@timo972/cc-router 0.12.0 → 0.12.1-rc.1

package/dist/proxy/messages-cross-route.js

@@ -12,6 +12,7 @@ import { stats, applyCodexUsage } from "./stats.js";
 import { extractCodexSessionKey } from "./openai-routing.js";
 import { sendAnthropicNoEligibleResponse, detectAnthropicClientSource } from "./anthropic-routing.js";
 import { mirrorUpstreamHeaders, runOpenAIIngress, } from "./openai-ingress.js";
+import { waitForWritable } from "./transport-timing.js";
 const MESSAGES_ENVELOPE = {
     wrap: (type, message) => ({ type: "error", error: { type, message } }),
     sendNoEligible: (error, res, nowMs) => sendAnthropicNoEligibleResponse(error, res, nowMs),
@@ -62,7 +63,7 @@ function extractUpstreamErrorMessage(bodyText, status) {
  * the Codex backend signals in-stream failures as a `response.failed`/`error`
  * SSE event on an HTTP 200, and those must not be reported as success.
  */
-async function sendOpenAIAsAnthropic(upstream, res, requestedStream, entry, report) {
+async function sendOpenAIAsAnthropic(upstream, res, requestedStream, entry, report, now) {
     const onUsage = (usage) => applyCodexUsage(entry, usage);
     // A non-OK response is never a Responses payload, whatever its content-type
     // — parsing it as an event stream or a completed response would translate a
@@ -97,7 +98,7 @@ async function sendOpenAIAsAnthropic(upstream, res, requestedStream, entry, repo
             // Headers are already flushed by the time a mid-stream failure surfaces,
             // so the client keeps the partial stream; reporting 502 here keeps the
             // activity log and error totals honest about what happened.
-            const failure = await sendOpenAIStreamAsAnthropic(upstream, res, onUsage, report);
+            const failure = await sendOpenAIStreamAsAnthropic(upstream, res, entry, onUsage, report, now);
             return { statusCode: failure === undefined ? upstream.status : 502 };
         }
         const collected = await collectOpenAIStreamAsAnthropicMessage(upstream, report);
@@ -303,7 +304,7 @@ async function collectOpenAIStreamAsAnthropicMessage(upstream, report) {
     };
 }
 /** Returns the upstream failure message when the stream ended in one. */
-async function sendOpenAIStreamAsAnthropic(upstream, res, onUsage, report) {
+async function sendOpenAIStreamAsAnthropic(upstream, res, entry, onUsage, report, now) {
     res.status(upstream.status);
     res.setHeader("content-type", "text/event-stream");
     res.setHeader("cache-control", "no-cache");
@@ -327,6 +328,7 @@ async function sendOpenAIStreamAsAnthropic(upstream, res, onUsage, report) {
     let totals;
     let failure;
     let completed = false;
+    let cleanEof = false;
     const pendingToolCalls = new Set();
     const writeProtocolError = () => {
         res.write(encodeSseEvent({
@@ -362,13 +364,23 @@ async function sendOpenAIStreamAsAnthropic(upstream, res, onUsage, report) {
             pendingToolCalls.delete(typed.output_index ?? 0);
         }
     };
-    const relayEvents = (events) => {
+    const relayEvents = async (events) => {
         for (const event of events) {
             inspect(event);
             for (const mapped of normalizer.convert(event)) {
-                res.write(encodeSseEvent(mapped));
+                if (!res.write(encodeSseEvent(mapped))) {
+                    // Do not consume another translated event or upstream chunk while
+                    // Node is buffering for a slow client. A close/error while waiting
+                    // ends the relay and explicitly releases the upstream reader.
+                    const drained = await waitForWritable(res);
+                    if (!drained) {
+                        await reader.cancel().catch(() => { });
+                        return false;
+                    }
+                }
             }
         }
+        return true;
     };
     try {
         while (true) {
@@ -380,17 +392,23 @@ async function sendOpenAIStreamAsAnthropic(upstream, res, onUsage, report) {
             const { value, done } = await reader.read();
             if (done)
                 break;
+            if (entry.firstByteDurationMs === undefined)
+                entry.firstByteDurationMs = now() - entry.ts;
             // Tolerant: one malformed frame must not abort the relay (which would
             // silently truncate the client's stream) nor discard the valid events
             // decoded from the same chunk.
             const parsed = parseSseLines(remainder + decoder.decode(value, { stream: true }), { tolerant: true });
             remainder = parsed.remainder;
-            relayEvents(parsed.events);
+            if (!await relayEvents(parsed.events))
+                return undefined;
         }
         const tail = decoder.decode();
         if (tail || remainder) {
-            relayEvents(parseSseLines(remainder + tail + "\n", { tolerant: true }).events);
+            if (!await relayEvents(parseSseLines(remainder + tail + "\n", { tolerant: true }).events)) {
+                return undefined;
+            }
         }
+        cleanEof = true;
         if (!completed && pendingToolCalls.size > 0 && failure === undefined) {
             failure = "OpenAI function call ended before completion";
             report.upstreamReportedFailure = true;
@@ -403,9 +421,12 @@ async function sendOpenAIStreamAsAnthropic(upstream, res, onUsage, report) {
         failure = error.message;
         report.upstreamReportedFailure = true;
         writeProtocolError();
+        cleanEof = true;
+        await reader.cancel().catch(() => { });
     }
     finally {
-        res.end();
+        if (cleanEof && !res.destroyed && !res.writableEnded)
+            res.end();
         onUsage?.(totals);
     }
     // Mirrors collectOpenAIStreamAsAnthropicMessage: tolerant parsing skips a
@@ -466,6 +487,7 @@ export function mountMessagesCrossProviderRoute(app, opts) {
             now,
             envelope: MESSAGES_ENVELOPE,
             onUpstreamAuthFailure: opts.onUpstreamAuthFailure,
+            timeoutMs: opts.timeoutMs,
             ...(opts.maxAttempts !== undefined ? { maxAttempts: opts.maxAttempts } : {}),
             ...(opts.sameAccountRetryDelayMs !== undefined
                 ? { sameAccountRetryDelayMs: opts.sameAccountRetryDelayMs }
@@ -473,7 +495,7 @@ export function mountMessagesCrossProviderRoute(app, opts) {
             ...(opts.retryRefreshTimeoutMs !== undefined
                 ? { retryRefreshTimeoutMs: opts.retryRefreshTimeoutMs }
                 : {}),
-            relay: (upstream, res, entry, report) => sendOpenAIAsAnthropic(upstream, res, requestedStream, entry, report),
+            relay: (upstream, res, entry, report) => sendOpenAIAsAnthropic(upstream, res, requestedStream, entry, report, now),
         });
     });
 }

package/dist/proxy/openai-ingress.js

@@ -6,6 +6,7 @@ import { stats, boundModelId, createLocalRoutingErrorLog } from "./stats.js";
 import { logError, logRoute } from "./logger.js";
 import { EmptyPoolError, NoEligibleAccountError } from "./account-pool.js";
 import { acquireRequestRoute, routeReasonDetails, routeFailureDetails } from "./lease-lifecycle.js";
+import { createCorrelationId, formatTransportDiagnostic, safeCauseCode } from "./transport-diagnostics.js";
 import { MAX_UPSTREAM_ATTEMPTS, RETRY_REFRESH_TIMEOUT_MS, SAME_ACCOUNT_RETRY_DELAY_MS, boundedWait, isRetryableUpstreamStatus, retryDelay, } from "./upstream-retry.js";
 /**
  * Mirrors `anthropic-routing.ts`'s `requestTerminated` check. This ingress
@@ -100,13 +101,14 @@ export function mirrorUpstreamHeaders(source, apply) {
  * an unhandled rejection behind.
  */
 export async function runOpenAIIngress(opts) {
-    const { res, sessionKey, path, openAIRouter, openAIPool, prepareOpenAIAccount, forwardOpenAI, forwardBody, recordActivity, now, envelope, relay, onUpstreamAuthFailure, } = opts;
+    const { res, sessionKey, path, openAIRouter, openAIPool, prepareOpenAIAccount, forwardOpenAI, forwardBody, recordActivity, now, envelope, relay, onUpstreamAuthFailure, timeoutMs, } = opts;
     // The model comes from a client-controlled body and is retained in the
     // activity ring buffer below. Bound it once, here, so every activity entry,
     // routing context and bucket lookup on this path carries an identifier that
     // cannot grow with the request. The body forwarded upstream is untouched —
     // it still carries whatever model the caller asked for.
     const requestedModel = boundModelId(opts.requestedModel);
+    const correlationId = createCorrelationId();
     // A client that hangs up must take the upstream request with it. Releasing
     // the lease (which the response's own close listener does) only returns the
     // account's *local* capacity — without this the Codex request keeps
@@ -145,8 +147,11 @@ export async function runOpenAIIngress(opts) {
         // this handler's promise — no account lease was taken, so there is
         // nothing to release.
         stats.totalErrors++;
-        const message = error instanceof Error ? error.message : String(error);
-        logError("proxy", 500, `unexpected routing failure: ${message}`);
+        logError("proxy", 500, formatTransportDiagnostic({
+            correlationId,
+            operation: "forward",
+            causeCode: safeCauseCode(error),
+        }));
         recordActivity({
             ts: now(),
             accountId: "proxy",
@@ -155,6 +160,7 @@ export async function runOpenAIIngress(opts) {
             statusCode: 500,
             path,
             details: "proxy_error:acquire",
+            correlationId,
         });
         res.status(500).json(envelope.wrap("proxy_error", "Unexpected routing error"));
         return;
@@ -166,6 +172,8 @@ export async function runOpenAIIngress(opts) {
     // reason string — keep it that way.
     logRoute(selected.route.account.id, selected.route.account.requestCount, Math.round((selected.route.account.expiresAt - now()) / 60_000), selected.details);
     const startedAt = now();
+    const refreshDurations = new Map();
+    let headerDurationMs = 0;
     const maxAttempts = Math.max(1, opts.maxAttempts ?? MAX_UPSTREAM_ATTEMPTS);
     const sameAccountDelayMs = opts.sameAccountRetryDelayMs ?? SAME_ACCOUNT_RETRY_DELAY_MS;
     const retryRefreshTimeoutMs = opts.retryRefreshTimeoutMs ?? RETRY_REFRESH_TIMEOUT_MS;
@@ -178,6 +186,8 @@ export async function runOpenAIIngress(opts) {
     const prepareRoute = async (routed) => {
         const account = routed.route.account;
         const needed = needsOpenAIRefresh(account);
+        const refreshStartedAt = now();
+        let refreshCauseCode;
         let ready;
         try {
             ready = await prepareOpenAIAccount(account);
@@ -185,14 +195,13 @@ export async function runOpenAIIngress(opts) {
         catch (error) {
             // A throwing refresh must behave exactly like a `false` return, never
             // crash the request (or the daemon).
-            const message = error instanceof Error ? error.message : String(error);
-            logError(account.id, 401, `openai token refresh threw: ${message}`);
+            refreshCauseCode = safeCauseCode(error);
             ready = false;
         }
+        const refreshDurationMs = now() - refreshStartedAt;
+        refreshDurations.set(account, refreshDurationMs);
         if (!ready) {
             routed.release();
-            account.errorCount++;
-            stats.totalErrors++;
             // Intentionally does not touch `account.healthy`: a single failed
             // refresh fails only this request. Disabling the account here would
             // hard-block it from every future request until a manual recovery, even
@@ -206,6 +215,13 @@ export async function runOpenAIIngress(opts) {
                 openAIRouter.invalidate(routed.route.sessionId, account.id, routed.route.bindingGeneration);
             }
             openAIPool.setGlobalCooldownForAccount(account, REFRESH_FAILURE_COOLDOWN_MS, "unavailable");
+            if (clientGone.signal.aborted || responseTerminated(res))
+                return false;
+            account.errorCount++;
+            stats.totalErrors++;
+            logError(account.id, 401, formatTransportDiagnostic({
+                correlationId, operation: "prepare", status: 401, causeCode: refreshCauseCode,
+            }));
             recordActivity({
                 ts: now(),
                 accountId: account.id,
@@ -213,7 +229,9 @@ export async function runOpenAIIngress(opts) {
                 type: "error",
                 statusCode: 401,
                 path,
-                details: "openai token refresh failed",
+                details: `openai token refresh failed;correlation=${correlationId};auth=${account.authFailure ?? "unknown"}`,
+                correlationId,
+                refreshDurationMs,
             });
             return false;
         }
@@ -223,6 +241,8 @@ export async function runOpenAIIngress(opts) {
         return true;
     };
     if (!(await prepareRoute(selected))) {
+        if (clientGone.signal.aborted || responseTerminated(res))
+            return;
         res.status(401).json(envelope.wrap("authentication_error", "OpenAI subscription token refresh failed"));
         return;
     }
@@ -248,6 +268,7 @@ export async function runOpenAIIngress(opts) {
                 body: forwardBody,
                 stream: forwardBody.stream === true,
                 signal: clientGone.signal,
+                timeoutMs,
             });
         }
         catch (error) {
@@ -267,21 +288,28 @@ export async function runOpenAIIngress(opts) {
             // own finish/close lifecycle once this response is sent.
             account.errorCount++;
             stats.totalErrors++;
-            const message = error instanceof Error ? error.message : String(error);
-            logError(account.id, 502, `openai request failed: ${message}`);
+            const timeout = error instanceof Error && error.name === "TimeoutError";
+            const diagnostic = formatTransportDiagnostic({
+                correlationId, operation: "forward", causeCode: safeCauseCode(error),
+            });
+            logError(account.id, timeout ? 504 : 502, diagnostic);
             recordActivity({
                 ts: startedAt,
                 accountId: account.id,
                 model: requestedModel,
                 type: "error",
-                statusCode: 502,
+                statusCode: timeout ? 504 : 502,
                 path,
-                details: "upstream_error:network",
+                details: `upstream_error:${timeout ? "timeout" : "network"};${diagnostic}`,
                 durationMs: now() - startedAt,
+                correlationId,
+                refreshDurationMs: refreshDurations.get(account),
+                headerDurationMs: now() - attemptStartedAt,
             });
-            res.status(502).json(envelope.wrap("upstream_error", `OpenAI request failed: ${message}`));
+            res.status(timeout ? 504 : 502).json(envelope.wrap("upstream_error", timeout ? "OpenAI request timed out" : "OpenAI request failed"));
             return;
         }
+        headerDurationMs = now() - attemptStartedAt;
         // Cooldown/eligibility react to the raw upstream signal — this must not
         // change based on how the relay later renders the response to the client.
         upstreamFailed = upstream.status === 401 || upstream.status === 429 || upstream.status >= 500;
@@ -314,11 +342,15 @@ export async function runOpenAIIngress(opts) {
                             : "upstream-error", applied.limitingScope);
                 if (upstream.status === 401)
                     onUpstreamAuthFailure?.(account);
+                logError(account.id, upstream.status, formatTransportDiagnostic({
+                    correlationId, operation: "upstream", status: upstream.status,
+                }));
             }
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            logError(account.id, upstream.status, `openai response classification failed: ${message}`);
+            logError(account.id, upstream.status, formatTransportDiagnostic({
+                correlationId, operation: "upstream", status: upstream.status, causeCode: safeCauseCode(error),
+            }));
         }
         // Retryable statuses (429 || >= 500) are a strict subset of
         // `upstreamFailed`, so this predicate alone decides the loop.
@@ -380,6 +412,9 @@ export async function runOpenAIIngress(opts) {
             path,
             ...(opts.method !== undefined ? { method: opts.method } : {}),
             ...(opts.source !== undefined ? { source: opts.source } : {}),
+            correlationId,
+            refreshDurationMs: refreshDurations.get(account),
+            headerDurationMs,
             details: `${details}:will-retry`,
             durationMs: now() - attemptStartedAt,
         });
@@ -405,12 +440,15 @@ export async function runOpenAIIngress(opts) {
         path,
         ...(opts.method !== undefined ? { method: opts.method } : {}),
         ...(opts.source !== undefined ? { source: opts.source } : {}),
+        refreshDurationMs: refreshDurations.get(account),
+        headerDurationMs,
+        correlationId,
         details,
     };
     let finalStatus = upstream.status;
     let relayFailed = false;
     let relayFailureMessage = "";
-    const relayReport = { upstreamReportedFailure: false };
+    const relayReport = { upstreamReportedFailure: false, routerFailure: false };
     try {
         const result = await relay(upstream, res, entry, relayReport);
         finalStatus = result.statusCode;
@@ -421,8 +459,17 @@ export async function runOpenAIIngress(opts) {
         // otherwise the client already has a partial response and the best we
         // can do is tear the connection down.
         relayFailed = true;
-        const message = error instanceof Error ? error.message : String(error);
-        relayFailureMessage = message;
+        // The same reader rejection is produced by two very different events:
+        // an upstream/idle failure, and the caller closing its socket. Capture
+        // the origin before any router-side destroy emits another `close`.
+        const downstreamAlreadyGone = clientGone.signal.aborted || responseTerminated(res);
+        relayReport.routerFailure = !downstreamAlreadyGone;
+        relayFailureMessage = formatTransportDiagnostic({
+            correlationId,
+            operation: "relay",
+            causeCode: error instanceof Error && error.name === "TimeoutError"
+                ? "UPSTREAM_IDLE_TIMEOUT" : safeCauseCode(error),
+        });
         // The recorded status is what this request *became*, which is a failure
         // whether or not another HTTP response can still be sent. Leaving it at
         // the upstream's 200 in the headers-already-sent case produced an
@@ -430,8 +477,11 @@ export async function runOpenAIIngress(opts) {
         // that contradicts itself, and one that reads as a success in any view
         // that keys off the status.
         finalStatus = 502;
-        if (!res.headersSent) {
-            res.status(502).json(envelope.wrap("upstream_error", `OpenAI response relay failed: ${message}`));
+        if (downstreamAlreadyGone) {
+            // There is no peer left to receive an error response.
+        }
+        else if (!res.headersSent) {
+            res.status(502).json(envelope.wrap("upstream_error", "OpenAI response relay failed"));
         }
         else {
             if (!res.writableEnded && !res.destroyed)
@@ -451,7 +501,9 @@ export async function runOpenAIIngress(opts) {
     // a 200 stream — the client can truncate a stream, but it cannot make
     // upstream announce a failure. Only the truncation is the disconnect's to
     // explain away.
-    const clientCancelled = clientGone.signal.aborted && !relayReport.upstreamReportedFailure;
+    const clientCancelled = clientGone.signal.aborted
+        && !relayReport.upstreamReportedFailure
+        && !relayReport.routerFailure;
     // Logged only now, after the cancellation classification: the Codex CLI
     // aborts streams routinely (a superseded turn, Ctrl-C, a pane closing),
     // and each abort rejects the relay's body read with "This operation was
@@ -459,7 +511,8 @@ export async function runOpenAIIngress(opts) {
     // every one — eight hours of them in one unattended overnight session —
     // while the stats correctly ignored them. The log now matches the stats.
     if (relayFailed && !clientCancelled) {
-        logError(account.id, 502, `openai response relay failed: ${relayFailureMessage}`);
+        logError(account.id, 502, relayFailureMessage);
+        entry.details = details ? `${details};${relayFailureMessage}` : relayFailureMessage;
     }
     // Activity/stats must reflect what the client actually received, not just
     // the raw upstream signal: the non-streaming collector can synthesize a

package/dist/proxy/pool-refresh.js

@@ -0,0 +1,80 @@
+/**
+ * One operator-triggered "reload everything" pass over the live pools —
+ * what a router restart gives you, without dropping in-flight requests or
+ * sticky sessions: expired cooldowns are swept, due (or quarantined) tokens
+ * go through the same refresh path the background loops use, and every
+ * account's usage is re-fetched immediately instead of waiting for its
+ * scheduled slot.
+ *
+ * Provider-agnostic on purpose: each provider hands in its own token refresh
+ * and usage hook, so the endpoint never learns OAuth or usage details.
+ */
+export async function refreshAllAccounts(sources, options = {}) {
+    const now = options.now ?? Date.now;
+    const startedAt = now();
+    options.sweepCooldowns?.();
+    const providers = await Promise.all(sources.map(async (source) => {
+        let tokenRefreshFailed = 0;
+        try {
+            tokenRefreshFailed = Math.max(0, (await source.refreshTokens()).failed);
+        }
+        catch (error) {
+            tokenRefreshFailed = source.getAll().length;
+            options.onError?.(source.provider, error);
+        }
+        // Snapshot AFTER the token pass — a refresh may have quarantined or
+        // recovered accounts — and as a copy: the pools hand out their live
+        // array, which an add/delete can mutate while usage fetches settle.
+        const accounts = [...source.getAll()];
+        const outcomes = await Promise.allSettled(accounts.map(account => source.refreshUsage(account)));
+        let usageRefreshed = 0;
+        for (const outcome of outcomes) {
+            if (outcome.status === "fulfilled" && outcome.value.ok)
+                usageRefreshed++;
+            else if (outcome.status === "rejected")
+                options.onError?.(source.provider, outcome.reason);
+        }
+        return {
+            provider: source.provider,
+            accounts: accounts.length,
+            usageRefreshed,
+            usageFailed: accounts.length - usageRefreshed,
+            tokenRefreshFailed,
+        };
+    }));
+    const total = (pick) => providers.reduce((sum, p) => sum + pick(p), 0);
+    return {
+        accounts: total(p => p.accounts),
+        usageRefreshed: total(p => p.usageRefreshed),
+        usageFailed: total(p => p.usageFailed),
+        tokenRefreshFailed: total(p => p.tokenRefreshFailed),
+        durationMs: Math.max(0, now() - startedAt),
+        providers,
+    };
+}
+/**
+ * Single-flight wrapper: a second reload request while one is running joins
+ * the running one instead of starting another pass. Needed because the
+ * dashboard's client deadline is shorter than the worst case of many
+ * accounts all timing out — a client that gave up and pressed again must
+ * not stack a second sweep on the pools.
+ */
+export function createRefreshAllRunner(run) {
+    let inFlight = null;
+    return () => {
+        if (inFlight)
+            return inFlight;
+        const operation = run().finally(() => {
+            if (inFlight === operation)
+                inFlight = null;
+        });
+        inFlight = operation;
+        return operation;
+    };
+}
+/** Human-readable one-liner for the activity log and the dashboard banner. */
+export function describeRefreshAll(summary) {
+    const failed = summary.usageFailed > 0 ? `, ${summary.usageFailed} usage fetch${summary.usageFailed === 1 ? "" : "es"} failed` : "";
+    const tokens = summary.tokenRefreshFailed > 0 ? `, ${summary.tokenRefreshFailed} token refresh${summary.tokenRefreshFailed === 1 ? "" : "es"} failed` : "";
+    return `reloaded ${summary.accounts} account${summary.accounts === 1 ? "" : "s"}, usage fresh for ${summary.usageRefreshed}${failed}${tokens} (${summary.durationMs}ms)`;
+}

package/dist/proxy/responses-server.js

@@ -6,6 +6,7 @@ import { stats, applyCodexUsage, boundModelId } from "./stats.js";
 import { logWarn } from "./logger.js";
 import { extractCodexSessionKey, sendOpenAINoEligibleResponse } from "./openai-routing.js";
 import { runOpenAIIngress, mirrorUpstreamHeaders, } from "./openai-ingress.js";
+import { waitForWritable } from "./transport-timing.js";
 const RESPONSES_ENVELOPE = {
     wrap: (type, message) => ({ error: { type, message } }),
     sendNoEligible: (error, res, nowMs) => sendOpenAINoEligibleResponse(error, res, nowMs),
@@ -38,30 +39,45 @@ async function sendUpstreamResponse(upstream, res, onChunk) {
     // releases a stalled stream, so the account's upstream slot is not held for
     // a response nobody will receive.
     const DISCONNECTED = Symbol("client-disconnected");
+    let resolveDisconnected;
+    const onClose = () => resolveDisconnected?.(DISCONNECTED);
     const disconnected = new Promise(resolve => {
+        resolveDisconnected = resolve;
         if (res.destroyed)
             resolve(DISCONNECTED);
         else
-            res.once("close", () => resolve(DISCONNECTED));
+            res.once("close", onClose);
     });
+    let completed = false;
     try {
         while (true) {
             const next = await Promise.race([reader.read(), disconnected]);
             if (next === DISCONNECTED) {
                 await reader.cancel().catch(() => { });
-                break;
+                return;
             }
             const { value, done } = next;
             if (done)
                 break;
             if (value) {
-                res.write(Buffer.from(value));
                 onChunk?.(value);
+                if (!res.write(Buffer.from(value))) {
+                    // Backpressure is a contract: do not consume another upstream chunk
+                    // until Node drains, or until the peer goes away.
+                    const drained = await waitForWritable(res);
+                    if (!drained) {
+                        await reader.cancel().catch(() => { });
+                        return;
+                    }
+                }
             }
         }
+        completed = true;
     }
     finally {
-        res.end();
+        res.removeListener("close", onClose);
+        if (completed && !res.destroyed && !res.writableEnded)
+            res.end();
     }
 }
 export function mountResponsesRoutes(app, opts) {
@@ -137,6 +153,7 @@ export function mountResponsesRoutes(app, opts) {
             now,
             envelope: RESPONSES_ENVELOPE,
             onUpstreamAuthFailure: opts.onUpstreamAuthFailure,
+            timeoutMs: opts.timeoutMs,
             ...(opts.maxAttempts !== undefined ? { maxAttempts: opts.maxAttempts } : {}),
             ...(opts.sameAccountRetryDelayMs !== undefined
                 ? { sameAccountRetryDelayMs: opts.sameAccountRetryDelayMs }
@@ -160,6 +177,8 @@ export function mountResponsesRoutes(app, opts) {
                     // (or be cut short) after upstream has already announced a failure,
                     // and the verdict has to survive that.
                     await sendUpstreamResponse(upstream, res, chunk => {
+                        if (entry.firstByteDurationMs === undefined)
+                            entry.firstByteDurationMs = now() - entry.ts;
                         observer.push(chunk);
                         if (observer.explicitFailure() !== undefined)
                             report.upstreamReportedFailure = true;