@juspay/neurolink 10.4.2 → 10.4.4

package/dist/server/routes/claudeProxyRoutes.js

@@ -26,7 +26,7 @@ import { relocateClientSystemIntoMessages } from "../../proxy/systemRelocation.j
 import { logBodyCapture, logRequest, logRequestAttempt, } from "../../proxy/requestLogger.js";
 import { createSSEInterceptor } from "../../proxy/sseInterceptor.js";
 import { createStreamTerminalOutcomeTracker, mergeStreamTerminalOutcome, preflightAnthropicStream, } from "../../proxy/streamOutcome.js";
-import { isPermanentRefreshFailure, needsRefresh, persistTokens, refreshToken, } from "../../proxy/tokenRefresh.js";
+import { isPermanentRefreshFailure, needsRefresh, persistTokens, refreshToken, refreshTokenFromLatest, } from "../../proxy/tokenRefresh.js";
 import { buildProxyTranslationPlan, parseRetryAfterMs, } from "../../proxy/routingPolicy.js";
 import { writeJsonSnapshotAtomically } from "../../proxy/snapshotPersistence.js";
 import { recordAttempt, recordAttemptError, recordFinalError, recordFinalSuccess, } from "../../proxy/usageStats.js";
@@ -45,6 +45,8 @@ const BLOCKED_UPSTREAM_HEADERS = new Set([
     "content-length",
     "transfer-encoding",
 ]);
+const PROXY_INTERNAL_ACCOUNT_LABEL = "proxy/internal";
+const PROXY_INTERNAL_ACCOUNT_TYPE = "internal";
 // ---------------------------------------------------------------------------
 // Module-level state
 // ---------------------------------------------------------------------------
@@ -959,15 +961,36 @@ async function handleTranslatedClaudeRequest(args) {
             requestStartTime,
         });
     }
-    return handleTranslatedJsonRequest({
-        ctx,
-        format: "claude",
-        requestModel: body.model,
-        parsed,
-        attempts,
-        tracer,
-        requestStartTime,
-    });
+    try {
+        return await handleTranslatedJsonRequest({
+            ctx,
+            format: "claude",
+            requestModel: body.model,
+            parsed,
+            attempts,
+            tracer,
+            requestStartTime,
+            terminalFailureStatus: 502,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "unknown error";
+        logger.error(`[claude-proxy] Translated generation failed for ${body.model}: ${message}`);
+        const clientError = buildClaudeError(502, `Generation failed: ${message}`);
+        const clientErrorBody = JSON.stringify(clientError);
+        logProxyBody({
+            phase: "client_response",
+            headers: { "content-type": "application/json" },
+            body: clientErrorBody,
+            bodySize: Buffer.byteLength(clientErrorBody, "utf8"),
+            contentType: "application/json",
+            account: "translation",
+            accountType: "translation",
+            responseStatus: 502,
+            durationMs: Date.now() - requestStartTime,
+        });
+        return clientError;
+    }
 }
 function logProxyRoutingPlan(logProxyBody, stage, plan) {
     logProxyBody({
@@ -980,7 +1003,7 @@ function logProxyRoutingPlan(logProxyBody, stage, plan) {
     });
 }
 async function handleClaudePassthroughRequest(args) {
-    const { ctx, body, clientRequestBody, tracer, requestStartTime, logProxyBody, } = args;
+    const { ctx, body, clientRequestBody, tracer, requestStartTime, logProxyBody, logFinalRequest, } = args;
     tracer?.setMode("passthrough-cli");
     const bodyStr = clientRequestBody;
     const toolCount = Array.isArray(body.tools) ? body.tools.length : 0;
@@ -1016,6 +1039,7 @@ async function handleClaudePassthroughRequest(args) {
             upstreamUrl: "https://api.anthropic.com/v1/messages?beta=true",
         },
     });
+    recordAttempt("passthrough", "passthrough");
     let response;
     try {
         response = await fetch("https://api.anthropic.com/v1/messages?beta=true", {
@@ -1027,24 +1051,11 @@ async function handleClaudePassthroughRequest(args) {
     }
     catch (fetchErr) {
         const errMsg = fetchErr instanceof Error ? fetchErr.message : String(fetchErr);
+        recordAttemptError("passthrough", "passthrough", 502);
         tracer?.setError("network_error", errMsg);
         upstreamSpan?.end();
         tracer?.end(502, Date.now() - requestStartTime);
-        logRequest({
-            timestamp: new Date().toISOString(),
-            requestId: ctx.requestId,
-            method: ctx.method,
-            path: ctx.path,
-            model: body.model,
-            stream: body.stream ?? false,
-            toolCount,
-            account: "passthrough",
-            accountType: "passthrough",
-            responseStatus: 502,
-            responseTimeMs: Date.now() - requestStartTime,
-            errorType: "network_error",
-            errorMessage: errMsg,
-        });
+        logFinalRequest(502, "passthrough", "passthrough", "network_error", errMsg);
         const errorBody = buildClaudeError(502, `Passthrough fetch failed: ${errMsg}`);
         const errorBodyText = JSON.stringify(errorBody);
         logProxyBody({
@@ -1068,6 +1079,7 @@ async function handleClaudePassthroughRequest(args) {
     tracer?.logUpstreamResponseHeaders(upstreamResponseHeaders);
     if (!response.ok) {
         const errorText = await response.text();
+        recordAttemptError("passthrough", "passthrough", response.status, response.status === 429 ? "quota" : undefined);
         tracer?.logUpstreamResponseBody(errorText);
         logProxyBody({
             phase: "upstream_response",
@@ -1096,6 +1108,7 @@ async function handleClaudePassthroughRequest(args) {
         upstreamSpan?.end();
         tracer?.setError("api_error", errorText.slice(0, 500));
         tracer?.end(response.status, Date.now() - requestStartTime);
+        logFinalRequest(response.status, "passthrough", "passthrough", response.status === 429 ? "rate_limit_error" : "api_error", errorText);
         try {
             return JSON.parse(errorText);
         }
@@ -1115,6 +1128,7 @@ async function handleClaudePassthroughRequest(args) {
             upstreamSpan,
             upstreamResponseHeaders,
             logProxyBody,
+            logFinalRequest,
         });
     }
     return handleClaudePassthroughJsonResponse({
@@ -1128,6 +1142,7 @@ async function handleClaudePassthroughRequest(args) {
         upstreamSpan,
         upstreamResponseHeaders,
         logProxyBody,
+        logFinalRequest,
     });
 }
 function trackUpstreamReadableStream(source) {
@@ -1168,15 +1183,28 @@ function trackUpstreamReadableStream(source) {
     return { stream, outcome: tracker.outcome };
 }
 async function handleClaudePassthroughStreamResponse(args) {
-    const { ctx, body, bodyStr, response, tracer, requestStartTime, toolCount, upstreamSpan, upstreamResponseHeaders, logProxyBody, } = args;
+    const { bodyStr, response, tracer, requestStartTime, upstreamSpan, upstreamResponseHeaders, logProxyBody, logFinalRequest, } = args;
     const responseHeaders = { ...upstreamResponseHeaders };
     const { stream: clientCaptureStream, capture: clientCapture } = createRawStreamCapture();
     const responseBody = response.body;
     if (!responseBody) {
+        recordAttemptError("passthrough", "passthrough", 502);
         throw new Error("Expected passthrough stream response body");
     }
     const trackedStream = trackUpstreamReadableStream(responseBody);
     let streamSource = trackedStream.stream;
+    let streamFinalized = false;
+    const finalizeStream = (status, errorType, errorMessage, usage) => {
+        if (streamFinalized) {
+            return false;
+        }
+        streamFinalized = true;
+        if (errorType === "stream_error") {
+            recordAttemptError("passthrough", "passthrough", status);
+        }
+        logFinalRequest(status, "passthrough", "passthrough", errorType, errorMessage, usage);
+        return true;
+    };
     if (tracer) {
         try {
             const { stream: interceptor, telemetry } = createSSEInterceptor({
@@ -1224,31 +1252,11 @@ async function handleClaudePassthroughStreamResponse(args) {
                     capturedTracer.setError(failure.errorType, failure.message);
                 }
                 capturedTracer.end(failure?.status ?? response.status, Date.now() - requestStartTime);
-                const traceCtx = capturedTracer.getTraceContext();
-                logRequest({
-                    timestamp: new Date().toISOString(),
-                    requestId: ctx.requestId,
-                    method: ctx.method,
-                    path: ctx.path,
-                    model: body.model,
-                    stream: true,
-                    toolCount,
-                    account: "passthrough",
-                    accountType: "passthrough",
-                    responseStatus: failure?.status ?? response.status,
-                    responseTimeMs: Date.now() - requestStartTime,
+                finalizeStream(failure?.status ?? response.status, failure?.errorType, failure?.message, {
                     inputTokens: data.usage.inputTokens,
                     outputTokens: data.usage.outputTokens,
                     cacheCreationTokens: data.usage.cacheCreationInputTokens,
                     cacheReadTokens: data.usage.cacheReadInputTokens,
-                    traceId: traceCtx.traceId,
-                    spanId: traceCtx.spanId,
-                    ...(failure
-                        ? {
-                            errorType: failure.errorType,
-                            errorMessage: failure.message,
-                        }
-                        : {}),
                 });
                 logProxyBody({
                     phase: "upstream_response",
@@ -1276,27 +1284,14 @@ async function handleClaudePassthroughStreamResponse(args) {
                 });
             })
                 .catch((error) => {
-                capturedTracer.setError("stream_error", error instanceof Error ? error.message : String(error));
+                if (streamFinalized) {
+                    return;
+                }
+                const message = error instanceof Error ? error.message : String(error);
+                capturedTracer.setError("stream_telemetry_error", message);
                 capturedUpstreamSpan?.end();
                 capturedTracer.end(500, Date.now() - requestStartTime);
-                const traceCtx = capturedTracer.getTraceContext();
-                logRequest({
-                    timestamp: new Date().toISOString(),
-                    requestId: ctx.requestId,
-                    method: ctx.method,
-                    path: ctx.path,
-                    model: body.model,
-                    stream: true,
-                    toolCount,
-                    account: "passthrough",
-                    accountType: "passthrough",
-                    responseStatus: 500,
-                    responseTimeMs: Date.now() - requestStartTime,
-                    errorType: "stream_error",
-                    errorMessage: error instanceof Error ? error.message : String(error),
-                    traceId: traceCtx.traceId,
-                    spanId: traceCtx.spanId,
-                });
+                finalizeStream(500, "stream_telemetry_error", message);
             });
         }
         catch {
@@ -1307,28 +1302,7 @@ async function handleClaudePassthroughStreamResponse(args) {
                     tracer.setError(failure.errorType, failure.message);
                 }
                 tracer.end(failure?.status ?? response.status, Date.now() - requestStartTime);
-                const traceCtx = tracer.getTraceContext();
-                logRequest({
-                    timestamp: new Date().toISOString(),
-                    requestId: ctx.requestId,
-                    method: ctx.method,
-                    path: ctx.path,
-                    model: body.model,
-                    stream: true,
-                    toolCount,
-                    account: "passthrough",
-                    accountType: "passthrough",
-                    responseStatus: failure?.status ?? response.status,
-                    responseTimeMs: Date.now() - requestStartTime,
-                    traceId: traceCtx.traceId,
-                    spanId: traceCtx.spanId,
-                    ...(failure
-                        ? {
-                            errorType: failure.errorType,
-                            errorMessage: failure.message,
-                        }
-                        : {}),
-                });
+                finalizeStream(failure?.status ?? response.status, failure?.errorType, failure?.message);
             });
         }
     }
@@ -1342,28 +1316,11 @@ async function handleClaudePassthroughStreamResponse(args) {
                 .then(([data, clientBody, rawOutcome]) => {
                 const terminalOutcome = mergeStreamTerminalOutcome(rawOutcome, data.streamErrorMessage);
                 const failure = getStreamFailureDetails(terminalOutcome);
-                logRequest({
-                    timestamp: new Date().toISOString(),
-                    requestId: ctx.requestId,
-                    method: ctx.method,
-                    path: ctx.path,
-                    model: body.model,
-                    stream: true,
-                    toolCount,
-                    account: "passthrough",
-                    accountType: "passthrough",
-                    responseStatus: failure?.status ?? response.status,
-                    responseTimeMs: Date.now() - requestStartTime,
+                finalizeStream(failure?.status ?? response.status, failure?.errorType, failure?.message, {
                     inputTokens: data.usage.inputTokens,
                     outputTokens: data.usage.outputTokens,
                     cacheCreationTokens: data.usage.cacheCreationInputTokens,
                     cacheReadTokens: data.usage.cacheReadInputTokens,
-                    ...(failure
-                        ? {
-                            errorType: failure.errorType,
-                            errorMessage: failure.message,
-                        }
-                        : {}),
                 });
                 logProxyBody({
                     phase: "upstream_response",
@@ -1391,21 +1348,9 @@ async function handleClaudePassthroughStreamResponse(args) {
                 });
             })
                 .catch((error) => {
-                logRequest({
-                    timestamp: new Date().toISOString(),
-                    requestId: ctx.requestId,
-                    method: ctx.method,
-                    path: ctx.path,
-                    model: body.model,
-                    stream: true,
-                    toolCount,
-                    account: "passthrough",
-                    accountType: "passthrough",
-                    responseStatus: 500,
-                    responseTimeMs: Date.now() - requestStartTime,
-                    errorType: "stream_telemetry_error",
-                    errorMessage: error instanceof Error ? error.message : String(error),
-                });
+                if (!streamFinalized) {
+                    finalizeStream(500, "stream_telemetry_error", error instanceof Error ? error.message : String(error));
+                }
             });
         }
         catch {
@@ -1413,25 +1358,7 @@ async function handleClaudePassthroughStreamResponse(args) {
             // the transport failure to the client.
             trackedStream.outcome.then((outcome) => {
                 const failure = getStreamFailureDetails(outcome);
-                logRequest({
-                    timestamp: new Date().toISOString(),
-                    requestId: ctx.requestId,
-                    method: ctx.method,
-                    path: ctx.path,
-                    model: body.model,
-                    stream: true,
-                    toolCount,
-                    account: "passthrough",
-                    accountType: "passthrough",
-                    responseStatus: failure?.status ?? response.status,
-                    responseTimeMs: Date.now() - requestStartTime,
-                    ...(failure
-                        ? {
-                            errorType: failure.errorType,
-                            errorMessage: failure.message,
-                        }
-                        : {}),
-                });
+                finalizeStream(failure?.status ?? response.status, failure?.errorType, failure?.message);
             });
         }
     }
@@ -1442,7 +1369,7 @@ async function handleClaudePassthroughStreamResponse(args) {
     });
 }
 async function handleClaudePassthroughJsonResponse(args) {
-    const { ctx, body, bodyStr, response, tracer, requestStartTime, toolCount, upstreamSpan, upstreamResponseHeaders, logProxyBody, } = args;
+    const { bodyStr, response, tracer, requestStartTime, upstreamSpan, upstreamResponseHeaders, logProxyBody, logFinalRequest, } = args;
     const responseText = await response.text();
     tracer?.logUpstreamResponseBody(responseText);
     logProxyBody({
@@ -1505,43 +1432,17 @@ async function handleClaudePassthroughJsonResponse(args) {
         tracer.recordBodySizes(bodyStr.length, responseJsonStr.length);
         upstreamSpan?.end();
         tracer.end(response.status, Date.now() - requestStartTime);
-        const traceCtx = tracer.getTraceContext();
-        logRequest({
-            timestamp: new Date().toISOString(),
-            requestId: ctx.requestId,
-            method: ctx.method,
-            path: ctx.path,
-            model: body.model,
-            stream: false,
-            toolCount,
-            account: "passthrough",
-            accountType: "passthrough",
-            responseStatus: response.status,
-            responseTimeMs: Date.now() - requestStartTime,
+        logFinalRequest(response.status, "passthrough", "passthrough", undefined, undefined, {
             inputTokens: usage?.input_tokens,
             outputTokens: usage?.output_tokens,
             cacheCreationTokens: usage?.cache_creation_input_tokens,
             cacheReadTokens: usage?.cache_read_input_tokens,
-            traceId: traceCtx.traceId,
-            spanId: traceCtx.spanId,
         });
     }
     else {
         upstreamSpan?.end();
         tracer?.end(response.status, Date.now() - requestStartTime);
-        logRequest({
-            timestamp: new Date().toISOString(),
-            requestId: ctx.requestId,
-            method: ctx.method,
-            path: ctx.path,
-            model: body.model,
-            stream: false,
-            toolCount,
-            account: "passthrough",
-            accountType: "passthrough",
-            responseStatus: response.status,
-            responseTimeMs: Date.now() - requestStartTime,
-        });
+        logFinalRequest(response.status, "passthrough", "passthrough");
     }
     return responseJson;
 }
@@ -1632,7 +1533,9 @@ async function loadClaudeProxyAccounts(args) {
                 expiresAt,
                 label,
             };
-            const refreshed = await refreshToken(tempAccount);
+            const refreshed = await refreshTokenFromLatest(tempAccount, {
+                providerKey: key,
+            });
             if (!refreshed.success) {
                 const account = {
                     key,
@@ -1701,20 +1604,7 @@ async function loadClaudeProxyAccounts(args) {
         };
     }
     for (const account of accounts) {
-        const state = getOrCreateRuntimeState(account.key);
-        const tokenChanged = state.lastToken !== account.token ||
-            state.lastRefreshToken !== account.refreshToken;
-        if (tokenChanged) {
-            if (state.permanentlyDisabled) {
-                logger.always(`[proxy] account=${account.label} eligible credentials reloaded; clearing stale runtime auth-disable state`);
-            }
-            // Eligibility was already resolved while loading accounts. This only
-            // clears stale in-process auth state after an explicit credential reload.
-            state.consecutiveRefreshFailures = 0;
-            state.permanentlyDisabled = false;
-        }
-        state.lastToken = account.token;
-        state.lastRefreshToken = account.refreshToken;
+        reconcileEligibleAccountRuntimeState(account);
     }
     await seedRuntimeQuotasFromDisk(accounts);
     const enabledAccounts = accounts.filter((account) => {
@@ -1856,7 +1746,6 @@ async function executeClaudeFallbackTranslation(args) {
         }
         // Telemetry AFTER validation — not before like the old lazy path
         tracer?.end(200, Date.now() - requestStartTime);
-        recordFinalSuccess();
         logFinalRequest(200, "", providerLabel, undefined, undefined, {
             inputTokens: resolvedUsage.input,
             outputTokens: resolvedUsage.output,
@@ -1894,7 +1783,6 @@ async function executeClaudeFallbackTranslation(args) {
         toolCalls: streamResult.toolCalls,
     };
     tracer?.end(200, Date.now() - requestStartTime);
-    recordFinalSuccess();
     const clientResponse = serializeClaudeResponse(internal, body.model);
     logFinalRequest(200, "", providerLabel, undefined, undefined, {
         inputTokens: internal.usage?.input,
@@ -2100,7 +1988,6 @@ function buildClaudeAnthropicFailureResponse(args) {
     if (invalidRequestFailure) {
         tracer?.setError("invalid_request_error", summarizeErrorMessage(invalidRequestFailure.body));
         tracer?.end(invalidRequestFailure.status, Date.now() - requestStartTime);
-        recordFinalError(invalidRequestFailure.status);
         try {
             const parsedError = JSON.parse(invalidRequestFailure.body);
             logFinalRequest(invalidRequestFailure.status, "", "final", "invalid_request_error", summarizeErrorMessage(invalidRequestFailure.body));
@@ -2162,7 +2049,6 @@ function buildClaudeAnthropicFailureResponse(args) {
     const errorBody = buildClaudeError(429, errorMessage, "overloaded_error");
     tracer?.setError("rate_limit_error", errorMessage);
     tracer?.end(429, Date.now() - requestStartTime);
-    recordFinalError(429);
     logFinalRequest(429, "", "final", "rate_limit_error", errorMessage);
     const errorBodyText = JSON.stringify(errorBody);
     logProxyBody({
@@ -2241,6 +2127,7 @@ async function handleAnthropicSuccessfulResponse(args) {
         attemptNumber,
         finalBodyStr,
         upstreamSpan,
+        logAttempt,
         logProxyBody,
         logFinalRequest,
     });
@@ -2248,10 +2135,11 @@ async function handleAnthropicSuccessfulResponse(args) {
 async function handleAnthropicStreamingSuccessResponse(args) {
     const { account, accountState, response, responseHeaders, tracer, requestStartTime, fetchStartMs, attemptNumber, finalBodyStr, upstreamSpan, logAttempt, logProxyBody, logFinalRequest, } = args;
     if (!response.body) {
+        recordAttemptError(account.label, account.type, 502);
+        logAttempt(502, "stream_error", "No response body from upstream");
         upstreamSpan?.end();
         tracer?.setError("stream_error", "No response body from upstream");
         tracer?.end(502, Date.now() - requestStartTime);
-        recordFinalError(502, account.label, account.type);
         logFinalRequest(502, account.label, account.type, "stream_error", "No response body from upstream");
         const clientError = buildClaudeError(502, "No response body from upstream");
         const clientErrorBody = JSON.stringify(clientError);
@@ -2386,6 +2274,9 @@ async function handleAnthropicStreamingSuccessResponse(args) {
             failure: { message: preflight.message, rateLimit: isRateLimit },
         };
     }
+    logAttempt(response.status, undefined, undefined, {
+        attemptDurationMs: Date.now() - fetchStartMs,
+    });
     const streamOutcomeTracker = createStreamTerminalOutcomeTracker();
     let mainStreamClosed = false;
     const remainingStream = new ReadableStream({
@@ -2462,6 +2353,11 @@ function getStreamFailureDetails(outcome) {
     }
     return undefined;
 }
+function recordCommittedAnthropicStreamAttemptFailure(outcome, account) {
+    if (outcome.kind === "upstream_error") {
+        recordAttemptError(account.label, account.type, 502);
+    }
+}
 function attachAnthropicSuccessStreamTelemetry(args) {
     const { account, response, responseHeaders, remainingStream, streamOutcome, tracer, requestStartTime, attemptNumber, finalBodyStr, upstreamSpan, logProxyBody, logFinalRequest, } = args;
     const { stream: clientCaptureStream, capture: clientCapture } = createRawStreamCapture();
@@ -2480,6 +2376,7 @@ function attachAnthropicSuccessStreamTelemetry(args) {
             Promise.all([telemetry, clientCapture, streamOutcome])
                 .then(([data, clientBody, rawOutcome]) => {
                 const terminalOutcome = mergeStreamTerminalOutcome(rawOutcome, data.streamErrorMessage);
+                recordCommittedAnthropicStreamAttemptFailure(terminalOutcome, account);
                 capturedTracer.setUsage({
                     inputTokens: data.usage.inputTokens,
                     outputTokens: data.usage.outputTokens,
@@ -2519,12 +2416,10 @@ function attachAnthropicSuccessStreamTelemetry(args) {
                 if (failure) {
                     capturedTracer.setError(failure.errorType, failure.message);
                     capturedTracer.end(failure.status, Date.now() - requestStartTime);
-                    recordFinalError(failure.status, capturedAccountLabel, account.type);
                     logFinalRequest(failure.status, capturedAccountLabel, account.type, failure.errorType, failure.message, usage);
                 }
                 else {
                     capturedTracer.end(200, Date.now() - requestStartTime);
-                    recordFinalSuccess(capturedAccountLabel, account.type);
                     logFinalRequest(200, capturedAccountLabel, account.type, undefined, undefined, usage);
                 }
                 logProxyBody({
@@ -2553,28 +2448,26 @@ function attachAnthropicSuccessStreamTelemetry(args) {
                 });
             })
                 .catch((error) => {
-                capturedTracer.setError("stream_error", error instanceof Error ? error.message : String(error));
+                capturedTracer.setError("stream_telemetry_error", error instanceof Error ? error.message : String(error));
                 capturedUpstreamSpan?.end();
                 capturedTracer.end(500, Date.now() - requestStartTime);
-                recordFinalError(500, capturedAccountLabel, account.type);
-                logFinalRequest(500, capturedAccountLabel, account.type, "stream_error", error instanceof Error ? error.message : String(error));
+                logFinalRequest(500, capturedAccountLabel, account.type, "stream_telemetry_error", error instanceof Error ? error.message : String(error));
             });
         }
         catch {
             // Interceptor attachment failed after stream setup. Preserve delivery but
             // still settle the request from the actual stream terminal outcome.
             streamOutcome.then((outcome) => {
+                recordCommittedAnthropicStreamAttemptFailure(outcome, account);
                 const failure = getStreamFailureDetails(outcome);
                 upstreamSpan?.end();
                 if (failure) {
                     tracer.setError(failure.errorType, failure.message);
                     tracer.end(failure.status, Date.now() - requestStartTime);
-                    recordFinalError(failure.status, account.label, account.type);
                     logFinalRequest(failure.status, account.label, account.type, failure.errorType, failure.message);
                 }
                 else {
                     tracer.end(response.status, Date.now() - requestStartTime);
-                    recordFinalSuccess(account.label, account.type);
                     logFinalRequest(response.status, account.label, account.type);
                 }
             });
@@ -2591,6 +2484,7 @@ function attachAnthropicSuccessStreamTelemetry(args) {
             Promise.all([noTracerTelemetry, clientCapture, streamOutcome])
                 .then(([data, clientBody, rawOutcome]) => {
                 const terminalOutcome = mergeStreamTerminalOutcome(rawOutcome, data.streamErrorMessage);
+                recordCommittedAnthropicStreamAttemptFailure(terminalOutcome, account);
                 const failure = getStreamFailureDetails(terminalOutcome);
                 const usage = {
                     inputTokens: data.usage.inputTokens,
@@ -2599,11 +2493,9 @@ function attachAnthropicSuccessStreamTelemetry(args) {
                     cacheReadTokens: data.usage.cacheReadInputTokens,
                 };
                 if (failure) {
-                    recordFinalError(failure.status, capturedAccountLabel, account.type);
                     logFinalRequest(failure.status, capturedAccountLabel, account.type, failure.errorType, failure.message, usage);
                 }
                 else {
-                    recordFinalSuccess(capturedAccountLabel, account.type);
                     logFinalRequest(200, capturedAccountLabel, account.type, undefined, undefined, usage);
                 }
                 logProxyBody({
@@ -2633,7 +2525,6 @@ function attachAnthropicSuccessStreamTelemetry(args) {
             })
                 .catch((error) => {
                 const message = error instanceof Error ? error.message : String(error);
-                recordFinalError(500, account.label, account.type);
                 logFinalRequest(500, account.label, account.type, "stream_telemetry_error", message);
             });
         }
@@ -2657,13 +2548,12 @@ function attachAnthropicSuccessStreamTelemetry(args) {
                 // Non-fatal
             });
             streamOutcome.then((outcome) => {
+                recordCommittedAnthropicStreamAttemptFailure(outcome, account);
                 const failure = getStreamFailureDetails(outcome);
                 if (failure) {
-                    recordFinalError(failure.status, account.label, account.type);
                     logFinalRequest(failure.status, account.label, account.type, failure.errorType, failure.message);
                 }
                 else {
-                    recordFinalSuccess(account.label, account.type);
                     logFinalRequest(response.status, account.label, account.type);
                 }
             });
@@ -2693,8 +2583,11 @@ function attachAnthropicSuccessStreamTelemetry(args) {
     });
 }
 async function handleAnthropicJsonSuccessResponse(args) {
-    const { account, response, responseHeaders, tracer, requestStartTime, fetchStartMs, attemptNumber, finalBodyStr, upstreamSpan, logProxyBody, logFinalRequest, } = args;
+    const { account, response, responseHeaders, tracer, requestStartTime, fetchStartMs, attemptNumber, finalBodyStr, upstreamSpan, logAttempt, logProxyBody, logFinalRequest, } = args;
     const responseText = await response.text();
+    logAttempt(response.status, undefined, undefined, {
+        attemptDurationMs: Date.now() - fetchStartMs,
+    });
     tracer?.logUpstreamResponseBody(responseText);
     logProxyBody({
         phase: "upstream_response",
@@ -2756,7 +2649,6 @@ async function handleAnthropicJsonSuccessResponse(args) {
         tracer.recordBodySizes(finalBodyStr.length, responseJsonStr.length);
         upstreamSpan?.end();
         tracer.end(response.status, Date.now() - requestStartTime);
-        recordFinalSuccess(account.label, account.type);
         logFinalRequest(response.status, account.label, account.type, undefined, undefined, {
             inputTokens: usage?.input_tokens,
             outputTokens: usage?.output_tokens,
@@ -2769,7 +2661,6 @@ async function handleAnthropicJsonSuccessResponse(args) {
         const noTracerUsage = responseJson && typeof responseJson === "object"
             ? responseJson.usage
             : undefined;
-        recordFinalSuccess(account.label, account.type);
         logFinalRequest(response.status, account.label, account.type, undefined, undefined, {
             inputTokens: noTracerUsage?.input_tokens,
             outputTokens: noTracerUsage?.output_tokens,
@@ -2779,8 +2670,8 @@ async function handleAnthropicJsonSuccessResponse(args) {
     }
     return { response: responseJson };
 }
-async function handleAnthropicSuccessfulRetryResponse(args) {
-    const { body, account, accountState, retryResp, tracer, requestStartTime, fetchStartMs, attemptNumber, finalBodyStr, upstreamSpan, logProxyBody, logFinalRequest, } = args;
+async function handleAnthropicSuccessfulNonStreamRetryResponse(args) {
+    const { account, accountState, retryResp, tracer, requestStartTime, fetchStartMs, attemptNumber, finalBodyStr, upstreamSpan, logAttempt, logProxyBody, logFinalRequest, } = args;
     const retryQuota = parseQuotaHeaders(retryResp.headers);
     if (retryQuota) {
         // Keep the auth-retry success path in parity with the main success path:
@@ -2802,63 +2693,11 @@ async function handleAnthropicSuccessfulRetryResponse(args) {
             });
         });
     }
-    if (body.stream && retryResp.body) {
-        const retryReader = retryResp.body.getReader();
-        const streamOutcomeTracker = createStreamTerminalOutcomeTracker();
-        let retryStreamClosed = false;
-        const retryStream = new ReadableStream({
-            async pull(controller) {
-                if (retryStreamClosed) {
-                    return;
-                }
-                try {
-                    const { done, value } = await retryReader.read();
-                    if (retryStreamClosed) {
-                        return;
-                    }
-                    if (done) {
-                        retryStreamClosed = true;
-                        streamOutcomeTracker.complete();
-                        controller.close();
-                        return;
-                    }
-                    controller.enqueue(value);
-                }
-                catch (streamErr) {
-                    const errMsg = describeTransportError(streamErr);
-                    logger.always(`[proxy] mid-stream error (auth-retry) account=${account.label}: ${errMsg}`);
-                    streamOutcomeTracker.fail(errMsg);
-                    if (!retryStreamClosed) {
-                        retryStreamClosed = true;
-                        const errorEvent = `event: error\ndata: ${JSON.stringify({ type: "error", error: { type: "api_error", message: `Upstream stream interrupted: ${errMsg}` } })}\n\n`;
-                        controller.enqueue(new TextEncoder().encode(errorEvent));
-                        controller.close();
-                    }
-                }
-            },
-            cancel() {
-                retryStreamClosed = true;
-                streamOutcomeTracker.cancel();
-                return retryReader.cancel();
-            },
-        });
-        return attachAnthropicSuccessStreamTelemetry({
-            account,
-            response: retryResp,
-            responseHeaders: Object.fromEntries([...retryResp.headers.entries()]),
-            remainingStream: retryStream,
-            streamOutcome: streamOutcomeTracker.outcome,
-            tracer,
-            requestStartTime,
-            attemptNumber,
-            finalBodyStr,
-            upstreamSpan,
-            logProxyBody,
-            logFinalRequest,
-        });
-    }
     const retryRespHeaders = Object.fromEntries([...retryResp.headers.entries()]);
     const retryText = await retryResp.text();
+    logAttempt(retryResp.status, undefined, undefined, {
+        attemptDurationMs: Date.now() - fetchStartMs,
+    });
     tracer?.logUpstreamResponseHeaders(retryRespHeaders);
     tracer?.logUpstreamResponseBody(retryText);
     logProxyBody({
@@ -2902,7 +2741,6 @@ async function handleAnthropicSuccessfulRetryResponse(args) {
         tracer.recordBodySizes(finalBodyStr.length, retryJsonStr.length);
         upstreamSpan?.end();
         tracer.end(retryResp.status, Date.now() - requestStartTime);
-        recordFinalSuccess(account.label, account.type);
         logFinalRequest(retryResp.status, account.label, account.type, undefined, undefined, {
             inputTokens: retryUsage?.input_tokens,
             outputTokens: retryUsage?.output_tokens,
@@ -2912,7 +2750,6 @@ async function handleAnthropicSuccessfulRetryResponse(args) {
     }
     else {
         upstreamSpan?.end();
-        recordFinalSuccess(account.label, account.type);
         logFinalRequest(retryResp.status, account.label, account.type);
     }
     return retryJson;
@@ -2933,7 +2770,7 @@ async function handleAnthropicAuthRetry(args) {
     let authRetryError = "received 401 from Anthropic";
     for (let authRetry = 0; authRetry < MAX_AUTH_RETRIES; authRetry++) {
         logger.always(`[proxy] ← 401 account=${account.label} refreshing (attempt ${authRetry + 1}/${MAX_AUTH_RETRIES})`);
-        const refreshSucceeded = await refreshToken(account);
+        const refreshSucceeded = await refreshTokenFromLatest(account, account.persistTarget);
         if (!refreshSucceeded.success) {
             authRetryError = `refresh failed for account=${account.label} attempt ${authRetry + 1}/${MAX_AUTH_RETRIES}: ${refreshSucceeded.error?.slice(0, 200) ?? "unknown"}`;
             currentLastError = authRetryError;
@@ -2960,7 +2797,7 @@ async function handleAnthropicAuthRetry(args) {
         const retryLogAttempt = (status, errorType, errorMessage, extra) => logAttempt(status, errorType, errorMessage, {
             ...extra,
             attempt: retryAttemptNumber,
-            attemptDurationMs: Date.now() - retryAttemptStartedAt,
+            attemptDurationMs: extra?.attemptDurationMs ?? Date.now() - retryAttemptStartedAt,
         });
         const retryBodyStr = buildUpstreamBody(account.token).bodyStr;
         const retryFetchStartMs = Date.now();
@@ -2986,23 +2823,54 @@ async function handleAnthropicAuthRetry(args) {
                 authRetrySucceeded = true;
                 accountState.consecutiveRefreshFailures = 0;
                 logger.always(`[proxy] ← 200 account=${account.label} (after ${authRetry + 1} refresh(es))`);
-                const successResponse = await handleAnthropicSuccessfulRetryResponse({
-                    ctx,
-                    body,
-                    account,
-                    accountState,
-                    retryResp,
-                    tracer,
-                    requestStartTime,
-                    fetchStartMs: retryFetchStartMs,
-                    attemptNumber: retryAttemptNumber,
-                    finalBodyStr: retryBodyStr,
-                    upstreamSpan: currentUpstreamSpan,
-                    logProxyBody,
-                    logFinalRequest,
-                });
+                const successResult = body.stream
+                    ? await handleAnthropicSuccessfulResponse({
+                        ctx,
+                        body,
+                        account,
+                        accountState,
+                        response: retryResp,
+                        tracer,
+                        requestStartTime,
+                        fetchStartMs: retryFetchStartMs,
+                        attemptNumber: retryAttemptNumber,
+                        finalBodyStr: retryBodyStr,
+                        upstreamSpan: currentUpstreamSpan,
+                        logAttempt: retryLogAttempt,
+                        logProxyBody,
+                        logFinalRequest,
+                    })
+                    : {
+                        response: await handleAnthropicSuccessfulNonStreamRetryResponse({
+                            account,
+                            accountState,
+                            retryResp,
+                            tracer,
+                            requestStartTime,
+                            fetchStartMs: retryFetchStartMs,
+                            attemptNumber: retryAttemptNumber,
+                            finalBodyStr: retryBodyStr,
+                            upstreamSpan: currentUpstreamSpan,
+                            logAttempt: retryLogAttempt,
+                            logProxyBody,
+                            logFinalRequest,
+                        }),
+                    };
+                if ("retryNextAccount" in successResult) {
+                    const failure = successResult.failure;
+                    return {
+                        continueLoop: true,
+                        lastError: failure?.message ?? currentLastError,
+                        authFailureMessage: currentAuthFailureMessage,
+                        sawRateLimit: currentSawRateLimit || Boolean(failure?.rateLimit),
+                        sawTransientFailure: currentSawTransientFailure ||
+                            Boolean(failure && !failure.rateLimit),
+                        sawNetworkError: currentSawNetworkError,
+                        upstreamSpan: undefined,
+                    };
+                }
                 return {
-                    response: successResponse,
+                    response: successResult.response,
                     continueLoop: false,
                     lastError: currentLastError,
                     authFailureMessage: currentAuthFailureMessage,
@@ -3119,7 +2987,6 @@ async function handleAnthropicAuthRetry(args) {
                 break;
             }
             retryLogAttempt(retryStatus, "api_error", summarizeErrorMessage(retryBody));
-            recordFinalError(retryStatus, account.label, account.type);
             try {
                 logFinalRequest(retryStatus, account.label, account.type, "api_error", summarizeErrorMessage(retryBody));
                 return {
@@ -3225,7 +3092,6 @@ function buildAnthropicTerminalErrorResponse(args) {
 }
 function finalizeAnthropicTerminalFetchError(args) {
     const { terminalError, account, tracer, requestStartTime, attemptNumber, logProxyBody, logFinalRequest, } = args;
-    recordFinalError(terminalError.status, account.label, account.type);
     tracer?.end(terminalError.status, Date.now() - requestStartTime);
     return buildAnthropicTerminalErrorResponse({
         responseStatus: terminalError.status,
@@ -3329,7 +3195,6 @@ async function handleAnthropicNonOkResponse(args) {
         };
     }
     if (response.status === 404) {
-        recordFinalError(response.status, account.label, account.type);
         logger.always(`[proxy] ← 404 account=${account.label}`);
         logAttempt(404, "not_found_error", summarizeErrorMessage(errBody));
         tracer?.setError("not_found_error", summarizeErrorMessage(errBody));
@@ -3378,7 +3243,6 @@ async function handleAnthropicNonOkResponse(args) {
             upstreamSpan: undefined,
         };
     }
-    recordFinalError(response.status, account.label, account.type);
     logger.always(`[proxy] ← ${response.status} account=${account.label}`);
     logger.debug(`[claude-proxy] error body: ${errBody.substring(0, 200)}`);
     logAttempt(response.status, "api_error", summarizeErrorMessage(errBody));
@@ -3449,7 +3313,35 @@ function createClaudeRequestRuntimeContext(args) {
                 : {}),
         });
     };
+    let finalRequestLogged = false;
     const logFinalRequest = (status, accountLabel, accountType, errorType, errorMessage, extra) => {
+        if (finalRequestLogged) {
+            logger.debug(`[claude-proxy] ignored duplicate finalization for request ${ctx.requestId}`);
+            return;
+        }
+        finalRequestLogged = true;
+        const finalAccountLabel = accountLabel ||
+            (status >= 400 ? PROXY_INTERNAL_ACCOUNT_LABEL : undefined);
+        const finalAccountType = accountLabel
+            ? accountType || undefined
+            : status >= 400
+                ? PROXY_INTERNAL_ACCOUNT_TYPE
+                : undefined;
+        if (status >= 400) {
+            recordFinalError(status, finalAccountLabel, finalAccountType, {
+                requestId: ctx.requestId,
+                errorType,
+                terminalOutcome: errorType === "client_cancelled"
+                    ? "client_cancelled"
+                    : errorType?.includes("stream")
+                        ? "stream_error"
+                        : "handler_error",
+                message: errorMessage,
+            });
+        }
+        else {
+            recordFinalSuccess(finalAccountLabel, finalAccountType);
+        }
         const traceCtx = tracer?.getTraceContext();
         logRequest({
             timestamp: new Date().toISOString(),
@@ -3459,8 +3351,8 @@ function createClaudeRequestRuntimeContext(args) {
             model: body.model,
             stream: !!body.stream,
             toolCount: Array.isArray(body.tools) ? body.tools.length : 0,
-            account: accountLabel,
-            accountType,
+            account: finalAccountLabel ?? "",
+            accountType: finalAccountType ?? "",
             responseStatus: status,
             responseTimeMs: Date.now() - requestStartTime,
             ...(errorType ? { errorType } : {}),
@@ -3485,7 +3377,6 @@ function createClaudeRequestRuntimeContext(args) {
     const buildLoggedClaudeError = (status, message, errorType, extra) => {
         const errorBody = buildClaudeError(status, message, errorType);
         const errorBodyText = JSON.stringify(errorBody);
-        recordFinalError(status, extra?.account, extra?.accountType);
         logFinalRequest(status, extra?.account ?? "", extra?.accountType ?? "final", errorType, message);
         logProxyBody({
             phase: "client_response",
@@ -3565,7 +3456,7 @@ async function prepareAnthropicAccountAttempt(args) {
     let lastError = currentLastError;
     let authFailureMessage = currentAuthFailureMessage;
     if (needsRefresh(account)) {
-        const refreshed = await refreshToken(account);
+        const refreshed = await refreshTokenFromLatest(account, account.persistTarget);
         if (refreshed.success) {
             if (account.persistTarget) {
                 await persistTokens(account.persistTarget, account);
@@ -4274,6 +4165,31 @@ function isClaudeProxyRouteRuntimeOptions(value) {
         "runtimeConfigProvider" in value &&
         typeof value.runtimeConfigProvider === "function");
 }
+function buildEarlyClaudeRequestError(args) {
+    const { ctx, body, status, message, errorType } = args;
+    recordFinalError(status, PROXY_INTERNAL_ACCOUNT_LABEL, PROXY_INTERNAL_ACCOUNT_TYPE, {
+        requestId: ctx.requestId,
+        errorType,
+        terminalOutcome: "handler_error",
+        message,
+    });
+    void logRequest({
+        timestamp: new Date().toISOString(),
+        requestId: ctx.requestId,
+        method: ctx.method,
+        path: ctx.path,
+        model: typeof body?.model === "string" ? body.model : "",
+        stream: body?.stream ?? false,
+        toolCount: Array.isArray(body?.tools) ? body.tools.length : 0,
+        account: PROXY_INTERNAL_ACCOUNT_LABEL,
+        accountType: PROXY_INTERNAL_ACCOUNT_TYPE,
+        responseStatus: status,
+        responseTimeMs: 0,
+        errorType,
+        errorMessage: message,
+    });
+    return buildClaudeError(status, message);
+}
 /**
  * Create Claude-compatible proxy routes.
  *
@@ -4317,15 +4233,27 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                     // 1. Validate
                     if (typeof body?.model !== "string" ||
                         !Array.isArray(body?.messages)) {
-                        return buildClaudeError(400, "Missing required fields: model, messages");
+                        return buildEarlyClaudeRequestError({
+                            ctx,
+                            body,
+                            status: 400,
+                            message: "Missing required fields: model, messages",
+                            errorType: "invalid_request_error",
+                        });
                     }
                     // 2. Resolve model via router (or pass through to anthropic)
                     // Guard: without a model router, only Claude models are allowed.
                     const modelLower = body.model.toLowerCase();
                     if (!requestModelRouter && !modelLower.startsWith("claude-")) {
-                        return buildClaudeError(404, `Model '${body.model}' is not an Anthropic model. ` +
-                            `The proxy only supports Claude models. ` +
-                            `Use a model router to route non-Claude models to other providers.`);
+                        return buildEarlyClaudeRequestError({
+                            ctx,
+                            body,
+                            status: 404,
+                            message: `Model '${body.model}' is not an Anthropic model. ` +
+                                `The proxy only supports Claude models. ` +
+                                `Use a model router to route non-Claude models to other providers.`,
+                            errorType: "not_found_error",
+                        });
                     }
                     const route = requestModelRouter?.resolve(body.model) ?? {
                         provider: "anthropic",
@@ -4355,6 +4283,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                     tracer,
                                     requestStartTime,
                                     logProxyBody,
+                                    logFinalRequest,
                                 });
                             }
                             return handleAnthropicRoutedClaudeRequest({
@@ -4476,17 +4405,51 @@ function getOrCreateRuntimeState(accountKey) {
     accountRuntimeState.set(accountKey, initial);
     return initial;
 }
+function reconcileEligibleAccountRuntimeState(account) {
+    const state = getOrCreateRuntimeState(account.key);
+    const tokenChanged = state.lastToken !== account.token ||
+        state.lastRefreshToken !== account.refreshToken;
+    const wasPermanentlyDisabled = state.permanentlyDisabled;
+    if (wasPermanentlyDisabled) {
+        logger.always(`[proxy] account=${account.label} is enabled in the token store; clearing stale runtime auth-disable state`);
+    }
+    state.permanentlyDisabled = false;
+    if (tokenChanged || wasPermanentlyDisabled) {
+        state.consecutiveRefreshFailures = 0;
+    }
+    state.lastToken = account.token;
+    state.lastRefreshToken = account.refreshToken;
+}
 async function disableAccountUntilReauth(account, state, reason) {
-    state.permanentlyDisabled = true;
-    // Decision 7 (usage): Persist disabled state to disk so it survives restarts
     try {
         const { tokenStore } = await import("../../auth/tokenStore.js");
-        await tokenStore.markDisabled(account.key, reason);
+        const providerKey = account.persistTarget &&
+            typeof account.persistTarget !== "string" &&
+            "providerKey" in account.persistTarget
+            ? account.persistTarget.providerKey
+            : undefined;
+        if (providerKey) {
+            const disabled = await tokenStore.markDisabledIfCurrent(providerKey, {
+                accessToken: account.token,
+                refreshToken: account.refreshToken,
+                expiresAt: account.expiresAt ?? 0,
+            }, reason);
+            if (!disabled) {
+                state.permanentlyDisabled = false;
+                logger.always(`[proxy] account=${account.label} credentials changed while authentication was in flight; ignored stale disable`);
+                return false;
+            }
+        }
+        else {
+            await tokenStore.markDisabled(account.key, reason);
+        }
     }
     catch (e) {
         logger.debug(`[proxy] failed to persist disabled state for ${account.label}: ${e instanceof Error ? e.message : String(e)}`);
     }
+    state.permanentlyDisabled = true;
     logger.always(`[proxy] account=${account.label} disabled until re-authentication. Run: neurolink auth login anthropic --method oauth`);
+    return true;
 }
 async function coolAccountAfterTransientRefreshFailure(account, state) {
     state.consecutiveRefreshFailures += 1;
@@ -4710,6 +4673,7 @@ export const __testHooks = {
     orderAccountsByQuota,
     resetEpochToMs,
     seedRuntimeQuotasFromDisk,
+    reconcileEligibleAccountRuntimeState,
     getAccountRuntimeState: (key) => {
         const state = accountRuntimeState.get(key);
         return state ? { ...state } : undefined;