@nxtedition/nxt-undici 7.4.1 → 7.4.2

package/lib/index.d.ts

@@ -55,17 +55,25 @@ export interface LoggerLike {
   info(obj: unknown, msg?: string): void
 }
 
+export type BodyFactoryResult =
+  | Readable
+  | Uint8Array
+  | string
+  | Iterable<unknown>
+  | AsyncIterable<unknown>
+
+/** Called with an options object (not a bare signal); the signal aborts when the
+ *  request is destroyed before the factory resolves. May be async. */
+export type BodyFactory = (opts: {
+  signal: AbortSignal
+}) => BodyFactoryResult | Promise<BodyFactoryResult>
+
 export interface DispatchOptions {
   id?: string | null
   origin?: string | null
   path?: string | null
   method?: string | null
-  body?:
-    | Readable
-    | Uint8Array
-    | string
-    | ((signal: AbortSignal) => Readable | Uint8Array | string | Iterable<unknown>)
-    | null
+  body?: Readable | Uint8Array | string | BodyFactory | null
   query?: Record<string, unknown> | null
   headers?: Record<string, string | string[] | null | undefined> | null
   signal?: AbortSignal | null
@@ -80,8 +88,13 @@ export interface DispatchOptions {
   retry?: RetryOptions | number | boolean | RetryFn | null
   proxy?: ProxyOptions | boolean | null
   cache?: CacheOptions | boolean | null
-  upgrade?: boolean | null
+  /** Protocol to upgrade to (e.g. 'websocket'). undici requires a string and the
+   *  dispatch handler must implement onUpgrade — only meaningful with raw
+   *  dispatch()/compose(); request() has no upgrade support (see RequestOptions). */
+  upgrade?: string | null
   follow?: number | FollowFn | boolean | null
+  /** Alias for `follow`; ignored when `follow` is also set. */
+  redirect?: number | FollowFn | boolean | null
   error?: boolean | null
   verify?: VerifyOptions | boolean | null
   logger?: LoggerLike | null
@@ -121,6 +134,8 @@ export interface ProxyOptions {
 export interface CacheOptions {
   store?: CacheStore
   maxEntrySize?: number
+  /** Upper bound on an entry's freshness lifetime, in seconds (default 30 days). */
+  maxEntryTTL?: number
 }
 
 export interface VerifyOptions {
@@ -130,7 +145,16 @@ export interface VerifyOptions {
 
 export interface DnsOptions {
   ttl?: number
+  /** How long (ms) a failed lookup is negative-cached; requests inside this
+   *  window fail fast without hitting the resolver again (default 1000). */
+  negativeTTL?: number
   balance?: 'hash'
+  /** Custom resolver, `dns.lookup`-compatible (called with `{ all: true }`). */
+  lookup?: (
+    hostname: string,
+    options: { all: boolean },
+    callback: (err: Error | null, addresses: { address: string; family: number }[]) => void,
+  ) => void
 }
 
 export interface LogInterceptorOptions {
@@ -247,10 +271,14 @@ export interface CacheStore {
   close(): void
 }
 
-export interface RequestOptions extends DispatchOptions {
+/** `upgrade` is omitted: request()'s internal handler has no onUpgrade, so any
+ *  upgrade attempt rejects with InvalidArgumentError — use dispatch() instead. */
+export interface RequestOptions extends Omit<DispatchOptions, 'upgrade'> {
   url?: URLLike | null
   dispatch?: DispatchFn | null
   dispatcher?: Dispatcher | null
+  /** highWaterMark for the response body readable (non-negative number). */
+  highWaterMark?: number | null
 }
 
 export interface ResponseData {

package/lib/index.js

@@ -29,6 +29,7 @@ export const cache = {
 }
 
 export { parseHeaders } from './utils.js'
+export { SqliteCacheStore } from './sqlite-cache-store.js'
 export { Client, Pool, Agent, getGlobalDispatcher, setGlobalDispatcher } from '@nxtedition/undici'
 
 function defaultLookup(origin, opts, callback) {

package/lib/interceptor/cache.js

@@ -121,7 +121,10 @@ class CacheHandler extends DecoratorHandler {
       return super.onHeaders(statusCode, headers, resume)
     }
 
-    const vary = {}
+    // Null prototype: selector names come from the response Vary header and
+    // request header names are caller-controlled — on a plain `{}` a
+    // `__proto__` key would hit the prototype setter and be silently dropped.
+    const vary = Object.create(null)
     if (headers.vary) {
       if (typeof headers.vary !== 'string') {
         return super.onHeaders(statusCode, headers, resume)
@@ -141,9 +144,15 @@ class CacheHandler extends DecoratorHandler {
       }
     }
 
-    const ttl = cacheControlDirectives.immutable
-      ? 31556952
-      : Number(cacheControlDirectives['s-maxage'] ?? cacheControlDirectives['max-age'])
+    // RFC 8246: 'immutable' means the body won't change during the freshness
+    // lifetime — it does not define or extend that lifetime. An explicit
+    // s-maxage/max-age always wins; immutable only supplies a (long) default
+    // when no explicit lifetime is present. Capped by maxEntryTTL below.
+    const ttl = Number(
+      cacheControlDirectives['s-maxage'] ??
+        cacheControlDirectives['max-age'] ??
+        (cacheControlDirectives.immutable ? 31556952 : NaN),
+    )
     if (!ttl || !Number.isFinite(ttl) || ttl <= 0) {
       return super.onHeaders(statusCode, headers, resume)
     }
@@ -167,6 +176,23 @@ class CacheHandler extends DecoratorHandler {
 
     if (end == null || end - start <= this.#maxEntrySize) {
       const cachedAt = Date.now()
+      // Snapshot the headers: the same object is delivered downstream to the
+      // caller (request() resolves with it before the body finishes), and the
+      // entry isn't serialized to the store until onComplete. Without a copy,
+      // any mutation the caller makes to res.headers while the body streams
+      // would be persisted into the shared cache and replayed to every later
+      // request. parseHeaders values are strings or string arrays, so a
+      // one-level copy with array values sliced is a full snapshot. Use
+      // Object.keys so only own enumerable header fields are copied — never
+      // inherited properties from the prototype chain. Null prototype: on a
+      // plain `{}` a header literally named `__proto__` would hit the
+      // Object.prototype setter instead of becoming a data property (silent
+      // drop / prototype-pollution vector).
+      const storedHeaders = Object.create(null)
+      for (const name of Object.keys(headers)) {
+        const val = headers[name]
+        storedHeaders[name] = Array.isArray(val) ? val.slice() : val
+      }
       this.#value = {
         body: [],
         start,
@@ -174,7 +200,7 @@ class CacheHandler extends DecoratorHandler {
         deleteAt: cachedAt + lifetime * 1e3,
         statusCode,
         statusMessage: '',
-        headers,
+        headers: storedHeaders,
         cacheControlDirectives,
         etag: isEtagUsable(headers.etag) ? headers.etag : '',
         vary,
@@ -229,7 +255,45 @@ export default () => (dispatch) => (opts, handler) => {
     return dispatch(opts, handler)
   }
 
-  const rawCacheControl = opts?.headers?.['cache-control']
+  // TODO (fix): enable range requests
+
+  // Build the key the same way for lookups and stores: makeCacheKey
+  // stringifies the origin (e.g. URL objects), so using raw opts on the get
+  // path while the set path normalizes would make the cache permanently miss.
+  const key = undici.util.cache.makeCacheKey(opts)
+
+  // makeCacheKey preserves request header names verbatim. Vary selector names
+  // are lowercased (in onHeaders and matchesValue), so lowercase the key's
+  // header names once here — the same key feeds both the get and set paths, so
+  // this keeps Vary matching symmetric even when a caller supplies non-lowercase
+  // header names (the standalone interceptors.cache() composition; the wrapped
+  // pipeline already normalizes). A fresh object avoids mutating opts.headers.
+  // Header names are caller-controlled, so build a null-prototype map (a
+  // `__proto__` key on a plain object would silently overwrite the prototype
+  // instead of setting a property) and copy own keys only.
+  if (key.headers && typeof key.headers === 'object') {
+    const lower = Object.create(null)
+    for (const name of Object.keys(key.headers)) {
+      lower[name.toLowerCase()] = key.headers[name]
+    }
+    key.headers = lower
+  }
+
+  // All request-directive and conditional-header guards below MUST read from
+  // the lowercased key.headers, not raw opts.headers — otherwise a caller
+  // supplying capitalized names (e.g. `Authorization`, `Cache-Control` via the
+  // standalone composition) would silently skip the guards while the store
+  // side (CacheHandler) reads the lowercased form, e.g. serving a non-public
+  // cached response to an authorized request (RFC 9111 §3.5).
+  const headers = key.headers ?? {}
+
+  // Cache-Control is a list-typed field: duplicated field lines arrive as an
+  // array and combine into a single comma-separated value per RFC 9110 §5.2,
+  // keeping the raw-string directive checks below working.
+  let rawCacheControl = headers['cache-control']
+  if (Array.isArray(rawCacheControl)) {
+    rawCacheControl = rawCacheControl.join(', ')
+  }
   const cacheControlDirectives = parseCacheControl(rawCacheControl) ?? {}
   // cache-control-parser does not recognise 'only-if-cached', so check the raw string.
   const onlyIfCached =
@@ -237,7 +301,7 @@ export default () => (dispatch) => (opts, handler) => {
 
   // RFC 9111 Section 5.4: Pragma: no-cache should be treated as
   // Cache-Control: no-cache when Cache-Control is absent.
-  if (rawCacheControl == null && opts?.headers?.pragma === 'no-cache') {
+  if (rawCacheControl == null && headers.pragma === 'no-cache') {
     cacheControlDirectives['no-cache'] = true
   }
 
@@ -262,27 +326,6 @@ export default () => (dispatch) => (opts, handler) => {
   const store =
     opts.cache.store ?? (DEFAULT_STORE ??= new SqliteCacheStore({ location: ':memory:' }))
 
-  // TODO (fix): enable range requests
-
-  // Build the key the same way for lookups and stores: makeCacheKey
-  // stringifies the origin (e.g. URL objects), so using raw opts on the get
-  // path while the set path normalizes would make the cache permanently miss.
-  const key = undici.util.cache.makeCacheKey(opts)
-
-  // makeCacheKey preserves request header names verbatim. Vary selector names
-  // are lowercased (in onHeaders and matchesValue), so lowercase the key's
-  // header names once here — the same key feeds both the get and set paths, so
-  // this keeps Vary matching symmetric even when a caller supplies non-lowercase
-  // header names (the standalone interceptors.cache() composition; the wrapped
-  // pipeline already normalizes). A fresh object avoids mutating opts.headers.
-  if (key.headers && typeof key.headers === 'object') {
-    const lower = {}
-    for (const name in key.headers) {
-      lower[name.toLowerCase()] = key.headers[name]
-    }
-    key.headers = lower
-  }
-
   let entry
   try {
     entry = store.get(key)
@@ -297,18 +340,18 @@ export default () => (dispatch) => (opts, handler) => {
 
   // RFC 9111 Section 3.5: A shared cache must not use a cached response to a
   // request with Authorization unless the response includes a public directive.
-  if (entry && opts.headers?.authorization && !entry.cacheControlDirectives?.public) {
+  if (entry && headers.authorization && !entry.cacheControlDirectives?.public) {
     entry = undefined
   }
 
   // RFC 9110 Section 13: Evaluate conditional request headers against cached entry.
   // typeof guards: duplicated conditional headers arrive as arrays — treat
   // them as non-matching and bypass to origin rather than crashing.
-  if (entry && opts.headers?.['if-none-match']) {
+  if (entry && headers['if-none-match']) {
     if (
-      typeof opts.headers['if-none-match'] === 'string' &&
+      typeof headers['if-none-match'] === 'string' &&
       entry.etag &&
-      weakMatch(opts.headers['if-none-match'], entry.etag)
+      weakMatch(headers['if-none-match'], entry.etag)
     ) {
       return serveFromCache(
         { statusCode: 304, headers: entry.headers, cachedAt: entry.cachedAt },
@@ -318,12 +361,12 @@ export default () => (dispatch) => (opts, handler) => {
     }
     // Etag didn't match — bypass to origin.
     entry = undefined
-  } else if (entry && opts.headers?.['if-modified-since']) {
+  } else if (entry && headers['if-modified-since']) {
     const lastModified = entry.headers?.['last-modified']
     if (
-      typeof opts.headers['if-modified-since'] === 'string' &&
+      typeof headers['if-modified-since'] === 'string' &&
       lastModified &&
-      new Date(lastModified) <= new Date(opts.headers['if-modified-since'])
+      new Date(lastModified) <= new Date(headers['if-modified-since'])
     ) {
       return serveFromCache(
         { statusCode: 304, headers: entry.headers, cachedAt: entry.cachedAt },
@@ -335,11 +378,7 @@ export default () => (dispatch) => (opts, handler) => {
     entry = undefined
   }
 
-  if (
-    opts.headers?.['if-match'] ||
-    opts.headers?.['if-unmodified-since'] ||
-    opts.headers?.['if-range']
-  ) {
+  if (headers['if-match'] || headers['if-unmodified-since'] || headers['if-range']) {
     // TODO (fix): evaluate these conditional headers against cached entry.
     return dispatch(opts, handler)
   }

package/lib/interceptor/dns.js

@@ -44,6 +44,27 @@ class Handler extends DecoratorHandler {
 
 const SWEEP_INTERVAL = 30e3
 
+// A cached (or in-flight-shared) lookup error must never be handed to more
+// than one caller as-is: downstream decorateError call sites (response-retry,
+// response-error) mutate the error they receive (err.req, err.res,
+// err.statusCode), so a shared object would leak one request's decoration
+// into another's. Give each caller a fresh Error carrying the identifying
+// dns fields, with the original attached as `cause`.
+function makeLookupError(err) {
+  const wrapped = new Error(err.message, { cause: err })
+  wrapped.code = err.code
+  if (err.errno !== undefined) {
+    wrapped.errno = err.errno
+  }
+  if (err.syscall !== undefined) {
+    wrapped.syscall = err.syscall
+  }
+  if (err.hostname !== undefined) {
+    wrapped.hostname = err.hostname
+  }
+  return wrapped
+}
+
 // Error codes that mean the IP itself is unreachable/bad, so the selected
 // record should be invalidated immediately (expires = 0), forcing a re-resolve.
 // Anything else surfaced on the response path — a headers/body timeout, a
@@ -67,12 +88,16 @@ const CONNECTION_ERROR_CODES = new Set([
 
 export default () => (dispatch) => {
   const cache = new Map()
+  const negatives = new Map()
   const promises = new Map()
 
   // The `cache` Map is otherwise only ever written, never trimmed, so a process
   // touching many distinct hostnames over its lifetime would leak entries that
   // can never be selected again. Sweep dead entries (all records expired and
   // none in flight) at most once per SWEEP_INTERVAL to bound the O(n) cost.
+  // Negative entries are swept on the same cadence (they are also deleted
+  // eagerly on the next successful lookup / overwritten on the next failure,
+  // so the sweep only matters for hostnames that are never touched again).
   let lastSweep = 0
   function sweep(now) {
     if (now - lastSweep < SWEEP_INTERVAL) {
@@ -84,18 +109,33 @@ export default () => (dispatch) => {
         cache.delete(hostname)
       }
     }
+    for (const [hostname, negative] of negatives) {
+      if (negative.expires < now) {
+        negatives.delete(hostname)
+      }
+    }
   }
 
-  function resolve(hostname, { ttl }) {
+  function resolve(hostname, { ttl, negativeTTL, lookup }) {
     let promise = promises.get(hostname)
     if (!promise) {
       promise = new Promise((resolve) => {
-        dns.lookup(hostname, { all: true }, (err, records) => {
+        lookup(hostname, { all: true }, (err, records) => {
           promises.delete(hostname)
 
           if (err) {
+            // Negative cache: remember the failure for a short while so a hot
+            // caller of an unresolvable host fails fast instead of issuing a
+            // lookup storm (response-retry retries ENOTFOUND/EAI_AGAIN up to
+            // `retry` (default 8) times, so without this every logical
+            // request produced ~9 lookups). EAI_AGAIN is transient by
+            // definition, but the same small TTL applies — the window only
+            // needs to absorb a retry burst, and a short TTL keeps recovery
+            // fast either way.
+            negatives.set(hostname, { err, expires: getFastNow() + negativeTTL })
             resolve([err, null])
           } else {
+            negatives.delete(hostname)
             const now = getFastNow()
             const val = records.map(({ address }) => {
               return {
@@ -125,6 +165,8 @@ export default () => (dispatch) => {
       }
 
       const ttl = opts.dns.ttl ?? 2e3
+      const negativeTTL = opts.dns.negativeTTL ?? 1e3
+      const lookup = opts.dns.lookup ?? dns.lookup
       const url = new URL(opts.path ?? '', opts.origin)
       const balance = opts.dns.balance
 
@@ -141,9 +183,19 @@ export default () => (dispatch) => {
       let records = cache.get(hostname)
 
       if (records == null || records.every((x) => x.expires < now)) {
-        const [err, val] = await resolve(hostname, { ttl })
+        // A fresh negative entry means a lookup for this hostname failed less
+        // than negativeTTL ago — fail fast instead of hitting the resolver
+        // again. Fresh positive records (checked above) take precedence, so a
+        // failed pre-emptive refresh never fails requests that can still be
+        // served from cache.
+        const negative = negatives.get(hostname)
+        if (negative != null && negative.expires >= now) {
+          throw makeLookupError(negative.err)
+        }
+
+        const [err, val] = await resolve(hostname, { ttl, negativeTTL, lookup })
         if (err) {
-          throw err
+          throw makeLookupError(err)
         }
         records = val
       }
@@ -190,7 +242,7 @@ export default () => (dispatch) => {
       // refreshed records land in cache for the next request, smoothing
       // out DNS lookup latency. `resolve()` dedupes via `promises`.
       if (records.some((x) => x.expires < now + ttl / 2)) {
-        resolve(hostname, { ttl })
+        resolve(hostname, { ttl, negativeTTL, lookup })
       }
 
       url.hostname = net.isIPv6(record.address) ? `[${record.address}]` : record.address
@@ -224,8 +276,23 @@ export default () => (dispatch) => {
       }
 
       try {
+        // origin is rewritten to the resolved IP, so pin the host header to
+        // the logical hostname — but never clobber an explicit user-supplied
+        // host (virtual hosting). Lowercase lookup matches the pipeline
+        // invariant (parseHeaders) and priority.js, which reads the same key.
+        // Host is a singular header, so only a single non-empty string value
+        // is preserved (same rule as priority.js) — an array (duplicate Host
+        // field-lines) or an empty string falls back to the origin-derived
+        // host.
         return dispatch(
-          { ...opts, origin: url.origin, headers: { ...opts.headers, host } },
+          {
+            ...opts,
+            origin: url.origin,
+            headers: {
+              ...opts.headers,
+              host: (typeof opts.headers?.host === 'string' && opts.headers.host) || host,
+            },
+          },
           new Handler(handler, onSettle),
         )
       } catch (err) {

package/lib/interceptor/log.js

@@ -1,10 +1,144 @@
-import { DecoratorHandler } from '../utils.js'
+import { DecoratorHandler, parseHeaders } from '../utils.js'
 
 const kGlobalIndex = Symbol.for('@nxtedition/nxt-undici#globalIndex')
 const kGlobalArray = Symbol.for('@nxtedition/nxt-undici#globalArray')
 
+const REDACTED = '[redacted]'
+
+// Header names (lowercase) whose values must never reach the logs.
+const SECRET_HEADERS = new Set(['authorization', 'proxy-authorization', 'cookie', 'set-cookie'])
+
+// Allocation-free pre-scan: true when `headers` is a plain object that the
+// parse + redact path would reproduce verbatim — every key already lowercase,
+// every value a string (or array of strings), no secret header present. In
+// that case the original object can be logged as-is: log bindings only read
+// it (pino serializes child bindings eagerly), nothing in the pipeline
+// mutates a caller's headers object in place. Uses a `for..in` + `Object.hasOwn`
+// guard rather than `Object.keys` so the scan itself allocates nothing while
+// still ignoring inherited props exactly as `Object.keys` would.
+function isCleanHeaderObject(headers) {
+  for (const key in headers) {
+    if (!Object.hasOwn(headers, key)) {
+      continue
+    }
+    if (SECRET_HEADERS.has(key) || key.toLowerCase() !== key) {
+      return false
+    }
+    const val = headers[key]
+    if (Array.isArray(val)) {
+      for (const item of val) {
+        if (typeof item !== 'string') {
+          return false
+        }
+      }
+    } else if (typeof val !== 'string') {
+      return false
+    }
+  }
+  return true
+}
+
+// Return a loggable view of `headers` with credential values replaced by a
+// redaction marker. Copy-on-write: the common case (already-lowercased plain
+// object, string values, nothing to redact) returns the original object as-is,
+// allocating no new headers object (the pre-scan itself is allocation-free
+// too). Only when something actually needs work — flat-array
+// form ([name, value, name, value, ...] with Buffer or string entries from
+// onHeaders/onUpgrade), a secret header, a non-lowercase name, or a
+// non-string value — do we build a sanitized copy via parseHeaders, which
+// lowercases names, stringifies values (Buffers included, so no
+// `{type:'Buffer',data:[...]}` blobs in bindings), skips null/undefined, and
+// merges duplicate names into arrays instead of overwriting earlier values.
+function sanitizeHeaders(headers) {
+  if (headers == null || typeof headers !== 'object') {
+    return undefined
+  }
+
+  if (!Array.isArray(headers) && isCleanHeaderObject(headers)) {
+    return headers
+  }
+
+  const sanitized = parseHeaders(headers)
+
+  for (const name of SECRET_HEADERS) {
+    if (name in sanitized) {
+      sanitized[name] = REDACTED
+    }
+  }
+
+  return sanitized
+}
+
+// Normalize the request origin for logging without leaking userinfo
+// credentials embedded as `http://user:pass@host`. Copy-on-write: userinfo
+// requires an '@', so a string without one is returned as-is — no URL
+// allocation. Real `URL` instances already expose a credential-free
+// `origin`; arbitrary URL-like objects do NOT get that fast path, since a
+// plain `{ origin: 'http://user:pass@host' }` would bypass the userinfo
+// check. Everything else is stringified, and only strings that could carry
+// userinfo are parsed and reduced to URL#origin (which never contains
+// userinfo); if such a string is not a parseable URL, prefer losing the
+// value over risking embedded credentials.
+function sanitizeOrigin(origin) {
+  if (origin == null) {
+    return undefined
+  }
+  if (origin instanceof URL) {
+    return origin.origin
+  }
+  const str = typeof origin === 'string' ? origin : String(origin)
+  if (!str.includes('@')) {
+    return str
+  }
+  try {
+    return new URL(str).origin
+  } catch {
+    return REDACTED
+  }
+}
+
+// Summarize the request body (type + size) instead of embedding its content.
+// Bodies may contain credentials or be arbitrarily large, and pino serializes
+// child bindings eagerly — never put the payload itself into the log record.
+function describeBody(body) {
+  if (body == null) {
+    return undefined
+  }
+  if (typeof body === 'string') {
+    return `string(${Buffer.byteLength(body)} bytes)`
+  }
+  if (Buffer.isBuffer(body)) {
+    return `Buffer(${body.byteLength} bytes)`
+  }
+  if (ArrayBuffer.isView(body)) {
+    return `${body.constructor?.name ?? 'TypedArray'}(${body.byteLength} bytes)`
+  }
+  if (typeof body === 'object' && typeof body.byteLength === 'number') {
+    return `${body.constructor?.name ?? 'ArrayBuffer'}(${body.byteLength} bytes)`
+  }
+  if (typeof body === 'function') {
+    return 'function'
+  }
+  return body.constructor?.name ?? typeof body
+}
+
+// Small, sanitized summary of the request opts used for all `ureq` log
+// bindings. Built once per request instead of binding the live opts object,
+// which both leaked credentials/bodies into logs and paid eager pino
+// serialization of the full opts (including the entire body) per request.
+function sanitizeRequest(opts) {
+  return {
+    id: opts.id,
+    origin: sanitizeOrigin(opts.origin),
+    path: opts.path,
+    method: opts.method,
+    headers: sanitizeHeaders(opts.headers),
+    body: describeBody(opts.body),
+  }
+}
+
 class Handler extends DecoratorHandler {
-  #opts
+  #ureq
   #logger
 
   #abort
@@ -25,8 +159,8 @@ class Handler extends DecoratorHandler {
   constructor(logOpts, opts, { handler }) {
     super(handler)
 
-    this.#opts = opts
-    this.#logger = opts.logger.child({ ureq: opts })
+    this.#ureq = sanitizeRequest(opts)
+    this.#logger = opts.logger.child({ ureq: this.#ureq })
 
     if (logOpts?.bindings) {
       this.#logger = this.#logger.child(logOpts?.bindings)
@@ -59,7 +193,7 @@ class Handler extends DecoratorHandler {
 
     this.#logger.debug(
       {
-        ures: { statusCode, headers },
+        ures: { statusCode, headers: sanitizeHeaders(headers) },
         elapsedTime: this.#timing.headers,
       },
       'upstream request upgrade',
@@ -76,7 +210,9 @@ class Handler extends DecoratorHandler {
   onHeaders(statusCode, headers, resume) {
     this.#timing.headers = performance.now() - this.#created
     this.#statusCode = statusCode
-    this.#headers = headers
+    // Only used for log records; store the sanitized copy so set-cookie etc.
+    // never end up in retained (error-level) logs.
+    this.#headers = sanitizeHeaders(headers)
 
     return super.onHeaders(statusCode, headers, resume)
   }
@@ -95,7 +231,7 @@ class Handler extends DecoratorHandler {
     this.#timing.end = performance.now() - this.#created
 
     const data = {
-      ureq: this.#opts,
+      ureq: this.#ureq,
       ures: {
         statusCode: this.#statusCode,
         headers: this.#headers,
@@ -161,7 +297,46 @@ class Handler extends DecoratorHandler {
       this[kGlobalIndex] = -1
     }
   }
+
+  // Finalization for a request whose inner dispatch threw synchronously:
+  // undici never took ownership of the handler, so no terminal callback
+  // (onError/onComplete) will ever arrive. Log the failure and deregister
+  // from the in-flight registry. Deliberately does NOT forward onError —
+  // the dispatch entry below rethrows and an outer interceptor (lookup)
+  // delivers the error to the original handler chain, so forwarding here
+  // would double-deliver it.
+  onDispatchError(err) {
+    if (this[kGlobalIndex] === -1) {
+      // A terminal callback already ran before the error escaped dispatch
+      // (e.g. onError was delivered and the error was then rethrown):
+      // already logged and deregistered.
+      return
+    }
+
+    this.#timing.end = performance.now() - this.#created
+
+    this.#logger.error({ err, elapsedTime: this.#timing.end }, 'upstream request failed')
+
+    this.onDone()
+  }
 }
 
-export default (logOpts) => (dispatch) => (opts, handler) =>
-  opts.logger ? dispatch(opts, new Handler(logOpts, opts, { handler })) : dispatch(opts, handler)
+export default (logOpts) => (dispatch) => (opts, handler) => {
+  if (!opts.logger) {
+    return dispatch(opts, handler)
+  }
+
+  const logHandler = new Handler(logOpts, opts, { handler })
+
+  try {
+    return dispatch(opts, logHandler)
+  } catch (err) {
+    // An inner interceptor threw synchronously at dispatch time (e.g. proxy
+    // loop detection). The error escapes past the already-registered handler,
+    // which would otherwise stay in the global in-flight registry forever.
+    // Finalize it and rethrow so outer interceptors observe the same error
+    // as before.
+    logHandler.onDispatchError(err)
+    throw err
+  }
+}