@juspay/neurolink 12.12.3 → 12.12.5

package/dist/proxy/rollingWorkerProtocol.d.ts

@@ -1,5 +1,7 @@
 import type { ProxyWorkerControlMessage, ProxyWorkerStatusMessage } from "../types/index.js";
 export declare const PROXY_SOCKET_WORKER_ENV = "NEUROLINK_PROXY_SOCKET_WORKER";
+/** The worker has not been sent a commit and cannot have served this socket. */
+export declare const PROXY_SOCKET_OFFER_TIMEOUT = "PROXY_SOCKET_OFFER_TIMEOUT";
 export declare const PROXY_ROLLING_SUPERVISOR_ENV = "NEUROLINK_PROXY_ROLLING_SUPERVISOR";
 export declare function isProxyWorkerControlMessage(value: unknown): value is ProxyWorkerControlMessage;
 export declare function isProxyWorkerStatusMessage(value: unknown): value is ProxyWorkerStatusMessage;

package/dist/proxy/rollingWorkerProtocol.js

@@ -1,4 +1,6 @@
 export const PROXY_SOCKET_WORKER_ENV = "NEUROLINK_PROXY_SOCKET_WORKER";
+/** The worker has not been sent a commit and cannot have served this socket. */
+export const PROXY_SOCKET_OFFER_TIMEOUT = "PROXY_SOCKET_OFFER_TIMEOUT";
 export const PROXY_ROLLING_SUPERVISOR_ENV = "NEUROLINK_PROXY_ROLLING_SUPERVISOR";
 export function isProxyWorkerControlMessage(value) {
     if (!value || typeof value !== "object") {

package/dist/proxy/rollingWorkerSupervisor.d.ts

@@ -11,6 +11,10 @@ export declare class RollingWorkerSupervisor {
     private candidate;
     private readonly draining;
     private readonly queuedSockets;
+    private flushingSockets;
+    private consecutiveOfferTimeouts;
+    private lastStallReplacementAt;
+    private transferStateTimer;
     private replacement;
     private rejectedSockets;
     private failedTransfers;
@@ -40,5 +44,6 @@ export declare class RollingWorkerSupervisor {
     private extractLifecycleFailureDetails;
     private recordFailure;
     private recordEvent;
+    private scheduleTransferState;
     private publishState;
 }

package/dist/proxy/rollingWorkerSupervisor.js

@@ -1,4 +1,5 @@
 import { ErrorFactory } from "../utils/errorHandling.js";
+import { PROXY_SOCKET_OFFER_TIMEOUT } from "./rollingWorkerProtocol.js";
 const DEFAULT_READY_TIMEOUT_MS = 30_000;
 const DEFAULT_SOCKET_QUEUE_LIMIT = 1_024;
 const DEFAULT_SOCKET_QUEUE_TIMEOUT_MS = 30_000;
@@ -16,6 +17,10 @@ export class RollingWorkerSupervisor {
     candidate = null;
     draining = new Map();
     queuedSockets = [];
+    flushingSockets = false;
+    consecutiveOfferTimeouts = 0;
+    lastStallReplacementAt = 0;
+    transferStateTimer;
     replacement = null;
     rejectedSockets = 0;
     failedTransfers = 0;
@@ -29,6 +34,7 @@ export class RollingWorkerSupervisor {
             ...options,
             readyTimeoutMs: options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,
             socketQueueLimit: options.socketQueueLimit ?? DEFAULT_SOCKET_QUEUE_LIMIT,
+            maxPendingTransfers: Math.max(1, options.maxPendingTransfers ?? 16),
             socketQueueTimeoutMs: options.socketQueueTimeoutMs ?? DEFAULT_SOCKET_QUEUE_TIMEOUT_MS,
             shutdownTimeoutMs: options.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS,
         };
@@ -56,6 +62,8 @@ export class RollingWorkerSupervisor {
                 generation: worker.generation,
             })),
             queuedSockets: this.queuedSockets.length,
+            pendingTransfers: (this.active?.pendingTransfers ?? 0) +
+                [...this.draining.values()].reduce((total, worker) => total + worker.pendingTransfers, 0),
             rejectedSockets: this.rejectedSockets,
             failedTransfers: this.failedTransfers,
             recentEvents: [...this.recentEvents],
@@ -93,11 +101,14 @@ export class RollingWorkerSupervisor {
             this.rejectSocket(socket);
             return;
         }
-        if (this.active) {
+        if (this.active &&
+            this.queuedSockets.length === 0 &&
+            this.active.pendingTransfers < this.options.maxPendingTransfers) {
             this.transferSocket(this.active, socket);
             return;
         }
         this.queueSocket(socket);
+        this.flushQueuedSockets();
     }
     queueSocket(socket) {
         if (this.queuedSockets.length >= this.options.socketQueueLimit) {
@@ -116,7 +127,7 @@ export class RollingWorkerSupervisor {
         };
         queued.timeout.unref?.();
         this.queuedSockets.push(queued);
-        this.publishState();
+        this.scheduleTransferState();
     }
     close() {
         if (this.shutdownPromise) {
@@ -294,6 +305,7 @@ export class RollingWorkerSupervisor {
                     drainRequested: false,
                 };
                 this.active = activated;
+                this.consecutiveOfferTimeouts = 0;
                 this.candidate = null;
                 this.flushQueuedSockets();
                 if (previous) {
@@ -365,20 +377,29 @@ export class RollingWorkerSupervisor {
         });
     }
     flushQueuedSockets() {
-        // Capture the active worker once: a synchronous sendSocket failure inside
-        // transferSocket can clear this.active mid-loop, and re-reading it would
-        // pass null into transferSocket and strand the queued socket.
-        const worker = this.active;
-        if (!worker) {
+        if (this.flushingSockets) {
             return;
         }
-        for (const queued of this.queuedSockets.splice(0)) {
-            clearTimeout(queued.timeout);
-            this.transferSocket(worker, queued.socket);
+        this.flushingSockets = true;
+        try {
+            while (this.active &&
+                this.queuedSockets.length > 0 &&
+                this.active.pendingTransfers < this.options.maxPendingTransfers) {
+                const queued = this.queuedSockets.shift();
+                if (!queued) {
+                    break;
+                }
+                clearTimeout(queued.timeout);
+                this.transferSocket(this.active, queued.socket);
+            }
+        }
+        finally {
+            this.flushingSockets = false;
         }
     }
     transferSocket(worker, socket) {
         worker.pendingTransfers += 1;
+        this.scheduleTransferState();
         let settled = false;
         const complete = (error) => {
             if (settled) {
@@ -389,7 +410,12 @@ export class RollingWorkerSupervisor {
             if (error) {
                 this.handleTransferFailure(worker, socket, error);
             }
+            else if (this.active?.generation === worker.generation) {
+                this.consecutiveOfferTimeouts = 0;
+            }
             this.maybeDrainWorker(worker);
+            this.flushQueuedSockets();
+            this.scheduleTransferState();
         };
         try {
             worker.handle.sendSocket(worker.generation, socket, complete);
@@ -426,17 +452,41 @@ export class RollingWorkerSupervisor {
             reason: detail,
         });
         const lifecycle = this.extractLifecycleFailureDetails(error, worker.handle.pid);
+        const cancelledOffer = error instanceof Error &&
+            error.code === PROXY_SOCKET_OFFER_TIMEOUT;
+        if (cancelledOffer && this.active?.generation === worker.generation) {
+            this.consecutiveOfferTimeouts += 1;
+            // Persistent stalls need recovery, but keep serving existing streams
+            // until a replacement activates. Avoid accumulating draining workers or
+            // spawning repeatedly when the whole host is under pressure.
+            if (this.consecutiveOfferTimeouts >= 3 &&
+                !this.candidate &&
+                this.draining.size === 0 &&
+                Date.now() - this.lastStallReplacementAt >= 60_000 &&
+                !this.closed) {
+                this.lastStallReplacementAt = Date.now();
+                this.options.onReplacementRequested?.({
+                    generation: worker.generation,
+                    pid: worker.handle.pid,
+                    reason: "socket_offer_timeout",
+                });
+            }
+        }
         this.recordFailure(worker.generation, worker.version, "transfer", `worker ${worker.handle.pid} failed to accept a transferred socket: ${detail}`, {
             ...lifecycle.details,
             // If the error already records an exit, the supervisor did not cause
             // that exit. Otherwise this captures the deliberate cleanup following
             // the failed transfer, not a claimed root cause for the failure.
-            supervisorAction: lifecycle.observedExit
-                ? "none"
-                : "sigkill_after_transfer_failure",
+            supervisorAction: cancelledOffer
+                ? "cancel_uncommitted_socket"
+                : lifecycle.observedExit
+                    ? "none"
+                    : "sigkill_after_transfer_failure",
         });
         this.options.log?.(`[proxy-supervisor] socket transfer failed generation=${worker.generation} pid=${worker.handle.pid}: ${detail}`);
-        if (this.active?.generation === worker.generation && !this.closed) {
+        if (!cancelledOffer &&
+            this.active?.generation === worker.generation &&
+            !this.closed) {
             this.active = null;
             this.draining.set(worker.generation, worker);
             if (!lifecycle.observedExit) {
@@ -518,7 +568,18 @@ export class RollingWorkerSupervisor {
             this.recentEvents.splice(0, this.recentEvents.length - MAX_RECENT_SUPERVISOR_EVENTS);
         }
     }
+    scheduleTransferState() {
+        if (this.closed || this.transferStateTimer || !this.options.onStateChange) {
+            return;
+        }
+        // The installed supervisor persists each notification. Keep diagnostics
+        // fresh without adding a synchronous disk write to every socket handoff.
+        this.transferStateTimer = setTimeout(() => this.publishState(), 250);
+        this.transferStateTimer.unref();
+    }
     publishState() {
+        clearTimeout(this.transferStateTimer);
+        this.transferStateTimer = undefined;
         try {
             this.options.onStateChange?.(this.snapshot());
         }

package/dist/proxy/routingPolicy.js

@@ -35,6 +35,9 @@ export function buildProxyTranslationPlan(primary, fallbackChain, requestedModel
         attempts.push({
             provider: fallback.provider,
             model: fallback.model,
+            ...(fallback.reasoningEffort !== undefined
+                ? { reasoningEffort: fallback.reasoningEffort }
+                : {}),
             label: `${fallback.provider}/${fallback.model}`,
         });
     }

package/dist/server/routes/claudeProxyRoutes.js

@@ -25,7 +25,8 @@ import { ProviderTransportCoordinator } from "../../proxy/providerTransportCoord
 import { MAX_COOLDOWN_MS_BY_REASON } from "../../proxy/routingEvidence.js";
 import { buildProxyLimitHeaders, summarizePoolHeadroom, } from "../../proxy/quotaHeaders.js";
 import { buildClaudeError, ClaudeStreamSerializer, generateToolUseId, parseClaudeRequest, serializeClaudeResponse, } from "../../proxy/claudeFormat.js";
-import { CodexFallbackResponseError, consumeCodexFallbackResponse, convertClaudeRequestToCodex, } from "../../proxy/codexFallback.js";
+import { CodexFallbackResponseError, consumeCodexFallbackResponse, createCodexFallbackStream, convertClaudeRequestToCodex, } from "../../proxy/codexFallback.js";
+import { registerProxyResponseObserver } from "../../proxy/proxyActivity.js";
 import { buildAnthropicModelsListResponse, buildTranslationOptions, extractText, extractToolArgs, extractUsageFromStreamResult, handleTranslatedJsonRequest, handleTranslatedStreamRequest, hasTranslatedOutput, } from "../../proxy/proxyTranslationEngine.js";
 import { tracers } from "../../telemetry/tracers.js";
 import { withSpan } from "../../telemetry/withSpan.js";
@@ -337,6 +338,7 @@ async function acquireFirstAvailableAccountAdmission(accountKeys, capacity, abor
 }
 /** Track whether we've run the one-time startup prune. */
 let startupPruneDone = false;
+let startupPrune;
 /** Default cooling period when retries are exhausted and upstream didn't
  *  provide a retry-after header. Short enough to recover quickly, long
  *  enough to avoid immediately hammering the same account. */
@@ -3201,10 +3203,18 @@ async function loadClaudeProxyAccounts(args) {
     const { tokenStore } = await import("../../auth/tokenStore.js");
     const persistedCooldowns = await loadAccountCooldowns();
     if (!startupPruneDone) {
-        await tokenStore.pruneExpired();
-        startupPruneDone = true;
+        startupPrune ??= tokenStore
+            .pruneExpired()
+            .then(() => {
+            startupPruneDone = true;
+        })
+            .finally(() => {
+            startupPrune = undefined;
+        });
+        await startupPrune;
     }
-    const compoundKeys = await tokenStore.listByPrefix("anthropic:");
+    const inventory = await tokenStore.getProviderSnapshot();
+    const compoundKeys = Object.keys(inventory).filter((key) => key.startsWith("anthropic:"));
     // Tracked so an empty pool can name the real cause: "every account is
     // entitlement-blocked" is a different problem from "no credentials".
     const entitlementBlockedLabels = [];
@@ -3215,9 +3225,9 @@ async function loadClaudeProxyAccounts(args) {
             logger.debug(`[proxy] skipping account=${key} (not in account allowlist)`);
             continue;
         }
-        if (await tokenStore.isDisabled(key)) {
+        if (inventory[key].disabled) {
             const existingState = getOrCreateRuntimeState(key);
-            const disabledReason = await tokenStore.getDisabledReason(key);
+            const disabledReason = inventory[key].disabledReason;
             // Older releases permanently disabled accounts after any refresh error,
             // including timeouts, 429s and 5xx responses. Re-evaluate those legacy
             // entries once under the terminal/transient classifier below.
@@ -3238,7 +3248,7 @@ async function loadClaudeProxyAccounts(args) {
                 continue;
             }
         }
-        const tokens = await tokenStore.loadTokens(key);
+        const tokens = inventory[key].tokens;
         if (!tokens) {
             skippedForOtherReasons += 1;
             continue;
@@ -3623,12 +3633,11 @@ async function executeClaudeFallbackWithRetry(args) {
 /**
  * Run the configured `codex` fallback through the native pooled Codex route.
  *
- * The inner response is fully buffered and validated before this function
- * creates a single Claude frame. That preserves the proxy's no-replay-after-
- * output guarantee when Codex returns an incomplete stream.
+ * Streaming clients receive incremental output. Once the stream is returned,
+ * failures are terminal SSE errors; only pre-output failures may try a fallback.
  */
 async function executeClaudeCodexFallback(args) {
-    const { ctx, body, model, tracer, requestStartTime, logProxyBody, logFinalRequest, } = args;
+    const { ctx, body, model, reasoningEffort, tracer, requestStartTime, logProxyBody, logFinalRequest, } = args;
     const codexCtx = {
         ...ctx,
         requestId: `${ctx.requestId}:codex-fallback`,
@@ -3640,7 +3649,7 @@ async function executeClaudeCodexFallback(args) {
         },
         query: {},
         params: {},
-        body: convertClaudeRequestToCodex(body, model),
+        body: convertClaudeRequestToCodex(body, model, reasoningEffort),
         metadata: { ...ctx.metadata, "neurolink.codexFallback": true },
         // Keep the child attribution isolated until its stream has passed
         // validation. A failed Codex attempt must not look like a served request.
@@ -3648,6 +3657,145 @@ async function executeClaudeCodexFallback(args) {
     };
     const codexResponse = await handleCodexResponsesRequest(codexCtx);
     const codexHeaders = { ...(codexCtx.responseHeaders ?? {}) };
+    if (body.stream) {
+        const bridge = await createCodexFallbackStream(codexResponse, body.model);
+        ctx.responseHeaders ??= {};
+        Object.assign(ctx.responseHeaders, redactHeadersForBorrower(codexHeaders));
+        const account = codexHeaders["x-neurolink-account"] ?? "";
+        const accountType = codexHeaders["x-neurolink-account-type"] ?? "codex-oauth";
+        let settled = false;
+        let captured = "";
+        let responseBytes = 0;
+        const finish = (status, result, errorType, message) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            ctx.abortSignal?.removeEventListener("abort", cancel);
+            if (status >= 400) {
+                ctx.metadata.terminalErrorType = errorType;
+            }
+            tracer?.end(status, Date.now() - requestStartTime);
+            logFinalRequest(status, account, accountType, errorType, message, {
+                inputTokens: result?.usage?.input,
+                outputTokens: result?.usage?.output,
+                cacheCreationTokens: result?.usage?.cacheCreationTokens,
+                cacheReadTokens: result?.usage?.cacheReadTokens,
+            });
+            recordFallbackAttempt({
+                provider: "codex",
+                model,
+                status: status < 400 ? "success" : "failure",
+                durationMs: Date.now() - requestStartTime,
+                ...(message ? { errorMessage: message } : {}),
+            });
+            logProxyBody({
+                phase: "client_response",
+                contentType: "text/event-stream",
+                body: captured,
+                bodySize: responseBytes,
+                responseStatus: status,
+                durationMs: Date.now() - requestStartTime,
+            });
+        };
+        const cancel = () => {
+            finish(499, undefined, "client_cancelled", "Client cancelled Codex fallback stream");
+            void bridge.cancel();
+        };
+        ctx.abortSignal?.addEventListener("abort", cancel, { once: true });
+        registerProxyResponseObserver(ctx.metadata, {
+            onTerminal: ({ outcome }) => {
+                if (outcome === "client_cancelled") {
+                    cancel();
+                }
+                else if (outcome === "stream_error") {
+                    finish(502, undefined, "stream_error", "Codex fallback stream failed");
+                    void bridge.cancel();
+                }
+            },
+        });
+        const capture = (frame) => {
+            responseBytes += Buffer.byteLength(frame);
+            if (captured.length < 1024 * 1024) {
+                captured += frame.slice(0, 1024 * 1024 - captured.length);
+            }
+            return frame;
+        };
+        async function* relay() {
+            try {
+                if (ctx.abortSignal?.aborted) {
+                    cancel();
+                    return;
+                }
+                let pending = bridge.frames.next();
+                while (!settled) {
+                    let timer;
+                    const heartbeat = new Promise((resolve) => {
+                        timer = setTimeout(() => resolve(null), 15_000);
+                        timer.unref();
+                    });
+                    let next;
+                    try {
+                        next = await Promise.race([pending, heartbeat]);
+                    }
+                    finally {
+                        clearTimeout(timer);
+                    }
+                    if (settled) {
+                        return;
+                    }
+                    if (next === null) {
+                        yield capture(ClaudeStreamSerializer.pingEvent());
+                        continue;
+                    }
+                    if (next.done === true) {
+                        finish(200, next.value);
+                        return;
+                    }
+                    const frame = capture(next.value);
+                    if (frame.startsWith("event: message_stop\n")) {
+                        // Finalize before exposing the terminal frame: a client can close
+                        // immediately after receiving it without making another pull.
+                        const completion = await bridge.frames.next();
+                        if (completion.done !== true) {
+                            throw new Error("Codex fallback emitted output after message_stop");
+                        }
+                        if (settled) {
+                            return;
+                        }
+                        finish(200, completion.value);
+                        yield frame;
+                        return;
+                    }
+                    yield frame;
+                    pending = bridge.frames.next();
+                }
+            }
+            catch (error) {
+                if (!settled) {
+                    const detail = redactProviderErrorMessage(describeTransportError(error));
+                    logger.always(`[proxy] Codex fallback stream failed: ${detail}`);
+                    const serializer = new ClaudeStreamSerializer(body.model);
+                    const frames = [
+                        ...serializer.emitError(502, "Codex fallback stream failed"),
+                    ].map(capture);
+                    finish(502, undefined, "stream_error", detail);
+                    yield* frames;
+                }
+            }
+            finally {
+                ctx.abortSignal?.removeEventListener("abort", cancel);
+                if (!settled) {
+                    cancel();
+                }
+                await bridge.cancel();
+                await bridge.frames
+                    .return({ text: "", toolCalls: [], finishReason: "end_turn" })
+                    .catch(() => undefined);
+            }
+        }
+        return relay();
+    }
     let parsed;
     try {
         parsed = await consumeCodexFallbackResponse(codexResponse);
@@ -3673,49 +3821,6 @@ async function executeClaudeCodexFallback(args) {
         ...(parsed.usage ? { usage: parsed.usage } : {}),
         toolCalls: parsed.toolCalls,
     };
-    if (body.stream) {
-        const serializer = new ClaudeStreamSerializer(body.model, parsed.usage?.input ?? 0);
-        const frames = [];
-        for (const frame of serializer.start()) {
-            frames.push(frame);
-        }
-        if (parsed.text) {
-            for (const frame of serializer.pushDelta(parsed.text)) {
-                frames.push(frame);
-            }
-        }
-        for (const toolCall of parsed.toolCalls) {
-            for (const frame of serializer.pushToolUse(generateToolUseId(), toolCall.toolName, toolCall.args)) {
-                frames.push(frame);
-            }
-        }
-        for (const frame of serializer.finish(parsed.usage?.output, parsed.finishReason)) {
-            frames.push(frame);
-        }
-        tracer?.end(200, Date.now() - requestStartTime);
-        logFinalRequest(200, accountLabel, accountType, undefined, undefined, {
-            inputTokens: parsed.usage?.input,
-            outputTokens: parsed.usage?.output,
-            cacheCreationTokens: parsed.usage?.cacheCreationTokens,
-            cacheReadTokens: parsed.usage?.cacheReadTokens,
-        });
-        const bufferedBody = frames.join("");
-        logProxyBody({
-            phase: "client_response",
-            headers: { "content-type": "text/event-stream" },
-            body: bufferedBody,
-            bodySize: Buffer.byteLength(bufferedBody, "utf8"),
-            contentType: "text/event-stream",
-            responseStatus: 200,
-            durationMs: Date.now() - requestStartTime,
-        });
-        async function* sseGenerator() {
-            for (const frame of frames) {
-                yield frame;
-            }
-        }
-        return sseGenerator();
-    }
     tracer?.end(200, Date.now() - requestStartTime);
     const clientResponse = serializeClaudeResponse(internal, body.model);
     logFinalRequest(200, accountLabel, accountType, undefined, undefined, {
@@ -3820,6 +3925,7 @@ async function tryConfiguredClaudeFallbackChain(args) {
         reason: "all_anthropic_accounts_exhausted",
     });
     let lastFallbackError;
+    let terminalFailure;
     let invalidRequestFailure;
     for (const fallback of fallbackPlan.attempts.slice(1)) {
         if (!fallback.provider || !fallback.model) {
@@ -3827,7 +3933,7 @@ async function tryConfiguredClaudeFallbackChain(args) {
         }
         const fallbackStart = Date.now();
         try {
-            logger.always(`[proxy] fallback → ${fallback.provider}/${fallback.model}`);
+            logger.always(`[proxy] fallback → ${fallback.provider}/${fallback.model}${fallback.reasoningEffort ? ` reasoning=${fallback.reasoningEffort}` : ""}`);
             let response;
             if (fallback.provider === "codex") {
                 // Codex is a local OAuth account pool, not a generic SDK provider.
@@ -3836,6 +3942,7 @@ async function tryConfiguredClaudeFallbackChain(args) {
                     ctx,
                     body,
                     model: fallback.model,
+                    reasoningEffort: fallback.reasoningEffort,
                     tracer,
                     requestStartTime,
                     logProxyBody,
@@ -3872,6 +3979,9 @@ async function tryConfiguredClaudeFallbackChain(args) {
                     providerLabel: fallback.provider,
                 });
             }
+            if (fallback.provider === "codex" && body.stream) {
+                return { response };
+            }
             recordFallbackAttempt({
                 provider: fallback.provider,
                 model: fallback.model,
@@ -3898,7 +4008,27 @@ async function tryConfiguredClaudeFallbackChain(args) {
             return { response };
         }
         catch (fallbackErr) {
-            invalidRequestFailure ??=
+            const status = ctx.abortSignal?.aborted
+                ? 499
+                : fallbackErr instanceof CodexFallbackResponseError
+                    ? fallbackErr.status
+                    : 502;
+            terminalFailure = {
+                status,
+                message: `Configured fallback ${fallback.provider}/${fallback.model} failed (HTTP ${status})`,
+                errorType: status === 499
+                    ? "client_cancelled"
+                    : status === 429
+                        ? "rate_limit_error"
+                        : status === 401
+                            ? "authentication_error"
+                            : status === 403
+                                ? "permission_error"
+                                : status === 400
+                                    ? "invalid_request_error"
+                                    : "api_error",
+            };
+            invalidRequestFailure =
                 getCodexFallbackInvalidRequestFailure(fallbackErr) ?? undefined;
             const errMsg = redactProviderErrorMessage(fallbackErr instanceof Error
                 ? fallbackErr.message
@@ -3933,14 +4063,29 @@ async function tryConfiguredClaudeFallbackChain(args) {
                 durationMs: Date.now() - fallbackStart,
             });
             lastFallbackError = `[${fallback.provider}/${fallback.model}] ${redactProviderErrorMessage(describeTransportError(fallbackErr))}`;
+            if (ctx.abortSignal?.aborted) {
+                break;
+            }
         }
     }
     return {
         response: null,
         lastErrorMessage: lastFallbackError,
+        terminalFailure,
         ...(invalidRequestFailure ? { invalidRequestFailure } : {}),
     };
 }
+/** Preserve the final fallback status through every HTTP route adapter. */
+function buildConfiguredClaudeFallbackFailure(args) {
+    const { failure, buildLoggedClaudeError, tracer, requestStartTime } = args;
+    tracer?.setError(failure.errorType, failure.message);
+    tracer?.end(failure.status, Date.now() - requestStartTime);
+    const body = buildLoggedClaudeError(failure.status, failure.message, failure.errorType);
+    return new Response(JSON.stringify(body), {
+        status: failure.status,
+        headers: { "content-type": "application/json" },
+    });
+}
 async function tryAutoClaudeFallback(args) {
     const { ctx, body, tracer, requestStartTime, logProxyBody, logFinalRequest } = args;
     const fallbackStart = Date.now();
@@ -6324,6 +6469,15 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                 logFinalRequest,
             });
         }
+        if (configuredFallbackResult.terminalFailure) {
+            const failure = configuredFallbackResult.terminalFailure;
+            return buildConfiguredClaudeFallbackFailure({
+                failure,
+                buildLoggedClaudeError,
+                tracer,
+                requestStartTime,
+            });
+        }
         return buildDeferredClaudeAccountFailureResponse({
             ctx,
             tracer,
@@ -6820,13 +6974,25 @@ async function handleAnthropicRoutedClaudeRequest(args) {
         if (configuredFallbackResult.response) {
             return configuredFallbackResult.response;
         }
-        if (configuredFallbackResult.invalidRequestFailure &&
-            !loopState.sawRateLimit) {
-            // A converted Codex request can be rejected independently of the original
-            // Anthropic request. Preserve a real pool 429 as the actionable terminal
-            // response when both occurred.
-            loopState.invalidRequestFailure =
-                configuredFallbackResult.invalidRequestFailure;
+        if (configuredFallbackResult.invalidRequestFailure) {
+            // Surface the failure of the provider actually attempted last.
+            return buildClaudeAnthropicFailureResponse({
+                tracer,
+                requestStartTime,
+                authFailureMessage: null,
+                authCooldownMessage: null,
+                invalidRequestFailure: configuredFallbackResult.invalidRequestFailure,
+                entitlementFailure: null,
+                scopedExhaustion: null,
+                sawNetworkError: false,
+                sawTransientFailure: false,
+                sawRateLimit: false,
+                lastError: undefined,
+                orderedAccounts: [],
+                buildLoggedClaudeError,
+                logProxyBody,
+                logFinalRequest,
+            });
         }
         fallbackFailureMessage = configuredFallbackResult.lastErrorMessage;
         // A translation-layer-selected provider is only permitted by an explicit
@@ -6848,6 +7014,16 @@ async function handleAnthropicRoutedClaudeRequest(args) {
             fallbackFailureMessage =
                 autoFallbackResult.lastErrorMessage ?? fallbackFailureMessage;
         }
+        if (configuredFallbackResult.terminalFailure &&
+            !configuredFallbackResult.invalidRequestFailure) {
+            const failure = configuredFallbackResult.terminalFailure;
+            return buildConfiguredClaudeFallbackFailure({
+                failure,
+                buildLoggedClaudeError,
+                tracer,
+                requestStartTime,
+            });
+        }
         loopState.fallbackFailureMessage = fallbackFailureMessage;
     }
     // Terminal failure — usually "every account is rate-limited". This is the