@yansigit/opencodex 2.33.0 → 2.35.0

package/src/server/management/provider-routes.ts

@@ -97,6 +97,9 @@ import { isPlainRecord, parseDebugLogQuery, tokPerSecondResult, unavailableCostR
 import type { MetricUnavailableReason, TokPerSecondResult, CostEstimateReason, CostResult, MetricSource } from "./shared";
 import type { ManagementContext } from "./context";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
+import { resolveAiStudioCredentials } from "../../oauth/aistudio-credentials";
+import { buildAiStudioHeaders, parseGoogleCookieJar } from "../../oauth/google-aistudio-auth";
+import { maxWsFrameBytesConfigError, wsUpstreamConfigError } from "../../config/provider-validation";
 
 type ProviderPatchApplication =
   | { error: string }
@@ -108,6 +111,93 @@ type ProviderPatchApplication =
       headersTouched: boolean;
     };
 
+const AI_STUDIO_REAUTH_ERROR = "Session expired or missing — re-authentication required";
+const AI_STUDIO_PROBE_TIMEOUT_MS = 8_000;
+const AI_STUDIO_PROBE_MODEL = "gemini-2.5-flash";
+const AI_STUDIO_ORIGIN = "https://aistudio.google.com";
+
+let aiStudioProbeFetchForTests: typeof fetch | undefined;
+
+export function setAiStudioProbeFetchForTests(fetchImpl?: typeof fetch): void {
+  aiStudioProbeFetchForTests = fetchImpl;
+}
+
+function isAiStudioHtmlSignIn(text: string): boolean {
+  const lower = text.trim().toLowerCase();
+  return lower.startsWith("<!doctype") || lower.startsWith("<html") || lower.includes("accounts.google.com/v3/signin");
+}
+
+async function probeAiStudioLiveSession(
+  name: string,
+  prov: OcxProviderConfig,
+): Promise<{ ok: boolean; latencyMs: number; authState?: "connected" | "checking" | "needs_reauth" | "unsupported"; message?: string; error?: string }> {
+  const credentials = resolveAiStudioCredentials(prov);
+  if (credentials.kind !== "ready") {
+    return { ok: false, latencyMs: 0, error: AI_STUDIO_REAUTH_ERROR };
+  }
+  if (process.platform !== "darwin") {
+    return {
+      ok: true,
+      latencyMs: 0,
+      authState: "unsupported",
+      message: "AI Studio credentials configured; native login is unsupported on this platform",
+    };
+  }
+
+  const base = (prov.baseUrl || "https://alkalimakersuite-pa.clients6.google.com").replace(/\/+$/, "");
+  const url = base + "/v1internal:generateContent";
+  const jar = parseGoogleCookieJar(credentials.cookieHeader);
+  const headers = await buildAiStudioHeaders(jar, AI_STUDIO_ORIGIN);
+  const body = JSON.stringify({
+    model: AI_STUDIO_PROBE_MODEL,
+    contents: [{ role: "user", parts: [{ text: "ping" }] }],
+    generationConfig: { maxOutputTokens: 1 },
+  });
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), AI_STUDIO_PROBE_TIMEOUT_MS);
+  const started = Date.now();
+  try {
+    const outboundProvider = aiStudioProbeFetchForTests
+      ? { ...prov, fetch: aiStudioProbeFetchForTests }
+      : prov;
+    const response = await providerOutboundPost(name, outboundProvider, url, {
+      headers,
+      body,
+      signal: controller.signal,
+    });
+    const latencyMs = Date.now() - started;
+    const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
+    const text = await response.text().catch(() => "");
+
+    if ((response.status >= 300 && response.status < 400) || response.status === 401 || response.status === 403) {
+      return { ok: false, latencyMs, error: AI_STUDIO_REAUTH_ERROR };
+    }
+    if (contentType.includes("text/html") || isAiStudioHtmlSignIn(text)) {
+      return { ok: false, latencyMs, error: AI_STUDIO_REAUTH_ERROR };
+    }
+    if (response.status !== 200) {
+      return { ok: false, latencyMs, error: "AI Studio connection probe failed" };
+    }
+    try {
+      JSON.parse(text);
+    } catch {
+      return { ok: false, latencyMs, error: "AI Studio connection probe failed" };
+    }
+    return {
+      ok: true,
+      latencyMs,
+      authState: "connected",
+      message: "AI Studio session verified",
+    };
+  } catch {
+    return { ok: false, latencyMs: Date.now() - started, error: "AI Studio connection probe failed" };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+
 /**
  * Apply the recognized PATCH field mask onto a provider copy. The caller runs this once
  * for validation and again inside the config mutation lock against the newest provider,
@@ -206,6 +296,28 @@ function applyProviderPatchFields(
     next.liveModels = rawBody.liveModels;
     touched = true;
   }
+  if (Object.hasOwn(rawBody, "wsUpstream")) {
+    const value = rawBody.wsUpstream;
+    if (value === null) {
+      delete next.wsUpstream;
+    } else {
+      const error = wsUpstreamConfigError(value);
+      if (error) return { error };
+      next.wsUpstream = value as boolean;
+    }
+    touched = true;
+  }
+  if (Object.hasOwn(rawBody, "maxWsFrameBytes")) {
+    const value = rawBody.maxWsFrameBytes;
+    if (value === null) {
+      delete next.maxWsFrameBytes;
+    } else {
+      const error = maxWsFrameBytesConfigError(value);
+      if (error) return { error };
+      next.maxWsFrameBytes = value as number;
+    }
+    touched = true;
+  }
   if (Object.hasOwn(rawBody, "xaiResponsesOptIn")) {
     if (name !== "xai") return { error: "xaiResponsesOptIn is valid only for provider xai" };
     if (typeof rawBody.xaiResponsesOptIn !== "boolean") {
@@ -482,6 +594,8 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
       contextWindow: p.contextWindow,
       modelContextWindows: p.modelContextWindows,
       modelAutoCompactTokenLimits: p.modelAutoCompactTokenLimits,
+      wsUpstream: p.wsUpstream,
+      maxWsFrameBytes: p.maxWsFrameBytes,
       modelSupportsServiceTier: p.modelSupportsServiceTier,
       noStructuredOutputModels: p.noStructuredOutputModels,
       upstreamHttpVersion: p.upstreamHttpVersion,
@@ -575,15 +689,26 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     let body: { name?: unknown; provider?: unknown; setDefault?: boolean };
     try { body = await readManagementJsonBody(req); } catch (error) { rethrowManagementBodyTooLarge(error); return jsonResponse({ error: "invalid JSON body" }, 400); }
     const name = typeof body.name === "string" ? body.name.trim() : "";
-    const providerError = providerManagementConfigError(name, body.provider);
+    const submittedProvider = isPlainRecord(body.provider)
+      ? structuredClone(body.provider) as Record<string, unknown>
+      : body.provider;
+    const submittedCredential = isPlainRecord(submittedProvider)
+      && isPlainRecord(submittedProvider.azureCredential)
+      ? submittedProvider.azureCredential as Record<string, unknown>
+      : undefined;
+    if (typeof submittedCredential?.managedIdentityClientId === "string") {
+      submittedCredential.managedIdentityClientId = submittedCredential.managedIdentityClientId.trim();
+    }
+    const providerError = providerManagementConfigError(name, submittedProvider);
     if (providerError) return jsonResponse({ error: providerError }, 400);
-    const serviceTierError = providerServiceTierConfigError(name, body.provider);
+    const serviceTierError = providerServiceTierConfigError(name, submittedProvider);
     if (serviceTierError) return jsonResponse({ error: serviceTierError }, 400);
-    const prov = body.provider ? stripCodexRuntimeProviderFields(body.provider as OcxProviderConfig) : undefined;
+    const prov = submittedProvider ? stripCodexRuntimeProviderFields(submittedProvider as OcxProviderConfig) : undefined;
     // PATCH already clears on null; POST persisted the body as submitted, so a `null` here
     // reached disk and the next loadConfig() refused it. Canonicalize to absent, which is what
     // "clear" means everywhere else.
     if (prov && prov.upstreamHttpVersion === null) delete prov.upstreamHttpVersion;
+    if (prov && prov.wsUpstream === null) delete prov.wsUpstream;
     if (!name || !prov?.adapter || !prov?.baseUrl) {
       return jsonResponse({ error: "name, provider.adapter and provider.baseUrl are required" }, 400);
     }
@@ -628,6 +753,12 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
     // erase hand-edited per-model prices from Logs/Usage estimates.
     const existingCosts = config.providers[name]?.modelCosts;
     if (existingCosts && !prov.modelCosts) prov.modelCosts = existingCosts;
+    // And to the per-provider account-failover opt-out (#2568d). `ProviderPayload` has no
+    // member for it either, so an add/edit save structurally cannot carry it — and dropping it
+    // silently ENABLES rotation, because activation is presence-driven once the knob is gone.
+    // An overwrite must not spend a second subscription account's quota as a side effect.
+    const existingFailover = config.providers[name]?.oauthAccountFailover;
+    if (existingFailover && !prov.oauthAccountFailover) prov.oauthAccountFailover = existingFailover;
     // ...and to hand-edited context windows. `ProviderPayload` (gui/src/provider-payload.ts)
     // has no member for either field, so the add/edit form structurally cannot send them:
     // absence in the request means "not carried", never "the user deleted it". Deletion goes
@@ -838,6 +969,9 @@ export async function handleProviderRoutes(ctx: ManagementContext): Promise<Resp
         message: "Passthrough provider is configured (forwards your Codex login; no upstream /models).",
       });
     }
+    if (prov.googleMode === "ai-studio-web" || name === "google-aistudio") {
+      return jsonResponse(await probeAiStudioLiveSession(name, prov));
+    }
     if (prov.liveModels === false) {
       // A static catalog has no live discovery endpoint to test. This is neither
       // positive connectivity evidence nor an outage, and it must stay before

package/src/server/management/routing-profile-routes.ts

@@ -20,7 +20,7 @@ import { assemblePolicyCandidateEvidence } from "../../routing/compatibility/ass
 import { activateLab, labActivationRequired } from "../../lib/lab-activation";
 import { quotaEvidenceForCandidate } from "../../routing/quota";
 import { routedProviderConfig } from "../../router";
-import { saveConfigPreservingClaudeCode, getConfigDir } from "../../config";
+import { deleteConfigTopLevelKey, saveConfigPreservingClaudeCode, getConfigDir } from "../../config";
 import { reconcileLiveStateStores } from "../../lib/state-store-registrations";
 import { isPlainRecord } from "./shared";
 import { readManagementJsonBody, rethrowManagementBodyTooLarge } from "./body";
@@ -337,7 +337,7 @@ export async function handleRoutingProfileRoutes(ctx: ManagementContext): Promis
     const nextProfiles = { ...(config.routingProfiles ?? {}) };
     delete nextProfiles[id];
     if (Object.keys(nextProfiles).length > 0) config.routingProfiles = nextProfiles;
-    else delete config.routingProfiles;
+    else deleteConfigTopLevelKey(config, "routingProfiles");
     const saveConfigPreservingClaudeCodeSafe = deps.saveConfigPreservingClaudeCode ?? saveConfigPreservingClaudeCode;
     saveConfigPreservingClaudeCodeSafe(config);
     reconcileLiveStateStores();

package/src/server/management-api.ts

@@ -70,6 +70,7 @@ import { handleOauthAccountRoutes } from "./management/oauth-account-routes";
 import { handleComboRoutes } from "./management/combo-routes";
 import { handleSystemRoutes } from "./management/system-routes";
 import { handleSidebarRoutes } from "./management/sidebar-routes";
+import { handleCodexPromptRoutes } from "./management/codex-prompt-routes";
 import { handleIntegrationRoutes } from "./management/integration-routes";
 import { handleNativeIntegrationRoutes } from "./management/native-integration-routes";
 import type { ManagementContext } from "./management/context";
@@ -229,6 +230,7 @@ export async function handleManagementAPI(
     ??     (await handleIntegrationRoutes(ctx))
     ??     (await handleNativeIntegrationRoutes(ctx))
     ??     (await handleAgentSettingsRoutes(ctx))
+    ??     (await handleCodexPromptRoutes(ctx))
     ??     (await handleOauthAccountRoutes(ctx))
     ??     (await handleComboRoutes(ctx))
     ??     (await handleSystemRoutes(ctx))

package/src/server/port-reclaim.ts

@@ -144,6 +144,24 @@ export function scanListenPids(port: number): ListenPidScan {
           .filter(pid => Number.isSafeInteger(pid) && pid > 0),
       };
     } catch (lsofErr) {
+      if (lsofErr && typeof lsofErr === "object" && "status" in lsofErr && lsofErr.status === 1) {
+        return { ok: true, pids: [] };
+      }
+      try {
+        const output = execFileSync("ss", ["-tlnp", `sport = :${port}`], {
+          encoding: "utf-8",
+          stdio: ["ignore", "pipe", "ignore"],
+          timeout: 3000,
+        });
+        const pids = new Set<number>();
+        for (const match of output.matchAll(/pid=(\d+)/g)) {
+          const pid = Number(match[1]);
+          if (Number.isSafeInteger(pid) && pid > 0) pids.add(pid);
+        }
+        return { ok: true, pids: [...pids] };
+      } catch {
+        /* ss unavailable or unsupported on this platform; try netstat */
+      }
       try {
         const output = execFileSync("netstat", ["-anlp"], {
           encoding: "utf-8",
@@ -154,7 +172,7 @@ export function scanListenPids(port: number): ListenPidScan {
       } catch (netstatErr) {
         return {
           ok: false,
-          error: `lsof/netstat unavailable: ${String(lsofErr)} / ${String(netstatErr)}`,
+          error: `lsof/ss/netstat unavailable: ${String(lsofErr)} / ${String(netstatErr)}`,
         };
       }
     }

package/src/server/relay-eager.ts

@@ -24,7 +24,12 @@
  * up to the drain window.
  */
 
-import { buildFailedTailPayload, createSseTerminalOutputBoundary } from "./relay";
+import {
+  adapterEofIncompleteFrame,
+  createSseTerminalOutputBoundary,
+  doneFrame,
+  failedTailFrame,
+} from "./relay";
 import {
   nextSseBlock,
   payloadRewriteAsBlockRewrite,
@@ -100,9 +105,19 @@ export function relaySseEagerBounded(
   const now = opts?.now ?? Date.now;
 
   const reader = body.getReader();
+  const terminalEncoder = new TextEncoder();
+  const adapterEofFrame = adapterEofIncompleteFrame(terminalEncoder);
+  const terminalSentinel = doneFrame(terminalEncoder);
   const terminalBoundary = createSseTerminalOutputBoundary();
   const activeRewrite: SseBlockRewrite | undefined = hooks.rewriteBlocks
     ?? (hooks.rewritePayload ? payloadRewriteAsBlockRewrite(hooks.rewritePayload) : undefined);
+  const encodeFailedTail = (error: unknown): Uint8Array | null => {
+    try {
+      return failedTailFrame(terminalEncoder, error);
+    } catch {
+      return null;
+    }
+  };
   const rewriteDecoder = activeRewrite ? new TextDecoder() : null;
   const rewriteEncoder = activeRewrite ? new TextEncoder() : null;
   const rewriteBudget = opts?.rewriteBudget;
@@ -164,13 +179,21 @@ export function relaySseEagerBounded(
   let queuedBytes = 0;
   let cancelled = false;
   let done = false;
-  const terminalSentinel = new TextEncoder().encode("data: [DONE]\n\n");
   // Pause gate: resolved by client pull, client cancel, or upstream abort so a
   // paused producer ALWAYS resumes (audit blocker 2 — no deadlock; onDone and
   // turn unregistration stay reachable, drainAndShutdown never hangs).
   let wake: (() => void) | null = null;
   const wakeUp = () => { const w = wake; wake = null; w?.(); };
-  const paused = () => new Promise<void>(resolve => { wake = resolve; });
+  const paused = () => new Promise<void>(resolve => {
+    wake = resolve;
+    // A pull, cancel, or abort can win the tiny window between the loop's
+    // predicate check and installing this resolver. Re-check every wake
+    // predicate after installation so that an already-fired wake cannot leave
+    // the producer parked forever.
+    if (queuedBytes <= maxQueueBytes || cancelled || upstream.signal.aborted) {
+      wakeUp();
+    }
+  });
   upstream.signal.addEventListener("abort", wakeUp, { once: true });
 
   let controllerRef: ReadableStreamDefaultController<Uint8Array> | null = null;
@@ -196,6 +219,9 @@ export function relaySseEagerBounded(
 
   const producer = async () => {
     let syntheticKind: "incomplete" | "failed" | null = null;
+    let deliveryFallbackSent = false;
+    let priorRewriteFailure = false;
+    let priorRewriteError: unknown;
     // reader.read() is not intrinsically tied to the upstream AbortController
     // (a fetch body usually rejects on abort, but that coupling is the fetch
     // implementation's, not the stream's), so abort must break a parked read on
@@ -221,18 +247,46 @@ export function relaySseEagerBounded(
         if (upstreamDone) {
           hooks.finishInspection();
           const boundedTail = terminalBoundary.finish();
+          let clientTail = boundedTail;
+          let rewriteFailed = false;
+          let rewriteError: unknown;
           if (activeRewrite) {
-            const rewritten = rewriteOutbound(boundedTail);
-            const tail = joinUint8Arrays(rewritten, flushRewriteTail());
-            if (tail.byteLength > 0 && !cancelled) {
-              queuedBytes += tail.byteLength;
-              try { controllerRef?.enqueue(tail); } catch { /* client already gone */ }
+            try {
+              const rewritten = rewriteOutbound(boundedTail);
+              clientTail = joinUint8Arrays(rewritten, flushRewriteTail());
+            } catch (error) {
+              rewriteFailed = true;
+              rewriteError = error;
+              clientTail = new Uint8Array(0);
+            }
+          }
+          if (rewriteFailed) {
+            const safeTail = encodeFailedTail(rewriteError);
+            if (safeTail && !cancelled && !upstream.signal.aborted) {
+              if (!hooks.sawTerminal()) syntheticKind = "failed";
+              queuedBytes += safeTail.byteLength;
+              try { controllerRef?.enqueue(safeTail); } catch { /* client already torn down */ }
+              try { controllerRef?.close(); } catch { /* client already gone */ }
             }
-          } else if (boundedTail.byteLength > 0 && !cancelled) {
-            queuedBytes += boundedTail.byteLength;
-            try { controllerRef?.enqueue(boundedTail); } catch { /* client already gone */ }
+            break;
+          }
+          if (clientTail.byteLength > 0 && !cancelled) {
+            queuedBytes += clientTail.byteLength;
+            try { controllerRef?.enqueue(clientTail); } catch { /* client already gone */ }
           }
-          if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
+          if (terminalBoundary.terminalSeen()) {
+            if (!terminalBoundary.doneSeen() && !cancelled) {
+              queuedBytes += terminalSentinel.byteLength;
+              try { controllerRef?.enqueue(terminalSentinel); } catch { /* client already gone */ }
+            }
+          } else if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
+            // A clean 200 EOF without a Responses terminal must be visible to
+            // Codex as one incomplete turn, followed by the normal sentinel.
+            queuedBytes += adapterEofFrame.byteLength + terminalSentinel.byteLength;
+            try {
+              controllerRef?.enqueue(adapterEofFrame);
+              controllerRef?.enqueue(terminalSentinel);
+            } catch { /* client already gone */ }
             syntheticKind = "incomplete";
           }
           break;
@@ -247,7 +301,21 @@ export function relaySseEagerBounded(
           continue;
         }
         const terminalBounded = terminalBoundary.feed(value);
-        const outbound = activeRewrite ? rewriteOutbound(terminalBounded) : terminalBounded;
+        let outbound: Uint8Array;
+        if (activeRewrite) {
+          try {
+            outbound = rewriteOutbound(terminalBounded);
+          } catch (error) {
+            // Preserve the first rewrite failure across the teardown flush. A
+            // second empty flush may succeed, but the terminal bytes still
+            // must not bypass the failed rewrite or become DONE-only output.
+            priorRewriteFailure = true;
+            priorRewriteError = error;
+            throw error;
+          }
+        } else {
+          outbound = terminalBounded;
+        }
         if (outbound.byteLength > 0) {
           queuedBytes += outbound.byteLength;
           try {
@@ -278,16 +346,75 @@ export function relaySseEagerBounded(
     } catch (err) {
       // Upstream read failure. Distinguish genuine mid-stream reset from
       // abort-driven teardown (shutdown/cancel-expiry) — audit M3.
-      if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
+      // A read can fail after delivering an unterminated terminal block. Flush
+      // both observers before deciding whether this is a synthetic reset so
+      // eager mode matches the tee/pull boundary semantics at EOF.
+      let boundedTail: Uint8Array<ArrayBufferLike> = new Uint8Array(0);
+      let tailTerminal = false;
+      let tailDone = false;
+      try { hooks.finishInspection(); } catch { /* preserve the original read failure */ }
+      try {
+        boundedTail = terminalBoundary.finish();
+        tailTerminal = terminalBoundary.terminalSeen();
+        tailDone = terminalBoundary.doneSeen();
+      } catch {
+        // A near-cap ambiguous delimiter tail may itself overflow at EOF.
+        // Preserve the original read/framing failure and continue emitting
+        // the bounded failed tail instead of letting cleanup throw again.
+      }
+      let clientTail: Uint8Array<ArrayBufferLike> = boundedTail;
+      let rewriteFailed = false;
+      let rewriteError: unknown;
+      if (priorRewriteFailure) {
+        rewriteFailed = true;
+        rewriteError = priorRewriteError;
+        clientTail = new Uint8Array(0);
+      } else if (activeRewrite) {
+        try {
+          const rewritten = rewriteOutbound(boundedTail);
+          clientTail = joinUint8Arrays(rewritten, flushRewriteTail());
+        } catch (error) {
+          rewriteFailed = true;
+          rewriteError = error;
+          clientTail = new Uint8Array(0);
+        }
+      }
+      if (clientTail.byteLength > 0 && !cancelled && !upstream.signal.aborted) {
+        queuedBytes += clientTail.byteLength;
+        try { controllerRef?.enqueue(clientTail); } catch { /* client already torn down */ }
+      }
+      if (rewriteFailed && !cancelled && !upstream.signal.aborted) {
+        // Never bypass a client rewrite after it fails: boundedTail can contain
+        // provider metadata or content that the active rewrite was required to
+        // remove. Emit one safe failed envelope instead. When inspection has
+        // already reported the real upstream terminal, this is a delivery
+        // fallback only and must not create a second accounting outcome.
+        const safeTail = encodeFailedTail(rewriteError ?? err);
+        if (safeTail && !cancelled && !upstream.signal.aborted) {
+          if (!hooks.sawTerminal()) syntheticKind = "failed";
+          deliveryFallbackSent = true;
+          queuedBytes += safeTail.byteLength;
+          try { controllerRef?.enqueue(safeTail); } catch { /* client already torn down */ }
+          try { controllerRef?.close(); } catch { /* client already gone */ }
+        }
+      } else if (tailTerminal && !cancelled && !upstream.signal.aborted) {
+        if (!tailDone) {
+          queuedBytes += terminalSentinel.byteLength;
+          try { controllerRef?.enqueue(terminalSentinel); } catch { /* client already gone */ }
+        }
+      } else if (!tailTerminal && !cancelled && !upstream.signal.aborted) {
         // Serializing `err` can run user-defined accessors (Error.message
         // getters, toString) that re-entrantly cancel the client or abort the
         // upstream. Build the tail FIRST, then re-check eligibility before
         // committing to the synthetic terminal (adversarial review blocker).
-        const tail = new TextEncoder().encode(
-          `\n\nevent: response.failed\ndata: ${buildFailedTailPayload(err)}\n\ndata: [DONE]\n\n`,
-        );
-        if (!hooks.sawTerminal() && !cancelled && !upstream.signal.aborted) {
-          syntheticKind = "failed";
+        const tail = encodeFailedTail(err);
+        if (tail && !cancelled && !upstream.signal.aborted) {
+          // Inspection and client framing have separate bounded parsers. If
+          // inspection resynchronized after an oversized frame and observed a
+          // later real terminal, it still must not suppress a terminal delivery
+          // to the client. Only accounting remains tied to the inspected result.
+          if (!hooks.sawTerminal()) syntheticKind = "failed";
+          deliveryFallbackSent = true;
           queuedBytes += tail.byteLength;
           try { controllerRef?.enqueue(tail); } catch { /* client already torn down */ }
           try { controllerRef?.close(); } catch { /* client already torn down */ }
@@ -306,7 +433,7 @@ export function relaySseEagerBounded(
       if (cancelled && !hooks.sawTerminal()) {
         hooks.onClientCancel();
       }
-      if (cancelled || upstream.signal.aborted || syntheticKind === "failed") {
+      if (cancelled || upstream.signal.aborted || syntheticKind === "failed" || deliveryFallbackSent) {
         upstream.abort();
         reader.cancel().catch(() => {});
       }