@wardby/cli 0.7.0 → 0.9.0

package/dist/providers/coding-proxy/proxy.js

@@ -1,11 +1,17 @@
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { randomBytes, randomUUID } from "node:crypto";
 import { shippedCatalog } from "../llm/catalog.js";
 import { SHIPPED_CATALOG_VERSION } from "../llm/catalog-shipped.js";
 import { deriveRegistryToken } from "../../coding/registry/token.js";
+import { capabilityHash } from "./capability-hash.js";
+import { CLAUDE_MCP_TOOL_PREFIX } from "../../coding/mcp-token.js";
 import { AnthropicSseUsageTracker, actualCostUsd, fingerprintRequest, parseAnthropicAuthoritativeUsage, parseAuthoritativeUsage, pricingSnapshot, safeUpstreamErrorCode, terminalUsageFromSseFrame, } from "./metering.js";
 import { conversationKey, estimateHold } from "./hold.js";
 import { estimateInterrupted, previousInput } from "./interrupted.js";
 import { createPinnedProxyFetch } from "./secure-fetch.js";
+import { resultsFromRequest, stepsFromJson, streamStepExtractor, } from "../../core/run-steps/extract.js";
+import { RUN_STEPS_LEVELS } from "../../core/run-steps/config.js";
+import { SeenIds } from "../../core/run-steps/seen.js";
+import { CLAUDE_RESULT_TOOL } from "../../core/run-steps/summarize.js";
 export const PROXY_MAX_BODY_BYTES = 8 * 1024 * 1024;
 export const PROXY_MAX_OUTPUT_TOKENS = 1_000_000;
 export const PROXY_DEFAULT_MAX_OUTPUT_TOKENS = 4_096;
@@ -30,7 +36,7 @@ const REQUEST_KEY_PATTERN = /^[\x21-\x7e]{1,200}$/;
 export const OPTIONAL_ANTHROPIC_BETAS = ["per-turn-control-2026-07-01"];
 const APPROVED_ANTHROPIC_BETAS = new Set([...CLAUDE_CODE_ANTHROPIC_BETAS, ...OPTIONAL_ANTHROPIC_BETAS]);
 const WARDBY_COMMAND_TOOL = "mcp__wardby_tools__run_command";
-const STRUCTURED_OUTPUT_TOOL = "StructuredOutput";
+const STRUCTURED_OUTPUT_TOOL = CLAUDE_RESULT_TOOL;
 const MAX_COMMAND_BYTES = 16 * 1024;
 const MAX_TOOL_TEXT_BYTES = 256 * 1024;
 /**
@@ -48,20 +54,26 @@ export class CodingProxyError extends Error {
         this.code = code;
     }
 }
-export function capabilityHash(capability) {
-    return createHash("sha256").update(capability).digest("base64url");
+/** What this session's replies and requests are read for. */
+function stepCapture(session, ceiling) {
+    const level = session.runStepsLevel ?? "summary";
+    if (level === "off" || ceiling === "off")
+        return "none";
+    return level === "detail" && ceiling === "detail" ? "detail" : "summary";
 }
+export { capabilityHash };
 // OpenAI Responses allowlist. Everything a request may carry is listed here;
 // anything else is refused before a credential is resolved. It mirrors what the
 // pinned Codex CLI (src/coding-worker/package.json) actually sends, recorded in
 // fixtures/codex-<version>-responses-requests.json. Only client-side tools
-// (function, custom, and namespaces of them) are allowed: a hosted tool (web
-// search, remote MCP, code interpreter, image generation, file search, ...), a
-// remote image or file, a stored prompt, or a previous response would make
-// OpenAI fetch or run something outside the worker's egress policy and outside
-// the token-metered budget. Tool names vary by model and Codex version, so they
-// are checked for shape, not against a fixed list: a client-side tool the model
-// calls is executed by the worker itself, which the container boundary governs.
+// (function, custom, namespaces of them, and the client-executed tool_search)
+// are allowed: a hosted tool (web search, remote MCP, code interpreter, image
+// generation, file search, ...), a remote image or file, a stored prompt, or a
+// previous response would make OpenAI fetch or run something outside the
+// worker's egress policy and outside the token-metered budget. Tool names vary
+// by model and Codex version, so they are checked for shape, not against a
+// fixed list: a client-side tool the model calls is executed by the worker
+// itself, which the container boundary governs.
 const OPENAI_REQUEST_KEYS = new Set([
     "model",
     "instructions",
@@ -151,13 +163,32 @@ function openAiToolName(value, code = "invalid_openai_request") {
     if (typeof value !== "string" || !OPENAI_TOOL_NAME.test(value))
         throw new CodingProxyError(400, code);
 }
-function validateOpenAiFunctionTool(tool) {
-    openAiOnlyKeys(tool, ["type", "name", "description", "strict", "parameters"], "invalid_openai_tool");
+function validateOpenAiFunctionTool(tool, inSearchOutput) {
+    openAiOnlyKeys(tool, inSearchOutput
+        ? ["type", "name", "description", "strict", "defer_loading", "parameters"]
+        : ["type", "name", "description", "strict", "parameters"], "invalid_openai_tool");
     openAiToolName(tool.name, "invalid_openai_tool");
     openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
     if (tool.strict !== undefined && typeof tool.strict !== "boolean") {
         throw new CodingProxyError(400, "invalid_openai_tool");
     }
+    // Codex marks the tools a tool_search_output loads with defer_loading: true,
+    // and sends it nowhere else. It only delays when the model sees the
+    // definition, which is checked in full.
+    if (tool.defer_loading !== undefined && tool.defer_loading !== true) {
+        throw new CodingProxyError(400, "invalid_openai_tool");
+    }
+    openAiOptional(tool.parameters, (value) => openAiRecord(value, "invalid_openai_tool"));
+}
+// The tool_search tool Codex sends for models whose metadata asks for it. Only
+// client execution: Codex runs the search over its own deferred tools and
+// returns them in a tool_search_output item. A server-executed search would
+// have OpenAI run it.
+function validateOpenAiToolSearchTool(tool) {
+    openAiOnlyKeys(tool, ["type", "execution", "description", "parameters"], "invalid_openai_tool");
+    if (tool.execution !== "client")
+        throw new CodingProxyError(400, "openai_tool_not_allowed:tool_search");
+    openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
     openAiOptional(tool.parameters, (value) => openAiRecord(value, "invalid_openai_tool"));
 }
 function validateOpenAiCustomTool(tool) {
@@ -175,30 +206,57 @@ function validateOpenAiCustomTool(tool) {
     }
     openAiString(format.definition, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool");
 }
-function validateOpenAiTools(value, count, nested = false) {
+// Every tool list (the request's tools, each additional_tools item, each
+// tool_search_output item) is capped at MAX_OPENAI_TOOLS entries on its own.
+// Across the request, `distinct` holds the `namespace/name` of each callable
+// tool and is capped too. Codex replays every earlier tool_search_output on
+// each turn, so a long run repeats the same definitions many times: each copy
+// is still validated, but only a tool not seen before adds to the shared cap.
+function validateOpenAiTools(value, distinct, { toolSearch = false, inSearchOutput = false, namespace, listed = { value: 0 }, } = {}) {
     if (!Array.isArray(value))
         throw new CodingProxyError(400, "invalid_openai_tool");
+    const callable = (name) => {
+        distinct.add(`${namespace ?? ""}/${name}`);
+        if (distinct.size > MAX_OPENAI_TOOLS)
+            throw new CodingProxyError(400, "invalid_openai_tool");
+    };
     for (const candidate of value) {
-        if (++count.value > MAX_OPENAI_TOOLS)
+        if (++listed.value > MAX_OPENAI_TOOLS)
             throw new CodingProxyError(400, "invalid_openai_tool");
         const tool = openAiRecord(candidate, "invalid_openai_tool");
         if (tool.type === "function") {
-            validateOpenAiFunctionTool(tool);
+            validateOpenAiFunctionTool(tool, inSearchOutput);
+            callable(tool.name);
         }
         else if (tool.type === "custom") {
             validateOpenAiCustomTool(tool);
+            callable(tool.name);
         }
-        else if (tool.type === "namespace" && !nested) {
+        else if (tool.type === "namespace" && namespace === undefined) {
             openAiOnlyKeys(tool, ["type", "name", "description", "tools"], "invalid_openai_tool");
             openAiToolName(tool.name, "invalid_openai_tool");
             openAiOptional(tool.description, (value) => openAiString(value, MAX_TOOL_TEXT_BYTES, "invalid_openai_tool"));
-            validateOpenAiTools(tool.tools, count, true);
+            validateOpenAiTools(tool.tools, distinct, { inSearchOutput, namespace: tool.name, listed });
+        }
+        else if (tool.type === "tool_search" && toolSearch) {
+            validateOpenAiToolSearchTool(tool);
+            callable("tool_search");
         }
         else {
             throw new CodingProxyError(400, openAiCode("openai_tool_not_allowed", tool.type));
         }
     }
 }
+// The arguments the model gave the client-side tool_search, as its parameters
+// in the captures declare them: a query and an optional result limit.
+function validateOpenAiToolSearchArguments(value) {
+    const args = openAiRecord(value);
+    openAiOnlyKeys(args, ["query", "limit"]);
+    openAiString(args.query, MAX_TOOL_TEXT_BYTES);
+    if (args.limit !== undefined && !(Number.isSafeInteger(args.limit) && args.limit > 0)) {
+        throw new CodingProxyError(400, "invalid_openai_request");
+    }
+}
 function validateOpenAiContentPart(value, allowed) {
     const part = openAiRecord(value);
     if (typeof part.type !== "string" || !allowed.has(part.type)) {
@@ -241,7 +299,7 @@ function validateOpenAiTextParts(value, type) {
         openAiString(part.text, PROXY_MAX_BODY_BYTES);
     }
 }
-function validateOpenAiInputItem(value, toolCount) {
+function validateOpenAiInputItem(value, distinctTools) {
     const item = openAiRecord(value);
     switch (item.type) {
         case undefined:
@@ -300,12 +358,32 @@ function validateOpenAiInputItem(value, toolCount) {
             openAiOptional(item.recipient, (value) => openAiString(value, MAX_OPENAI_ID_LENGTH));
             validateOpenAiContent(item.content, OPENAI_AGENT_MESSAGE_PARTS, false);
             return;
+        case "tool_search_call":
+            openAiOnlyKeys(item, ["type", "id", "call_id", "status", "execution", "arguments"]);
+            openAiOptional(item.id, openAiId);
+            openAiId(item.call_id);
+            openAiOptional(item.status, (value) => openAiString(value, 64));
+            if (item.execution !== "client")
+                throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", item.type));
+            validateOpenAiToolSearchArguments(item.arguments);
+            return;
+        case "tool_search_output":
+            // The tools the client-side search loaded: each one passes the same checks
+            // as a top-level tool, so this cannot bring in a shape the proxy refuses.
+            openAiOnlyKeys(item, ["type", "id", "call_id", "status", "execution", "tools"]);
+            openAiOptional(item.id, openAiId);
+            openAiId(item.call_id);
+            openAiOptional(item.status, (value) => openAiString(value, 64));
+            if (item.execution !== "client")
+                throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", item.type));
+            validateOpenAiTools(item.tools, distinctTools, { inSearchOutput: true });
+            return;
         case "additional_tools":
             openAiOnlyKeys(item, ["type", "id", "role", "tools"]);
             openAiOptional(item.id, openAiId);
             if (item.role !== undefined && item.role !== "developer")
                 throw new CodingProxyError(400, "invalid_openai_request");
-            validateOpenAiTools(item.tools, toolCount);
+            validateOpenAiTools(item.tools, distinctTools);
             return;
         default:
             throw new CodingProxyError(400, openAiCode("openai_input_not_allowed", item.type));
@@ -372,9 +450,9 @@ function validateOpenAiBody(body) {
         throw new CodingProxyError(400, "invalid_openai_request");
     }
     openAiOptional(body.instructions, (value) => openAiString(value, PROXY_MAX_BODY_BYTES));
-    const toolCount = { value: 0 };
+    const distinctTools = new Set();
     if (body.tools !== undefined)
-        validateOpenAiTools(body.tools, toolCount);
+        validateOpenAiTools(body.tools, distinctTools, { toolSearch: true });
     if (body.tool_choice !== undefined) {
         if (typeof body.tool_choice !== "string" || !OPENAI_TOOL_CHOICES.has(body.tool_choice)) {
             throw new CodingProxyError(400, "openai_tool_choice_not_allowed");
@@ -401,7 +479,7 @@ function validateOpenAiBody(body) {
         throw new CodingProxyError(400, "invalid_openai_request");
     }
     for (const item of body.input)
-        validateOpenAiInputItem(item, toolCount);
+        validateOpenAiInputItem(item, distinctTools);
 }
 function parseOpenAiRequest(rawBody) {
     if (Buffer.byteLength(rawBody) > PROXY_MAX_BODY_BYTES)
@@ -516,15 +594,33 @@ function validateStructuredOutputTool(value) {
     if (tool.cache_control !== undefined)
         validateCacheControl(tool.cache_control);
 }
-function validateApprovedTool(value) {
+/**
+ * One of the run's pinned MCP tools, as Claude Code advertises it: a plain client tool named
+ * `mcp__wardby_mcp__<exposed name>` (fixtures/claude-code-2.1.286-mcp-requests.json). Only the name
+ * is checked against the pins; the gateway checks the call itself again.
+ */
+function validateMcpTool(tool) {
+    onlyKeys(tool, ["name", "description", "input_schema", "cache_control", "type"]);
+    if ((tool.description !== undefined &&
+        (typeof tool.description !== "string" || tool.description.length > MAX_TOOL_TEXT_BYTES)) ||
+        (tool.type !== undefined && tool.type !== "custom")) {
+        throw new CodingProxyError(400, "tools_not_allowed");
+    }
+    record(tool.input_schema, "tools_not_allowed");
+    if (tool.cache_control !== undefined)
+        validateCacheControl(tool.cache_control);
+}
+function validateApprovedTool(value, mcpTools) {
     const tool = record(value, "tools_not_allowed");
     if (tool.name === WARDBY_COMMAND_TOOL)
         return validateCommandTool(tool);
     if (tool.name === STRUCTURED_OUTPUT_TOOL)
         return validateStructuredOutputTool(tool);
+    if (typeof tool.name === "string" && mcpTools.has(tool.name))
+        return validateMcpTool(tool);
     throw new CodingProxyError(400, "tools_not_allowed");
 }
-function validateToolUseBlock(value) {
+function validateToolUseBlock(value, mcpTools) {
     onlyKeys(value, ["type", "id", "name", "input"]);
     if (typeof value.id !== "string" || value.id.length < 1 || value.id.length > 512) {
         throw new CodingProxyError(400, "unsupported_anthropic_feature");
@@ -533,6 +629,9 @@ function validateToolUseBlock(value) {
         return validateCommandInput(value.input);
     if (value.name === STRUCTURED_OUTPUT_TOOL)
         return void record(value.input, "unsupported_anthropic_feature");
+    if (typeof value.name === "string" && mcpTools.has(value.name)) {
+        return void record(value.input, "unsupported_anthropic_feature");
+    }
     throw new CodingProxyError(400, "unsupported_anthropic_feature");
 }
 function validateToolResultBlock(value) {
@@ -559,7 +658,7 @@ function validateThinkingBlock(value) {
         throw new CodingProxyError(400, "unsupported_anthropic_feature");
     }
 }
-function validateMessageBlocks(value, role) {
+function validateMessageBlocks(value, role, mcpTools) {
     if (!Array.isArray(value) || value.length > 10_000)
         throw new CodingProxyError(400, "invalid_anthropic_request");
     for (const candidate of value) {
@@ -568,7 +667,7 @@ function validateMessageBlocks(value, role) {
             validateTextBlock(block);
         }
         else if (block.type === "tool_use" && role === "assistant") {
-            validateToolUseBlock(block);
+            validateToolUseBlock(block, mcpTools);
         }
         else if (block.type === "tool_result" && role === "user") {
             validateToolResultBlock(block);
@@ -624,7 +723,7 @@ function validateEffortConfig(value, { thinkingMode, efforts }, betas) {
         throw new CodingProxyError(400, "unsupported_anthropic_feature");
     }
 }
-function parseAnthropicRequest(rawBody, betaHeader, shape) {
+function parseAnthropicRequest(rawBody, betaHeader, shape, mcpTools) {
     const beta = parseAnthropicBeta(betaHeader);
     if (Buffer.byteLength(rawBody) > PROXY_MAX_BODY_BYTES)
         throw new CodingProxyError(413, "payload_too_large");
@@ -688,18 +787,20 @@ function parseAnthropicRequest(rawBody, betaHeader, shape) {
                 continue;
             }
         }
-        validateMessageBlocks(message.content, message.role);
+        validateMessageBlocks(message.content, message.role, mcpTools);
     }
     if (body.tools !== undefined) {
-        if (!Array.isArray(body.tools) || body.tools.length > 2)
+        // run_command and StructuredOutput, plus one per pinned MCP tool.
+        if (!Array.isArray(body.tools) || body.tools.length > 2 + mcpTools.size) {
             throw new CodingProxyError(400, "tools_not_allowed");
+        }
         const names = new Set();
         for (const tool of body.tools) {
             const definition = record(tool, "tools_not_allowed");
             if (typeof definition.name !== "string" || names.has(definition.name))
                 throw new CodingProxyError(400, "tools_not_allowed");
             names.add(definition.name);
-            validateApprovedTool(definition);
+            validateApprovedTool(definition, mcpTools);
         }
     }
     if (body.metadata !== undefined) {
@@ -760,13 +861,17 @@ function parseAnthropicRequest(rawBody, betaHeader, shape) {
         anthropicBeta: beta.header,
     };
 }
-function parseRequest(protocol, rawBody, anthropicBeta, shape) {
+/** The Claude tool names of a session's pinned MCP tools; empty for a session without pins. */
+function claudeMcpToolNames(pins) {
+    return new Set((pins ?? []).map((pin) => `${CLAUDE_MCP_TOOL_PREFIX}${pin.exposedName}`));
+}
+function parseRequest(protocol, rawBody, anthropicBeta, shape, mcpTools) {
     if (protocol !== "anthropic-messages" && anthropicBeta !== undefined) {
         throw new CodingProxyError(400, "invalid_anthropic_beta");
     }
     try {
         return protocol === "anthropic-messages"
-            ? parseAnthropicRequest(rawBody, anthropicBeta, shape)
+            ? parseAnthropicRequest(rawBody, anthropicBeta, shape, mcpTools)
             : parseOpenAiRequest(rawBody);
     }
     catch (error) {
@@ -821,9 +926,17 @@ export class CodingProxy {
     priceVersion;
     activeRequests = new Map();
     onModelRequest;
+    steps;
+    createStepExtractor;
+    runStepsCeiling;
+    /** Results already handed over, per session: each request resends the history. */
+    seenResults = new SeenIds();
     constructor(options) {
         this.ledger = options.ledger;
         this.onModelRequest = options.onModelRequest;
+        this.steps = options.steps;
+        this.createStepExtractor = options.createStepExtractor;
+        this.runStepsCeiling = options.runStepsCeiling ?? "summary";
         this.credentials = options.credentials;
         this.upstreamUrls = {
             "openai-responses": options.upstreamUrl ?? "https://api.openai.com/v1/responses",
@@ -874,6 +987,14 @@ export class CodingProxy {
             throw new Error("invalid_proxy_deadline");
         if (!input.credentialRef || input.credentialRef.length > 200)
             throw new Error("invalid_proxy_credential_reference");
+        // Both or neither: pins without a token could never be called, a token without pins lists nothing.
+        const mcp = input.mcpTools !== undefined || input.mcpTokenHash !== undefined;
+        if (mcp && (!input.mcpTools || input.mcpTools.length === 0 || !input.mcpTokenHash)) {
+            throw new Error("invalid_proxy_mcp_tools");
+        }
+        if (input.runStepsLevel !== undefined && !RUN_STEPS_LEVELS.includes(input.runStepsLevel)) {
+            throw new Error("invalid_proxy_run_steps_level");
+        }
         const capability = `rrp_${randomBytes(32).toString("base64url")}`;
         const id = randomUUID();
         const registryTokenHash = capabilityHash(deriveRegistryToken(capability));
@@ -888,6 +1009,8 @@ export class CodingProxy {
             budgetUsd: input.budgetUsd,
             registryTokenHash,
             terms: input.terms,
+            ...(mcp ? { mcpTools: input.mcpTools, mcpTokenHash: input.mcpTokenHash } : {}),
+            ...(input.runStepsLevel ? { runStepsLevel: input.runStepsLevel } : {}),
         });
         this.audit({ type: "session.created", runId: input.runId });
         return {
@@ -901,6 +1024,7 @@ export class CodingProxy {
         };
     }
     async cancelSession(sessionId) {
+        this.seenResults.forget(sessionId);
         await this.ledger.cancelSession(sessionId);
         for (const controller of this.activeRequests.get(sessionId) ?? [])
             controller.abort();
@@ -934,7 +1058,7 @@ export class CodingProxy {
         };
         let parsed;
         try {
-            parsed = parseRequest(input.protocol, input.rawBody, input.anthropicBeta, shape);
+            parsed = parseRequest(input.protocol, input.rawBody, input.anthropicBeta, shape, claudeMcpToolNames(session.mcpTools));
         }
         catch (error) {
             // The session is already authenticated and no credential has been
@@ -1000,6 +1124,8 @@ export class CodingProxy {
             now: this.now(),
         });
         if (reservation.outcome === "inactive") {
+            // The session has ended (cancelled, expired or closed): another replica may have ended it.
+            this.seenResults.forget(session.id);
             this.audit({ type: "request.rejected", runId: session.runId, reason: reservation.reason });
             throw new CodingProxyError(403, `session_${reservation.reason}`);
         }
@@ -1029,6 +1155,14 @@ export class CodingProxy {
             model: request.model,
             ...holdAudit,
         });
+        // Run steps: the results this (validated) request carries for the previous turn, once per call id.
+        const capture = stepCapture(session, this.runStepsCeiling);
+        if (capture !== "none") {
+            this.submitSteps(input.bearer, session.runId, () => ({
+                steps: [],
+                results: this.seenResults.fresh(session.id, resultsFromRequest(session.protocol, parsed.body, { detail: capture === "detail" })),
+            }));
+        }
         let key;
         try {
             key = await this.credentials.resolve(session.credentialRef);
@@ -1048,6 +1182,7 @@ export class CodingProxy {
         }
         const remainingMs = session.deadlineAt.getTime() - this.now().getTime();
         if (remainingMs <= 0) {
+            this.seenResults.forget(session.id);
             await this.ledger.release(request.id, 403);
             throw new CodingProxyError(403, "session_expired");
         }
@@ -1121,9 +1256,9 @@ export class CodingProxy {
         }
         try {
             if (parsed.stream)
-                await this.forwardStream(session, request, upstream, sink, progress);
+                await this.forwardStream(session, request, upstream, sink, progress, input.bearer);
             else
-                await this.forwardJson(session, request, upstream, sink);
+                await this.forwardJson(session, request, upstream, sink, input.bearer);
         }
         catch (error) {
             await this.markUncertain(session, request, upstream.status, failureReason(error), responseHeadersOf(upstream), progress);
@@ -1193,7 +1328,7 @@ export class CodingProxy {
             throw new CodingProxyError(502, "reservation_invariant_violated");
         }
     }
-    async forwardJson(session, request, upstream, sink) {
+    async forwardJson(session, request, upstream, sink, capability) {
         const declaredLength = Number(upstream.headers.get("content-length"));
         if (Number.isFinite(declaredLength) && declaredLength > MAX_UPSTREAM_JSON_BYTES) {
             throw new Error("upstream_response_too_large");
@@ -1213,8 +1348,15 @@ export class CodingProxy {
         sink.start(upstream.status, { "content-type": "application/json", "cache-control": "no-store" });
         await safeWrite(sink, bytes, { value: true });
         sink.end();
+        const capture = stepCapture(session, this.runStepsCeiling);
+        if (capture !== "none") {
+            this.submitSteps(capability, session.runId, () => ({
+                steps: stepsFromJson(session.protocol, value, { detail: capture === "detail" }),
+                results: [],
+            }));
+        }
     }
-    async forwardStream(session, request, upstream, sink, progress) {
+    async forwardStream(session, request, upstream, sink, progress, capability) {
         if (!upstream.body)
             throw new Error("missing_upstream_body");
         sink.start(upstream.status, { "content-type": "text/event-stream", "cache-control": "no-store" });
@@ -1225,49 +1367,98 @@ export class CodingProxy {
         let completed = false;
         let failedWithoutUsage = false;
         const anthropicUsage = session.protocol === "anthropic-messages" ? (progress.anthropic = new AnthropicSseUsageTracker()) : undefined;
+        // Run steps: each frame is read after it was relayed. An extractor that throws is dropped, never the relay.
+        let steps = this.newStepExtractor(session);
+        const observe = (frame) => {
+            if (!steps)
+                return;
+            try {
+                steps.consume(frame);
+            }
+            catch {
+                steps = undefined;
+            }
+        };
         const body = upstream.body;
-        for await (const chunk of body) {
-            receivedBytes += chunk.byteLength;
-            if (receivedBytes > MAX_UPSTREAM_JSON_BYTES)
-                throw new Error("upstream_response_too_large");
-            buffer = (buffer + decoder.decode(chunk, { stream: true })).replaceAll("\r\n", "\n");
-            for (;;) {
-                const boundary = buffer.indexOf("\n\n");
-                if (boundary < 0)
-                    break;
-                const frame = buffer.slice(0, boundary);
-                buffer = buffer.slice(boundary + 2);
-                const terminal = anthropicUsage ? anthropicUsage.consume(frame) : terminalUsageFromSseFrame(frame);
-                if (!terminal.terminal) {
-                    progress.relayedOutputBytes += relayedTextBytes(frame, session.protocol);
-                    await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
-                    continue;
-                }
-                if (!terminal.usage) {
-                    if (!terminal.failure)
-                        throw new Error("terminal_usage_missing");
-                    // The upstream failed the response and reported no usage. Pass its failure on so the
-                    // client sees the real error instead of a cut connection; the reservation stays held.
-                    await this.recordUpstreamFailure(session, terminal.failure);
-                    if (!completed) {
-                        await this.markUncertain(session, request, upstream.status, `upstream_failed:${terminal.failure}`, responseHeadersOf(upstream), progress);
+        try {
+            for await (const chunk of body) {
+                receivedBytes += chunk.byteLength;
+                if (receivedBytes > MAX_UPSTREAM_JSON_BYTES)
+                    throw new Error("upstream_response_too_large");
+                buffer = (buffer + decoder.decode(chunk, { stream: true })).replaceAll("\r\n", "\n");
+                for (;;) {
+                    const boundary = buffer.indexOf("\n\n");
+                    if (boundary < 0)
+                        break;
+                    const frame = buffer.slice(0, boundary);
+                    buffer = buffer.slice(boundary + 2);
+                    const terminal = anthropicUsage ? anthropicUsage.consume(frame) : terminalUsageFromSseFrame(frame);
+                    if (!terminal.terminal) {
+                        progress.relayedOutputBytes += relayedTextBytes(frame, session.protocol);
+                        await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
+                        observe(frame);
+                        continue;
+                    }
+                    if (!terminal.usage) {
+                        if (!terminal.failure)
+                            throw new Error("terminal_usage_missing");
+                        // The upstream failed the response and reported no usage. Pass its failure on so the
+                        // client sees the real error instead of a cut connection; the reservation stays held.
+                        await this.recordUpstreamFailure(session, terminal.failure);
+                        if (!completed) {
+                            await this.markUncertain(session, request, upstream.status, `upstream_failed:${terminal.failure}`, responseHeadersOf(upstream), progress);
+                        }
+                        failedWithoutUsage = true;
+                        await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
+                        observe(frame);
+                        continue;
                     }
-                    failedWithoutUsage = true;
+                    await this.complete(session, request, terminal.usage, upstream.status);
+                    completed = true;
                     await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
-                    continue;
+                    observe(frame);
                 }
-                await this.complete(session, request, terminal.usage, upstream.status);
-                completed = true;
-                await safeWrite(sink, Buffer.from(`${frame}\n\n`), connected);
             }
+            buffer = (buffer + decoder.decode()).replaceAll("\r\n", "\n");
+            if (!completed && !failedWithoutUsage)
+                throw new Error("terminal_usage_missing");
+            if (buffer)
+                await safeWrite(sink, Buffer.from(buffer), connected);
+            if (connected.value)
+                sink.end();
+        }
+        finally {
+            // The reply's steps, also when the stream broke (then its open text is marked cut).
+            const extractor = steps;
+            if (extractor)
+                this.submitSteps(capability, session.runId, () => ({ steps: extractor.finish(), results: [] }));
+        }
+    }
+    /** Queues a step batch for the control plane. Best effort: any failure drops the steps, never the request. */
+    submitSteps(capability, runId, build) {
+        if (!this.steps)
+            return;
+        try {
+            const batch = build();
+            if (batch.steps.length > 0 || batch.results.length > 0)
+                this.steps.submit(capability, runId, batch);
+        }
+        catch {
+            // Dropped: steps are never a reason to fail a model request.
+        }
+    }
+    newStepExtractor(session) {
+        if (!this.steps)
+            return undefined;
+        const capture = stepCapture(session, this.runStepsCeiling);
+        if (capture === "none")
+            return undefined;
+        try {
+            return (this.createStepExtractor ?? streamStepExtractor)(session.protocol, { detail: capture === "detail" });
+        }
+        catch {
+            return undefined;
         }
-        buffer = (buffer + decoder.decode()).replaceAll("\r\n", "\n");
-        if (!completed && !failedWithoutUsage)
-            throw new Error("terminal_usage_missing");
-        if (buffer)
-            await safeWrite(sink, Buffer.from(buffer), connected);
-        if (connected.value)
-            sink.end();
     }
     /** Best effort: the executor reads it to name the failure; it must never break the relay. */
     async recordUpstreamFailure(session, code) {

package/dist/providers/coding-proxy/run-step-forwarder.d.ts

@@ -0,0 +1,42 @@
+import { type RunStepBatch, type RunStepSubmitter } from "../../core/run-steps/types.js";
+export declare const MAX_FORWARD_QUEUE = 256;
+/** A queue holds at most this many bytes of (estimated) serialized submissions. */
+export declare const MAX_FORWARD_QUEUE_BYTES: number;
+export interface RunStepForwarderOptions {
+    /** WARDBY_RUN_STEPS_URL, without a trailing slash. */
+    url: string;
+    fetchImpl?: typeof fetch;
+    maxQueue?: number;
+    maxQueueBytes?: number;
+    timeoutMs?: number;
+    /** How long flush() and close() wait for the queue to settle before giving up. */
+    flushTimeoutMs?: number;
+    log?: {
+        info(fields: Record<string, unknown>, message: string): void;
+    };
+}
+export declare class RunStepForwarder implements RunStepSubmitter {
+    private readonly options;
+    private queue;
+    private queueBytes;
+    private draining;
+    private scheduled;
+    private closed;
+    private inflight;
+    private dropped;
+    private readonly loggedReasons;
+    constructor(options: RunStepForwarderOptions);
+    submit(capability: string, runId: string, batch: RunStepBatch): void;
+    /** Resolves once everything submitted so far was posted or dropped, or after a bound. Never rejects. */
+    flush(): Promise<void>;
+    /** Stops accepting, waits at most the flush bound, then drops what is left and aborts the in-flight POST. */
+    close(): Promise<void>;
+    private kick;
+    private drain;
+    /**
+     * The capability goes in the Authorization header only. The response body is never read, and a
+     * failure is logged by a fixed reason: an error's or a response's text never reaches a log line.
+     */
+    private post;
+    private drop;
+}