@pasko70/pibo 3.5.0 → 3.5.1

package/dist/reliability/store.js

@@ -44,12 +44,14 @@ function ensurePiboJobColumn(db, name, definition) {
         db.exec(`ALTER TABLE pibo_jobs ADD COLUMN ${name} ${definition}`);
 }
 export class PiboReliabilityStore {
+    options;
     db;
     appendEventStatement;
     getEventByStreamIdStatement;
     getEventByTopicEventIdStatement;
     getEventByTopicIdempotencyKeyStatement;
-    constructor(path = piboHomePath("pibo-events.sqlite")) {
+    constructor(path = piboHomePath("pibo-events.sqlite"), options = {}) {
+        this.options = options;
         const resolvedPath = path === ":memory:" ? path : resolve(path);
         const insidePiboHome = ensurePrivatePiboHomeForPath(resolvedPath);
         if (resolvedPath !== ":memory:")
@@ -571,6 +573,38 @@ export class PiboReliabilityStore {
         }
         return jobs;
     }
+    inspectJobs(input = {}) {
+        const timestamp = now();
+        return this.listJobs(input).map((job) => this.inspectJob(job, timestamp));
+    }
+    reconcileOrphanRunJobs(input) {
+        const checkedAt = asDate(input.now).toISOString();
+        return this.inImmediateTransaction(() => this.reconcileOrphanRunJobsInTransaction(checkedAt, input.apply));
+    }
+    getRunJobReliabilityStatus() {
+        const timestamp = now();
+        const expired = this.db.prepare(`
+			SELECT COUNT(*) AS count
+			FROM pibo_jobs AS job
+			LEFT JOIN pibo_runs AS run ON run.job_id = job.job_id
+			WHERE job.queue = 'runs'
+				AND job.state = 'running'
+				AND job.claim_expires_at IS NOT NULL
+				AND job.claim_expires_at <= ?
+				AND run.run_id IS NULL
+		`).get(timestamp);
+        const dead = this.db.prepare(`
+			SELECT COUNT(*) AS count FROM pibo_dead_jobs
+			WHERE queue = 'runs' AND dead_reason = 'orphan_run_job'
+		`).get();
+        const expiredOrphanRunJobs = Number(expired.count);
+        const orphanRunDeadLetters = Number(dead.count);
+        return {
+            status: expiredOrphanRunJobs > 0 || orphanRunDeadLetters > 0 ? "degraded" : "ok",
+            expiredOrphanRunJobs,
+            orphanRunDeadLetters,
+        };
+    }
     listRecoverableJobs(input = {}) {
         const timestamp = now();
         const clauses = [
@@ -683,28 +717,37 @@ export class PiboReliabilityStore {
         const runId = input.runId ?? `run_${randomUUID()}`;
         const maxAttempts = Math.max(1, input.maxAttempts ?? 1);
         const timeoutAt = input.timeoutMs === undefined ? undefined : new Date(Date.parse(timestamp) + input.timeoutMs).toISOString();
-        const job = this.enqueue({
-            queue: "runs",
-            payload: {
-                runId,
-                controllerPiboSessionId: input.controllerPiboSessionId,
-                toolName: input.toolName,
-                params: input.params,
-                timeoutMs: input.timeoutMs,
-            },
-            maxAttempts,
+        return this.inImmediateTransaction(() => {
+            const job = this.enqueue({
+                queue: "runs",
+                runAt: timestamp,
+                payload: {
+                    runId,
+                    controllerPiboSessionId: input.controllerPiboSessionId,
+                    toolName: input.toolName,
+                    params: input.params,
+                    timeoutMs: input.timeoutMs,
+                },
+                maxAttempts,
+            });
+            this.options.onRunCreationBoundary?.("after_enqueue");
+            const claimed = this.claimPendingJobInTransaction(job.jobId, input.workerId ?? `run-registry:${process.pid}`, timestamp, 24 * 60 * 60 * 1000);
+            if (!claimed)
+                throw new Error(`Failed to claim newly-created run job "${job.jobId}"`);
+            this.options.onRunCreationBoundary?.("after_claim");
+            this.options.onRunCreationBoundary?.("before_run_insert");
+            this.db
+                .prepare(`
+					INSERT INTO pibo_runs (
+						run_id, kind, controller_pibo_session_id, status, completion_policy, consumed, tool_name,
+						summary, result_json, error, notified_status, acknowledged_status, created_at, updated_at,
+						completed_at, job_id, retryable, max_attempts, timeout_ms, timeout_at, timeout_phase, service_warning, resource_json, origin_json
+					) VALUES (?, 'tool', ?, 'running', ?, 0, ?, ?, NULL, NULL, NULL, NULL, ?, ?, NULL, ?, ?, ?, ?, ?, NULL, ?, ?, ?)
+				`)
+                .run(runId, input.controllerPiboSessionId, input.completionPolicy, input.toolName, `${input.toolName} run is running.`, timestamp, timestamp, job.jobId, input.retryable ? 1 : 0, maxAttempts, input.timeoutMs ?? null, timeoutAt ?? null, input.serviceWarning ?? null, input.resources ? JSON.stringify(input.resources) : null, input.origin ? JSON.stringify(input.origin) : null);
+            this.options.onRunCreationBoundary?.("after_run_insert");
+            return this.requireRun(runId);
         });
-        this.db
-            .prepare(`
-				INSERT INTO pibo_runs (
-					run_id, kind, controller_pibo_session_id, status, completion_policy, consumed, tool_name,
-					summary, result_json, error, notified_status, acknowledged_status, created_at, updated_at,
-					completed_at, job_id, retryable, max_attempts, timeout_ms, timeout_at, timeout_phase, service_warning, resource_json, origin_json
-				) VALUES (?, 'tool', ?, 'running', ?, 0, ?, ?, NULL, NULL, NULL, NULL, ?, ?, NULL, ?, ?, ?, ?, ?, NULL, ?, ?, ?)
-			`)
-            .run(runId, input.controllerPiboSessionId, input.completionPolicy, input.toolName, `${input.toolName} run is running.`, timestamp, timestamp, job.jobId, input.retryable ? 1 : 0, maxAttempts, input.timeoutMs ?? null, timeoutAt ?? null, input.serviceWarning ?? null, input.resources ? JSON.stringify(input.resources) : null, input.origin ? JSON.stringify(input.origin) : null);
-        this.claimJob(job.jobId, input.workerId ?? `run-registry:${process.pid}`, 24 * 60 * 60 * 1000);
-        return this.requireRun(runId);
     }
     updateRun(runId, patch) {
         const existing = this.getRun(runId);
@@ -779,9 +822,10 @@ export class PiboReliabilityStore {
     }
     recoverInterruptedRuns(workerId = `run-registry:${process.pid}`) {
         return this.inImmediateTransaction(() => {
+            const timestamp = now();
+            this.reconcileOrphanRunJobsInTransaction(timestamp, true);
             const rows = this.db.prepare("SELECT * FROM pibo_runs WHERE status = 'running'").all();
             const recovered = [];
-            const timestamp = now();
             for (const row of rows) {
                 if (row.job_id && this.hasUnexpiredJobClaim(row.job_id, timestamp, workerId))
                     continue;
@@ -883,6 +927,58 @@ export class PiboReliabilityStore {
 			`)
             .get(jobId, workerId, claimToken ?? null, claimToken ?? null, timestamp);
     }
+    claimPendingJobInTransaction(jobId, workerId, timestamp, visibilityTimeoutMs) {
+        const claimExpiresAt = new Date(Date.parse(timestamp) + visibilityTimeoutMs).toISOString();
+        return this.db.prepare(`
+			UPDATE pibo_jobs
+			SET state = 'running',
+				worker_id = ?,
+				claim_expires_at = ?,
+				claim_token = claim_token + 1,
+				attempts = attempts + 1,
+				updated_at = ?
+			WHERE job_id = ?
+				AND state = 'pending'
+				AND run_at <= ?
+				AND attempts < max_attempts
+				AND (expires_at IS NULL OR expires_at > ?)
+			RETURNING *
+		`).get(workerId, claimExpiresAt, timestamp, jobId, timestamp, timestamp);
+    }
+    inspectJob(job, timestamp) {
+        const claimExpired = job.state === "running"
+            && (!job.claimExpiresAt || job.claimExpiresAt <= timestamp);
+        const missingRunRecord = job.queue === "runs"
+            && this.db.prepare("SELECT 1 AS found FROM pibo_runs WHERE job_id = ? LIMIT 1").get(job.jobId) === undefined;
+        let effectiveLiveness;
+        if (job.state === "pending")
+            effectiveLiveness = missingRunRecord ? "orphan_pending" : "pending";
+        else if (claimExpired)
+            effectiveLiveness = missingRunRecord ? "expired_orphan" : "expired_claim";
+        else
+            effectiveLiveness = missingRunRecord ? "live_orphan_claim" : "live_claim";
+        return { ...job, claimExpired, missingRunRecord, effectiveLiveness };
+    }
+    reconcileOrphanRunJobsInTransaction(timestamp, apply) {
+        const rows = this.db.prepare(`
+			SELECT job.*
+			FROM pibo_jobs AS job
+			LEFT JOIN pibo_runs AS run ON run.job_id = job.job_id
+			WHERE job.queue = 'runs'
+				AND job.state = 'running'
+				AND job.claim_expires_at IS NOT NULL
+				AND job.claim_expires_at <= ?
+				AND run.run_id IS NULL
+			ORDER BY job.created_at ASC, job.job_id ASC
+		`).all(timestamp);
+        const candidates = rows.map((row) => this.inspectJob(jobFromRow(row), timestamp));
+        if (apply) {
+            for (const row of rows) {
+                this.moveJobToDead(row, "Expired runs job has no matching pibo_runs record.", "orphan_run_job", timestamp);
+            }
+        }
+        return { checkedAt: timestamp, apply, candidates, moved: apply ? rows.length : 0 };
+    }
     moveExpiredJobs(timestamp) {
         const expired = this.db.prepare("SELECT * FROM pibo_jobs WHERE expires_at IS NOT NULL AND expires_at <= ?").all(timestamp);
         for (const row of expired)

package/dist/session-ui/terminalRows.js

@@ -23,8 +23,8 @@ export function buildCompactTerminalRows(traceView, options) {
     const candidates = syncThinkingToolRows(flatNodes.map((item) => createRowCandidate(item.node, item.turnId)));
     applyCompletedTurnTiming(candidates, turnById);
     const reconciled = reconcileConceptualRowCandidates(candidates);
-    const rows = !showToolDebugMetrics && (options.toolDisplayMode ?? "default") === "default"
-        ? groupRelatedToolCandidates(reconciled).map((candidate) => candidate.row)
+    const rows = (options.toolDisplayMode ?? "default") === "default"
+        ? groupRelatedToolCandidates(reconciled, showToolDebugMetrics).map((candidate) => candidate.row)
         : reconciled.map((candidate) => candidate.row);
     return applyToolDisplayMode(rows, options.toolDisplayMode ?? "default");
 }
@@ -942,12 +942,12 @@ function isThinkingOutput(value) {
 function isThinkingLevelSetOutput(value) {
     return isRecord(value) && value.action === "set_thinking_level";
 }
-function groupRelatedToolCandidates(candidates) {
+function groupRelatedToolCandidates(candidates, imagesOnly = false) {
     const grouped = [];
     for (let index = 0; index < candidates.length; index += 1) {
         const candidate = candidates[index];
         const groupKind = candidateGroupKind(candidate);
-        if (!groupKind) {
+        if (!groupKind || (imagesOnly && groupKind !== "images")) {
             grouped.push(candidate);
             continue;
         }
@@ -1028,21 +1028,20 @@ function createImageGroup(candidates) {
     const omittedDetailCount = Math.max(0, detailItems.length - visibleDetailItems.length);
     const firstRow = candidates[0]?.row;
     const firstId = firstRow?.id ?? "images";
-    const lastId = candidates[candidates.length - 1]?.row.id ?? firstId;
     const status = candidates.some((candidate) => candidate.row.status === "running")
         ? "running"
         : candidates.some((candidate) => candidate.row.status === "error")
             ? "error"
             : "done";
     return {
-        id: `group:images:${firstId}:${lastId}`,
+        id: firstId,
         kind: "tool.group.images",
         status,
         errorKind: status === "error" ? "tool" : undefined,
         lines: [
             {
                 prefix: "bullet",
-                tokens: [token(status === "running" ? "Viewing images" : status === "error" ? "Image reads failed" : "Viewed images", toneForStatus(status), "semibold")],
+                tokens: [token(status === "running" ? `Viewing ${detailItems.length} images` : status === "error" ? `${detailItems.length} image reads · error` : `${detailItems.length} ${detailItems.length === 1 ? "Image Viewed" : "Images Viewed"}`, toneForStatus(status), "semibold")],
             },
             ...visibleDetailItems.map((item, index) => ({
                 prefix: index === 0 ? "detail" : "continuation",
@@ -1062,7 +1061,7 @@ function createImageGroup(candidates) {
         orderStreamFrameIndex: firstRow?.orderStreamFrameIndex,
         detailItems,
         expandable: detailItems.some((item) => item.toolCallReference || item.input !== undefined || item.output !== undefined || Boolean(item.error)),
-        imagePreviews: detailItems.flatMap((item) => item.imagePreviews ?? []).slice(0, MAX_COMPACT_TERMINAL_IMAGE_PREVIEWS),
+        imagePreviews: detailItems.flatMap((item) => item.imagePreviews ?? []),
         previewOmission: omittedDetailCount > 0 ? {
             source: "details",
             visibleLineCount: visibleDetailItems.length,

package/dist/sessions/pibo-data-store.js

@@ -227,21 +227,21 @@ export class PiboDataSessionStore {
                 if (typeof index !== "number" || !Number.isSafeInteger(index) || index < 0)
                     continue;
                 maximum = Math.max(maximum, index);
-                persistedParts.push({ index, attributes });
+                persistedParts.push({ index, type: row.type, attributes });
             }
-            // An unfinished durable part may still belong to another process. Only a
-            // completed turn provides enough evidence to reattach an exact replay.
-            if (turnCompleted) {
-                const matchesReplay = ({ attributes }) => attributes.outputPartFingerprint === input.fingerprint
-                    || attributes.identityFingerprint === input.identityFingerprint;
-                const replay = (input.suppliedIndex === undefined
-                    ? undefined
-                    : persistedParts.find((part) => part.index === input.suppliedIndex && matchesReplay(part)))
-                    ?? persistedParts.find(matchesReplay);
-                if (replay) {
-                    this.observeOutputPartIndex(input, replay.index);
-                    return replay.index;
-                }
+            // A completed turn or an exact terminal-part fingerprint is durable
+            // evidence for replay. Nonterminal parts remain unattached while the turn
+            // is open because another producer may still own them.
+            const matchesReplay = ({ type, attributes }) => (turnCompleted || outputPartEventIsTerminal(type))
+                && (attributes.outputPartFingerprint === input.fingerprint
+                    || attributes.identityFingerprint === input.identityFingerprint);
+            const replay = (input.suppliedIndex === undefined
+                ? undefined
+                : persistedParts.find((part) => part.index === input.suppliedIndex && matchesReplay(part)))
+                ?? (turnCompleted ? persistedParts.find(matchesReplay) : undefined);
+            if (replay) {
+                this.observeOutputPartIndex(input, replay.index);
+                return replay.index;
             }
             const minimum = Math.max(input.proposedIndex, maximum + 1);
             const row = this.db.prepare(`
@@ -538,6 +538,7 @@ export class PiboDataSessionStore {
                         actorId: session.id,
                         event,
                         createdAt: at,
+                        persistenceProvenance: { producer: "runtime-recovery", projection: "product-history", phase: "startup-recovery" },
                     });
                 results.push({
                     turnId: recovered.turn.turnId,
@@ -726,6 +727,9 @@ function outputPartEventTypes(kind) {
         case "compaction": return ["compaction_start", "compaction_end"];
     }
 }
+function outputPartEventIsTerminal(type) {
+    return type === "assistant_message" || type === "thinking_finished" || type === "assistant_usage" || type === "compaction_end";
+}
 function parseJsonObject(json) {
     if (!json)
         return {};

package/dist/shared/trace-event-projection.js

@@ -539,15 +539,25 @@ export function latestTraceStreamId(events, initial) {
 function attachModelInferenceToLatestOutput(nodes, byId, event, storedEvent) {
     const eventId = event.eventId;
     const candidates = flattenTraceNodes(nodes)
-        .filter((node) => node.eventId === eventId && traceNodeStartedBeforeInference(node, storedEvent) && (node.type === "assistant.message"
+        .filter((node) => node.eventId === eventId && (event.inferenceTarget || traceNodeStartedBeforeInference(node, storedEvent)) && (node.type === "assistant.message"
         || node.type === "model.reasoning"
         || node.type === "tool.call"
         || node.type === "agent.delegation"))
         .sort(compareTraceNodes);
-    const target = candidates.at(-1) ?? (eventId ? byId.get(messageTurnNodeId(eventId)) : undefined);
+    const anchor = event.inferenceTarget;
+    const turnNode = eventId ? byId.get(messageTurnNodeId(eventId)) : undefined;
+    const target = anchor
+        ? (anchor.type === "tool"
+            ? candidates.find((node) => node.toolCallId === anchor.toolCallId)
+            : anchor.type === "assistant"
+                ? candidates.find((node) => node.stableKey === `assistant:${eventId}:assistant:${anchor.assistantIndex}`)
+                : turnNode) ?? turnNode
+        : candidates.at(-1) ?? turnNode;
     if (!target)
         return;
-    const id = eventId ? `${eventId}:usage:${event.usageIndex ?? 0}` : storedEvent.id;
+    const id = event.inferenceId
+        ? `${eventId ?? storedEvent.piboSessionId}:inference:${event.inferenceId}`
+        : eventId ? `${eventId}:usage:${event.usageIndex ?? 0}` : storedEvent.id;
     const record = {
         id,
         completedAt: storedEvent.createdAt,

package/dist/web/channel.js

@@ -191,16 +191,31 @@ function createGatewayRuntimeStatuses(channelContext) {
         }
     });
 }
-function createGatewayStatusResponse(channelContext, options, generation) {
+async function createGatewayStatusResponse(channelContext, options, generation) {
     const mode = gatewayMode(options);
+    const appStatuses = {};
+    for (const app of channelContext.getWebApps()) {
+        if (!app.gatewayStatus)
+            continue;
+        try {
+            Object.assign(appStatuses, await app.gatewayStatus());
+        }
+        catch (error) {
+            appStatuses[`${app.name}Status`] = { status: "ambiguous", error: error instanceof Error ? error.message : "Status unavailable" };
+        }
+    }
+    const durable = appStatuses.durableMessageQueue;
     return responseJson({
-        status: "ok",
+        status: durable?.status === "degraded" || durable?.status === "ambiguous" ? "degraded" : "ok",
         mode,
         generation,
-        health: { status: "ok", mode },
+        health: { status: durable?.status === "degraded" || durable?.status === "ambiguous" ? "degraded" : "ok", mode },
+        runtimeQueue: { layer: "runtime-session", statuses: createGatewayRuntimeStatuses(channelContext) },
         runtimeStatuses: createGatewayRuntimeStatuses(channelContext),
         ...(channelContext.getRuntimeCapacityStatus ? { runtimeCapacity: channelContext.getRuntimeCapacityStatus() } : {}),
+        ...(channelContext.getRunJobReliabilityStatus ? { reliability: channelContext.getRunJobReliabilityStatus() } : {}),
         activeRuns: collectActiveRuns(channelContext),
+        ...appStatuses,
     });
 }
 function createCanonicalRedirect(request, canonicalBaseURL) {
@@ -218,6 +233,68 @@ function createCanonicalRedirect(request, canonicalBaseURL) {
 function isEventStreamResponse(response) {
     return response.headers.get("content-type")?.toLowerCase().startsWith("text/event-stream") === true;
 }
+function responseCanStart(response) {
+    return !response.destroyed && !response.writableEnded && !response.writableFinished && !response.headersSent;
+}
+function responseState(response) {
+    return [
+        `destroyed=${response.destroyed}`,
+        `writableEnded=${response.writableEnded}`,
+        `writableFinished=${response.writableFinished}`,
+        `headersSent=${response.headersSent}`,
+    ].join(",");
+}
+function requestPath(request) {
+    return (request.url ?? "/").split(/[?#]/, 1)[0].slice(0, 256).replace(/[\r\n]/g, "_");
+}
+function errorIdentity(error) {
+    try {
+        if (!(error instanceof Error))
+            return typeof error;
+        const rawName = typeof error.name === "string" ? error.name : "Error";
+        const name = rawName.replace(/[^A-Za-z0-9_.-]/g, "").slice(0, 64) || "Error";
+        const code = "code" in error && typeof error.code === "string" ? error.code.replace(/[^A-Za-z0-9_-]/g, "").slice(0, 64) : undefined;
+        return code ? `${name}:${code}` : name;
+    }
+    catch {
+        return "Error";
+    }
+}
+function logHttpBoundaryFailure(phase, request, error, response) {
+    try {
+        const method = (request.method ?? "UNKNOWN").replace(/[^A-Z]/gi, "").slice(0, 16) || "UNKNOWN";
+        const state = response ? ` response={${responseState(response)}}` : "";
+        console.error(`[web-host] contained ${phase} failure method=${method} path=${requestPath(request)} error=${errorIdentity(error)}${state}`);
+    }
+    catch {
+        // Diagnostics are best-effort and must never reopen the request rejection path.
+    }
+}
+function terminateResponse(response, error) {
+    if (response.destroyed || response.writableEnded || response.writableFinished)
+        return;
+    try {
+        response.destroy(error instanceof Error ? error : undefined);
+    }
+    catch {
+        // A broken response implementation must not escape the request boundary.
+    }
+}
+function endUpgradeSocket(socket, statusLine) {
+    if (socket.destroyed)
+        return;
+    try {
+        socket.end(statusLine);
+    }
+    catch {
+        try {
+            socket.destroy();
+        }
+        catch {
+            // A broken socket implementation must not escape the upgrade boundary.
+        }
+    }
+}
 async function waitForServerClose(closePromise, timeoutMs) {
     return await new Promise((resolve, reject) => {
         let settled = false;
@@ -323,7 +400,7 @@ export function createWebHostChannel(options = {}) {
                 return;
             }
             if (url.pathname === "/gateway/status") {
-                await sendResponse(nodeResponse, createGatewayStatusResponse(requireContext(), options, generation));
+                await sendResponse(nodeResponse, await createGatewayStatusResponse(requireContext(), options, generation));
                 return;
             }
             if (url.pathname.startsWith("/api/auth/")) {
@@ -360,8 +437,18 @@ export function createWebHostChannel(options = {}) {
         }
         catch (error) {
             const status = error instanceof PiboAuthError || error instanceof PiboWebHttpError ? error.statusCode : 500;
-            if (!nodeResponse.destroyed) {
-                await sendResponse(nodeResponse, responseJson({ error: error instanceof Error ? error.message : String(error) }, { status }));
+            logHttpBoundaryFailure("request", nodeRequest, error, nodeResponse);
+            if (responseCanStart(nodeResponse)) {
+                try {
+                    await sendResponse(nodeResponse, responseJson({ error: error instanceof Error ? error.message : String(error) }, { status }));
+                }
+                catch (responseError) {
+                    logHttpBoundaryFailure("error-response", nodeRequest, responseError, nodeResponse);
+                    terminateResponse(nodeResponse, responseError);
+                }
+            }
+            else {
+                terminateResponse(nodeResponse, error);
             }
         }
         finally {
@@ -384,10 +471,9 @@ export function createWebHostChannel(options = {}) {
             await app.handleUpgrade(nodeRequest, socket, head, createAppContext(ctx), requestURL);
         }
         catch (error) {
-            if (!socket.destroyed) {
-                const unauthorized = error instanceof PiboAuthError || error instanceof PiboWebHttpError;
-                socket.end(`HTTP/1.1 ${unauthorized ? 401 : 502} ${unauthorized ? "Unauthorized" : "Bad Gateway"}\r\nConnection: close\r\n\r\n`);
-            }
+            logHttpBoundaryFailure("upgrade", nodeRequest, error);
+            const unauthorized = error instanceof PiboAuthError || error instanceof PiboWebHttpError;
+            endUpgradeSocket(socket, `HTTP/1.1 ${unauthorized ? 401 : 502} ${unauthorized ? "Unauthorized" : "Bad Gateway"}\r\nConnection: close\r\n\r\n`);
         }
     };
     return {
@@ -405,10 +491,26 @@ export function createWebHostChannel(options = {}) {
             for (const app of channelContext.getWebApps())
                 await app.initialize?.(createAppContext(channelContext));
             server = createServer((request, response) => {
-                void handleRequest(request, response);
+                void handleRequest(request, response).catch((error) => {
+                    try {
+                        logHttpBoundaryFailure("request-terminal", request, error, response);
+                        terminateResponse(response, error);
+                    }
+                    catch {
+                        // The terminal request boundary itself is intentionally nonthrowing.
+                    }
+                });
             });
             server.on("upgrade", (request, socket, head) => {
-                void handleUpgrade(request, socket, head);
+                void handleUpgrade(request, socket, head).catch((error) => {
+                    try {
+                        logHttpBoundaryFailure("upgrade-terminal", request, error);
+                        endUpgradeSocket(socket);
+                    }
+                    catch {
+                        // The terminal upgrade boundary itself is intentionally nonthrowing.
+                    }
+                });
             });
             server.on("connection", (socket) => {
                 sockets.add(socket);