@wardby/cli 0.2.0 → 0.3.0

package/dist/providers/coding-proxy/proxy.js

@@ -1,7 +1,8 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { getModelPricing, PRICING_VERSION } from "../llm/pricing.js";
 import { getAnthropicPricing } from "../llm/pricing-anthropic.js";
-import { AnthropicSseUsageTracker, actualCostUsd, estimateReservationUsd, fingerprintRequest, parseAnthropicAuthoritativeUsage, parseAuthoritativeUsage, pricingSnapshot, terminalUsageFromSseFrame, } from "./metering.js";
+import { deriveRegistryToken } from "../../coding/registry/token.js";
+import { AnthropicSseUsageTracker, actualCostUsd, estimateReservationUsd, fingerprintRequest, parseAnthropicAuthoritativeUsage, parseAuthoritativeUsage, pricingSnapshot, safeUpstreamErrorCode, terminalUsageFromSseFrame, } from "./metering.js";
 import { createPinnedProxyFetch } from "./secure-fetch.js";
 export const PROXY_MAX_BODY_BYTES = 8 * 1024 * 1024;
 export const PROXY_MAX_OUTPUT_TOKENS = 1_000_000;
@@ -16,12 +17,20 @@ export const CLAUDE_CODE_ANTHROPIC_BETAS = [
     "thinking-token-count-2026-05-13",
 ];
 const MAX_UPSTREAM_JSON_BYTES = 16 * 1024 * 1024;
+/** A rejected upstream's error body is read only this far, for its error code. */
+const MAX_UPSTREAM_ERROR_BYTES = 64 * 1024;
 const REQUEST_KEY_PATTERN = /^[\x21-\x7e]{1,200}$/;
 const APPROVED_ANTHROPIC_BETAS = new Set(CLAUDE_CODE_ANTHROPIC_BETAS);
 const WARDBY_COMMAND_TOOL = "mcp__wardby_tools__run_command";
 const STRUCTURED_OUTPUT_TOOL = "StructuredOutput";
 const MAX_COMMAND_BYTES = 16 * 1024;
 const MAX_TOOL_TEXT_BYTES = 256 * 1024;
+/**
+ * The longest run_command timeout the Claude tool runner offers the model (its MAX_TIMEOUT_MS,
+ * src/claude-tool-runner/command.mjs; the proxy tests keep the two equal). A lower limit here let the
+ * command run, then refused the next request, which replays that tool call, as unsupported.
+ */
+export const MAX_COMMAND_TIMEOUT_MS = 120_000;
 export class CodingProxyError extends Error {
     status;
     code;
@@ -31,9 +40,361 @@ export class CodingProxyError extends Error {
         this.code = code;
     }
 }
-function capabilityHash(capability) {
+export function capabilityHash(capability) {
     return createHash("sha256").update(capability).digest("base64url");
 }
+// OpenAI Responses allowlist. Everything a request may carry is listed here;
+// anything else is refused before a credential is resolved. It mirrors what the
+// pinned Codex CLI (src/coding-worker/package.json) actually sends, recorded in
+// fixtures/codex-<version>-responses-requests.json. Only client-side tools
+// (function, custom, and namespaces of them) are allowed: a hosted tool (web
+// search, remote MCP, code interpreter, image generation, file search, ...), a
+// remote image or file, a stored prompt, or a previous response would make
+// OpenAI fetch or run something outside the worker's egress policy and outside
+// the token-metered budget. Tool names vary by model and Codex version, so they
+// are checked for shape, not against a fixed list: a client-side tool the model
+// calls is executed by the worker itself, which the container boundary governs.
+const OPENAI_REQUEST_KEYS = new Set([
+    "model",
+    "instructions",
+    "input",
+    "tools",
+    "tool_choice",
+    "parallel_tool_calls",
+    "reasoning",
+    "store",
+    "stream",
+    "include",
+    "prompt_cache_key",
+    "text",
+    "client_metadata",
+    "max_output_tokens",
+    "background",
+    "service_tier",
+]);
+const OPENAI_REASONING_EFFORTS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"]);
+const OPENAI_REASONING_SUMMARIES = new Set(["auto", "concise", "detailed", "none"]);
+const OPENAI_REASONING_CONTEXTS = new Set(["all_turns", "current_turn"]);
+const OPENAI_INCLUDES = new Set(["reasoning.encrypted_content"]);
+// Only unset (Codex never sends one) or an explicit "default". "auto" defers to
+// the OpenAI project's own tier setting, which may be priority or scale; those
+// and "flex" are billed at rates the pricing table does not track.
+const OPENAI_SERVICE_TIERS = new Set(["default"]);
+// The client_metadata keys the pinned Codex sends (recorded fixture). Several
+// are x-codex-*/x-openai-* keys whose server-side meaning is undocumented, so a
+// new key fails closed like every other unknown field.
+const OPENAI_CLIENT_METADATA_KEYS = new Set([
+    "parent_turn_id",
+    "root_turn_id",
+    "session_id",
+    "thread_id",
+    "turn_id",
+    "x-codex-installation-id",
+    "x-codex-parent-thread-id",
+    "x-codex-turn-metadata",
+    "x-codex-window-id",
+    "x-openai-subagent",
+]);
+const OPENAI_TOOL_CHOICES = new Set(["auto", "none", "required"]);
+const OPENAI_VERBOSITIES = new Set(["low", "medium", "high"]);
+const OPENAI_IMAGE_DETAILS = new Set(["auto", "low", "high", "original"]);
+const OPENAI_MESSAGE_ROLES = new Set(["user", "developer", "system", "assistant"]);
+const OPENAI_MESSAGE_PHASES = new Set(["commentary", "final_answer"]);
+const OPENAI_GRAMMAR_SYNTAXES = new Set(["lark", "regex"]);
+const OPENAI_INPUT_PARTS = new Set(["input_text", "input_image"]);
+const OPENAI_ASSISTANT_PARTS = new Set(["output_text"]);
+const OPENAI_AGENT_MESSAGE_PARTS = new Set(["input_text", "encrypted_content"]);
+const OPENAI_TOOL_NAME = /^[A-Za-z0-9_-]{1,128}$/;
+const OPENAI_CODE_SUFFIX = /^[A-Za-z0-9_.-]{1,64}$/;
+// Only an inline base64 image: Codex's view_image and code-mode image() send
+// local files this way. A URL (or a file_id) would make OpenAI fetch it.
+const OPENAI_INLINE_IMAGE = /^data:image\/(?:png|jpeg|gif|webp);base64,[A-Za-z0-9+/]+={0,2}$/;
+const MAX_OPENAI_ITEMS = 10_000;
+const MAX_OPENAI_TOOLS = 512;
+const MAX_OPENAI_ID_LENGTH = 512;
+const MAX_OPENAI_METADATA_VALUE_LENGTH = 16 * 1024;
+function openAiCode(prefix, value) {
+    return `${prefix}:${typeof value === "string" && OPENAI_CODE_SUFFIX.test(value) ? value : "other"}`;
+}
+function openAiRecord(value, code = "invalid_openai_request") {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new CodingProxyError(400, code);
+    return value;
+}
+function openAiOnlyKeys(value, keys, code = "invalid_openai_request") {
+    const allowed = new Set(keys);
+    if (Object.keys(value).some((key) => !allowed.has(key)))
+        throw new CodingProxyError(400, code);
+}
+function openAiString(value, maxLength, code = "invalid_openai_request") {
+    if (typeof value !== "string" || value.length > maxLength)
+        throw new CodingProxyError(400, code);
+}
+function openAiOptional(value, check) {
+    if (value !== undefined)
+        check(value);
+}
+function openAiId(value) {
+    if (typeof value !== "string" || value.length < 1 || value.length > MAX_OPENAI_ID_LENGTH) {
+        throw new CodingProxyError(400, "invalid_openai_request");
+    }
+}
+function openAiToolName(value, code = "invalid_openai_request") {
+    if (typeof value !== "string" || !OPENAI_TOOL_NAME.test(value))
+        throw new CodingProxyError(400, code);
+}
+function validateOpenAiFunctionTool(tool) {
+    openAiOnlyKeys(tool, ["type", "name", "description", "strict", "parameters"], "invalid_openai_tool");
+    openAiToolName(tool.name, "invalid_openai_tool");
+    openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
+    if (tool.strict !== undefined && typeof tool.strict !== "boolean") {
+        throw new CodingProxyError(400, "invalid_openai_tool");
+    }
+    openAiOptional(tool.parameters, (value) => openAiRecord(value, "invalid_openai_tool"));
+}
+function validateOpenAiCustomTool(tool) {
+    openAiOnlyKeys(tool, ["type", "name", "description", "format"], "invalid_openai_tool");
+    openAiToolName(tool.name, "invalid_openai_tool");
+    openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
+    if (tool.format === undefined)
+        return;
+    const format = openAiRecord(tool.format, "invalid_openai_tool");
+    if (format.type === "text")
+        return openAiOnlyKeys(format, ["type"], "invalid_openai_tool");
+    openAiOnlyKeys(format, ["type", "syntax", "definition"], "invalid_openai_tool");
+    if (format.type !== "grammar" || typeof format.syntax !== "string" || !OPENAI_GRAMMAR_SYNTAXES.has(format.syntax)) {
+        throw new CodingProxyError(400, "invalid_openai_tool");
+    }
+    openAiString(format.definition, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool");
+}
+function validateOpenAiTools(value, count, nested = false) {
+    if (!Array.isArray(value))
+        throw new CodingProxyError(400, "invalid_openai_tool");
+    for (const candidate of value) {
+        if (++count.value > MAX_OPENAI_TOOLS)
+            throw new CodingProxyError(400, "invalid_openai_tool");
+        const tool = openAiRecord(candidate, "invalid_openai_tool");
+        if (tool.type === "function") {
+            validateOpenAiFunctionTool(tool);
+        }
+        else if (tool.type === "custom") {
+            validateOpenAiCustomTool(tool);
+        }
+        else if (tool.type === "namespace" && !nested) {
+            openAiOnlyKeys(tool, ["type", "name", "description", "tools"], "invalid_openai_tool");
+            openAiToolName(tool.name, "invalid_openai_tool");
+            openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
+            validateOpenAiTools(tool.tools, count, true);
+        }
+        else {
+            throw new CodingProxyError(400, openAiCode("openai_tool_not_allowed", tool.type));
+        }
+    }
+}
+function validateOpenAiContentPart(value, allowed) {
+    const part = openAiRecord(value);
+    if (typeof part.type !== "string" || !allowed.has(part.type)) {
+        throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", part.type));
+    }
+    if (part.type === "input_image") {
+        if (part.file_id !== undefined || typeof part.image_url !== "string" || !OPENAI_INLINE_IMAGE.test(part.image_url)) {
+            throw new CodingProxyError(400, "openai_remote_input_not_allowed");
+        }
+        openAiOnlyKeys(part, ["type", "image_url", "detail"]);
+        if (part.detail !== undefined && (typeof part.detail !== "string" || !OPENAI_IMAGE_DETAILS.has(part.detail))) {
+            throw new CodingProxyError(400, "invalid_openai_request");
+        }
+    }
+    else if (part.type === "encrypted_content") {
+        openAiOnlyKeys(part, ["type", "encrypted_content"]);
+        openAiString(part.encrypted_content, PROXY_MAX_BODY_BYTES);
+    }
+    else {
+        openAiOnlyKeys(part, ["type", "text"]);
+        openAiString(part.text, PROXY_MAX_BODY_BYTES);
+    }
+}
+function validateOpenAiContent(value, allowed, allowString = true) {
+    if (typeof value === "string" && allowString)
+        return;
+    if (!Array.isArray(value) || value.length > MAX_OPENAI_ITEMS)
+        throw new CodingProxyError(400, "invalid_openai_request");
+    for (const part of value)
+        validateOpenAiContentPart(part, allowed);
+}
+function validateOpenAiTextParts(value, type) {
+    if (!Array.isArray(value) || value.length > MAX_OPENAI_ITEMS)
+        throw new CodingProxyError(400, "invalid_openai_request");
+    for (const candidate of value) {
+        const part = openAiRecord(candidate);
+        openAiOnlyKeys(part, ["type", "text"]);
+        if (part.type !== type)
+            throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", part.type));
+        openAiString(part.text, PROXY_MAX_BODY_BYTES);
+    }
+}
+function validateOpenAiInputItem(value, toolCount) {
+    const item = openAiRecord(value);
+    switch (item.type) {
+        case undefined:
+        case "message": {
+            openAiOnlyKeys(item, ["type", "id", "role", "content", "phase"]);
+            openAiOptional(item.id, openAiId);
+            if (typeof item.role !== "string" || !OPENAI_MESSAGE_ROLES.has(item.role)) {
+                throw new CodingProxyError(400, "invalid_openai_request");
+            }
+            if (item.phase !== undefined && (typeof item.phase !== "string" || !OPENAI_MESSAGE_PHASES.has(item.phase))) {
+                throw new CodingProxyError(400, "invalid_openai_request");
+            }
+            validateOpenAiContent(item.content, item.role === "assistant" ? OPENAI_ASSISTANT_PARTS : OPENAI_INPUT_PARTS);
+            return;
+        }
+        case "reasoning":
+            openAiOnlyKeys(item, ["type", "id", "summary", "content", "encrypted_content"]);
+            openAiOptional(item.id, openAiId);
+            validateOpenAiTextParts(item.summary, "summary_text");
+            if (item.content !== undefined && item.content !== null)
+                validateOpenAiTextParts(item.content, "reasoning_text");
+            if (item.encrypted_content !== undefined && item.encrypted_content !== null) {
+                openAiString(item.encrypted_content, PROXY_MAX_BODY_BYTES);
+            }
+            return;
+        case "function_call":
+            openAiOnlyKeys(item, ["type", "id", "call_id", "name", "namespace", "arguments"]);
+            openAiOptional(item.id, openAiId);
+            openAiId(item.call_id);
+            openAiToolName(item.name);
+            openAiOptional(item.namespace, (value) => openAiToolName(value));
+            openAiString(item.arguments, PROXY_MAX_BODY_BYTES);
+            return;
+        case "custom_tool_call":
+            openAiOnlyKeys(item, ["type", "id", "status", "call_id", "name", "input"]);
+            openAiOptional(item.id, openAiId);
+            openAiOptional(item.status, (value) => openAiString(value, 64));
+            openAiId(item.call_id);
+            openAiToolName(item.name);
+            openAiString(item.input, PROXY_MAX_BODY_BYTES);
+            return;
+        case "function_call_output":
+        case "custom_tool_call_output":
+            openAiOnlyKeys(item, item.type === "function_call_output"
+                ? ["type", "id", "call_id", "output"]
+                : ["type", "id", "call_id", "name", "output"]);
+            openAiOptional(item.id, openAiId);
+            openAiId(item.call_id);
+            openAiOptional(item.name, (value) => openAiToolName(value));
+            validateOpenAiContent(item.output, OPENAI_INPUT_PARTS);
+            return;
+        case "agent_message":
+            openAiOnlyKeys(item, ["type", "id", "author", "recipient", "content"]);
+            openAiOptional(item.id, openAiId);
+            openAiOptional(item.author, (value) => openAiString(value, MAX_OPENAI_ID_LENGTH));
+            openAiOptional(item.recipient, (value) => openAiString(value, MAX_OPENAI_ID_LENGTH));
+            validateOpenAiContent(item.content, OPENAI_AGENT_MESSAGE_PARTS, false);
+            return;
+        case "additional_tools":
+            openAiOnlyKeys(item, ["type", "id", "role", "tools"]);
+            openAiOptional(item.id, openAiId);
+            if (item.role !== undefined && item.role !== "developer")
+                throw new CodingProxyError(400, "invalid_openai_request");
+            validateOpenAiTools(item.tools, toolCount);
+            return;
+        default:
+            throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", item.type));
+    }
+}
+function validateOpenAiReasoning(value) {
+    const reasoning = openAiRecord(value, "openai_reasoning_not_allowed");
+    openAiOnlyKeys(reasoning, ["effort", "summary", "context"], "openai_reasoning_not_allowed");
+    for (const [key, allowed] of [
+        ["effort", OPENAI_REASONING_EFFORTS],
+        ["summary", OPENAI_REASONING_SUMMARIES],
+        ["context", OPENAI_REASONING_CONTEXTS],
+    ]) {
+        const setting = reasoning[key];
+        if (setting !== undefined && (typeof setting !== "string" || !allowed.has(setting))) {
+            throw new CodingProxyError(400, "openai_reasoning_not_allowed");
+        }
+    }
+}
+function validateOpenAiText(value) {
+    const text = openAiRecord(value, "openai_text_not_allowed");
+    openAiOnlyKeys(text, ["verbosity", "format"], "openai_text_not_allowed");
+    if (text.verbosity !== undefined && (typeof text.verbosity !== "string" || !OPENAI_VERBOSITIES.has(text.verbosity))) {
+        throw new CodingProxyError(400, "openai_text_not_allowed");
+    }
+    if (text.format === undefined)
+        return;
+    const format = openAiRecord(text.format, "openai_text_not_allowed");
+    if (format.type === "text")
+        return openAiOnlyKeys(format, ["type"], "openai_text_not_allowed");
+    openAiOnlyKeys(format, ["type", "name", "schema", "strict", "description"], "openai_text_not_allowed");
+    if (format.type !== "json_schema" || typeof format.name !== "string" || !OPENAI_TOOL_NAME.test(format.name)) {
+        throw new CodingProxyError(400, "openai_text_not_allowed");
+    }
+    openAiRecord(format.schema, "openai_text_not_allowed");
+    if (format.strict !== undefined && typeof format.strict !== "boolean") {
+        throw new CodingProxyError(400, "openai_text_not_allowed");
+    }
+    openAiOptional(format.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "openai_text_not_allowed"));
+}
+function validateOpenAiClientMetadata(value) {
+    const metadata = openAiRecord(value);
+    for (const [key, entry] of Object.entries(metadata)) {
+        if (!OPENAI_CLIENT_METADATA_KEYS.has(key)) {
+            throw new CodingProxyError(400, openAiCode("openai_client_metadata_key_not_allowed", key));
+        }
+        openAiString(entry, MAX_OPENAI_METADATA_VALUE_LENGTH);
+    }
+}
+function validateOpenAiBody(body) {
+    for (const key of Object.keys(body)) {
+        if (!OPENAI_REQUEST_KEYS.has(key))
+            throw new CodingProxyError(400, openAiCode("openai_request_key_not_allowed", key));
+    }
+    if (body.background !== undefined && body.background !== false) {
+        throw new CodingProxyError(400, body.background === true ? "background_not_allowed" : "invalid_openai_request");
+    }
+    if (body.service_tier !== undefined) {
+        if (typeof body.service_tier !== "string" || !OPENAI_SERVICE_TIERS.has(body.service_tier)) {
+            throw new CodingProxyError(400, "service_tier_not_allowed");
+        }
+    }
+    if (body.store !== undefined && typeof body.store !== "boolean") {
+        throw new CodingProxyError(400, "invalid_openai_request");
+    }
+    openAiOptional(body.instructions, (value) => openAiString(value, PROXY_MAX_BODY_BYTES));
+    const toolCount = { value: 0 };
+    if (body.tools !== undefined)
+        validateOpenAiTools(body.tools, toolCount);
+    if (body.tool_choice !== undefined) {
+        if (typeof body.tool_choice !== "string" || !OPENAI_TOOL_CHOICES.has(body.tool_choice)) {
+            throw new CodingProxyError(400, "openai_tool_choice_not_allowed");
+        }
+    }
+    if (body.parallel_tool_calls !== undefined && typeof body.parallel_tool_calls !== "boolean") {
+        throw new CodingProxyError(400, "invalid_openai_request");
+    }
+    openAiOptional(body.reasoning, validateOpenAiReasoning);
+    if (body.include !== undefined) {
+        const include = body.include;
+        if (!Array.isArray(include) ||
+            new Set(include).size !== include.length ||
+            include.some((entry) => typeof entry !== "string" || !OPENAI_INCLUDES.has(entry))) {
+            throw new CodingProxyError(400, "openai_include_not_allowed");
+        }
+    }
+    openAiOptional(body.prompt_cache_key, (value) => openAiString(value, MAX_OPENAI_ID_LENGTH));
+    openAiOptional(body.text, validateOpenAiText);
+    openAiOptional(body.client_metadata, validateOpenAiClientMetadata);
+    if (typeof body.input === "string")
+        return;
+    if (!Array.isArray(body.input) || body.input.length > MAX_OPENAI_ITEMS) {
+        throw new CodingProxyError(400, "invalid_openai_request");
+    }
+    for (const item of body.input)
+        validateOpenAiInputItem(item, toolCount);
+}
 function parseOpenAiRequest(rawBody) {
     if (Buffer.byteLength(rawBody) > PROXY_MAX_BODY_BYTES)
         throw new CodingProxyError(413, "payload_too_large");
@@ -59,8 +420,7 @@ function parseOpenAiRequest(rawBody) {
     }
     if (body.stream !== true && body.stream !== false)
         throw new CodingProxyError(400, "stream_required");
-    if (body.background === true)
-        throw new CodingProxyError(400, "background_not_allowed");
+    validateOpenAiBody(body);
     const normalized = { ...body, max_output_tokens: maxOutputTokens, store: false, background: false };
     const encoded = JSON.stringify(normalized);
     if (Buffer.byteLength(encoded) > PROXY_MAX_BODY_BYTES)
@@ -118,7 +478,7 @@ function validateCommandInput(value) {
         (typeof input.timeout_ms !== "number" ||
             !Number.isSafeInteger(input.timeout_ms) ||
             input.timeout_ms < 1_000 ||
-            input.timeout_ms > 60_000)) {
+            input.timeout_ms > MAX_COMMAND_TIMEOUT_MS)) {
         throw new CodingProxyError(400, "unsupported_anthropic_feature");
     }
 }
@@ -227,6 +587,15 @@ function parseAnthropicBeta(value) {
     const normalized = [...unique].sort();
     return { header: normalized.join(","), values: new Set(normalized) };
 }
+/**
+ * Models that take manual extended thinking (`{type: "enabled", budget_tokens}`) instead of adaptive
+ * thinking, and no effort level: Claude Haiku 4.5, which returns a 400 for adaptive thinking. The
+ * pinned Claude Agent SDK sends it `budget_tokens` = max_tokens - 1 and no `output_config`
+ * (fixtures/anthropic-sdk-request-haiku-4-5.json). Every other model stays adaptive-only.
+ */
+const MANUAL_THINKING_MODELS = new Set(["claude-haiku-4-5"]);
+/** Anthropic's minimum manual thinking budget. */
+const MIN_THINKING_BUDGET_TOKENS = 1024;
 function requireAnthropicBeta(values, beta) {
     if (!values.has(beta))
         throw new CodingProxyError(400, "anthropic_beta_required");
@@ -305,13 +674,27 @@ function parseAnthropicRequest(rawBody, betaHeader) {
         if (typeof metadata.user_id !== "string")
             throw new CodingProxyError(400, "invalid_anthropic_request");
     }
+    const manualThinking = MANUAL_THINKING_MODELS.has(body.model);
     if (body.thinking !== undefined) {
         requireAnthropicBeta(beta.values, "interleaved-thinking-2025-05-14");
         requireAnthropicBeta(beta.values, "thinking-token-count-2026-05-13");
         const thinking = record(body.thinking);
-        onlyKeys(thinking, ["type"]);
-        if (thinking.type !== "adaptive")
-            throw new CodingProxyError(400, "unsupported_anthropic_feature");
+        if (manualThinking) {
+            onlyKeys(thinking, ["type", "budget_tokens"]);
+            const budget = thinking.budget_tokens;
+            if (thinking.type !== "enabled" ||
+                typeof budget !== "number" ||
+                !Number.isSafeInteger(budget) ||
+                budget < MIN_THINKING_BUDGET_TOKENS ||
+                budget >= body.max_tokens) {
+                throw new CodingProxyError(400, "unsupported_anthropic_feature");
+            }
+        }
+        else {
+            onlyKeys(thinking, ["type"]);
+            if (thinking.type !== "adaptive")
+                throw new CodingProxyError(400, "unsupported_anthropic_feature");
+        }
     }
     if (body.context_management !== undefined) {
         requireAnthropicBeta(beta.values, "context-management-2025-06-27");
@@ -327,6 +710,9 @@ function parseAnthropicRequest(rawBody, betaHeader) {
         }
     }
     if (body.output_config !== undefined) {
+        // Effort doesn't exist on a manual-thinking model; the SDK never sends it there.
+        if (manualThinking)
+            throw new CodingProxyError(400, "unsupported_anthropic_feature");
         requireAnthropicBeta(beta.values, "effort-2025-11-24");
         const output = record(body.output_config);
         onlyKeys(output, ["effort"]);
@@ -352,9 +738,18 @@ function parseRequest(protocol, rawBody, anthropicBeta) {
     if (protocol !== "anthropic-messages" && anthropicBeta !== undefined) {
         throw new CodingProxyError(400, "invalid_anthropic_beta");
     }
-    return protocol === "anthropic-messages"
-        ? parseAnthropicRequest(rawBody, anthropicBeta)
-        : parseOpenAiRequest(rawBody);
+    try {
+        return protocol === "anthropic-messages"
+            ? parseAnthropicRequest(rawBody, anthropicBeta)
+            : parseOpenAiRequest(rawBody);
+    }
+    catch (error) {
+        // JSON nested deeply enough (inside a free-form tool schema, say) overflows
+        // the stack when re-encoded. It is the client's request, not a proxy fault.
+        if (error instanceof RangeError)
+            throw new CodingProxyError(400, "request_nesting_too_deep");
+        throw error;
+    }
 }
 function safeRequestKey(value, fingerprint) {
     if (value === undefined)
@@ -437,6 +832,7 @@ export class CodingProxy {
             throw new Error("invalid_proxy_credential_reference");
         const capability = `rrp_${randomBytes(32).toString("base64url")}`;
         const id = randomUUID();
+        const registryTokenHash = capabilityHash(deriveRegistryToken(capability));
         await this.ledger.createSession({
             id,
             runId: input.runId,
@@ -446,6 +842,7 @@ export class CodingProxy {
             allowedModels: models,
             deadlineAt: input.deadlineAt,
             budgetUsd: input.budgetUsd,
+            registryTokenHash,
         });
         this.audit({ type: "session.created", runId: input.runId });
         return {
@@ -463,13 +860,33 @@ export class CodingProxy {
         for (const controller of this.activeRequests.get(sessionId) ?? [])
             controller.abort();
     }
+    /** Whether this session's run was refused a model request for budget. */
+    budgetExhausted(sessionId) {
+        return this.ledger.budgetExhausted(sessionId);
+    }
+    /** The code of the first upstream failure relayed for this session's run, if any. */
+    upstreamFailure(sessionId) {
+        return this.ledger.upstreamFailure(sessionId);
+    }
     async execute(input, sink) {
         const session = await this.authenticate(input.bearer);
         if (session.protocol !== input.protocol) {
             this.audit({ type: "request.rejected", runId: session.runId, reason: "protocol_mismatch" });
             throw new CodingProxyError(403, "protocol_mismatch");
         }
-        const parsed = parseRequest(input.protocol, input.rawBody, input.anthropicBeta);
+        let parsed;
+        try {
+            parsed = parseRequest(input.protocol, input.rawBody, input.anthropicBeta);
+        }
+        catch (error) {
+            // The session is already authenticated and no credential has been
+            // resolved; record the refusal against the run so a smuggling attempt
+            // is attributable, then refuse.
+            if (error instanceof CodingProxyError) {
+                this.audit({ type: "request.rejected", runId: session.runId, status: error.status, reason: error.code });
+            }
+            throw error;
+        }
         if (!session.allowedModels.includes(parsed.model)) {
             this.audit({ type: "request.rejected", runId: session.runId, model: parsed.model, reason: "model_not_allowed" });
             throw new CodingProxyError(403, "model_not_allowed");
@@ -558,6 +975,8 @@ export class CodingProxy {
             const headers = {
                 "content-type": "application/json",
                 accept: parsed.stream ? "text/event-stream" : "application/json",
+                // The pinned fetch never decompresses, and the response is relayed as-is.
+                "accept-encoding": "identity",
             };
             if (session.protocol === "anthropic-messages") {
                 headers["x-api-key"] = key;
@@ -583,7 +1002,10 @@ export class CodingProxy {
             throw new CodingProxyError(502, controller.signal.aborted ? "upstream_aborted" : "upstream_transport_error");
         }
         if (!upstream.ok) {
+            // Read while the deadline still bounds the body; the body itself is never relayed.
+            const code = (await rejectedUpstreamErrorCode(upstream)) ?? `http_${upstream.status}`;
             cleanupActive();
+            await this.recordUpstreamFailure(session, code);
             await this.ledger.release(request.id, upstream.status);
             this.audit({
                 type: "request.released",
@@ -604,7 +1026,7 @@ export class CodingProxy {
                 await this.forwardJson(session, request, upstream, sink);
         }
         catch (error) {
-            await this.markUncertain(session, request, upstream.status, "invalid_or_incomplete_upstream_response");
+            await this.markUncertain(session, request, upstream.status, failureReason(error), responseHeadersOf(upstream));
             sink.destroy();
             throw error instanceof CodingProxyError ? error : new CodingProxyError(502, "invalid_upstream_response");
         }
@@ -681,6 +1103,7 @@ export class CodingProxy {
         let buffer = "";
         let receivedBytes = 0;
         let completed = false;
+        let failedWithoutUsage = false;
         const anthropicUsage = session.protocol === "anthropic-messages" ? new AnthropicSseUsageTracker() : undefined;
         const body = upstream.body;
         for await (const chunk of body) {
@@ -699,23 +1122,61 @@ export class CodingProxy {
                     await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
                     continue;
                 }
-                if (!terminal.usage)
-                    throw new Error("terminal_usage_missing");
+                if (!terminal.usage) {
+                    if (!terminal.failure)
+                        throw new Error("terminal_usage_missing");
+                    // The upstream failed the response and reported no usage. Pass its failure on so the
+                    // client sees the real error instead of a cut connection; the reservation stays held.
+                    await this.recordUpstreamFailure(session, terminal.failure);
+                    if (!completed) {
+                        await this.markUncertain(session, request, upstream.status, `upstream_failed:${terminal.failure}`, responseHeadersOf(upstream));
+                    }
+                    failedWithoutUsage = true;
+                    await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
+                    continue;
+                }
                 await this.complete(session, request, terminal.usage, upstream.status);
                 completed = true;
                 await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
             }
         }
         buffer = (buffer + decoder.decode()).replaceAll("\r\n", "\n");
-        if (!completed)
+        if (!completed && !failedWithoutUsage)
             throw new Error("terminal_usage_missing");
         if (buffer)
             await safeWrite(sink, Buffer.from(buffer), connected);
         if (connected.value)
             sink.end();
     }
-    async markUncertain(session, request, status, reason) {
+    /** Best effort: the executor reads it to name the failure; it must never break the relay. */
+    async recordUpstreamFailure(session, code) {
+        await this.ledger.recordUpstreamFailure(session.id, code).catch(() => undefined);
+    }
+    async markUncertain(session, request, status, reason, headers = {}) {
         await this.ledger.markUncertain(request.id, status);
-        this.audit({ type: "request.uncertain", runId: session.runId, requestId: request.id, status, reason });
+        this.audit({ type: "request.uncertain", runId: session.runId, requestId: request.id, status, reason, ...headers });
     }
 }
+/** The safe error code in a rejected upstream's JSON body, or undefined when it names none or cannot be read. */
+async function rejectedUpstreamErrorCode(upstream) {
+    try {
+        const bytes = await readBoundedBody(upstream.body, MAX_UPSTREAM_ERROR_BYTES);
+        const value = JSON.parse(Buffer.from(bytes).toString("utf8"));
+        return value && typeof value === "object" ? safeUpstreamErrorCode(value) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The fixed code a relay failed with, or a generic one: error messages are not recorded. */
+function failureReason(error) {
+    const message = error instanceof Error ? error.message : "";
+    return /^[a-z_]{1,64}$/.test(message) ? message : "stream_read_failed";
+}
+/** The upstream's content type and encoding, trimmed to a short printable value, for the audit record. */
+function responseHeadersOf(upstream) {
+    const clean = (value) => value ? value.replace(/[^\x20-\x7e]/g, "").slice(0, 100) || undefined : undefined;
+    const contentType = clean(upstream.headers.get("content-type"));
+    const contentEncoding = clean(upstream.headers.get("content-encoding"));
+    return { ...(contentType ? { contentType } : {}), ...(contentEncoding ? { contentEncoding } : {}) };
+}