@sentropic/remote-cli 0.0.3

package/dist/llm-gateway-runtime/index.js

@@ -0,0 +1,1295 @@
+import "../chunk-3RG5ZIWI.js";
+
+// src/llm-gateway-runtime/index.ts
+import { serve } from "@hono/node-server";
+import { Hono } from "hono";
+
+// src/llm-gateway-runtime/sticky.ts
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { dirname } from "path";
+import { createHmac, timingSafeEqual } from "crypto";
+
+// src/llm-gateway-runtime/accounts.ts
+function isUnsupportedClaudeOAuthAccount(account) {
+  return account.provider === "anthropic" && (account.authType === "bearer" || account.id === "claude-oauth" || account.token.startsWith("sk-ant-oat"));
+}
+function parse() {
+  const raw = process.env.GATEWAY_ACCOUNTS;
+  if (!raw) throw new Error("GATEWAY_ACCOUNTS env var is required");
+  const list = JSON.parse(raw);
+  if (!Array.isArray(list) || list.length === 0)
+    throw new Error("GATEWAY_ACCOUNTS must be a non-empty JSON array");
+  const accounts = list.filter(
+    (account) => !isUnsupportedClaudeOAuthAccount(account)
+  );
+  if (accounts.length === 0) {
+    throw new Error(
+      "GATEWAY_ACCOUNTS has no supported accounts: Claude Code OAuth is not a supported upstream transport"
+    );
+  }
+  return accounts;
+}
+var _accounts = null;
+function getAccounts() {
+  if (!_accounts) _accounts = parse();
+  return _accounts;
+}
+var _rrIdx = 0;
+function selectAccount() {
+  const accounts = getAccounts();
+  const acct = accounts[_rrIdx % accounts.length];
+  _rrIdx++;
+  return acct;
+}
+function findAccount(accountId) {
+  return getAccounts().find((a) => a.id === accountId);
+}
+function updateAccountToken(accountId, newToken, expiresAt) {
+  const accounts = getAccounts();
+  const acc = accounts.find((a) => a.id === accountId);
+  if (!acc) return;
+  acc.token = newToken;
+  if (expiresAt !== void 0) acc.expiresAt = expiresAt;
+}
+function jwtExpiry(token) {
+  try {
+    const parts = token.split(".");
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (typeof payload.exp === "number") return new Date(payload.exp * 1e3).toISOString();
+  } catch {
+  }
+  return void 0;
+}
+async function refreshOAuthToken(accountId) {
+  const acc = findAccount(accountId);
+  if (!acc?.refreshToken) return null;
+  let resp;
+  try {
+    resp = await fetch("https://auth.openai.com/oauth/token", {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: acc.refreshToken,
+        client_id: "app_EMoamEEZ73f0CkXaXp7hrann"
+      })
+    });
+  } catch (err) {
+    console.error(`[llm-gateway] OAuth refresh network error for ${accountId}:`, err);
+    return null;
+  }
+  if (!resp.ok) {
+    const body = await resp.text().catch(() => "");
+    console.error(`[llm-gateway] OAuth refresh failed (${resp.status}) for ${accountId}: ${body}`);
+    return null;
+  }
+  const data = await resp.json();
+  if (!data.access_token) {
+    console.error(`[llm-gateway] OAuth refresh: no access_token in response for ${accountId}`);
+    return null;
+  }
+  const expiresAt = jwtExpiry(data.access_token);
+  updateAccountToken(accountId, data.access_token, expiresAt);
+  console.log(`[llm-gateway] OAuth token refreshed for ${accountId}${expiresAt ? `, expires ${expiresAt}` : ""}`);
+  return data.access_token;
+}
+
+// src/llm-gateway-runtime/sticky.ts
+var SA_TOKEN_PATH = "/var/run/secrets/kubernetes.io/serviceaccount/token";
+var K8S_HOST = process.env.KUBERNETES_SERVICE_HOST ?? "kubernetes.default.svc.cluster.local";
+var K8S_PORT = process.env.KUBERNETES_SERVICE_PORT ?? "443";
+var NAMESPACE = process.env.POD_NAMESPACE ?? "sentropic-remote";
+var CONFIGMAP_NAME = process.env.STICKY_CONFIGMAP ?? "llm-gateway-sticky";
+var LOCAL_STICKY_FILE = process.env.LLM_GATEWAY_STICKY_FILE;
+function saToken() {
+  try {
+    return readFileSync(SA_TOKEN_PATH, "utf-8").trim();
+  } catch {
+    return process.env.K8S_TOKEN ?? "";
+  }
+}
+function cmUrl() {
+  return `https://${K8S_HOST}:${K8S_PORT}/api/v1/namespaces/${NAMESPACE}/configmaps/${CONFIGMAP_NAME}`;
+}
+function readLocalSticky() {
+  if (!LOCAL_STICKY_FILE) return {};
+  try {
+    return JSON.parse(readFileSync(LOCAL_STICKY_FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeLocalSticky(data) {
+  if (!LOCAL_STICKY_FILE) return;
+  mkdirSync(dirname(LOCAL_STICKY_FILE), { recursive: true });
+  const tmp = `${LOCAL_STICKY_FILE}.tmp.${process.pid}`;
+  writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+  chmodSync(tmp, 384);
+  renameSync(tmp, LOCAL_STICKY_FILE);
+}
+async function readSticky() {
+  const token = saToken();
+  if (!token) return readLocalSticky();
+  const resp = await fetch(cmUrl(), {
+    headers: { Authorization: `Bearer ${token}` }
+  });
+  if (resp.status === 404) return {};
+  if (!resp.ok) throw new Error(`sticky ConfigMap read failed: ${resp.status}`);
+  const cm = await resp.json();
+  return cm.data ?? {};
+}
+async function writeSticky(sessionId, accountId) {
+  const token = saToken();
+  if (!token) {
+    writeLocalSticky({ ...readLocalSticky(), [sessionId]: accountId });
+    return;
+  }
+  const patch = {
+    apiVersion: "v1",
+    kind: "ConfigMap",
+    metadata: { name: CONFIGMAP_NAME, namespace: NAMESPACE },
+    data: { [sessionId]: accountId }
+  };
+  const resp = await fetch(cmUrl(), {
+    method: "PATCH",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/strategic-merge-patch+json"
+    },
+    body: JSON.stringify(patch)
+  });
+  if (!resp.ok) throw new Error(`sticky ConfigMap patch failed: ${resp.status}`);
+}
+var _sessions = /* @__PURE__ */ new Map();
+var TOKEN_PREFIX = "gw-v1-";
+function tokenSeed() {
+  const seed = process.env.LLM_GATEWAY_TOKEN_SEED;
+  if (!seed) throw new Error("LLM_GATEWAY_TOKEN_SEED env var is required");
+  return seed;
+}
+function b64url(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+function unb64url(value) {
+  try {
+    return Buffer.from(value, "base64url").toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function macFor(sessionId) {
+  return createHmac("sha256", tokenSeed()).update("gw-token-v1\0").update(sessionId).digest("base64url");
+}
+function gatewayTokenForSession(sessionId) {
+  return `${TOKEN_PREFIX}${b64url(sessionId)}.${macFor(sessionId)}`;
+}
+function sessionIdFromGatewayToken(gatewayToken) {
+  if (!gatewayToken.startsWith(TOKEN_PREFIX)) return null;
+  const rest = gatewayToken.slice(TOKEN_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot <= 0) return null;
+  const encodedSessionId = rest.slice(0, dot);
+  const suppliedMac = rest.slice(dot + 1);
+  const sessionId = unb64url(encodedSessionId);
+  if (!sessionId) return null;
+  const expectedMac = macFor(sessionId);
+  const a = Buffer.from(suppliedMac);
+  const b = Buffer.from(expectedMac);
+  if (a.length !== b.length || !timingSafeEqual(a, b)) return null;
+  return sessionId;
+}
+function sessionCount() {
+  return _sessions.size;
+}
+async function lookupToken(gatewayToken) {
+  const cached = _sessions.get(gatewayToken);
+  if (cached) return cached;
+  const sessionId = sessionIdFromGatewayToken(gatewayToken);
+  if (!sessionId) return void 0;
+  const existing = await readSticky();
+  const accountId = existing[sessionId];
+  let account = accountId === void 0 ? void 0 : findAccount(accountId);
+  if (!account) {
+    account = selectAccount();
+    await writeSticky(sessionId, account.id);
+  }
+  const entry = {
+    gatewayToken,
+    accountId: account.id,
+    token: account.token,
+    provider: account.provider,
+    ...account.authType ? { authType: account.authType } : {}
+  };
+  _sessions.set(gatewayToken, entry);
+  return entry;
+}
+function updateSessionToken(gatewayToken, newToken) {
+  const entry = _sessions.get(gatewayToken);
+  if (entry) entry.token = newToken;
+}
+async function acquireSession(sessionId) {
+  const existing = await readSticky();
+  let account;
+  const boundId = existing[sessionId];
+  if (boundId !== void 0) {
+    const found = findAccount(boundId);
+    if (found) {
+      account = found;
+    } else {
+      account = selectAccount();
+      await writeSticky(sessionId, account.id);
+    }
+  } else {
+    account = selectAccount();
+    await writeSticky(sessionId, account.id);
+  }
+  const gatewayToken = gatewayTokenForSession(sessionId);
+  _sessions.set(gatewayToken, {
+    gatewayToken,
+    accountId: account.id,
+    token: account.token,
+    provider: account.provider,
+    ...account.authType ? { authType: account.authType } : {}
+  });
+  return { gatewayToken, accountId: account.id };
+}
+
+// src/llm-gateway-runtime/proxy-openai.ts
+import {
+  mapCodexReasoningEffort,
+  prepareCodexResponsesRequest
+} from "@sentropic/llm-gateway";
+var OPENAI_BASE = process.env.OPENAI_UPSTREAM_URL ?? "https://api.openai.com";
+var DEFAULT_CODEX_MAX_INPUT_CHARS = 2e5;
+var CODEX_CONTEXT_TRUNCATION_NOTICE = "[llm-gateway: older Claude Code transcript omitted to fit the Codex upstream context window.]";
+function isCodexOAuthToken(token) {
+  return !token.startsWith("sk-") && token.split(".").length === 3;
+}
+var TRANSIENT_UPSTREAM_ERROR_CODES = /* @__PURE__ */ new Set([
+  "EAI_AGAIN",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "UND_ERR_CONNECT_TIMEOUT",
+  "UND_ERR_HEADERS_TIMEOUT",
+  "UND_ERR_SOCKET"
+]);
+var UPSTREAM_RETRY_DELAYS_MS = process.env.NODE_ENV === "test" ? [0, 0] : [250, 1e3];
+function abortError(err) {
+  return err.name === "AbortError";
+}
+function upstreamErrorCause(err) {
+  const candidate = err;
+  if (candidate.code || candidate.hostname) return candidate;
+  return candidate.cause;
+}
+function upstreamFetchErrorMessage(err) {
+  const cause = upstreamErrorCause(err);
+  if (cause?.code && cause.hostname) return `${cause.code} ${cause.hostname}`;
+  if (cause?.code) return cause.code;
+  if (err instanceof Error && err.message) return err.message;
+  return "unknown upstream fetch error";
+}
+function isTransientUpstreamError(err) {
+  const code = upstreamErrorCause(err)?.code;
+  return !!code && TRANSIENT_UPSTREAM_ERROR_CODES.has(code);
+}
+function anthropicGatewayError(message) {
+  return { type: "error", error: { type: "api_error", message } };
+}
+async function sleep(ms) {
+  if (ms <= 0) return;
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function fetchUpstreamWithRetry(fetcher) {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      return await fetcher();
+    } catch (err) {
+      if (abortError(err) || !isTransientUpstreamError(err) || attempt >= UPSTREAM_RETRY_DELAYS_MS.length) {
+        throw err;
+      }
+      await sleep(UPSTREAM_RETRY_DELAYS_MS[attempt] ?? 0);
+    }
+  }
+}
+var DEFAULT_MODEL_MAP = {
+  "gpt-5.5": "gpt-5.5",
+  "gpt-5.3-codex-spark": "gpt-5.3-codex-spark",
+  "claude-opus-4-8": "gpt-5.5",
+  "claude-opus-4-7": "gpt-5.5",
+  "claude-opus-4-6": "gpt-5.5",
+  "claude-sonnet-4-6": "gpt-5.5",
+  "claude-sonnet-4-5": "gpt-5.5",
+  "claude-haiku-4-5-20251001": "gpt-5.5"
+};
+var _modelMap = null;
+function modelMap() {
+  if (!_modelMap) {
+    _modelMap = process.env.OPENAI_MODEL_MAP ? { ...DEFAULT_MODEL_MAP, ...JSON.parse(process.env.OPENAI_MODEL_MAP) } : DEFAULT_MODEL_MAP;
+  }
+  return _modelMap;
+}
+function mapModel(anthropicModel) {
+  if (anthropicModel.startsWith("gpt-")) return anthropicModel;
+  return modelMap()[anthropicModel] ?? "gpt-5.5";
+}
+function budgetToEffort(budgetTokens) {
+  if (budgetTokens >= 5e4) return "xhigh";
+  if (budgetTokens >= 25e3) return "high";
+  if (budgetTokens >= 8e3) return "medium";
+  return "low";
+}
+function extractAssistantContent(content) {
+  if (typeof content === "string") return { text: content || null, toolCalls: [] };
+  const texts = [];
+  const toolCalls = [];
+  for (const item of content) {
+    if (item.type === "text") {
+      texts.push(item.text);
+    } else if (item.type === "tool_use") {
+      const tc = item;
+      toolCalls.push({
+        id: tc.id,
+        type: "function",
+        function: { name: tc.name, arguments: JSON.stringify(tc.input) }
+      });
+    }
+  }
+  return { text: texts.join("") || null, toolCalls };
+}
+function toOAIMessages(messages) {
+  const result = [];
+  for (const msg of messages) {
+    if (msg.role === "assistant") {
+      const { text, toolCalls } = extractAssistantContent(msg.content);
+      const entry = { role: "assistant", content: text };
+      if (toolCalls.length > 0) entry.tool_calls = toolCalls;
+      result.push(entry);
+    } else {
+      if (Array.isArray(msg.content)) {
+        for (const item of msg.content) {
+          if (item.type === "tool_result") {
+            const tr = item;
+            const c = typeof tr.content === "string" ? tr.content : tr.content.map((b) => b.text).join("");
+            result.push({ role: "tool", tool_call_id: tr.tool_use_id, content: c });
+          }
+        }
+        const textItems = msg.content.filter(
+          (c) => c.type === "text"
+        );
+        if (textItems.length > 0) {
+          result.push({
+            role: "user",
+            content: textItems.map((t) => ({ type: "text", text: t.text }))
+          });
+        }
+      } else {
+        result.push({ role: "user", content: msg.content });
+      }
+    }
+  }
+  return result;
+}
+function systemToText(system) {
+  if (typeof system === "string") return system || void 0;
+  if (!Array.isArray(system)) return void 0;
+  const parts = [];
+  for (const block of system) {
+    if (block.type === "text") {
+      parts.push(block.text);
+    }
+  }
+  return parts.join("\n\n") || void 0;
+}
+function toCodexInput(messages) {
+  const items = [];
+  for (const msg of messages) {
+    if (msg.role === "assistant") {
+      const texts = [];
+      const toolCalls = [];
+      if (typeof msg.content === "string") {
+        if (msg.content) texts.push(msg.content);
+      } else {
+        for (const block of msg.content) {
+          if (block.type === "text") texts.push(block.text);
+          else if (block.type === "tool_use") toolCalls.push(block);
+        }
+      }
+      const text = texts.join("");
+      if (text || toolCalls.length === 0) {
+        items.push({ type: "message", role: "assistant", content: text });
+      }
+      for (const tc of toolCalls) {
+        items.push({ type: "function_call", call_id: tc.id, name: tc.name, arguments: JSON.stringify(tc.input) });
+      }
+    } else {
+      const texts = [];
+      const toolResults = [];
+      if (typeof msg.content === "string") {
+        if (msg.content) texts.push(msg.content);
+      } else {
+        for (const block of msg.content) {
+          if (block.type === "text") texts.push(block.text);
+          else if (block.type === "tool_result") toolResults.push(block);
+        }
+      }
+      for (const tr of toolResults) {
+        const output = typeof tr.content === "string" ? tr.content : tr.content.map((b) => b.text).join("");
+        items.push({ type: "function_call_output", call_id: tr.tool_use_id, output });
+      }
+      const text = texts.join("");
+      if (text) items.push({ type: "message", role: "user", content: text });
+    }
+  }
+  return items;
+}
+function codexEffort(budgetTokens) {
+  return mapCodexReasoningEffort(budgetToEffort(budgetTokens)) ?? "low";
+}
+function toCodexRequest(body) {
+  const req = {
+    model: mapModel(body.model),
+    input: toCodexInput(body.messages),
+    store: false,
+    stream: true
+  };
+  const instructions = systemToText(body.system);
+  if (instructions) req.instructions = instructions;
+  if (body.thinking?.type === "enabled") {
+    req.reasoning = { effort: codexEffort(body.thinking.budget_tokens) };
+  }
+  if (body.tools && body.tools.length > 0) {
+    req.tools = body.tools.map((t) => ({
+      type: "function",
+      name: t.name,
+      ...t.description !== void 0 ? { description: t.description } : {},
+      parameters: t.input_schema,
+      strict: false
+    }));
+  }
+  return req;
+}
+function codexMaxInputChars() {
+  const configured = Number.parseInt(process.env.CODEX_MAX_INPUT_CHARS ?? "", 10);
+  return Number.isFinite(configured) && configured > 0 ? configured : DEFAULT_CODEX_MAX_INPUT_CHARS;
+}
+function anthropicInputChars(body) {
+  return JSON.stringify({ system: body.system, messages: body.messages }).length;
+}
+function trimTextTail(text, budget) {
+  if (text.length <= budget) return text;
+  if (budget <= CODEX_CONTEXT_TRUNCATION_NOTICE.length + 8) {
+    return CODEX_CONTEXT_TRUNCATION_NOTICE.slice(0, Math.max(0, budget));
+  }
+  const prefix = `${CODEX_CONTEXT_TRUNCATION_NOTICE}
+
+`;
+  return prefix + text.slice(-(budget - prefix.length));
+}
+function trimContentTail(content, budget) {
+  if (typeof content === "string") return trimTextTail(content, budget);
+  const kept = [];
+  let remaining = budget;
+  for (let i = content.length - 1; i >= 0; i -= 1) {
+    const block = content[i];
+    const size = JSON.stringify(block).length;
+    if (size <= remaining) {
+      kept.unshift(block);
+      remaining -= size;
+      continue;
+    }
+    if (block.type === "text" && remaining > CODEX_CONTEXT_TRUNCATION_NOTICE.length + 32) {
+      kept.unshift({
+        ...block,
+        text: trimTextTail(block.text, remaining)
+      });
+    }
+    break;
+  }
+  return kept.length > 0 ? kept : [{ type: "text", text: CODEX_CONTEXT_TRUNCATION_NOTICE }];
+}
+function stripLeadingOrphanToolResults(messages) {
+  if (messages.length === 0) return messages;
+  const first = messages[0];
+  if (first.role !== "user" || !Array.isArray(first.content)) return messages;
+  const filtered = first.content.filter((block) => block.type !== "tool_result");
+  if (filtered.length === first.content.length) return messages;
+  if (filtered.length === 0) return messages.slice(1);
+  return [{ ...first, content: filtered }, ...messages.slice(1)];
+}
+function trimCodexBodyForContext(body, maxChars = codexMaxInputChars()) {
+  const beforeChars = anthropicInputChars(body);
+  if (beforeChars <= maxChars) {
+    return { body, trimmed: false, beforeChars, afterChars: beforeChars };
+  }
+  const notice = { role: "user", content: CODEX_CONTEXT_TRUNCATION_NOTICE };
+  const systemChars = JSON.stringify(body.system ?? "").length;
+  const noticeChars = JSON.stringify(notice).length;
+  let remaining = Math.max(1024, maxChars - systemChars - noticeChars);
+  const kept = [];
+  for (let i = body.messages.length - 1; i >= 0; i -= 1) {
+    const message = body.messages[i];
+    const messageChars = JSON.stringify(message).length;
+    if (messageChars <= remaining) {
+      kept.unshift(message);
+      remaining -= messageChars;
+      continue;
+    }
+    if (kept.length === 0 && remaining > 1024) {
+      kept.unshift({ ...message, content: trimContentTail(message.content, remaining) });
+    }
+    break;
+  }
+  const trimmedMessages = stripLeadingOrphanToolResults(kept);
+  const trimmedBody = {
+    ...body,
+    messages: [notice, ...trimmedMessages]
+  };
+  const afterChars = anthropicInputChars(trimmedBody);
+  return { body: trimmedBody, trimmed: true, beforeChars, afterChars };
+}
+function toOpenAIRequest(body) {
+  const messages = [];
+  const system = systemToText(body.system);
+  if (system) messages.push({ role: "system", content: system });
+  messages.push(...toOAIMessages(body.messages));
+  const req = {
+    model: mapModel(body.model),
+    messages,
+    max_completion_tokens: body.max_tokens
+  };
+  if (body.stream) {
+    req.stream = true;
+    req.stream_options = { include_usage: true };
+  }
+  if (body.thinking?.type === "enabled") {
+    req.reasoning_effort = budgetToEffort(body.thinking.budget_tokens);
+  }
+  if (body.tools && body.tools.length > 0) {
+    req.tools = body.tools.map((t) => ({
+      type: "function",
+      function: {
+        name: t.name,
+        ...t.description !== void 0 ? { description: t.description } : {},
+        parameters: t.input_schema
+      }
+    }));
+  }
+  return req;
+}
+function toAnthropicResponse(openai, originalModel) {
+  const choice = openai.choices[0];
+  const message = choice?.message;
+  const content = [];
+  if (message?.content) {
+    content.push({ type: "text", text: message.content });
+  }
+  for (const tc of message?.tool_calls ?? []) {
+    let input = {};
+    try {
+      input = JSON.parse(tc.function.arguments);
+    } catch {
+    }
+    content.push({ type: "tool_use", id: tc.id, name: tc.function.name, input });
+  }
+  const stopReason = choice?.finish_reason === "tool_calls" ? "tool_use" : choice?.finish_reason === "length" ? "max_tokens" : "end_turn";
+  return {
+    id: openai.id ?? `msg_${Date.now().toString(36)}`,
+    type: "message",
+    role: "assistant",
+    content,
+    model: originalModel,
+    stop_reason: stopReason,
+    stop_sequence: null,
+    usage: {
+      input_tokens: openai.usage?.prompt_tokens ?? 0,
+      output_tokens: openai.usage?.completion_tokens ?? 0
+    }
+  };
+}
+function sseEvent(event, data) {
+  return `event: ${event}
+data: ${JSON.stringify(data)}
+
+`;
+}
+function closeStreamWithGatewayError(controller, enc, message) {
+  try {
+    controller.enqueue(enc.encode(sseEvent("error", anthropicGatewayError(message))));
+  } catch {
+  }
+  try {
+    controller.close();
+  } catch {
+  }
+}
+function translateOpenAIStreamToAnthropic(openaiStream, originalModel, messageId, estimatedInputTokens) {
+  const enc = new TextEncoder();
+  return new ReadableStream({
+    async start(controller) {
+      const emit = (s) => controller.enqueue(enc.encode(s));
+      let nextBlockIdx = 0;
+      let textBlockIdx = -1;
+      let textBlockOpen = false;
+      const toolBlockMap = /* @__PURE__ */ new Map();
+      let outputTokens = 0;
+      let stopReason = "end_turn";
+      emit(sseEvent("message_start", {
+        type: "message_start",
+        message: {
+          id: messageId,
+          type: "message",
+          role: "assistant",
+          content: [],
+          model: originalModel,
+          stop_reason: null,
+          stop_sequence: null,
+          usage: { input_tokens: estimatedInputTokens, output_tokens: 0 }
+        }
+      }));
+      emit(sseEvent("ping", { type: "ping" }));
+      const reader = openaiStream.getReader();
+      let buf = "";
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          buf += new TextDecoder().decode(value);
+          const lines = buf.split("\n");
+          buf = lines.pop() ?? "";
+          for (const line of lines) {
+            if (!line.startsWith("data: ")) continue;
+            const raw = line.slice(6).trim();
+            if (raw === "[DONE]") {
+              if (textBlockOpen) {
+                emit(sseEvent("content_block_stop", { type: "content_block_stop", index: textBlockIdx }));
+              }
+              for (const [, blockIdx] of toolBlockMap) {
+                emit(sseEvent("content_block_stop", { type: "content_block_stop", index: blockIdx }));
+              }
+              emit(sseEvent("message_delta", {
+                type: "message_delta",
+                delta: { stop_reason: stopReason, stop_sequence: null },
+                usage: { output_tokens: outputTokens }
+              }));
+              emit(sseEvent("message_stop", { type: "message_stop" }));
+              controller.close();
+              return;
+            }
+            let chunk;
+            try {
+              chunk = JSON.parse(raw);
+            } catch {
+              continue;
+            }
+            if (chunk.usage?.completion_tokens) outputTokens = chunk.usage.completion_tokens;
+            const choice = chunk.choices?.[0];
+            if (!choice) continue;
+            if (choice.finish_reason) {
+              stopReason = choice.finish_reason === "tool_calls" ? "tool_use" : choice.finish_reason === "length" ? "max_tokens" : "end_turn";
+            }
+            const delta = choice.delta;
+            if (!delta) continue;
+            if (typeof delta.content === "string" && delta.content.length > 0) {
+              if (!textBlockOpen) {
+                textBlockIdx = nextBlockIdx++;
+                textBlockOpen = true;
+                emit(sseEvent("content_block_start", {
+                  type: "content_block_start",
+                  index: textBlockIdx,
+                  content_block: { type: "text", text: "" }
+                }));
+              }
+              emit(sseEvent("content_block_delta", {
+                type: "content_block_delta",
+                index: textBlockIdx,
+                delta: { type: "text_delta", text: delta.content }
+              }));
+            }
+            for (const tc of delta.tool_calls ?? []) {
+              if (textBlockOpen) {
+                emit(sseEvent("content_block_stop", { type: "content_block_stop", index: textBlockIdx }));
+                textBlockOpen = false;
+              }
+              if (!toolBlockMap.has(tc.index)) {
+                const blockIdx2 = nextBlockIdx++;
+                toolBlockMap.set(tc.index, blockIdx2);
+                emit(sseEvent("content_block_start", {
+                  type: "content_block_start",
+                  index: blockIdx2,
+                  content_block: {
+                    type: "tool_use",
+                    id: tc.id ?? `toolu_${tc.index}`,
+                    name: tc.function?.name ?? "",
+                    input: {}
+                  }
+                }));
+              }
+              const blockIdx = toolBlockMap.get(tc.index);
+              if (tc.function?.arguments) {
+                emit(sseEvent("content_block_delta", {
+                  type: "content_block_delta",
+                  index: blockIdx,
+                  delta: { type: "input_json_delta", partial_json: tc.function.arguments }
+                }));
+              }
+            }
+          }
+        }
+        if (textBlockOpen) {
+          emit(sseEvent("content_block_stop", { type: "content_block_stop", index: textBlockIdx }));
+        }
+        for (const [, blockIdx] of toolBlockMap) {
+          emit(sseEvent("content_block_stop", { type: "content_block_stop", index: blockIdx }));
+        }
+        emit(sseEvent("message_delta", {
+          type: "message_delta",
+          delta: { stop_reason: stopReason, stop_sequence: null },
+          usage: { output_tokens: outputTokens }
+        }));
+        emit(sseEvent("message_stop", { type: "message_stop" }));
+        controller.close();
+      } catch (err) {
+        closeStreamWithGatewayError(
+          controller,
+          enc,
+          `Upstream stream failed: ${upstreamFetchErrorMessage(err)}`
+        );
+      } finally {
+        reader.releaseLock();
+      }
+    }
+  });
+}
+function translateCodexStreamToAnthropic(codexStream, originalModel, messageId, estimatedInputTokens) {
+  const enc = new TextEncoder();
+  return new ReadableStream({
+    async start(controller) {
+      const emit = (s) => controller.enqueue(enc.encode(s));
+      let nextBlockIdx = 0;
+      const blockMap = /* @__PURE__ */ new Map();
+      let textBlockOpen = false;
+      let outputTokens = 0;
+      let stopReason = "end_turn";
+      emit(sseEvent("message_start", {
+        type: "message_start",
+        message: {
+          id: messageId,
+          type: "message",
+          role: "assistant",
+          content: [],
+          model: originalModel,
+          stop_reason: null,
+          stop_sequence: null,
+          usage: { input_tokens: estimatedInputTokens, output_tokens: 0 }
+        }
+      }));
+      emit(sseEvent("ping", { type: "ping" }));
+      const reader = codexStream.getReader();
+      let buf = "";
+      let currentEvent = "";
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          buf += new TextDecoder().decode(value);
+          const lines = buf.split("\n");
+          buf = lines.pop() ?? "";
+          for (const line of lines) {
+            if (line.startsWith("event: ")) {
+              currentEvent = line.slice(7).trim();
+              continue;
+            }
+            if (!line.startsWith("data: ")) {
+              if (line === "") currentEvent = "";
+              continue;
+            }
+            const raw = line.slice(6).trim();
+            if (raw === "[DONE]") continue;
+            let data;
+            try {
+              data = JSON.parse(raw);
+            } catch {
+              continue;
+            }
+            const evType = data.type ?? currentEvent;
+            const outputIndex = data.output_index ?? 0;
+            switch (evType) {
+              case "response.output_item.added": {
+                const item = data.item;
+                if (!item) break;
+                if (item.type === "function_call") {
+                  const blockIdx = nextBlockIdx++;
+                  blockMap.set(outputIndex, { type: "tool", idx: blockIdx });
+                  emit(sseEvent("content_block_start", {
+                    type: "content_block_start",
+                    index: blockIdx,
+                    content_block: {
+                      type: "tool_use",
+                      id: item.call_id ?? `toolu_${outputIndex}`,
+                      name: item.name ?? "",
+                      input: {}
+                    }
+                  }));
+                }
+                break;
+              }
+              case "response.output_text.delta": {
+                const delta = data.delta;
+                if (!delta) break;
+                if (!blockMap.has(outputIndex)) {
+                  const blockIdx = nextBlockIdx++;
+                  blockMap.set(outputIndex, { type: "text", idx: blockIdx });
+                  textBlockOpen = true;
+                  emit(sseEvent("content_block_start", {
+                    type: "content_block_start",
+                    index: blockIdx,
+                    content_block: { type: "text", text: "" }
+                  }));
+                }
+                const tBlock = blockMap.get(outputIndex);
+                emit(sseEvent("content_block_delta", {
+                  type: "content_block_delta",
+                  index: tBlock.idx,
+                  delta: { type: "text_delta", text: delta }
+                }));
+                break;
+              }
+              case "response.function_call_arguments.delta": {
+                const delta = data.delta;
+                if (!delta) break;
+                const fBlock = blockMap.get(outputIndex);
+                if (fBlock?.type === "tool") {
+                  emit(sseEvent("content_block_delta", {
+                    type: "content_block_delta",
+                    index: fBlock.idx,
+                    delta: { type: "input_json_delta", partial_json: delta }
+                  }));
+                }
+                break;
+              }
+              case "response.output_item.done": {
+                const block = blockMap.get(outputIndex);
+                if (block) {
+                  emit(sseEvent("content_block_stop", { type: "content_block_stop", index: block.idx }));
+                  if (block.type === "text") textBlockOpen = false;
+                }
+                const item = data.item;
+                if (item?.type === "function_call") stopReason = "tool_use";
+                break;
+              }
+              case "response.completed": {
+                const response = data.response;
+                const usage = response?.usage;
+                if (typeof usage?.output_tokens === "number") outputTokens = usage.output_tokens;
+                for (const [, block] of blockMap) {
+                  if (block.type === "text" && textBlockOpen) {
+                    emit(sseEvent("content_block_stop", { type: "content_block_stop", index: block.idx }));
+                    textBlockOpen = false;
+                  }
+                }
+                emit(sseEvent("message_delta", {
+                  type: "message_delta",
+                  delta: { stop_reason: stopReason, stop_sequence: null },
+                  usage: { output_tokens: outputTokens }
+                }));
+                emit(sseEvent("message_stop", { type: "message_stop" }));
+                controller.close();
+                return;
+              }
+              case "response.failed": {
+                emit(sseEvent("error", {
+                  type: "error",
+                  error: { type: "api_error", message: codexFailureMessage(data) }
+                }));
+                controller.close();
+                return;
+              }
+            }
+          }
+        }
+        if (textBlockOpen) {
+          for (const [, block] of blockMap) {
+            if (block.type === "text") {
+              emit(sseEvent("content_block_stop", { type: "content_block_stop", index: block.idx }));
+            }
+          }
+        }
+        for (const [, block] of blockMap) {
+          if (block.type === "tool") {
+            emit(sseEvent("content_block_stop", { type: "content_block_stop", index: block.idx }));
+          }
+        }
+        emit(sseEvent("message_delta", {
+          type: "message_delta",
+          delta: { stop_reason: stopReason, stop_sequence: null },
+          usage: { output_tokens: outputTokens }
+        }));
+        emit(sseEvent("message_stop", { type: "message_stop" }));
+        controller.close();
+      } catch (err) {
+        closeStreamWithGatewayError(
+          controller,
+          enc,
+          `Upstream stream failed: ${upstreamFetchErrorMessage(err)}`
+        );
+      } finally {
+        reader.releaseLock();
+      }
+    }
+  });
+}
+function codexFailureMessage(data) {
+  const response = data.response;
+  const error = data.error ?? response?.error;
+  const message = error?.message ?? error?.code ?? response?.status;
+  return typeof message === "string" && message ? message : "Codex upstream response failed";
+}
+async function codexStreamToAnthropicResponse(codexStream, originalModel, messageId, estimatedInputTokens) {
+  const reader = codexStream.getReader();
+  const blockMap = /* @__PURE__ */ new Map();
+  let nextBlockIdx = 0;
+  let outputTokens = 0;
+  let buf = "";
+  let currentEvent = "";
+  const ensureTextBlock = (outputIndex) => {
+    const existing = blockMap.get(outputIndex);
+    if (existing?.type === "text") return existing;
+    const block = {
+      type: "text",
+      idx: nextBlockIdx++,
+      text: ""
+    };
+    blockMap.set(outputIndex, block);
+    return block;
+  };
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buf += new TextDecoder().decode(value);
+      const lines = buf.split("\n");
+      buf = lines.pop() ?? "";
+      for (const line of lines) {
+        if (line.startsWith("event: ")) {
+          currentEvent = line.slice(7).trim();
+          continue;
+        }
+        if (!line.startsWith("data: ")) {
+          if (line === "") currentEvent = "";
+          continue;
+        }
+        const raw = line.slice(6).trim();
+        if (raw === "[DONE]") continue;
+        let data;
+        try {
+          data = JSON.parse(raw);
+        } catch {
+          continue;
+        }
+        const evType = data.type ?? currentEvent;
+        const outputIndex = data.output_index ?? 0;
+        switch (evType) {
+          case "response.output_item.added": {
+            const item = data.item;
+            if (item?.type === "function_call") {
+              blockMap.set(outputIndex, {
+                type: "tool",
+                idx: nextBlockIdx++,
+                id: item.call_id ?? `toolu_${outputIndex}`,
+                name: item.name ?? "",
+                args: ""
+              });
+            }
+            break;
+          }
+          case "response.output_text.delta": {
+            const delta = data.delta;
+            if (delta) ensureTextBlock(outputIndex).text += delta;
+            break;
+          }
+          case "response.output_text.done": {
+            const text = data.text;
+            if (text !== void 0) ensureTextBlock(outputIndex).text = text;
+            break;
+          }
+          case "response.function_call_arguments.delta": {
+            const delta = data.delta;
+            const block = blockMap.get(outputIndex);
+            if (delta && block?.type === "tool") block.args += delta;
+            break;
+          }
+          case "response.output_item.done": {
+            const item = data.item;
+            const block = blockMap.get(outputIndex);
+            if (item?.type === "function_call" && block?.type === "tool") {
+              if (typeof item.call_id === "string") block.id = item.call_id;
+              if (typeof item.name === "string") block.name = item.name;
+              if (typeof item.arguments === "string") block.args = item.arguments;
+            }
+            break;
+          }
+          case "response.completed": {
+            const response = data.response;
+            const usage = response?.usage;
+            if (typeof usage?.output_tokens === "number") outputTokens = usage.output_tokens;
+            break;
+          }
+          case "response.failed":
+            throw new Error(codexFailureMessage(data));
+        }
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const content = [...blockMap.values()].sort((a, b) => a.idx - b.idx).map((block) => {
+    if (block.type === "text") return { type: "text", text: block.text };
+    let input = {};
+    try {
+      input = block.args ? JSON.parse(block.args) : {};
+    } catch {
+      input = {};
+    }
+    return { type: "tool_use", id: block.id, name: block.name, input };
+  });
+  return {
+    id: messageId,
+    type: "message",
+    role: "assistant",
+    content,
+    model: originalModel,
+    stop_reason: content.some((block) => block.type === "tool_use") ? "tool_use" : "end_turn",
+    stop_sequence: null,
+    usage: { input_tokens: estimatedInputTokens, output_tokens: outputTokens }
+  };
+}
+async function handleMessagesViaOpenAI(c, session) {
+  const rawBody = await c.req.arrayBuffer();
+  let body;
+  try {
+    body = JSON.parse(new TextDecoder().decode(rawBody));
+  } catch {
+    return c.json({ error: "invalid JSON" }, 400);
+  }
+  const originalModel = body.model;
+  const isCodex = isCodexOAuthToken(session.token);
+  const codexContext = isCodex ? trimCodexBodyForContext(body) : null;
+  const upstreamBody = codexContext?.body ?? body;
+  if (codexContext?.trimmed) {
+    console.warn(
+      `[llm-gateway] Codex context trimmed for ${originalModel}: ${codexContext.beforeChars} -> ${codexContext.afterChars} chars`
+    );
+  }
+  const upstreamReq = isCodex ? toCodexRequest(upstreamBody) : toOpenAIRequest(upstreamBody);
+  const messageId = `msg_${Date.now().toString(36)}`;
+  const estimatedInputTokens = Math.ceil(JSON.stringify(upstreamBody.messages).length / 4);
+  const doFetch = (token) => {
+    if (isCodex) {
+      const codexRequest = prepareCodexResponsesRequest(
+        upstreamReq
+      );
+      return fetch(codexRequest.url, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "content-type": "application/json",
+          originator: "opencode",
+          "User-Agent": "opencode/0.1.0",
+          session_id: `codex_${Date.now().toString(36)}`
+        },
+        body: JSON.stringify(codexRequest.body),
+        // @ts-expect-error Node 18+ supports duplex for streaming
+        duplex: "half",
+        signal: c.req.raw.signal
+      });
+    }
+    return fetch(`${OPENAI_BASE}/v1/chat/completions`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(upstreamReq),
+      // @ts-expect-error Node 18+ supports duplex for streaming
+      duplex: "half",
+      signal: c.req.raw.signal
+    });
+  };
+  let upstream;
+  try {
+    upstream = await fetchUpstreamWithRetry(() => doFetch(session.token));
+  } catch (err) {
+    if (abortError(err)) return new Response(null, { status: 499 });
+    return c.json(
+      anthropicGatewayError(`Upstream fetch failed: ${upstreamFetchErrorMessage(err)}`),
+      502
+    );
+  }
+  if (upstream.status === 401 && session.accountId) {
+    await upstream.body?.cancel().catch(() => {
+    });
+    const newToken = await refreshOAuthToken(session.accountId);
+    if (newToken) {
+      if (session.gatewayToken) updateSessionToken(session.gatewayToken, newToken);
+      try {
+        upstream = await fetchUpstreamWithRetry(() => doFetch(newToken));
+      } catch (err) {
+        if (abortError(err)) return new Response(null, { status: 499 });
+        return c.json(
+          anthropicGatewayError(`Upstream fetch failed: ${upstreamFetchErrorMessage(err)}`),
+          502
+        );
+      }
+    }
+  }
+  if (!upstream.ok) {
+    const errBody = await upstream.text();
+    return new Response(errBody, {
+      status: upstream.status,
+      headers: { "content-type": upstream.headers.get("content-type") ?? "application/json" }
+    });
+  }
+  if (body.stream && isCodex && upstream.body) {
+    const stream = translateCodexStreamToAnthropic(
+      upstream.body,
+      originalModel,
+      messageId,
+      estimatedInputTokens
+    );
+    return new Response(stream, {
+      status: 200,
+      headers: {
+        "content-type": "text/event-stream; charset=utf-8",
+        "cache-control": "no-cache",
+        "x-accel-buffering": "no"
+      }
+    });
+  }
+  if (isCodex && upstream.body) {
+    try {
+      return c.json(
+        await codexStreamToAnthropicResponse(
+          upstream.body,
+          originalModel,
+          messageId,
+          estimatedInputTokens
+        )
+      );
+    } catch (err) {
+      return c.json(anthropicGatewayError(err instanceof Error ? err.message : String(err)), 502);
+    }
+  }
+  if (body.stream && upstream.body) {
+    const stream = translateOpenAIStreamToAnthropic(
+      upstream.body,
+      originalModel,
+      messageId,
+      estimatedInputTokens
+    );
+    return new Response(stream, {
+      status: 200,
+      headers: {
+        "content-type": "text/event-stream; charset=utf-8",
+        "cache-control": "no-cache",
+        "x-accel-buffering": "no"
+      }
+    });
+  }
+  const openaiResp = await upstream.json();
+  return c.json(toAnthropicResponse(openaiResp, originalModel));
+}
+
+// src/llm-gateway-runtime/proxy-anthropic.ts
+var ANTHROPIC_BASE = process.env.ANTHROPIC_UPSTREAM_URL ?? "https://api.anthropic.com";
+var PASSTHROUGH_REQUEST_HEADERS = [
+  "anthropic-version",
+  "anthropic-beta",
+  "content-type"
+];
+var PASSTHROUGH_RESPONSE_HEADERS = [
+  "content-type",
+  "transfer-encoding",
+  "retry-after"
+];
+function gatewayTokenFromRequest(c) {
+  const auth = c.req.header("authorization") ?? "";
+  if (auth.startsWith("Bearer gw-")) return auth.slice("Bearer ".length);
+  const apiKey = c.req.header("x-api-key") ?? "";
+  if (apiKey.startsWith("gw-")) return apiKey;
+  return null;
+}
+async function handleMessages(c) {
+  const gatewayToken = gatewayTokenFromRequest(c);
+  if (!gatewayToken) return c.json({ error: "unauthorized" }, 403);
+  const session = await lookupToken(gatewayToken);
+  if (!session) return c.json({ error: "unauthorized" }, 403);
+  if (session.provider === "openai" || session.provider === "codex") {
+    return handleMessagesViaOpenAI(c, {
+      token: session.token,
+      gatewayToken: session.gatewayToken,
+      accountId: session.accountId
+    });
+  }
+  const upstreamUrl = `${ANTHROPIC_BASE}/v1/messages`;
+  const body = await c.req.raw.arrayBuffer();
+  const requestHeaders = {
+    "anthropic-version": c.req.header("anthropic-version") ?? "2023-06-01"
+  };
+  for (const h of PASSTHROUGH_REQUEST_HEADERS) {
+    const v = c.req.header(h);
+    if (v !== void 0) requestHeaders[h] = v;
+  }
+  requestHeaders["x-api-key"] = session.token;
+  let upstream;
+  try {
+    upstream = await fetch(upstreamUrl, {
+      method: "POST",
+      headers: requestHeaders,
+      body,
+      // @ts-expect-error Node 18+ fetch supports duplex for streaming
+      duplex: "half",
+      signal: c.req.raw.signal
+    });
+  } catch (err) {
+    if (err.name === "AbortError") {
+      return new Response(null, { status: 499 });
+    }
+    throw err;
+  }
+  const responseHeaders = {};
+  for (const h of PASSTHROUGH_RESPONSE_HEADERS) {
+    const v = upstream.headers.get(h);
+    if (v !== null) responseHeaders[h] = v;
+  }
+  return new Response(upstream.body, {
+    status: upstream.status,
+    headers: responseHeaders
+  });
+}
+
+// src/llm-gateway-runtime/index.ts
+var app = new Hono();
+app.get("/health", (c) => c.json({ ok: true }));
+app.get("/healthz", (c) => c.json({ ok: true }));
+app.post("/v1/session", async (c) => {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid JSON" }, 400);
+  }
+  if (typeof body.sessionId !== "string" || !body.sessionId) {
+    return c.json({ error: "sessionId (string) required" }, 400);
+  }
+  const result = await acquireSession(body.sessionId);
+  return c.json(result, 201);
+});
+app.post("/v1/messages", handleMessages);
+var port = parseInt(process.env.PORT ?? "3001", 10);
+serve({ fetch: app.fetch, port }, () => {
+  process.stdout.write(
+    `[llm-gateway] listening on :${port} \u2014 ${sessionCount()} sessions in memory
+`
+  );
+});