@juspay/neurolink 12.14.7 → 12.14.8

package/dist/proxy/sseInterceptor.js

@@ -15,6 +15,7 @@
  *   upstreamResponse.body.pipeThrough(stream).pipeTo(clientWritable);
  *   const data = await telemetry; // resolves on stream end
  */
+import { hasUsefulClaudeContent } from "./claudeOutputObservation.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -172,6 +173,8 @@ function finalize(acc) {
         messageId: acc.messageId,
         messageStopReceived: acc.messageStopReceived,
         firstUsefulOutputAt: acc.firstUsefulOutputAt,
+        firstUsefulOutputEvent: acc.firstUsefulOutputEvent,
+        observationIncomplete: acc.observationIncomplete,
         model: acc.model,
         usage: {
             inputTokens: acc.inputTokens,
@@ -191,6 +194,7 @@ function finalize(acc) {
             ? { streamErrorMessage: acc.streamErrorMessage }
             : {}),
         ...(acc.rawTextChunks ? { rawText: acc.rawTextChunks.join("") } : {}),
+        rawTextTruncated: acc.rawTextTruncated,
     };
 }
 // ---------------------------------------------------------------------------
@@ -320,12 +324,17 @@ function processEvent(acc, event) {
     if (!event.data) {
         return;
     }
+    if (event.data.length > 1024 * 1024) {
+        acc.observationIncomplete = true;
+        return;
+    }
     let parsed;
     try {
         parsed = JSON.parse(event.data);
     }
     catch {
         // Malformed JSON — skip silently, bytes already forwarded to client
+        acc.observationIncomplete = true;
         return;
     }
     const payloadType = parsed && typeof parsed === "object" && "type" in parsed
@@ -357,11 +366,52 @@ function processEvent(acc, event) {
             typeof delta === "object" &&
             (("text" in delta &&
                 typeof delta.text === "string" &&
-                delta.text.length > 0) ||
+                delta.text.trim().length > 0) ||
                 ("partial_json" in delta &&
                     typeof delta.partial_json === "string" &&
-                    delta.partial_json.length > 0))) {
-            acc.firstUsefulOutputAt ??= Date.now();
+                    delta.partial_json.trim().length > 0) ||
+                ("refusal" in delta &&
+                    typeof delta.refusal === "string" &&
+                    delta.refusal.trim().length > 0))) {
+            if (acc.firstUsefulOutputAt === undefined) {
+                acc.firstUsefulOutputAt = now;
+                acc.firstUsefulOutputEvent = `content_block_delta.${"text" in delta ? "text" : "refusal" in delta ? "refusal" : "partial_json"}`;
+            }
+        }
+    }
+    if (acc.firstUsefulOutputAt === undefined &&
+        parsed &&
+        typeof parsed === "object") {
+        const payload = parsed;
+        if (eventType === "message_start" &&
+            hasUsefulClaudeContent(payload.message)) {
+            acc.firstUsefulOutputAt = now;
+            acc.firstUsefulOutputEvent = "message_start.content";
+        }
+        const block = payload.content_block;
+        if (eventType === "content_block_start" &&
+            block &&
+            typeof block === "object") {
+            const content = block;
+            if ((typeof content.text === "string" && content.text.trim().length > 0) ||
+                (typeof content.refusal === "string" &&
+                    content.refusal.trim().length > 0) ||
+                ((content.type === "tool_use" || content.type === "server_tool_use") &&
+                    content.input &&
+                    typeof content.input === "object" &&
+                    Object.keys(content.input).length > 0)) {
+                acc.firstUsefulOutputAt = now;
+                acc.firstUsefulOutputEvent = "content_block_start";
+            }
+        }
+        // A completed zero-argument tool call is useful even when no input delta was sent.
+        if (eventType === "content_block_stop" &&
+            typeof payload.index === "number") {
+            const content = acc.contentBlocks.find((block) => block.index === payload.index);
+            if (content?.type === "tool_use" && content.toolName) {
+                acc.firstUsefulOutputAt = now;
+                acc.firstUsefulOutputEvent = "content_block_stop.tool_use";
+            }
         }
     }
     switch (eventType) {
@@ -403,6 +453,7 @@ export function createSSEInterceptor(options = {}) {
     const captureRawText = options.captureRawText ?? false;
     const acc = createAccumulator(captureRawText);
     let sseBuffer = "";
+    let discardingFrame = false;
     let resolved = false;
     const decoder = new TextDecoder();
     let resolveTelemetry;
@@ -415,6 +466,9 @@ export function createSSEInterceptor(options = {}) {
             return;
         }
         resolved = true;
+        if (sseBuffer.trim()) {
+            acc.observationIncomplete = true;
+        }
         resolveTelemetry(finalize(acc));
     }
     const transform = new TransformStream({
@@ -427,8 +481,22 @@ export function createSSEInterceptor(options = {}) {
             const decodedChunk = decoder.decode(chunk, { stream: true });
             appendRawTextChunk(acc, decodedChunk);
             sseBuffer += decodedChunk;
+            if (discardingFrame) {
+                const boundary = /\r\n\r\n|\n\n|\r\r/.exec(sseBuffer);
+                if (!boundary) {
+                    sseBuffer = sseBuffer.slice(-4);
+                    return;
+                }
+                sseBuffer = sseBuffer.slice(boundary.index + boundary[0].length);
+                discardingFrame = false;
+            }
             const { events, remainder } = extractSSEEvents(sseBuffer);
             sseBuffer = remainder;
+            if (sseBuffer.length > 1024 * 1024) {
+                acc.observationIncomplete = true;
+                discardingFrame = true;
+                sseBuffer = sseBuffer.slice(-4);
+            }
             for (const event of events) {
                 processEvent(acc, event);
             }

package/dist/server/routes/claudeProxyRoutes.d.ts

@@ -1,14 +1,3 @@
-/**
- * Claude-Compatible Proxy Routes
- *
- * Exposes Anthropic-compatible /v1/messages, /v1/models, and /v1/messages/count_tokens
- * endpoints. ALL requests are routed through ctx.neurolink.generate() / ctx.neurolink.stream()
- * -- no direct HTTP calls to Anthropic.
- *
- * An optional ModelRouter can remap incoming model names to different
- * provider/model pairs (e.g. "claude-sonnet-4-20250514" -> vertex/gemini-2.5-pro).
- * Without a router, models are passed through to the Anthropic provider.
- */
 import { buildTranslationOptions } from "../../proxy/proxyTranslationEngine.js";
 import { ProxyTracer } from "../../proxy/proxyTracer.js";
 import { isPermanentRefreshFailure } from "../../proxy/tokenRefresh.js";

package/dist/server/routes/claudeProxyRoutes.js

@@ -1,3 +1,4 @@
+import { claudeOutputLogFields, observeClaudeJsonOutput, observeClaudeStreamOutput, } from "../../proxy/claudeOutputObservation.js";
 /**
  * Claude-Compatible Proxy Routes
  *
@@ -2437,7 +2438,7 @@ async function handleClaudePassthroughStreamResponse(args) {
             ])
                 .then(([data, clientBody, rawOutcome]) => {
                 const terminalOutcome = mergeStreamTerminalOutcome(rawOutcome, data.streamErrorMessage, data.messageStopReceived);
-                ctx.metadata.firstUsefulOutputAt = data.firstUsefulOutputAt;
+                observeClaudeStreamOutput(ctx.metadata, data);
                 const failure = getStreamFailureDetails(terminalOutcome);
                 capturedTracer.setUsage({
                     inputTokens: data.usage.inputTokens,
@@ -2482,6 +2483,7 @@ async function handleClaudePassthroughStreamResponse(args) {
                     phase: "upstream_response",
                     headers: responseHeaders,
                     body: data.rawText ?? "",
+                    sourceTruncated: data.rawTextTruncated,
                     bodySize: data.totalBytesReceived,
                     contentType: responseHeaders["content-type"] ?? "text/event-stream",
                     account: "passthrough",
@@ -2494,6 +2496,7 @@ async function handleClaudePassthroughStreamResponse(args) {
                     phase: "client_response",
                     headers: responseHeaders,
                     body: clientBody.text,
+                    sourceTruncated: clientBody.truncated,
                     bodySize: clientBody.totalBytes,
                     contentType: responseHeaders["content-type"] ?? "text/event-stream",
                     account: "passthrough",
@@ -2539,7 +2542,7 @@ async function handleClaudePassthroughStreamResponse(args) {
             ])
                 .then(([data, clientBody, rawOutcome]) => {
                 const terminalOutcome = mergeStreamTerminalOutcome(rawOutcome, data.streamErrorMessage, data.messageStopReceived);
-                ctx.metadata.firstUsefulOutputAt = data.firstUsefulOutputAt;
+                observeClaudeStreamOutput(ctx.metadata, data);
                 const failure = getStreamFailureDetails(terminalOutcome);
                 finalizeStream(failure?.status ?? response.status, failure?.errorType, failure?.message, {
                     inputTokens: data.usage.inputTokens,
@@ -2551,6 +2554,7 @@ async function handleClaudePassthroughStreamResponse(args) {
                     phase: "upstream_response",
                     headers: responseHeaders,
                     body: data.rawText ?? "",
+                    sourceTruncated: data.rawTextTruncated,
                     bodySize: data.totalBytesReceived,
                     contentType: responseHeaders["content-type"] ?? "text/event-stream",
                     account: "passthrough",
@@ -2563,6 +2567,7 @@ async function handleClaudePassthroughStreamResponse(args) {
                     phase: "client_response",
                     headers: responseHeaders,
                     body: clientBody.text,
+                    sourceTruncated: clientBody.truncated,
                     bodySize: clientBody.totalBytes,
                     contentType: responseHeaders["content-type"] ?? "text/event-stream",
                     account: "passthrough",
@@ -2603,7 +2608,7 @@ async function handleClaudePassthroughStreamResponse(args) {
     });
 }
 async function handleClaudePassthroughJsonResponse(args) {
-    const { bodyStr, response, tracer, requestStartTime, upstreamSpan, upstreamResponseHeaders, logProxyBody, logFinalRequest, } = args;
+    const { ctx, bodyStr, response, tracer, requestStartTime, upstreamSpan, upstreamResponseHeaders, logProxyBody, logFinalRequest, } = args;
     const responseText = await response.text();
     tracer?.logUpstreamResponseBody(responseText);
     logProxyBody({
@@ -2631,6 +2636,7 @@ async function handleClaudePassthroughJsonResponse(args) {
         durationMs: Date.now() - requestStartTime,
     });
     const responseJson = JSON.parse(responseText);
+    observeClaudeJsonOutput(ctx.metadata, responseJson);
     if (tracer && responseJson && typeof responseJson === "object") {
         const usage = responseJson.usage;
         if (usage) {
@@ -3569,6 +3575,8 @@ async function executeClaudeFallbackTranslation(args) {
         for (const frame of serializer.finish(resolvedUsage.output, reason)) {
             frames.push(frame);
         }
+        ctx.metadata.firstUsefulOutputAt = Date.now();
+        ctx.metadata.firstUsefulOutputEvent = "translated_response.ready";
         // Telemetry AFTER validation — not before like the old lazy path
         tracer?.end(200, Date.now() - requestStartTime);
         logFinalRequest(200, "", providerLabel, undefined, undefined, {
@@ -3609,6 +3617,7 @@ async function executeClaudeFallbackTranslation(args) {
     };
     tracer?.end(200, Date.now() - requestStartTime);
     const clientResponse = serializeClaudeResponse(internal, body.model);
+    observeClaudeJsonOutput(ctx.metadata, clientResponse);
     logFinalRequest(200, "", providerLabel, undefined, undefined, {
         inputTokens: internal.usage?.input,
         outputTokens: internal.usage?.output,
@@ -3855,6 +3864,7 @@ async function executeClaudeCodexFallback(args) {
     };
     tracer?.end(200, Date.now() - requestStartTime);
     const clientResponse = serializeClaudeResponse(internal, body.model);
+    observeClaudeJsonOutput(ctx.metadata, clientResponse);
     logFinalRequest(200, accountLabel, accountType, undefined, undefined, {
         inputTokens: parsed.usage?.input,
         outputTokens: parsed.usage?.output,
@@ -4476,6 +4486,7 @@ async function handleAnthropicSuccessfulResponse(args) {
         });
     }
     return handleAnthropicJsonSuccessResponse({
+        ctx,
         account,
         response,
         responseHeaders,
@@ -4758,7 +4769,7 @@ function attachAnthropicSuccessStreamTelemetry(args) {
             telemetryDone = Promise.all([telemetry, clientCapture, streamOutcome])
                 .then(([data, clientBody, rawOutcome]) => {
                 const terminalOutcome = mergeStreamTerminalOutcome(rawOutcome, data.streamErrorMessage, data.messageStopReceived);
-                ctx.metadata.firstUsefulOutputAt = data.firstUsefulOutputAt;
+                observeClaudeStreamOutput(ctx.metadata, data);
                 recordCommittedAnthropicStreamAttemptFailure(terminalOutcome, account, logAttempt);
                 capturedTracer.setUsage({
                     inputTokens: data.usage.inputTokens,
@@ -4823,6 +4834,7 @@ function attachAnthropicSuccessStreamTelemetry(args) {
                     phase: "upstream_response",
                     headers: responseHeaders,
                     body: data.rawText ?? "",
+                    sourceTruncated: data.rawTextTruncated,
                     bodySize: data.totalBytesReceived,
                     contentType: responseHeaders["content-type"] ?? "text/event-stream",
                     account: capturedAccountLabel,
@@ -4835,6 +4847,7 @@ function attachAnthropicSuccessStreamTelemetry(args) {
                     phase: "client_response",
                     headers: responseHeaders,
                     body: clientBody.text,
+                    sourceTruncated: clientBody.truncated,
                     bodySize: clientBody.totalBytes,
                     contentType: responseHeaders["content-type"] ?? "text/event-stream",
                     account: capturedAccountLabel,
@@ -4888,7 +4901,7 @@ function attachAnthropicSuccessStreamTelemetry(args) {
             ])
                 .then(([data, clientBody, rawOutcome]) => {
                 const terminalOutcome = mergeStreamTerminalOutcome(rawOutcome, data.streamErrorMessage, data.messageStopReceived);
-                ctx.metadata.firstUsefulOutputAt = data.firstUsefulOutputAt;
+                observeClaudeStreamOutput(ctx.metadata, data);
                 recordCommittedAnthropicStreamAttemptFailure(terminalOutcome, account, logAttempt);
                 const failure = getStreamFailureDetails(terminalOutcome);
                 const usage = {
@@ -4911,6 +4924,7 @@ function attachAnthropicSuccessStreamTelemetry(args) {
                     phase: "upstream_response",
                     headers: responseHeaders,
                     body: data.rawText ?? "",
+                    sourceTruncated: data.rawTextTruncated,
                     bodySize: data.totalBytesReceived,
                     contentType: responseHeaders["content-type"] ?? "text/event-stream",
                     account: capturedAccountLabel,
@@ -4923,6 +4937,7 @@ function attachAnthropicSuccessStreamTelemetry(args) {
                     phase: "client_response",
                     headers: responseHeaders,
                     body: clientBody.text,
+                    sourceTruncated: clientBody.truncated,
                     bodySize: clientBody.totalBytes,
                     contentType: responseHeaders["content-type"] ?? "text/event-stream",
                     account: capturedAccountLabel,
@@ -4944,6 +4959,7 @@ function attachAnthropicSuccessStreamTelemetry(args) {
                     phase: "client_response",
                     headers: responseHeaders,
                     body: clientBody.text,
+                    sourceTruncated: clientBody.truncated,
                     bodySize: clientBody.totalBytes,
                     contentType: responseHeaders["content-type"] ?? "text/event-stream",
                     account: account.label,
@@ -4995,7 +5011,7 @@ function attachAnthropicSuccessStreamTelemetry(args) {
     };
 }
 async function handleAnthropicJsonSuccessResponse(args) {
-    const { account, response, responseHeaders, tracer, requestStartTime, fetchStartMs, attemptNumber, finalBodyStr, upstreamSpan, logAttempt, logProxyBody, logFinalRequest, } = args;
+    const { ctx, account, response, responseHeaders, tracer, requestStartTime, fetchStartMs, attemptNumber, finalBodyStr, upstreamSpan, logAttempt, logProxyBody, logFinalRequest, } = args;
     const responseText = await response.text();
     logAttempt(response.status, undefined, undefined, {
         attemptDurationMs: Date.now() - fetchStartMs,
@@ -5026,6 +5042,7 @@ async function handleAnthropicJsonSuccessResponse(args) {
         durationMs: Date.now() - requestStartTime,
     });
     const responseJson = JSON.parse(responseText);
+    observeClaudeJsonOutput(ctx.metadata, responseJson);
     // Settlement is not diagnostics. It ran inside the tracer branch, so a node
     // with tracing off served every borrowed request for free and the lender's
     // ledger never moved — settle from the response itself instead.
@@ -5087,7 +5104,7 @@ async function handleAnthropicJsonSuccessResponse(args) {
     return { response: responseJson };
 }
 async function handleAnthropicSuccessfulNonStreamRetryResponse(args) {
-    const { account, accountState, requestedModel, retryResp, tracer, requestStartTime, fetchStartMs, attemptNumber, finalBodyStr, upstreamSpan, logAttempt, logProxyBody, logFinalRequest, } = args;
+    const { ctx, account, accountState, requestedModel, retryResp, tracer, requestStartTime, fetchStartMs, attemptNumber, finalBodyStr, upstreamSpan, logAttempt, logProxyBody, logFinalRequest, } = args;
     const retryQuota = parseQuotaHeaders(retryResp.headers, {
         model: requestedModel,
     });
@@ -5145,6 +5162,7 @@ async function handleAnthropicSuccessfulNonStreamRetryResponse(args) {
         durationMs: Date.now() - requestStartTime,
     });
     const retryJson = JSON.parse(retryText);
+    observeClaudeJsonOutput(ctx.metadata, retryJson);
     // A response served after an auth retry is a served response: it costs the
     // lender's account exactly what any other one does.
     settleFromResponseUsage(account, retryJson);
@@ -5267,6 +5285,7 @@ async function handleAnthropicAuthRetry(args) {
                     })
                     : {
                         response: await handleAnthropicSuccessfulNonStreamRetryResponse({
+                            ctx,
                             account,
                             accountState,
                             requestedModel: body.model,
@@ -6004,11 +6023,7 @@ function createClaudeRequestRuntimeContext(args) {
             ...buildClientAttribution(ctx.headers),
             responseStatus: status,
             responseTimeMs: Date.now() - requestStartTime,
-            ...(typeof ctx.metadata.firstUsefulOutputAt === "number"
-                ? {
-                    firstUsefulOutputMs: Math.max(0, ctx.metadata.firstUsefulOutputAt - requestStartTime),
-                }
-                : {}),
+            ...claudeOutputLogFields(ctx.metadata, requestStartTime),
             ...(errorType ? { errorType } : {}),
             ...(errorMessage ? { errorMessage } : {}),
             ...(extra?.errorCode ? { errorCode: extra.errorCode } : {}),

package/dist/server/routes/codexProxyRoutes.js

@@ -25,7 +25,10 @@ import { createCodexUsageTap } from "../../proxy/codexUsage.js";
 import { CODEX_ACCOUNT_PREFIX, parseCodexRateLimitHeaders, } from "../../proxy/codexAccountUsage.js";
 import { buildClientAttribution } from "../../proxy/clientAttribution.js";
 import { registerProxyResponseObserver } from "../../proxy/proxyActivity.js";
-import { logRequest, logRequestAttempt } from "../../proxy/requestLogger.js";
+import { logRequest, logRequestAttempt, logBodyCapture, isProxyBodyCaptureEnabled, } from "../../proxy/requestLogger.js";
+import { createRawStreamCapture } from "../../proxy/rawStreamCapture.js";
+import { resolveProxyLogTraceContext } from "../../proxy/proxyTraceContext.js";
+import { isBorrowedRequest } from "../../proxy/shareContext.js";
 import { ProxyTracer } from "../../proxy/proxyTracer.js";
 import { parseRetryAfterMs } from "../../proxy/routingPolicy.js";
 import { recordAttempt, recordAttemptError, recordFinalError, recordFinalSuccess, } from "../../proxy/usageStats.js";
@@ -272,6 +275,68 @@ function publishCodexHeaders(ctx, account, attempt, quota) {
 }
 /** Core pooled handler for POST /backend-api/codex/responses. */
 export async function handleCodexResponsesRequest(ctx) {
+    if (ctx.metadata?.[CODEX_FALLBACK_METADATA_KEY] !== true) {
+        void logBodyCapture({
+            timestamp: new Date().toISOString(),
+            requestId: ctx.requestId,
+            phase: "client_request",
+            model: codexCaptureModel(ctx),
+            stream: true,
+            headers: ctx.headers,
+            body: ctx.body,
+            contentType: "application/json",
+            ...resolveProxyLogTraceContext({ requestId: ctx.requestId }),
+        });
+    }
+    const response = await executeCodexResponsesRequest(ctx);
+    return ctx.metadata?.[CODEX_FALLBACK_METADATA_KEY] === true
+        ? response
+        : captureCodexResponse(ctx, response, "client_response");
+}
+function codexCaptureModel(ctx) {
+    const body = ctx.body;
+    return typeof body?.model === "string" ? body.model : "-";
+}
+/** Observe bytes through the existing bounded pass-through; cancellation still reaches upstream. */
+function captureCodexResponse(ctx, response, phase, account, attempt) {
+    if (!isProxyBodyCaptureEnabled()) {
+        return response;
+    }
+    const metadata = {
+        timestamp: new Date().toISOString(),
+        requestId: ctx.requestId,
+        phase,
+        model: codexCaptureModel(ctx),
+        stream: true,
+        headers: Object.fromEntries(response.headers.entries()),
+        contentType: response.headers.get("content-type") ?? undefined,
+        responseStatus: response.status,
+        account: account?.label,
+        accountType: account ? CODEX_ACCOUNT_TYPE : undefined,
+        attempt,
+        ...resolveProxyLogTraceContext({ requestId: ctx.requestId }),
+    };
+    if (!response.body || isBorrowedRequest()) {
+        void logBodyCapture(metadata);
+        return response;
+    }
+    const observed = createRawStreamCapture();
+    void observed.capture
+        .then((capture) => logBodyCapture({
+        ...metadata,
+        timestamp: new Date().toISOString(),
+        body: capture.text,
+        bodySize: capture.totalBytes,
+        sourceTruncated: capture.truncated,
+    }))
+        .catch(() => undefined);
+    return new Response(response.body.pipeThrough(observed.stream), {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+    });
+}
+async function executeCodexResponsesRequest(ctx) {
     const requestStartTime = Date.now();
     const body = ctx.body ?? {};
     const bodyStr = JSON.stringify(body);
@@ -475,9 +540,24 @@ export async function handleCodexResponsesRequest(ctx) {
                 recordAttempt(account.label, CODEX_ACCOUNT_TYPE);
                 let upstream;
                 try {
+                    const upstreamHeaders = buildCodexUpstreamHeaders(ctx.headers, account);
+                    void logBodyCapture({
+                        timestamp: new Date().toISOString(),
+                        requestId: ctx.requestId,
+                        phase: "upstream_request",
+                        model,
+                        stream: true,
+                        body: bodyStr,
+                        headers: upstreamHeaders,
+                        contentType: "application/json",
+                        account: account.label,
+                        accountType: CODEX_ACCOUNT_TYPE,
+                        attempt,
+                        ...tracer?.getTraceContext(),
+                    });
                     upstream = await fetch(CODEX_RESPONSES_URL, {
                         method: "POST",
-                        headers: buildCodexUpstreamHeaders(ctx.headers, account),
+                        headers: upstreamHeaders,
                         body: bodyStr,
                         signal: ctx.abortSignal
                             ? AbortSignal.any([
@@ -541,6 +621,7 @@ export async function handleCodexResponsesRequest(ctx) {
                     lastErrorStatus = 502;
                     break; // rotate to next account
                 }
+                upstream = captureCodexResponse(ctx, upstream, "upstream_response", account, attempt);
                 if (upstream.ok) {
                     const quota = parseCodexRateLimitHeaders(upstream.headers);
                     if (quota) {

package/dist/types/proxy.d.ts

@@ -561,6 +561,8 @@ export type RequestLogEntry = {
     firstUsefulOutputStatus?: "observed" | "no_useful_output" | "not_observed";
     /** Native protocol event that established the first useful output. */
     firstUsefulOutputEvent?: string;
+    /** Why first-output timing could not be established for this response. */
+    firstUsefulOutputUnavailableReason?: string;
     /** Requested reasoning effort retained independently of body capture. */
     reasoningEffort?: string;
     /** Small routing evidence retained even when response bodies are pruned. */
@@ -645,6 +647,8 @@ export type ProcessedProxyBodyCapture = {
 export type ProxyBodyCaptureAdmission = {
     limitingResource: "entry" | "captures" | "bytes" | "worker";
     estimatedBytes?: number;
+    /** Per-entry clone ceiling, independent of the aggregate queue ceiling. */
+    maxEntryBytes?: number;
     pending: number;
     pendingBytes: number;
     maxPending: number;
@@ -739,6 +743,7 @@ export type ProxyTelemetryCheck = {
 };
 /** Small stored metadata used by the doctor; bodies are queried separately. */
 export type ProxyTelemetryStoredRecord = Partial<RequestLogEntry> & {
+    recordedAtMicroseconds?: number;
     captureId?: string;
     bodySha256?: string;
     redactedBodyBytes?: number;
@@ -837,6 +842,8 @@ export type CodexTokenRefresher = (refreshToken: string) => Promise<{
 }>;
 export type ProxyBodyCaptureInput = {
     phase: string;
+    /** The stream observer retained only a bounded prefix. */
+    sourceTruncated?: boolean;
     headers?: Record<string, string>;
     body?: unknown;
     bodySize?: number;
@@ -2165,6 +2172,8 @@ export type ProxyBodyCaptureEntry = {
     headers?: Record<string, string>;
     body?: unknown;
     bodySize?: number;
+    /** The bounded stream observer omitted a suffix before redaction/processing. */
+    sourceTruncated?: boolean;
     contentType?: string;
     responseStatus?: number;
     durationMs?: number;
@@ -2335,6 +2344,8 @@ export type SSEContentBlock = {
 export type SSETelemetry = {
     messageStopReceived: boolean;
     firstUsefulOutputAt?: number;
+    firstUsefulOutputEvent?: string;
+    observationIncomplete?: boolean;
     messageId: string;
     model: string;
     usage: {
@@ -2358,6 +2369,7 @@ export type SSETelemetry = {
     /** Error carried as a terminal SSE `event: error`, if one was observed. */
     streamErrorMessage?: string;
     rawText?: string;
+    rawTextTruncated?: boolean;
 };
 /** Terminal outcome of a response body after the HTTP headers were sent. */
 export type StreamTerminalOutcome = {
@@ -2379,6 +2391,8 @@ export type StreamTerminalOutcomeTracker = {
 export type TelemetryAccumulator = {
     messageStopReceived: boolean;
     firstUsefulOutputAt?: number;
+    firstUsefulOutputEvent?: string;
+    observationIncomplete?: boolean;
     messageId: string;
     model: string;
     inputTokens: number;

package/dist/types/proxyRestart.d.ts

@@ -44,6 +44,31 @@ export type ProxyRestartControlOptions = {
     getInstalledVersion: () => Promise<string | undefined>;
     isUpdatePending: () => boolean;
     getStatus: () => Promise<unknown>;
+    /** Current supervisor process evidence; never infer it from a worker/plist. */
+    getTelemetry?: () => ProxyProcessTelemetrySnapshot;
     /** Report control-server errors without stopping the serving listener. */
     log?: (message: string) => void;
 };
+/** Small read-only process evidence, excluding environment variables and log content. */
+export type ProxyProcessTelemetrySnapshot = {
+    pid: number;
+    checkedAt: string;
+    configuredSink: "otel" | "file";
+    lifecycleSink: string;
+    otelInitialized: boolean;
+    stdio: {
+        stdout: "file" | "non_file" | "unavailable";
+        stderr: "file" | "non_file" | "unavailable";
+    };
+    exportDropped: number;
+    exportUnconfirmed: number;
+};
+export type ProxySupervisorTelemetry = {
+    status: "available";
+    process: ProxyProcessTelemetrySnapshot;
+} | {
+    status: "unavailable";
+    reason: string;
+} | {
+    status: "not_applicable";
+};

package/dist/utils/logSanitize.js

@@ -47,7 +47,7 @@ const SECRET_PATTERN = new RegExp(
     // Bare tokens by known prefix (e.g. `sk-abc…`, `r8_xyz…`)
     `|\\b(?:${PREFIX_PATTERN})[_\\-][A-Za-z0-9_\\-\\.]{8,}\\b` +
     // Generic key=value pairs (URL params, JSON bodies, header dumps)
-    "|\\b(?:api[_-]?key|access[_-]?token|secret[_-]?key|refresh[_-]?token)\\s*[:=]\\s*['\"]?[^\\s,;'\"&]+", "gi");
+    "|\\b(?:api[_-]?key|access[_-]?token|secret[_-]?key|refresh[_-]?token)['\"]?\\s*[:=]\\s*['\"]?[^\\s,;'\"&]+", "gi");
 /** Header names that should always be redacted regardless of value shape. */
 const SENSITIVE_HEADER_NAMES = [
     "authorization",