state.accountType}". Verify the account type matches your Copilot plan and that upstream is reachable.`);
 		process.exit(1);
 	}
 	const visibleModels = allModels.filter((m) => !isHiddenModel(m.id, state.showAllModels));
-	if (visibleModels.length === 0) consola.warn("All upstream models are filtered by the hardcoded blacklist. /v1/models will return an empty list, but explicit POSTs with a hidden id still pass through to upstream. Restart with --show-all-models to see the full catalogue.");
+	if (visibleModels.length === 0) consola.warn("All upstream models are filtered by the hardcoded blacklist. /v1/models will return an empty list, but explicit POSTs with a hidden id still pass through to upstream. Edit src/lib/hidden-models.ts to change the blacklist.");
 	else consola.info(`Available models:\n${visibleModels.map((m) => formatModelInfo(m)).join("\n")}`);
 	const serverUrl = `http://${resolveClientHost(options.host, void 0)}:${options.port}`;
-	if (options.claudeCode) {
-		if (visibleModels.length === 0) {
-			consola.error("--claude-code interactive setup needs at least one visible model. Restart with --show-all-models or update src/lib/hidden-models.ts.");
-			process.exit(1);
-		}
-		const selectedModel = await consola.prompt("Select a model to use with Claude Code", {
-			type: "select",
-			options: visibleModels.map((model) => model.id)
-		});
-		const selectedSmallModel = await consola.prompt("Select a small model to use with Claude Code", {
-			type: "select",
-			options: visibleModels.map((model) => model.id)
-		});
-		const command = generateEnvScript({
-			ANTHROPIC_BASE_URL: serverUrl,
-			[CLAUDE_CODE_AUTH_TOKEN_ENV]: CLAUDE_CODE_AUTH_TOKEN_PLACEHOLDER,
-			ANTHROPIC_MODEL: selectedModel,
-			ANTHROPIC_DEFAULT_SONNET_MODEL: selectedModel,
-			ANTHROPIC_SMALL_FAST_MODEL: selectedSmallModel,
-			ANTHROPIC_DEFAULT_HAIKU_MODEL: selectedSmallModel,
-			DISABLE_NON_ESSENTIAL_MODEL_CALLS: "1",
-			CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1"
-		}, "claude");
-		try {
-			clipboard.writeSync(command);
-			consola.success("Copied Claude Code command to clipboard!");
-		} catch {
-			consola.warn("Failed to copy to clipboard. Here is the Claude Code command:");
-			consola.log(command);
-		}
-		for (const line of buildClaudeCodeAuthHint(options.apiKeySource)) consola.warn(line);
-	}
-	consola.box(`🌐 Usage Viewer: https://ericc-ch.github.io/copilot-api?endpoint=${serverUrl}/usage${options.history ? `\n📜 History UI: ${serverUrl}/history` : ""}`);
+	consola.box(`🌐 Usage Viewer: https://ericc-ch.github.io/copilot-api?endpoint=${serverUrl}/usage\n📜 History UI: ${serverUrl}/history`);
 	for (const line of buildStartupAuthLines({
 		source: options.apiKeySource,
 		bindAddress: resolveBindAddress(options.host, void 0)
@@ -10049,23 +9512,6 @@ async function runServer(options) {
 		} }
 	}));
 }
-function parseTimezoneOffset(value) {
-	if (typeof value !== "string") return 8;
-	const n = Number(value);
-	if (!Number.isFinite(n)) return 8;
-	return n;
-}
-const validContextEditingModes = [
-	"off",
-	"clear-thinking",
-	"clear-tooluse",
-	"clear-both"
-];
-function parseContextEditing(value) {
-	if (validContextEditingModes.includes(value)) return value;
-	consola.warn(`Invalid context editing mode: "${value}", using "off". Valid: ${validContextEditingModes.join(", ")}`);
-	return "off";
-}
 const start = defineCommand({
 	meta: {
 		name: "start",
@@ -10095,101 +9541,15 @@ const start = defineCommand({
 			default: "individual",
 			description: "Account type to use (individual, business, enterprise)"
 		},
-		manual: {
-			type: "boolean",
-			default: false,
-			description: "Enable manual request approval"
-		},
 		"no-rate-limit": {
 			type: "boolean",
 			default: false,
 			description: "Disable adaptive rate limiting"
 		},
-		"retry-interval": {
-			type: "string",
-			default: "10",
-			description: "Seconds to wait before retrying after rate limit error (default: 10)"
-		},
-		"request-interval": {
-			type: "string",
-			default: "10",
-			description: "Seconds between requests in rate-limited mode (default: 10)"
-		},
-		"recovery-timeout": {
-			type: "string",
-			default: "10",
-			description: "Minutes before attempting to recover from rate-limited mode (default: 10)"
-		},
-		"consecutive-successes": {
-			type: "string",
-			default: "5",
-			description: "Number of consecutive successes needed to recover from rate-limited mode (default: 5)"
-		},
 		"github-token": {
 			alias: "g",
 			type: "string",
-			description: "Provide GitHub token directly (must be generated using the `auth` subcommand). Falls back to the GH_TOKEN env var if the flag is omitted — prefer the env for automation since argv is visible via /proc/<pid>/cmdline."
-		},
-		"claude-code": {
-			alias: "c",
-			type: "boolean",
-			default: false,
-			description: "Generate a command to launch Claude Code with Copilot API config"
-		},
-		"show-token": {
-			type: "boolean",
-			default: false,
-			description: "Show GitHub and Copilot tokens on fetch and refresh"
-		},
-		"show-all-models": {
-			type: "boolean",
-			default: false,
-			description: "Show ALL upstream models, including the hardcoded blacklist (default: false, blacklist filtered from listings)"
-		},
-		"proxy-env": {
-			type: "boolean",
-			default: false,
-			description: "Initialize proxy from environment variables"
-		},
-		"no-history": {
-			type: "boolean",
-			default: false,
-			description: "Disable request history recording and Web UI"
-		},
-		"history-limit": {
-			type: "string",
-			default: "1000",
-			description: "Maximum number of history entries to keep in memory (0 = unlimited)"
-		},
-		"no-auto-truncate": {
-			type: "boolean",
-			default: false,
-			description: "Disable automatic conversation history truncation when exceeding limits"
-		},
-		"compress-tool-results": {
-			type: "boolean",
-			default: false,
-			description: "Compress old tool_result content before truncating messages (may lose context details)"
-		},
-		"redirect-anthropic": {
-			type: "boolean",
-			default: false,
-			description: "Redirect Anthropic models through OpenAI translation (instead of direct API)"
-		},
-		"strip-server-tools": {
-			type: "boolean",
-			default: false,
-			description: "Strip Anthropic server-side tools (web_search, etc.) from requests"
-		},
-		"context-editing": {
-			type: "string",
-			default: "off",
-			description: "Context editing mode: off, clear-thinking, clear-tooluse, clear-both"
-		},
-		"timezone-offset": {
-			type: "string",
-			default: "+8",
-			description: "Timezone offset in hours from UTC for log timestamps (e.g., +8, -5, 0)"
+			description: "Provide GitHub token directly (must be generated using the `login` subcommand). Falls back to the GH_TOKEN env var if the flag is omitted — prefer the env for automation since argv is visible via /proc/<pid>/cmdline."
 		},
 		"posthog-key": {
 			type: "string",
@@ -10210,25 +9570,8 @@ const start = defineCommand({
 			host: resolveBindHost(args.host, process.env.HOST),
 			verbose: args.verbose,
 			accountType: args["account-type"],
-			manual: args.manual,
 			rateLimit: !args["no-rate-limit"],
-			retryInterval: Number.parseInt(args["retry-interval"], 10),
-			requestInterval: Number.parseInt(args["request-interval"], 10),
-			recoveryTimeout: Number.parseInt(args["recovery-timeout"], 10),
-			consecutiveSuccesses: Number.parseInt(args["consecutive-successes"], 10),
 			githubToken: args["github-token"] || process.env.GH_TOKEN,
-			claudeCode: args["claude-code"],
-			showToken: args["show-token"],
-			showAllModels: args["show-all-models"],
-			proxyEnv: args["proxy-env"],
-			history: !args["no-history"],
-			historyLimit: Number.parseInt(args["history-limit"], 10),
-			autoTruncate: !args["no-auto-truncate"],
-			compressToolResults: args["compress-tool-results"],
-			redirectAnthropic: args["redirect-anthropic"],
-			stripServerTools: args["strip-server-tools"],
-			contextEditing: parseContextEditing(args["context-editing"]),
-			timezoneOffset: parseTimezoneOffset(args["timezone-offset"]),
 			posthogKey: args["posthog-key"],
 			apiKey: resolvedApiKey.key,
 			apiKeySource: resolvedApiKey.source
@@ -10245,12 +9588,10 @@ await runMain(defineCommand({
 		description: "A wrapper around GitHub Copilot API to make it OpenAI compatible, making it usable for other tools."
 	},
 	subCommands: {
-		auth,
+		login,
 		logout,
 		start,
-		"check-usage": checkUsage,
-		debug,
-		"patch-claude": patchClaude
+		debug
 	}
 }));