@juspay/neurolink 12.12.4 → 12.12.5

package/dist/proxy/rollingWorkerSupervisor.js

@@ -1,4 +1,5 @@
 import { ErrorFactory } from "../utils/errorHandling.js";
+import { PROXY_SOCKET_OFFER_TIMEOUT } from "./rollingWorkerProtocol.js";
 const DEFAULT_READY_TIMEOUT_MS = 30_000;
 const DEFAULT_SOCKET_QUEUE_LIMIT = 1_024;
 const DEFAULT_SOCKET_QUEUE_TIMEOUT_MS = 30_000;
@@ -16,6 +17,10 @@ export class RollingWorkerSupervisor {
     candidate = null;
     draining = new Map();
     queuedSockets = [];
+    flushingSockets = false;
+    consecutiveOfferTimeouts = 0;
+    lastStallReplacementAt = 0;
+    transferStateTimer;
     replacement = null;
     rejectedSockets = 0;
     failedTransfers = 0;
@@ -29,6 +34,7 @@ export class RollingWorkerSupervisor {
             ...options,
             readyTimeoutMs: options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS,
             socketQueueLimit: options.socketQueueLimit ?? DEFAULT_SOCKET_QUEUE_LIMIT,
+            maxPendingTransfers: Math.max(1, options.maxPendingTransfers ?? 16),
             socketQueueTimeoutMs: options.socketQueueTimeoutMs ?? DEFAULT_SOCKET_QUEUE_TIMEOUT_MS,
             shutdownTimeoutMs: options.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS,
         };
@@ -56,6 +62,8 @@ export class RollingWorkerSupervisor {
                 generation: worker.generation,
             })),
             queuedSockets: this.queuedSockets.length,
+            pendingTransfers: (this.active?.pendingTransfers ?? 0) +
+                [...this.draining.values()].reduce((total, worker) => total + worker.pendingTransfers, 0),
             rejectedSockets: this.rejectedSockets,
             failedTransfers: this.failedTransfers,
             recentEvents: [...this.recentEvents],
@@ -93,11 +101,14 @@ export class RollingWorkerSupervisor {
             this.rejectSocket(socket);
             return;
         }
-        if (this.active) {
+        if (this.active &&
+            this.queuedSockets.length === 0 &&
+            this.active.pendingTransfers < this.options.maxPendingTransfers) {
             this.transferSocket(this.active, socket);
             return;
         }
         this.queueSocket(socket);
+        this.flushQueuedSockets();
     }
     queueSocket(socket) {
         if (this.queuedSockets.length >= this.options.socketQueueLimit) {
@@ -116,7 +127,7 @@ export class RollingWorkerSupervisor {
         };
         queued.timeout.unref?.();
         this.queuedSockets.push(queued);
-        this.publishState();
+        this.scheduleTransferState();
     }
     close() {
         if (this.shutdownPromise) {
@@ -294,6 +305,7 @@ export class RollingWorkerSupervisor {
                     drainRequested: false,
                 };
                 this.active = activated;
+                this.consecutiveOfferTimeouts = 0;
                 this.candidate = null;
                 this.flushQueuedSockets();
                 if (previous) {
@@ -365,20 +377,29 @@ export class RollingWorkerSupervisor {
         });
     }
     flushQueuedSockets() {
-        // Capture the active worker once: a synchronous sendSocket failure inside
-        // transferSocket can clear this.active mid-loop, and re-reading it would
-        // pass null into transferSocket and strand the queued socket.
-        const worker = this.active;
-        if (!worker) {
+        if (this.flushingSockets) {
             return;
         }
-        for (const queued of this.queuedSockets.splice(0)) {
-            clearTimeout(queued.timeout);
-            this.transferSocket(worker, queued.socket);
+        this.flushingSockets = true;
+        try {
+            while (this.active &&
+                this.queuedSockets.length > 0 &&
+                this.active.pendingTransfers < this.options.maxPendingTransfers) {
+                const queued = this.queuedSockets.shift();
+                if (!queued) {
+                    break;
+                }
+                clearTimeout(queued.timeout);
+                this.transferSocket(this.active, queued.socket);
+            }
+        }
+        finally {
+            this.flushingSockets = false;
         }
     }
     transferSocket(worker, socket) {
         worker.pendingTransfers += 1;
+        this.scheduleTransferState();
         let settled = false;
         const complete = (error) => {
             if (settled) {
@@ -389,7 +410,12 @@ export class RollingWorkerSupervisor {
             if (error) {
                 this.handleTransferFailure(worker, socket, error);
             }
+            else if (this.active?.generation === worker.generation) {
+                this.consecutiveOfferTimeouts = 0;
+            }
             this.maybeDrainWorker(worker);
+            this.flushQueuedSockets();
+            this.scheduleTransferState();
         };
         try {
             worker.handle.sendSocket(worker.generation, socket, complete);
@@ -426,17 +452,41 @@ export class RollingWorkerSupervisor {
             reason: detail,
         });
         const lifecycle = this.extractLifecycleFailureDetails(error, worker.handle.pid);
+        const cancelledOffer = error instanceof Error &&
+            error.code === PROXY_SOCKET_OFFER_TIMEOUT;
+        if (cancelledOffer && this.active?.generation === worker.generation) {
+            this.consecutiveOfferTimeouts += 1;
+            // Persistent stalls need recovery, but keep serving existing streams
+            // until a replacement activates. Avoid accumulating draining workers or
+            // spawning repeatedly when the whole host is under pressure.
+            if (this.consecutiveOfferTimeouts >= 3 &&
+                !this.candidate &&
+                this.draining.size === 0 &&
+                Date.now() - this.lastStallReplacementAt >= 60_000 &&
+                !this.closed) {
+                this.lastStallReplacementAt = Date.now();
+                this.options.onReplacementRequested?.({
+                    generation: worker.generation,
+                    pid: worker.handle.pid,
+                    reason: "socket_offer_timeout",
+                });
+            }
+        }
         this.recordFailure(worker.generation, worker.version, "transfer", `worker ${worker.handle.pid} failed to accept a transferred socket: ${detail}`, {
             ...lifecycle.details,
             // If the error already records an exit, the supervisor did not cause
             // that exit. Otherwise this captures the deliberate cleanup following
             // the failed transfer, not a claimed root cause for the failure.
-            supervisorAction: lifecycle.observedExit
-                ? "none"
-                : "sigkill_after_transfer_failure",
+            supervisorAction: cancelledOffer
+                ? "cancel_uncommitted_socket"
+                : lifecycle.observedExit
+                    ? "none"
+                    : "sigkill_after_transfer_failure",
         });
         this.options.log?.(`[proxy-supervisor] socket transfer failed generation=${worker.generation} pid=${worker.handle.pid}: ${detail}`);
-        if (this.active?.generation === worker.generation && !this.closed) {
+        if (!cancelledOffer &&
+            this.active?.generation === worker.generation &&
+            !this.closed) {
             this.active = null;
             this.draining.set(worker.generation, worker);
             if (!lifecycle.observedExit) {
@@ -518,7 +568,18 @@ export class RollingWorkerSupervisor {
             this.recentEvents.splice(0, this.recentEvents.length - MAX_RECENT_SUPERVISOR_EVENTS);
         }
     }
+    scheduleTransferState() {
+        if (this.closed || this.transferStateTimer || !this.options.onStateChange) {
+            return;
+        }
+        // The installed supervisor persists each notification. Keep diagnostics
+        // fresh without adding a synchronous disk write to every socket handoff.
+        this.transferStateTimer = setTimeout(() => this.publishState(), 250);
+        this.transferStateTimer.unref();
+    }
     publishState() {
+        clearTimeout(this.transferStateTimer);
+        this.transferStateTimer = undefined;
         try {
             this.options.onStateChange?.(this.snapshot());
         }

package/dist/server/routes/claudeProxyRoutes.js

@@ -25,7 +25,8 @@ import { ProviderTransportCoordinator } from "../../proxy/providerTransportCoord
 import { MAX_COOLDOWN_MS_BY_REASON } from "../../proxy/routingEvidence.js";
 import { buildProxyLimitHeaders, summarizePoolHeadroom, } from "../../proxy/quotaHeaders.js";
 import { buildClaudeError, ClaudeStreamSerializer, generateToolUseId, parseClaudeRequest, serializeClaudeResponse, } from "../../proxy/claudeFormat.js";
-import { CodexFallbackResponseError, consumeCodexFallbackResponse, convertClaudeRequestToCodex, } from "../../proxy/codexFallback.js";
+import { CodexFallbackResponseError, consumeCodexFallbackResponse, createCodexFallbackStream, convertClaudeRequestToCodex, } from "../../proxy/codexFallback.js";
+import { registerProxyResponseObserver } from "../../proxy/proxyActivity.js";
 import { buildAnthropicModelsListResponse, buildTranslationOptions, extractText, extractToolArgs, extractUsageFromStreamResult, handleTranslatedJsonRequest, handleTranslatedStreamRequest, hasTranslatedOutput, } from "../../proxy/proxyTranslationEngine.js";
 import { tracers } from "../../telemetry/tracers.js";
 import { withSpan } from "../../telemetry/withSpan.js";
@@ -337,6 +338,7 @@ async function acquireFirstAvailableAccountAdmission(accountKeys, capacity, abor
 }
 /** Track whether we've run the one-time startup prune. */
 let startupPruneDone = false;
+let startupPrune;
 /** Default cooling period when retries are exhausted and upstream didn't
  *  provide a retry-after header. Short enough to recover quickly, long
  *  enough to avoid immediately hammering the same account. */
@@ -3201,10 +3203,18 @@ async function loadClaudeProxyAccounts(args) {
     const { tokenStore } = await import("../../auth/tokenStore.js");
     const persistedCooldowns = await loadAccountCooldowns();
     if (!startupPruneDone) {
-        await tokenStore.pruneExpired();
-        startupPruneDone = true;
+        startupPrune ??= tokenStore
+            .pruneExpired()
+            .then(() => {
+            startupPruneDone = true;
+        })
+            .finally(() => {
+            startupPrune = undefined;
+        });
+        await startupPrune;
     }
-    const compoundKeys = await tokenStore.listByPrefix("anthropic:");
+    const inventory = await tokenStore.getProviderSnapshot();
+    const compoundKeys = Object.keys(inventory).filter((key) => key.startsWith("anthropic:"));
     // Tracked so an empty pool can name the real cause: "every account is
     // entitlement-blocked" is a different problem from "no credentials".
     const entitlementBlockedLabels = [];
@@ -3215,9 +3225,9 @@ async function loadClaudeProxyAccounts(args) {
             logger.debug(`[proxy] skipping account=${key} (not in account allowlist)`);
             continue;
         }
-        if (await tokenStore.isDisabled(key)) {
+        if (inventory[key].disabled) {
             const existingState = getOrCreateRuntimeState(key);
-            const disabledReason = await tokenStore.getDisabledReason(key);
+            const disabledReason = inventory[key].disabledReason;
             // Older releases permanently disabled accounts after any refresh error,
             // including timeouts, 429s and 5xx responses. Re-evaluate those legacy
             // entries once under the terminal/transient classifier below.
@@ -3238,7 +3248,7 @@ async function loadClaudeProxyAccounts(args) {
                 continue;
             }
         }
-        const tokens = await tokenStore.loadTokens(key);
+        const tokens = inventory[key].tokens;
         if (!tokens) {
             skippedForOtherReasons += 1;
             continue;
@@ -3623,9 +3633,8 @@ async function executeClaudeFallbackWithRetry(args) {
 /**
  * Run the configured `codex` fallback through the native pooled Codex route.
  *
- * The inner response is fully buffered and validated before this function
- * creates a single Claude frame. That preserves the proxy's no-replay-after-
- * output guarantee when Codex returns an incomplete stream.
+ * Streaming clients receive incremental output. Once the stream is returned,
+ * failures are terminal SSE errors; only pre-output failures may try a fallback.
  */
 async function executeClaudeCodexFallback(args) {
     const { ctx, body, model, reasoningEffort, tracer, requestStartTime, logProxyBody, logFinalRequest, } = args;
@@ -3648,6 +3657,145 @@ async function executeClaudeCodexFallback(args) {
     };
     const codexResponse = await handleCodexResponsesRequest(codexCtx);
     const codexHeaders = { ...(codexCtx.responseHeaders ?? {}) };
+    if (body.stream) {
+        const bridge = await createCodexFallbackStream(codexResponse, body.model);
+        ctx.responseHeaders ??= {};
+        Object.assign(ctx.responseHeaders, redactHeadersForBorrower(codexHeaders));
+        const account = codexHeaders["x-neurolink-account"] ?? "";
+        const accountType = codexHeaders["x-neurolink-account-type"] ?? "codex-oauth";
+        let settled = false;
+        let captured = "";
+        let responseBytes = 0;
+        const finish = (status, result, errorType, message) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            ctx.abortSignal?.removeEventListener("abort", cancel);
+            if (status >= 400) {
+                ctx.metadata.terminalErrorType = errorType;
+            }
+            tracer?.end(status, Date.now() - requestStartTime);
+            logFinalRequest(status, account, accountType, errorType, message, {
+                inputTokens: result?.usage?.input,
+                outputTokens: result?.usage?.output,
+                cacheCreationTokens: result?.usage?.cacheCreationTokens,
+                cacheReadTokens: result?.usage?.cacheReadTokens,
+            });
+            recordFallbackAttempt({
+                provider: "codex",
+                model,
+                status: status < 400 ? "success" : "failure",
+                durationMs: Date.now() - requestStartTime,
+                ...(message ? { errorMessage: message } : {}),
+            });
+            logProxyBody({
+                phase: "client_response",
+                contentType: "text/event-stream",
+                body: captured,
+                bodySize: responseBytes,
+                responseStatus: status,
+                durationMs: Date.now() - requestStartTime,
+            });
+        };
+        const cancel = () => {
+            finish(499, undefined, "client_cancelled", "Client cancelled Codex fallback stream");
+            void bridge.cancel();
+        };
+        ctx.abortSignal?.addEventListener("abort", cancel, { once: true });
+        registerProxyResponseObserver(ctx.metadata, {
+            onTerminal: ({ outcome }) => {
+                if (outcome === "client_cancelled") {
+                    cancel();
+                }
+                else if (outcome === "stream_error") {
+                    finish(502, undefined, "stream_error", "Codex fallback stream failed");
+                    void bridge.cancel();
+                }
+            },
+        });
+        const capture = (frame) => {
+            responseBytes += Buffer.byteLength(frame);
+            if (captured.length < 1024 * 1024) {
+                captured += frame.slice(0, 1024 * 1024 - captured.length);
+            }
+            return frame;
+        };
+        async function* relay() {
+            try {
+                if (ctx.abortSignal?.aborted) {
+                    cancel();
+                    return;
+                }
+                let pending = bridge.frames.next();
+                while (!settled) {
+                    let timer;
+                    const heartbeat = new Promise((resolve) => {
+                        timer = setTimeout(() => resolve(null), 15_000);
+                        timer.unref();
+                    });
+                    let next;
+                    try {
+                        next = await Promise.race([pending, heartbeat]);
+                    }
+                    finally {
+                        clearTimeout(timer);
+                    }
+                    if (settled) {
+                        return;
+                    }
+                    if (next === null) {
+                        yield capture(ClaudeStreamSerializer.pingEvent());
+                        continue;
+                    }
+                    if (next.done === true) {
+                        finish(200, next.value);
+                        return;
+                    }
+                    const frame = capture(next.value);
+                    if (frame.startsWith("event: message_stop\n")) {
+                        // Finalize before exposing the terminal frame: a client can close
+                        // immediately after receiving it without making another pull.
+                        const completion = await bridge.frames.next();
+                        if (completion.done !== true) {
+                            throw new Error("Codex fallback emitted output after message_stop");
+                        }
+                        if (settled) {
+                            return;
+                        }
+                        finish(200, completion.value);
+                        yield frame;
+                        return;
+                    }
+                    yield frame;
+                    pending = bridge.frames.next();
+                }
+            }
+            catch (error) {
+                if (!settled) {
+                    const detail = redactProviderErrorMessage(describeTransportError(error));
+                    logger.always(`[proxy] Codex fallback stream failed: ${detail}`);
+                    const serializer = new ClaudeStreamSerializer(body.model);
+                    const frames = [
+                        ...serializer.emitError(502, "Codex fallback stream failed"),
+                    ].map(capture);
+                    finish(502, undefined, "stream_error", detail);
+                    yield* frames;
+                }
+            }
+            finally {
+                ctx.abortSignal?.removeEventListener("abort", cancel);
+                if (!settled) {
+                    cancel();
+                }
+                await bridge.cancel();
+                await bridge.frames
+                    .return({ text: "", toolCalls: [], finishReason: "end_turn" })
+                    .catch(() => undefined);
+            }
+        }
+        return relay();
+    }
     let parsed;
     try {
         parsed = await consumeCodexFallbackResponse(codexResponse);
@@ -3673,49 +3821,6 @@ async function executeClaudeCodexFallback(args) {
         ...(parsed.usage ? { usage: parsed.usage } : {}),
         toolCalls: parsed.toolCalls,
     };
-    if (body.stream) {
-        const serializer = new ClaudeStreamSerializer(body.model, parsed.usage?.input ?? 0);
-        const frames = [];
-        for (const frame of serializer.start()) {
-            frames.push(frame);
-        }
-        if (parsed.text) {
-            for (const frame of serializer.pushDelta(parsed.text)) {
-                frames.push(frame);
-            }
-        }
-        for (const toolCall of parsed.toolCalls) {
-            for (const frame of serializer.pushToolUse(generateToolUseId(), toolCall.toolName, toolCall.args)) {
-                frames.push(frame);
-            }
-        }
-        for (const frame of serializer.finish(parsed.usage?.output, parsed.finishReason)) {
-            frames.push(frame);
-        }
-        tracer?.end(200, Date.now() - requestStartTime);
-        logFinalRequest(200, accountLabel, accountType, undefined, undefined, {
-            inputTokens: parsed.usage?.input,
-            outputTokens: parsed.usage?.output,
-            cacheCreationTokens: parsed.usage?.cacheCreationTokens,
-            cacheReadTokens: parsed.usage?.cacheReadTokens,
-        });
-        const bufferedBody = frames.join("");
-        logProxyBody({
-            phase: "client_response",
-            headers: { "content-type": "text/event-stream" },
-            body: bufferedBody,
-            bodySize: Buffer.byteLength(bufferedBody, "utf8"),
-            contentType: "text/event-stream",
-            responseStatus: 200,
-            durationMs: Date.now() - requestStartTime,
-        });
-        async function* sseGenerator() {
-            for (const frame of frames) {
-                yield frame;
-            }
-        }
-        return sseGenerator();
-    }
     tracer?.end(200, Date.now() - requestStartTime);
     const clientResponse = serializeClaudeResponse(internal, body.model);
     logFinalRequest(200, accountLabel, accountType, undefined, undefined, {
@@ -3820,6 +3925,7 @@ async function tryConfiguredClaudeFallbackChain(args) {
         reason: "all_anthropic_accounts_exhausted",
     });
     let lastFallbackError;
+    let terminalFailure;
     let invalidRequestFailure;
     for (const fallback of fallbackPlan.attempts.slice(1)) {
         if (!fallback.provider || !fallback.model) {
@@ -3873,6 +3979,9 @@ async function tryConfiguredClaudeFallbackChain(args) {
                     providerLabel: fallback.provider,
                 });
             }
+            if (fallback.provider === "codex" && body.stream) {
+                return { response };
+            }
             recordFallbackAttempt({
                 provider: fallback.provider,
                 model: fallback.model,
@@ -3899,7 +4008,27 @@ async function tryConfiguredClaudeFallbackChain(args) {
             return { response };
         }
         catch (fallbackErr) {
-            invalidRequestFailure ??=
+            const status = ctx.abortSignal?.aborted
+                ? 499
+                : fallbackErr instanceof CodexFallbackResponseError
+                    ? fallbackErr.status
+                    : 502;
+            terminalFailure = {
+                status,
+                message: `Configured fallback ${fallback.provider}/${fallback.model} failed (HTTP ${status})`,
+                errorType: status === 499
+                    ? "client_cancelled"
+                    : status === 429
+                        ? "rate_limit_error"
+                        : status === 401
+                            ? "authentication_error"
+                            : status === 403
+                                ? "permission_error"
+                                : status === 400
+                                    ? "invalid_request_error"
+                                    : "api_error",
+            };
+            invalidRequestFailure =
                 getCodexFallbackInvalidRequestFailure(fallbackErr) ?? undefined;
             const errMsg = redactProviderErrorMessage(fallbackErr instanceof Error
                 ? fallbackErr.message
@@ -3934,14 +4063,29 @@ async function tryConfiguredClaudeFallbackChain(args) {
                 durationMs: Date.now() - fallbackStart,
             });
             lastFallbackError = `[${fallback.provider}/${fallback.model}] ${redactProviderErrorMessage(describeTransportError(fallbackErr))}`;
+            if (ctx.abortSignal?.aborted) {
+                break;
+            }
         }
     }
     return {
         response: null,
         lastErrorMessage: lastFallbackError,
+        terminalFailure,
         ...(invalidRequestFailure ? { invalidRequestFailure } : {}),
     };
 }
+/** Preserve the final fallback status through every HTTP route adapter. */
+function buildConfiguredClaudeFallbackFailure(args) {
+    const { failure, buildLoggedClaudeError, tracer, requestStartTime } = args;
+    tracer?.setError(failure.errorType, failure.message);
+    tracer?.end(failure.status, Date.now() - requestStartTime);
+    const body = buildLoggedClaudeError(failure.status, failure.message, failure.errorType);
+    return new Response(JSON.stringify(body), {
+        status: failure.status,
+        headers: { "content-type": "application/json" },
+    });
+}
 async function tryAutoClaudeFallback(args) {
     const { ctx, body, tracer, requestStartTime, logProxyBody, logFinalRequest } = args;
     const fallbackStart = Date.now();
@@ -6325,6 +6469,15 @@ async function handleAnthropicRoutedClaudeRequest(args) {
                 logFinalRequest,
             });
         }
+        if (configuredFallbackResult.terminalFailure) {
+            const failure = configuredFallbackResult.terminalFailure;
+            return buildConfiguredClaudeFallbackFailure({
+                failure,
+                buildLoggedClaudeError,
+                tracer,
+                requestStartTime,
+            });
+        }
         return buildDeferredClaudeAccountFailureResponse({
             ctx,
             tracer,
@@ -6821,13 +6974,25 @@ async function handleAnthropicRoutedClaudeRequest(args) {
         if (configuredFallbackResult.response) {
             return configuredFallbackResult.response;
         }
-        if (configuredFallbackResult.invalidRequestFailure &&
-            !loopState.sawRateLimit) {
-            // A converted Codex request can be rejected independently of the original
-            // Anthropic request. Preserve a real pool 429 as the actionable terminal
-            // response when both occurred.
-            loopState.invalidRequestFailure =
-                configuredFallbackResult.invalidRequestFailure;
+        if (configuredFallbackResult.invalidRequestFailure) {
+            // Surface the failure of the provider actually attempted last.
+            return buildClaudeAnthropicFailureResponse({
+                tracer,
+                requestStartTime,
+                authFailureMessage: null,
+                authCooldownMessage: null,
+                invalidRequestFailure: configuredFallbackResult.invalidRequestFailure,
+                entitlementFailure: null,
+                scopedExhaustion: null,
+                sawNetworkError: false,
+                sawTransientFailure: false,
+                sawRateLimit: false,
+                lastError: undefined,
+                orderedAccounts: [],
+                buildLoggedClaudeError,
+                logProxyBody,
+                logFinalRequest,
+            });
         }
         fallbackFailureMessage = configuredFallbackResult.lastErrorMessage;
         // A translation-layer-selected provider is only permitted by an explicit
@@ -6849,6 +7014,16 @@ async function handleAnthropicRoutedClaudeRequest(args) {
             fallbackFailureMessage =
                 autoFallbackResult.lastErrorMessage ?? fallbackFailureMessage;
         }
+        if (configuredFallbackResult.terminalFailure &&
+            !configuredFallbackResult.invalidRequestFailure) {
+            const failure = configuredFallbackResult.terminalFailure;
+            return buildConfiguredClaudeFallbackFailure({
+                failure,
+                buildLoggedClaudeError,
+                tracer,
+                requestStartTime,
+            });
+        }
         loopState.fallbackFailureMessage = fallbackFailureMessage;
     }
     // Terminal failure — usually "every account is rate-limited". This is the

package/dist/server/routes/codexProxyRoutes.js

@@ -134,18 +134,18 @@ function buildCodexErrorResponse(status, message) {
  * tokens and hydrating cooldown + quota state from disk.
  */
 async function loadCodexProxyAccounts() {
-    const keys = await tokenStore.listByPrefix(CODEX_ACCOUNT_PREFIX);
-    const [cooldowns, quotas] = await Promise.all([
+    const [inventory, cooldowns, quotas] = await Promise.all([
+        tokenStore.getProviderSnapshot(),
         loadAccountCooldowns(),
         loadAccountQuotas(),
     ]);
     const now = Date.now();
     const accounts = [];
-    for (const key of keys) {
-        if (await tokenStore.isDisabled(key)) {
+    for (const [key, entry] of Object.entries(inventory)) {
+        if (!key.startsWith(CODEX_ACCOUNT_PREFIX) || entry.disabled) {
             continue;
         }
-        const tokens = await tokenStore.loadTokens(key);
+        const tokens = entry.tokens;
         if (!tokens || tokens.tokenType !== "Bearer") {
             // Only OAuth (Bearer) accounts can serve the ChatGPT backend.
             continue;
@@ -346,6 +346,17 @@ export async function handleCodexResponsesRequest(ctx) {
         }).catch(() => undefined);
     };
     const accounts = await loadCodexProxyAccounts();
+    const cancelRequest = async (account) => {
+        await recordFinalOutcome(account, 499, {
+            errorType: "client_cancelled",
+            errorMessage: "Client cancelled Codex request",
+            terminalOutcome: "client_cancelled",
+        });
+        return buildCodexErrorResponse(499, "Client cancelled Codex request");
+    };
+    if (ctx.abortSignal?.aborted) {
+        return cancelRequest();
+    }
     if (accounts.length === 0) {
         await recordFinalOutcome(undefined, 401, {
             errorType: "no_accounts",
@@ -392,6 +403,9 @@ export async function handleCodexResponsesRequest(ctx) {
         let authRetried = false;
         // Same-account loop only re-runs once, for a post-401 token refresh.
         for (;;) {
+            if (ctx.abortSignal?.aborted) {
+                return cancelRequest(lastAttemptedAccount);
+            }
             attempt += 1;
             const attemptStartedAt = Date.now();
             lastAttemptedAccount = account;
@@ -402,10 +416,23 @@ export async function handleCodexResponsesRequest(ctx) {
                     method: "POST",
                     headers: buildCodexUpstreamHeaders(ctx.headers, account),
                     body: bodyStr,
-                    signal: AbortSignal.timeout(CODEX_UPSTREAM_TIMEOUT_MS),
+                    signal: ctx.abortSignal
+                        ? AbortSignal.any([
+                            ctx.abortSignal,
+                            AbortSignal.timeout(CODEX_UPSTREAM_TIMEOUT_MS),
+                        ])
+                        : AbortSignal.timeout(CODEX_UPSTREAM_TIMEOUT_MS),
                 });
             }
             catch (error) {
+                if (ctx.abortSignal?.aborted) {
+                    writeAttempt(account, attempt, attemptStartedAt, 499, {
+                        errorType: "client_cancelled",
+                        errorMessage: "Client cancelled Codex request",
+                        retryable: false,
+                    });
+                    return cancelRequest(account);
+                }
                 // A transport failure message is derived from local state — resolved
                 // hostnames, socket paths, Node internals — and says nothing the caller
                 // can act on. Keep the detail in the log and return a fixed string, so

package/dist/types/cli.d.ts

@@ -860,6 +860,7 @@ export type ProxyRollingState = {
         generation: number;
     }>;
     queuedSockets: number;
+    pendingTransfers?: number;
     rejectedSockets: number;
     failedTransfers: number;
     lastFailure: {
@@ -871,7 +872,7 @@ export type ProxyRollingState = {
         workerPid?: number;
         workerExitCode?: number | null;
         workerExitSignal?: string | null;
-        supervisorAction?: "none" | "sigkill_after_transfer_failure";
+        supervisorAction?: "none" | "sigkill_after_transfer_failure" | "cancel_uncommitted_socket";
     } | null;
 };
 export type ProxySupervisorState = {