codex-copilot-dx 0.6.18 → 0.6.20

package/src/pm-studio-setup.mjs

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { createHash, randomUUID } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import {
   AUTH_PROFILE_CLAUDE,
@@ -20,12 +20,14 @@ import {
   patchAsarBuffer,
   sha256Hex,
 } from "./pm-studio-asar.mjs";
+import { inspectBundleContent } from "./pm-studio-bundle-content.mjs";
 import { withPmStudioSetupLock } from "./pm-studio-setup-lock.mjs";
 
+export { inspectBundleContent } from "./pm-studio-bundle-content.mjs";
+
 export const DEFAULT_PM_STUDIO_APP_PATH = "/Applications/PM Studio.app";
 export const PM_STUDIO_CLAUDE_AUTH_COMMAND = "ccdx auth login claude --reauth --github-login <personal-login>";
 const MIN_FREE_MARGIN_BYTES = 16 * 1024 * 1024;
-const BUNDLE_CONTENT_SCHEME = "ccdx-bundle-content-v2";
 
 function setupError(code, message, details) {
   const error = new Error(message);
@@ -60,158 +62,6 @@ function runChecked(processRunner, command, args, label) {
   return result;
 }
 
-function hashRegularFile(filePath, expected, readBuffer) {
-  const hash = createHash("sha256");
-  const file = fs.openSync(filePath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
-  const buffer = readBuffer || Buffer.allocUnsafe(1024 * 1024);
-  try {
-    const before = fs.fstatSync(file, { bigint: true });
-    if (before.dev !== BigInt(expected.dev)
-      || before.ino !== BigInt(expected.ino)
-      || before.size !== BigInt(expected.size)) {
-      throw setupError("PM_STUDIO_BUNDLE_CHANGED", `PM Studio bundle changed while reading ${filePath}`);
-    }
-    for (;;) {
-      const length = fs.readSync(file, buffer, 0, buffer.length, null);
-      if (length === 0) break;
-      hash.update(buffer.subarray(0, length));
-    }
-    const after = fs.fstatSync(file, { bigint: true });
-    if (before.dev !== after.dev
-      || before.ino !== after.ino
-      || before.size !== after.size
-      || before.mtimeNs !== after.mtimeNs
-      || before.ctimeNs !== after.ctimeNs) {
-      throw setupError("PM_STUDIO_BUNDLE_CHANGED", `PM Studio bundle changed while hashing ${filePath}`);
-    }
-  } finally {
-    fs.closeSync(file);
-  }
-  return hash.digest("hex");
-}
-
-function parseXattrHex(output, root, ignoredXattrs) {
-  const records = [];
-  const ignored = new Set(ignoredXattrs);
-  const seen = new Set();
-  let current = null;
-  const flush = () => {
-    if (!current) return;
-    if (!ignored.has(current.name)) {
-      const key = `${current.path}\0${current.name}`;
-      if (seen.has(key)) throw setupError("PM_STUDIO_XATTR_INVALID", `Duplicate extended attribute ${current.name}`);
-      seen.add(key);
-      const value = Buffer.from(current.hex.join(""), "hex");
-      records.push(["xattr", current.path, current.name, value.length, sha256Hex(value)]);
-    }
-    current = null;
-  };
-
-  for (const line of String(output || "").split(/\r?\n/)) {
-    if (!line) continue;
-    const separator = line.lastIndexOf(": ");
-    if ((line === `${root}:` || line.startsWith(`${root}: `) || line.startsWith(`${root}${path.sep}`))
-      && separator >= root.length && line.endsWith(":")) {
-      flush();
-      const target = line.slice(0, separator);
-      const relative = target === root ? "." : path.relative(root, target).split(path.sep).join("/");
-      if (!relative || relative === ".." || relative.startsWith("../") || path.isAbsolute(relative)) {
-        throw setupError("PM_STUDIO_XATTR_INVALID", `Extended attribute path escapes PM Studio: ${target}`);
-      }
-      current = { path: relative, name: line.slice(separator + 2, -1), hex: [] };
-      continue;
-    }
-    if (!current) throw setupError("PM_STUDIO_XATTR_INVALID", "Could not parse PM Studio extended attributes");
-    const data = line.includes("  |") ? line.slice(0, line.indexOf("  |")) : line;
-    const tokens = data.trim().split(/\s+/);
-    if (!/^[0-9a-f]{8}$/i.test(tokens[0]) || tokens.slice(1).some((token) => !/^[0-9a-f]{2}$/i.test(token))) {
-      throw setupError("PM_STUDIO_XATTR_INVALID", "Could not parse PM Studio extended attribute bytes");
-    }
-    current.hex.push(...tokens.slice(1));
-  }
-  flush();
-  return records.sort((left, right) => Buffer.compare(
-    Buffer.from(`${left[1]}\0${left[2]}`),
-    Buffer.from(`${right[1]}\0${right[2]}`),
-  ));
-}
-
-export function inspectBundleContent(appPath, {
-  xattrOutput = "",
-  ignoredXattrs = [],
-  readBuffer,
-} = {}) {
-  const root = path.resolve(appPath);
-  const rootStat = fs.lstatSync(root);
-  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
-    throw setupError("PM_STUDIO_APP_INVALID", `PM Studio path is not a regular app bundle: ${appPath}`);
-  }
-  const records = [];
-  const normalizedPaths = new Map();
-  let regularFileCount = 0;
-  let regularBytes = 0;
-  let symlinkCount = 0;
-
-  const rememberPath = (relative) => {
-    const normalized = relative.normalize("NFC");
-    const existing = normalizedPaths.get(normalized);
-    if (existing && existing !== relative) {
-      throw setupError("PM_STUDIO_BUNDLE_PATH_COLLISION", `PM Studio contains colliding paths: ${existing} and ${relative}`);
-    }
-    normalizedPaths.set(normalized, relative);
-  };
-  rememberPath(".");
-  records.push(["directory", ".", rootStat.mode & 0o7777]);
-  const visit = (directory) => {
-    const names = fs.readdirSync(directory).sort((left, right) =>
-      Buffer.compare(Buffer.from(left), Buffer.from(right)));
-    for (const name of names) {
-      const fullPath = path.join(directory, name);
-      const stat = fs.lstatSync(fullPath);
-      const relative = path.relative(root, fullPath).split(path.sep).join("/");
-      const mode = stat.mode & 0o7777;
-      rememberPath(relative);
-      if (stat.isDirectory() && !stat.isSymbolicLink()) {
-        records.push(["directory", relative, mode]);
-        visit(fullPath);
-      } else if (stat.isSymbolicLink()) {
-        const target = fs.readlinkSync(fullPath);
-        const resolved = path.resolve(path.dirname(fullPath), target);
-        if (path.isAbsolute(target)
-          || (resolved !== root && !resolved.startsWith(`${root}${path.sep}`))
-          || !fs.existsSync(resolved)) {
-          throw setupError("PM_STUDIO_BUNDLE_SYMLINK_INVALID", `PM Studio contains an unsafe symlink: ${relative}`);
-        }
-        symlinkCount += 1;
-        records.push(["symlink", relative, mode, target]);
-      } else if (stat.isFile()) {
-        if (stat.nlink !== 1) {
-          throw setupError("PM_STUDIO_BUNDLE_HARDLINK_INVALID", `PM Studio contains a hard-linked file: ${relative}`);
-        }
-        regularFileCount += 1;
-        regularBytes += stat.size;
-        records.push(["file", relative, mode, stat.size, hashRegularFile(fullPath, stat, readBuffer)]);
-      } else {
-        throw setupError("PM_STUDIO_BUNDLE_ENTRY_INVALID", `PM Studio contains an unsupported entry: ${relative}`);
-      }
-    }
-  };
-  visit(root);
-
-  const xattrRecords = parseXattrHex(xattrOutput, root, ignoredXattrs);
-  const hash = createHash("sha256");
-  for (const record of [...records, ...xattrRecords]) hash.update(`${JSON.stringify(record)}\n`);
-  return {
-    scheme: BUNDLE_CONTENT_SCHEME,
-    sha256: hash.digest("hex"),
-    entryCount: records.length,
-    regularFileCount,
-    regularBytes,
-    symlinkCount,
-    xattrCount: xattrRecords.length,
-  };
-}
-
 function defaultInspectBundleContent({ appPath, recipe, processRunner, readBuffer }) {
   const xattrs = runChecked(processRunner, "/usr/bin/xattr", ["-r", "-s", "-x", "-l", appPath],
     "Reading PM Studio extended attributes");
@@ -346,7 +196,7 @@ function statusInspectExecutableIntegrity({ appPath, infoPlistPath, recipe, proc
   };
 }
 
-export function createPmStudioStatusOperationOverrides() {
+function createPmStudioFileInspectionOperationOverrides() {
   const evidenceCache = new Map();
   const bundleReadBuffer = Buffer.allocUnsafe(1024 * 1024);
   return {
@@ -370,6 +220,10 @@ export function createPmStudioStatusOperationOverrides() {
   };
 }
 
+export function createPmStudioStatusOperationOverrides() {
+  return createPmStudioFileInspectionOperationOverrides();
+}
+
 function defaultSignApp({ appPath, source, processRunner }) {
   const preserve = [];
   if (source?.codeSign?.displayValid === true) {
@@ -1043,7 +897,7 @@ function patchRecordForState(manifest, recipe, state) {
   return patchRecordMatches(manifest?.patched, recipe, state) ? manifest.patched : null;
 }
 
-function validateBackup({ backupDir, recipe, operations }) {
+function validateBackup({ backupDir, recipe, operations, evidence }) {
   const manifestPath = path.join(backupDir, "manifest.json");
   const backupAppPath = path.join(backupDir, "PM Studio.app");
   let manifest;
@@ -1079,6 +933,9 @@ function validateBackup({ backupDir, recipe, operations }) {
   if (inspection.state !== "clean") {
     throw setupError("PM_STUDIO_BACKUP_INVALID", "Existing PM Studio backup is not an exact clean bundle", inspection.issues);
   }
+  if (evidence) {
+    evidence.inspection = inspection;
+  }
   return { backupDir, backupAppPath, manifestPath, manifest, reused: true };
 }
 
@@ -1316,6 +1173,10 @@ function restoreStateFingerprint(inspection, bundleContent) {
 
 function inspectRestoreState({ appPath, recipe, operations }) {
   const inspection = inspectPmStudioApp({ appPath, recipe, operations });
+  return restoreStateFromInspection({ appPath, inspection, recipe, operations });
+}
+
+function restoreStateFromInspection({ appPath, inspection, recipe, operations }) {
   const bundleContent = inspection.bundleContent || operations.inspectBundleContent({
     ...appPaths(appPath, recipe),
     recipe,
@@ -1355,7 +1216,10 @@ export async function runPmStudioSetup({
   operations: operationOverrides = {},
   logger = (line) => console.log(line),
 } = {}) {
-  const operations = createPmStudioSetupOperations(operationOverrides);
+  const operations = createPmStudioSetupOperations({
+    ...createPmStudioFileInspectionOperationOverrides(),
+    ...operationOverrides,
+  });
   return operations.withSetupLock({ appPath }, async () => {
   const messages = [];
   const emit = (message) => {
@@ -1548,7 +1412,10 @@ export async function runPmStudioRestore({
   operations: operationOverrides = {},
   logger = (line) => console.log(line),
 } = {}) {
-  const operations = createPmStudioSetupOperations(operationOverrides);
+  const operations = createPmStudioSetupOperations({
+    ...createPmStudioFileInspectionOperationOverrides(),
+    ...operationOverrides,
+  });
   return operations.withSetupLock({ appPath }, async () => {
     const messages = [];
     const emit = (message) => {
@@ -1590,7 +1457,8 @@ export async function runPmStudioRestore({
 
     const manifestPath = pmStudioPatchManifestPath({ home, backupRoot, recipe });
     const backupDir = path.dirname(manifestPath);
-    const backup = validateBackup({ backupDir, recipe, operations });
+    const backupEvidence = {};
+    const backup = validateBackup({ backupDir, recipe, operations, evidence: backupEvidence });
     assertPatchedBinaryRecord({
       inspection: source.inspection,
       manifestPath: backup.manifestPath,
@@ -1604,7 +1472,12 @@ export async function runPmStudioRestore({
     });
     assertRestoreSpace({ appPath, backupAppPath: backup.backupAppPath, operations });
     const manifestSnapshot = fs.readFileSync(backup.manifestPath);
-    const backupSource = inspectRestoreState({ appPath: backup.backupAppPath, recipe, operations });
+    const backupSource = restoreStateFromInspection({
+      appPath: backup.backupAppPath,
+      inspection: backupEvidence.inspection,
+      recipe,
+      operations,
+    });
     if (backupSource.inspection.state !== "clean") {
       throw setupError("PM_STUDIO_BACKUP_INVALID", "Verified PM Studio backup is not an exact clean bundle",
         backupSource.inspection.issues);
@@ -1623,9 +1496,16 @@ export async function runPmStudioRestore({
         throw setupError("PM_STUDIO_BACKUP_CHANGED",
           "PM Studio backup manifest changed during restore; the verified staging bundle was not installed");
       }
-      const currentBackup = validateBackup({ backupDir, recipe, operations });
-      const unchangedBackup = inspectRestoreState({
+      const currentBackupEvidence = {};
+      const currentBackup = validateBackup({
+        backupDir,
+        recipe,
+        operations,
+        evidence: currentBackupEvidence,
+      });
+      const unchangedBackup = restoreStateFromInspection({
         appPath: currentBackup.backupAppPath,
+        inspection: currentBackupEvidence.inspection,
         recipe,
         operations,
       });

package/src/responses-handler.mjs

@@ -3,6 +3,7 @@ import { applyCopilotResponsesRequestPolicies } from "./copilot-responses-policy
 import {
   createRequestAbort,
   logRequestFailure,
+  MAX_UPSTREAM_CHAT_SUCCESS_BODY_BYTES,
   MAX_UPSTREAM_ERROR_BODY_BYTES,
   readJsonBody,
   readBoundedResponseText,
@@ -136,7 +137,7 @@ export function createResponsesHandler(options) {
       if (!["responses_prepare_timeout", "stream_handshake_timeout", "upstream_timeout"].includes(abort.reason)) {
         return error;
       }
-      const activated = imagePressure?.markTimeout?.(prepared?.historyRootId, {
+      const activated = imagePressure?.markTimeout?.(responseHistoryPressureRootId(prepared), {
         eligible: imagePressureResult?.pressureEligible === true,
       });
       if (!activated) return error;
@@ -310,7 +311,11 @@ export function createResponsesHandler(options) {
             });
             releaseChatPayload();
             const data = upstream.ok
-              ? await upstream.text()
+              ? await readBoundedResponseText(upstream, {
+                maxBytes: MAX_UPSTREAM_CHAT_SUCCESS_BODY_BYTES,
+                label: "Copilot Chat success body",
+                signal: abort.signal,
+              })
               : await readBoundedResponseText(upstream, {
                 maxBytes: MAX_UPSTREAM_ERROR_BODY_BYTES,
                 label: "Copilot Chat error body",

package/src/responses-proxy.mjs

@@ -3,6 +3,7 @@ import {
   httpError,
   logRequestFailure,
   MAX_UPSTREAM_ERROR_BODY_BYTES,
+  MAX_UPSTREAM_RESPONSES_SUCCESS_BODY_BYTES,
   readBoundedResponseText,
   sendUpstreamError,
   writeOrDrain,
@@ -265,7 +266,11 @@ export async function proxyCopilotResponses(reqContext, req, res, upstream = cop
     }
   } else {
     const data = resp.ok
-      ? await resp.text()
+      ? await readBoundedResponseText(resp, {
+        maxBytes: MAX_UPSTREAM_RESPONSES_SUCCESS_BODY_BYTES,
+        label: "Copilot Responses success body",
+        signal: options.signal,
+      })
       : await readBoundedResponseText(resp, {
         maxBytes: MAX_UPSTREAM_ERROR_BODY_BYTES,
         label: "Copilot Responses error body",

package/src/runtime-config.mjs

@@ -7,6 +7,8 @@ export const RUNTIME_DEFAULTS = Object.freeze({
   maxBodyBytes: 64 * 1024 * 1024,
   maxDecodedBodyBytes: 128 * 1024 * 1024,
   maxInflightBodyBytes: 32 * 1024 * 1024,
+  maxUpstreamChatResponseBytes: 64 * 1024 * 1024,
+  maxUpstreamResponsesResponseBytes: 256 * 1024 * 1024,
   maxQueuedRequests: 16,
   requestQueueTimeoutMs: 120 * 1000,
   responseHistoryMaxBytes: 64 * 1024 * 1024,
@@ -15,26 +17,50 @@ export const RUNTIME_DEFAULTS = Object.freeze({
   tokenLockStaleMs: 15 * 60 * 1000,
 });
 
+// Node clamps larger timer delays to 1ms. Keep timer parsing separate from
+// byte/count limits so valid large resource budgets remain configurable.
+export const MAX_TIMER_DELAY_MS = 2_147_483_647;
+
 export function parsePositiveInteger(value, fallback, max = Number.POSITIVE_INFINITY) {
   const parsed = Number.parseInt(value, 10);
   return Number.isFinite(parsed) && parsed > 0 ? Math.min(parsed, max) : fallback;
 }
 
+export function parseSafePositiveInteger(value, fallback) {
+  const text = typeof value === "number" ? String(value) : String(value ?? "").trim();
+  if (!/^\d+$/.test(text)) return fallback;
+  const parsed = Number(text);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) return fallback;
+  return parsed;
+}
+
+export function parseTimerMs(value, fallback) {
+  return Math.min(parseSafePositiveInteger(value, fallback), MAX_TIMER_DELAY_MS);
+}
+
 export function loadRuntimeConfig(env = process.env) {
   return Object.freeze({
-    upstreamTimeoutMs: parsePositiveInteger(env.CCDX_UPSTREAM_TIMEOUT_MS, RUNTIME_DEFAULTS.upstreamTimeoutMs),
-    streamHandshakeTimeoutMs: parsePositiveInteger(env.CCDX_STREAM_HANDSHAKE_TIMEOUT_MS, RUNTIME_DEFAULTS.streamHandshakeTimeoutMs),
-    streamIdleTimeoutMs: parsePositiveInteger(env.CCDX_STREAM_IDLE_TIMEOUT_MS, RUNTIME_DEFAULTS.streamIdleTimeoutMs),
-    requestBodyTimeoutMs: parsePositiveInteger(env.CCDX_REQUEST_BODY_TIMEOUT_MS, RUNTIME_DEFAULTS.requestBodyTimeoutMs),
+    upstreamTimeoutMs: parseTimerMs(env.CCDX_UPSTREAM_TIMEOUT_MS, RUNTIME_DEFAULTS.upstreamTimeoutMs),
+    streamHandshakeTimeoutMs: parseTimerMs(env.CCDX_STREAM_HANDSHAKE_TIMEOUT_MS, RUNTIME_DEFAULTS.streamHandshakeTimeoutMs),
+    streamIdleTimeoutMs: parseTimerMs(env.CCDX_STREAM_IDLE_TIMEOUT_MS, RUNTIME_DEFAULTS.streamIdleTimeoutMs),
+    requestBodyTimeoutMs: parseTimerMs(env.CCDX_REQUEST_BODY_TIMEOUT_MS, RUNTIME_DEFAULTS.requestBodyTimeoutMs),
     maxSseBufferBytes: parsePositiveInteger(env.CCDX_MAX_SSE_BUFFER_BYTES, RUNTIME_DEFAULTS.maxSseBufferBytes),
     maxBodyBytes: parsePositiveInteger(env.CCDX_MAX_BODY_BYTES, RUNTIME_DEFAULTS.maxBodyBytes),
     maxDecodedBodyBytes: parsePositiveInteger(env.CCDX_MAX_DECODED_BODY_BYTES, RUNTIME_DEFAULTS.maxDecodedBodyBytes),
     maxInflightBodyBytes: parsePositiveInteger(env.CCDX_MAX_INFLIGHT_BODY_BYTES, RUNTIME_DEFAULTS.maxInflightBodyBytes),
+    maxUpstreamChatResponseBytes: parsePositiveInteger(
+      env.CCDX_MAX_UPSTREAM_CHAT_RESPONSE_BYTES,
+      RUNTIME_DEFAULTS.maxUpstreamChatResponseBytes,
+    ),
+    maxUpstreamResponsesResponseBytes: parsePositiveInteger(
+      env.CCDX_MAX_UPSTREAM_RESPONSES_RESPONSE_BYTES,
+      RUNTIME_DEFAULTS.maxUpstreamResponsesResponseBytes,
+    ),
     maxQueuedRequests: parsePositiveInteger(env.CCDX_MAX_QUEUED_REQUESTS, RUNTIME_DEFAULTS.maxQueuedRequests),
-    requestQueueTimeoutMs: parsePositiveInteger(env.CCDX_REQUEST_QUEUE_TIMEOUT_MS, RUNTIME_DEFAULTS.requestQueueTimeoutMs),
+    requestQueueTimeoutMs: parseTimerMs(env.CCDX_REQUEST_QUEUE_TIMEOUT_MS, RUNTIME_DEFAULTS.requestQueueTimeoutMs),
     responseHistoryMaxBytes: parsePositiveInteger(env.CCDX_RESPONSE_HISTORY_MAX_BYTES, RUNTIME_DEFAULTS.responseHistoryMaxBytes),
     responseHistoryMaxEntries: parsePositiveInteger(env.CCDX_RESPONSE_HISTORY_MAX_ENTRIES, RUNTIME_DEFAULTS.responseHistoryMaxEntries),
-    tokenLockTimeoutMs: parsePositiveInteger(env.CCDX_TOKEN_LOCK_TIMEOUT_MS, RUNTIME_DEFAULTS.tokenLockTimeoutMs),
-    tokenLockStaleMs: parsePositiveInteger(env.CCDX_TOKEN_LOCK_STALE_MS, RUNTIME_DEFAULTS.tokenLockStaleMs),
+    tokenLockTimeoutMs: parseSafePositiveInteger(env.CCDX_TOKEN_LOCK_TIMEOUT_MS, RUNTIME_DEFAULTS.tokenLockTimeoutMs),
+    tokenLockStaleMs: parseSafePositiveInteger(env.CCDX_TOKEN_LOCK_STALE_MS, RUNTIME_DEFAULTS.tokenLockStaleMs),
   });
 }

package/src/token-counter-service.mjs

@@ -0,0 +1,211 @@
+import { Worker } from "node:worker_threads";
+import { anthropicTokenText } from "./anthropic.mjs";
+import { debugLog } from "./log.mjs";
+
+export const DEFAULT_TOKEN_COUNTER_TIMEOUT_MS = 120 * 1000;
+export const DEFAULT_TOKEN_COUNTER_MAX_QUEUED = 16;
+
+function serviceError(message, statusCode) {
+  return Object.assign(new Error(message), { statusCode });
+}
+
+const DIAGNOSTIC_PHASES = new Set(["create", "worker", "error", "exit", "postMessage"]);
+const DIAGNOSTIC_ERROR_NAMES = new Set(["Error", "TypeError", "RangeError", "SyntaxError", "WorkerExit"]);
+
+export function tokenCounterWorkerDiagnostic(phase, error) {
+  const safePhase = DIAGNOSTIC_PHASES.has(phase) ? phase : "unknown";
+  let rawName;
+  let rawCode;
+  try { rawName = error?.name; } catch {}
+  try { rawCode = error?.code; } catch {}
+  const safeName = DIAGNOSTIC_ERROR_NAMES.has(rawName) ? rawName : "Error";
+  if (typeof rawCode === "number") rawCode = String(rawCode);
+  const safeCode = typeof rawCode === "string" && /^(?:\d+|[A-Z][A-Z0-9_]{0,63})$/.test(rawCode)
+    ? rawCode
+    : "unknown";
+  return `Token counter worker failure: phase=${safePhase} name=${safeName} code=${safeCode}`;
+}
+
+function positiveInteger(value, fallback) {
+  return Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
+}
+
+function abortError(signal) {
+  if (signal?.reason instanceof Error) return signal.reason;
+  const error = new Error("The operation was aborted");
+  error.name = "AbortError";
+  return error;
+}
+
+export function tokenCounterWorkerExecArgv(execArgv = process.execArgv) {
+  const filtered = [];
+  for (let index = 0; index < execArgv.length; index += 1) {
+    const value = execArgv[index];
+    if (value === "--input-type") {
+      index += 1;
+      continue;
+    }
+    if (value.startsWith("--input-type=")) continue;
+    filtered.push(value);
+  }
+  return filtered;
+}
+
+function createTokenCounterWorker() {
+  const execArgv = tokenCounterWorkerExecArgv();
+  const options = execArgv.length === process.execArgv.length ? undefined : { execArgv };
+  return new Worker(new URL("./token-counter-worker.mjs", import.meta.url), options);
+}
+
+export function createTokenCounterService({
+  timeoutMs = DEFAULT_TOKEN_COUNTER_TIMEOUT_MS,
+  maxQueued = DEFAULT_TOKEN_COUNTER_MAX_QUEUED,
+  workerFactory = createTokenCounterWorker,
+} = {}) {
+  timeoutMs = positiveInteger(timeoutMs, DEFAULT_TOKEN_COUNTER_TIMEOUT_MS);
+  maxQueued = positiveInteger(maxQueued, DEFAULT_TOKEN_COUNTER_MAX_QUEUED);
+  const queue = [];
+  let worker = null;
+  let active = null;
+  let nextId = 1;
+  let closed = false;
+
+  const finish = (job, callback, value) => {
+    if (job.finished) return;
+    job.finished = true;
+    if (job.timer) clearTimeout(job.timer);
+    job.signal?.removeEventListener("abort", job.onAbort);
+    callback(value);
+  };
+
+  const retireWorker = () => {
+    const retired = worker;
+    worker = null;
+    if (!retired) return;
+    retired.removeAllListeners();
+    retired.on("error", () => {});
+    Promise.resolve(retired.terminate()).catch(() => {});
+  };
+
+  const pump = () => {
+    if (closed || active || queue.length === 0) return;
+    if (!worker) {
+      try {
+        worker = workerFactory();
+      } catch (error) {
+        debugLog(tokenCounterWorkerDiagnostic("create", error));
+        const job = queue.shift();
+        if (job) finish(job, job.reject, serviceError("Token counter worker failed", 500));
+        queueMicrotask(pump);
+        return;
+      }
+      worker.on("message", (message) => {
+        if (!active || message?.id !== active.id) return;
+        const job = active;
+        active = null;
+        if (message.error) {
+          debugLog(tokenCounterWorkerDiagnostic("worker", message.error));
+          retireWorker();
+          finish(job, job.reject, serviceError("Token counter worker failed", 500));
+        } else {
+          finish(job, job.resolve, message.result);
+        }
+        pump();
+      });
+      worker.on("error", (error) => {
+        debugLog(tokenCounterWorkerDiagnostic("error", error));
+        const job = active;
+        active = null;
+        retireWorker();
+        if (job) finish(job, job.reject, serviceError("Token counter worker failed", 500));
+        pump();
+      });
+      worker.on("exit", (code) => {
+        if (active) debugLog(tokenCounterWorkerDiagnostic("exit", { name: "WorkerExit", code }));
+        const job = active;
+        active = null;
+        worker = null;
+        if (job) finish(job, job.reject, serviceError("Token counter worker failed", 500));
+        pump();
+      });
+      worker.unref?.();
+    }
+    const job = queue.shift();
+    if (!job || job.finished) return pump();
+    active = job;
+    try {
+      worker.postMessage({ id: job.id, text: job.text });
+      job.text = null;
+    } catch (error) {
+      debugLog(tokenCounterWorkerDiagnostic("postMessage", error));
+      active = null;
+      retireWorker();
+      finish(job, job.reject, serviceError("Token counter worker failed", 500));
+      pump();
+    }
+  };
+
+  const cancel = (job, error) => {
+    if (job.finished) return;
+    const queuedIndex = queue.indexOf(job);
+    if (queuedIndex >= 0) queue.splice(queuedIndex, 1);
+    if (active === job) {
+      active = null;
+      retireWorker();
+    }
+    finish(job, job.reject, error);
+    pump();
+  };
+
+  return {
+    count(body, { signal, deadlineMs = timeoutMs } = {}) {
+      if (closed) return Promise.reject(serviceError("Token counter service is closed", 503));
+      if (signal?.aborted) return Promise.reject(abortError(signal));
+      let text;
+      try {
+        text = anthropicTokenText(body);
+      } catch {
+        return Promise.reject(serviceError("Invalid count_tokens request", 400));
+      }
+      if (active && queue.length >= maxQueued) {
+        return Promise.reject(serviceError(`Token counter queue is full (${maxQueued} waiting)`, 503));
+      }
+      return new Promise((resolve, reject) => {
+        deadlineMs = positiveInteger(deadlineMs, timeoutMs);
+        const job = {
+          id: nextId++,
+          text,
+          signal,
+          resolve,
+          reject,
+          finished: false,
+          timer: null,
+          onAbort: null,
+        };
+        job.onAbort = () => cancel(job, abortError(signal));
+        signal?.addEventListener("abort", job.onAbort, { once: true });
+        job.timer = setTimeout(() => {
+          cancel(job, serviceError(`Token counting timed out after ${deadlineMs}ms`, 504));
+        }, deadlineMs);
+        queue.push(job);
+        if (signal?.aborted) job.onAbort();
+        else pump();
+      });
+    },
+    close() {
+      if (closed) return;
+      closed = true;
+      const error = serviceError("Token counter service is closed", 503);
+      if (active) {
+        const job = active;
+        active = null;
+        finish(job, job.reject, error);
+      }
+      for (const job of queue.splice(0)) finish(job, job.reject, error);
+      retireWorker();
+    },
+    stats() {
+      return { active: active ? 1 : 0, queued: queue.length, worker: worker ? 1 : 0 };
+    },
+  };
+}

package/src/token-counter-worker.mjs

@@ -0,0 +1,16 @@
+import { parentPort } from "node:worker_threads";
+import { countTokenText } from "./anthropic.mjs";
+
+parentPort.on("message", async ({ id, text }) => {
+  try {
+    parentPort.postMessage({ id, result: await countTokenText(text) });
+  } catch (error) {
+    parentPort.postMessage({
+      id,
+      error: {
+        name: typeof error?.name === "string" ? error.name : "Error",
+        code: typeof error?.code === "string" ? error.code : "unknown",
+      },
+    });
+  }
+});