clauderipple 0.9.4 → 0.10.0

package/dist/router/src/proxy.js

@@ -30,6 +30,7 @@ import { PRESETS } from "./presets.js";
 import { ChatGptAdapter } from "./providers/chatgpt/index.js";
 import { OpenAiCompatibleAdapter } from "./providers/openai/index.js";
 import { GoogleAdapter } from "./providers/google/index.js";
+import { OpenCodeUsage, isOpenCodeGo } from "./providers/opencode-usage.js";
 import { GrokAdapter } from "./providers/grok/index.js";
 import { conversationKey } from "./providers/chatgpt/translate.js";
 import { providerFor, searchProviderFor, terminateHosts } from "./config.js";
@@ -193,6 +194,8 @@ export class Proxy {
     claudeUsage;
     /** The Claude models the signed-in account can use, from Anthropic's own list. */
     claudeModels;
+    /** Each OpenCode Go provider's usage windows, for the status bar's limits row (never a key). */
+    opencodeUsage;
     deps;
     /**
      * Cooldowns, quarantines and conversation stickiness for provider credentials. In memory: a
@@ -343,6 +346,27 @@ export class Proxy {
             return Promise.resolve(null);
         return this.google(name, cfg).fetchModels();
     }
+    /** Each google provider account's quota groups by owner id, for the status bar's limits row. */
+    googleUsage(name) {
+        const cfg = this.deps.config().providers[name];
+        if (!cfg || cfg.type !== "google" || cfg.auth !== "antigravity")
+            return Promise.resolve({});
+        return this.google(name, cfg).usageSnapshot();
+    }
+    /** A Grok provider's usage pool, for the status bar's limits row. Empty otherwise. */
+    grokLimits(name) {
+        const cfg = this.deps.config().providers[name];
+        if (!cfg || cfg.type !== "grok")
+            return Promise.resolve([]);
+        return this.grok(name, cfg).usage();
+    }
+    /** An OpenCode Go provider's usage windows, for the status bar's limits row. Empty otherwise. */
+    opencodeLimits(name) {
+        const cfg = this.deps.config().providers[name];
+        if (!cfg || cfg.type !== "openai-compatible" || !isOpenCodeGo(cfg))
+            return Promise.resolve([]);
+        return this.opencodeUsage.windows(name, cfg.url, cfg.headers ?? {});
+    }
     /** Dashboard action: put one resting Google account back into rotation now. */
     googleClearCooldown(ownerId) {
         for (const [name, p] of Object.entries(this.deps.config().providers)) {
@@ -376,6 +400,7 @@ export class Proxy {
             upstream: () => this.deps.config().upstream,
             warn: (message) => deps.log.warn(message),
         });
+        this.opencodeUsage = new OpenCodeUsage({ warn: (message) => deps.log.warn(message) });
         this.httpServer = http.createServer({ maxHeaderSize: 64 * 1024 }, (req, res) => {
             void this.handle(req, res);
         });
@@ -605,12 +630,16 @@ export class Proxy {
             record.session = session;
         let observedUsage;
         let observedStopReason;
+        let promptFallbackNote;
+        let promptRefusalSeen = false;
         // `failed` counts requests that did not get a proper response (vanished, upstream error,
         // provider error). A note alone is not a failure: adapters attach usage notes on success.
         const finish = (status, bytes, note, failed = note !== undefined, extra) => {
             if (finished)
                 return;
             finished = true;
+            if (promptFallbackNote)
+                note = [promptFallbackNote, note].filter(Boolean).join("; ");
             this.stats.inFlight--;
             if (isMessages)
                 this.stats.messagesInFlight--;
@@ -646,7 +675,7 @@ export class Proxy {
                     completed.requestedTier = extra.requestedTier;
                 if (extra?.servedTier !== undefined)
                     completed.servedTier = extra.servedTier;
-                if (extra?.upstreamCalled === false)
+                if (extra?.upstreamCalled === false && !promptRefusalSeen)
                     completed.upstreamCalled = false;
                 if (extra?.refusal !== undefined)
                     completed.refusal = extra.refusal;
@@ -728,10 +757,11 @@ export class Proxy {
             }
         }
         // A slot with fallbacks picks its provider before anything is sent, so a primary that is rate
-        // limited for the next hour is skipped rather than rediscovered once per request. Failing over
-        // mid-turn is not possible — once a byte of the answer has gone out, replacing it would splice
-        // two answers together — so the choice has to be made here or not at all.
-        const route = resolved ? this.chooseTarget(resolved, cfg, log) : null;
+        // limited for the next hour is skipped rather than rediscovered once per request. A distinct
+        // prompt refusal can also select one fallback below, but only before any response is written.
+        let route = resolved ? this.chooseTarget(resolved, cfg, log) : null;
+        /** The request before any target rewrote it, kept only when a Google target may hand the turn back. */
+        let pristine;
         const source = typeof model === "string" ? model : "-";
         record = {
             ...record,
@@ -784,258 +814,292 @@ export class Proxy {
         let chosen = null;
         let penalised = null;
         let target;
-        if (route && json) {
-            record = { ...record, target: route.model, provider: route.provider };
-            const configured = cfg.providers[route.provider];
-            if (!configured) {
-                finish("500", 0, `unknown provider ${route.provider}`, true, { ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "unknown-provider" });
-                res.writeHead(500, { "content-type": "application/json" }).end(JSON.stringify({ error: { type: "clauderipple_config", message: `unknown provider ${route.provider}` } }));
-                return;
-            }
-            // A model may speak another wire than the rest of its provider: one subscription serving
-            // several protocols is one provider, and this is where the model's own shape is folded in so
-            // the branches below pick the adapter it actually needs.
-            const provider = providerFor(configured, route.model);
-            rewriteBody(json, route, cfg.effortClamp);
-            if (provider.type === "chatgpt") {
-                const td = threadDecision(json);
-                if (td === "refuse") {
-                    const out = JSON.stringify(THREAD_UNSUPPORTED);
-                    res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
-                    finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true, ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "thread-continue" });
+        // Re-enter only for the one unwritten Google prompt refusal. Each target sees the original
+        // request, not the primary's rewritten effort, stripped thread, or translated body.
+        for (;;) {
+            if (pristine)
+                json = structuredClone(pristine);
+            if (route && json) {
+                record = { ...record, target: route.model, provider: route.provider };
+                delete record.effort;
+                const configured = cfg.providers[route.provider];
+                if (!configured) {
+                    finish("500", 0, `unknown provider ${route.provider}`, true, { ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "unknown-provider" });
+                    res.writeHead(500, { "content-type": "application/json" }).end(JSON.stringify({ error: { type: "clauderipple_config", message: `unknown provider ${route.provider}` } }));
                     return;
                 }
-                if (td === "strip")
-                    stripThreadFields(json);
-                const routeEffort = effortOf(json);
-                if (routeEffort)
-                    record.effort = routeEffort;
-                tag = `CHATGPT ${route.tag} effort=${routeEffort ?? "-"}`;
-                try {
-                    // The adapter reports each account's outcome to the shared pool itself, so a slot pointing
-                    // here fails over once every account is out (chooseTarget asks the adapter).
-                    const o = await this.chatgpt(route.provider, provider).handle(req, res, path, json, route.model, effortOf(json));
-                    if (!path.startsWith("/v1/messages/count_tokens"))
-                        this.providerHealth.observe(route.provider, o.status, o.exhaustion);
-                    finish(String(o.status), o.bytes, o.note, o.status >= 400, { ...o, ...(searchAttempted ? { upstreamCalled: undefined } : {}) });
-                }
-                catch (e) {
-                    finish("-", 0, `chatgpt error ${e.code ?? ""} ${e.message}`);
-                    if (!res.headersSent)
-                        res.writeHead(502, { "content-type": "application/json" }).end(JSON.stringify({ type: "error", error: { type: "api_error", message: e.message } }));
-                    else
-                        res.destroy();
-                }
-                return;
-            }
-            if (provider.type === "openai-compatible") {
-                const td = threadDecision(json);
-                if (td === "refuse") {
-                    const out = JSON.stringify(THREAD_UNSUPPORTED);
-                    res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
-                    finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true, ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "thread-continue" });
+                // A model may speak another wire than the rest of its provider: one subscription serving
+                // several protocols is one provider, and this is where the model's own shape is folded in so
+                // the branches below pick the adapter it actually needs.
+                const provider = providerFor(configured, route.model);
+                // Only the Google adapter can return a turn unwritten, so only it pays for the copy.
+                if (!pristine && provider.type === "google")
+                    pristine = structuredClone(json);
+                rewriteBody(json, route, cfg.effortClamp);
+                if (provider.type === "chatgpt") {
+                    const td = threadDecision(json);
+                    if (td === "refuse") {
+                        const out = JSON.stringify(THREAD_UNSUPPORTED);
+                        res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
+                        finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true, ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "thread-continue" });
+                        return;
+                    }
+                    if (td === "strip")
+                        stripThreadFields(json);
+                    const routeEffort = effortOf(json);
+                    if (routeEffort)
+                        record.effort = routeEffort;
+                    tag = `CHATGPT ${route.tag} effort=${routeEffort ?? "-"}`;
+                    try {
+                        // The adapter reports each account's outcome to the shared pool itself, so a slot pointing
+                        // here fails over once every account is out (chooseTarget asks the adapter).
+                        const o = await this.chatgpt(route.provider, provider).handle(req, res, path, json, route.model, effortOf(json));
+                        if (!path.startsWith("/v1/messages/count_tokens"))
+                            this.providerHealth.observe(route.provider, o.status, o.exhaustion);
+                        finish(String(o.status), o.bytes, o.note, o.status >= 400, { ...o, ...(searchAttempted ? { upstreamCalled: undefined } : {}) });
+                    }
+                    catch (e) {
+                        finish("-", 0, `chatgpt error ${e.code ?? ""} ${e.message}`);
+                        if (!res.headersSent)
+                            res.writeHead(502, { "content-type": "application/json" }).end(JSON.stringify({ type: "error", error: { type: "api_error", message: e.message } }));
+                        else
+                            res.destroy();
+                    }
                     return;
                 }
-                if (td === "strip")
-                    stripThreadFields(json);
-                const routeEffort = effortOf(json);
-                if (routeEffort)
-                    record.effort = routeEffort;
-                tag = `OPENAI ${route.tag} wire=${provider.wire ?? "chat"} effort=${routeEffort ?? "-"}`;
-                try {
-                    const o = await this.openai(route.provider, provider).handle(req, res, path, json, route.model, routeEffort);
-                    this.recordOutcome(route.provider, o.status);
-                    if (!path.startsWith("/v1/messages/count_tokens"))
-                        this.providerHealth.observe(route.provider, o.status, o.exhaustion);
-                    finish(String(o.status), o.bytes, o.note, o.status >= 400, { ...o, ...(searchAttempted ? { upstreamCalled: undefined } : {}) });
-                }
-                catch (e) {
-                    this.recordOutcome(route.provider, 0);
-                    finish("-", 0, `openai error ${e.code ?? ""} ${e.message}`);
-                    if (!res.headersSent)
-                        res.writeHead(502, { "content-type": "application/json" }).end(JSON.stringify({ type: "error", error: { type: "api_error", message: e.message } }));
-                    else
-                        res.destroy();
-                }
-                return;
-            }
-            if (provider.type === "google") {
-                // Google holds no server-side thread either, so a `continue` is refused as it is for the
-                // other translated providers; the CLI resends the turn with the full history.
-                const td = threadDecision(json);
-                if (td === "refuse") {
-                    const out = JSON.stringify(THREAD_UNSUPPORTED);
-                    res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
-                    finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true, ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "thread-continue" });
+                if (provider.type === "openai-compatible") {
+                    const td = threadDecision(json);
+                    if (td === "refuse") {
+                        const out = JSON.stringify(THREAD_UNSUPPORTED);
+                        res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
+                        finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true, ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "thread-continue" });
+                        return;
+                    }
+                    if (td === "strip")
+                        stripThreadFields(json);
+                    const routeEffort = effortOf(json);
+                    if (routeEffort)
+                        record.effort = routeEffort;
+                    tag = `OPENAI ${route.tag} wire=${provider.wire ?? "chat"} effort=${routeEffort ?? "-"}`;
+                    try {
+                        const o = await this.openai(route.provider, provider).handle(req, res, path, json, route.model, routeEffort);
+                        this.recordOutcome(route.provider, o.status);
+                        if (!path.startsWith("/v1/messages/count_tokens"))
+                            this.providerHealth.observe(route.provider, o.status, o.exhaustion);
+                        finish(String(o.status), o.bytes, o.note, o.status >= 400, { ...o, ...(searchAttempted ? { upstreamCalled: undefined } : {}) });
+                    }
+                    catch (e) {
+                        this.recordOutcome(route.provider, 0);
+                        finish("-", 0, `openai error ${e.code ?? ""} ${e.message}`);
+                        if (!res.headersSent)
+                            res.writeHead(502, { "content-type": "application/json" }).end(JSON.stringify({ type: "error", error: { type: "api_error", message: e.message } }));
+                        else
+                            res.destroy();
+                    }
                     return;
                 }
-                if (td === "strip")
-                    stripThreadFields(json);
-                const routeEffort = effortOf(json);
-                if (routeEffort)
-                    record.effort = routeEffort;
-                tag = `GOOGLE ${route.tag} effort=${routeEffort ?? "-"}`;
-                try {
-                    const o = await this.google(route.provider, provider).handle(req, res, path, json, route.model, routeEffort);
-                    this.recordOutcome(route.provider, o.status);
-                    if (!path.startsWith("/v1/messages/count_tokens"))
-                        this.providerHealth.observe(route.provider, o.status, o.exhaustion);
-                    finish(String(o.status), o.bytes, o.note, o.status >= 400, { ...o, ...(searchAttempted ? { upstreamCalled: undefined } : {}) });
-                }
-                catch (e) {
-                    this.recordOutcome(route.provider, 0);
-                    finish("-", 0, `google error ${e.code ?? ""} ${e.message}`);
-                    if (!res.headersSent)
-                        res.writeHead(502, { "content-type": "application/json" }).end(JSON.stringify({ type: "error", error: { type: "api_error", message: e.message } }));
-                    else
-                        res.destroy();
+                if (provider.type === "google") {
+                    // Google holds no server-side thread either, so a `continue` is refused as it is for the
+                    // other translated providers; the CLI resends the turn with the full history.
+                    const td = threadDecision(json);
+                    if (td === "refuse") {
+                        const out = JSON.stringify(THREAD_UNSUPPORTED);
+                        res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
+                        finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true, ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "thread-continue" });
+                        return;
+                    }
+                    if (td === "strip")
+                        stripThreadFields(json);
+                    const routeEffort = effortOf(json);
+                    if (routeEffort)
+                        record.effort = routeEffort;
+                    tag = `GOOGLE ${route.tag} effort=${routeEffort ?? "-"}`;
+                    try {
+                        const o = await this.google(route.provider, provider).handle(req, res, path, json, route.model, routeEffort);
+                        if (o.kind === "prompt-incompatible") {
+                            const alreadyRetried = promptRefusalSeen;
+                            promptRefusalSeen = true;
+                            if (res.destroyed || res.writableEnded || res.headersSent) {
+                                finish("0", 0, "client closed before prompt-refusal fallback", true);
+                                if (!res.destroyed && !res.writableEnded)
+                                    res.destroy();
+                                return;
+                            }
+                            const fallback = !alreadyRetried && resolved
+                                ? this.promptFallback(resolved, route, cfg) : null;
+                            if (fallback) {
+                                promptFallbackNote = `${o.note}; fallback ${route.provider}/${route.model} → ${fallback.provider}/${fallback.model}`;
+                                log.info(`FAILOVER ${promptFallbackNote}`);
+                                route = fallback;
+                                continue;
+                            }
+                            // Refusal is request-specific: neither cool nor mark success for this provider.
+                            res.writeHead(400, { "content-type": "application/json" }).end(o.errorBody);
+                            finish("400", Buffer.byteLength(o.errorBody), o.note, true, { refusal: "prompt-incompatible" });
+                            return;
+                        }
+                        this.recordOutcome(route.provider, o.status);
+                        if (!path.startsWith("/v1/messages/count_tokens"))
+                            this.providerHealth.observe(route.provider, o.status, o.exhaustion);
+                        finish(String(o.status), o.bytes, o.note, o.status >= 400, { ...o, ...(searchAttempted ? { upstreamCalled: undefined } : {}) });
+                    }
+                    catch (e) {
+                        this.recordOutcome(route.provider, 0);
+                        finish("-", 0, `google error ${e.code ?? ""} ${e.message}`);
+                        if (!res.headersSent)
+                            res.writeHead(502, { "content-type": "application/json" }).end(JSON.stringify({ type: "error", error: { type: "api_error", message: e.message } }));
+                        else
+                            res.destroy();
+                    }
+                    return;
                 }
-                return;
-            }
-            if (provider.type === "grok") {
-                // The chat proxy keeps no server-side thread, so a `continue` is refused like on the other
-                // translated providers and the CLI resends the turn with the full history.
-                const td = threadDecision(json);
-                if (td === "refuse") {
-                    const out = JSON.stringify(THREAD_UNSUPPORTED);
-                    res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
-                    finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true });
+                if (provider.type === "grok") {
+                    // The chat proxy keeps no server-side thread, so a `continue` is refused like on the other
+                    // translated providers and the CLI resends the turn with the full history.
+                    const td = threadDecision(json);
+                    if (td === "refuse") {
+                        const out = JSON.stringify(THREAD_UNSUPPORTED);
+                        res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
+                        finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true });
+                        return;
+                    }
+                    if (td === "strip")
+                        stripThreadFields(json);
+                    record = { ...record, target: route.model, provider: route.provider };
+                    const routeEffort = effortOf(json);
+                    if (routeEffort)
+                        record.effort = routeEffort;
+                    tag = `GROK ${route.tag} effort=${routeEffort ?? "-"}`;
+                    try {
+                        const o = await this.grok(route.provider, provider).handle(req, res, path, json, route.model, routeEffort);
+                        this.recordOutcome(route.provider, o.status);
+                        finish(String(o.status), o.bytes, o.note, o.status >= 400, { ...(o.usage ? { usage: o.usage } : {}), ...(o.stopReason ? { stopReason: o.stopReason } : {}) });
+                    }
+                    catch (e) {
+                        this.recordOutcome(route.provider, 0);
+                        finish("-", 0, `grok error ${e.code ?? ""} ${e.message}`);
+                        if (!res.headersSent)
+                            res.writeHead(502, { "content-type": "application/json" }).end(JSON.stringify({ type: "error", error: { type: "api_error", message: e.message } }));
+                        else
+                            res.destroy();
+                    }
                     return;
                 }
-                if (td === "strip")
-                    stripThreadFields(json);
-                record = { ...record, target: route.model, provider: route.provider };
-                const routeEffort = effortOf(json);
-                if (routeEffort)
-                    record.effort = routeEffort;
-                tag = `GROK ${route.tag} effort=${routeEffort ?? "-"}`;
-                try {
-                    const o = await this.grok(route.provider, provider).handle(req, res, path, json, route.model, routeEffort);
-                    this.recordOutcome(route.provider, o.status);
-                    finish(String(o.status), o.bytes, o.note, o.status >= 400, { ...(o.usage ? { usage: o.usage } : {}), ...(o.stopReason ? { stopReason: o.stopReason } : {}) });
+                if (provider.type === "anthropic") {
+                    if (!provider.accountPool || provider.auth !== "claude-code") {
+                        finish("400", 0, "native Anthropic provider is available through OpenAI ingress only", false);
+                        res.writeHead(400, { "content-type": "application/json" }).end(JSON.stringify({ error: { type: "invalid_request_error", message: "native Anthropic provider is available through OpenAI ingress only" } }));
+                        return;
+                    }
+                    // Native Messages need no translation. Only authentication changes, so server-side threads,
+                    // prompt caching, beta features and the client's exact tool contract remain first-party.
+                    const credentials = await this.claudeAccounts.credentials();
+                    if (credentials.length === 0) {
+                        const out = JSON.stringify({ type: "error", error: { type: "authentication_error", message: "ClaudeRipple: no usable Claude account; sign in or reauthenticate an account" } });
+                        res.writeHead(401, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
+                        finish("401", out.length, "no usable Claude account", true, { ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "no-account" });
+                        return;
+                    }
+                    dropForeignThinking(json);
+                    body = Buffer.from(JSON.stringify(json));
+                    chosen = this.pool.pick(route.provider, credentials, conversationKey(json));
+                    const using = chosen ?? credentials[0];
+                    chosen = using;
+                    penalised = { provider: route.provider, id: using.id };
+                    target = {
+                        protocol: "https:",
+                        host: cfg.upstream,
+                        port: this.deps.upstreamPort ?? 443,
+                        agent: this.deps.upstreamAgent ?? this.agentFor(route.provider, "https:"),
+                        extraHeaders: withClientBetas(using.headers, req.headers["anthropic-beta"]),
+                        dropClientAuth: true,
+                        dropHeaders: new Set(credentials.flatMap((credential) => Object.keys(credential.headers).map((name) => name.toLowerCase()))),
+                        dropHeaderPrefixes: ["anthropic-client-", "x-stainless-"],
+                    };
+                    const routeEffort = effortOf(json);
+                    if (routeEffort)
+                        record.effort = routeEffort;
+                    tag = `CLAUDE ${route.tag} account=${using.ownerId?.slice(0, 8) ?? "current"}`;
                 }
-                catch (e) {
-                    this.recordOutcome(route.provider, 0);
-                    finish("-", 0, `grok error ${e.code ?? ""} ${e.message}`);
-                    if (!res.headersSent)
-                        res.writeHead(502, { "content-type": "application/json" }).end(JSON.stringify({ type: "error", error: { type: "api_error", message: e.message } }));
-                    else
-                        res.destroy();
+                else {
+                    // An Anthropic-shaped endpoint keeps no server-side thread either, so a `continue` is refused
+                    // here as it is for the translated providers. sanitizeForCompatible used to strip the field
+                    // and forward the rest, which is only the delta: DeepSeek (via Bailian) received two orphan
+                    // tool_results with no task and answered that none had been given (measured 2026-09-24, CLI
+                    // 2.1.280). Refused, the CLI resends the turn with the full history.
+                    if (threadDecision(json) === "refuse") {
+                        const out = JSON.stringify(THREAD_UNSUPPORTED);
+                        res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
+                        finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true, ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "thread-continue" });
+                        return;
+                    }
+                    const preset = provider.preset ? PRESETS.find((entry) => entry.id === provider.preset) : undefined;
+                    const routeModel = route.model;
+                    const modelEffortLevels = provider.models?.find((entry) => entry.id === routeModel)?.effortLevels;
+                    compatCaps = resolveCompatibleCaps(preset ? { effortLevels: preset.effortLevels, thinking: preset.thinking, ...(preset.serverTools ? { serverTools: true } : {}) } : undefined, modelEffortLevels === undefined ? provider.caps : { ...provider.caps, effortLevels: modelEffortLevels });
+                    const sanitized = sanitizeForCompatible(json, compatCaps);
+                    json = sanitized.json;
+                    compatChanges = sanitized.changes;
+                    // The upstream would otherwise read Claude Code's own system prompt and answer that it is
+                    // Claude. After sanitizing, so the effort named is the one the provider actually receives.
+                    applyIdentityToAnthropicBody(json, {
+                        model: route.model,
+                        effort: effortOf(json),
+                        identity: provider.identity,
+                        instructionsAppend: provider.instructionsAppend,
+                    });
+                    body = Buffer.from(JSON.stringify(json));
+                    const u = new URL(provider.url);
+                    const protocol = u.protocol === "https:" ? "https:" : "http:";
+                    // Which credential answers this turn. The conversation keeps the one it is on while that one
+                    // is healthy, because moving it moves the prompt cache with it. Every credential cooling or
+                    // quarantined leaves `chosen` null, and the request goes out on the configured headers so the
+                    // provider — not us — gets to say no.
+                    const credentials = this.credentialsOf(route.provider, provider);
+                    // The same key the prompt cache is keyed on. `metadata.user_id` alone is one value for every
+                    // conversation a user has, so using it raw would drag all of them onto one credential at once
+                    // — the opposite of what stickiness is for (see conversationKey and ARCHITECTURE §4).
+                    chosen = this.pool.pick(route.provider, credentials, conversationKey(json));
+                    // Nothing usable means every credential is cooling, and the turn still has to go somewhere:
+                    // the first one, so the request carries real credentials rather than none, and so the answer
+                    // is charged to the credential that actually produced it.
+                    const using = chosen ?? credentials[0];
+                    chosen = using;
+                    penalised = { provider: route.provider, id: using.id };
+                    target = {
+                        protocol,
+                        host: u.hostname,
+                        port: Number(u.port) || (protocol === "https:" ? 443 : 80),
+                        agent: this.agentFor(route.provider, protocol),
+                        // The credential wins over the session header: they are different names in practice, but a
+                        // vendor that reused one would mean the request going out unauthenticated.
+                        extraHeaders: provider.sessionHeader
+                            ? { [provider.sessionHeader]: conversationKey(json), ...using.headers }
+                            : using.headers,
+                        dropClientAuth: true,
+                        // Providers mount their Anthropic-compatible API under a path (DeepSeek /anthropic, OpenRouter /api,
+                        // Qwen /apps/anthropic): the CLI's /v1/messages is appended to it. Dropping it sent requests to the
+                        // vendor's website, which answered 200 with HTML (measured 2026-09-13 with OpenRouter).
+                        basePath: u.pathname.replace(/\/+$/, ""),
+                    };
+                    const routeEffort = effortOf(json);
+                    if (routeEffort)
+                        record.effort = routeEffort;
+                    tag = `${route.provider.toUpperCase()} ${route.tag} effort=${routeEffort ?? "-"}`;
                 }
-                return;
             }
-            if (provider.type === "anthropic") {
-                if (!provider.accountPool || provider.auth !== "claude-code") {
-                    finish("400", 0, "native Anthropic provider is available through OpenAI ingress only", false);
-                    res.writeHead(400, { "content-type": "application/json" }).end(JSON.stringify({ error: { type: "invalid_request_error", message: "native Anthropic provider is available through OpenAI ingress only" } }));
-                    return;
-                }
-                // Native Messages need no translation. Only authentication changes, so server-side threads,
-                // prompt caching, beta features and the client's exact tool contract remain first-party.
-                const credentials = await this.claudeAccounts.credentials();
-                if (credentials.length === 0) {
-                    const out = JSON.stringify({ type: "error", error: { type: "authentication_error", message: "ClaudeRipple: no usable Claude account; sign in or reauthenticate an account" } });
-                    res.writeHead(401, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
-                    finish("401", out.length, "no usable Claude account", true, { ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "no-account" });
-                    return;
-                }
-                dropForeignThinking(json);
-                body = Buffer.from(JSON.stringify(json));
-                chosen = this.pool.pick(route.provider, credentials, conversationKey(json));
-                const using = chosen ?? credentials[0];
-                chosen = using;
-                penalised = { provider: route.provider, id: using.id };
-                target = {
-                    protocol: "https:",
-                    host: cfg.upstream,
-                    port: this.deps.upstreamPort ?? 443,
-                    agent: this.deps.upstreamAgent ?? this.agentFor(route.provider, "https:"),
-                    extraHeaders: withClientBetas(using.headers, req.headers["anthropic-beta"]),
-                    dropClientAuth: true,
-                    dropHeaders: new Set(credentials.flatMap((credential) => Object.keys(credential.headers).map((name) => name.toLowerCase()))),
-                    dropHeaderPrefixes: ["anthropic-client-", "x-stainless-"],
-                };
-                const routeEffort = effortOf(json);
-                if (routeEffort)
-                    record.effort = routeEffort;
-                tag = `CLAUDE ${route.tag} account=${using.ownerId?.slice(0, 8) ?? "current"}`;
+            else if (isApiHost) {
+                target = { protocol: "https:", host: cfg.upstream, port: this.deps.upstreamPort ?? 443, agent: this.deps.upstreamAgent ?? this.upstreamAgent, extraHeaders: {} };
+                tag = `PASS ${typeof model === "string" ? model : "-"}`;
+                // Passthrough stays byte-exact unless another model's thinking would get the turn refused.
+                if (json && dropForeignThinking(json) > 0)
+                    body = Buffer.from(JSON.stringify(json));
             }
             else {
-                // An Anthropic-shaped endpoint keeps no server-side thread either, so a `continue` is refused
-                // here as it is for the translated providers. sanitizeForCompatible used to strip the field
-                // and forward the rest, which is only the delta: DeepSeek (via Bailian) received two orphan
-                // tool_results with no task and answered that none had been given (measured 2026-09-24, CLI
-                // 2.1.280). Refused, the CLI resends the turn with the full history.
-                if (threadDecision(json) === "refuse") {
-                    const out = JSON.stringify(THREAD_UNSUPPORTED);
-                    res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
-                    finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true, ...(!searchAttempted ? { upstreamCalled: false } : {}), refusal: "thread-continue" });
-                    return;
-                }
-                const preset = provider.preset ? PRESETS.find((entry) => entry.id === provider.preset) : undefined;
-                const modelEffortLevels = provider.models?.find((entry) => entry.id === route.model)?.effortLevels;
-                compatCaps = resolveCompatibleCaps(preset ? { effortLevels: preset.effortLevels, thinking: preset.thinking, ...(preset.serverTools ? { serverTools: true } : {}) } : undefined, modelEffortLevels === undefined ? provider.caps : { ...provider.caps, effortLevels: modelEffortLevels });
-                const sanitized = sanitizeForCompatible(json, compatCaps);
-                json = sanitized.json;
-                compatChanges = sanitized.changes;
-                // The upstream would otherwise read Claude Code's own system prompt and answer that it is
-                // Claude. After sanitizing, so the effort named is the one the provider actually receives.
-                applyIdentityToAnthropicBody(json, {
-                    model: route.model,
-                    effort: effortOf(json),
-                    identity: provider.identity,
-                    instructionsAppend: provider.instructionsAppend,
-                });
-                body = Buffer.from(JSON.stringify(json));
-                const u = new URL(provider.url);
-                const protocol = u.protocol === "https:" ? "https:" : "http:";
-                // Which credential answers this turn. The conversation keeps the one it is on while that one
-                // is healthy, because moving it moves the prompt cache with it. Every credential cooling or
-                // quarantined leaves `chosen` null, and the request goes out on the configured headers so the
-                // provider — not us — gets to say no.
-                const credentials = this.credentialsOf(route.provider, provider);
-                // The same key the prompt cache is keyed on. `metadata.user_id` alone is one value for every
-                // conversation a user has, so using it raw would drag all of them onto one credential at once
-                // — the opposite of what stickiness is for (see conversationKey and ARCHITECTURE §4).
-                chosen = this.pool.pick(route.provider, credentials, conversationKey(json));
-                // Nothing usable means every credential is cooling, and the turn still has to go somewhere:
-                // the first one, so the request carries real credentials rather than none, and so the answer
-                // is charged to the credential that actually produced it.
-                const using = chosen ?? credentials[0];
-                chosen = using;
-                penalised = { provider: route.provider, id: using.id };
-                target = {
-                    protocol,
-                    host: u.hostname,
-                    port: Number(u.port) || (protocol === "https:" ? 443 : 80),
-                    agent: this.agentFor(route.provider, protocol),
-                    // The credential wins over the session header: they are different names in practice, but a
-                    // vendor that reused one would mean the request going out unauthenticated.
-                    extraHeaders: provider.sessionHeader
-                        ? { [provider.sessionHeader]: conversationKey(json), ...using.headers }
-                        : using.headers,
-                    dropClientAuth: true,
-                    // Providers mount their Anthropic-compatible API under a path (DeepSeek /anthropic, OpenRouter /api,
-                    // Qwen /apps/anthropic): the CLI's /v1/messages is appended to it. Dropping it sent requests to the
-                    // vendor's website, which answered 200 with HTML (measured 2026-09-13 with OpenRouter).
-                    basePath: u.pathname.replace(/\/+$/, ""),
-                };
-                const routeEffort = effortOf(json);
-                if (routeEffort)
-                    record.effort = routeEffort;
-                tag = `${route.provider.toUpperCase()} ${route.tag} effort=${routeEffort ?? "-"}`;
+                target = { protocol: "https:", host: reqHost, port: 443, agent: this.agentFor(`host:${reqHost}`, "https:"), extraHeaders: {} };
+                tag = `WEB ${reqHost}`;
             }
-        }
-        else if (isApiHost) {
-            target = { protocol: "https:", host: cfg.upstream, port: this.deps.upstreamPort ?? 443, agent: this.deps.upstreamAgent ?? this.upstreamAgent, extraHeaders: {} };
-            tag = `PASS ${typeof model === "string" ? model : "-"}`;
-            // Passthrough stays byte-exact unless another model's thinking would get the turn refused.
-            if (json && dropForeignThinking(json) > 0)
-                body = Buffer.from(JSON.stringify(json));
-        }
-        else {
-            target = { protocol: "https:", host: reqHost, port: 443, agent: this.agentFor(`host:${reqHost}`, "https:"), extraHeaders: {} };
-            tag = `WEB ${reqHost}`;
+            break;
         }
         if (json && typeof json.service_tier === "string")
             record.requestedTier = json.service_tier;
@@ -1536,26 +1600,12 @@ export class Proxy {
     chooseTarget(resolved, cfg, log) {
         if (!resolved.fallbacks?.length)
             return resolved;
-        const usable = (name) => {
-            const provider = cfg.providers[name];
-            if (!provider)
-                return false;
-            if (provider.type === "anthropic") {
-                if (!provider.accountPool || provider.auth !== "claude-code")
-                    return false;
-                const accounts = this.claudeAccounts.peekCredentials();
-                return accounts.length > 0 && this.pool.hasUsable(name, accounts);
-            }
-            if (provider.type === "chatgpt")
-                return this.chatgpt(name, provider).hasUsable();
-            return this.pool.hasUsable(name, this.credentialsOf(name, provider));
-        };
-        if (usable(resolved.provider))
+        if (this.targetUsable(resolved, cfg))
             return resolved;
         for (const f of resolved.fallbacks) {
             if (f.provider === resolved.provider && f.model === resolved.model)
                 continue;
-            if (!usable(f.provider))
+            if (!this.targetUsable(f, cfg))
                 continue;
             log.info(`FAILOVER ${resolved.provider}/${resolved.model} exhausted → ${f.provider}/${f.model}`);
             // The tag names the model that answers, not the one that could not: a log line saying `->m1`
@@ -1570,6 +1620,37 @@ export class Proxy {
         }
         return resolved;
     }
+    /** Only configured route fallbacks, not another account or an invented provider. */
+    promptFallback(resolved, attempted, cfg) {
+        for (const f of resolved.fallbacks ?? []) {
+            if (f.provider === attempted.provider && f.model === attempted.model)
+                continue;
+            if (!this.targetUsable(f, cfg))
+                continue;
+            return {
+                provider: f.provider, model: f.model, effort: f.effort ?? resolved.effort,
+                tag: `${resolved.tag.split("->")[0] ?? resolved.model}->${f.model} (prompt fallback from ${attempted.provider})`,
+            };
+        }
+        return null;
+    }
+    targetUsable(target, cfg) {
+        const configured = cfg.providers[target.provider];
+        if (!configured)
+            return false;
+        const provider = providerFor(configured, target.model);
+        if (provider.type === "anthropic") {
+            if (!provider.accountPool || provider.auth !== "claude-code")
+                return false;
+            const accounts = this.claudeAccounts.peekCredentials();
+            return accounts.length > 0 && this.pool.hasUsable(target.provider, accounts);
+        }
+        if (provider.type === "chatgpt")
+            return this.chatgpt(target.provider, provider).hasUsable();
+        if (provider.type === "google" && provider.auth === "antigravity")
+            return this.google(target.provider, provider).hasUsable();
+        return this.pool.hasUsable(target.provider, this.credentialsOf(target.provider, provider));
+    }
     /**
      * Tell the pool how a translated provider's turn went. These adapters hold their own credential —
      * an OAuth grant, or configured headers — so there is one of it, but the pool still has to hear