@omnicross/core 0.1.1 → 0.1.2

package/dist/chunk-2FEVTJWG.js

@@ -0,0 +1,4400 @@
+import {
+  collectMatchText
+} from "./chunk-QOCNX236.js";
+import {
+  streamSSEResponse
+} from "./chunk-VVEHS2LI.js";
+import {
+  TransformerChainExecutor
+} from "./chunk-G2UTNSGU.js";
+import {
+  injectExtendedContextBeta
+} from "./chunk-MZNPGW5Q.js";
+import {
+  GeminiTransformer
+} from "./chunk-C7PSERMH.js";
+import {
+  OpenAIResponseTransformer
+} from "./chunk-5HTVET6E.js";
+import {
+  AnthropicTransformer
+} from "./chunk-FTQ7IQUC.js";
+import {
+  getGeminiCodeAssistResolver
+} from "./chunk-DRWHTIIZ.js";
+import {
+  executeProviderCall
+} from "./chunk-JO5NLTLY.js";
+import {
+  LlmConfigProviderAuth,
+  getProviderHeaders
+} from "./chunk-PXUJF5HS.js";
+import {
+  resolveProviderChain
+} from "./chunk-JWC6APFQ.js";
+import {
+  resolveSubscriptionChain
+} from "./chunk-5ERIZW3D.js";
+import {
+  SubscriptionAuthSource
+} from "./chunk-74TMJA7Z.js";
+import {
+  serializeError
+} from "./chunk-AVYJ4YBN.js";
+import {
+  buildProviderApiUrl,
+  resolveApiFormat,
+  resolveProviderEndpoint
+} from "./chunk-H5JUT3KV.js";
+import {
+  resolveRoute
+} from "./chunk-3MEACFK3.js";
+import {
+  convertAnthropicToOpenAI,
+  convertOpenAIToAnthropic
+} from "./chunk-5ZQBEOMD.js";
+import {
+  applyAugmentation
+} from "./chunk-745DV5FL.js";
+import {
+  OPENROUTER_APP_HEADERS,
+  isOpenRouterProvider
+} from "./chunk-E3WHL7CO.js";
+import {
+  NATIVE_SEARCH_TOOL_NAMES
+} from "./chunk-FMOBD2OQ.js";
+
+// src/completion/StreamEventBuffer.ts
+var TERMINAL_TYPES = /* @__PURE__ */ new Set(["done", "error", "abort"]);
+var QUEUE_CAP = 200;
+var entries = /* @__PURE__ */ new Map();
+function channelOf(streamId) {
+  return `completion:stream:${streamId}`;
+}
+function safeIsDestroyed(sender) {
+  try {
+    return sender.isDestroyed();
+  } catch {
+    return true;
+  }
+}
+function safeSend(sender, channel, payload) {
+  if (safeIsDestroyed(sender)) return false;
+  try {
+    sender.send(channel, payload);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function register(streamId, sender) {
+  entries.set(streamId, { sender, queue: [], attached: false, closed: false });
+}
+function emit(streamId, event) {
+  const entry = entries.get(streamId);
+  if (!entry) {
+    return;
+  }
+  if (safeIsDestroyed(entry.sender)) {
+    entries.delete(streamId);
+    return;
+  }
+  if (entry.attached) {
+    safeSend(entry.sender, channelOf(streamId), event);
+    return;
+  }
+  if (entry.queue.length >= QUEUE_CAP) {
+    const evictAt = entry.queue.findIndex((e) => !TERMINAL_TYPES.has(e.type));
+    if (evictAt >= 0) {
+      entry.queue.splice(evictAt, 1);
+    } else {
+      entry.queue.shift();
+    }
+  }
+  entry.queue.push(event);
+}
+function attach(streamId) {
+  const entry = entries.get(streamId);
+  if (!entry) return { ok: false, drained: 0 };
+  if (entry.attached) return { ok: true, drained: 0 };
+  const channel = channelOf(streamId);
+  let drained = 0;
+  for (const event of entry.queue) {
+    if (safeSend(entry.sender, channel, event)) {
+      drained++;
+    }
+  }
+  entry.queue = [];
+  entry.attached = true;
+  return { ok: true, drained };
+}
+function release(streamId) {
+  const entry = entries.get(streamId);
+  if (!entry) return;
+  if (entry.closed) return;
+  entry.closed = true;
+  if (entry.attached) {
+    entries.delete(streamId);
+    return;
+  }
+  setImmediate(() => {
+    entries.delete(streamId);
+  });
+}
+
+// src/completion/message-converter.ts
+var OPENROUTER_AUDIO_FORMAT_MAP = {
+  "audio/wav": "wav",
+  "audio/x-wav": "wav",
+  "audio/wave": "wav",
+  "audio/mpeg": "mp3",
+  "audio/mp3": "mp3",
+  "audio/aiff": "aiff",
+  "audio/x-aiff": "aiff",
+  "audio/aac": "aac",
+  "audio/ogg": "ogg",
+  "audio/flac": "flac",
+  "audio/x-flac": "flac",
+  "audio/mp4": "m4a",
+  "audio/m4a": "m4a",
+  "audio/x-m4a": "m4a",
+  "audio/L16": "pcm16",
+  "audio/L24": "pcm24"
+};
+var MAX_INLINE_VIDEO_BYTES = 25 * 1024 * 1024;
+function decodeDataUrl(url) {
+  const match = url.match(/^data:([^;]+);base64,(.+)$/);
+  if (!match) return null;
+  return { mimeType: match[1], data: match[2] };
+}
+function looksLikeRemoteUrl(url) {
+  return /^https?:\/\//i.test(url);
+}
+function resolveAudioFormat(mimeType, sourceUrl) {
+  const candidate = (mimeType || "").toLowerCase();
+  const mapped = OPENROUTER_AUDIO_FORMAT_MAP[candidate];
+  if (mapped) return mapped;
+  const decoded = decodeDataUrl(sourceUrl);
+  if (decoded) {
+    const mappedFromUrl = OPENROUTER_AUDIO_FORMAT_MAP[decoded.mimeType.toLowerCase()];
+    if (mappedFromUrl) return mappedFromUrl;
+  }
+  throw new Error(
+    `Unsupported audio format for OpenAI/OpenRouter chat input: ${mimeType || "unknown"}. Supported: wav, mp3, aiff, aac, ogg, flac, m4a, pcm16, pcm24.`
+  );
+}
+function convertMessageToOpenAI(msg) {
+  const role = msg.role;
+  const hasImages = msg.images && msg.images.length > 0;
+  const hasAudios = msg.audios && msg.audios.length > 0;
+  const hasVideos = msg.videos && msg.videos.length > 0;
+  if (!hasImages && !hasAudios && !hasVideos) {
+    return { role, content: msg.content };
+  }
+  const content = [];
+  if (msg.content) {
+    content.push({ type: "text", text: msg.content });
+  }
+  if (msg.images) {
+    for (const img of msg.images) {
+      content.push({
+        type: "image_url",
+        image_url: { url: img.url }
+      });
+    }
+  }
+  if (msg.audios) {
+    for (const audio of msg.audios) {
+      const decoded = decodeDataUrl(audio.url);
+      if (decoded) {
+        const format = resolveAudioFormat(decoded.mimeType, audio.url);
+        content.push({ type: "input_audio", input_audio: { data: decoded.data, format } });
+      } else if (audio.mimeType) {
+        content.push({ type: "audio_url", audio_url: { url: audio.url, format: audio.mimeType } });
+      } else {
+        content.push({ type: "audio_url", audio_url: { url: audio.url } });
+      }
+    }
+  }
+  if (msg.videos) {
+    for (const video of msg.videos) {
+      if (looksLikeRemoteUrl(video.url)) {
+        content.push({ type: "video_url", video_url: { url: video.url } });
+        continue;
+      }
+      const decoded = decodeDataUrl(video.url);
+      if (decoded) {
+        const sizeBytes = Math.floor(decoded.data.length * 3 / 4);
+        if (sizeBytes > MAX_INLINE_VIDEO_BYTES) {
+          const sizeMb = (sizeBytes / 1024 / 1024).toFixed(1);
+          throw new Error(
+            `Video too large for inline upload: ${sizeMb} MB exceeds the 25 MB cap. Use a publicly accessible HTTPS URL instead.`
+          );
+        }
+        content.push({ type: "video_url", video_url: { url: video.url } });
+      } else {
+        content.push({ type: "video_url", video_url: { url: video.url } });
+      }
+    }
+  }
+  return { role, content };
+}
+function convertMessageToAnthropic(msg) {
+  const role = msg.role === "system" ? "user" : msg.role;
+  const hasImages = msg.images && msg.images.length > 0;
+  const hasAudios = msg.audios && msg.audios.length > 0;
+  if (!hasImages && !hasAudios) {
+    return { role, content: msg.content };
+  }
+  const content = [];
+  if (msg.content) {
+    content.push({ type: "text", text: msg.content });
+  }
+  if (msg.images) {
+    for (const img of msg.images) {
+      let base64Data = img.url;
+      let mediaType = img.mimeType || "image/jpeg";
+      if (img.url.startsWith("data:")) {
+        const match = img.url.match(/^data:([^;]+);base64,(.+)$/);
+        if (match) {
+          mediaType = match[1];
+          base64Data = match[2];
+        }
+      }
+      content.push({
+        type: "image",
+        source: { type: "base64", media_type: mediaType, data: base64Data }
+      });
+    }
+  }
+  if (msg.audios) {
+    for (const audio of msg.audios) {
+      let base64Data = audio.url;
+      let mediaType = audio.mimeType || "audio/wav";
+      if (audio.url.startsWith("data:")) {
+        const match = audio.url.match(/^data:([^;]+);base64,(.+)$/);
+        if (match) {
+          mediaType = match[1];
+          base64Data = match[2];
+        }
+      }
+      content.push({
+        type: "audio",
+        source: { type: "base64", media_type: mediaType, data: base64Data }
+      });
+    }
+  }
+  return { role, content };
+}
+function convertMessageToGemini(msg) {
+  const role = msg.role === "assistant" ? "model" : msg.role;
+  const parts = [];
+  if (msg.content) {
+    parts.push({ text: msg.content });
+  }
+  if (msg.images && msg.images.length > 0) {
+    for (const img of msg.images) {
+      let base64Data = img.url;
+      let mimeType = img.mimeType || "image/jpeg";
+      if (img.url.startsWith("data:")) {
+        const match = img.url.match(/^data:([^;]+);base64,(.+)$/);
+        if (match) {
+          mimeType = match[1];
+          base64Data = match[2];
+        }
+      }
+      parts.push({ inlineData: { mimeType, data: base64Data } });
+    }
+  }
+  if (msg.audios && msg.audios.length > 0) {
+    for (const audio of msg.audios) {
+      let base64Data = audio.url;
+      let mimeType = audio.mimeType || "audio/wav";
+      if (audio.url.startsWith("data:")) {
+        const match = audio.url.match(/^data:([^;]+);base64,(.+)$/);
+        if (match) {
+          mimeType = match[1];
+          base64Data = match[2];
+        }
+      }
+      parts.push({ inlineData: { mimeType, data: base64Data } });
+    }
+  }
+  return { role, parts };
+}
+
+// src/completion/openrouter-utils.ts
+function getOpenRouterProviderConfig(provider, modelId) {
+  if (!isOpenRouterProvider(provider)) {
+    return void 0;
+  }
+  const modelConfig = provider.modelConfigs?.find((m) => m.id === modelId);
+  return modelConfig?.openRouterProvider;
+}
+function addOpenRouterProviderToRequest(requestBody, provider, modelId) {
+  const providerRouting = getOpenRouterProviderConfig(provider, modelId);
+  if (!providerRouting) {
+    return requestBody;
+  }
+  const hasConfig = Object.values(providerRouting).some(
+    (v) => v !== void 0 && v !== null && (Array.isArray(v) ? v.length > 0 : true)
+  );
+  if (!hasConfig) {
+    return requestBody;
+  }
+  return {
+    ...requestBody,
+    provider: providerRouting
+  };
+}
+
+// src/completion/DirectApiHandler.ts
+import { getOpenAIReasoningEffort } from "@omnicross/contracts/thinking-config";
+
+// src/provider-proxy/ProviderProxy.ts
+import http from "http";
+
+// src/provider-proxy/providerProxyRouteMap.ts
+import { randomBytes } from "crypto";
+var DEFAULT_ROUTE_IDLE_MS = 10 * 60 * 1e3;
+var TOKEN_BYTES = 32;
+var ProviderProxyRouteMap = class {
+  constructor(defaultIdleMs = DEFAULT_ROUTE_IDLE_MS) {
+    this.defaultIdleMs = defaultIdleMs;
+  }
+  defaultIdleMs;
+  routes = /* @__PURE__ */ new Map();
+  /**
+   * Register a route for one run and return its crypto-random token. The
+   * caller (next batch) injects the token as the forwarded auth-header sentinel
+   * (`ANTHROPIC_AUTH_TOKEN` / `OPENAI_API_KEY`). Optionally override the idle
+   * timeout (tests use a short one).
+   */
+  addRoute(context, idleMs) {
+    const token = randomBytes(TOKEN_BYTES).toString("hex");
+    const entry = {
+      context,
+      idleTimer: null,
+      idleMs: idleMs ?? this.defaultIdleMs
+    };
+    this.routes.set(token, entry);
+    this.armIdleTimer(token, entry);
+    return token;
+  }
+  /**
+   * Look up a route by its token, touching the idle timer so an active run's
+   * context survives. Returns `undefined` on a miss / reaped entry — the caller
+   * rejects (no fallback).
+   */
+  lookup(token) {
+    if (!token) return void 0;
+    const entry = this.routes.get(token);
+    if (!entry) return void 0;
+    this.armIdleTimer(token, entry);
+    return entry.context;
+  }
+  /** Remove a route at run end. Returns true if an entry existed. */
+  removeRoute(token) {
+    const entry = this.routes.get(token);
+    if (!entry) return false;
+    this.clearIdleTimer(entry);
+    this.routes.delete(token);
+    return true;
+  }
+  /** Current live-route count (tests / diagnostics). */
+  size() {
+    return this.routes.size;
+  }
+  /** Whether a token currently resolves (does NOT touch the idle timer). */
+  has(token) {
+    return this.routes.has(token);
+  }
+  /** Tear down every route (proxy stop / app teardown). */
+  clear() {
+    for (const entry of this.routes.values()) {
+      this.clearIdleTimer(entry);
+    }
+    this.routes.clear();
+  }
+  // ---------------------------------------------------------------------------
+  // Idle reaping (modeled on AcpSessionManager.armIdleTimer / clearIdleTimer)
+  // ---------------------------------------------------------------------------
+  armIdleTimer(token, entry) {
+    this.clearIdleTimer(entry);
+    entry.idleTimer = setTimeout(() => {
+      this.routes.delete(token);
+    }, entry.idleMs);
+    entry.idleTimer.unref?.();
+  }
+  clearIdleTimer(entry) {
+    if (entry.idleTimer) {
+      clearTimeout(entry.idleTimer);
+      entry.idleTimer = null;
+    }
+  }
+};
+
+// src/provider-proxy/usage/recordAnthropicUsage.ts
+function readAnthropicUsage(usage) {
+  if (!usage) return null;
+  const inputTokens = Number(usage.input_tokens) || 0;
+  const outputTokens = Number(usage.output_tokens) || 0;
+  const cacheReadTokens = Number(usage.cache_read_input_tokens) || 0;
+  const cacheCreationTokens = Number(usage.cache_creation_input_tokens) || 0;
+  return {
+    inputTokens,
+    outputTokens,
+    cacheReadTokens,
+    cacheCreationTokens,
+    // The Anthropic wire carries no separate reasoning-token field; thinking
+    // tokens are folded into `output_tokens`.
+    reasoningTokens: 0
+  };
+}
+function recordAnthropicNonStreamUsage(recorder, bodyText, attribution) {
+  try {
+    const parsed = JSON.parse(bodyText);
+    const tapped = readAnthropicUsage(parsed.usage);
+    if (!tapped) return;
+    recorder.record({
+      messageId: null,
+      parentMessageId: null,
+      sessionId: attribution.sessionId,
+      providerId: attribution.providerId,
+      model: attribution.model,
+      apiKeyId: null,
+      engineOrigin: "codex-ingress",
+      usage: tapped,
+      rawUsage: parsed.usage
+    });
+  } catch {
+  }
+}
+
+// src/provider-proxy/ingress/providerProxyShared.ts
+var sharedExecutor = null;
+function getSharedExecutor() {
+  if (!sharedExecutor) {
+    sharedExecutor = new TransformerChainExecutor();
+  }
+  return sharedExecutor;
+}
+var sharedResponses = null;
+function getResponsesEndpointTransformer() {
+  if (!sharedResponses) sharedResponses = new OpenAIResponseTransformer();
+  return sharedResponses;
+}
+var sharedAnthropic = null;
+function getAnthropicEndpointTransformer() {
+  if (!sharedAnthropic) sharedAnthropic = new AnthropicTransformer();
+  return sharedAnthropic;
+}
+var sharedGemini = null;
+function getGeminiEndpointTransformer() {
+  if (!sharedGemini) sharedGemini = new GeminiTransformer();
+  return sharedGemini;
+}
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+    req.on("error", reject);
+  });
+}
+async function relayResponse(res, providerResponse, isStream) {
+  const contentType = providerResponse.headers.get("Content-Type") ?? "";
+  const status = providerResponse.status && providerResponse.status >= 100 ? providerResponse.status : 200;
+  if (isStream || contentType.includes("text/event-stream")) {
+    res.writeHead(status, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive"
+    });
+    if (!providerResponse.body) {
+      res.end();
+      return null;
+    }
+    const reader = providerResponse.body.getReader();
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        res.write(value);
+      }
+    } finally {
+      reader.releaseLock();
+      res.end();
+    }
+    return null;
+  }
+  const bodyText = await providerResponse.text();
+  res.writeHead(status, { "Content-Type": contentType.includes("json") ? contentType : "application/json" });
+  res.end(bodyText);
+  return bodyText;
+}
+function writeError(res, status, message) {
+  if (res.headersSent) return;
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ error: { type: "provider_proxy_error", message } }));
+}
+function resolveApiKey(apiKey) {
+  if (!apiKey) return "";
+  if (apiKey.startsWith("$")) {
+    return process.env[apiKey.slice(1)] || "";
+  }
+  return apiKey;
+}
+async function resolvePoolBoundKey(deps, providerId, provider, sessionId) {
+  if (deps.apiKeyPool && sessionId) {
+    const poolKey = await deps.apiKeyPool.getKeyForSession(providerId, sessionId);
+    if (poolKey) return poolKey;
+  }
+  return resolveApiKey(resolveProviderEndpoint(provider).apiKey);
+}
+
+// src/provider-proxy/ingress/anthropicSubscriptionPlan.ts
+async function buildSubscriptionPlan(res, route, deps, anthropicBody, routeModel, isStream) {
+  const profile = route.subscriptionProfile;
+  if (!profile) {
+    writeError(res, 502, "Subscription mode requires an Anthropic subscription profile");
+    return null;
+  }
+  let resolvedModel = routeModel;
+  let scenario;
+  if (profile.modelMapper) {
+    const summary = buildSubscriptionRequestSummary(anthropicBody);
+    const mapped = profile.modelMapper(routeModel, summary, route.subscriptionConfig);
+    resolvedModel = mapped.resolvedModel;
+    scenario = mapped.scenario;
+  }
+  const plan = buildSubscriptionIterationPlan(profile, route, deps, resolvedModel, isStream, scenario);
+  if (!plan) {
+    writeError(res, 502, "Subscription profile is missing resolveUpstreamUrl");
+    return null;
+  }
+  return plan;
+}
+function buildSubscriptionIterationPlan(profile, route, deps, resolvedModel, isStream, scenario) {
+  const upstreamUrl = profile.resolveUpstreamUrl?.(resolvedModel, route.subscriptionConfig);
+  if (!upstreamUrl) return null;
+  const auth = route.auth ?? new SubscriptionAuthSource(profile);
+  const sameFormat = profile.mode === "pass-through" || upstreamUrl.endsWith("/v1/messages");
+  const overrideNames = profile.resolveProviderTransformerNames?.(
+    resolvedModel,
+    route.subscriptionConfig
+  );
+  const chain = sameFormat ? { providerTransformers: [], modelTransformers: [] } : resolveSubscriptionChain(
+    profile,
+    deps.llmConfig.getTransformerService(),
+    getAnthropicEndpointTransformer(),
+    overrideNames
+  );
+  const transformerProvider = {
+    name: profile.authStrategy.providerId,
+    baseUrl: upstreamUrl,
+    apiKey: "",
+    models: [resolvedModel]
+  };
+  return {
+    auth,
+    chain,
+    transformerProvider,
+    resolvedModel,
+    isStream,
+    // EXCEPTION (the Responses chain) (Phase 3 task 3.3): the `openai-response`
+    // provider transformer emits an ABSOLUTE-path `config.url`
+    // (`new URL('/v1/responses', baseUrl)`) that DISCARDS any base PATH prefix — so
+    // for a path-prefixed base (zen `https://opencode.ai/zen/v1/responses` → drops
+    // `/zen/`; codex `https://chatgpt.com/backend-api/codex/responses` → drops
+    // `/backend-api/codex/`). On the core `/v1/messages` plan the endpoint
+    // transformer is `anthropic` and the codex/zen-responses chain is
+    // `['openai-response']` (endpoint != provider), so `transformRequestIn` RUNS
+    // and emits the lossy URL. The guard makes this safe REGARDLESS of whether it
+    // ran: `usesResponsesChain(['openai-response'])` captures BOTH codex and zen
+    // responses, so the profile's complete `upstreamUrl` always wins (codex → its
+    // backend-api/codex/responses; zen → its `/zen/...` endpoint). The gemini
+    // chain's `config.url` is RELATIVE (`./{model}:{action}`) and PRESERVES the
+    // base path, so it correctly wins. The bypass-by-name optimization only applies
+    // on the core OpenAI-Responses ingress (endpoint == `openai-response`), NOT
+    // here. `// UNVERIFIED (no live zen key)`.
+    resolveUrl: usesResponsesChain(overrideNames ?? profile.providerTransformerNames) ? () => upstreamUrl : (config) => config.url instanceof URL ? config.url.toString() : typeof config.url === "string" ? config.url : upstreamUrl,
+    upstreamUrl,
+    sameFormat,
+    isSubscription: true,
+    scenario
+  };
+}
+function usesResponsesChain(names) {
+  return !!names && names.includes("openai-response");
+}
+function buildSubscriptionRequestSummary(anthropicBody) {
+  const messages = Array.isArray(anthropicBody.messages) ? anthropicBody.messages : [];
+  let totalChars = collectText(anthropicBody.system);
+  for (const message of messages) {
+    if (message && typeof message === "object") {
+      totalChars += collectText(message.content);
+    }
+  }
+  return {
+    messageCount: messages.length,
+    estimatedInputTokens: Math.ceil(totalChars / 4),
+    // Single source of truth (shared with the dispatcher builder) so both
+    // ingress paths yield identical `matchText` for the same body.
+    matchText: collectMatchText(anthropicBody)
+  };
+}
+function collectText(value) {
+  if (typeof value === "string") return value.length;
+  if (Array.isArray(value)) {
+    let sum = 0;
+    for (const item of value) sum += collectText(item);
+    return sum;
+  }
+  if (value && typeof value === "object") {
+    const text = value.text;
+    if (typeof text === "string") return text.length;
+  }
+  return 0;
+}
+async function runPipeline(anthropicBody, plan) {
+  const executor = getSharedExecutor();
+  const endpointTransformer = getAnthropicEndpointTransformer();
+  const { auth, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
+  const authHeaders = {};
+  await auth.applyHeaders(authHeaders, { upstreamUrl, model: resolvedModel });
+  let rawStatus = null;
+  const { response } = await executeProviderCall({
+    executor,
+    request: anthropicBody,
+    provider: transformerProvider,
+    chain,
+    endpointTransformer,
+    resolveUrl,
+    buildHeaders: (config) => {
+      const headers = { ...authHeaders };
+      if (config.headers) {
+        for (const [key, value] of Object.entries(config.headers)) {
+          if (value !== void 0 && !(key in headers)) headers[key] = value;
+        }
+      }
+      return headers;
+    },
+    fetchFn: (url, headers, body) => {
+      console.info(`[ProviderProxy:anthropic] -> ${url} model=${resolvedModel} stream=${isStream}`);
+      return fetch(url, { method: "POST", headers, body: JSON.stringify(body) }).then((r) => {
+        rawStatus = r.status;
+        return r;
+      });
+    },
+    runResponseChain: true
+  });
+  return { response, rawStatus };
+}
+async function runSubscriptionSameFormatFetch(rawBody, plan) {
+  const headers = { "content-type": "application/json" };
+  await plan.auth.applyHeaders(headers, {
+    upstreamUrl: plan.upstreamUrl,
+    model: plan.resolvedModel
+  });
+  console.info(
+    `[ProviderProxy:anthropic] (subscription same-format) -> ${plan.upstreamUrl} model=${plan.resolvedModel} stream=${plan.isStream}`
+  );
+  const response = await fetch(plan.upstreamUrl, { method: "POST", headers, body: rawBody });
+  return { response, rawStatus: response.status };
+}
+async function runSubscriptionAttemptWith401Retry(anthropicBody, relayBody, plan) {
+  const runOnce = () => plan.sameFormat ? runSubscriptionSameFormatFetch(relayBody, plan) : runPipeline(anthropicBody, plan);
+  const first = await runOnce();
+  if (first.rawStatus !== 401) return first;
+  const refreshed = await plan.auth.onUnauthorized?.();
+  if (!refreshed) {
+    console.warn("[ProviderProxy:anthropic] 401 not recoverable (onUnauthorized returned false)");
+    return first;
+  }
+  console.info("[ProviderProxy:anthropic] 401 \u2192 token refreshed; retrying once");
+  return runOnce();
+}
+function isFallbackEligibleStatus(rawStatus) {
+  return rawStatus === null || rawStatus >= 500 || rawStatus === 429;
+}
+function breakerOutcome(rawStatus) {
+  if (isFallbackEligibleStatus(rawStatus)) return "failure";
+  if (rawStatus !== null && rawStatus >= 200 && rawStatus < 300) return "success";
+  return "neutral";
+}
+function recordBreakerOutcome(profile, modelId, rawStatus) {
+  const outcome = breakerOutcome(rawStatus);
+  if (outcome === "neutral") return;
+  profile?.recordModelOutcome?.(modelId, outcome === "success");
+}
+async function runSubscriptionAttemptOutcome(anthropicBody, relayBody, plan) {
+  try {
+    return { kind: "result", result: await runSubscriptionAttemptWith401Retry(anthropicBody, relayBody, plan) };
+  } catch (error) {
+    return { kind: "thrown", error };
+  }
+}
+function outcomeStatus(outcome) {
+  return outcome.kind === "thrown" ? null : outcome.result.rawStatus;
+}
+function settleOutcome(outcome) {
+  if (outcome.kind === "thrown") throw outcome.error;
+  return outcome.result;
+}
+async function runPipelineWithSubscriptionRetry(anthropicBody, rawBody, initialPlan, route, deps) {
+  const profile = route.subscriptionProfile;
+  const scenario = initialPlan.scenario;
+  if (!profile?.nextFallback || scenario === void 0) {
+    const loneOutcome = await runSubscriptionAttemptOutcome(anthropicBody, rawBody, initialPlan);
+    recordBreakerOutcome(profile, initialPlan.resolvedModel, outcomeStatus(loneOutcome));
+    return settleOutcome(loneOutcome);
+  }
+  const attempted = [];
+  let plan = initialPlan;
+  let firstRelayBody = rawBody;
+  let firstBodyObj = anthropicBody;
+  if (profile.allowModel && !profile.allowModel(initialPlan.resolvedModel)) {
+    attempted.push(initialPlan.resolvedModel);
+    const firstAdmitting = profile.nextFallback(scenario, attempted, route.subscriptionConfig);
+    const gatedPlan = firstAdmitting ? buildSubscriptionIterationPlan(profile, route, deps, firstAdmitting.modelId, initialPlan.isStream, scenario) : null;
+    if (firstAdmitting && gatedPlan) {
+      console.warn(
+        `[ProviderProxy:anthropic] subscription primary ${initialPlan.resolvedModel} circuit open -> first admitting fallback ${firstAdmitting.modelId}`
+      );
+      plan = gatedPlan;
+      firstBodyObj = { ...anthropicBody, model: firstAdmitting.modelId };
+      firstRelayBody = gatedPlan.sameFormat ? JSON.stringify(firstBodyObj) : rawBody;
+    } else {
+      attempted.length = 0;
+      console.warn(
+        `[ProviderProxy:anthropic] subscription all opencodego circuits open -> fail open to primary ${initialPlan.resolvedModel}`
+      );
+    }
+  }
+  let outcome = await runSubscriptionAttemptOutcome(firstBodyObj, firstRelayBody, plan);
+  recordBreakerOutcome(profile, plan.resolvedModel, outcomeStatus(outcome));
+  if (!attempted.includes(plan.resolvedModel)) attempted.push(plan.resolvedModel);
+  while (attempted.length < MAX_FALLBACK_ATTEMPTS) {
+    if (!isFallbackEligibleStatus(outcomeStatus(outcome))) return settleOutcome(outcome);
+    const next = profile.nextFallback(scenario, attempted, route.subscriptionConfig);
+    if (!next) return settleOutcome(outcome);
+    const nextPlan = buildSubscriptionIterationPlan(
+      profile,
+      route,
+      deps,
+      next.modelId,
+      plan.isStream,
+      scenario
+    );
+    if (!nextPlan) return settleOutcome(outcome);
+    const sinceLabel = outcome.kind === "thrown" ? "thrown error" : `status ${String(outcome.result.rawStatus)}`;
+    console.warn(
+      `[ProviderProxy:anthropic] subscription fallback ${plan.resolvedModel} -> ${next.modelId} after ${sinceLabel}`
+    );
+    const fallbackBodyObj = { ...anthropicBody, model: next.modelId };
+    const fallbackRelayBody = nextPlan.sameFormat ? JSON.stringify(fallbackBodyObj) : rawBody;
+    plan = nextPlan;
+    attempted.push(next.modelId);
+    outcome = await runSubscriptionAttemptOutcome(fallbackBodyObj, fallbackRelayBody, plan);
+    recordBreakerOutcome(profile, plan.resolvedModel, outcomeStatus(outcome));
+  }
+  return settleOutcome(outcome);
+}
+var MAX_FALLBACK_ATTEMPTS = 3;
+
+// src/provider-proxy/ingress/anthropicMessagesByo.ts
+async function handleAnthropicMessagesByo(res, rawBody, route, deps, options = {}) {
+  let anthropicBody;
+  try {
+    anthropicBody = JSON.parse(rawBody);
+  } catch {
+    writeError(res, 400, "Invalid JSON in request body");
+    return;
+  }
+  const isStream = anthropicBody.stream === true;
+  const resolvedModel = route.model;
+  anthropicBody.model = resolvedModel;
+  try {
+    const plan = route.authMode === "subscription" ? await buildSubscriptionPlan(res, route, deps, anthropicBody, resolvedModel, isStream) : await buildByoPlan(res, route, deps, resolvedModel, isStream);
+    if (!plan) return;
+    anthropicBody.model = plan.resolvedModel;
+    const providerResponse = route.authMode === "subscription" ? await runPipelineWithSubscriptionRetry(anthropicBody, rawBody, plan, route, deps) : await runPipelineWithPoolReporting(anthropicBody, rawBody, plan, options);
+    const bodyText = await relayResponse(res, providerResponse.response, isStream);
+    if (bodyText && deps.usageRecorder) {
+      recordAnthropicNonStreamUsage(deps.usageRecorder, bodyText, {
+        sessionId: route.sessionId,
+        providerId: route.providerId ?? "anthropic",
+        model: plan.resolvedModel
+      });
+    }
+  } catch (err) {
+    const errMsg = serializeError(err);
+    console.error("[ProviderProxy:anthropic] Pipeline error:", errMsg);
+    writeError(res, 502, errMsg);
+  }
+}
+async function buildByoPlan(res, route, deps, resolvedModel, isStream) {
+  const providerId = route.providerId;
+  if (!providerId) {
+    writeError(res, 502, "BYO route is missing a providerId");
+    return null;
+  }
+  const provider = await deps.llmConfig.getProvider(providerId);
+  if (!provider) {
+    writeError(res, 502, `Provider not found: ${providerId}`);
+    return null;
+  }
+  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  if (!apiKey) {
+    writeError(res, 502, "API key not configured");
+    return null;
+  }
+  const auth = route.auth ?? new LlmConfigProviderAuth({
+    provider,
+    apiKey,
+    apiKeyPool: deps.apiKeyPool ?? null,
+    providerId,
+    sessionId: route.sessionId
+  });
+  const { chain } = await resolveProviderChain(deps.llmConfig, providerId, resolvedModel);
+  const transformerProvider = {
+    name: provider.name,
+    baseUrl: provider.api_base_url,
+    apiKey,
+    models: provider.models || []
+  };
+  const byoUrl = buildProviderApiUrl(provider, { model: resolvedModel, stream: isStream });
+  const sameFormat = route.targetProviderFormat === "anthropic" || resolveApiFormat(provider) === "anthropic";
+  return {
+    auth,
+    chain,
+    transformerProvider,
+    resolvedModel,
+    isStream,
+    resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : byoUrl,
+    upstreamUrl: byoUrl,
+    sameFormat,
+    isSubscription: false,
+    provider,
+    apiKey,
+    extendedContextEnabled: route.anthropicSdkHints?.extendedContext?.enabled ?? false
+  };
+}
+async function runSameFormatFetch(rawBody, plan, options, keyOverride) {
+  const { provider, apiKey, resolvedModel, isStream, extendedContextEnabled } = plan;
+  if (!provider) {
+    throw new Error("[ProviderProxy:anthropic] same-format BYO path requires a provider row");
+  }
+  const effectiveKey = keyOverride ?? apiKey ?? "";
+  const headers = getProviderHeaders(provider, effectiveKey);
+  const callerBeta = options.callerAnthropicBeta?.trim();
+  if (callerBeta) {
+    const existing = headers["anthropic-beta"] ?? headers["Anthropic-Beta"];
+    const parts = new Set(
+      [existing, callerBeta].filter((v) => typeof v === "string" && v.length > 0).flatMap((v) => v.split(",").map((s) => s.trim()).filter((s) => s.length > 0))
+    );
+    if (parts.size > 0) {
+      delete headers["Anthropic-Beta"];
+      headers["anthropic-beta"] = [...parts].join(",");
+    }
+  }
+  injectExtendedContextBeta(headers, resolvedModel, extendedContextEnabled ?? false);
+  const url = buildProviderApiUrl(provider, { model: resolvedModel, stream: isStream });
+  console.info(`[ProviderProxy:anthropic] (same-format) -> ${url} model=${resolvedModel} stream=${isStream}`);
+  const response = await fetch(url, { method: "POST", headers, body: rawBody });
+  return { response, rawStatus: response.status };
+}
+async function runPipelineWithPoolReporting(anthropicBody, rawBody, plan, options) {
+  const runOnce = (keyOverride) => plan.sameFormat ? runSameFormatFetch(rawBody, plan, options, keyOverride) : runPipeline(anthropicBody, plan);
+  const first = await runOnce();
+  const outcome = await plan.auth.onResult?.(first.rawStatus);
+  if (outcome?.rebound) {
+    console.info(
+      "[ProviderProxy:anthropic] pool re-bound key after status",
+      first.rawStatus,
+      "\u2192 retrying once"
+    );
+    return runOnce(outcome.newKey);
+  }
+  return first;
+}
+
+// src/provider-proxy/ingress/anthropicMessagesIngress.ts
+function isAnthropicMessagesRequest(method, url) {
+  return method === "POST" && !!url && url.includes("/v1/messages");
+}
+async function handleAnthropicMessagesRequest(req, res, route, deps) {
+  const handlerFactory = deps.anthropicIngressHandlerFactory;
+  if (!handlerFactory) {
+    const rawBody = await readBody(req);
+    const callerBetaRaw = req.headers["anthropic-beta"];
+    const callerAnthropicBeta = Array.isArray(callerBetaRaw) ? callerBetaRaw.join(",") : callerBetaRaw;
+    await handleAnthropicMessagesByo(res, rawBody, route, deps, { callerAnthropicBeta });
+    return;
+  }
+  const hints = route.anthropicSdkHints;
+  if (!hints) {
+    writeError(res, 502, "Anthropic route is missing anthropicSdkHints");
+    return;
+  }
+  if (!hints.passThrough && !route.providerId) {
+    writeError(res, 502, "Anthropic route is missing a providerId");
+    return;
+  }
+  const handler = handlerFactory({
+    llmConfig: deps.llmConfig,
+    providerId: route.providerId ?? "",
+    model: route.model,
+    apiKey: hints.apiKey,
+    backgroundTaskModel: route.backgroundTaskModel,
+    isOfficialProvider: hints.isOfficialProvider,
+    thinkingLevel: hints.thinkingLevel,
+    extendedContext: hints.extendedContext ?? null,
+    passThrough: hints.passThrough,
+    passThroughAuthToken: hints.passThroughAuthToken ?? null,
+    resolvePassThroughAuthToken: hints.resolvePassThroughAuthToken ?? null,
+    subscriptionProfile: hints.subscriptionProfile ?? null,
+    maxConcurrency: hints.maxConcurrency,
+    webSearchService: hints.webSearchService ?? null,
+    onRetry: hints.onRetry,
+    onStreamEvent: hints.onStreamEvent,
+    usageRecorder: hints.usageRecorder ?? null,
+    attribution: hints.attribution ?? null
+  });
+  await handler.handle(req, res);
+}
+
+// src/provider-proxy/usage/recordGeminiUsage.ts
+function readGeminiUsage(usage) {
+  if (!usage) return null;
+  const promptTokens = Number(usage.promptTokenCount) || 0;
+  const candidatesTokens = Number(usage.candidatesTokenCount) || 0;
+  const cacheReadTokens = Number(usage.cachedContentTokenCount) || 0;
+  const reasoningTokens = Number(usage.thoughtsTokenCount) || 0;
+  const billableInput = Math.max(0, promptTokens - cacheReadTokens);
+  return {
+    inputTokens: billableInput,
+    outputTokens: candidatesTokens,
+    cacheReadTokens,
+    cacheCreationTokens: 0,
+    reasoningTokens
+  };
+}
+function recordGeminiNonStreamUsage(recorder, bodyText, attribution) {
+  try {
+    const parsed = JSON.parse(bodyText);
+    const tapped = readGeminiUsage(parsed.usageMetadata);
+    if (!tapped) return;
+    recorder.record({
+      messageId: null,
+      parentMessageId: null,
+      sessionId: attribution.sessionId,
+      providerId: attribution.providerId,
+      model: attribution.model,
+      apiKeyId: null,
+      engineOrigin: "codex-ingress",
+      usage: tapped,
+      rawUsage: parsed.usageMetadata
+    });
+  } catch {
+  }
+}
+
+// src/provider-proxy/ingress/geminiGenerateContentIngress.ts
+var GENERATE_CONTENT_ACTION = ":generateContent";
+var STREAM_GENERATE_CONTENT_ACTION = ":streamGenerateContent";
+function isGeminiGenerateContentRequest(method, url) {
+  if (method !== "POST" || !url) return false;
+  const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
+  const lastSegment = path.split("/").pop() ?? "";
+  return lastSegment.includes(STREAM_GENERATE_CONTENT_ACTION) || lastSegment.includes(GENERATE_CONTENT_ACTION);
+}
+function isGeminiStreamRequest(url) {
+  if (!url) return false;
+  const [path, query = ""] = url.split("?");
+  const lastSegment = (path?.replace(/\/+$/, "") ?? "").split("/").pop() ?? "";
+  if (lastSegment.includes(STREAM_GENERATE_CONTENT_ACTION)) return true;
+  return /(^|&)alt=sse(&|$)/.test(query);
+}
+async function handleGeminiGenerateContentRequest(res, rawBody, url, route, deps) {
+  let geminiBody;
+  try {
+    geminiBody = JSON.parse(rawBody);
+  } catch {
+    writeError(res, 400, "Invalid JSON in request body");
+    return;
+  }
+  if (route.authMode === "subscription") {
+    writeError(res, 502, "Gemini generateContent ingress does not support subscription auth");
+    return;
+  }
+  const isStream = isGeminiStreamRequest(url);
+  geminiBody.stream = isStream;
+  const resolvedModel = route.model;
+  geminiBody.model = resolvedModel;
+  try {
+    const plan = await buildByoPlan2(res, route, deps, resolvedModel, isStream);
+    if (!plan) return;
+    const providerResponse = await runPipelineWithPoolReporting2(geminiBody, plan);
+    const bodyText = await relayResponse(res, providerResponse.response, isStream);
+    if (bodyText && deps.usageRecorder) {
+      recordGeminiNonStreamUsage(deps.usageRecorder, bodyText, {
+        sessionId: route.sessionId,
+        providerId: route.providerId ?? "gemini",
+        model: resolvedModel
+      });
+    }
+  } catch (err) {
+    const errMsg = serializeError(err);
+    console.error("[ProviderProxy:gemini] Pipeline error:", errMsg);
+    writeError(res, 502, errMsg);
+  }
+}
+async function buildByoPlan2(res, route, deps, resolvedModel, isStream) {
+  const providerId = route.providerId;
+  if (!providerId) {
+    writeError(res, 502, "BYO route is missing a providerId");
+    return null;
+  }
+  const provider = await deps.llmConfig.getProvider(providerId);
+  if (!provider) {
+    writeError(res, 502, `Provider not found: ${providerId}`);
+    return null;
+  }
+  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  if (!apiKey) {
+    writeError(res, 502, "API key not configured");
+    return null;
+  }
+  const auth = route.auth ?? new LlmConfigProviderAuth({
+    provider,
+    apiKey,
+    apiKeyPool: deps.apiKeyPool ?? null,
+    providerId,
+    sessionId: route.sessionId
+  });
+  const { chain } = await resolveProviderChain(deps.llmConfig, providerId, resolvedModel);
+  const transformerProvider = {
+    name: provider.name,
+    baseUrl: provider.api_base_url,
+    apiKey,
+    models: provider.models || []
+  };
+  const byoUrl = buildProviderApiUrl(provider, { model: resolvedModel, stream: isStream });
+  return {
+    auth,
+    chain,
+    transformerProvider,
+    resolvedModel,
+    isStream,
+    resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : byoUrl,
+    upstreamUrl: byoUrl
+  };
+}
+async function runPipeline2(geminiBody, plan) {
+  const executor = getSharedExecutor();
+  const endpointTransformer = getGeminiEndpointTransformer();
+  const { auth, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
+  const authHeaders = {};
+  await auth.applyHeaders(authHeaders, { upstreamUrl, model: resolvedModel });
+  let rawStatus = null;
+  const { response } = await executeProviderCall({
+    executor,
+    request: geminiBody,
+    provider: transformerProvider,
+    chain,
+    endpointTransformer,
+    resolveUrl,
+    buildHeaders: (config) => {
+      const headers = { ...authHeaders };
+      if (config.headers) {
+        for (const [key, value] of Object.entries(config.headers)) {
+          if (value !== void 0 && !(key in headers)) headers[key] = value;
+        }
+      }
+      return headers;
+    },
+    fetchFn: (url, headers, body) => {
+      console.log(`[ProviderProxy:gemini] -> ${url} model=${resolvedModel} stream=${isStream}`);
+      return fetch(url, { method: "POST", headers, body: JSON.stringify(body) }).then((r) => {
+        rawStatus = r.status;
+        return r;
+      });
+    },
+    runResponseChain: true
+  });
+  return { response, rawStatus };
+}
+async function runPipelineWithPoolReporting2(geminiBody, plan) {
+  const first = await runPipeline2(geminiBody, plan);
+  const outcome = await plan.auth.onResult?.(first.rawStatus);
+  if (outcome?.rebound) {
+    console.log(
+      "[ProviderProxy:gemini] pool re-bound key after status",
+      first.rawStatus,
+      "\u2192 retrying once"
+    );
+    return runPipeline2(geminiBody, plan);
+  }
+  return first;
+}
+
+// src/provider-proxy/usage/recordChatCompletionsUsage.ts
+function readChatCompletionsUsage(usage) {
+  if (!usage) return null;
+  const promptTokens = Number(usage.prompt_tokens) || 0;
+  const completionTokens = Number(usage.completion_tokens) || 0;
+  const promptDetails = usage.prompt_tokens_details ?? {};
+  const cacheReadTokens = Number(promptDetails.cached_tokens) || 0;
+  const completionDetails = usage.completion_tokens_details ?? {};
+  const reasoningTokens = Number(completionDetails.reasoning_tokens) || 0;
+  const billableInput = Math.max(0, promptTokens - cacheReadTokens);
+  return {
+    inputTokens: billableInput,
+    outputTokens: completionTokens,
+    cacheReadTokens,
+    cacheCreationTokens: 0,
+    reasoningTokens
+  };
+}
+function recordChatCompletionsNonStreamUsage(recorder, bodyText, attribution) {
+  try {
+    const parsed = JSON.parse(bodyText);
+    const tapped = readChatCompletionsUsage(parsed.usage);
+    if (!tapped) return;
+    recorder.record({
+      messageId: null,
+      parentMessageId: null,
+      sessionId: attribution.sessionId,
+      providerId: attribution.providerId,
+      model: attribution.model,
+      apiKeyId: null,
+      engineOrigin: "codex-ingress",
+      usage: tapped,
+      rawUsage: parsed.usage
+    });
+  } catch {
+  }
+}
+
+// src/provider-proxy/ingress/openaiChatIngress.ts
+function isOpenAIChatRequest(method, url) {
+  if (method !== "POST" || !url) return false;
+  const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
+  return path.endsWith("/chat/completions");
+}
+async function handleOpenAIChatRequest(res, rawBody, route, deps) {
+  let chatBody;
+  try {
+    chatBody = JSON.parse(rawBody);
+  } catch {
+    writeError(res, 400, "Invalid JSON in request body");
+    return;
+  }
+  if (route.authMode === "subscription") {
+    writeError(res, 502, "OpenAI Chat Completions ingress does not support subscription auth");
+    return;
+  }
+  const isStream = chatBody.stream === true;
+  const resolvedModel = route.model;
+  chatBody.model = resolvedModel;
+  try {
+    const plan = await buildByoPlan3(res, route, deps, resolvedModel, isStream);
+    if (!plan) return;
+    const providerResponse = await runPipelineWithPoolReporting3(chatBody, plan);
+    const bodyText = await relayResponse(res, providerResponse.response, isStream);
+    if (bodyText && deps.usageRecorder) {
+      recordChatCompletionsNonStreamUsage(deps.usageRecorder, bodyText, {
+        sessionId: route.sessionId,
+        providerId: route.providerId ?? "openai",
+        model: resolvedModel
+      });
+    }
+  } catch (err) {
+    const errMsg = serializeError(err);
+    console.error("[ProviderProxy:chat] Pipeline error:", errMsg);
+    writeError(res, 502, errMsg);
+  }
+}
+async function buildByoPlan3(res, route, deps, resolvedModel, isStream) {
+  const providerId = route.providerId;
+  if (!providerId) {
+    writeError(res, 502, "BYO route is missing a providerId");
+    return null;
+  }
+  const provider = await deps.llmConfig.getProvider(providerId);
+  if (!provider) {
+    writeError(res, 502, `Provider not found: ${providerId}`);
+    return null;
+  }
+  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  if (!apiKey) {
+    writeError(res, 502, "API key not configured");
+    return null;
+  }
+  const auth = route.auth ?? new LlmConfigProviderAuth({
+    provider,
+    apiKey,
+    apiKeyPool: deps.apiKeyPool ?? null,
+    providerId,
+    sessionId: route.sessionId
+  });
+  const { chain } = await resolveProviderChain(deps.llmConfig, providerId, resolvedModel);
+  const transformerProvider = {
+    name: provider.name,
+    baseUrl: provider.api_base_url,
+    apiKey,
+    models: provider.models || []
+  };
+  const byoUrl = buildProviderApiUrl(provider, { model: resolvedModel, stream: isStream });
+  return {
+    auth,
+    chain,
+    transformerProvider,
+    resolvedModel,
+    isStream,
+    resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : byoUrl,
+    upstreamUrl: byoUrl
+  };
+}
+async function runPipeline3(chatBody, plan) {
+  const executor = getSharedExecutor();
+  const { auth, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
+  const authHeaders = {};
+  await auth.applyHeaders(authHeaders, { upstreamUrl, model: resolvedModel });
+  let rawStatus = null;
+  const { response } = await executeProviderCall({
+    executor,
+    request: chatBody,
+    provider: transformerProvider,
+    chain,
+    resolveUrl,
+    buildHeaders: (config) => {
+      const headers = { ...authHeaders };
+      if (config.headers) {
+        for (const [key, value] of Object.entries(config.headers)) {
+          if (value !== void 0 && !(key in headers)) headers[key] = value;
+        }
+      }
+      return headers;
+    },
+    fetchFn: (url, headers, body) => {
+      console.log(`[ProviderProxy:chat] -> ${url} model=${resolvedModel} stream=${isStream}`);
+      return fetch(url, { method: "POST", headers, body: JSON.stringify(body) }).then((r) => {
+        rawStatus = r.status;
+        return r;
+      });
+    },
+    runResponseChain: true
+  });
+  return { response, rawStatus };
+}
+async function runPipelineWithPoolReporting3(chatBody, plan) {
+  const first = await runPipeline3(chatBody, plan);
+  const outcome = await plan.auth.onResult?.(first.rawStatus);
+  if (outcome?.rebound) {
+    console.log(
+      "[ProviderProxy:chat] pool re-bound key after status",
+      first.rawStatus,
+      "\u2192 retrying once"
+    );
+    return runPipeline3(chatBody, plan);
+  }
+  return first;
+}
+
+// src/provider-proxy/usage/recordResponsesUsage.ts
+function readResponsesUsage(usage) {
+  if (!usage) return null;
+  const inputTokens = Number(usage.input_tokens) || 0;
+  const outputTokens = Number(usage.output_tokens) || 0;
+  const inputDetails = usage.input_tokens_details ?? {};
+  const cacheReadTokens = Number(inputDetails.cached_tokens) || 0;
+  const outputDetails = usage.output_tokens_details ?? {};
+  const reasoningTokens = Number(outputDetails.reasoning_tokens) || 0;
+  const billableInput = Math.max(0, inputTokens - cacheReadTokens);
+  return {
+    inputTokens: billableInput,
+    outputTokens,
+    cacheReadTokens,
+    cacheCreationTokens: 0,
+    reasoningTokens
+  };
+}
+function recordResponsesNonStreamUsage(recorder, bodyText, attribution) {
+  try {
+    const parsed = JSON.parse(bodyText);
+    const tapped = readResponsesUsage(parsed.usage);
+    if (!tapped) return;
+    recorder.record({
+      messageId: null,
+      parentMessageId: null,
+      sessionId: attribution.sessionId,
+      providerId: attribution.providerId,
+      model: attribution.model,
+      apiKeyId: null,
+      engineOrigin: "codex-ingress",
+      usage: tapped,
+      rawUsage: parsed.usage
+    });
+  } catch {
+  }
+}
+
+// src/provider-proxy/ingress/openaiResponsesIngress.ts
+function isOpenAIResponsesRequest(method, url) {
+  if (method !== "POST" || !url) return false;
+  const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
+  return path.endsWith("/responses");
+}
+async function handleOpenAIResponsesRequest(res, rawBody, route, deps) {
+  let responsesBody;
+  try {
+    responsesBody = JSON.parse(rawBody);
+  } catch {
+    writeError(res, 400, "Invalid JSON in request body");
+    return;
+  }
+  const isStream = responsesBody.stream === true;
+  const resolvedModel = route.model;
+  responsesBody.model = resolvedModel;
+  try {
+    const plan = route.authMode === "subscription" ? await buildSubscriptionPlan2(res, route, deps, resolvedModel, isStream) : await buildByoPlan4(res, route, deps, resolvedModel, isStream);
+    if (!plan) return;
+    const providerResponse = route.authMode === "subscription" ? await runPipelineWithSubscriptionRetry2(responsesBody, plan) : await runPipelineWithPoolReporting4(responsesBody, plan);
+    const bodyText = await relayResponse(res, providerResponse.response, isStream);
+    if (bodyText && deps.usageRecorder) {
+      recordResponsesNonStreamUsage(deps.usageRecorder, bodyText, {
+        sessionId: route.sessionId,
+        providerId: route.providerId ?? "codex",
+        model: resolvedModel
+      });
+    }
+  } catch (err) {
+    const errMsg = serializeError(err);
+    console.error("[ProviderProxy:responses] Pipeline error:", errMsg);
+    writeError(res, 502, errMsg);
+  }
+}
+async function buildByoPlan4(res, route, deps, resolvedModel, isStream) {
+  const providerId = route.providerId;
+  if (!providerId) {
+    writeError(res, 502, "BYO route is missing a providerId");
+    return null;
+  }
+  const provider = await deps.llmConfig.getProvider(providerId);
+  if (!provider) {
+    writeError(res, 502, `Provider not found: ${providerId}`);
+    return null;
+  }
+  const apiKey = await resolvePoolBoundKey(deps, providerId, provider, route.sessionId);
+  if (!apiKey) {
+    writeError(res, 502, "API key not configured");
+    return null;
+  }
+  const auth = route.auth ?? new LlmConfigProviderAuth({
+    provider,
+    apiKey,
+    apiKeyPool: deps.apiKeyPool ?? null,
+    providerId,
+    sessionId: route.sessionId
+  });
+  const { chain } = await resolveProviderChain(deps.llmConfig, providerId, resolvedModel);
+  const transformerProvider = {
+    name: provider.name,
+    baseUrl: provider.api_base_url,
+    apiKey,
+    models: provider.models || []
+  };
+  const byoUrl = buildProviderApiUrl(provider, { model: resolvedModel, stream: isStream });
+  return {
+    auth,
+    chain,
+    transformerProvider,
+    resolvedModel,
+    isStream,
+    resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : byoUrl,
+    upstreamUrl: byoUrl
+  };
+}
+async function buildSubscriptionPlan2(res, route, deps, resolvedModel, isStream) {
+  const profile = route.subscriptionProfile;
+  if (!profile) {
+    writeError(res, 502, "Subscription mode requires a codex subscription profile");
+    return null;
+  }
+  const upstreamUrl = profile.resolveUpstreamUrl?.(resolvedModel);
+  if (!upstreamUrl) {
+    writeError(res, 502, "Subscription profile is missing resolveUpstreamUrl");
+    return null;
+  }
+  const auth = route.auth ?? new SubscriptionAuthSource(profile);
+  const chain = resolveSubscriptionChain(
+    profile,
+    deps.llmConfig.getTransformerService(),
+    getResponsesEndpointTransformer()
+  );
+  const transformerProvider = {
+    name: profile.authStrategy.providerId,
+    baseUrl: upstreamUrl,
+    apiKey: "",
+    models: [resolvedModel]
+  };
+  if (profile.authStrategy.providerId === "gemini") {
+    try {
+      transformerProvider.geminiProject = await resolveGeminiCodeAssistProject(profile);
+    } catch (err) {
+      writeError(res, 502, serializeError(err));
+      return null;
+    }
+  }
+  return {
+    auth,
+    chain,
+    transformerProvider,
+    resolvedModel,
+    isStream,
+    // Prefer the transformer-supplied URL (Code Assist carries the correct
+    // stream vs non-stream colon-method URL in `config.url`); fall back to the
+    // profile's `resolveUpstreamUrl` for non-Code-Assist subscriptions.
+    resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : typeof config.url === "string" ? config.url : upstreamUrl,
+    upstreamUrl
+  };
+}
+async function resolveGeminiCodeAssistProject(profile) {
+  const probe = {};
+  await profile.authStrategy.applyHeaders(probe);
+  const bearer = probe.Authorization ?? probe.authorization ?? "";
+  const accessToken = bearer.replace(/^Bearer\s+/i, "").trim();
+  if (!accessToken) return void 0;
+  const resolver = getGeminiCodeAssistResolver();
+  if (!resolver) return void 0;
+  return resolver.resolveProject(accessToken);
+}
+async function runPipeline4(responsesBody, plan) {
+  const executor = getSharedExecutor();
+  const endpointTransformer = getResponsesEndpointTransformer();
+  const { auth, chain, transformerProvider, resolvedModel, isStream, resolveUrl, upstreamUrl } = plan;
+  const authHeaders = {};
+  await auth.applyHeaders(authHeaders, { upstreamUrl, model: resolvedModel });
+  let rawStatus = null;
+  const { response } = await executeProviderCall({
+    executor,
+    request: responsesBody,
+    provider: transformerProvider,
+    chain,
+    endpointTransformer,
+    resolveUrl,
+    buildHeaders: (config) => {
+      const headers = { ...authHeaders };
+      if (config.headers) {
+        for (const [key, value] of Object.entries(config.headers)) {
+          if (value !== void 0 && !(key in headers)) headers[key] = value;
+        }
+      }
+      return headers;
+    },
+    fetchFn: (url, headers, body) => {
+      console.log(`[ProviderProxy:responses] -> ${url} model=${resolvedModel} stream=${isStream}`);
+      return fetch(url, { method: "POST", headers, body: JSON.stringify(body) }).then((r) => {
+        rawStatus = r.status;
+        return r;
+      });
+    },
+    runResponseChain: true
+  });
+  return { response, rawStatus };
+}
+async function runPipelineWithPoolReporting4(responsesBody, plan) {
+  const first = await runPipeline4(responsesBody, plan);
+  const outcome = await plan.auth.onResult?.(first.rawStatus);
+  if (outcome?.rebound) {
+    console.log(
+      "[ProviderProxy:responses] pool re-bound key after status",
+      first.rawStatus,
+      "\u2192 retrying once"
+    );
+    return runPipeline4(responsesBody, plan);
+  }
+  return first;
+}
+async function runPipelineWithSubscriptionRetry2(responsesBody, plan) {
+  const first = await runPipeline4(responsesBody, plan);
+  if (first.rawStatus !== 401) return first;
+  const refreshed = await plan.auth.onUnauthorized?.();
+  if (!refreshed) {
+    console.warn("[ProviderProxy:responses] 401 not recoverable (onUnauthorized returned false)");
+    return first;
+  }
+  console.log("[ProviderProxy:responses] 401 \u2192 token refreshed; retrying once");
+  return runPipeline4(responsesBody, plan);
+}
+
+// src/provider-proxy/providerProxyRouter.ts
+function extractRouteToken(authHeader) {
+  if (!authHeader) return void 0;
+  const trimmed = authHeader.trim();
+  if (!trimmed) return void 0;
+  const m = /^Bearer\s+(.+)$/i.exec(trimmed);
+  return (m ? m[1] : trimmed).trim() || void 0;
+}
+function resolveRouteToken(req) {
+  const fromAuth = extractRouteToken(req.headers["authorization"]);
+  if (fromAuth) return fromAuth;
+  const googKey = req.headers["x-goog-api-key"];
+  const value = Array.isArray(googKey) ? googKey[0] : googKey;
+  return value?.trim() || void 0;
+}
+async function routeRequest(req, res, routes, deps) {
+  const token = resolveRouteToken(req);
+  const route = routes.lookup(token);
+  if (!route) {
+    writeError(res, 401, "Invalid or expired route token");
+    return;
+  }
+  const method = req.method;
+  const url = req.url;
+  if (isAnthropicMessagesRequest(method, url)) {
+    await handleAnthropicMessagesRequest(req, res, route, deps);
+    return;
+  }
+  if (isOpenAIResponsesRequest(method, url)) {
+    const rawBody = await readBody(req);
+    await handleOpenAIResponsesRequest(res, rawBody, route, deps);
+    return;
+  }
+  if (isOpenAIChatRequest(method, url)) {
+    const rawBody = await readBody(req);
+    await handleOpenAIChatRequest(res, rawBody, route, deps);
+    return;
+  }
+  if (isGeminiGenerateContentRequest(method, url)) {
+    const rawBody = await readBody(req);
+    await handleGeminiGenerateContentRequest(res, rawBody, url, route, deps);
+    return;
+  }
+  writeError(res, 404, `Unsupported: ${method} ${url}`);
+}
+
+// src/provider-proxy/ProviderProxy.ts
+function isLoopbackAddress(addr) {
+  if (!addr) return false;
+  const normalized = addr.startsWith("::ffff:") ? addr.slice("::ffff:".length) : addr;
+  return normalized === "127.0.0.1" || normalized.startsWith("127.") || normalized === "::1" || addr === "::1";
+}
+var ProviderProxy = class {
+  constructor(deps, routes) {
+    this.deps = deps;
+    this.routes = routes ?? new ProviderProxyRouteMap();
+  }
+  deps;
+  server = null;
+  port = 0;
+  routes;
+  /**
+   * Start the resident listener on a stable port on 127.0.0.1. Idempotent —
+   * a second `start()` returns the already-bound port.
+   */
+  async start() {
+    if (this.server) return this.port;
+    return new Promise((resolve, reject) => {
+      const server = http.createServer((req, res) => {
+        const peer = req.socket.remoteAddress;
+        if (!isLoopbackAddress(peer)) {
+          res.writeHead(403, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: { type: "provider_proxy_error", message: "Loopback only" } }));
+          req.socket.destroy();
+          return;
+        }
+        routeRequest(req, res, this.routes, this.deps).catch((err) => {
+          const errMsg = serializeError(err);
+          console.error("[ProviderProxy] Unhandled error:", errMsg);
+          if (!res.headersSent) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: { type: "provider_proxy_error", message: errMsg } }));
+          }
+        });
+      });
+      server.listen(0, "127.0.0.1", () => {
+        const addr = server.address();
+        if (addr && typeof addr === "object") {
+          this.port = addr.port;
+          this.server = server;
+          console.log(`[ProviderProxy] Listening on 127.0.0.1:${this.port}`);
+          resolve(this.port);
+        } else {
+          reject(new Error("Failed to get server address"));
+        }
+      });
+      server.on("error", reject);
+    });
+  }
+  /** Stop the listener, clear all routes, and release the port. */
+  async stop() {
+    this.routes.clear();
+    const server = this.server;
+    if (!server) return;
+    return new Promise((resolve) => {
+      server.close(() => {
+        console.log(`[ProviderProxy] Stopped (port=${this.port})`);
+        this.server = null;
+        this.port = 0;
+        resolve();
+      });
+    });
+  }
+  /** Base URL for injector wiring (`ANTHROPIC_BASE_URL` / codex `base_url`). */
+  getBaseUrl() {
+    return `http://127.0.0.1:${this.port}`;
+  }
+  /**
+   * The SHARED route map. Exposed so the outbound API server
+   * (`outbound-api-server`) can mint per-request routes on the SAME map and
+   * delegate to the existing `routeRequest()` dispatch — guaranteeing a single
+   * conversion stack. Not used by the resident per-run flow.
+   */
+  getRouteMap() {
+    return this.routes;
+  }
+  /**
+   * The app-session deps the proxy services all routes with. Exposed so the
+   * outbound server can pass them verbatim into `routeRequest()`.
+   */
+  getDeps() {
+    return this.deps;
+  }
+  /** Register a route for one run; returns the crypto route token (task 2.2). */
+  addRoute(context, idleMs) {
+    return this.routes.addRoute(context, idleMs);
+  }
+  /** Remove a route at run end. Returns true if an entry existed. */
+  removeRoute(token) {
+    return this.routes.removeRoute(token);
+  }
+  /** Live-route count (diagnostics / tests). */
+  routeCount() {
+    return this.routes.size();
+  }
+};
+
+// src/provider-proxy/index.ts
+var instance = null;
+function getProviderProxy(deps) {
+  if (!instance) {
+    if (!deps) {
+      throw new Error("getProviderProxy: deps are required on first construction");
+    }
+    instance = new ProviderProxy(deps);
+  }
+  return instance;
+}
+function __resetProviderProxyForTests() {
+  instance = null;
+}
+
+// src/outbound-api/OutboundApiServer.ts
+import http2 from "http";
+import { networkInterfaces } from "os";
+
+// src/outbound-api/outboundApiRouter.ts
+import { Readable } from "stream";
+
+// src/outbound-api/outboundApiKeyAuth.ts
+import { createHash, randomBytes as randomBytes2 } from "crypto";
+var SECRET_BYTES = 32;
+var PREFIX_LEN = 14;
+var KEY_PREFIX = "sk-omnicross-";
+var BASE62 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+var BASE62_REJECT_THRESHOLD = 248;
+function randomBase62(count) {
+  let out = "";
+  while (out.length < count) {
+    const buf = randomBytes2(count - out.length + 8);
+    for (const byte of buf) {
+      if (out.length >= count) break;
+      if (byte >= BASE62_REJECT_THRESHOLD) continue;
+      out += BASE62[byte % 62];
+    }
+  }
+  return out;
+}
+function generateSecret() {
+  return KEY_PREFIX + randomBase62(SECRET_BYTES);
+}
+function hashKey(secret) {
+  return createHash("sha256").update(secret, "utf8").digest("hex");
+}
+function keyPrefix(secret) {
+  return secret.slice(0, PREFIX_LEN);
+}
+function newKeyId() {
+  return `oak_${Date.now()}_${randomBytes2(6).toString("hex")}`;
+}
+async function createNamedKey(db, name) {
+  const secret = generateSecret();
+  const id = newKeyId();
+  const prefix = keyPrefix(secret);
+  const row = await db.outboundApiKeysCreate({
+    id,
+    name,
+    keyHash: hashKey(secret),
+    keyPrefix: prefix
+  });
+  return {
+    id: row.id,
+    name: row.name,
+    keyPrefix: row.keyPrefix,
+    createdAt: row.createdAt,
+    plaintextOnce: secret
+  };
+}
+async function verifyPresentedKey(db, presentedKey) {
+  if (!presentedKey) return null;
+  const trimmed = presentedKey.trim();
+  if (!trimmed) return null;
+  const row = await db.outboundApiKeysGetByHash(hashKey(trimmed));
+  if (!row) return null;
+  if (!row.enabled || row.revokedAt !== null) return null;
+  void db.outboundApiKeysTouchLastUsed(row.id).catch(() => {
+  });
+  return { id: row.id };
+}
+
+// src/outbound-api/roleDetection.ts
+import { normalizeModelId } from "@omnicross/contracts/canonical-models";
+var BACKGROUND_TIER_TOKENS = /* @__PURE__ */ new Set([
+  "haiku",
+  "mini",
+  "flash",
+  "small",
+  "lite",
+  "nano",
+  "8b"
+]);
+function modelTokens(normalizedId) {
+  return normalizedId.split(/[-._:/\s]+/).filter(Boolean);
+}
+function isBackgroundTierModel(rawModelId) {
+  if (!rawModelId) return false;
+  const tokens = modelTokens(normalizeModelId(rawModelId));
+  return tokens.some((tok) => BACKGROUND_TIER_TOKENS.has(tok));
+}
+function extractRequestedModel(ingressFormat, body) {
+  const model = body["model"];
+  return typeof model === "string" && model ? model : void 0;
+}
+function anthropicHasVision(body) {
+  const messages = body["messages"];
+  if (!Array.isArray(messages)) return false;
+  for (const msg of messages) {
+    const content = msg?.content;
+    if (!Array.isArray(content)) continue;
+    for (const part of content) {
+      if (part?.type === "image") return true;
+    }
+  }
+  return false;
+}
+function openaiChatHasVision(body) {
+  const messages = body["messages"];
+  if (!Array.isArray(messages)) return false;
+  for (const msg of messages) {
+    const content = msg?.content;
+    if (!Array.isArray(content)) continue;
+    for (const part of content) {
+      if (part?.type === "image_url") return true;
+    }
+  }
+  return false;
+}
+function openaiResponsesHasVision(body) {
+  const input = body["input"];
+  if (!Array.isArray(input)) return false;
+  for (const item of input) {
+    const content = item?.content;
+    if (Array.isArray(content)) {
+      for (const part of content) {
+        if (part?.type === "input_image") return true;
+      }
+    }
+    if (item?.type === "input_image") return true;
+  }
+  return false;
+}
+function geminiHasVision(body) {
+  const contents = body["contents"];
+  if (!Array.isArray(contents)) return false;
+  for (const content of contents) {
+    const parts = content?.parts;
+    if (!Array.isArray(parts)) continue;
+    for (const part of parts) {
+      const p = part;
+      if (p?.inline_data || p?.inlineData || p?.file_data || p?.fileData) return true;
+    }
+  }
+  return false;
+}
+function hasVisionContent(ingressFormat, body) {
+  switch (ingressFormat) {
+    case "anthropic-messages":
+      return anthropicHasVision(body);
+    case "openai-chat":
+      return openaiChatHasVision(body);
+    case "openai-responses":
+      return openaiResponsesHasVision(body);
+    case "gemini-generatecontent":
+      return geminiHasVision(body);
+    default:
+      return false;
+  }
+}
+function detectRequestRole(ingressFormat, body, options) {
+  if (hasVisionContent(ingressFormat, body)) return "vision";
+  const requestedModel = extractRequestedModel(ingressFormat, body);
+  if (requestedModel) {
+    const overrides = options?.backgroundModelIds;
+    if (overrides && overrides.length > 0) {
+      const reqNorm = normalizeModelId(requestedModel);
+      const inOverride = overrides.some((id) => {
+        if (!id) return false;
+        const candidate = id.includes(",") ? id.slice(id.indexOf(",") + 1) : id;
+        return normalizeModelId(candidate) === reqNorm || candidate === requestedModel;
+      });
+      if (inOverride) return "background";
+    }
+    if (isBackgroundTierModel(requestedModel)) return "background";
+  }
+  return "default";
+}
+function endpointToIngressFormat(endpoint) {
+  switch (endpoint) {
+    case "chat":
+      return "openai-chat";
+    case "responses":
+      return "openai-responses";
+    case "messages":
+      return "anthropic-messages";
+    case "gemini":
+      return "gemini-generatecontent";
+  }
+}
+
+// src/outbound-api/outboundApiRouter.ts
+function writeJsonError(res, status, message, headers = {}) {
+  if (res.headersSent) return;
+  res.writeHead(status, { "Content-Type": "application/json", ...headers });
+  res.end(JSON.stringify({ error: { type: "outbound_api_error", message } }));
+}
+function extractPresentedKey(req) {
+  const auth = req.headers["authorization"];
+  if (typeof auth === "string" && auth.trim()) {
+    const m = /^Bearer\s+(.+)$/i.exec(auth.trim());
+    return (m ? m[1] : auth).trim() || void 0;
+  }
+  const xApiKey = req.headers["x-api-key"];
+  const xApi = Array.isArray(xApiKey) ? xApiKey[0] : xApiKey;
+  if (xApi?.trim()) return xApi.trim();
+  const goog = req.headers["x-goog-api-key"];
+  const g = Array.isArray(goog) ? goog[0] : goog;
+  return g?.trim() || void 0;
+}
+function selectEndpoint(method, url) {
+  if (method !== "POST" || !url) return null;
+  const path = url.split("?")[0]?.replace(/\/+$/, "") ?? "";
+  if (path.endsWith("/chat/completions")) return "chat";
+  if (path.endsWith("/responses")) return "responses";
+  if (path.includes("/v1/messages")) return "messages";
+  const lastSeg = path.split("/").pop() ?? "";
+  if (lastSeg.endsWith(":generateContent") || lastSeg.endsWith(":streamGenerateContent")) {
+    return "gemini";
+  }
+  return null;
+}
+function extractGeminiModelFromUrl(url) {
+  if (!url) return void 0;
+  const path = url.split("?")[0] ?? "";
+  const m = /\/models\/([^/:]+):(?:stream)?[gG]enerateContent$/.exec(path.replace(/\/+$/, ""));
+  return m ? decodeURIComponent(m[1]) : void 0;
+}
+function readBody2(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+function shimAuthHeader(req, routeToken) {
+  req.headers["authorization"] = `Bearer ${routeToken}`;
+  delete req.headers["x-goog-api-key"];
+  delete req.headers["x-api-key"];
+}
+async function handleOutboundRequest(req, res, deps, config, rateLimiter) {
+  const presented = extractPresentedKey(req);
+  const verified = await verifyPresentedKey(deps.db, presented);
+  if (!verified) {
+    writeJsonError(res, 401, "Invalid or missing API key");
+    return;
+  }
+  const decision = rateLimiter.check(verified.id);
+  if (!decision.allowed) {
+    writeJsonError(res, 429, "Rate limit exceeded", {
+      "Retry-After": String(decision.retryAfterSeconds)
+    });
+    return;
+  }
+  const endpoint = selectEndpoint(req.method, req.url);
+  if (!endpoint) {
+    writeJsonError(res, 404, `Unsupported: ${req.method} ${req.url}`);
+    return;
+  }
+  const endpointConfig = config.endpoints.find((e) => e.endpoint === endpoint);
+  if (!endpointConfig) {
+    writeJsonError(res, 503, `endpoint '${endpoint}' is not configured`);
+    return;
+  }
+  const ingressFormat = endpointToIngressFormat(endpoint);
+  const rawBody = await readBody2(req);
+  let parsedBody = {};
+  try {
+    parsedBody = rawBody ? JSON.parse(rawBody) : {};
+  } catch {
+    writeJsonError(res, 400, "Invalid JSON in request body");
+    return;
+  }
+  if (endpoint === "gemini" && typeof parsedBody["model"] !== "string") {
+    const urlModel = extractGeminiModelFromUrl(req.url);
+    if (urlModel) parsedBody["model"] = urlModel;
+  }
+  const role = detectRequestRole(ingressFormat, parsedBody, {
+    backgroundModelIds: endpointConfig.backgroundModelIds
+  });
+  const resolved = await resolveRoute({
+    config: endpointConfig,
+    role,
+    ingressFormat,
+    llmConfig: deps.llmConfig,
+    // pool-seam (omnicross-daemon-parity-poolseam, design D1/D2(a)): synthesize a
+    // STABLE per-verified-key sessionId so the BYO ingress can seed a pool session
+    // binding and 429/529/401/403 failover actually fires. Synthesize ONLY when
+    // the pool is wired — pool-null embedders/tests keep `route.sessionId === null`
+    // (byte-identical to pre-seam). The `outbound:` prefix is namespace-isolated
+    // from real chat-session ids; `verified.id` is a small operator-controlled set,
+    // so `sessionBindings` stays bounded (one binding per named key, not per
+    // request — `sessionBindings` has no TTL).
+    sessionId: deps.proxyDeps.apiKeyPool ? `outbound:${verified.id}` : null
+  });
+  if (!resolved.ok) {
+    writeJsonError(res, resolved.error.status, resolved.error.message);
+    return;
+  }
+  const routeMap = deps.providerProxy.getRouteMap();
+  const token = routeMap.addRoute(resolved.route);
+  try {
+    shimAuthHeader(req, token);
+    const replay = makeReplayRequest(req, rawBody);
+    await routeRequest(replay, res, routeMap, deps.proxyDeps);
+  } catch (err) {
+    const message = serializeError(err);
+    console.error("[OutboundApi] dispatch error:", message);
+    writeJsonError(res, 502, message);
+  } finally {
+    routeMap.removeRoute(token);
+  }
+}
+function makeReplayRequest(req, rawBody) {
+  const buf = Buffer.from(rawBody, "utf8");
+  const readable = Readable.from(buf.length > 0 ? [buf] : []);
+  readable.method = req.method;
+  readable.url = req.url;
+  readable.headers = req.headers;
+  readable.httpVersion = req.httpVersion;
+  readable.socket = req.socket;
+  return readable;
+}
+
+// src/outbound-api/outboundRateLimiter.ts
+var DEFAULT_WINDOW_MS = 6e4;
+var DEFAULT_MAX_REQUESTS = 60;
+var OutboundRateLimiter = class {
+  windowMs;
+  maxRequests;
+  /** apiKeyId → ascending request timestamps within the current window. */
+  hits = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    this.windowMs = options.windowMs ?? DEFAULT_WINDOW_MS;
+    this.maxRequests = options.maxRequests ?? DEFAULT_MAX_REQUESTS;
+  }
+  /**
+   * Record a request for `apiKeyId` and decide whether it is allowed. Prunes
+   * timestamps older than the window first; when allowed, the request's
+   * timestamp is appended.
+   */
+  check(apiKeyId, now = Date.now()) {
+    const cutoff = now - this.windowMs;
+    const timestamps = (this.hits.get(apiKeyId) ?? []).filter((ts) => ts > cutoff);
+    if (timestamps.length >= this.maxRequests) {
+      if (timestamps.length === 0) {
+        this.hits.delete(apiKeyId);
+        return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil(this.windowMs / 1e3)) };
+      }
+      const oldest = timestamps[0];
+      const retryAfterMs = Math.max(0, oldest + this.windowMs - now);
+      this.hits.set(apiKeyId, timestamps);
+      return {
+        allowed: false,
+        retryAfterSeconds: Math.max(1, Math.ceil(retryAfterMs / 1e3))
+      };
+    }
+    timestamps.push(now);
+    this.hits.set(apiKeyId, timestamps);
+    return { allowed: true, retryAfterSeconds: 0 };
+  }
+  /** Drop all recorded state (tests / teardown). */
+  reset() {
+    this.hits.clear();
+  }
+};
+
+// src/outbound-api/OutboundApiServer.ts
+var DEFAULT_OUTBOUND_PORT = 8765;
+var LOOPBACK_ADDR = "127.0.0.1";
+var LAN_ADDR = "0.0.0.0";
+var OutboundApiServer = class {
+  constructor(deps, onPortChange) {
+    this.deps = deps;
+    this.onPortChange = onPortChange;
+  }
+  deps;
+  onPortChange;
+  server = null;
+  boundPort = 0;
+  boundAddr = LOOPBACK_ADDR;
+  endpoints = [];
+  rateLimiter = new OutboundRateLimiter();
+  /**
+   * Apply a config. Restarts the listener ONLY when the bind address or port
+   * changes (or when toggling enabled); per-endpoint routing config is updated
+   * in place (read live per request — no restart).
+   */
+  async applyConfig(input) {
+    this.endpoints = input.endpoints;
+    const wantAddr = input.networkBinding ? LAN_ADDR : LOOPBACK_ADDR;
+    const wantPort = input.port ?? DEFAULT_OUTBOUND_PORT;
+    if (!input.enabled) {
+      await this.stop();
+      return;
+    }
+    const running = this.server !== null;
+    const bindChanged = running && (this.boundAddr !== wantAddr || this.boundPort !== wantPort);
+    if (running && !bindChanged) {
+      return;
+    }
+    if (running) await this.stop();
+    await this.start(wantAddr, wantPort);
+  }
+  /** Start the listener on `bindAddr:port`, falling back on EADDRINUSE. */
+  async start(bindAddr, port) {
+    if (this.server) return this.boundPort;
+    const actualPort = await this.listen(bindAddr, port);
+    this.boundAddr = bindAddr;
+    this.boundPort = actualPort;
+    if (actualPort !== port) this.onPortChange?.(actualPort);
+    console.log(`[OutboundApiServer] Listening on ${bindAddr}:${actualPort}`);
+    return actualPort;
+  }
+  /** Bind once; on EADDRINUSE retry with an ephemeral port (port 0). */
+  listen(bindAddr, port) {
+    return new Promise((resolve, reject) => {
+      const server = http2.createServer((req, res) => {
+        this.onRequest(req, res);
+      });
+      const onError = (err) => {
+        if (err.code === "EADDRINUSE" && port !== 0) {
+          server.removeListener("error", onError);
+          this.listen(bindAddr, 0).then(resolve, reject);
+          return;
+        }
+        reject(err);
+      };
+      server.on("error", onError);
+      server.listen(port, bindAddr, () => {
+        const addr = server.address();
+        if (addr && typeof addr === "object") {
+          server.removeListener("error", onError);
+          server.on("error", (e) => console.error("[OutboundApiServer] server error", serializeError(e)));
+          this.server = server;
+          resolve(addr.port);
+        } else {
+          reject(new Error("Failed to get outbound server address"));
+        }
+      });
+    });
+  }
+  /** Per-request handler. Auth is enforced on EVERY request (incl. loopback). */
+  onRequest(req, res) {
+    handleOutboundRequest(
+      req,
+      res,
+      this.deps,
+      { endpoints: this.endpoints },
+      this.rateLimiter
+    ).catch((err) => {
+      const message = serializeError(err);
+      console.error("[OutboundApiServer] unhandled error:", message);
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: { type: "outbound_api_error", message } }));
+      }
+    });
+  }
+  /** Stop the listener and release the port. */
+  async stop() {
+    const server = this.server;
+    if (!server) return;
+    this.server = null;
+    this.boundPort = 0;
+    return new Promise((resolve) => {
+      server.close(() => {
+        console.log("[OutboundApiServer] Stopped");
+        resolve();
+      });
+    });
+  }
+  /** A live status snapshot for the Settings tab. */
+  getStatus() {
+    const running = this.server !== null;
+    if (!running) {
+      return {
+        running: false,
+        port: 0,
+        loopbackUrl: null,
+        lanUrl: null,
+        formats: null,
+        lanFormats: null
+      };
+    }
+    const port = this.boundPort;
+    const loopbackBase = `http://${LOOPBACK_ADDR}:${port}`;
+    const isLan = this.boundAddr === LAN_ADDR;
+    const lanIp = isLan ? firstLanIPv4() : null;
+    const lanBase = lanIp ? `http://${lanIp}:${port}` : null;
+    return {
+      running: true,
+      port,
+      loopbackUrl: loopbackBase,
+      lanUrl: lanBase,
+      formats: formatUrls(loopbackBase),
+      lanFormats: lanBase ? formatUrls(lanBase) : null
+    };
+  }
+};
+function formatUrls(base) {
+  return {
+    chat: `${base}/v1/chat/completions`,
+    responses: `${base}/v1/responses`,
+    messages: `${base}/v1/messages`,
+    gemini: `${base}/v1beta/models/{model}:generateContent`
+  };
+}
+function firstLanIPv4() {
+  const ifaces = networkInterfaces();
+  for (const addrs of Object.values(ifaces)) {
+    if (!addrs) continue;
+    for (const addr of addrs) {
+      if (addr.family === "IPv4" && !addr.internal) return addr.address;
+    }
+  }
+  return null;
+}
+
+// src/outbound-api/apiServerConfig.ts
+var OUTBOUND_API_SERVER_CONFIG_KEY = "outboundApiServer.config";
+var ALL_ENDPOINTS = ["chat", "responses", "messages", "gemini"];
+function defaultEndpointConfig(endpoint) {
+  return {
+    endpoint,
+    defaultModel: "",
+    backgroundModel: "",
+    useSubscription: false
+  };
+}
+function defaultServerConfig() {
+  return {
+    enabled: false,
+    networkBinding: false,
+    endpoints: ALL_ENDPOINTS.map(defaultEndpointConfig),
+    port: DEFAULT_OUTBOUND_PORT
+  };
+}
+function normalizeServerConfig(raw) {
+  const base = defaultServerConfig();
+  if (!raw) return base;
+  const byEndpoint = /* @__PURE__ */ new Map();
+  for (const e of raw.endpoints ?? []) {
+    if (e && ALL_ENDPOINTS.includes(e.endpoint)) {
+      byEndpoint.set(e.endpoint, {
+        endpoint: e.endpoint,
+        defaultModel: e.defaultModel ?? "",
+        backgroundModel: e.backgroundModel ?? "",
+        visionModel: e.visionModel,
+        useSubscription: e.useSubscription === true,
+        backgroundModelIds: e.backgroundModelIds
+      });
+    }
+  }
+  return {
+    enabled: raw.enabled === true,
+    networkBinding: raw.networkBinding === true,
+    endpoints: ALL_ENDPOINTS.map(
+      (ep) => byEndpoint.get(ep) ?? defaultEndpointConfig(ep)
+    ),
+    port: raw.port ?? base.port
+  };
+}
+async function loadServerConfig(store) {
+  const raw = await store.get(
+    OUTBOUND_API_SERVER_CONFIG_KEY
+  );
+  return normalizeServerConfig(raw);
+}
+async function saveServerConfig(store, config) {
+  await store.set(OUTBOUND_API_SERVER_CONFIG_KEY, config);
+}
+function mergeServerConfig(current, patch) {
+  return normalizeServerConfig({
+    enabled: patch.enabled ?? current.enabled,
+    networkBinding: patch.networkBinding ?? current.networkBinding,
+    endpoints: patch.endpoints ?? current.endpoints,
+    port: patch.port ?? current.port
+  });
+}
+
+// src/outbound-api/index.ts
+var instance2 = null;
+function getOutboundApiServer(deps, onPortChange) {
+  if (!instance2) {
+    if (!deps) {
+      throw new Error("getOutboundApiServer: deps are required on first construction");
+    }
+    instance2 = new OutboundApiServer(deps, onPortChange);
+  }
+  return instance2;
+}
+function __resetOutboundApiServerForTests() {
+  instance2 = null;
+}
+
+// src/completion/DirectApiHandler.ts
+async function callOpenAICompletion(provider, apiKey, options, logger) {
+  const request = {
+    model: options.model,
+    messages: options.messages.map((m) => convertMessageToOpenAI(m)),
+    // Only set max_tokens if explicitly provided, otherwise let API use its default
+    ...options.maxTokens ? { max_tokens: options.maxTokens } : {},
+    temperature: options.temperature,
+    stream: false
+    // For now, non-streaming only
+  };
+  if (options.thinkLevel && options.thinkLevel !== "none") {
+    const effort = getOpenAIReasoningEffort(options.thinkLevel);
+    if (effort) {
+      request.reasoning_effort = effort;
+    }
+  }
+  const apiUrl = buildProviderApiUrl(provider, { model: options.model, stream: false });
+  const headers = getProviderHeaders(provider, apiKey);
+  logger.info("Calling OpenAI completion API", { url: apiUrl, model: options.model });
+  const response = await fetch(apiUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(request)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    return {
+      success: false,
+      error: `API error (${response.status}): ${errorText}`
+    };
+  }
+  const data = await response.json();
+  const choice = data.choices[0];
+  return {
+    success: true,
+    message: {
+      id: `msg_${Date.now()}`,
+      role: "assistant",
+      content: choice.message.content || "",
+      timestamp: Date.now(),
+      thinking: data.reasoning_content ? { content: data.reasoning_content } : void 0
+    },
+    usage: {
+      promptTokens: data.usage.prompt_tokens,
+      completionTokens: data.usage.completion_tokens,
+      totalTokens: data.usage.total_tokens
+    }
+  };
+}
+async function callAnthropicCompletion(provider, apiKey, options, logger) {
+  const hasImages = options.messages.some((m) => m.images && m.images.length > 0);
+  if (hasImages) {
+    const systemMessages = options.messages.filter((m) => m.role === "system");
+    const nonSystemMessages = options.messages.filter((m) => m.role !== "system");
+    const anthropicRequest2 = {
+      model: options.model,
+      max_tokens: options.maxTokens || 16384,
+      temperature: options.temperature,
+      ...systemMessages.length > 0 ? { system: systemMessages.map((m) => m.content).join("\n\n") } : {},
+      messages: nonSystemMessages.map((m) => convertMessageToAnthropic(m)),
+      stream: false
+    };
+    const apiUrl2 = buildProviderApiUrl(provider, { model: options.model, stream: false });
+    const headers2 = getProviderHeaders(provider, apiKey);
+    logger.info("Calling Anthropic completion API with images", { url: apiUrl2, model: options.model });
+    const response2 = await fetch(apiUrl2, {
+      method: "POST",
+      headers: headers2,
+      body: JSON.stringify(anthropicRequest2)
+    });
+    if (!response2.ok) {
+      const errorText = await response2.text();
+      return {
+        success: false,
+        error: `API error (${response2.status}): ${errorText}`
+      };
+    }
+    const anthropicResponse2 = await response2.json();
+    const openaiResponse2 = convertAnthropicToOpenAI(anthropicResponse2);
+    const choice2 = openaiResponse2.choices[0];
+    return {
+      success: true,
+      message: {
+        id: `assistant-${Date.now()}`,
+        role: "assistant",
+        content: choice2.message?.content || "",
+        timestamp: Date.now()
+      },
+      usage: openaiResponse2.usage ? {
+        promptTokens: openaiResponse2.usage.prompt_tokens,
+        completionTokens: openaiResponse2.usage.completion_tokens,
+        totalTokens: openaiResponse2.usage.total_tokens
+      } : void 0
+    };
+  }
+  const openaiRequest = {
+    model: options.model,
+    messages: options.messages.map((m) => ({
+      role: m.role,
+      content: m.content
+    })),
+    // Anthropic requires max_tokens; use 16384 default if not explicitly set
+    max_tokens: options.maxTokens || 16384,
+    temperature: options.temperature,
+    stream: false
+  };
+  const config = {
+    defaultModel: options.model
+  };
+  const anthropicRequest = convertOpenAIToAnthropic(openaiRequest, config);
+  const apiUrl = buildProviderApiUrl(provider, { model: options.model, stream: false });
+  const headers = getProviderHeaders(provider, apiKey);
+  logger.info("Calling Anthropic completion API", { url: apiUrl, model: options.model });
+  const response = await fetch(apiUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(anthropicRequest)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    return {
+      success: false,
+      error: `API error (${response.status}): ${errorText}`
+    };
+  }
+  const anthropicResponse = await response.json();
+  const openaiResponse = convertAnthropicToOpenAI(anthropicResponse);
+  const choice = openaiResponse.choices[0];
+  return {
+    success: true,
+    message: {
+      id: `msg_${Date.now()}`,
+      role: "assistant",
+      content: choice.message.content || "",
+      timestamp: Date.now(),
+      thinking: openaiResponse.reasoning_content ? { content: openaiResponse.reasoning_content } : void 0
+    },
+    usage: {
+      promptTokens: openaiResponse.usage.prompt_tokens,
+      completionTokens: openaiResponse.usage.completion_tokens,
+      totalTokens: openaiResponse.usage.total_tokens
+    }
+  };
+}
+async function callGeminiCompletion(provider, apiKey, options, logger) {
+  const contents = [];
+  let systemInstruction;
+  for (const msg of options.messages) {
+    if (msg.role === "system") {
+      systemInstruction = { parts: [{ text: msg.content }] };
+    } else {
+      contents.push(convertMessageToGemini(msg));
+    }
+  }
+  const request = {
+    contents,
+    generationConfig: {
+      ...options.maxTokens ? { maxOutputTokens: options.maxTokens } : {},
+      ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
+    }
+  };
+  if (systemInstruction) {
+    request.systemInstruction = systemInstruction;
+  }
+  const apiUrl = buildProviderApiUrl(provider, { model: options.model, stream: false });
+  const headers = getProviderHeaders(provider, apiKey);
+  logger.info("Calling Gemini completion API", { url: apiUrl, model: options.model });
+  const response = await fetch(apiUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(request)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    return {
+      success: false,
+      error: `API error (${response.status}): ${errorText}`
+    };
+  }
+  const data = await response.json();
+  const candidates = data.candidates;
+  if (!candidates || candidates.length === 0) {
+    return {
+      success: false,
+      error: "No candidates in response"
+    };
+  }
+  const candidate = candidates[0];
+  const content = candidate.content;
+  let textContent = "";
+  if (content?.parts) {
+    for (const part of content.parts) {
+      if (part.text) {
+        textContent += part.text;
+      }
+    }
+  }
+  const usage = data.usageMetadata;
+  return {
+    success: true,
+    message: {
+      id: `msg_${Date.now()}`,
+      role: "assistant",
+      content: textContent,
+      timestamp: Date.now()
+    },
+    usage: usage ? {
+      promptTokens: usage.promptTokenCount || 0,
+      completionTokens: usage.candidatesTokenCount || 0,
+      totalTokens: usage.totalTokenCount || 0
+    } : void 0
+  };
+}
+async function callOpenAIResponseCompletion(provider, apiKey, options, logger) {
+  const input = [];
+  for (const msg of options.messages) {
+    if (msg.role === "system") {
+      input.push({ role: "developer", content: msg.content });
+    } else {
+      input.push({ role: msg.role, content: msg.content });
+    }
+  }
+  const request = {
+    model: options.model,
+    input,
+    stream: false,
+    ...options.maxTokens ? { max_output_tokens: options.maxTokens } : {},
+    ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
+  };
+  if (options.thinkLevel && options.thinkLevel !== "none") {
+    const effort = getOpenAIReasoningEffort(options.thinkLevel);
+    if (effort) {
+      request.reasoning = { effort, summary: "auto" };
+    }
+  }
+  const apiUrl = buildProviderApiUrl(provider, { model: options.model, stream: false });
+  const headers = getProviderHeaders(provider, apiKey);
+  logger.info("Calling OpenAI Response API", { url: apiUrl, model: options.model });
+  const response = await fetch(apiUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(request)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    return {
+      success: false,
+      error: `API error (${response.status}): ${errorText}`
+    };
+  }
+  const data = await response.json();
+  let textContent = "";
+  const output = data.output;
+  if (output) {
+    for (const item of output) {
+      if (item.type === "message") {
+        const content = item.content;
+        if (content) {
+          for (const part of content) {
+            if (part.type === "output_text" && typeof part.text === "string") {
+              textContent += part.text;
+            }
+          }
+        }
+      }
+    }
+  }
+  const usage = data.usage;
+  return {
+    success: true,
+    message: {
+      id: `msg_${Date.now()}`,
+      role: "assistant",
+      content: textContent,
+      timestamp: Date.now()
+    },
+    usage: usage ? {
+      promptTokens: usage.input_tokens || 0,
+      completionTokens: usage.output_tokens || 0,
+      totalTokens: (usage.input_tokens || 0) + (usage.output_tokens || 0)
+    } : void 0
+  };
+}
+
+// src/completion/StreamHandler.ts
+import { buildAnthropicThinking, getOpenAIReasoningEffort as getOpenAIReasoningEffort2 } from "@omnicross/contracts/thinking-config";
+async function streamOpenAICompletion(provider, apiKey, options, messageId, callbacks, logger) {
+  const request = {
+    model: options.model,
+    messages: options.messages.map((m) => convertMessageToOpenAI(m)),
+    // Only set max_tokens if explicitly provided, otherwise let API use its default
+    ...options.maxTokens ? { max_tokens: options.maxTokens } : {},
+    temperature: options.temperature,
+    stream: true
+  };
+  if (options.thinkLevel && options.thinkLevel !== "none") {
+    const effort = getOpenAIReasoningEffort2(options.thinkLevel);
+    if (effort) {
+      request.reasoning_effort = effort;
+    }
+  }
+  const apiUrl = buildProviderApiUrl(provider, { model: options.model, stream: true });
+  const headers = getProviderHeaders(provider, apiKey);
+  if (options.nativeSearchAugmentation) {
+    applyAugmentation(request, options.nativeSearchAugmentation);
+  }
+  logger.info("Streaming OpenAI completion request", {
+    url: apiUrl,
+    providerId: options.providerId,
+    model: options.model,
+    maxTokens: options.maxTokens,
+    max_tokens_in_request: request.max_tokens,
+    temperature: options.temperature,
+    messagesCount: options.messages.length,
+    hasNativeSearchAugmentation: !!options.nativeSearchAugmentation
+  });
+  const response = await fetch(apiUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(request)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    callbacks.onError?.(`API error (${response.status}): ${errorText}`);
+    return;
+  }
+  const result = await streamSSEResponse(response, "openai", {
+    onDelta: callbacks.onDelta,
+    onReasoning: callbacks.onReasoning,
+    onAudio: callbacks.onAudio,
+    onVideo: callbacks.onVideo,
+    onError: callbacks.onError
+  });
+  callbacks.onDone?.(
+    {
+      id: messageId,
+      role: "assistant",
+      content: result.content,
+      timestamp: Date.now(),
+      thinking: result.reasoning ? { content: result.reasoning } : void 0,
+      audios: result.audios.length > 0 ? result.audios : void 0,
+      videos: result.videos.length > 0 ? result.videos : void 0
+    },
+    result.usage,
+    result.metrics
+  );
+}
+async function streamAnthropicCompletion(provider, apiKey, options, messageId, callbacks, logger) {
+  const hasImages = options.messages.some((m) => m.images && m.images.length > 0);
+  const MAX_TOKENS_FOR_THINKING = 16384;
+  let effectiveMaxTokens = options.maxTokens || 16384;
+  const thinkingMaxTokens = options.thinkLevel && options.thinkLevel !== "none" ? Math.min(effectiveMaxTokens, MAX_TOKENS_FOR_THINKING) : effectiveMaxTokens;
+  const thinkingConfig = options.thinkLevel && options.thinkLevel !== "none" ? buildAnthropicThinking(options.model, options.thinkLevel, thinkingMaxTokens) : void 0;
+  if (thinkingConfig) {
+    effectiveMaxTokens = thinkingMaxTokens;
+  }
+  logger.debug("Anthropic thinking configuration", {
+    thinkLevel: options.thinkLevel,
+    thinkingConfig,
+    effectiveMaxTokens
+  });
+  let anthropicRequest;
+  if (hasImages) {
+    const systemMessages = options.messages.filter((m) => m.role === "system");
+    const nonSystemMessages = options.messages.filter((m) => m.role !== "system");
+    anthropicRequest = {
+      model: options.model,
+      max_tokens: effectiveMaxTokens,
+      // Omit temperature when thinking is enabled (Anthropic will use default temperature=1)
+      ...thinkingConfig ? {} : { temperature: options.temperature },
+      ...systemMessages.length > 0 ? { system: systemMessages.map((m) => m.content).join("\n\n") } : {},
+      messages: nonSystemMessages.map((m) => convertMessageToAnthropic(m)),
+      stream: true,
+      ...thinkingConfig ? { thinking: thinkingConfig } : {}
+    };
+  } else {
+    const config = {
+      defaultModel: options.model
+    };
+    const openaiRequest = {
+      model: options.model,
+      messages: options.messages.map((m) => ({
+        role: m.role,
+        content: m.content
+      })),
+      // Anthropic requires max_tokens; use adjusted value
+      max_tokens: effectiveMaxTokens,
+      // Omit temperature when thinking is enabled (Anthropic will use default temperature=1)
+      temperature: thinkingConfig ? void 0 : options.temperature,
+      stream: true
+    };
+    anthropicRequest = convertOpenAIToAnthropic(openaiRequest, config);
+    if (thinkingConfig) {
+      anthropicRequest.thinking = thinkingConfig;
+      delete anthropicRequest.temperature;
+    }
+  }
+  const apiUrl = buildProviderApiUrl(provider, { model: options.model, stream: true });
+  const headers = getProviderHeaders(provider, apiKey);
+  if (options.nativeSearchAugmentation) {
+    applyAugmentation(anthropicRequest, options.nativeSearchAugmentation);
+  }
+  logger.info("Streaming Anthropic completion request", {
+    url: apiUrl,
+    model: anthropicRequest.model,
+    messagesCount: anthropicRequest.messages?.length,
+    max_tokens: anthropicRequest.max_tokens,
+    temperature: anthropicRequest.temperature,
+    stream: anthropicRequest.stream,
+    hasImages,
+    hasThinking: !!anthropicRequest.thinking,
+    hasNativeSearchAugmentation: !!options.nativeSearchAugmentation
+  });
+  const response = await fetch(apiUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(anthropicRequest)
+  });
+  logger.debug("Anthropic response status", { status: response.status });
+  if (!response.ok) {
+    const errorText = await response.text();
+    logger.error("Anthropic API error", void 0, { status: response.status, errorText });
+    callbacks.onError?.(`API error (${response.status}): ${errorText}`);
+    return;
+  }
+  const result = await streamSSEResponse(response, "anthropic", {
+    onDelta: callbacks.onDelta,
+    onReasoning: callbacks.onReasoning,
+    onError: callbacks.onError,
+    onBlock: callbacks.onBlock
+  });
+  logger.info("Anthropic stream complete", {
+    contentLength: result.content.length,
+    reasoningLength: result.reasoning?.length || 0,
+    blocksCount: result.blocks.length
+  });
+  callbacks.onDone?.(
+    {
+      id: messageId,
+      role: "assistant",
+      content: result.content,
+      timestamp: Date.now(),
+      thinking: result.reasoning ? { content: result.reasoning } : void 0,
+      blocks: result.blocks.length > 0 ? result.blocks : void 0
+    },
+    result.usage,
+    result.metrics
+  );
+}
+async function streamGeminiCompletion(provider, apiKey, options, messageId, callbacks, logger) {
+  const contents = [];
+  let systemInstruction;
+  for (const msg of options.messages) {
+    if (msg.role === "system") {
+      systemInstruction = { parts: [{ text: msg.content }] };
+    } else {
+      contents.push(convertMessageToGemini(msg));
+    }
+  }
+  const request = {
+    contents,
+    generationConfig: {
+      ...options.maxTokens ? { maxOutputTokens: options.maxTokens } : {},
+      ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
+    }
+  };
+  if (systemInstruction) {
+    request.systemInstruction = systemInstruction;
+  }
+  const apiUrl = buildProviderApiUrl(provider, { model: options.model, stream: true });
+  const headers = getProviderHeaders(provider, apiKey);
+  if (options.nativeSearchAugmentation) {
+    applyAugmentation(request, options.nativeSearchAugmentation);
+  }
+  logger.info("Streaming Gemini completion request", {
+    url: apiUrl,
+    model: options.model,
+    contentsCount: contents.length,
+    hasSystemInstruction: !!systemInstruction,
+    maxOutputTokens: options.maxTokens,
+    temperature: options.temperature,
+    hasNativeSearchAugmentation: !!options.nativeSearchAugmentation
+  });
+  const response = await fetch(apiUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(request)
+  });
+  logger.debug("Gemini response status", { status: response.status });
+  if (!response.ok) {
+    const errorText = await response.text();
+    logger.error("Gemini API error", void 0, { status: response.status, errorText });
+    callbacks.onError?.(`API error (${response.status}): ${errorText}`);
+    return;
+  }
+  const result = await streamSSEResponse(response, "gemini", {
+    onDelta: callbacks.onDelta,
+    onReasoning: callbacks.onReasoning,
+    onError: callbacks.onError
+  });
+  logger.info("Gemini stream complete", { contentLength: result.content.length });
+  callbacks.onDone?.(
+    {
+      id: messageId,
+      role: "assistant",
+      content: result.content,
+      timestamp: Date.now(),
+      thinking: result.reasoning ? { content: result.reasoning } : void 0
+    },
+    result.usage,
+    result.metrics
+  );
+}
+async function streamOpenAIResponseCompletion(provider, apiKey, options, messageId, callbacks, logger) {
+  const input = [];
+  for (const msg of options.messages) {
+    if (msg.role === "system") {
+      input.push({ role: "developer", content: msg.content });
+    } else {
+      input.push({ role: msg.role, content: msg.content });
+    }
+  }
+  const request = {
+    model: options.model,
+    input,
+    stream: true,
+    ...options.maxTokens ? { max_output_tokens: options.maxTokens } : {},
+    ...options.temperature !== void 0 ? { temperature: options.temperature } : {}
+  };
+  if (options.thinkLevel && options.thinkLevel !== "none") {
+    const effort = getOpenAIReasoningEffort2(options.thinkLevel);
+    if (effort) {
+      request.reasoning = { effort, summary: "auto" };
+    }
+  }
+  const apiUrl = buildProviderApiUrl(provider, { model: options.model, stream: true });
+  const headers = getProviderHeaders(provider, apiKey);
+  logger.info("Streaming OpenAI Response API request", {
+    url: apiUrl,
+    providerId: options.providerId,
+    model: options.model,
+    maxOutputTokens: options.maxTokens,
+    temperature: options.temperature,
+    inputCount: input.length,
+    reasoning: request.reasoning
+  });
+  const response = await fetch(apiUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(request)
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    callbacks.onError?.(`API error (${response.status}): ${errorText}`);
+    return;
+  }
+  const result = await streamSSEResponse(response, "openai-response", {
+    onDelta: callbacks.onDelta,
+    onReasoning: callbacks.onReasoning,
+    onError: callbacks.onError
+  });
+  logger.info("OpenAI Response API stream complete", { contentLength: result.content.length });
+  callbacks.onDone?.(
+    {
+      id: messageId,
+      role: "assistant",
+      content: result.content,
+      timestamp: Date.now(),
+      thinking: result.reasoning ? { content: result.reasoning } : void 0
+    },
+    result.usage,
+    result.metrics
+  );
+}
+
+// src/completion/ThinkingResolver.ts
+import {
+  buildAnthropicThinking as buildAnthropicThinking2,
+  calculateThinkingBudget,
+  DEFAULT_MAX_TOKENS,
+  getClaudeMaxTokens,
+  isReasoningModel
+} from "@omnicross/contracts/thinking-config";
+async function resolveEffectiveMaxTokens(llmConfig, getProvider, logger, providerId, modelId, sessionMaxTokens) {
+  if (sessionMaxTokens !== void 0 && sessionMaxTokens > 0) {
+    logger.debug("Using session maxTokens", { sessionMaxTokens });
+    return sessionMaxTokens;
+  }
+  try {
+    const globalParams = await llmConfig.getGlobalModelParameters();
+    if (globalParams?.maxTokens?.enabled && globalParams.maxTokens.value > 0) {
+      logger.debug("Using global maxTokens", { maxTokens: globalParams.maxTokens.value });
+      return globalParams.maxTokens.value;
+    }
+  } catch (err) {
+    logger.warn("Failed to get global params", err instanceof Error ? err : void 0);
+  }
+  const MAX_TOKENS_CAP = 131072;
+  const provider = await getProvider(providerId);
+  if (provider) {
+    const modelConfig = provider.modelConfigs?.find((m) => m.id === modelId);
+    if (modelConfig?.maxTokens && modelConfig.maxTokens > 0) {
+      const cappedMaxTokens = Math.min(modelConfig.maxTokens, MAX_TOKENS_CAP);
+      logger.debug("Using model config maxTokens", {
+        maxTokens: modelConfig.maxTokens,
+        cappedMaxTokens
+      });
+      return cappedMaxTokens;
+    }
+    if (provider.modelGroups) {
+      for (const group of provider.modelGroups) {
+        const model = group.models?.find((m) => m.id === modelId);
+        if (model?.maxTokens && model.maxTokens > 0) {
+          const cappedMaxTokens = Math.min(model.maxTokens, MAX_TOKENS_CAP);
+          logger.debug("Using modelGroup model maxTokens", {
+            maxTokens: model.maxTokens,
+            cappedMaxTokens
+          });
+          return cappedMaxTokens;
+        }
+      }
+    }
+  }
+  try {
+    const discoveredMaxTokens = await llmConfig.getDiscoveredModelMaxTokens(providerId, modelId);
+    if (discoveredMaxTokens && discoveredMaxTokens > 0) {
+      const cappedMaxTokens = Math.min(discoveredMaxTokens, MAX_TOKENS_CAP);
+      logger.debug("Using discovered model maxTokens", {
+        discoveredMaxTokens,
+        cappedMaxTokens
+      });
+      return cappedMaxTokens;
+    }
+  } catch (err) {
+    logger.warn("Failed to get discovered model maxTokens", err instanceof Error ? err : void 0);
+  }
+  logger.debug("No maxTokens configured, returning undefined");
+  return void 0;
+}
+async function getRequiredMaxTokens(llmConfig, getProvider, logger, providerId, modelId, sessionMaxTokens) {
+  const resolved = await resolveEffectiveMaxTokens(llmConfig, getProvider, logger, providerId, modelId, sessionMaxTokens);
+  if (resolved !== void 0) {
+    return resolved;
+  }
+  logger.debug("Using default maxTokens", { defaultMaxTokens: DEFAULT_MAX_TOKENS });
+  return DEFAULT_MAX_TOKENS;
+}
+async function resolveThinkingBudget(getProvider, logger, providerId, modelId, maxTokens, thinkLevel) {
+  if (thinkLevel === "none" || !isReasoningModel(modelId)) {
+    return {
+      adjustedMaxTokens: maxTokens,
+      thinkingBudget: void 0,
+      thinkingConfig: void 0
+    };
+  }
+  const thinkingBudget = calculateThinkingBudget(modelId, thinkLevel, maxTokens);
+  const provider = await getProvider(providerId);
+  const providerName = provider?.name?.toLowerCase() || "";
+  const apiFormat = provider ? resolveApiFormat(provider) : "openai";
+  if (apiFormat === "anthropic" || providerName === "anthropic" || providerName.includes("claude")) {
+    const thinkingConfig = buildAnthropicThinking2(modelId, thinkLevel, maxTokens);
+    const adjustedMaxTokens = getClaudeMaxTokens(maxTokens, thinkingBudget) || maxTokens;
+    logger.debug("Claude model thinking budget", {
+      thinkingBudget,
+      adjustedMaxTokens
+    });
+    return {
+      adjustedMaxTokens,
+      thinkingBudget,
+      thinkingConfig
+    };
+  }
+  logger.debug("Non-Claude model thinking budget", { thinkingBudget });
+  return {
+    adjustedMaxTokens: maxTokens,
+    thinkingBudget,
+    thinkingConfig: thinkingBudget ? { type: "enabled", budget_tokens: thinkingBudget } : void 0
+  };
+}
+
+// src/completion/ToolExecutor.ts
+function logToolFormat(tools, logger) {
+  if (!Array.isArray(tools) || tools.length === 0) {
+    logger.warn("No tools provided");
+    return;
+  }
+  const firstTool = tools[0];
+  if ("function" in firstTool) {
+    const openaiTools = tools;
+    logger.info("Tools configured (OpenAI format)", {
+      count: openaiTools.length,
+      tools: openaiTools.map((t) => t.function.name),
+      firstTool: {
+        name: firstTool.function.name,
+        description: firstTool.function.description?.slice(0, 100),
+        parameters: firstTool.function.parameters
+      }
+    });
+  } else if ("input_schema" in firstTool) {
+    const anthropicTools = tools;
+    logger.info("Tools configured (Anthropic format)", {
+      count: anthropicTools.length,
+      tools: anthropicTools.map((t) => t.name),
+      firstTool: {
+        name: firstTool.name,
+        description: firstTool.description?.slice(0, 100),
+        input_schema: firstTool.input_schema
+      }
+    });
+  } else if ("functionDeclarations" in firstTool) {
+    const geminiTools = tools;
+    const allDeclarations = geminiTools.flatMap((t) => t.functionDeclarations);
+    logger.info("Tools configured (Gemini format)", {
+      count: allDeclarations.length,
+      tools: allDeclarations.map((t) => t.name),
+      firstTool: {
+        name: allDeclarations[0]?.name,
+        description: allDeclarations[0]?.description?.slice(0, 100),
+        parameters: allDeclarations[0]?.parameters
+      }
+    });
+  }
+}
+function buildToolRequest(apiFormat, conversationMessages, actualModel, options, provider) {
+  let requestBody;
+  let url;
+  if (apiFormat === "google") {
+    const contents = [];
+    for (const msg of conversationMessages) {
+      if (msg.role !== "system") {
+        contents.push({
+          role: msg.role === "assistant" ? "model" : "user",
+          parts: [{ text: msg.content }]
+        });
+      }
+    }
+    requestBody = {
+      contents,
+      tools: options.tools
+    };
+    url = buildProviderApiUrl(provider, { model: actualModel, stream: true });
+  } else if (apiFormat === "anthropic") {
+    requestBody = {
+      model: actualModel,
+      messages: conversationMessages.filter((m) => m.role !== "system").map((m) => ({
+        role: m.role,
+        content: m.content
+      })),
+      max_tokens: options.maxTokens || 4096,
+      temperature: options.temperature ?? 0.7,
+      stream: true,
+      tools: options.tools
+    };
+    const systemMsg = conversationMessages.find((m) => m.role === "system");
+    if (systemMsg) {
+      requestBody.system = systemMsg.content;
+    }
+    url = buildProviderApiUrl(provider, { model: actualModel, stream: true });
+  } else {
+    requestBody = {
+      model: actualModel,
+      messages: conversationMessages.map((m) => ({
+        role: m.role,
+        content: m.content
+      })),
+      max_tokens: options.maxTokens || 4096,
+      temperature: options.temperature ?? 0.7,
+      stream: true,
+      tools: options.tools
+    };
+    url = buildProviderApiUrl(provider, { model: actualModel, stream: true });
+  }
+  return { requestBody, url };
+}
+function extractDeltaContent(rawJson, apiFormat) {
+  const json = rawJson;
+  if (apiFormat === "google") {
+    const parts = json.candidates?.[0]?.content?.parts || [];
+    let text = "";
+    for (const part of parts) {
+      if (part.thought === true) continue;
+      if (part.text) text += part.text;
+    }
+    return text;
+  } else if (apiFormat === "anthropic") {
+    return json.delta?.text || "";
+  } else {
+    return json.choices?.[0]?.delta?.content || "";
+  }
+}
+function extractDeltaReasoning(rawJson, apiFormat) {
+  const json = rawJson;
+  if (apiFormat === "google") {
+    const parts = json.candidates?.[0]?.content?.parts || [];
+    let reasoning = "";
+    for (const part of parts) {
+      if (part.thought === true && part.text) reasoning += part.text;
+    }
+    return reasoning;
+  } else if (apiFormat === "anthropic") {
+    return "";
+  } else {
+    const delta = json.choices?.[0]?.delta;
+    return (delta?.thinking?.content || "") + (delta?.reasoning_content || "");
+  }
+}
+function extractToolCalls(rawJson, apiFormat, toolCalls, callbacks, logger, pendingOpenAIToolCalls) {
+  const json = rawJson;
+  if (apiFormat === "google") {
+    const parts = json.candidates?.[0]?.content?.parts || [];
+    for (const part of parts) {
+      if (part.functionCall) {
+        logger.info("Function call detected", { functionCall: part.functionCall });
+        const toolCall = {
+          id: `call_${Date.now()}_${Math.random().toString(36).slice(2)}`,
+          name: part.functionCall.name,
+          args: part.functionCall.args || {}
+        };
+        toolCalls.push(toolCall);
+        callbacks.onToolCall?.(toolCall);
+        logger.info("Tool called", { toolName: toolCall.name });
+      }
+    }
+  } else if (apiFormat !== "anthropic") {
+    const delta = json.choices?.[0]?.delta;
+    if (delta?.tool_calls && pendingOpenAIToolCalls) {
+      for (const tc of delta.tool_calls) {
+        const index = tc.index ?? 0;
+        let pending = pendingOpenAIToolCalls.get(index);
+        if (!pending) {
+          pending = { id: "", name: "", arguments: "" };
+          pendingOpenAIToolCalls.set(index, pending);
+        }
+        if (tc.id) pending.id = tc.id;
+        if (tc.function?.name) pending.name += tc.function.name;
+        if (tc.function?.arguments) pending.arguments += tc.function.arguments;
+      }
+    }
+  }
+}
+function finalizeOpenAIToolCalls(pendingOpenAIToolCalls, toolCalls, callbacks, logger) {
+  for (const [, pending] of pendingOpenAIToolCalls) {
+    if (pending.name) {
+      try {
+        const toolCall = {
+          id: pending.id || `tool_${Date.now()}_${Math.random().toString(36).slice(2)}`,
+          name: pending.name,
+          args: JSON.parse(pending.arguments || "{}")
+        };
+        toolCalls.push(toolCall);
+        callbacks.onToolCall?.(toolCall);
+        logger.info("Tool called (OpenAI)", { toolName: toolCall.name, args: toolCall.args });
+      } catch (e) {
+        logger.error("Failed to parse OpenAI tool call arguments", e instanceof Error ? e : void 0, {
+          name: pending.name,
+          arguments: pending.arguments
+        });
+      }
+    }
+  }
+}
+function parseStreamChunk(rawJson, apiFormat, callbacks, logger) {
+  const json = rawJson;
+  if (apiFormat === "google") {
+    const candidate = json.candidates?.[0];
+    if (!candidate) {
+      logger.warn("No candidate found in Gemini response");
+      return;
+    }
+    const parts = candidate.content?.parts || [];
+    for (const part of parts) {
+      if (part.thought === true && part.text) {
+        callbacks.onReasoning?.(part.text);
+        continue;
+      } else if (part.thoughtSignature && !part.thought) {
+        logger.debug("Gemini returned thoughtSignature without thought content");
+      }
+      if (part.text) {
+        callbacks.onDelta?.(part.text);
+      }
+    }
+  } else if (apiFormat === "anthropic") {
+    const delta = json.delta;
+    if (delta?.text) {
+      callbacks.onDelta?.(delta.text);
+    }
+  } else {
+    const delta = json.choices?.[0]?.delta;
+    if (delta?.content) {
+      callbacks.onDelta?.(delta.content);
+    }
+    if (delta?.thinking?.content) {
+      callbacks.onReasoning?.(delta.thinking.content);
+    }
+    if (delta?.reasoning_content) {
+      callbacks.onReasoning?.(delta.reasoning_content);
+    }
+  }
+}
+function buildIterationBlocks(iteration, content, reasoning, blocks, callbacks) {
+  const blockIdPrefix = `block_${iteration}_${Date.now()}`;
+  if (reasoning && reasoning.trim()) {
+    const thinkingBlock = {
+      id: `${blockIdPrefix}_thinking`,
+      type: "thinking",
+      content: reasoning
+    };
+    blocks.push(thinkingBlock);
+    callbacks.onBlock?.(thinkingBlock);
+  }
+  if (content && content.trim()) {
+    const textBlock = {
+      id: `${blockIdPrefix}_text`,
+      type: "text",
+      content
+    };
+    blocks.push(textBlock);
+    callbacks.onBlock?.(textBlock);
+  }
+}
+async function executeToolCalls(toolCalls, mcpTools, mcpService, blocks, callbacks, logger, builtinExecutor) {
+  const toolResults = [];
+  for (const toolCall of toolCalls) {
+    const toolUseBlock = {
+      id: `${toolCall.id}_use`,
+      type: "tool_use",
+      toolId: toolCall.id,
+      toolName: toolCall.name,
+      input: toolCall.args,
+      status: "running"
+    };
+    blocks.push(toolUseBlock);
+    callbacks.onBlock?.(toolUseBlock);
+    try {
+      logger.info("Executing tool", { toolName: toolCall.name });
+      const mcpTool = mcpTools.find((t) => t.id === toolCall.name);
+      if (!mcpTool) {
+        logger.error("Tool not found", void 0, { toolName: toolCall.name });
+        continue;
+      }
+      logger.debug("Tool info", {
+        serverId: mcpTool.serverId,
+        toolName: mcpTool.name,
+        args: toolCall.args
+      });
+      const mappedArgs = mapToolArguments(toolCall.args, mcpTool, logger);
+      let result;
+      if (mcpTool.serverId === "builtin" && builtinExecutor) {
+        result = await builtinExecutor.execute(mcpTool.name, mappedArgs);
+      } else if (mcpService) {
+        result = await mcpService.callTool(mcpTool.serverId, mcpTool.name, mappedArgs, toolCall.id);
+      } else {
+        result = { isError: true, content: [{ type: "text", text: "MCP service not available" }] };
+      }
+      logger.info("Tool result received", { result });
+      callbacks.onToolResult?.(toolCall.id, result);
+      const resultText = result.content?.[0]?.text || JSON.stringify(result);
+      const toolResultBlock = {
+        id: `${toolCall.id}_result`,
+        type: "tool_result",
+        toolId: toolCall.id,
+        toolName: toolCall.name,
+        output: resultText,
+        isError: result.isError
+      };
+      blocks.push(toolResultBlock);
+      callbacks.onBlock?.(toolResultBlock);
+      const toolUseBlockRef = blocks.find((b) => b.id === `${toolCall.id}_use`);
+      if (toolUseBlockRef && toolUseBlockRef.type === "tool_use") {
+        toolUseBlockRef.status = result.isError ? "error" : "completed";
+        callbacks.onBlock?.({ ...toolUseBlockRef });
+      }
+      toolResults.push({ toolCall, result });
+    } catch (error) {
+      logger.error("Tool execution error", error instanceof Error ? error : void 0);
+      const errorMessage = error instanceof Error ? error.message : "Unknown error";
+      const errorResult = {
+        isError: true,
+        content: [{ type: "text", text: `Error: ${errorMessage}` }]
+      };
+      callbacks.onToolResult?.(toolCall.id, errorResult);
+      const errorToolResultBlock = {
+        id: `${toolCall.id}_result`,
+        type: "tool_result",
+        toolId: toolCall.id,
+        toolName: toolCall.name,
+        error: errorMessage,
+        isError: true
+      };
+      blocks.push(errorToolResultBlock);
+      callbacks.onBlock?.(errorToolResultBlock);
+      const errorToolUseBlockRef = blocks.find((b) => b.id === `${toolCall.id}_use`);
+      if (errorToolUseBlockRef && errorToolUseBlockRef.type === "tool_use") {
+        errorToolUseBlockRef.status = "error";
+        callbacks.onBlock?.({ ...errorToolUseBlockRef });
+      }
+      toolResults.push({ toolCall, result: errorResult });
+    }
+  }
+  return toolResults;
+}
+function mapToolArguments(args, mcpTool, logger) {
+  const mappedArgs = { ...args };
+  const toolSchema = mcpTool.inputSchema;
+  if (toolSchema?.properties) {
+    const expectedParams = Object.keys(toolSchema.properties);
+    const paramMappings = {
+      "search_query": ["query", "q", "searchQuery", "search"],
+      "content": ["text", "body", "message"],
+      "file_path": ["path", "filePath", "file"],
+      "url": ["link", "uri"]
+    };
+    for (const expectedParam of expectedParams) {
+      if (!(expectedParam in mappedArgs)) {
+        const aliases = paramMappings[expectedParam];
+        if (aliases) {
+          for (const alias of aliases) {
+            if (alias in mappedArgs) {
+              logger.info("Mapping parameter", { from: alias, to: expectedParam });
+              mappedArgs[expectedParam] = mappedArgs[alias];
+              delete mappedArgs[alias];
+              break;
+            }
+          }
+        }
+      }
+    }
+  }
+  return mappedArgs;
+}
+
+// src/completion/ToolHandler.ts
+async function streamWithTools(options, callbacks, mcpService, llmConfig, getProvider, resolveApiKey2, logger, builtinExecutor) {
+  try {
+    const routedInfo = await llmConfig.resolveRoutedModel(
+      options.providerId,
+      options.model
+    );
+    const actualProviderId = routedInfo?.actualProviderId || options.providerId;
+    const actualModel = routedInfo?.actualModelId || options.model;
+    const provider = await getProvider(actualProviderId);
+    if (!provider) {
+      callbacks.onError?.(`Provider not found: ${actualProviderId}`);
+      return;
+    }
+    if (!provider.enabled) {
+      callbacks.onError?.(`Provider is disabled: ${provider.name}`);
+      return;
+    }
+    const { apiKey: effectiveKey } = resolveProviderEndpoint(provider);
+    const apiKey = resolveApiKey2(effectiveKey);
+    if (!apiKey) {
+      callbacks.onError?.("API key not configured");
+      return;
+    }
+    const messageId = `msg_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+    callbacks.onStart?.(messageId);
+    const globalParams = await llmConfig.getGlobalModelParameters();
+    const MAX_ITERATIONS = globalParams.toolMaxTurns ?? 100;
+    let iteration = 0;
+    const conversationMessages = [...options.messages];
+    let finalContent = "";
+    let finalReasoning = "";
+    let finalUsageTokens;
+    const blocks = [];
+    logger.info("Sending request to LLM with tools", {
+      model: actualModel,
+      providerId: actualProviderId,
+      messagesCount: options.messages.length
+    });
+    logToolFormat(options.tools, logger);
+    const apiFormat = resolveApiFormat(provider);
+    logger.info("API format determined", { apiFormat });
+    while (iteration < MAX_ITERATIONS) {
+      iteration++;
+      logger.info("Agentic loop iteration", {
+        iteration,
+        maxIterations: MAX_ITERATIONS,
+        messagesCount: conversationMessages.length
+      });
+      const { requestBody, url } = buildToolRequest(
+        apiFormat,
+        conversationMessages,
+        actualModel,
+        options,
+        provider
+      );
+      if (options.nativeSearchAugmentation) {
+        applyAugmentation(requestBody, options.nativeSearchAugmentation);
+      }
+      const headers = getProviderHeaders(provider, apiKey);
+      logger.info("Sending tool call request", {
+        url,
+        headers,
+        requestBody
+      });
+      const response = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(requestBody)
+      });
+      if (!response.ok) {
+        const errorText = await response.text();
+        callbacks.onError?.(`API error (${response.status}): ${errorText}`);
+        return;
+      }
+      const reader = response.body?.getReader();
+      if (!reader) {
+        callbacks.onError?.("No response body");
+        return;
+      }
+      const decoder = new TextDecoder();
+      let content = "";
+      let reasoning = "";
+      const toolCalls = [];
+      const pendingOpenAIToolCalls = /* @__PURE__ */ new Map();
+      let buffer = "";
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          const chunk = decoder.decode(value, { stream: true });
+          logger.debug("Received raw chunk", { chunkLength: chunk.length });
+          buffer += chunk;
+          const lines = buffer.split("\n");
+          buffer = lines.pop() || "";
+          for (const line of lines) {
+            const trimmedLine = line.trim();
+            if (!trimmedLine) continue;
+            logger.debug("Processing line", { linePreview: trimmedLine.substring(0, 200) });
+            if (trimmedLine.startsWith("data: ")) {
+              const data = trimmedLine.slice(6);
+              if (data === "[DONE]") {
+                logger.debug("Stream done");
+                continue;
+              }
+              try {
+                const json = JSON.parse(data);
+                logger.debug("Parsed JSON", { json });
+                if (json.error) {
+                  logger.error("API Error", void 0, { error: json.error });
+                  callbacks.onError?.(`API Error: ${json.error.message || JSON.stringify(json.error)}`);
+                  return;
+                }
+                parseStreamChunk(json, apiFormat, callbacks, logger);
+                content = content + extractDeltaContent(json, apiFormat);
+                reasoning = reasoning + extractDeltaReasoning(json, apiFormat);
+                extractToolCalls(json, apiFormat, toolCalls, callbacks, logger, pendingOpenAIToolCalls);
+                if (apiFormat !== "google" && apiFormat !== "anthropic" && json.usage) {
+                  finalUsageTokens = {
+                    promptTokens: json.usage.prompt_tokens || 0,
+                    completionTokens: json.usage.completion_tokens || 0,
+                    totalTokens: json.usage.total_tokens || 0
+                  };
+                }
+              } catch (_e) {
+              }
+            }
+          }
+        }
+        if (apiFormat !== "google" && apiFormat !== "anthropic") {
+          finalizeOpenAIToolCalls(pendingOpenAIToolCalls, toolCalls, callbacks, logger);
+          pendingOpenAIToolCalls.clear();
+        }
+        finalContent = content;
+        finalReasoning = reasoning;
+        buildIterationBlocks(iteration, content, reasoning, blocks, callbacks);
+        const executableToolCalls = toolCalls.filter(
+          (tc) => !NATIVE_SEARCH_TOOL_NAMES.includes(tc.name)
+        );
+        logger.info("Tool execution check", {
+          toolCallsLength: toolCalls.length,
+          executableToolCallsLength: executableToolCalls.length,
+          hasMcpTools: !!options.mcpTools,
+          mcpToolsLength: options.mcpTools?.length,
+          hasMcpService: !!mcpService
+        });
+        if (executableToolCalls.length > 0 && options.mcpTools && (mcpService || builtinExecutor)) {
+          logger.info("Executing tool calls", { count: executableToolCalls.length });
+          conversationMessages.push({
+            id: `assistant_${iteration}`,
+            role: "assistant",
+            content: content || "Calling tools...",
+            timestamp: Date.now()
+          });
+          const toolResults = await executeToolCalls(
+            executableToolCalls,
+            options.mcpTools,
+            mcpService,
+            blocks,
+            callbacks,
+            logger,
+            builtinExecutor
+          );
+          const toolResultsText = toolResults.map(({ toolCall, result }) => {
+            const resultText = typeof result === "string" ? result : result.content?.[0]?.text || JSON.stringify(result);
+            return `Tool ${toolCall.name} result:
+${resultText}`;
+          }).join("\n\n");
+          conversationMessages.push({
+            id: `tool_results_${iteration}`,
+            role: "user",
+            content: toolResultsText,
+            timestamp: Date.now()
+          });
+          logger.info("Continuing to next iteration with tool results");
+          continue;
+        } else {
+          logger.info("No tool calls, finishing");
+          break;
+        }
+      } catch (streamError) {
+        logger.error("Stream processing error", streamError instanceof Error ? streamError : void 0);
+        callbacks.onError?.(`Stream error: ${streamError instanceof Error ? streamError.message : "Unknown error"}`);
+        return;
+      }
+    }
+    logger.info("Sending final callback", { blocksCount: blocks.length });
+    callbacks.onDone?.({
+      id: messageId,
+      role: "assistant",
+      content: finalContent,
+      timestamp: Date.now(),
+      thinking: finalReasoning ? { content: finalReasoning } : void 0,
+      blocks: blocks.length > 0 ? blocks : void 0
+    }, finalUsageTokens);
+  } catch (error) {
+    logger.error("Error in streamWithTools", error instanceof Error ? error : void 0);
+    const message = error instanceof Error ? error.message : "Unknown error";
+    callbacks.onError?.(message);
+  }
+}
+
+// src/completion/TransformerHandler.ts
+function readUsageFromOpenAIResponse(usage) {
+  if (!usage) return null;
+  const promptTokens = Number(usage.prompt_tokens) || 0;
+  const completionTokens = Number(usage.completion_tokens) || 0;
+  const promptDetails = usage.prompt_tokens_details ?? {};
+  const cachedTokens = Number(promptDetails.cached_tokens) || Number(usage.cache_read_input_tokens) || 0;
+  const cacheCreation = Number(usage.cache_creation_input_tokens) || 0;
+  const inputTokens = Math.max(0, promptTokens - cachedTokens - cacheCreation);
+  const reasoningDetails = usage.completion_tokens_details ?? usage.output_tokens_details ?? {};
+  const reasoningTokens = Number(reasoningDetails.reasoning_tokens) || 0;
+  return {
+    inputTokens,
+    outputTokens: completionTokens,
+    cacheReadTokens: cachedTokens,
+    cacheCreationTokens: cacheCreation,
+    reasoningTokens
+  };
+}
+var sharedExecutor2 = null;
+function getSharedExecutor2() {
+  if (!sharedExecutor2) {
+    sharedExecutor2 = new TransformerChainExecutor();
+  }
+  return sharedExecutor2;
+}
+async function resolveChainWithMain(llmConfig, providerId, model) {
+  return resolveProviderChain(llmConfig, providerId, model);
+}
+async function completeWithTransformers(options, llmConfig, getProvider, resolveApiKey2, completeFallback, logger, recording) {
+  try {
+    const routedInfo = await llmConfig.resolveRoutedModel(
+      options.providerId,
+      options.model
+    );
+    const actualProviderId = routedInfo?.actualProviderId || options.providerId;
+    const actualModel = routedInfo?.actualModelId || options.model;
+    const provider = await getProvider(actualProviderId);
+    if (!provider) {
+      return { success: false, error: `Provider not found: ${actualProviderId}` };
+    }
+    if (!provider.enabled) {
+      return { success: false, error: `Provider is disabled: ${provider.name}` };
+    }
+    const { apiKey: effectiveKey } = resolveProviderEndpoint(provider);
+    const apiKey = resolveApiKey2(effectiveKey);
+    if (!apiKey) {
+      return { success: false, error: "API key not configured" };
+    }
+    const { chain, hasTransformers } = await resolveChainWithMain(
+      llmConfig,
+      actualProviderId,
+      actualModel
+    );
+    if (!hasTransformers) {
+      return completeFallback(options);
+    }
+    const unifiedRequest = {
+      model: actualModel,
+      messages: options.messages.map((m) => ({
+        role: m.role,
+        content: m.content
+      })),
+      max_tokens: options.maxTokens || 4096,
+      temperature: options.temperature,
+      stream: options.stream ?? false
+    };
+    const transformerProvider = {
+      name: provider.name,
+      baseUrl: provider.api_base_url,
+      apiKey,
+      models: provider.models || []
+    };
+    const executor = getSharedExecutor2();
+    const { response } = await executeProviderCall({
+      executor,
+      request: unifiedRequest,
+      provider: transformerProvider,
+      chain,
+      endpointTransformer: void 0,
+      extendedContext: options.useExtendedContext ? { enabled: true, model: actualModel } : void 0,
+      resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : buildProviderApiUrl(provider, { model: actualModel, stream: false }),
+      buildHeaders: (config) => ({
+        ...getProviderHeaders(provider, apiKey),
+        ...config.headers,
+        ...isOpenRouterProvider(provider) ? OPENROUTER_APP_HEADERS : {}
+      }),
+      // Add OpenRouter provider routing config if applicable
+      prepareBody: (requestBody) => addOpenRouterProviderToRequest(
+        requestBody,
+        provider,
+        actualModel
+      ),
+      fetchFn: (url, headers, body) => {
+        logger.info("Calling completion with transformers", { url });
+        return fetch(url, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(body)
+        });
+      }
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      return {
+        success: false,
+        error: `API error (${response.status}): ${errorText}`
+      };
+    }
+    const transformedResponse = await executor.executeResponseChain(
+      unifiedRequest,
+      response,
+      transformerProvider,
+      chain,
+      { endpointTransformer: void 0 }
+    );
+    const data = await transformedResponse.json();
+    const choice = data.choices?.[0];
+    if (!choice) {
+      return { success: false, error: "No choices in response" };
+    }
+    const rawToolCalls = choice.message?.tool_calls;
+    const toolCalls = rawToolCalls?.map((tc) => ({
+      id: tc.id,
+      name: tc.function.name,
+      args: typeof tc.function.arguments === "string" ? JSON.parse(tc.function.arguments) : tc.function.arguments
+    }));
+    const tapped = readUsageFromOpenAIResponse(data.usage);
+    if (recording?.recorder && tapped) {
+      recording.recorder.record({
+        messageId: options.messageId ?? null,
+        parentMessageId: options.parentMessageId ?? null,
+        sessionId: options.sessionId ?? null,
+        providerId: actualProviderId,
+        model: actualModel,
+        apiKeyId: recording.apiKeyId ?? null,
+        engineOrigin: "completion",
+        usage: tapped,
+        rawUsage: data.usage
+      });
+    }
+    return {
+      success: true,
+      message: {
+        id: `msg_${Date.now()}`,
+        role: "assistant",
+        content: choice.message?.content || "",
+        timestamp: Date.now(),
+        thinking: data.reasoning_content || choice.message?.thinking?.content ? { content: data.reasoning_content || choice.message?.thinking?.content || "", signature: choice.message?.thinking?.signature } : void 0,
+        toolCalls
+      },
+      usage: data.usage ? {
+        promptTokens: data.usage.prompt_tokens || 0,
+        completionTokens: data.usage.completion_tokens || 0,
+        totalTokens: data.usage.total_tokens || 0
+      } : void 0,
+      finishReason: choice.finish_reason
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    return { success: false, error: message };
+  }
+}
+async function completeStreamWithTransformers(options, callbacks, llmConfig, getProvider, resolveApiKey2, completeStreamFallback, logger, recording) {
+  try {
+    const routedInfo = await llmConfig.resolveRoutedModel(
+      options.providerId,
+      options.model
+    );
+    const actualProviderId = routedInfo?.actualProviderId || options.providerId;
+    const actualModel = routedInfo?.actualModelId || options.model;
+    const provider = await getProvider(actualProviderId);
+    if (!provider) {
+      callbacks.onError?.(`Provider not found: ${actualProviderId}`);
+      return;
+    }
+    if (!provider.enabled) {
+      callbacks.onError?.(`Provider is disabled: ${provider.name}`);
+      return;
+    }
+    const { apiKey: effectiveKey } = resolveProviderEndpoint(provider);
+    const apiKey = resolveApiKey2(effectiveKey);
+    if (!apiKey) {
+      callbacks.onError?.("API key not configured");
+      return;
+    }
+    const { chain, hasTransformers } = await resolveChainWithMain(
+      llmConfig,
+      actualProviderId,
+      actualModel
+    );
+    if (!hasTransformers) {
+      return completeStreamFallback(options, callbacks);
+    }
+    const messageId = `msg_${Date.now()}`;
+    callbacks.onStart?.(messageId);
+    const unifiedRequest = {
+      model: actualModel,
+      messages: options.messages.map((m) => ({
+        role: m.role,
+        content: m.content
+      })),
+      max_tokens: options.maxTokens || 4096,
+      temperature: options.temperature,
+      stream: true
+    };
+    const transformerProvider = {
+      name: provider.name,
+      baseUrl: provider.api_base_url,
+      apiKey,
+      models: provider.models || []
+    };
+    const executor = getSharedExecutor2();
+    const { response } = await executeProviderCall({
+      executor,
+      request: unifiedRequest,
+      provider: transformerProvider,
+      chain,
+      endpointTransformer: void 0,
+      extendedContext: options.useExtendedContext ? { enabled: true, model: actualModel } : void 0,
+      resolveUrl: (config) => config.url instanceof URL ? config.url.toString() : buildProviderApiUrl(provider, { model: actualModel, stream: true }),
+      buildHeaders: (config) => ({
+        ...getProviderHeaders(provider, apiKey),
+        ...config.headers,
+        ...isOpenRouterProvider(provider) ? OPENROUTER_APP_HEADERS : {}
+      }),
+      // Add OpenRouter provider routing config if applicable
+      prepareBody: (requestBody) => addOpenRouterProviderToRequest(
+        requestBody,
+        provider,
+        actualModel
+      ),
+      fetchFn: (url, headers, body) => {
+        logger.info("Streaming completion with transformers", { url });
+        return fetch(url, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(body)
+        });
+      }
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      callbacks.onError?.(`API error (${response.status}): ${errorText}`);
+      return;
+    }
+    const transformedResponse = await executor.executeResponseChain(
+      unifiedRequest,
+      response,
+      transformerProvider,
+      chain,
+      { endpointTransformer: void 0 }
+    );
+    const reader = transformedResponse.body?.getReader();
+    if (!reader) {
+      callbacks.onError?.("No response body");
+      return;
+    }
+    const decoder = new TextDecoder();
+    let content = "";
+    let reasoning = "";
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        const chunk = decoder.decode(value, { stream: true });
+        const lines = chunk.split("\n").filter((line) => line.trim() !== "");
+        for (const line of lines) {
+          if (line.startsWith("data: ")) {
+            const data = line.slice(6);
+            if (data === "[DONE]") continue;
+            try {
+              const json = JSON.parse(data);
+              const delta = json.choices?.[0]?.delta;
+              if (delta?.content) {
+                content += delta.content;
+                callbacks.onDelta?.(delta.content);
+              }
+              if (delta?.thinking?.content) {
+                reasoning += delta.thinking.content;
+                callbacks.onReasoning?.(delta.thinking.content);
+              }
+              if (delta?.reasoning_content) {
+                reasoning += delta.reasoning_content;
+                callbacks.onReasoning?.(delta.reasoning_content);
+              }
+              if (json.usage) {
+                const tapped = readUsageFromOpenAIResponse(json.usage);
+                if (recording?.recorder && tapped) {
+                  recording.recorder.record({
+                    messageId: options.messageId ?? null,
+                    parentMessageId: options.parentMessageId ?? null,
+                    sessionId: options.sessionId ?? null,
+                    providerId: actualProviderId,
+                    model: actualModel,
+                    apiKeyId: recording.apiKeyId ?? null,
+                    engineOrigin: "completion",
+                    usage: tapped,
+                    rawUsage: json.usage
+                  });
+                }
+                callbacks.onDone?.(
+                  {
+                    id: messageId,
+                    role: "assistant",
+                    content,
+                    timestamp: Date.now(),
+                    thinking: reasoning ? { content: reasoning } : void 0
+                  },
+                  {
+                    promptTokens: json.usage.prompt_tokens || 0,
+                    completionTokens: json.usage.completion_tokens || 0,
+                    totalTokens: json.usage.total_tokens || 0
+                  }
+                );
+                return;
+              }
+            } catch (_e) {
+            }
+          }
+        }
+      }
+      callbacks.onDone?.({
+        id: messageId,
+        role: "assistant",
+        content,
+        timestamp: Date.now(),
+        thinking: reasoning ? { content: reasoning } : void 0
+      });
+    } finally {
+      reader.releaseLock();
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    callbacks.onError?.(message);
+  }
+}
+
+// src/completion/CompletionService.ts
+var CompletionService = class {
+  constructor(paths, llmConfig, logger) {
+    this.paths = paths;
+    this.llmConfig = llmConfig;
+    this.logger = logger;
+  }
+  paths;
+  llmConfig;
+  logger;
+  apiKeyPool = null;
+  usageRecorder = null;
+  usageEventSink = null;
+  visionFallbackProvider = null;
+  /**
+   * Set the API key pool service for multi-key load balancing.
+   * When set, keys are resolved via the pool instead of directly from the provider.
+   */
+  setApiKeyPool(pool) {
+    this.apiKeyPool = pool;
+  }
+  /**
+   * Set the usage recorder so completion paths can persist token/cost stats.
+   * Optional — when unset, all calls succeed but nothing is recorded.
+   */
+  setUsageRecorder(recorder) {
+    this.usageRecorder = recorder;
+  }
+  /**
+   * Set the usage-event sink so completion paths can push live usage events
+   * (context-meter, aggregate recorder) into the in-process hub. Injected DOWN
+   * at bootstrap with `getUsageEventHub()` immediately after construction, so
+   * emission is unconditional in production. Optional — when unset (unit-test
+   * constructors), the emit calls no-op, identical to `usageRecorder`.
+   */
+  setUsageEventSink(sink) {
+    this.usageEventSink = sink;
+  }
+  /**
+   * Set the vision-fallback provider used by `applyVisionFallback` to describe
+   * images for non-vision models. Injected DOWN by the host at bootstrap
+   * (the host's impl is built on top of CompletionService).
+   * Optional — when unset, `applyVisionFallback` strips images instead.
+   */
+  setVisionFallbackProvider(provider) {
+    this.visionFallbackProvider = provider;
+  }
+  /**
+   * Get provider by ID
+   * Delegates to the `ProviderConfigSource` which maintains its own in-memory cache.
+   */
+  async getProvider(providerId) {
+    return this.llmConfig.getProvider(providerId);
+  }
+  /**
+   * Send a completion request
+   */
+  async complete(options) {
+    try {
+      const routedInfo = await this.llmConfig.resolveRoutedModel(
+        options.providerId,
+        options.model
+      );
+      const actualProviderId = routedInfo?.actualProviderId || options.providerId;
+      const actualModel = routedInfo?.actualModelId || options.model;
+      const provider = await this.getProvider(actualProviderId);
+      if (!provider) {
+        return { success: false, error: `Provider not found: ${actualProviderId}` };
+      }
+      if (!provider.enabled) {
+        return { success: false, error: `Provider is disabled: ${provider.name}` };
+      }
+      const apiKey = await this.resolveApiKeyForRequest(provider, actualProviderId, options.sessionId);
+      if (!apiKey) {
+        return { success: false, error: "API key not configured" };
+      }
+      const apiFormat = resolveApiFormat(provider);
+      this.logger.info("Using API format for completion", { apiFormat, providerId: actualProviderId });
+      const resolvedOptions = { ...options, model: actualModel };
+      let result = await this.callDirectHandler(apiFormat, provider, apiKey, resolvedOptions);
+      if (!result.success && result.error && this.apiKeyPool && options.sessionId) {
+        const status = this.extractHttpStatus(result.error);
+        if (status && (status === 429 || status === 529 || status === 401 || status === 403)) {
+          const newKey = await this.apiKeyPool.reportError(actualProviderId, options.sessionId, status);
+          if (newKey) {
+            this.logger.info("Retrying completion with new API key", {
+              providerId: actualProviderId,
+              statusCode: status
+            });
+            result = await this.callDirectHandler(apiFormat, provider, newKey, resolvedOptions);
+          }
+        }
+      }
+      if (result.success && this.apiKeyPool && options.sessionId) {
+        this.apiKeyPool.reportSuccess(options.sessionId);
+      }
+      if (result.success && result.usage && options.sessionId) {
+        this.usageEventSink?.emit({
+          sessionId: options.sessionId,
+          modelId: actualModel,
+          usage: result.usage,
+          engineOrigin: "completion"
+        });
+      }
+      return result;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      return { success: false, error: message };
+    }
+  }
+  /**
+   * Send a streaming completion request
+   */
+  async completeStream(options, callbacks) {
+    try {
+      await this.applyVisionFallback(options);
+      this.logger.info("Starting stream completion", {
+        providerId: options.providerId,
+        model: options.model,
+        messagesCount: options.messages.length
+      });
+      const routedInfo = await this.llmConfig.resolveRoutedModel(
+        options.providerId,
+        options.model
+      );
+      this.logger.debug("Resolved routed model", { routedInfo });
+      const actualProviderId = routedInfo?.actualProviderId || options.providerId;
+      const actualModel = routedInfo?.actualModelId || options.model;
+      this.logger.debug("Resolved provider and model", { actualProviderId, actualModel });
+      const provider = await this.getProvider(actualProviderId);
+      this.logger.debug("Retrieved provider", provider ? {
+        id: provider.id,
+        name: provider.name,
+        apiType: provider.apiType,
+        apiFormat: provider.apiFormat,
+        api_base_url: provider.api_base_url,
+        enabled: provider.enabled
+      } : { error: "Provider not found" });
+      if (!provider) {
+        callbacks.onError?.(`Provider not found: ${actualProviderId}`);
+        return;
+      }
+      if (!provider.enabled) {
+        callbacks.onError?.(`Provider is disabled: ${provider.name}`);
+        return;
+      }
+      const apiKey = await this.resolveApiKeyForRequest(provider, actualProviderId, options.sessionId);
+      if (!apiKey) {
+        callbacks.onError?.("API key not configured");
+        return;
+      }
+      const apiFormat = resolveApiFormat(provider);
+      this.logger.info("Using API format for stream", { apiFormat });
+      const messageId = `msg_${Date.now()}`;
+      callbacks.onStart?.(messageId);
+      const resolvedOptions = { ...options, model: actualModel };
+      if (options.sessionId) {
+        const sid = options.sessionId;
+        const userOnDone = callbacks.onDone;
+        callbacks = {
+          ...callbacks,
+          onDone: (message, usage, metrics) => {
+            if (usage) {
+              this.usageEventSink?.emit({
+                sessionId: sid,
+                modelId: actualModel,
+                usage,
+                engineOrigin: "completion"
+              });
+            }
+            userOnDone?.(message, usage, metrics);
+          }
+        };
+      }
+      if (this.apiKeyPool && options.sessionId) {
+        const retryState = { error: null };
+        const interceptCallbacks = {
+          ...callbacks,
+          onStart: void 0,
+          // already called above
+          onError: (error) => {
+            const status = this.extractHttpStatus(error);
+            if (status && (status === 429 || status === 529 || status === 401 || status === 403)) {
+              retryState.error = { status, message: error };
+              return;
+            }
+            callbacks.onError?.(error);
+          },
+          onDone: (message, usage, metrics) => {
+            this.apiKeyPool.reportSuccess(options.sessionId);
+            callbacks.onDone?.(message, usage, metrics);
+          }
+        };
+        await this.callStreamHandler(apiFormat, provider, apiKey, resolvedOptions, messageId, interceptCallbacks);
+        if (retryState.error) {
+          const newKey = await this.apiKeyPool.reportError(
+            actualProviderId,
+            options.sessionId,
+            retryState.error.status
+          );
+          if (newKey) {
+            this.logger.info("Retrying stream with new API key", {
+              providerId: actualProviderId,
+              statusCode: retryState.error.status
+            });
+            await this.callStreamHandler(apiFormat, provider, newKey, resolvedOptions, messageId, {
+              ...callbacks,
+              onStart: void 0
+              // don't fire onStart again
+            });
+          } else {
+            callbacks.onError?.(retryState.error.message);
+          }
+        }
+      } else {
+        await this.callStreamHandler(apiFormat, provider, apiKey, resolvedOptions, messageId, {
+          ...callbacks,
+          onStart: void 0
+          // already called above
+        });
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      this.logger.error("Stream completion error", error instanceof Error ? error : void 0, { message });
+      callbacks.onError?.(message);
+    }
+  }
+  /**
+   * Get available models for a provider
+   */
+  async getAvailableModels(providerId) {
+    const provider = await this.getProvider(providerId);
+    if (!provider) return [];
+    return provider.models || [];
+  }
+  /**
+   * Test provider connection with a specific model.
+   * Sends "Hello" and returns the AI response, duration, etc.
+   */
+  async testModel(providerId, modelId) {
+    try {
+      const provider = await this.getProvider(providerId);
+      if (!provider) {
+        return { success: false, message: "Provider not found", model: modelId };
+      }
+      const apiKey = this.resolveApiKey(provider.api_key);
+      if (!apiKey) {
+        return { success: false, message: "API key not configured", model: modelId };
+      }
+      const testMessages = [
+        { id: "test", role: "user", content: "Hello", timestamp: Date.now() }
+      ];
+      const startTime = Date.now();
+      const result = await this.complete({
+        providerId,
+        model: modelId,
+        messages: testMessages,
+        maxTokens: 100
+      });
+      const durationMs = Date.now() - startTime;
+      if (result.success) {
+        return {
+          success: true,
+          message: "Connection successful",
+          response: result.message?.content || "",
+          model: modelId,
+          durationMs
+        };
+      } else {
+        return {
+          success: false,
+          message: result.error || "Unknown error",
+          model: modelId,
+          durationMs
+        };
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown error";
+      return { success: false, message, model: modelId };
+    }
+  }
+  /**
+   * Check if any messages contain images and the model lacks vision capability.
+   * If so, use the auxiliary vision model to describe images as text and remove
+   * the image attachments from the messages.
+   *
+   * Mutates options.messages in-place.
+   */
+  async applyVisionFallback(options) {
+    const hasImages = options.messages.some((m) => m.images && m.images.length > 0);
+    if (!hasImages) return;
+    const hasVision = await this.llmConfig.hasVisionCapability(options.providerId, options.model);
+    if (hasVision) return;
+    const { vision: effectiveVisionModel } = await this.llmConfig.resolveEffectiveModels();
+    if (!effectiveVisionModel || !this.visionFallbackProvider) {
+      this.logger.info("Messages contain images but no vision auxiliary model configured; stripping images");
+      for (const msg of options.messages) {
+        if (msg.images && msg.images.length > 0) {
+          msg.images = void 0;
+        }
+      }
+      return;
+    }
+    this.logger.info("Model lacks vision capability, using auxiliary vision model for image descriptions", {
+      providerId: options.providerId,
+      model: options.model
+    });
+    const visionService = this.visionFallbackProvider;
+    for (const msg of options.messages) {
+      if (msg.images && msg.images.length > 0) {
+        const imageDataUrls = msg.images.map((img) => ({ data: img.url }));
+        const description = await visionService.describeImages(imageDataUrls, msg.content, effectiveVisionModel);
+        if (description && description !== "[Image description unavailable]") {
+          msg.content = `${msg.content}
+
+[Image Description]
+${description}`;
+        }
+        msg.images = void 0;
+      }
+    }
+  }
+  /**
+   * Resolve API key for a request with priority:
+   * 1. Coding Plan override (if enabled)
+   * 2. API key pool (session-affinity weighted round-robin)
+   * 3. Legacy single key from provider config
+   */
+  async resolveApiKeyForRequest(provider, providerId, sessionId) {
+    if (provider.codingPlan?.enabled && provider.codingPlan.apiKey) {
+      return this.resolveApiKey(provider.codingPlan.apiKey);
+    }
+    if (this.apiKeyPool) {
+      const poolKey = sessionId ? await this.apiKeyPool.getKeyForSession(providerId, sessionId) : await this.apiKeyPool.getKey(providerId);
+      if (poolKey) return poolKey;
+    }
+    const { apiKey: effectiveKey } = resolveProviderEndpoint(provider);
+    return this.resolveApiKey(effectiveKey);
+  }
+  // ==========================================================================
+  // Handler dispatch helpers
+  // ==========================================================================
+  /**
+   * Extract HTTP status code from error messages like "API error (429): ..."
+   */
+  extractHttpStatus(error) {
+    const match = error.match(/\((\d{3})\):/);
+    return match ? parseInt(match[1], 10) : null;
+  }
+  /**
+   * Dispatch a non-streaming completion to the appropriate handler.
+   */
+  async callDirectHandler(apiFormat, provider, apiKey, options) {
+    switch (apiFormat) {
+      case "anthropic":
+        return callAnthropicCompletion(provider, apiKey, options, this.logger);
+      case "google":
+        return callGeminiCompletion(provider, apiKey, options, this.logger);
+      case "openai-response":
+        return callOpenAIResponseCompletion(provider, apiKey, options, this.logger);
+      case "azure-openai":
+      case "openai":
+      default:
+        return callOpenAICompletion(provider, apiKey, options, this.logger);
+    }
+  }
+  /**
+   * Dispatch a streaming completion to the appropriate handler.
+   */
+  async callStreamHandler(apiFormat, provider, apiKey, options, messageId, callbacks) {
+    switch (apiFormat) {
+      case "openai-response":
+        await streamOpenAIResponseCompletion(provider, apiKey, options, messageId, callbacks, this.logger);
+        return;
+      case "anthropic":
+        await streamAnthropicCompletion(provider, apiKey, options, messageId, callbacks, this.logger);
+        return;
+      case "google":
+        await streamGeminiCompletion(provider, apiKey, options, messageId, callbacks, this.logger);
+        return;
+      case "azure-openai":
+      case "openai":
+      default:
+        await streamOpenAICompletion(provider, apiKey, options, messageId, callbacks, this.logger);
+        return;
+    }
+  }
+  /**
+   * Resolve API key (handle environment variable references)
+   */
+  resolveApiKey(apiKey) {
+    if (!apiKey) return "";
+    if (apiKey.startsWith("$")) {
+      const envVar = apiKey.slice(1);
+      return process.env[envVar] || "";
+    }
+    return apiKey;
+  }
+  /**
+   * Resolve effective max_tokens value with priority:
+   * 1. Session settings (if provided)
+   * 2. Global model parameters (if enabled)
+   * 3. Model's maxTokens from provider config
+   * 4. Discovered models cache (from API)
+   * 5. undefined - let API use its default
+   */
+  async resolveEffectiveMaxTokens(providerId, modelId, sessionMaxTokens) {
+    return resolveEffectiveMaxTokens(
+      this.llmConfig,
+      this.getProvider.bind(this),
+      this.logger,
+      providerId,
+      modelId,
+      sessionMaxTokens
+    );
+  }
+  /**
+   * Get required max_tokens for providers that need it (e.g., Anthropic)
+   * Falls back to DEFAULT_MAX_TOKENS if no value is configured
+   */
+  async getRequiredMaxTokens(providerId, modelId, sessionMaxTokens) {
+    return getRequiredMaxTokens(
+      this.llmConfig,
+      this.getProvider.bind(this),
+      this.logger,
+      providerId,
+      modelId,
+      sessionMaxTokens
+    );
+  }
+  /**
+   * Calculate thinking budget and adjust max_tokens for the provider
+   */
+  async resolveThinkingBudget(providerId, modelId, maxTokens, thinkLevel) {
+    return resolveThinkingBudget(
+      this.getProvider.bind(this),
+      this.logger,
+      providerId,
+      modelId,
+      maxTokens,
+      thinkLevel
+    );
+  }
+  // --------------------------------------------------------------------------
+  // Transformer Chain Completion
+  // --------------------------------------------------------------------------
+  /**
+   * Send a completion request using transformer chain
+   */
+  async completeWithTransformers(options) {
+    return completeWithTransformers(
+      options,
+      this.llmConfig,
+      this.getProvider.bind(this),
+      this.resolveApiKey.bind(this),
+      this.complete.bind(this),
+      this.logger,
+      this.usageRecorder ? { recorder: this.usageRecorder } : void 0
+    );
+  }
+  /**
+   * Send a streaming completion request using transformer chain
+   */
+  async completeStreamWithTransformers(options, callbacks) {
+    return completeStreamWithTransformers(
+      options,
+      callbacks,
+      this.llmConfig,
+      this.getProvider.bind(this),
+      this.resolveApiKey.bind(this),
+      this.completeStream.bind(this),
+      this.logger,
+      this.usageRecorder ? { recorder: this.usageRecorder } : void 0
+    );
+  }
+  // --------------------------------------------------------------------------
+  // Tool-based Completion
+  // --------------------------------------------------------------------------
+  /**
+   * Stream completion with MCP tools support (direct API call)
+   * Implements agentic loop: calls LLM -> executes tools -> calls LLM again until done
+   */
+  async streamWithTools(options, callbacks, mcpService, builtinExecutor) {
+    return streamWithTools(
+      options,
+      callbacks,
+      mcpService,
+      this.llmConfig,
+      this.getProvider.bind(this),
+      this.resolveApiKey.bind(this),
+      this.logger,
+      builtinExecutor
+    );
+  }
+};
+
+export {
+  CompletionService,
+  register,
+  emit,
+  attach,
+  release,
+  convertMessageToOpenAI,
+  convertMessageToAnthropic,
+  convertMessageToGemini,
+  getOpenRouterProviderConfig,
+  addOpenRouterProviderToRequest,
+  DEFAULT_ROUTE_IDLE_MS,
+  ProviderProxyRouteMap,
+  getSharedExecutor,
+  getResponsesEndpointTransformer,
+  getAnthropicEndpointTransformer,
+  getGeminiEndpointTransformer,
+  readBody,
+  relayResponse,
+  writeError,
+  resolvePoolBoundKey,
+  extractRouteToken,
+  isLoopbackAddress,
+  ProviderProxy,
+  getProviderProxy,
+  __resetProviderProxyForTests,
+  hashKey,
+  createNamedKey,
+  verifyPresentedKey,
+  detectRequestRole,
+  endpointToIngressFormat,
+  OutboundRateLimiter,
+  DEFAULT_OUTBOUND_PORT,
+  OutboundApiServer,
+  formatUrls,
+  OUTBOUND_API_SERVER_CONFIG_KEY,
+  defaultServerConfig,
+  normalizeServerConfig,
+  loadServerConfig,
+  saveServerConfig,
+  mergeServerConfig,
+  getOutboundApiServer,
+  __resetOutboundApiServerForTests
+};