@juspay/neurolink 10.8.5 → 10.8.7

package/dist/lib/server/routes/openaiProxyRoutes.js

@@ -321,7 +321,7 @@ export function createOpenAIProxyRoutes(modelRouter, basePath = "", loopbackPort
                         model: targetModel,
                     }, requestModelRouter?.getFallbackChain() ?? [], body.model, 
                     // The classifier only reads fields present on both types.
-                    adapted);
+                    adapted, requestModelRouter?.isAutoFallbackEnabled?.() ?? false);
                     const attempts = plan.attempts;
                     // --- Optional tracing ---
                     let tracer;

package/dist/lib/types/proxy.d.ts

@@ -29,6 +29,8 @@ export type ModelRouterInterface = {
     resolve(requestedModel: string): RouteResult;
     isClaudeTarget(requestedModel: string): boolean;
     getFallbackChain(): FallbackEntry[];
+    isAutoFallbackEnabled?(): boolean;
+    getMaxInflightPerAccount?(): number;
     getModelMappings?: () => ModelMapping[];
     getPassthroughModels?: () => string[];
 };
@@ -639,6 +641,27 @@ export type AnthropicSuccessResult = {
     };
 } | {
     response: Response | unknown;
+    holdsAccountAdmission?: boolean;
+};
+/** A release handle for one in-flight request admitted to an OAuth account. */
+export type AccountAdmissionLease = {
+    release(): void;
+};
+/** A cancellable queued request for per-account admission capacity. */
+export type QueuedAccountAdmission = {
+    accountKey: string;
+    promise: Promise<AccountAdmissionLease>;
+    cancel(): void;
+};
+/** One queued request waiting for per-account admission capacity. */
+export type AccountAdmissionWaiter = {
+    capacity: number;
+    resolve: (lease: AccountAdmissionLease) => void;
+};
+/** In-process request admission state for an OAuth account. */
+export type AccountAdmissionState = {
+    active: number;
+    waiters: AccountAdmissionWaiter[];
 };
 /** Result of buffering only enough upstream SSE to make a retry-safe decision. */
 export type AnthropicStreamPreflightResult = {
@@ -669,6 +692,7 @@ export type ParsedSSEBuffer = {
 };
 export type AnthropicAuthRetryResult = {
     response?: Response | unknown;
+    holdsAccountAdmission?: boolean;
     continueLoop: boolean;
     lastError: unknown;
     authFailureMessage: string | null;
@@ -1925,6 +1949,8 @@ export type RollingManagedWorker = {
     generation: number;
     version: string;
     dispose: () => void;
+    pendingTransfers: number;
+    drainRequested: boolean;
 };
 export type RollingCandidateWorker = RollingManagedWorker & {
     expectedVersion: string;

package/dist/lib/types/subscription.d.ts

@@ -908,6 +908,10 @@ export type ProxyRoutingConfig = {
     strategy: "round-robin" | "fill-first";
     modelMappings: ModelMapping[];
     fallbackChain: FallbackEntry[];
+    /** Permit a last-resort provider chosen by the translation layer. Disabled by default. */
+    autoFallback?: boolean;
+    /** Maximum in-flight upstream requests per OAuth account. Defaults to two. */
+    maxInflightPerAccount?: number;
     passthroughModels?: string[];
     /** Enable quota-aware fill-first account ordering. Defaults to true. */
     quotaRouting?: boolean;

package/dist/lib/utils/messageBuilder.d.ts

@@ -12,6 +12,31 @@ export declare function convertToModelMessages(messages: MultimodalChatMessage[]
  * Enhanced with CSV file processing support
  */
 export declare function buildMessagesArray(options: TextGenerationOptions | StreamOptions): Promise<ModelMessage[]>;
+/**
+ * Fold the `audioFiles` / `videoFiles` aliases into the unified `files` array.
+ *
+ * #284 gave audio and video their own input fields, but neither has a
+ * dedicated processor — both are meant to travel through the same
+ * auto-detecting `files` pipeline that already understands "audio"/"video"
+ * FileDetector results (see `appendDetectedFileResult`). The fold used to live
+ * inline in `buildMultimodalMessagesArray`, which meant any path that bypassed
+ * that builder never performed it and dropped the files silently: the model
+ * received the prompt alone and answered as though nothing were attached
+ * (#1259). GoogleVertex's native SDK path and `buildMultimodalOptions`
+ * (Bedrock) are both such paths, so the fold has to be callable from them.
+ *
+ * The aliases are cleared once merged, which makes the call idempotent: a
+ * provider override and the shared builder can both call this on the same
+ * options object without attaching every file twice.
+ *
+ * Mutates in place, matching `processUnifiedFilesArray` below — downstream
+ * stages all read `options.input.files`.
+ */
+export declare function mergeMediaFileAliases<TFile>(input: {
+    files?: Array<TFile | Buffer | string>;
+    audioFiles?: Array<Buffer | string>;
+    videoFiles?: Array<Buffer | string>;
+}): void;
 /**
  * Process the unified files array with auto-detection.
  * Handles lazy file registration, full processing, and preview injection.

package/dist/lib/utils/messageBuilder.js

@@ -777,6 +777,38 @@ function appendDetectedFileResult(result, file, options) {
         logger.info(`[FileDetector] ⚠️ Unknown format (metadata extracted): ${filename}`);
     }
 }
+/**
+ * Fold the `audioFiles` / `videoFiles` aliases into the unified `files` array.
+ *
+ * #284 gave audio and video their own input fields, but neither has a
+ * dedicated processor — both are meant to travel through the same
+ * auto-detecting `files` pipeline that already understands "audio"/"video"
+ * FileDetector results (see `appendDetectedFileResult`). The fold used to live
+ * inline in `buildMultimodalMessagesArray`, which meant any path that bypassed
+ * that builder never performed it and dropped the files silently: the model
+ * received the prompt alone and answered as though nothing were attached
+ * (#1259). GoogleVertex's native SDK path and `buildMultimodalOptions`
+ * (Bedrock) are both such paths, so the fold has to be callable from them.
+ *
+ * The aliases are cleared once merged, which makes the call idempotent: a
+ * provider override and the shared builder can both call this on the same
+ * options object without attaching every file twice.
+ *
+ * Mutates in place, matching `processUnifiedFilesArray` below — downstream
+ * stages all read `options.input.files`.
+ */
+export function mergeMediaFileAliases(input) {
+    if (!input.audioFiles?.length && !input.videoFiles?.length) {
+        return;
+    }
+    input.files = [
+        ...(input.files ?? []),
+        ...(input.audioFiles ?? []),
+        ...(input.videoFiles ?? []),
+    ];
+    input.audioFiles = undefined;
+    input.videoFiles = undefined;
+}
 /**
  * Process the unified files array with auto-detection.
  * Handles lazy file registration, full processing, and preview injection.
@@ -1115,18 +1147,7 @@ export async function buildMultimodalMessagesArray(options, provider, model) {
     // local const so TypeScript sees the definite (non-optional) type in the
     // rest of this function, avoiding 60+ "possibly undefined" errors.
     const inp = options.input;
-    // #284: audioFiles/videoFiles have no dedicated processor — route them
-    // through the same auto-detecting `files` pipeline that already
-    // understands "audio"/"video" FileDetector results (see
-    // appendDetectedFileResult), instead of silently dropping them once
-    // detectMultimodal() routes an audio/video-only request here.
-    if (inp.audioFiles?.length || inp.videoFiles?.length) {
-        inp.files = [
-            ...(inp.files || []),
-            ...(inp.audioFiles || []),
-            ...(inp.videoFiles || []),
-        ];
-    }
+    mergeMediaFileAliases(inp);
     // Compute provider-specific max PDF size once for consistent validation
     const pdfConfig = PDFProcessor.getProviderConfig(provider);
     const maxSize = pdfConfig

package/dist/lib/utils/multimodalOptionsBuilder.d.ts

@@ -12,6 +12,8 @@ import type { StreamOptions } from "../types/index.js";
  *   - input.files: Auto-detected file types
  *   - input.csvFiles: CSV files for tabular data
  *   - input.pdfFiles: PDF documents (Buffer | string paths)
+ *   - input.audioFiles: Audio files (Buffer | string paths)
+ *   - input.videoFiles: Video files (Buffer | string paths)
  *   - csvOptions: CSV parsing options
  *   - systemPrompt: System-level instructions
  *   - conversationMessages: Chat history
@@ -23,7 +25,7 @@ import type { StreamOptions } from "../types/index.js";
  * @param {string} providerName - Provider identifier (e.g., "vertex", "openai", "anthropic")
  * @param {string} modelName - Model identifier (e.g., "gemini-2.5-flash", "gpt-4o")
  * @returns {object} Normalized options object with:
- *   - input: { text, images, content, files, csvFiles, pdfFiles }
+ *   - input: { text, images, content, files, csvFiles, pdfFiles, audioFiles, videoFiles }
  *   - csvOptions: CSV processing options
  *   - systemPrompt: System prompt string
  *   - conversationHistory: Message history array
@@ -49,6 +51,8 @@ export declare function buildMultimodalOptions(options: StreamOptions, providerN
         files: (string | Buffer<ArrayBufferLike> | import("../types/file.js").FileWithMetadata)[] | undefined;
         csvFiles: (string | Buffer<ArrayBufferLike>)[] | undefined;
         pdfFiles: (string | Buffer<ArrayBufferLike>)[] | undefined;
+        audioFiles: (string | Buffer<ArrayBufferLike>)[] | undefined;
+        videoFiles: (string | Buffer<ArrayBufferLike>)[] | undefined;
     };
     csvOptions: import("../types/file.js").CSVProcessorOptions | undefined;
     pdfOptions: {

package/dist/lib/utils/multimodalOptionsBuilder.js

@@ -11,6 +11,8 @@
  *   - input.files: Auto-detected file types
  *   - input.csvFiles: CSV files for tabular data
  *   - input.pdfFiles: PDF documents (Buffer | string paths)
+ *   - input.audioFiles: Audio files (Buffer | string paths)
+ *   - input.videoFiles: Video files (Buffer | string paths)
  *   - csvOptions: CSV parsing options
  *   - systemPrompt: System-level instructions
  *   - conversationMessages: Chat history
@@ -22,7 +24,7 @@
  * @param {string} providerName - Provider identifier (e.g., "vertex", "openai", "anthropic")
  * @param {string} modelName - Model identifier (e.g., "gemini-2.5-flash", "gpt-4o")
  * @returns {object} Normalized options object with:
- *   - input: { text, images, content, files, csvFiles, pdfFiles }
+ *   - input: { text, images, content, files, csvFiles, pdfFiles, audioFiles, videoFiles }
  *   - csvOptions: CSV processing options
  *   - systemPrompt: System prompt string
  *   - conversationHistory: Message history array
@@ -49,6 +51,11 @@ export function buildMultimodalOptions(options, providerName, modelName) {
             files: options.input?.files,
             csvFiles: options.input?.csvFiles,
             pdfFiles: options.input?.pdfFiles,
+            // #1259: this is a whitelist — a field omitted here is dropped
+            // silently, and the model answers as though nothing were attached.
+            // audioFiles/videoFiles were missing, so Bedrock received neither.
+            audioFiles: options.input?.audioFiles,
+            videoFiles: options.input?.videoFiles,
         },
         csvOptions: options.csvOptions,
         pdfOptions: options.pdfOptions,

package/dist/providers/googleVertex/client.d.ts

@@ -141,6 +141,26 @@ export declare class GoogleVertexProvider extends BaseProvider {
      * Validate stream options
      */
     private validateStreamOptionsOnly;
+    /**
+     * Preprocess file input before routing to the native SDKs.
+     *
+     * BaseProvider runs this via `buildMultimodalMessagesArray`, but Vertex
+     * overrides both `generate()` and `executeStream()` to reach the native
+     * @google/genai / @anthropic-ai/vertex-sdk clients directly, so neither
+     * inherits it. Without this the file content never reaches the model and
+     * the reply is an entirely plausible "no document is attached" — a silent
+     * wrong answer rather than an error.
+     *
+     * #1258: only `generate()` used to call this, so the same document that
+     * `generate()` read back correctly came back as "no documents attached"
+     * through `stream()`. Sharing one method is what keeps the two paths from
+     * drifting apart again.
+     *
+     * #1259: the alias fold has to happen *before* the `files` check, or
+     * requests carrying only `audioFiles`/`videoFiles` look empty here and skip
+     * preprocessing entirely.
+     */
+    private preprocessNativeFileInput;
     protected executeStream(options: StreamOptions, _analysisSchema?: ZodType<unknown> | Schema<unknown>): Promise<StreamResult>;
     /**
      * Emit `stream:end` so the Pipeline B observability listener creates a

package/dist/providers/googleVertex/client.js

@@ -14,7 +14,7 @@ import { AuthenticationError, InvalidModelError, NetworkError, ProviderError, Ra
 import { ERROR_CODES, NeuroLinkError } from "../../utils/errorHandling.js";
 import { applyVertexAnthropicCacheBreakpoints } from "../../utils/anthropicCacheBreakpoints.js";
 import { FileDetector } from "../../utils/fileDetector.js";
-import { processUnifiedFilesArray } from "../../utils/messageBuilder.js";
+import { mergeMediaFileAliases, processUnifiedFilesArray, } from "../../utils/messageBuilder.js";
 import { logger } from "../../utils/logger.js";
 import { hasRestrictedOutputLimit, RESTRICTED_OUTPUT_TOKEN_LIMIT, toVertexAnthropicModelId, } from "../../utils/modelDetection.js";
 import { detectImageMimeType } from "../../utils/imageDetection.js";
@@ -868,6 +868,40 @@ export class GoogleVertexProvider extends BaseProvider {
     validateStreamOptionsOnly(options) {
         this.validateStreamOptions(options);
     }
+    /**
+     * Preprocess file input before routing to the native SDKs.
+     *
+     * BaseProvider runs this via `buildMultimodalMessagesArray`, but Vertex
+     * overrides both `generate()` and `executeStream()` to reach the native
+     * @google/genai / @anthropic-ai/vertex-sdk clients directly, so neither
+     * inherits it. Without this the file content never reaches the model and
+     * the reply is an entirely plausible "no document is attached" — a silent
+     * wrong answer rather than an error.
+     *
+     * #1258: only `generate()` used to call this, so the same document that
+     * `generate()` read back correctly came back as "no documents attached"
+     * through `stream()`. Sharing one method is what keeps the two paths from
+     * drifting apart again.
+     *
+     * #1259: the alias fold has to happen *before* the `files` check, or
+     * requests carrying only `audioFiles`/`videoFiles` look empty here and skip
+     * preprocessing entirely.
+     */
+    async preprocessNativeFileInput(options) {
+        if (options.input) {
+            mergeMediaFileAliases(options.input);
+        }
+        if (!options.input?.files?.length) {
+            return;
+        }
+        try {
+            // Mutates options.input.text / .images / .pdfFiles in place.
+            await processUnifiedFilesArray(options, 100 * 1024 * 1024, this.providerName);
+        }
+        catch (fileError) {
+            logger.warn(`[GoogleVertex] processUnifiedFilesArray threw, continuing without file content: ${fileError instanceof Error ? fileError.message : String(fileError)}`);
+        }
+    }
     async executeStream(options, _analysisSchema) {
         // ALL models now use native SDKs - no more @ai-sdk/google-vertex dependency
         const modelName = options.model || this.modelName || getDefaultVertexModel();
@@ -889,6 +923,9 @@ export class GoogleVertexProvider extends BaseProvider {
             // Tool filter (a0269210): trust options.tools — caller (BaseProvider.stream)
             // already merged MCP/built-in tools and applied any enabledToolNames filter.
             const optionTools = options.tools || {};
+            // #1258: stream() must run the same file preprocessing generate()
+            // does, or attached files are dropped on this path alone.
+            await this.preprocessNativeFileInput(options);
             // Emit a `neurolink.message.build` span for the native stream path
             // so observability tooling sees the same hierarchy it sees on
             // Pipeline A. Without this, test:tracing's "Message Build Span"
@@ -5742,20 +5779,7 @@ export class GoogleVertexProvider extends BaseProvider {
             const baseTools = !options.disableTools
                 ? await this.getToolsForStream(options)
                 : {};
-            // Process the unified `input.files` array before routing to the
-            // native SDK. BaseProvider.generate() runs this preprocessing via
-            // buildMultimodalMessagesArray, but Vertex's override skips it,
-            // which would otherwise drop text-file content (and the
-            // mimetype-hint contract) on the floor. Mutates options.input.text /
-            // options.input.images / options.input.pdfFiles in place.
-            if (options.input?.files && options.input.files.length > 0) {
-                try {
-                    await processUnifiedFilesArray(options, 100 * 1024 * 1024, this.providerName);
-                }
-                catch (fileError) {
-                    logger.warn(`[GoogleVertex] processUnifiedFilesArray threw, continuing without file content: ${fileError instanceof Error ? fileError.message : String(fileError)}`);
-                }
-            }
+            await this.preprocessNativeFileInput(options);
             // Emit a `neurolink.message.build` span so observability tooling
             // sees the message-construction phase even on the native (Pipeline B)
             // Vertex path. Pipeline A normally produces this via MessageBuilder;

package/dist/proxy/modelRouter.d.ts

@@ -1,12 +1,22 @@
 import type { FallbackEntry, ModelMapping, ProxyRoutingConfig, RouteResult } from "../types/index.js";
+/** Default and accepted range for concurrent upstream requests per OAuth account. */
+export declare const MIN_MAX_INFLIGHT_PER_ACCOUNT = 1;
+export declare const MAX_MAX_INFLIGHT_PER_ACCOUNT = 20;
+export declare const DEFAULT_MAX_INFLIGHT_PER_ACCOUNT = 2;
 export declare class ModelRouter {
     private readonly mappings;
     private readonly passthrough;
     private readonly fallback;
+    private readonly autoFallback;
+    private readonly maxInflightPerAccount;
     constructor(config: ProxyRoutingConfig);
     resolve(requestedModel: string): RouteResult;
     isClaudeTarget(requestedModel: string): boolean;
     getFallbackChain(): FallbackEntry[];
+    /** Whether translation-layer auto-provider fallback is explicitly enabled. */
+    isAutoFallbackEnabled(): boolean;
+    /** Maximum concurrent upstream requests admitted for each OAuth account. */
+    getMaxInflightPerAccount(): number;
     /** Return the raw model mapping entries (used by /v1/models). */
     getModelMappings(): ModelMapping[];
     /** Return models configured for passthrough (used by /v1/models). */

package/dist/proxy/modelRouter.js

@@ -1,11 +1,20 @@
+/** Default and accepted range for concurrent upstream requests per OAuth account. */
+export const MIN_MAX_INFLIGHT_PER_ACCOUNT = 1;
+export const MAX_MAX_INFLIGHT_PER_ACCOUNT = 20;
+export const DEFAULT_MAX_INFLIGHT_PER_ACCOUNT = 2;
 export class ModelRouter {
     mappings;
     passthrough;
     fallback;
+    autoFallback;
+    maxInflightPerAccount;
     constructor(config) {
         this.mappings = new Map(config.modelMappings.map((m) => [m.from, m]));
         this.passthrough = new Set(config.passthroughModels ?? []);
         this.fallback = config.fallbackChain;
+        this.autoFallback = config.autoFallback === true;
+        this.maxInflightPerAccount =
+            config.maxInflightPerAccount ?? DEFAULT_MAX_INFLIGHT_PER_ACCOUNT;
     }
     resolve(requestedModel) {
         const mapping = this.mappings.get(requestedModel);
@@ -29,6 +38,14 @@ export class ModelRouter {
     getFallbackChain() {
         return this.fallback;
     }
+    /** Whether translation-layer auto-provider fallback is explicitly enabled. */
+    isAutoFallbackEnabled() {
+        return this.autoFallback;
+    }
+    /** Maximum concurrent upstream requests admitted for each OAuth account. */
+    getMaxInflightPerAccount() {
+        return this.maxInflightPerAccount;
+    }
     /** Return the raw model mapping entries (used by /v1/models). */
     getModelMappings() {
         return Array.from(this.mappings.values());

package/dist/proxy/proxyConfig.js

@@ -12,6 +12,7 @@
  */
 import { readFile } from "node:fs/promises";
 import { extname } from "node:path";
+import { MAX_MAX_INFLIGHT_PER_ACCOUNT, MIN_MAX_INFLIGHT_PER_ACCOUNT, } from "./modelRouter.js";
 import { logger } from "../utils/logger.js";
 // ---------------------------------------------------------------------------
 // Environment variable resolution
@@ -237,6 +238,24 @@ export function validateProxyConfig(config) {
             normalizedQuotaRouting !== "false") {
             errors.push("routing.quota-routing must be a boolean");
         }
+        const rawAutoFallback = routing["auto-fallback"] ?? routing.autoFallback;
+        const normalizedAutoFallback = typeof rawAutoFallback === "string"
+            ? rawAutoFallback.trim().toLowerCase()
+            : undefined;
+        if (rawAutoFallback !== undefined &&
+            typeof rawAutoFallback !== "boolean" &&
+            normalizedAutoFallback !== "true" &&
+            normalizedAutoFallback !== "false") {
+            errors.push("routing.auto-fallback must be a boolean");
+        }
+        const rawMaxInflight = routing["max-inflight-per-account"] ?? routing.maxInflightPerAccount;
+        if (rawMaxInflight !== undefined &&
+            (typeof rawMaxInflight !== "number" ||
+                !Number.isInteger(rawMaxInflight) ||
+                rawMaxInflight < MIN_MAX_INFLIGHT_PER_ACCOUNT ||
+                rawMaxInflight > MAX_MAX_INFLIGHT_PER_ACCOUNT)) {
+            errors.push("routing.max-inflight-per-account must be an integer between 1 and 20");
+        }
         const rawSessionSoftLimit = routing["session-soft-limit"] ?? routing.sessionSoftLimit;
         if (rawSessionSoftLimit !== undefined) {
             const sessionSoftLimit = Number(rawSessionSoftLimit);
@@ -322,6 +341,8 @@ function warnPlaintextApiKeys(accounts) {
  * - `strategy` ("round-robin" | "fill-first")
  * - `model-mappings` / `modelMappings` — array of {from, to, provider}
  * - `fallback-chain` / `fallbackChain` — array of {provider, model}
+ * - `auto-fallback` / `autoFallback` — opt in to an unspecified provider
+ * - `max-inflight-per-account` / `maxInflightPerAccount` — concurrency cap
  * - `passthroughModels` / `passthrough-models` — array of model IDs
  * - `quota-routing` / `quotaRouting` — quota-aware fill-first ordering
  * - `session-soft-limit` / `sessionSoftLimit` — proactive handoff threshold
@@ -396,6 +417,31 @@ function parseRoutingConfig(raw) {
             logger.warn(`[proxy-config] Ignoring routing.quotaRouting: expected boolean, got ${typeof rawQuotaRouting}`);
         }
     }
+    const rawAutoFallback = raw["auto-fallback"] ?? raw.autoFallback;
+    if (rawAutoFallback !== undefined) {
+        if (typeof rawAutoFallback === "boolean") {
+            result.autoFallback = rawAutoFallback;
+        }
+        else if (typeof rawAutoFallback === "string" &&
+            ["true", "false"].includes(rawAutoFallback.trim().toLowerCase())) {
+            result.autoFallback = rawAutoFallback.trim().toLowerCase() === "true";
+        }
+        else {
+            logger.warn(`[proxy-config] Ignoring routing.autoFallback: expected boolean, got ${typeof rawAutoFallback}`);
+        }
+    }
+    const rawMaxInflight = raw["max-inflight-per-account"] ?? raw.maxInflightPerAccount;
+    if (rawMaxInflight !== undefined) {
+        if (typeof rawMaxInflight === "number" &&
+            Number.isInteger(rawMaxInflight) &&
+            rawMaxInflight >= MIN_MAX_INFLIGHT_PER_ACCOUNT &&
+            rawMaxInflight <= MAX_MAX_INFLIGHT_PER_ACCOUNT) {
+            result.maxInflightPerAccount = rawMaxInflight;
+        }
+        else {
+            logger.warn(`[proxy-config] Ignoring routing.maxInflightPerAccount: expected integer between 1 and 20, got ${String(rawMaxInflight)}`);
+        }
+    }
     const rawSessionSoftLimit = raw["session-soft-limit"] ?? raw.sessionSoftLimit;
     if (rawSessionSoftLimit !== undefined) {
         const sessionSoftLimit = Number(rawSessionSoftLimit);

package/dist/proxy/rollingWorkerSupervisor.d.ts

@@ -32,6 +32,7 @@ export declare class RollingWorkerSupervisor {
     private spawnCandidate;
     private flushQueuedSockets;
     private transferSocket;
+    private maybeDrainWorker;
     private handleTransferFailure;
     private rejectSocket;
     private describeTransferError;

package/dist/proxy/rollingWorkerSupervisor.js

@@ -287,21 +287,19 @@ export class RollingWorkerSupervisor {
                     generation,
                     version: expectedVersion,
                     dispose,
+                    pendingTransfers: 0,
+                    drainRequested: false,
                 };
                 this.active = activated;
                 this.candidate = null;
                 this.flushQueuedSockets();
                 if (previous) {
                     this.draining.set(previous.generation, previous);
-                    try {
-                        previous.handle.sendControl({
-                            type: "proxy-worker:drain",
-                            generation: previous.generation,
-                        });
-                    }
-                    catch {
-                        previous.handle.terminate("SIGTERM");
-                    }
+                    // A worker can still own socket transfers accepted before this
+                    // activation. Draining it before their IPC commits makes those
+                    // clients fail even though the replacement is healthy.
+                    previous.drainRequested = true;
+                    this.maybeDrainWorker(previous);
                 }
                 this.options.log?.(`[proxy-supervisor] activated generation=${generation} pid=${handle.pid} version=${expectedVersion}`);
                 this.publishState();
@@ -340,6 +338,8 @@ export class RollingWorkerSupervisor {
                 handle,
                 generation,
                 version: expectedVersion,
+                pendingTransfers: 0,
+                drainRequested: false,
                 expectedVersion,
                 activationRequested: false,
                 dispose,
@@ -362,15 +362,41 @@ export class RollingWorkerSupervisor {
         }
     }
     transferSocket(worker, socket) {
+        worker.pendingTransfers += 1;
+        let settled = false;
+        const complete = (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            worker.pendingTransfers = Math.max(0, worker.pendingTransfers - 1);
+            if (error) {
+                this.handleTransferFailure(worker, socket, error);
+            }
+            this.maybeDrainWorker(worker);
+        };
         try {
-            worker.handle.sendSocket(worker.generation, socket, (error) => {
-                if (error) {
-                    this.handleTransferFailure(worker, socket, error);
-                }
-            });
+            worker.handle.sendSocket(worker.generation, socket, complete);
         }
         catch (error) {
-            this.handleTransferFailure(worker, socket, error);
+            complete(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+    maybeDrainWorker(worker) {
+        if (!worker.drainRequested ||
+            worker.pendingTransfers > 0 ||
+            !this.draining.has(worker.generation)) {
+            return;
+        }
+        worker.drainRequested = false;
+        try {
+            worker.handle.sendControl({
+                type: "proxy-worker:drain",
+                generation: worker.generation,
+            });
+        }
+        catch {
+            worker.handle.terminate("SIGTERM");
         }
     }
     handleTransferFailure(worker, socket, error) {

package/dist/proxy/routingPolicy.d.ts

@@ -4,12 +4,14 @@ export declare function inferClaudeProxyModelTier(modelName: string): ClaudeProx
  * Build a translation plan for a Claude-compatible proxy request.
  * The plan lists the primary provider followed by eligible fallback targets.
  * All configured fallback entries are always eligible — no contract-based gating.
- * When no fallback chain is configured, an "auto-provider" entry is appended.
+ * An "auto-provider" entry is appended only when explicitly enabled by the
+ * caller. This keeps an empty fallback chain from silently escaping to an
+ * unrelated provider.
  */
 export declare function buildProxyTranslationPlan(primary: {
     provider: string;
     model?: string;
-}, fallbackChain: FallbackEntry[], requestedModel: string, _parsed: ParsedClaudeRequest): ProxyTranslationPlan;
+}, fallbackChain: FallbackEntry[], requestedModel: string, _parsed: ParsedClaudeRequest, allowAutoFallback?: boolean): ProxyTranslationPlan;
 /**
  * Parse the retry-after header from an upstream 429 response.
  * Returns milliseconds to wait, or 0 if no valid header present.

package/dist/proxy/routingPolicy.js

@@ -15,9 +15,11 @@ export function inferClaudeProxyModelTier(modelName) {
  * Build a translation plan for a Claude-compatible proxy request.
  * The plan lists the primary provider followed by eligible fallback targets.
  * All configured fallback entries are always eligible — no contract-based gating.
- * When no fallback chain is configured, an "auto-provider" entry is appended.
+ * An "auto-provider" entry is appended only when explicitly enabled by the
+ * caller. This keeps an empty fallback chain from silently escaping to an
+ * unrelated provider.
  */
-export function buildProxyTranslationPlan(primary, fallbackChain, requestedModel, _parsed) {
+export function buildProxyTranslationPlan(primary, fallbackChain, requestedModel, _parsed, allowAutoFallback = false) {
     const attempts = [
         {
             provider: primary.provider,
@@ -36,9 +38,10 @@ export function buildProxyTranslationPlan(primary, fallbackChain, requestedModel
             label: `${fallback.provider}/${fallback.model}`,
         });
     }
-    // Append auto-provider when no configured fallback chain exists,
-    // or when all configured entries were deduped (same as primary).
-    if (fallbackChain.length === 0 || attempts.length === 1) {
+    // A provider chosen by the translation layer is an explicit opt-in. It is
+    // intentionally not a default when configured entries are absent or deduped.
+    if (allowAutoFallback &&
+        (fallbackChain.length === 0 || attempts.length === 1)) {
         attempts.push({ label: "auto-provider" });
     }
     return {

package/dist/proxy/runtimeConfig.js

@@ -212,6 +212,8 @@ async function buildCandidate(options, generation, allowMissingConfig, allowMiss
             strategy,
             modelMappings: routing.modelMappings ?? [],
             fallbackChain: routing.fallbackChain ?? [],
+            autoFallback: routing.autoFallback,
+            maxInflightPerAccount: routing.maxInflightPerAccount,
             passthroughModels: routing.passthroughModels,
             quotaRouting: routing.quotaRouting,
             sessionSoftLimit: routing.sessionSoftLimit,