@wardby/cli 0.2.1 → 0.4.0

package/dist/providers/coding-proxy/proxy.js

@@ -1,7 +1,8 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { getModelPricing, PRICING_VERSION } from "../llm/pricing.js";
-import { getAnthropicPricing } from "../llm/pricing-anthropic.js";
-import { AnthropicSseUsageTracker, actualCostUsd, estimateReservationUsd, fingerprintRequest, parseAnthropicAuthoritativeUsage, parseAuthoritativeUsage, pricingSnapshot, terminalUsageFromSseFrame, } from "./metering.js";
+import { shippedCatalog } from "../llm/catalog.js";
+import { SHIPPED_CATALOG_VERSION } from "../llm/catalog-shipped.js";
+import { deriveRegistryToken } from "../../coding/registry/token.js";
+import { AnthropicSseUsageTracker, actualCostUsd, estimateReservationUsd, fingerprintRequest, parseAnthropicAuthoritativeUsage, parseAuthoritativeUsage, pricingSnapshot, safeUpstreamErrorCode, terminalUsageFromSseFrame, } from "./metering.js";
 import { createPinnedProxyFetch } from "./secure-fetch.js";
 export const PROXY_MAX_BODY_BYTES = 8 * 1024 * 1024;
 export const PROXY_MAX_OUTPUT_TOKENS = 1_000_000;
@@ -16,12 +17,26 @@ export const CLAUDE_CODE_ANTHROPIC_BETAS = [
     "thinking-token-count-2026-05-13",
 ];
 const MAX_UPSTREAM_JSON_BYTES = 16 * 1024 * 1024;
+/** A rejected upstream's error body is read only this far, for its error code. */
+const MAX_UPSTREAM_ERROR_BYTES = 64 * 1024;
 const REQUEST_KEY_PATTERN = /^[\x21-\x7e]{1,200}$/;
-const APPROVED_ANTHROPIC_BETAS = new Set(CLAUDE_CODE_ANTHROPIC_BETAS);
+/**
+ * Betas Claude Code sends only for some models. per-turn-control is sent for Claude Opus 5.5; it is
+ * required only by an effort-only system message (per-turn effort), and every body field is still
+ * checked against the reviewed shape, so the header alone unlocks nothing.
+ */
+export const OPTIONAL_ANTHROPIC_BETAS = ["per-turn-control-2026-07-01"];
+const APPROVED_ANTHROPIC_BETAS = new Set([...CLAUDE_CODE_ANTHROPIC_BETAS, ...OPTIONAL_ANTHROPIC_BETAS]);
 const WARDBY_COMMAND_TOOL = "mcp__wardby_tools__run_command";
 const STRUCTURED_OUTPUT_TOOL = "StructuredOutput";
 const MAX_COMMAND_BYTES = 16 * 1024;
 const MAX_TOOL_TEXT_BYTES = 256 * 1024;
+/**
+ * The longest run_command timeout the Claude tool runner offers the model (its MAX_TIMEOUT_MS,
+ * src/claude-tool-runner/command.mjs; the proxy tests keep the two equal). A lower limit here let the
+ * command run, then refused the next request, which replays that tool call, as unsupported.
+ */
+export const MAX_COMMAND_TIMEOUT_MS = 120_000;
 export class CodingProxyError extends Error {
     status;
     code;
@@ -31,9 +46,361 @@ export class CodingProxyError extends Error {
         this.code = code;
     }
 }
-function capabilityHash(capability) {
+export function capabilityHash(capability) {
     return createHash("sha256").update(capability).digest("base64url");
 }
+// OpenAI Responses allowlist. Everything a request may carry is listed here;
+// anything else is refused before a credential is resolved. It mirrors what the
+// pinned Codex CLI (src/coding-worker/package.json) actually sends, recorded in
+// fixtures/codex-<version>-responses-requests.json. Only client-side tools
+// (function, custom, and namespaces of them) are allowed: a hosted tool (web
+// search, remote MCP, code interpreter, image generation, file search, ...), a
+// remote image or file, a stored prompt, or a previous response would make
+// OpenAI fetch or run something outside the worker's egress policy and outside
+// the token-metered budget. Tool names vary by model and Codex version, so they
+// are checked for shape, not against a fixed list: a client-side tool the model
+// calls is executed by the worker itself, which the container boundary governs.
+const OPENAI_REQUEST_KEYS = new Set([
+    "model",
+    "instructions",
+    "input",
+    "tools",
+    "tool_choice",
+    "parallel_tool_calls",
+    "reasoning",
+    "store",
+    "stream",
+    "include",
+    "prompt_cache_key",
+    "text",
+    "client_metadata",
+    "max_output_tokens",
+    "background",
+    "service_tier",
+]);
+const OPENAI_REASONING_EFFORTS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"]);
+const OPENAI_REASONING_SUMMARIES = new Set(["auto", "concise", "detailed", "none"]);
+const OPENAI_REASONING_CONTEXTS = new Set(["all_turns", "current_turn"]);
+const OPENAI_INCLUDES = new Set(["reasoning.encrypted_content"]);
+// Only unset (Codex never sends one) or an explicit "default". "auto" defers to
+// the OpenAI project's own tier setting, which may be priority or scale; those
+// and "flex" are billed at rates the pricing table does not track.
+const OPENAI_SERVICE_TIERS = new Set(["default"]);
+// The client_metadata keys the pinned Codex sends (recorded fixture). Several
+// are x-codex-*/x-openai-* keys whose server-side meaning is undocumented, so a
+// new key fails closed like every other unknown field.
+const OPENAI_CLIENT_METADATA_KEYS = new Set([
+    "parent_turn_id",
+    "root_turn_id",
+    "session_id",
+    "thread_id",
+    "turn_id",
+    "x-codex-installation-id",
+    "x-codex-parent-thread-id",
+    "x-codex-turn-metadata",
+    "x-codex-window-id",
+    "x-openai-subagent",
+]);
+const OPENAI_TOOL_CHOICES = new Set(["auto", "none", "required"]);
+const OPENAI_VERBOSITIES = new Set(["low", "medium", "high"]);
+const OPENAI_IMAGE_DETAILS = new Set(["auto", "low", "high", "original"]);
+const OPENAI_MESSAGE_ROLES = new Set(["user", "developer", "system", "assistant"]);
+const OPENAI_MESSAGE_PHASES = new Set(["commentary", "final_answer"]);
+const OPENAI_GRAMMAR_SYNTAXES = new Set(["lark", "regex"]);
+const OPENAI_INPUT_PARTS = new Set(["input_text", "input_image"]);
+const OPENAI_ASSISTANT_PARTS = new Set(["output_text"]);
+const OPENAI_AGENT_MESSAGE_PARTS = new Set(["input_text", "encrypted_content"]);
+const OPENAI_TOOL_NAME = /^[A-Za-z0-9_-]{1,128}$/;
+const OPENAI_CODE_SUFFIX = /^[A-Za-z0-9_.-]{1,64}$/;
+// Only an inline base64 image: Codex's view_image and code-mode image() send
+// local files this way. A URL (or a file_id) would make OpenAI fetch it.
+const OPENAI_INLINE_IMAGE = /^data:image\/(?:png|jpeg|gif|webp);base64,[A-Za-z0-9+/]+={0,2}$/;
+const MAX_OPENAI_ITEMS = 10_000;
+const MAX_OPENAI_TOOLS = 512;
+const MAX_OPENAI_ID_LENGTH = 512;
+const MAX_OPENAI_METADATA_VALUE_LENGTH = 16 * 1024;
+function openAiCode(prefix, value) {
+    return `${prefix}:${typeof value === "string" && OPENAI_CODE_SUFFIX.test(value) ? value : "other"}`;
+}
+function openAiRecord(value, code = "invalid_openai_request") {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new CodingProxyError(400, code);
+    return value;
+}
+function openAiOnlyKeys(value, keys, code = "invalid_openai_request") {
+    const allowed = new Set(keys);
+    if (Object.keys(value).some((key) => !allowed.has(key)))
+        throw new CodingProxyError(400, code);
+}
+function openAiString(value, maxLength, code = "invalid_openai_request") {
+    if (typeof value !== "string" || value.length > maxLength)
+        throw new CodingProxyError(400, code);
+}
+function openAiOptional(value, check) {
+    if (value !== undefined)
+        check(value);
+}
+function openAiId(value) {
+    if (typeof value !== "string" || value.length < 1 || value.length > MAX_OPENAI_ID_LENGTH) {
+        throw new CodingProxyError(400, "invalid_openai_request");
+    }
+}
+function openAiToolName(value, code = "invalid_openai_request") {
+    if (typeof value !== "string" || !OPENAI_TOOL_NAME.test(value))
+        throw new CodingProxyError(400, code);
+}
+function validateOpenAiFunctionTool(tool) {
+    openAiOnlyKeys(tool, ["type", "name", "description", "strict", "parameters"], "invalid_openai_tool");
+    openAiToolName(tool.name, "invalid_openai_tool");
+    openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
+    if (tool.strict !== undefined && typeof tool.strict !== "boolean") {
+        throw new CodingProxyError(400, "invalid_openai_tool");
+    }
+    openAiOptional(tool.parameters, (value) => openAiRecord(value, "invalid_openai_tool"));
+}
+function validateOpenAiCustomTool(tool) {
+    openAiOnlyKeys(tool, ["type", "name", "description", "format"], "invalid_openai_tool");
+    openAiToolName(tool.name, "invalid_openai_tool");
+    openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
+    if (tool.format === undefined)
+        return;
+    const format = openAiRecord(tool.format, "invalid_openai_tool");
+    if (format.type === "text")
+        return openAiOnlyKeys(format, ["type"], "invalid_openai_tool");
+    openAiOnlyKeys(format, ["type", "syntax", "definition"], "invalid_openai_tool");
+    if (format.type !== "grammar" || typeof format.syntax !== "string" || !OPENAI_GRAMMAR_SYNTAXES.has(format.syntax)) {
+        throw new CodingProxyError(400, "invalid_openai_tool");
+    }
+    openAiString(format.definition, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool");
+}
+function validateOpenAiTools(value, count, nested = false) {
+    if (!Array.isArray(value))
+        throw new CodingProxyError(400, "invalid_openai_tool");
+    for (const candidate of value) {
+        if (++count.value > MAX_OPENAI_TOOLS)
+            throw new CodingProxyError(400, "invalid_openai_tool");
+        const tool = openAiRecord(candidate, "invalid_openai_tool");
+        if (tool.type === "function") {
+            validateOpenAiFunctionTool(tool);
+        }
+        else if (tool.type === "custom") {
+            validateOpenAiCustomTool(tool);
+        }
+        else if (tool.type === "namespace" && !nested) {
+            openAiOnlyKeys(tool, ["type", "name", "description", "tools"], "invalid_openai_tool");
+            openAiToolName(tool.name, "invalid_openai_tool");
+            openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
+            validateOpenAiTools(tool.tools, count, true);
+        }
+        else {
+            throw new CodingProxyError(400, openAiCode("openai_tool_not_allowed", tool.type));
+        }
+    }
+}
+function validateOpenAiContentPart(value, allowed) {
+    const part = openAiRecord(value);
+    if (typeof part.type !== "string" || !allowed.has(part.type)) {
+        throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", part.type));
+    }
+    if (part.type === "input_image") {
+        if (part.file_id !== undefined || typeof part.image_url !== "string" || !OPENAI_INLINE_IMAGE.test(part.image_url)) {
+            throw new CodingProxyError(400, "openai_remote_input_not_allowed");
+        }
+        openAiOnlyKeys(part, ["type", "image_url", "detail"]);
+        if (part.detail !== undefined && (typeof part.detail !== "string" || !OPENAI_IMAGE_DETAILS.has(part.detail))) {
+            throw new CodingProxyError(400, "invalid_openai_request");
+        }
+    }
+    else if (part.type === "encrypted_content") {
+        openAiOnlyKeys(part, ["type", "encrypted_content"]);
+        openAiString(part.encrypted_content, PROXY_MAX_BODY_BYTES);
+    }
+    else {
+        openAiOnlyKeys(part, ["type", "text"]);
+        openAiString(part.text, PROXY_MAX_BODY_BYTES);
+    }
+}
+function validateOpenAiContent(value, allowed, allowString = true) {
+    if (typeof value === "string" && allowString)
+        return;
+    if (!Array.isArray(value) || value.length > MAX_OPENAI_ITEMS)
+        throw new CodingProxyError(400, "invalid_openai_request");
+    for (const part of value)
+        validateOpenAiContentPart(part, allowed);
+}
+function validateOpenAiTextParts(value, type) {
+    if (!Array.isArray(value) || value.length > MAX_OPENAI_ITEMS)
+        throw new CodingProxyError(400, "invalid_openai_request");
+    for (const candidate of value) {
+        const part = openAiRecord(candidate);
+        openAiOnlyKeys(part, ["type", "text"]);
+        if (part.type !== type)
+            throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", part.type));
+        openAiString(part.text, PROXY_MAX_BODY_BYTES);
+    }
+}
+function validateOpenAiInputItem(value, toolCount) {
+    const item = openAiRecord(value);
+    switch (item.type) {
+        case undefined:
+        case "message": {
+            openAiOnlyKeys(item, ["type", "id", "role", "content", "phase"]);
+            openAiOptional(item.id, openAiId);
+            if (typeof item.role !== "string" || !OPENAI_MESSAGE_ROLES.has(item.role)) {
+                throw new CodingProxyError(400, "invalid_openai_request");
+            }
+            if (item.phase !== undefined && (typeof item.phase !== "string" || !OPENAI_MESSAGE_PHASES.has(item.phase))) {
+                throw new CodingProxyError(400, "invalid_openai_request");
+            }
+            validateOpenAiContent(item.content, item.role === "assistant" ? OPENAI_ASSISTANT_PARTS : OPENAI_INPUT_PARTS);
+            return;
+        }
+        case "reasoning":
+            openAiOnlyKeys(item, ["type", "id", "summary", "content", "encrypted_content"]);
+            openAiOptional(item.id, openAiId);
+            validateOpenAiTextParts(item.summary, "summary_text");
+            if (item.content !== undefined && item.content !== null)
+                validateOpenAiTextParts(item.content, "reasoning_text");
+            if (item.encrypted_content !== undefined && item.encrypted_content !== null) {
+                openAiString(item.encrypted_content, PROXY_MAX_BODY_BYTES);
+            }
+            return;
+        case "function_call":
+            openAiOnlyKeys(item, ["type", "id", "call_id", "name", "namespace", "arguments"]);
+            openAiOptional(item.id, openAiId);
+            openAiId(item.call_id);
+            openAiToolName(item.name);
+            openAiOptional(item.namespace, (value) => openAiToolName(value));
+            openAiString(item.arguments, PROXY_MAX_BODY_BYTES);
+            return;
+        case "custom_tool_call":
+            openAiOnlyKeys(item, ["type", "id", "status", "call_id", "name", "input"]);
+            openAiOptional(item.id, openAiId);
+            openAiOptional(item.status, (value) => openAiString(value, 64));
+            openAiId(item.call_id);
+            openAiToolName(item.name);
+            openAiString(item.input, PROXY_MAX_BODY_BYTES);
+            return;
+        case "function_call_output":
+        case "custom_tool_call_output":
+            openAiOnlyKeys(item, item.type === "function_call_output"
+                ? ["type", "id", "call_id", "output"]
+                : ["type", "id", "call_id", "name", "output"]);
+            openAiOptional(item.id, openAiId);
+            openAiId(item.call_id);
+            openAiOptional(item.name, (value) => openAiToolName(value));
+            validateOpenAiContent(item.output, OPENAI_INPUT_PARTS);
+            return;
+        case "agent_message":
+            openAiOnlyKeys(item, ["type", "id", "author", "recipient", "content"]);
+            openAiOptional(item.id, openAiId);
+            openAiOptional(item.author, (value) => openAiString(value, MAX_OPENAI_ID_LENGTH));
+            openAiOptional(item.recipient, (value) => openAiString(value, MAX_OPENAI_ID_LENGTH));
+            validateOpenAiContent(item.content, OPENAI_AGENT_MESSAGE_PARTS, false);
+            return;
+        case "additional_tools":
+            openAiOnlyKeys(item, ["type", "id", "role", "tools"]);
+            openAiOptional(item.id, openAiId);
+            if (item.role !== undefined && item.role !== "developer")
+                throw new CodingProxyError(400, "invalid_openai_request");
+            validateOpenAiTools(item.tools, toolCount);
+            return;
+        default:
+            throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", item.type));
+    }
+}
+function validateOpenAiReasoning(value) {
+    const reasoning = openAiRecord(value, "openai_reasoning_not_allowed");
+    openAiOnlyKeys(reasoning, ["effort", "summary", "context"], "openai_reasoning_not_allowed");
+    for (const [key, allowed] of [
+        ["effort", OPENAI_REASONING_EFFORTS],
+        ["summary", OPENAI_REASONING_SUMMARIES],
+        ["context", OPENAI_REASONING_CONTEXTS],
+    ]) {
+        const setting = reasoning[key];
+        if (setting !== undefined && (typeof setting !== "string" || !allowed.has(setting))) {
+            throw new CodingProxyError(400, "openai_reasoning_not_allowed");
+        }
+    }
+}
+function validateOpenAiText(value) {
+    const text = openAiRecord(value, "openai_text_not_allowed");
+    openAiOnlyKeys(text, ["verbosity", "format"], "openai_text_not_allowed");
+    if (text.verbosity !== undefined && (typeof text.verbosity !== "string" || !OPENAI_VERBOSITIES.has(text.verbosity))) {
+        throw new CodingProxyError(400, "openai_text_not_allowed");
+    }
+    if (text.format === undefined)
+        return;
+    const format = openAiRecord(text.format, "openai_text_not_allowed");
+    if (format.type === "text")
+        return openAiOnlyKeys(format, ["type"], "openai_text_not_allowed");
+    openAiOnlyKeys(format, ["type", "name", "schema", "strict", "description"], "openai_text_not_allowed");
+    if (format.type !== "json_schema" || typeof format.name !== "string" || !OPENAI_TOOL_NAME.test(format.name)) {
+        throw new CodingProxyError(400, "openai_text_not_allowed");
+    }
+    openAiRecord(format.schema, "openai_text_not_allowed");
+    if (format.strict !== undefined && typeof format.strict !== "boolean") {
+        throw new CodingProxyError(400, "openai_text_not_allowed");
+    }
+    openAiOptional(format.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "openai_text_not_allowed"));
+}
+function validateOpenAiClientMetadata(value) {
+    const metadata = openAiRecord(value);
+    for (const [key, entry] of Object.entries(metadata)) {
+        if (!OPENAI_CLIENT_METADATA_KEYS.has(key)) {
+            throw new CodingProxyError(400, openAiCode("openai_client_metadata_key_not_allowed", key));
+        }
+        openAiString(entry, MAX_OPENAI_METADATA_VALUE_LENGTH);
+    }
+}
+function validateOpenAiBody(body) {
+    for (const key of Object.keys(body)) {
+        if (!OPENAI_REQUEST_KEYS.has(key))
+            throw new CodingProxyError(400, openAiCode("openai_request_key_not_allowed", key));
+    }
+    if (body.background !== undefined && body.background !== false) {
+        throw new CodingProxyError(400, body.background === true ? "background_not_allowed" : "invalid_openai_request");
+    }
+    if (body.service_tier !== undefined) {
+        if (typeof body.service_tier !== "string" || !OPENAI_SERVICE_TIERS.has(body.service_tier)) {
+            throw new CodingProxyError(400, "service_tier_not_allowed");
+        }
+    }
+    if (body.store !== undefined && typeof body.store !== "boolean") {
+        throw new CodingProxyError(400, "invalid_openai_request");
+    }
+    openAiOptional(body.instructions, (value) => openAiString(value, PROXY_MAX_BODY_BYTES));
+    const toolCount = { value: 0 };
+    if (body.tools !== undefined)
+        validateOpenAiTools(body.tools, toolCount);
+    if (body.tool_choice !== undefined) {
+        if (typeof body.tool_choice !== "string" || !OPENAI_TOOL_CHOICES.has(body.tool_choice)) {
+            throw new CodingProxyError(400, "openai_tool_choice_not_allowed");
+        }
+    }
+    if (body.parallel_tool_calls !== undefined && typeof body.parallel_tool_calls !== "boolean") {
+        throw new CodingProxyError(400, "invalid_openai_request");
+    }
+    openAiOptional(body.reasoning, validateOpenAiReasoning);
+    if (body.include !== undefined) {
+        const include = body.include;
+        if (!Array.isArray(include) ||
+            new Set(include).size !== include.length ||
+            include.some((entry) => typeof entry !== "string" || !OPENAI_INCLUDES.has(entry))) {
+            throw new CodingProxyError(400, "openai_include_not_allowed");
+        }
+    }
+    openAiOptional(body.prompt_cache_key, (value) => openAiString(value, MAX_OPENAI_ID_LENGTH));
+    openAiOptional(body.text, validateOpenAiText);
+    openAiOptional(body.client_metadata, validateOpenAiClientMetadata);
+    if (typeof body.input === "string")
+        return;
+    if (!Array.isArray(body.input) || body.input.length > MAX_OPENAI_ITEMS) {
+        throw new CodingProxyError(400, "invalid_openai_request");
+    }
+    for (const item of body.input)
+        validateOpenAiInputItem(item, toolCount);
+}
 function parseOpenAiRequest(rawBody) {
     if (Buffer.byteLength(rawBody) > PROXY_MAX_BODY_BYTES)
         throw new CodingProxyError(413, "payload_too_large");
@@ -59,8 +426,7 @@ function parseOpenAiRequest(rawBody) {
     }
     if (body.stream !== true && body.stream !== false)
         throw new CodingProxyError(400, "stream_required");
-    if (body.background === true)
-        throw new CodingProxyError(400, "background_not_allowed");
+    validateOpenAiBody(body);
     const normalized = { ...body, max_output_tokens: maxOutputTokens, store: false, background: false };
     const encoded = JSON.stringify(normalized);
     if (Buffer.byteLength(encoded) > PROXY_MAX_BODY_BYTES)
@@ -118,7 +484,7 @@ function validateCommandInput(value) {
         (typeof input.timeout_ms !== "number" ||
             !Number.isSafeInteger(input.timeout_ms) ||
             input.timeout_ms < 1_000 ||
-            input.timeout_ms > 60_000)) {
+            input.timeout_ms > MAX_COMMAND_TIMEOUT_MS)) {
         throw new CodingProxyError(400, "unsupported_anthropic_feature");
     }
 }
@@ -227,11 +593,36 @@ function parseAnthropicBeta(value) {
     const normalized = [...unique].sort();
     return { header: normalized.join(","), values: new Set(normalized) };
 }
+/**
+ * Models whose catalog entry says `thinkingMode: "manual"` take manual extended thinking
+ * (`{type: "enabled", budget_tokens}`) instead of adaptive thinking, and no effort level (Claude
+ * Haiku 4.5 in the shipped catalog, which returns a 400 for adaptive thinking). The pinned Claude
+ * Agent SDK sends it `budget_tokens` = max_tokens - 1 and no `output_config`
+ * (fixtures/anthropic-sdk-request-haiku-4-5.json). Every other model stays adaptive-only.
+ */
+/** Anthropic's minimum manual thinking budget. */
+const MIN_THINKING_BUDGET_TOKENS = 1024;
 function requireAnthropicBeta(values, beta) {
     if (!values.has(beta))
         throw new CodingProxyError(400, "anthropic_beta_required");
 }
-function parseAnthropicRequest(rawBody, betaHeader) {
+/**
+ * An `output_config` (top-level, or on an effort-only system message): only an effort level, and
+ * only one the run's catalog entry lists. Budget is still reserved from max_tokens per request, so
+ * effort only changes how much of it the model uses. Effort doesn't exist on a manual-thinking
+ * model; the SDK never sends it there.
+ */
+function validateEffortConfig(value, { thinkingMode, efforts }, betas) {
+    if (thinkingMode === "manual")
+        throw new CodingProxyError(400, "unsupported_anthropic_feature");
+    requireAnthropicBeta(betas, "effort-2025-11-24");
+    const output = record(value);
+    onlyKeys(output, ["effort"]);
+    if (typeof output.effort !== "string" || !efforts.includes(output.effort)) {
+        throw new CodingProxyError(400, "unsupported_anthropic_feature");
+    }
+}
+function parseAnthropicRequest(rawBody, betaHeader, shape) {
     const beta = parseAnthropicBeta(betaHeader);
     if (Buffer.byteLength(rawBody) > PROXY_MAX_BODY_BYTES)
         throw new CodingProxyError(413, "payload_too_large");
@@ -272,12 +663,22 @@ function parseAnthropicRequest(rawBody, betaHeader) {
         validateTextBlocks(body.system);
     for (const value of body.messages) {
         const message = record(value);
-        onlyKeys(message, ["role", "content"]);
+        onlyKeys(message, message.role === "system" ? ["role", "content", "output_config"] : ["role", "content"]);
         if (message.role !== "user" && message.role !== "assistant" && message.role !== "system") {
             throw new CodingProxyError(400, "unsupported_anthropic_feature");
         }
         if (message.role === "system") {
             requireAnthropicBeta(beta.values, "mid-conversation-system-2026-04-07");
+            if (message.output_config !== undefined) {
+                // An effort-only system message (Claude Opus 5.5's per-turn effort): no content at all, and
+                // the same effort rule as the top-level output_config.
+                requireAnthropicBeta(beta.values, "per-turn-control-2026-07-01");
+                if (!Array.isArray(message.content) || message.content.length !== 0) {
+                    throw new CodingProxyError(400, "unsupported_anthropic_feature");
+                }
+                validateEffortConfig(message.output_config, shape, beta.values);
+                continue;
+            }
             if (typeof message.content === "string") {
                 if (Buffer.byteLength(message.content) > MAX_TOOL_TEXT_BYTES) {
                     throw new CodingProxyError(400, "unsupported_anthropic_feature");
@@ -305,13 +706,27 @@ function parseAnthropicRequest(rawBody, betaHeader) {
         if (typeof metadata.user_id !== "string")
             throw new CodingProxyError(400, "invalid_anthropic_request");
     }
+    const manualThinking = shape.thinkingMode === "manual";
     if (body.thinking !== undefined) {
         requireAnthropicBeta(beta.values, "interleaved-thinking-2025-05-14");
         requireAnthropicBeta(beta.values, "thinking-token-count-2026-05-13");
         const thinking = record(body.thinking);
-        onlyKeys(thinking, ["type"]);
-        if (thinking.type !== "adaptive")
-            throw new CodingProxyError(400, "unsupported_anthropic_feature");
+        if (manualThinking) {
+            onlyKeys(thinking, ["type", "budget_tokens"]);
+            const budget = thinking.budget_tokens;
+            if (thinking.type !== "enabled" ||
+                typeof budget !== "number" ||
+                !Number.isSafeInteger(budget) ||
+                budget < MIN_THINKING_BUDGET_TOKENS ||
+                budget >= body.max_tokens) {
+                throw new CodingProxyError(400, "unsupported_anthropic_feature");
+            }
+        }
+        else {
+            onlyKeys(thinking, ["type"]);
+            if (thinking.type !== "adaptive")
+                throw new CodingProxyError(400, "unsupported_anthropic_feature");
+        }
     }
     if (body.context_management !== undefined) {
         requireAnthropicBeta(beta.values, "context-management-2025-06-27");
@@ -326,13 +741,8 @@ function parseAnthropicRequest(rawBody, betaHeader) {
             throw new CodingProxyError(400, "unsupported_anthropic_feature");
         }
     }
-    if (body.output_config !== undefined) {
-        requireAnthropicBeta(beta.values, "effort-2025-11-24");
-        const output = record(body.output_config);
-        onlyKeys(output, ["effort"]);
-        if (output.effort !== "high")
-            throw new CodingProxyError(400, "unsupported_anthropic_feature");
-    }
+    if (body.output_config !== undefined)
+        validateEffortConfig(body.output_config, shape, beta.values);
     const normalized = { ...body };
     delete normalized.metadata;
     const encoded = JSON.stringify(normalized);
@@ -348,13 +758,22 @@ function parseAnthropicRequest(rawBody, betaHeader) {
         anthropicBeta: beta.header,
     };
 }
-function parseRequest(protocol, rawBody, anthropicBeta) {
+function parseRequest(protocol, rawBody, anthropicBeta, shape) {
     if (protocol !== "anthropic-messages" && anthropicBeta !== undefined) {
         throw new CodingProxyError(400, "invalid_anthropic_beta");
     }
-    return protocol === "anthropic-messages"
-        ? parseAnthropicRequest(rawBody, anthropicBeta)
-        : parseOpenAiRequest(rawBody);
+    try {
+        return protocol === "anthropic-messages"
+            ? parseAnthropicRequest(rawBody, anthropicBeta, shape)
+            : parseOpenAiRequest(rawBody);
+    }
+    catch (error) {
+        // JSON nested deeply enough (inside a free-form tool schema, say) overflows
+        // the stack when re-encoded. It is the client's request, not a proxy fault.
+        if (error instanceof RangeError)
+            throw new CodingProxyError(400, "request_nesting_too_deep");
+        throw error;
+    }
 }
 function safeRequestKey(value, fingerprint) {
     if (value === undefined)
@@ -414,10 +833,18 @@ export class CodingProxy {
                 });
         this.now = options.now ?? (() => new Date());
         this.audit = options.audit ?? (() => undefined);
+        // The fallback for sessions created before the catalog (no stored terms): the
+        // proxy has no catalog store, only the shipped catalog compiled into it.
         this.getPricing =
             options.pricing ??
-                ((model, protocol) => (protocol === "anthropic-messages" ? getAnthropicPricing(model) : getModelPricing(model)));
-        this.priceVersion = options.pricingVersion ?? PRICING_VERSION;
+                ((model, protocol) => {
+                    const entry = shippedCatalog().require(model);
+                    const expected = protocol === "anthropic-messages" ? "anthropic" : "openai";
+                    if (entry.provider !== expected)
+                        throw new Error("unknown_model");
+                    return entry;
+                });
+        this.priceVersion = options.pricingVersion ?? `shipped:${SHIPPED_CATALOG_VERSION}`;
     }
     async createSession(input) {
         if (input.protocol !== "openai-responses" && input.protocol !== "anthropic-messages") {
@@ -427,8 +854,16 @@ export class CodingProxy {
         if (models.length < 1 || models.length > 8 || models.some((model) => !model || model.length > 100)) {
             throw new Error("invalid_proxy_model_allowlist");
         }
-        for (const model of models)
-            this.getPricing(model, input.protocol);
+        if (input.terms) {
+            const expected = input.protocol === "anthropic-messages" ? "anthropic" : "openai";
+            if (models.length !== 1 || input.terms.entry.modelId !== models[0] || input.terms.entry.provider !== expected) {
+                throw new Error("invalid_proxy_model_terms");
+            }
+        }
+        else {
+            for (const model of models)
+                this.getPricing(model, input.protocol);
+        }
         if (!Number.isFinite(input.budgetUsd) || input.budgetUsd <= 0)
             throw new Error("invalid_proxy_budget");
         if (input.deadlineAt.getTime() <= this.now().getTime())
@@ -437,6 +872,7 @@ export class CodingProxy {
             throw new Error("invalid_proxy_credential_reference");
         const capability = `rrp_${randomBytes(32).toString("base64url")}`;
         const id = randomUUID();
+        const registryTokenHash = capabilityHash(deriveRegistryToken(capability));
         await this.ledger.createSession({
             id,
             runId: input.runId,
@@ -446,6 +882,8 @@ export class CodingProxy {
             allowedModels: models,
             deadlineAt: input.deadlineAt,
             budgetUsd: input.budgetUsd,
+            registryTokenHash,
+            terms: input.terms,
         });
         this.audit({ type: "session.created", runId: input.runId });
         return {
@@ -463,27 +901,53 @@ export class CodingProxy {
         for (const controller of this.activeRequests.get(sessionId) ?? [])
             controller.abort();
     }
+    /** Whether this session's run was refused a model request for budget. */
+    budgetExhausted(sessionId) {
+        return this.ledger.budgetExhausted(sessionId);
+    }
+    /** The code of the first upstream failure relayed for this session's run, if any. */
+    upstreamFailure(sessionId) {
+        return this.ledger.upstreamFailure(sessionId);
+    }
     async execute(input, sink) {
         const session = await this.authenticate(input.bearer);
         if (session.protocol !== input.protocol) {
             this.audit({ type: "request.rejected", runId: session.runId, reason: "protocol_mismatch" });
             throw new CodingProxyError(403, "protocol_mismatch");
         }
-        const parsed = parseRequest(input.protocol, input.rawBody, input.anthropicBeta);
+        // A session from before the model catalog has no stored entry: take the shape from the shipped one.
+        const entry = session.terms?.entry ?? shippedCatalog().get(session.allowedModels[0]);
+        const shape = {
+            thinkingMode: entry?.thinkingMode ?? "adaptive",
+            efforts: entry?.efforts ?? [],
+        };
+        let parsed;
+        try {
+            parsed = parseRequest(input.protocol, input.rawBody, input.anthropicBeta, shape);
+        }
+        catch (error) {
+            // The session is already authenticated and no credential has been
+            // resolved; record the refusal against the run so a smuggling attempt
+            // is attributable, then refuse.
+            if (error instanceof CodingProxyError) {
+                this.audit({ type: "request.rejected", runId: session.runId, status: error.status, reason: error.code });
+            }
+            throw error;
+        }
         if (!session.allowedModels.includes(parsed.model)) {
             this.audit({ type: "request.rejected", runId: session.runId, model: parsed.model, reason: "model_not_allowed" });
             throw new CodingProxyError(403, "model_not_allowed");
         }
-        let pricing;
+        let terms;
         try {
-            pricing = this.getPricing(parsed.model, session.protocol);
+            terms = this.termsFor(session, parsed.model);
         }
         catch {
             this.audit({ type: "request.rejected", runId: session.runId, model: parsed.model, reason: "unknown_model" });
             throw new CodingProxyError(400, "unknown_model");
         }
         const requestKey = safeRequestKey(input.requestKey, parsed.fingerprint);
-        const snapshot = pricingSnapshot(this.priceVersion, pricing);
+        const snapshot = pricingSnapshot(terms.version, terms.pricing);
         const reservationUsd = estimateReservationUsd(Buffer.byteLength(parsed.encoded), parsed.maxOutputTokens, snapshot);
         const reservation = await this.ledger.reserve({
             id: randomUUID(),
@@ -558,6 +1022,8 @@ export class CodingProxy {
             const headers = {
                 "content-type": "application/json",
                 accept: parsed.stream ? "text/event-stream" : "application/json",
+                // The pinned fetch never decompresses, and the response is relayed as-is.
+                "accept-encoding": "identity",
             };
             if (session.protocol === "anthropic-messages") {
                 headers["x-api-key"] = key;
@@ -583,7 +1049,10 @@ export class CodingProxy {
             throw new CodingProxyError(502, controller.signal.aborted ? "upstream_aborted" : "upstream_transport_error");
         }
         if (!upstream.ok) {
+            // Read while the deadline still bounds the body; the body itself is never relayed.
+            const code = (await rejectedUpstreamErrorCode(upstream)) ?? `http_${upstream.status}`;
             cleanupActive();
+            await this.recordUpstreamFailure(session, code);
             await this.ledger.release(request.id, upstream.status);
             this.audit({
                 type: "request.released",
@@ -604,7 +1073,7 @@ export class CodingProxy {
                 await this.forwardJson(session, request, upstream, sink);
         }
         catch (error) {
-            await this.markUncertain(session, request, upstream.status, "invalid_or_incomplete_upstream_response");
+            await this.markUncertain(session, request, upstream.status, failureReason(error), responseHeadersOf(upstream));
             sink.destroy();
             throw error instanceof CodingProxyError ? error : new CodingProxyError(502, "invalid_upstream_response");
         }
@@ -612,6 +1081,21 @@ export class CodingProxy {
             cleanupActive();
         }
     }
+    /** A session's model terms: its stored catalog entry, or the fallback for sessions from before the catalog. */
+    termsFor(session, model) {
+        if (session.terms) {
+            return {
+                pricing: session.terms.entry,
+                version: session.terms.version,
+                thinkingMode: session.terms.entry.thinkingMode,
+            };
+        }
+        return {
+            pricing: this.getPricing(model, session.protocol),
+            version: this.priceVersion,
+            thinkingMode: shippedCatalog().get(model)?.thinkingMode ?? "adaptive",
+        };
+    }
     async authenticate(bearer) {
         if (!bearer || bearer.length > 100)
             throw new CodingProxyError(401, "invalid_capability");
@@ -681,6 +1165,7 @@ export class CodingProxy {
         let buffer = "";
         let receivedBytes = 0;
         let completed = false;
+        let failedWithoutUsage = false;
         const anthropicUsage = session.protocol === "anthropic-messages" ? new AnthropicSseUsageTracker() : undefined;
         const body = upstream.body;
         for await (const chunk of body) {
@@ -699,23 +1184,61 @@ export class CodingProxy {
                     await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
                     continue;
                 }
-                if (!terminal.usage)
-                    throw new Error("terminal_usage_missing");
+                if (!terminal.usage) {
+                    if (!terminal.failure)
+                        throw new Error("terminal_usage_missing");
+                    // The upstream failed the response and reported no usage. Pass its failure on so the
+                    // client sees the real error instead of a cut connection; the reservation stays held.
+                    await this.recordUpstreamFailure(session, terminal.failure);
+                    if (!completed) {
+                        await this.markUncertain(session, request, upstream.status, `upstream_failed:${terminal.failure}`, responseHeadersOf(upstream));
+                    }
+                    failedWithoutUsage = true;
+                    await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
+                    continue;
+                }
                 await this.complete(session, request, terminal.usage, upstream.status);
                 completed = true;
                 await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
             }
         }
         buffer = (buffer + decoder.decode()).replaceAll("\r\n", "\n");
-        if (!completed)
+        if (!completed && !failedWithoutUsage)
             throw new Error("terminal_usage_missing");
         if (buffer)
             await safeWrite(sink, Buffer.from(buffer), connected);
         if (connected.value)
             sink.end();
     }
-    async markUncertain(session, request, status, reason) {
+    /** Best effort: the executor reads it to name the failure; it must never break the relay. */
+    async recordUpstreamFailure(session, code) {
+        await this.ledger.recordUpstreamFailure(session.id, code).catch(() => undefined);
+    }
+    async markUncertain(session, request, status, reason, headers = {}) {
         await this.ledger.markUncertain(request.id, status);
-        this.audit({ type: "request.uncertain", runId: session.runId, requestId: request.id, status, reason });
+        this.audit({ type: "request.uncertain", runId: session.runId, requestId: request.id, status, reason, ...headers });
     }
 }
+/** The safe error code in a rejected upstream's JSON body, or undefined when it names none or cannot be read. */
+async function rejectedUpstreamErrorCode(upstream) {
+    try {
+        const bytes = await readBoundedBody(upstream.body, MAX_UPSTREAM_ERROR_BYTES);
+        const value = JSON.parse(Buffer.from(bytes).toString("utf8"));
+        return value && typeof value === "object" ? safeUpstreamErrorCode(value) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The fixed code a relay failed with, or a generic one: error messages are not recorded. */
+function failureReason(error) {
+    const message = error instanceof Error ? error.message : "";
+    return /^[a-z_]{1,64}$/.test(message) ? message : "stream_read_failed";
+}
+/** The upstream's content type and encoding, trimmed to a short printable value, for the audit record. */
+function responseHeadersOf(upstream) {
+    const clean = (value) => value ? value.replace(/[^\x20-\x7e]/g, "").slice(0, 100) || undefined : undefined;
+    const contentType = clean(upstream.headers.get("content-type"));
+    const contentEncoding = clean(upstream.headers.get("content-encoding"));
+    return { ...(contentType ? { contentType } : {}), ...(contentEncoding ? { contentEncoding } : {}) };
+}