@juspay/neurolink 10.4.3 → 10.4.4

package/dist/cli/commands/proxy.d.ts

@@ -57,6 +57,7 @@ export declare function createProxyStartApp(params: {
     readiness: ProxyReadinessState;
 }>;
 export declare const proxyStartCommand: CommandModule<object, ProxyStartArgs>;
+export declare function sanitizeProxyStatusTerminalErrorMessage(message: string): string;
 export declare const proxyStatusCommand: CommandModule<object, ProxyStatusArgs>;
 export declare const proxyTelemetryCommand: CommandModule<object, ProxyTelemetryArgs>;
 export declare const proxyGuardCommand: CommandModule<object, ProxyGuardArgs>;

package/dist/cli/commands/proxy.js

@@ -12,11 +12,12 @@
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { stripVTControlCharacters } from "node:util";
 import chalk from "chalk";
 import ora from "ora";
 import { buildProxyHealthResponse, createProxyReadinessState, markProxyDrainingForUpdate, markProxyReady, resumeProxyConnections, waitForProxyReadiness, } from "../../lib/proxy/proxyHealth.js";
 import { logger } from "../../lib/utils/logger.js";
-import { sanitizeForLog } from "../../lib/utils/logSanitize.js";
+import { redactUrlsInText, sanitizeForLog, } from "../../lib/utils/logSanitize.js";
 import { withTimeout } from "../../lib/utils/async/withTimeout.js";
 import { formatUptime, isProcessRunning, StateFileManager, } from "../utils/serverUtils.js";
 import { configureProxyKeepAliveDispatcher } from "../../lib/proxy/proxyDispatcher.js";
@@ -39,9 +40,11 @@ import { fileURLToPath } from "node:url";
 import packageJson from "../../../package.json" with { type: "json" };
 const _require = createRequire(import.meta.url);
 const PROXY_VERSION = packageJson.version;
+const PROXY_INTERNAL_ACCOUNT_LABEL = "proxy/internal";
 const PROXY_TELEMETRY_SCRIPT_PATH = fileURLToPath(new URL("../../../scripts/observability/manage-local-openobserve.sh", import.meta.url));
 const PROXY_LIFECYCLE_SHUTDOWN_TIMEOUT_MS = 5_000;
 const LEGACY_STATUS_ACCOUNT_CACHE_TTL_MS = 5_000;
+const PROXY_STATUS_TOKEN_READ_TIMEOUT_MS = 2_000;
 let legacyStatusAccountCache;
 // Allowed drift between a pid's OS-reported start time and the persisted
 // ProxySupervisorState.startTime before processLooksLikeProxySupervisor
@@ -353,6 +356,15 @@ async function resolveLegacyStatusAccountLabel(storedAnthropicAccountCount) {
     };
     return label;
 }
+function deriveAccountAllowance(accountKey, now, allowlist, expirations, cooldowns) {
+    const allowed = isAccountAllowed(accountKey, allowlist);
+    const expiresAt = expirations.get(accountKey);
+    return {
+        allowed,
+        expired: expiresAt !== undefined && expiresAt <= now,
+        cooling: (cooldowns[accountKey]?.coolingUntil ?? 0) > now,
+    };
+}
 /**
  * Check if the launchd service is loaded and actively managing the proxy.
  * Returns true if launchctl reports the service as running.
@@ -1248,7 +1260,13 @@ export async function createProxyStartApp(params) {
     const recordRuntimeError = async (metadata, status, errorType, errorMessage, options) => {
         const clientMessage = options?.clientMessage ?? errorMessage;
         const clientErrorType = options?.clientErrorType ?? errorType;
-        recordFinalError(status);
+        recordFinalError(status, undefined, undefined, {
+            requestId: metadata.requestId,
+            errorType,
+            errorCode: options?.errorCode,
+            terminalOutcome: "handler_error",
+            message: errorMessage,
+        });
         await Promise.all([
             logRequest({
                 timestamp: new Date().toISOString(),
@@ -1522,21 +1540,45 @@ export async function createProxyStartApp(params) {
         const activeAccountAllowlist = runtimeConfig
             ? runtimeConfig.accountAllowlist
             : params.accountAllowlist;
-        const { getReconciledStats, getUsageStatsPersistenceStatus } = await import("../../lib/proxy/usageStats.js");
+        const { getReconciledUsageSnapshot, getUsageStatsPersistenceStatus } = await import("../../lib/proxy/usageStats.js");
         const { loadAccountCooldowns } = await import("../../lib/proxy/accountCooldown.js");
-        const stats = await getReconciledStats();
+        const usageSnapshot = await getReconciledUsageSnapshot();
+        const { stats, terminalErrors } = usageSnapshot;
+        const terminalErrorDetailsComparable = usageSnapshot.statsVersion === usageSnapshot.terminalErrorsVersion;
+        const lastTerminalError = terminalErrors.recent.at(-1) ?? null;
+        const terminalErrorDetailsMissing = terminalErrorDetailsComparable
+            ? Math.max(0, stats.totalErrors - terminalErrors.totalErrors)
+            : undefined;
+        const terminalErrorDetailsExcess = terminalErrorDetailsComparable
+            ? Math.max(0, terminalErrors.totalErrors - stats.totalErrors)
+            : undefined;
         const runtimeState = loadProxyState();
         const supervisorState = loadProxySupervisorState();
         const updateState = loadUpdateState();
         const cooldowns = await loadAccountCooldowns();
         const storedAccountKeys = new Set();
+        const storedAccountExpirations = new Map();
         const disabledAccountKeys = new Set();
         let accountInventoryLoaded = false;
         try {
             const { tokenStore } = await import("../../lib/auth/tokenStore.js");
-            for (const key of await tokenStore.listByPrefix("anthropic:")) {
-                storedAccountKeys.add(normalizeAnthropicAccountKey(key));
+            const storedKeys = await tokenStore.listByPrefix("anthropic:");
+            for (const key of storedKeys) {
+                const normalizedKey = normalizeAnthropicAccountKey(key);
+                storedAccountKeys.add(normalizedKey);
             }
+            await Promise.all(storedKeys.map(async (key) => {
+                const normalizedKey = normalizeAnthropicAccountKey(key);
+                try {
+                    const tokens = await withTimeout(tokenStore.peekTokens(key), PROXY_STATUS_TOKEN_READ_TIMEOUT_MS, "[proxy] /status token inspection timed out");
+                    if (tokens) {
+                        storedAccountExpirations.set(normalizedKey, tokens.expiresAt);
+                    }
+                }
+                catch (err) {
+                    logger.debug(`[proxy] /status: failed to inspect token metadata for ${normalizedKey}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }));
             for (const key of await tokenStore.listDisabled()) {
                 disabledAccountKeys.add(normalizeAnthropicAccountKey(key));
             }
@@ -1567,16 +1609,22 @@ export async function createProxyStartApp(params) {
                         ? ENV_ANTHROPIC_ACCOUNT_KEY
                         : normalizedKey;
             const isStored = storedAccountKeys.has(accountKey) || isLegacyAccount;
-            const cooling = (cooldowns[accountKey]?.coolingUntil ?? 0) > now;
-            const accountStatus = disabledAccountKeys.has(accountKey)
-                ? "disabled"
-                : !isAccountAllowed(accountKey, activeAccountAllowlist)
-                    ? "excluded"
-                    : accountInventoryLoaded && account.type === "oauth" && !isStored
-                        ? "removed"
-                        : cooling
-                            ? "cooling"
-                            : "active";
+            const { allowed, expired, cooling } = deriveAccountAllowance(accountKey, now, activeAccountAllowlist, storedAccountExpirations, cooldowns);
+            const accountStatus = account.type === "internal"
+                ? "internal"
+                : disabledAccountKeys.has(accountKey)
+                    ? "disabled"
+                    : expired
+                        ? "expired"
+                        : !allowed
+                            ? "excluded"
+                            : accountInventoryLoaded &&
+                                account.type === "oauth" &&
+                                !isStored
+                                ? "removed"
+                                : cooling
+                                    ? "cooling"
+                                    : "active";
             return {
                 label: account.label,
                 type: account.type,
@@ -1590,8 +1638,43 @@ export async function createProxyStartApp(params) {
                 quotaRateLimits: account.quotaRateLimitCount,
                 cooling,
                 status: accountStatus,
+                allowed: account.type === "internal" ? undefined : allowed,
+                expired: account.type === "oauth" ? expired : undefined,
             };
         });
+        const representedAccountKeys = new Set(accountRows
+            .filter((account) => account.type === "oauth")
+            .map((account) => normalizeAnthropicAccountKey(account.label)));
+        for (const accountKey of storedAccountKeys) {
+            if (representedAccountKeys.has(accountKey)) {
+                continue;
+            }
+            const { allowed, expired, cooling } = deriveAccountAllowance(accountKey, now, activeAccountAllowlist, storedAccountExpirations, cooldowns);
+            accountRows.push({
+                label: accountKey.slice("anthropic:".length),
+                type: "oauth",
+                attempts: 0,
+                requests: 0,
+                success: 0,
+                errors: 0,
+                attemptErrors: 0,
+                rateLimits: 0,
+                transientRateLimits: 0,
+                quotaRateLimits: 0,
+                cooling,
+                status: disabledAccountKeys.has(accountKey)
+                    ? "disabled"
+                    : expired
+                        ? "expired"
+                        : !allowed
+                            ? "excluded"
+                            : cooling
+                                ? "cooling"
+                                : "active",
+                allowed,
+                expired,
+            });
+        }
         const attributed = accountRows.reduce((total, account) => ({
             attempts: total.attempts + (account.attempts ?? 0),
             requests: total.requests + (account.requests ?? 0),
@@ -1622,13 +1705,33 @@ export async function createProxyStartApp(params) {
             quotaRateLimits: Math.max(0, stats.totalQuotaRateLimits - attributed.quotaRateLimits),
         };
         if (Object.values(unattributed).some((count) => count > 0)) {
-            accountRows.push({
-                label: "unattributed",
-                type: "internal",
-                ...unattributed,
-                cooling: false,
-                status: "unattributed",
-            });
+            const internalRow = accountRows.find((account) => account.label === PROXY_INTERNAL_ACCOUNT_LABEL);
+            if (internalRow) {
+                internalRow.attempts =
+                    (internalRow.attempts ?? 0) + unattributed.attempts;
+                internalRow.requests =
+                    (internalRow.requests ?? 0) + unattributed.requests;
+                internalRow.success = (internalRow.success ?? 0) + unattributed.success;
+                internalRow.errors = (internalRow.errors ?? 0) + unattributed.errors;
+                internalRow.attemptErrors =
+                    (internalRow.attemptErrors ?? 0) + unattributed.attemptErrors;
+                internalRow.rateLimits =
+                    (internalRow.rateLimits ?? 0) + unattributed.rateLimits;
+                internalRow.transientRateLimits =
+                    (internalRow.transientRateLimits ?? 0) +
+                        unattributed.transientRateLimits;
+                internalRow.quotaRateLimits =
+                    (internalRow.quotaRateLimits ?? 0) + unattributed.quotaRateLimits;
+            }
+            else {
+                accountRows.push({
+                    label: PROXY_INTERNAL_ACCOUNT_LABEL,
+                    type: "internal",
+                    ...unattributed,
+                    cooling: false,
+                    status: "internal",
+                });
+            }
         }
         return c.json({
             status: "running",
@@ -1652,6 +1755,11 @@ export async function createProxyStartApp(params) {
                 totalRateLimits: stats.totalRateLimits,
                 totalTransientRateLimits: stats.totalTransientRateLimits,
                 totalQuotaRateLimits: stats.totalQuotaRateLimits,
+                terminalErrors,
+                lastTerminalError,
+                terminalErrorDetailsComparable,
+                terminalErrorDetailsMissing,
+                terminalErrorDetailsExcess,
                 accounts: accountRows,
                 primaryAccount,
                 persistence: getUsageStatsPersistenceStatus(),
@@ -2436,6 +2544,12 @@ async function startProxyCommandHandler(argv) {
         else if (usageStatsPersistence.lastRecoveryAt) {
             logger.warn(`[proxy] recovered corrupt usage statistics state at ${new Date(usageStatsPersistence.lastRecoveryAt).toISOString()}`);
         }
+        if (usageStatsPersistence.terminalErrorsLastError) {
+            logger.warn(`[proxy] terminal-error persistence unavailable: ${usageStatsPersistence.terminalErrorsLastError}`);
+        }
+        else if (usageStatsPersistence.terminalErrorsLastRecoveryAt) {
+            logger.warn(`[proxy] recovered corrupt terminal-error state at ${new Date(usageStatsPersistence.terminalErrorsLastRecoveryAt).toISOString()}`);
+        }
         const baseEnv = { ...process.env };
         const envResolution = resolveProxyEnvFile({
             explicitEnvFile: argv.envFile,
@@ -2588,8 +2702,17 @@ export const proxyStartCommand = {
 // =============================================================================
 // STATUS DISPLAY HELPERS
 // =============================================================================
+export function sanitizeProxyStatusTerminalErrorMessage(message) {
+    return stripVTControlCharacters(sanitizeForLog(redactUrlsInText(message), 700))
+        .replace(/\s+/g, " ")
+        .trim()
+        .slice(0, 200);
+}
 function printStatusStats(stats) {
     console.info(`\n  Stats:`);
+    if (stats.startedAt !== undefined) {
+        console.info(`    Since:       ${new Date(stats.startedAt).toISOString()}`);
+    }
     if (stats.totalAttempts !== undefined) {
         console.info(`    Attempts:    ${stats.totalAttempts}`);
     }
@@ -2602,6 +2725,32 @@ function printStatusStats(stats) {
             stats.totalQuotaRateLimits !== undefined
             ? ` (${stats.totalTransientRateLimits} transient, ${stats.totalQuotaRateLimits} quota)`
             : ""));
+    if (stats.terminalErrors) {
+        const causes = Object.entries(stats.terminalErrors.counts)
+            .filter(([, count]) => count > 0)
+            .map(([category, count]) => `${category}=${count}`)
+            .join(", ");
+        console.info(`    Error details: ${stats.terminalErrors.totalErrors}/${stats.totalErrors}` +
+            (causes ? ` (${causes})` : ""));
+        console.info(`    Detail since: ${new Date(stats.terminalErrors.startedAt).toISOString()}`);
+        if ((stats.terminalErrorDetailsMissing ?? 0) > 0 ||
+            (stats.terminalErrorDetailsExcess ?? 0) > 0) {
+            console.info(`    Detail gap:  ${stats.terminalErrorDetailsMissing ?? 0} missing, ${stats.terminalErrorDetailsExcess ?? 0} awaiting counter reconciliation`);
+        }
+        else if (stats.terminalErrorDetailsComparable === false) {
+            console.info("    Detail gap:  unavailable during snapshot reconciliation");
+        }
+        const lastError = stats.lastTerminalError ?? stats.terminalErrors.recent.at(-1);
+        if (lastError) {
+            const cause = lastError.errorType ?? lastError.category;
+            const code = lastError.errorCode ? `/${lastError.errorCode}` : "";
+            const account = lastError.account ? ` account=${lastError.account}` : "";
+            console.info(`    Last error:  ${new Date(lastError.at).toISOString()} ${cause}${code} status=${lastError.status}${account}`);
+            if (lastError.message) {
+                console.info(`    Last cause:  ${sanitizeProxyStatusTerminalErrorMessage(lastError.message)}`);
+            }
+        }
+    }
     if (stats.accounts?.length) {
         console.info(`\n  Accounts:`);
         const headers = [
@@ -2620,7 +2769,17 @@ function printStatusStats(stats) {
             String(account.success ?? 0),
             String(account.errors ?? 0),
             String(account.rateLimits ?? 0),
-            account.status ?? (account.cooling ? "cooling" : "active"),
+            (() => {
+                const status = account.status ?? (account.cooling ? "cooling" : "active");
+                const states = [status];
+                if (account.expired && status !== "expired") {
+                    states.push("expired");
+                }
+                if (account.allowed === false && status !== "excluded") {
+                    states.push("excluded");
+                }
+                return states.join(", ");
+            })(),
         ]);
         const widths = headers.map((header, index) => Math.max(header.length, ...rows.map((row) => row[index].length)));
         const numericColumns = new Set([2, 3, 4, 5]);

package/dist/lib/auth/tokenStore.d.ts

@@ -96,6 +96,8 @@ export declare class TokenStore {
      * @throws TokenStoreError if reading fails (other than file not found)
      */
     loadTokens(provider: string): Promise<StoredOAuthTokens | null>;
+    /** Reads tokens without updating access metadata or rewriting the store. */
+    peekTokens(provider: string): Promise<StoredOAuthTokens | null>;
     /**
      * Internal load without mutex — callers must already hold the mutex.
      */
@@ -179,6 +181,11 @@ export declare class TokenStore {
      * @param reason - Optional human-readable reason (e.g., "refresh_failed")
      */
     markDisabled(provider: string, reason?: string): Promise<void>;
+    /**
+     * Disables an account only when the persisted credentials still match the
+     * request that observed the authentication failure.
+     */
+    markDisabledIfCurrent(provider: string, expectedTokens: Pick<StoredOAuthTokens, "accessToken" | "refreshToken" | "expiresAt">, reason?: string): Promise<boolean>;
     /**
      * Re-enables a previously disabled provider (persisted to disk).
      *

package/dist/lib/auth/tokenStore.js

@@ -213,6 +213,22 @@ export class TokenStore {
             return result;
         });
     }
+    /** Reads tokens without updating access metadata or rewriting the store. */
+    async peekTokens(provider) {
+        return this._mutex.runExclusive(async () => {
+            try {
+                const storageData = await this.loadStorageData();
+                const tokens = storageData.providers[provider]?.tokens;
+                return tokens ? { ...tokens } : null;
+            }
+            catch (error) {
+                if (error instanceof TokenStoreError && error.code === "NOT_FOUND") {
+                    return null;
+                }
+                throw error;
+            }
+        });
+    }
     /**
      * Internal load without mutex — callers must already hold the mutex.
      */
@@ -539,6 +555,44 @@ export class TokenStore {
             });
         });
     }
+    /**
+     * Disables an account only when the persisted credentials still match the
+     * request that observed the authentication failure.
+     */
+    async markDisabledIfCurrent(provider, expectedTokens, reason) {
+        return this._mutex.runExclusive(async () => {
+            let storageData;
+            try {
+                storageData = await this.loadStorageData();
+            }
+            catch (error) {
+                if (error instanceof TokenStoreError && error.code === "NOT_FOUND") {
+                    return false;
+                }
+                throw error;
+            }
+            const providerData = storageData.providers[provider];
+            if (!providerData) {
+                return false;
+            }
+            const current = providerData.tokens;
+            if (current.accessToken !== expectedTokens.accessToken ||
+                current.refreshToken !== expectedTokens.refreshToken ||
+                current.expiresAt !== expectedTokens.expiresAt) {
+                return false;
+            }
+            providerData.disabled = true;
+            providerData.disabledAt = Date.now();
+            providerData.disabledReason = reason;
+            storageData.lastModified = Date.now();
+            await this.saveStorageData(storageData);
+            logger.info("Provider marked as disabled", {
+                provider,
+                reason: reason ?? "unspecified",
+            });
+            return true;
+        });
+    }
     /**
      * Re-enables a previously disabled provider (persisted to disk).
      *

package/dist/lib/proxy/proxyTranslationEngine.d.ts

@@ -77,6 +77,7 @@ export declare function handleTranslatedJsonRequest(args: {
     attempts: ProxyTranslationAttempt[];
     tracer?: ProxyTracer;
     requestStartTime: number;
+    terminalFailureStatus?: number;
 }): Promise<unknown>;
 /**
  * Build the /v1/models response in OpenAI list format.

package/dist/lib/proxy/proxyTranslationEngine.js

@@ -247,6 +247,7 @@ export async function handleTranslatedStreamRequest(args) {
     let keepAliveTimer;
     let cancelled = false;
     let succeeded = false;
+    let streamInterruptedAfterOutput = false;
     let translatedModel;
     let finalStreamError = "No translation providers succeeded";
     let upstreamIterator;
@@ -267,6 +268,9 @@ export async function handleTranslatedStreamRequest(args) {
             }, KEEPALIVE_INTERVAL_MS);
             try {
                 for (let attemptIndex = 0; attemptIndex < attempts.length; attemptIndex++) {
+                    if (cancelled) {
+                        break;
+                    }
                     const attempt = attempts[attemptIndex];
                     lastAttemptLabel = attempt.label ?? "translation";
                     logger.always(`[proxy:${format}] attempt ${attemptIndex + 1}/${attempts.length}: ${attempt.label}`);
@@ -295,10 +299,14 @@ export async function handleTranslatedStreamRequest(args) {
                                 }
                             }
                         }
+                        if (cancelled) {
+                            return;
+                        }
                         const toolCalls = streamResult.toolCalls ?? [];
                         if (!hasTranslatedOutput(collectedText, toolCalls)) {
                             finalStreamError = `Translated provider ${attempt.label} returned no content or tool calls`;
                             logger.debug(`${tag} translation attempt ${attempt.label} returned no content or tool calls`);
+                            recordAttemptError(lastAttemptLabel, "translation", 502);
                             continue;
                         }
                         if (!cancelled && toolCalls.length) {
@@ -331,7 +339,6 @@ export async function handleTranslatedStreamRequest(args) {
                         tracer?.recordMetrics();
                         translatedModel = streamResult.model;
                         succeeded = true;
-                        recordFinalSuccess(lastAttemptLabel, "translation");
                         return;
                     }
                     catch (streamErr) {
@@ -343,6 +350,8 @@ export async function handleTranslatedStreamRequest(args) {
                                 ? streamErr.message
                                 : String(streamErr);
                         if (collectedText.trim().length > 0) {
+                            streamInterruptedAfterOutput = true;
+                            recordAttemptError(lastAttemptLabel, "translation", 502);
                             logger.always(`${tag} mid-stream error: ${finalStreamError}`);
                             for (const frame of serializer.emitError(`Upstream stream interrupted: ${finalStreamError}`)) {
                                 controller.enqueue(encoder.encode(frame));
@@ -354,7 +363,6 @@ export async function handleTranslatedStreamRequest(args) {
                     }
                 }
                 // All attempts exhausted
-                recordFinalError(500, lastAttemptLabel, "translation");
                 if (!cancelled) {
                     logger.always(`${tag} all translation attempts failed: ${finalStreamError}`);
                     for (const frame of serializer.emitError(finalStreamError)) {
@@ -372,12 +380,38 @@ export async function handleTranslatedStreamRequest(args) {
                 if (tracer && translatedModel && translatedModel !== requestModel) {
                     tracer.setModelSubstitution(requestModel, translatedModel);
                 }
-                if (!succeeded) {
-                    tracer?.setError("generation_error", finalStreamError.slice(0, 500));
+                const terminalStatus = cancelled
+                    ? 499
+                    : succeeded
+                        ? 200
+                        : streamInterruptedAfterOutput
+                            ? 502
+                            : 500;
+                const terminalErrorType = cancelled
+                    ? "client_cancelled"
+                    : streamInterruptedAfterOutput
+                        ? "stream_error"
+                        : succeeded
+                            ? undefined
+                            : "generation_error";
+                const terminalErrorMessage = cancelled
+                    ? "Client cancelled the streaming response"
+                    : succeeded
+                        ? undefined
+                        : finalStreamError;
+                if (terminalErrorType && terminalErrorMessage) {
+                    tracer?.setError(terminalErrorType, terminalErrorMessage.slice(0, 500));
+                    recordFinalError(terminalStatus, lastAttemptLabel, "translation", {
+                        requestId: ctx.requestId,
+                        errorType: terminalErrorType,
+                        terminalOutcome: terminalErrorType,
+                        message: terminalErrorMessage,
+                    });
+                }
+                else {
+                    recordFinalSuccess(lastAttemptLabel, "translation");
                 }
-                // Use the real outcome status so trace data matches the logged
-                // responseStatus below (success path is 200, exhausted-attempts path is 500).
-                tracer?.end(succeeded ? 200 : 500, Date.now() - requestStartTime);
+                tracer?.end(terminalStatus, Date.now() - requestStartTime);
                 const traceCtx = tracer?.getTraceContext();
                 logRequest({
                     timestamp: new Date().toISOString(),
@@ -389,8 +423,12 @@ export async function handleTranslatedStreamRequest(args) {
                     toolCount: Object.keys(parsed.tools).length,
                     account: "translation",
                     accountType: "translation",
-                    responseStatus: succeeded ? 200 : 500,
+                    responseStatus: terminalStatus,
                     responseTimeMs: Date.now() - requestStartTime,
+                    ...(terminalErrorType ? { errorType: terminalErrorType } : {}),
+                    ...(terminalErrorMessage
+                        ? { errorMessage: terminalErrorMessage.slice(0, 500) }
+                        : {}),
                     ...(traceCtx?.traceId ? { traceId: traceCtx.traceId } : {}),
                     ...(traceCtx?.spanId ? { spanId: traceCtx.spanId } : {}),
                 });
@@ -424,7 +462,7 @@ export async function handleTranslatedStreamRequest(args) {
  * Handles a translated non-streaming request for either Claude or OpenAI format.
  */
 export async function handleTranslatedJsonRequest(args) {
-    const { ctx, format, requestModel, parsed, attempts, tracer, requestStartTime, } = args;
+    const { ctx, format, requestModel, parsed, attempts, tracer, requestStartTime, terminalFailureStatus = 500, } = args;
     const tag = logTag(format);
     let lastAttemptError = "No translation providers succeeded";
     let lastAttemptLabel = "translation";
@@ -448,6 +486,7 @@ export async function handleTranslatedJsonRequest(args) {
             if (!hasTranslatedOutput(collectedText, streamResult.toolCalls)) {
                 lastAttemptError = `Translated provider ${attempt.label} returned no content or tool calls`;
                 logger.debug(`${tag} translation attempt ${attempt.label} returned no content or tool calls`);
+                recordAttemptError(lastAttemptLabel, "translation", 502);
                 continue;
             }
             const internal = {
@@ -505,9 +544,14 @@ export async function handleTranslatedJsonRequest(args) {
             recordAttemptError(lastAttemptLabel, "translation", 500);
         }
     }
-    recordFinalError(500, lastAttemptLabel, "translation");
+    recordFinalError(terminalFailureStatus, lastAttemptLabel, "translation", {
+        requestId: ctx.requestId,
+        errorType: "generation_error",
+        terminalOutcome: "handler_error",
+        message: lastAttemptError,
+    });
     tracer?.setError("generation_error", lastAttemptError.slice(0, 500));
-    tracer?.end(500, Date.now() - requestStartTime);
+    tracer?.end(terminalFailureStatus, Date.now() - requestStartTime);
     const traceCtx = tracer?.getTraceContext();
     logRequest({
         timestamp: new Date().toISOString(),
@@ -519,7 +563,7 @@ export async function handleTranslatedJsonRequest(args) {
         toolCount: Object.keys(parsed.tools).length,
         account: "translation",
         accountType: "translation",
-        responseStatus: 500,
+        responseStatus: terminalFailureStatus,
         responseTimeMs: Date.now() - requestStartTime,
         errorType: "generation_error",
         errorMessage: lastAttemptError.slice(0, 500),

package/dist/lib/proxy/rawStreamCapture.js

@@ -60,7 +60,11 @@ export function createRawStreamCapture() {
         },
     });
     const innerWriter = transform.writable.getWriter();
+    let writableController;
     const writable = new WritableStream({
+        start(controller) {
+            writableController = controller;
+        },
         write(chunk) {
             return innerWriter.write(chunk);
         },
@@ -72,9 +76,51 @@ export function createRawStreamCapture() {
             return innerWriter.abort(reason);
         },
     });
+    // A downstream reader cancellation errors the TransformStream's writable
+    // side, but this wrapper otherwise hides that state from the upstream pipe.
+    // Mirror it onto the wrapper so cancellation reaches the source reader.
+    void innerWriter.closed.catch((reason) => {
+        settle();
+        try {
+            writableController.error(reason);
+        }
+        catch {
+            // The wrapper may already be closing or aborted.
+        }
+    });
+    const innerReader = transform.readable.getReader();
+    const readable = new ReadableStream({
+        async pull(controller) {
+            try {
+                const { done, value } = await innerReader.read();
+                if (done) {
+                    controller.close();
+                }
+                else {
+                    controller.enqueue(value);
+                }
+            }
+            catch (error) {
+                controller.error(error);
+            }
+        },
+        async cancel(reason) {
+            settle();
+            try {
+                writableController.error(reason);
+            }
+            catch {
+                // The wrapper may already be closing or aborted.
+            }
+            await Promise.allSettled([
+                innerReader.cancel(reason),
+                innerWriter.abort(reason),
+            ]);
+        },
+    });
     return {
         stream: {
-            readable: transform.readable,
+            readable,
             writable,
         },
         capture,