copilot-relay 0.4.1 → 0.4.2

package/dist/main.js

@@ -264,7 +264,9 @@ const fileLevelByMethod = {
 	debug: consolaLevelByName.debug
 };
 const loggingSuppressed = new AsyncLocalStorage();
+const consoleSuppressed = new AsyncLocalStorage();
 const withoutLogging = (run) => loggingSuppressed.run(true, run);
+const withoutConsoleLogging = (run) => consoleSuppressed.run(true, run);
 let currentLogLevel = consolaLevelByName.info;
 const pendingLogWrites = /* @__PURE__ */ new Set();
 const registeredLogSecrets = /* @__PURE__ */ new Set();
@@ -423,15 +425,16 @@ const wrapFileLog = (level, fn) => ((...args) => {
 	if (loggingSuppressed.getStore()) return;
 	const methodLevel = fileLevelByMethod[level] ?? consolaLevelByName.info;
 	const writesToFile = methodLevel <= currentLogLevel;
-	const writesToConsole = methodLevel <= consola.level;
-	if (!writesToFile && !writesToConsole) return fn(...args);
+	const quiet = consoleSuppressed.getStore() === true;
+	const writesToConsole = !quiet && methodLevel <= consola.level;
+	if (!writesToFile && !writesToConsole) return quiet ? void 0 : fn(...args);
 	const rendered = [boundLogText(args.map((value) => boundLogText(escapeLogLineSeparators(scrubLogSecrets(scrubSensitiveUrls(formatLogValue(value)))), maxLogArgumentBytes)).join(" "), maxLogPayloadBytes)];
 	if (writesToFile) {
 		const pending = writeLogFile(level, rendered).catch(() => void 0);
 		pendingLogWrites.add(pending);
 		pending.then(() => pendingLogWrites.delete(pending));
 	}
-	return fn(...rendered);
+	return quiet ? void 0 : fn(...rendered);
 });
 consola.error = wrapFileLog("error", consola.error.bind(consola));
 consola.info = wrapFileLog("info", consola.info.bind(consola));
@@ -609,7 +612,8 @@ const ensureGitHubToken = async (options = {}) => {
 		return existingToken;
 	}
 	const deviceCode = await getDeviceCode();
-	log.info(`Open ${deviceCode.verification_uri} and enter code ${deviceCode.user_code}`);
+	if (options.onDeviceCode) options.onDeviceCode(deviceCode.verification_uri, deviceCode.user_code);
+	else log.info(`Open ${deviceCode.verification_uri} and enter code ${deviceCode.user_code}`);
 	const githubToken = await pollAccessToken(deviceCode);
 	await writeGitHubToken(githubToken);
 	log.info(`GitHub token synced to ${paths.githubTokenPath}`);
@@ -807,7 +811,7 @@ const resolveTarget = async (filePath, remainingLinks = 40) => {
 		return path.join(await resolveTarget(parent, remainingLinks), path.basename(filePath));
 	}
 };
-const readFileSnapshot = async (filePath) => {
+const readStableSnapshot = async (filePath) => {
 	const requestedPath = path.resolve(filePath);
 	const resolvedPath = await resolveTarget(requestedPath);
 	const before = await fs.lstat(resolvedPath).catch((error) => {
@@ -830,14 +834,46 @@ const readFileSnapshot = async (filePath) => {
 		if (isMissing(error)) throw new FileConflictError();
 		throw error;
 	}
-	if (!after.isFile() || !sameIdentity(identityOf(before), identityOf(after)) || await resolveTarget(requestedPath) !== resolvedPath) throw new FileConflictError();
-	return {
+	const snapshot = {
 		requestedPath,
 		resolvedPath,
 		raw,
 		mode: before.mode & 511,
 		identity: identityOf(before)
 	};
+	if (!after.isFile() || before.mode !== after.mode || await resolveTarget(requestedPath) !== resolvedPath) throw new FileConflictError();
+	if (!sameIdentity(snapshot.identity, identityOf(after))) {
+		if (sameReadContent(snapshot, {
+			...snapshot,
+			identity: identityOf(after)
+		})) throw new MetadataReadConflictError(snapshot);
+		throw new FileConflictError();
+	}
+	return snapshot;
+};
+const sameReadContent = (left, right) => left.resolvedPath === right.resolvedPath && left.raw === right.raw && left.mode === right.mode && left.identity !== null && right.identity !== null && sameIdentity(left.identity, {
+	...right.identity,
+	ctimeMs: left.identity.ctimeMs
+});
+var MetadataReadConflictError = class extends FileConflictError {
+	snapshot;
+	constructor(snapshot) {
+		super();
+		this.snapshot = snapshot;
+	}
+};
+const readFileSnapshot = async (filePath) => {
+	let firstRead;
+	for (let attempt = 1;; attempt++) try {
+		const snapshot = await readStableSnapshot(filePath);
+		if (firstRead && !sameReadContent(firstRead, snapshot)) throw new FileConflictError();
+		return snapshot;
+	} catch (error) {
+		if (!(error instanceof MetadataReadConflictError)) throw error;
+		if (attempt >= 3) throw new FileConflictError();
+		if (firstRead && !sameReadContent(firstRead, error.snapshot)) throw new FileConflictError();
+		firstRead ??= error.snapshot;
+	}
 };
 const assertUnchanged = async (expected) => {
 	const current = await readFileSnapshot(expected.requestedPath);
@@ -1306,6 +1342,7 @@ const maxQueuedBytes = 8 * 1024 * 1024;
 const activeCaptures = /* @__PURE__ */ new Set();
 const traceContext = new AsyncLocalStorage();
 const transportContext = new AsyncLocalStorage();
+const traceObserver = new AsyncLocalStorage();
 const responseExchanges = /* @__PURE__ */ new WeakMap();
 const pendingCaptures = /* @__PURE__ */ new Set();
 let captureRetentionDays = 3;
@@ -1331,6 +1368,11 @@ const errorName = (error) => error instanceof Error && [
 	"SyntaxError"
 ].includes(error.name) ? error.name : "Error";
 const record$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const withTraceObserver = (observe, run) => traceObserver.run(observe, run);
+const getReplayRequestId = () => {
+	const id = transportContext.getStore()?.requestId;
+	return id && uuid$1.test(id) ? id : void 0;
+};
 const withRecordedTransport = (transport, run) => transportContext.run(transport, run);
 const withRequestTrace = (trace, run) => traceContext.run(trace, run);
 const getRequestTrace = () => traceContext.getStore();
@@ -1495,6 +1537,109 @@ var RequestTrace = class RequestTrace {
 	deferredHandler = false;
 	removeAbort;
 	credentials = /* @__PURE__ */ new Set();
+	captureRequested = false;
+	finishedSettling = false;
+	failure;
+	recordFailure(failure) {
+		this.failure = failure;
+	}
+	diagnosticCaptureState() {
+		if (!this.captureRequested) return "off";
+		if (!this.captureDirectory) return "failed";
+		if (!this.finishedSettling) return "pending";
+		return this.manifest.captureState === "complete" ? "complete" : "incomplete";
+	}
+	diagnosticSnapshot() {
+		const known = (value, choices) => typeof value === "string" && choices.includes(value) ? value : void 0;
+		const id = (value) => {
+			const text$1 = this.metadataValue(value);
+			return text$1 && /^[A-Za-z0-9_.:-]{1,160}$/.test(text$1) ? text$1 : void 0;
+		};
+		const modelId = (value) => {
+			const text$1 = this.metadataValue(value);
+			return text$1 && /^[A-Za-z0-9_.\[\]-]{1,128}$/.test(text$1) ? text$1 : void 0;
+		};
+		const bodyState = (value) => known(value, [
+			"pending",
+			"complete",
+			"cancelled",
+			"error",
+			"absent"
+		]);
+		const status$1 = (value) => typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599 ? value : void 0;
+		const reasons$1 = [
+			"end_turn",
+			"stop_sequence",
+			"tool_use",
+			"pause_turn",
+			"refusal",
+			"max_tokens"
+		];
+		return {
+			requestId: this.requestId,
+			status: status$1(this.manifest.status),
+			responseState: bodyState(this.manifest.response?.state),
+			stopReason: known(this.manifest.outcome?.stop_reason, reasons$1),
+			reportedModel: modelId(this.manifest.outcome?.model),
+			terminal: this.manifest.outcome?.terminal === true,
+			failure: this.failure,
+			capture: { state: this.diagnosticCaptureState() },
+			exchanges: this.manifest.exchanges.map((exchange) => ({
+				order: exchange.order,
+				path: known(exchange.path, [
+					"/models",
+					"/chat/completions",
+					"/responses",
+					"/v1/messages"
+				]) ?? "unknown",
+				upstreamRequestId: id(exchange.upstreamRequestId),
+				providerRequestId: [
+					"x-copilot-service-request-id",
+					"x-github-request-id",
+					"x-request-id"
+				].map((key) => id(exchange.responseHeaders?.[key])).find(Boolean),
+				messageId: id(exchange.outcome?.message_id),
+				model: modelId(exchange.outcome?.model),
+				status: status$1(exchange.status),
+				responseState: bodyState(exchange.response?.state),
+				finishReason: known(exchange.outcome?.finish_reason, [
+					"stop",
+					"length",
+					"tool_calls",
+					"content_filter"
+				]),
+				stopReason: known(exchange.outcome?.stop_reason, reasons$1),
+				responseStatus: known(exchange.outcome?.response_status, [
+					"completed",
+					"failed",
+					"cancelled",
+					"incomplete"
+				]),
+				refusalCategory: known(exchange.outcome?.refusal_category, [
+					"cyber",
+					"bio",
+					"reasoning_extraction",
+					"general_harms",
+					"frontier_llm",
+					"unknown"
+				]),
+				incompleteReason: known(exchange.outcome?.incomplete_reason, [
+					"max_output_tokens",
+					"content_filter",
+					"unknown"
+				]),
+				error: known(exchange.error ?? exchange.response?.error, [
+					"AbortError",
+					"TimeoutError",
+					"TypeError",
+					"SyntaxError",
+					"Error"
+				]),
+				discarded: exchange.discarded === true
+			})),
+			refreshes: this.manifest.refreshes.map((refresh) => refresh.outcome)
+		};
+	}
 	protectCredential(value) {
 		if (value) this.credentials.add(value);
 		registerLogSecret(value);
@@ -1599,6 +1744,8 @@ var RequestTrace = class RequestTrace {
 	}
 	static async create(id, request, config, runtime, capture) {
 		const trace = new RequestTrace(id, request, config, runtime);
+		trace.captureRequested = capture;
+		traceObserver.getStore()?.(trace);
 		if (!capture) return trace;
 		try {
 			if (!uuid$1.test(id)) throw new Error("Invalid capture identifier.");
@@ -1881,6 +2028,7 @@ var RequestTrace = class RequestTrace {
 			await Promise.all([...this.openFiles.values()].map((handle) => handle.close().catch(() => {})));
 			this.openFiles.clear();
 			if (this.captureDirectory) activeCaptures.delete(this.captureDirectory);
+			this.finishedSettling = true;
 			this.resolveFinished();
 		});
 	}
@@ -2297,6 +2445,145 @@ async function boundModelOutputTokens(config, model, requested) {
 	return bounded;
 }
 
+//#endregion
+//#region src/lib/terminal.ts
+const colorEnabled = (env = process.env, isTTY = Boolean(process.stdout.isTTY)) => {
+	if (env.NO_COLOR !== void 0 || env.FORCE_COLOR === "0") return false;
+	if (env.FORCE_COLOR !== void 0) return env.FORCE_COLOR === "" || [
+		"1",
+		"2",
+		"3",
+		"true"
+	].includes(env.FORCE_COLOR);
+	return isTTY && env.TERM !== "dumb";
+};
+const codes = {
+	good: 32,
+	bad: 31,
+	warning: 33,
+	muted: 90
+};
+const terminalText = (value) => sanitizeTerminalString(value).replace(/[\x80-\x9f]|\p{Cf}|\p{Zl}|\p{Zp}/gu, "");
+const colorText = (text$1, tone, enabled) => enabled ? `\u001b[${codes[tone]}m${text$1}\u001b[0m` : text$1;
+
+//#endregion
+//#region src/lib/model-probe-output.ts
+const tones = {
+	PASS: "good",
+	FAIL: "bad",
+	INCOMPLETE: "warning",
+	SKIPPED: "muted",
+	NOT_TESTED: "muted"
+};
+const reasons = {
+	"completed-text": "Ready",
+	"probe-timeout": "Timed out",
+	"upstream-timeout-or-HTTP-504": "Upstream timeout (504)",
+	"authentication-rejected": "Auth rejected (401)",
+	"access-denied": "Access denied (403)",
+	"rate-limited": "Rate limited (429)",
+	"cancelled": "Cancelled",
+	"total-deadline": "Time budget reached",
+	"unsupported-model-type": "Not a chat model",
+	"unsupported-relay-endpoint": "Unsupported route",
+	"unsupported-api": "Unsupported API",
+	"unsupported-effort": "Unsupported effort",
+	"unsafe-or-noncanonical-id": "Unsupported model ID",
+	"upstream-response-failed": "Upstream failed",
+	"upstream-response-incomplete": "Incomplete response",
+	"malformed-response": "Invalid response",
+	"model-mismatch": "Model mismatch",
+	"reachable-output-budget-exhausted": "Output limit reached",
+	"output-budget-exhausted-usage-unreported": "Output limit reached",
+	"refusal-or-unexpected-completion": "Unexpected completion",
+	"refusal": "Refused",
+	"empty-completed-response": "Empty response",
+	"network-or-invalid-response": "Request failed",
+	"transport-error": "Connection failed",
+	"refresh-failed": "Token refresh failed",
+	"invalid-tool-input": "Invalid tool input",
+	"local-validation": "Request rejected",
+	"unknown-error": "Unknown API error"
+};
+const probeReason = (code) => reasons[code] ?? (/^HTTP-\d{3}$/.test(code) ? `HTTP ${code.slice(5)}` : "Unknown result");
+const probeColumnWidth = (ids, columns) => Math.min(Math.max(14, ...ids.map((id) => terminalText(id).length)), Math.max(14, columns - 42));
+const renderProbeHeader = (width) => `${"MODEL".padEnd(width)}  ${"STATUS".padEnd(10)}  ${"TIME".padStart(6)}  RESULT`;
+const wrap = (text$1, width) => {
+	const lines = [];
+	for (let index = 0; index < text$1.length; index += width) lines.push(text$1.slice(index, index + width));
+	return lines;
+};
+const probeTime = (row) => {
+	if (!row.sent) return "-";
+	const seconds = row.latency / 1e3;
+	if (seconds < 1e3) return `${seconds.toFixed(1)}s`;
+	if (seconds < 3600) return `${(seconds / 60).toFixed(1)}m`;
+	return `${(seconds / 3600).toFixed(1)}h`;
+};
+const renderProbeRow = (row, width, color, columns = 80) => {
+	const models$1 = wrap(terminalText(row.id), width);
+	const time = probeTime(row);
+	const results = wrap(probeReason(row.detail) + (row.unverified ? " *" : ""), Math.max(1, columns - width - 22));
+	const status$1 = colorText(row.status, tones[row.status], color) + " ".repeat(10 - row.status.length);
+	return Array.from({ length: Math.max(models$1.length, results.length) }, (_, index) => {
+		return `${(models$1[index] ?? "").padEnd(width)}${index === 0 ? `  ${status$1}  ${time.padStart(6)}  ` : " ".repeat(22)}${results[index] ?? ""}`.trimEnd();
+	});
+};
+const renderProbeSummary = (rows) => {
+	if (!rows.length) return "Summary: no models to test";
+	const labels = {
+		PASS: "passed",
+		FAIL: "failed",
+		INCOMPLETE: "incomplete",
+		SKIPPED: "skipped",
+		NOT_TESTED: "not tested"
+	};
+	return "Summary: " + Object.keys(labels).flatMap((status$1) => {
+		const count = rows.filter((row) => row.status === status$1).length;
+		return count ? [`${count} ${labels[status$1]}`] : [];
+	}).join(" · ");
+};
+const renderProbeDetails = (row, diagnostic) => {
+	const lines = [`  effort=${row.effort} max_tokens=${row.maxTokens} planned_route=${row.endpoint}`, `  reported=${row.reported} reason=${row.detail}`];
+	if (!diagnostic) return [...lines, "  request=not started"];
+	lines.push(`  request_id=${diagnostic.requestId}`);
+	lines.push(`  client_http=${diagnostic.status ?? "unknown"} response=${diagnostic.responseState ?? "unknown"} terminal=${diagnostic.terminal ? "observed" : "not observed"}`);
+	for (const exchange of diagnostic.exchanges) {
+		lines.push(`  route=${exchange.path} upstream_http=${exchange.status ?? "unknown"} response=${exchange.responseState ?? "unknown"}${exchange.discarded ? " discarded=yes" : ""}`);
+		lines.push(`  upstream_request_id=${exchange.upstreamRequestId ?? "unknown"}`);
+		if (exchange.providerRequestId) lines.push(`  provider_request_id=${exchange.providerRequestId}`);
+		if (exchange.model && exchange.model !== row.reported) lines.push(`  upstream_model=${exchange.model}`);
+		if (exchange.messageId) lines.push(`  message_id=${exchange.messageId}`);
+		const outcome = exchange.stopReason ?? exchange.finishReason ?? exchange.responseStatus;
+		if (outcome || exchange.error) lines.push(`  outcome=${outcome ?? "unknown"}${exchange.error ? ` transport=${exchange.error}` : ""}`);
+		if (exchange.refusalCategory) lines.push(`  refusal_category=${exchange.refusalCategory}`);
+		if (exchange.incompleteReason) lines.push(`  incomplete_reason=${exchange.incompleteReason}`);
+	}
+	if (diagnostic.refreshes.length) lines.push(`  refresh=${diagnostic.refreshes.join(",")}`);
+	lines.push(`  capture=${diagnostic.capture.state}`);
+	if (diagnostic.capture.state === "complete") lines.push(`  Offline replay: copilot-relay replay ${diagnostic.requestId}`);
+	else if (diagnostic.capture.state === "off") lines.push("  Replay unavailable: debug was off; capture privately if the error repeats.");
+	else lines.push("  Replay unavailable: capture is not complete.");
+	return lines;
+};
+const probeHint = (code) => {
+	if (code === "probe-timeout" || code === "upstream-timeout-or-HTTP-504") return "Timeout: check connection and configured deadline.";
+	if (["authentication-rejected", "refresh-failed"].includes(code)) return "Authentication: run copilot-relay auth before another probe.";
+	if (code === "access-denied") return "Access: check this account's model entitlement and gateway policy.";
+	if (code === "rate-limited") return "Rate limit: wait before retrying; repeated probes consume usage.";
+	if (code === "refusal") return "Refusal: inspect the failing request's evidence; a short probe does not explain its cause.";
+	if (code.includes("budget-exhausted")) return "Output limit: reachability is not completion; review the probe's output budget.";
+	if (code === "model-mismatch") return "Model mismatch: compare selected, sent and reported IDs with --details.";
+	if ([
+		"invalid-tool-input",
+		"malformed-response",
+		"upstream-response-failed",
+		"unknown-error",
+		"network-or-invalid-response",
+		"transport-error"
+	].includes(code) || /^HTTP-5\d\d$/.test(code)) return "API failure: the request ID locates the local summary; --details shows evidence on a new probe.";
+};
+
 //#endregion
 //#region src/claude/utils.ts
 const isEffortOnlyControl = (control) => control !== null && typeof control === "object" && !Array.isArray(control) && Object.keys(control).length === 1 && "effort" in control && isConfiguredReasoningEffort(control.effort);
@@ -2324,6 +2611,43 @@ function mapOpenAIStopReasonToClaude(finishReason) {
 		content_filter: "refusal"
 	}[finishReason];
 }
+/**
+* Upstream sends an empty `arguments` string for tools that take no
+* parameters (#114). Blank text is the empty object; anything else must be a
+* JSON object, and a failure names the tool rather than surfacing a bare
+* SyntaxError. Argument text is never echoed: it can carry user data.
+*/
+function parseUpstreamToolInput(toolName, argumentsText) {
+	const text$1 = argumentsText ?? "";
+	if (!text$1.trim()) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(text$1);
+	} catch {
+		throw invalidUpstreamToolInput(toolName, "is not valid JSON");
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw invalidUpstreamToolInput(toolName, "is not a JSON object");
+	return parsed;
+}
+function invalidUpstreamToolInputMessage(toolName, reason) {
+	return `Upstream returned tool input for "${toolName}" that ${reason}.`;
+}
+/** Mapped 502 whose message is client-safe: it names the tool, never the arguments. */
+var UpstreamToolInputError = class extends HTTPError {
+	constructor(message) {
+		super(message, Response.json({
+			type: "error",
+			error: {
+				type: "api_error",
+				message
+			}
+		}, { status: 502 }), message);
+		this.name = "UpstreamToolInputError";
+	}
+};
+function invalidUpstreamToolInput(toolName, reason) {
+	return new UpstreamToolInputError(invalidUpstreamToolInputMessage(toolName, reason));
+}
 
 //#endregion
 //#region src/claude/tool-names.ts
@@ -2638,17 +2962,15 @@ function getClaudeTextBlocks(messageContent) {
 }
 function getClaudeToolUseBlocks(toolCalls, toolNameMapper) {
 	if (!toolCalls) return [];
-	return toolCalls.map((toolCall) => ({
-		type: "tool_use",
-		id: toolCall.id,
-		name: toolNameMapper.toClaude(toolCall.function.name),
-		input: safeJsonParse(toolCall.function.arguments)
-	}));
-}
-function safeJsonParse(input) {
-	const parsed = JSON.parse(input);
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Upstream tool input must be a JSON object.");
-	return parsed;
+	return toolCalls.map((toolCall) => {
+		const name = toolNameMapper.toClaude(toolCall.function.name);
+		return {
+			type: "tool_use",
+			id: toolCall.id,
+			name,
+			input: parseUpstreamToolInput(name, toolCall.function.arguments)
+		};
+	});
 }
 
 //#endregion
@@ -2752,8 +3074,8 @@ function translateChunkToClaudeEvents(chunk, state, toolNameMapper = createClaud
 		closeOpenContentBlock(events$1, state);
 		if (choice.finish_reason === "tool_calls") for (const toolCall of Object.values(state.toolCalls)) {
 			const argumentsText = toolCall.arguments ?? "";
-			const input = JSON.parse(argumentsText);
-			if (!input || typeof input !== "object" || Array.isArray(input)) throw new Error("Upstream tool input must be a JSON object.");
+			parseUpstreamToolInput(toolCall.name, argumentsText);
+			const partialJson = argumentsText.trim() ? argumentsText : "{}";
 			const index = state.contentBlockIndex++;
 			toolCall.claudeBlockIndex = index;
 			events$1.push({
@@ -2770,7 +3092,7 @@ function translateChunkToClaudeEvents(chunk, state, toolNameMapper = createClaud
 				index,
 				delta: {
 					type: "input_json_delta",
-					partial_json: argumentsText
+					partial_json: partialJson
 				}
 			}, {
 				type: "content_block_stop",
@@ -2792,12 +3114,12 @@ function translateChunkToClaudeEvents(chunk, state, toolNameMapper = createClaud
 	}
 	return events$1;
 }
-function translateErrorToClaudeErrorEvent() {
+function translateErrorToClaudeErrorEvent(error) {
 	return {
 		type: "error",
 		error: {
 			type: "api_error",
-			message: "An unexpected error occurred during streaming."
+			message: error instanceof UpstreamToolInputError ? error.message : "An unexpected error occurred during streaming."
 		}
 	};
 }
@@ -5030,8 +5352,25 @@ claudeRoutes.post("/messages", async (c) => {
 	} catch (error) {
 		if (!(error instanceof HTTPError)) throw error;
 		c.set("requestErrorMessage", error.message);
+		const trace = c.get("requestTrace");
+		if (error.response.status === 400 && trace?.manifest.exchanges.length === 0) trace.recordFailure("local-validation");
 		log.error(`request_id=${requestId} ${error.message}`);
-		return error.response;
+		const headers = new Headers();
+		for (const name of [
+			"content-type",
+			"retry-after",
+			"x-request-id",
+			"x-github-request-id",
+			"x-copilot-service-request-id"
+		]) {
+			const value = error.response.headers.get(name);
+			if (value !== null) headers.set(name, value);
+		}
+		return new Response(await error.response.arrayBuffer(), {
+			status: error.response.status,
+			statusText: error.response.statusText,
+			headers
+		});
 	}
 	if (claudePayload.stream) {
 		const trace = c.get("requestTrace");
@@ -5046,7 +5385,10 @@ claudeRoutes.post("/messages", async (c) => {
 				await handleClaudeMessageRequest(config, claudePayload, requestSignal, requestId, writeEvent, c.req.raw.headers);
 			} catch (error) {
 				log.error(`request_id=${requestId} Error during Claude stream request:`, error);
-				await writeEvent(translateErrorToClaudeErrorEvent());
+				if (error instanceof UpstreamToolInputError) trace?.recordFailure("invalid-tool-input");
+				const errorEvent = translateErrorToClaudeErrorEvent(error);
+				if (errorEvent.type === "error") errorEvent.error.message += ` (request_id=${requestId})`;
+				await writeEvent(errorEvent);
 			} finally {
 				trace?.handlerSettled();
 				log.info(`request_id=${requestId} stream completed ${Math.round(performance.now() - streamStarted)}ms`);
@@ -5064,6 +5406,7 @@ claudeRoutes.post("/messages", async (c) => {
 			} }, 501);
 		}
 		if (error instanceof HTTPError) {
+			if (error instanceof UpstreamToolInputError) c.get("requestTrace")?.recordFailure("invalid-tool-input");
 			const text$1 = await error.response.text().catch(() => "");
 			c.set("requestErrorMessage", error.detail ?? text$1.slice(0, 240));
 			return new Response(text$1, {
@@ -5154,7 +5497,7 @@ const createServer = (config) => {
 	const { host, port } = config;
 	const configuredHost = parseAuthority(host.includes(":") && !host.startsWith("[") ? `[${host}]` : host, "http:")?.hostname;
 	app.use("*", async (c, next) => {
-		const requestId = randomUUID();
+		const requestId = getReplayRequestId() ?? randomUUID();
 		c.set("config", config);
 		c.set("requestId", requestId);
 		c.header("x-copilot-relay-request-id", requestId);
@@ -5163,6 +5506,7 @@ const createServer = (config) => {
 		try {
 			await next();
 		} finally {
+			c.header("x-copilot-relay-request-id", requestId);
 			const ms = Math.round(performance.now() - started);
 			log.info(formatStatusLog(requestId, c.req.method, c.req.path, c.res.status, ms, c.get("requestErrorMessage")));
 		}
@@ -5222,7 +5566,8 @@ const createServer = (config) => {
 			requestId: c.get("requestId"),
 			error
 		});
-		return c.json({ error: { message: "Internal server error" } }, 500);
+		c.get("requestTrace")?.recordFailure("internal-error");
+		return c.json({ error: { message: `Internal server error (request_id=${c.get("requestId")})` } }, 500);
 	});
 	app.get("/", (c) => c.json({
 		name: "copilot-relay",
@@ -5279,9 +5624,34 @@ const httpCategory = (status$1) => {
 	if (status$1 === 504) return "upstream-timeout-or-HTTP-504";
 	return `HTTP-${status$1}`;
 };
+const settleDiagnostic = async (trace) => {
+	let timer;
+	const deadline = new Promise((resolve$1) => {
+		timer = setTimeout(resolve$1, 1e3);
+	});
+	try {
+		await Promise.race([trace.finished, deadline]);
+	} finally {
+		clearTimeout(timer);
+	}
+};
+const failureFromEvidence = (row, diagnostic) => {
+	if ([
+		"probe-timeout",
+		"cancelled",
+		"total-deadline"
+	].includes(row.detail)) return row.detail;
+	if (diagnostic.refreshes.includes("failure")) return "refresh-failed";
+	if (diagnostic.failure === "invalid-tool-input" || diagnostic.failure === "local-validation") return diagnostic.failure;
+	const lastExchange = diagnostic.exchanges.findLast((exchange) => !exchange.discarded);
+	if (lastExchange?.error && ["HTTP-500", "network-or-invalid-response"].includes(row.detail)) return lastExchange.error === "SyntaxError" ? "malformed-response" : "transport-error";
+	if (diagnostic.failure === "internal-error" || row.detail === "network-or-invalid-response") return "unknown-error";
+	return row.detail;
+};
 async function probeModels(config, entries, options) {
-	console.log("\nDeep availability checks — isolated relay pipeline; not running-daemon health");
-	console.log(`Real inference usage: up to ${entries.length} sequential probes, ${options.maxTokens} output tokens each (bounded client retries may add calls).`);
+	console.log(`\nModel check · ${entries.length} ${entries.length === 1 ? "model" : "models"} · real Copilot usage`);
+	console.log("Isolated relay pipeline; not running-daemon health.");
+	console.log(`Up to ${options.maxTokens} output tokens/probe; existing retries may add calls.\n`);
 	const controller = new AbortController();
 	const interrupt = () => controller.abort();
 	process.on("SIGINT", interrupt);
@@ -5294,21 +5664,14 @@ async function probeModels(config, entries, options) {
 	};
 	const results = [];
 	const app = createServer(config);
-	const width = entries.reduce((width$1, [id]) => Math.max(width$1, safeId(id, config.copilotToken) ? id.length : 16), 5);
-	const reportWidth = width * 2 + 6;
-	console.log(`${"MODEL".padEnd(width)}  STATUS      ${"SENT/REPORTED".padEnd(reportWidth)}  LATENCY   DETAILS`);
+	const columns = Math.max(40, process.stdout.columns || 80);
+	const width = probeColumnWidth(entries.map(([id]) => safeId(id, config.copilotToken) ? id : "[unsupported ID]"), columns);
+	const color = colorEnabled();
+	if (entries.length) console.log(renderProbeHeader(width));
 	try {
 		runtimeState.modelCatalog = config.modelCatalog;
 		runtimeState.upstreamBaseUrl = config.copilotBaseUrl;
 		for (const [id, model] of entries) {
-			const row = {
-				id,
-				status: "NOT_TESTED",
-				reported: "-",
-				sent: false,
-				latency: 0,
-				detail: ""
-			};
 			const efforts = [
 				"none",
 				"low",
@@ -5321,6 +5684,18 @@ async function probeModels(config, entries, options) {
 			const maxTokens = Math.min(options.maxTokens, model.limits?.max_output_tokens ?? options.maxTokens, model.limits?.max_non_streaming_output_tokens ?? options.maxTokens);
 			const timeoutMs = Math.min(options.timeoutMs, config.upstreamTimeoutMs > 0 ? config.upstreamTimeoutMs : Infinity);
 			const endpoint = shouldUseNativeMessages(config, id) ? "/v1/messages" : shouldUseResponsesApiForModel(id) ? "/responses" : "/chat/completions";
+			const row = {
+				id: safeId(id, config.copilotToken) ? id : "[unsupported ID]",
+				status: "NOT_TESTED",
+				reported: "-",
+				sent: false,
+				endpoint,
+				latency: 0,
+				detail: "",
+				maxTokens,
+				effort,
+				unverified: model.reasoningEfforts === void 0 || model.supportedEndpoints === void 0
+			};
 			if (controller.signal.aborted || total.aborted) row.detail = controller.signal.aborted ? "cancelled" : "total-deadline";
 			else if (!safeId(id, config.copilotToken) || normalizeCopilotModelId(id) !== id) {
 				row.status = "SKIPPED";
@@ -5346,23 +5721,33 @@ async function probeModels(config, entries, options) {
 				};
 				const started = performance.now();
 				row.sent = true;
+				let trace;
+				let completedFetch = false;
 				try {
-					const response = await withoutLogging(() => app.fetch(new Request(`http://localhost${config.port ? `:${config.port}` : ""}/v1/messages`, {
-						method: "POST",
-						headers: { "content-type": "application/json" },
-						signal,
-						body: JSON.stringify({
-							model: id,
-							stream: false,
-							max_tokens: maxTokens,
-							output_config: { effort },
-							messages: [{
-								role: "user",
-								content: "Reply with OK only."
-							}]
-						})
-					})));
-					const body = await response.json().catch(() => void 0);
+					const { response, body } = await withoutLogging(() => withTraceObserver((value) => {
+						trace = value;
+					}, async () => {
+						const response$1 = await app.fetch(new Request(`http://localhost${config.port ? `:${config.port}` : ""}/v1/messages`, {
+							method: "POST",
+							headers: { "content-type": "application/json" },
+							signal,
+							body: JSON.stringify({
+								model: id,
+								stream: false,
+								max_tokens: maxTokens,
+								output_config: { effort },
+								messages: [{
+									role: "user",
+									content: "Reply with OK only."
+								}]
+							})
+						}));
+						return {
+							response: response$1,
+							body: await response$1.json().catch(() => void 0)
+						};
+					}));
+					completedFetch = true;
 					row.status = "FAIL";
 					if (signal.aborted) {
 						row.status = controller.signal.aborted || total.aborted ? "NOT_TESTED" : "FAIL";
@@ -5385,7 +5770,7 @@ async function probeModels(config, entries, options) {
 							row.status = "INCOMPLETE";
 							const tokens = record$1(body.usage) ? body.usage.output_tokens : void 0;
 							row.detail = typeof tokens === "number" && Number.isSafeInteger(tokens) && tokens > 0 ? "reachable-output-budget-exhausted" : "output-budget-exhausted-usage-unreported";
-						} else if (body.stop_reason !== "end_turn" || body.content.some((part) => record$1(part) && part.type !== "text" && part.type !== "thinking")) row.detail = "refusal-or-unexpected-completion";
+						} else if (body.stop_reason !== "end_turn" || body.content.some((part) => record$1(part) && part.type !== "text" && part.type !== "thinking")) row.detail = body.stop_reason === "refusal" ? "refusal" : "refusal-or-unexpected-completion";
 						else if (body.content.some((part) => record$1(part) && part.type === "text" && typeof part.text === "string" && part.text.trim())) {
 							row.status = "PASS";
 							row.detail = "completed-text";
@@ -5396,11 +5781,19 @@ async function probeModels(config, entries, options) {
 					row.detail = controller.signal.aborted ? "cancelled" : total.aborted ? "total-deadline" : signal.aborted ? "probe-timeout" : "network-or-invalid-response";
 				}
 				row.latency = Math.round(performance.now() - started);
+				if (trace) {
+					if (completedFetch) await settleDiagnostic(trace);
+					row.diagnostic = trace.diagnosticSnapshot();
+					if (row.reported !== "-" && !row.diagnostic.reportedModel) row.reported = "unreported";
+					if (row.status === "FAIL") row.detail = failureFromEvidence(row, row.diagnostic);
+				}
 			}
-			row.detail += ` tokens=${maxTokens} effort=${effort}${model.reasoningEfforts === void 0 ? "(unverified)" : ""}${model.supportedEndpoints === void 0 ? " endpoints=unverified" : ""}`;
+			if (!safeId(id, config.copilotToken)) row.id = "[unsupported ID]";
 			results.push(row);
-			const displayId = safeId(id, config.copilotToken) ? id : "[unsupported ID]";
-			console.log(scrubSensitiveUrls(`${displayId.padEnd(width)}  ${row.status.padEnd(10)}  ${(row.sent ? `${id}/${row.reported}` : "-/-").padEnd(reportWidth)}  ${`${row.latency}ms`.padEnd(8)}  ${row.detail}`));
+			for (const line of renderProbeRow(row, width, color, columns)) console.log(scrubSensitiveUrls(line));
+			if (options.details) for (const line of renderProbeDetails(row, row.diagnostic)) console.log(line);
+			else if (row.status !== "PASS" && row.diagnostic) console.log(`  request_id=${row.diagnostic.requestId}`);
+			if (row.status !== "PASS" && row.sent) withoutConsoleLogging(() => log.info(`request_id=${row.diagnostic?.requestId ?? "unknown"} model_probe model=${row.id} status=${row.status} reason=${row.detail}`));
 		}
 	} finally {
 		for (const key of [
@@ -5414,9 +5807,11 @@ async function probeModels(config, entries, options) {
 		process.off("SIGINT", interrupt);
 		process.off("SIGTERM", interrupt);
 	}
-	const count = (status$1) => results.filter((row) => row.status === status$1).length;
-	console.log(`\nSummary: ${count("PASS")} passed, ${count("FAIL")} failed, ${count("INCOMPLETE")} incomplete, ${count("SKIPPED")} skipped, ${count("NOT_TESTED")} not tested`);
-	console.log("PASS means completed text from the reported model, not tool/effort coverage or running-daemon health.");
+	console.log(`\n${renderProbeSummary(results)}`);
+	if (results.some((row) => row.unverified)) console.log("* Effort or endpoint metadata is unverified.");
+	const hints = new Set(results.filter((row) => row.status !== "PASS").map((row) => probeHint(row.detail)).filter(Boolean));
+	for (const hint of hints) console.log(hint);
+	if (!options.details && results.some((row) => row.status !== "PASS" && row.sent)) console.log("Use --details for request evidence; another deep run consumes usage.");
 	return controller.signal.aborted ? 130 : results.length > 0 && results.every((row) => row.status === "PASS") ? 0 : 2;
 }
 
@@ -5432,6 +5827,10 @@ const models = defineCommand({
 			type: "boolean",
 			description: "Send real inference probes through an isolated relay pipeline; consumes Copilot usage."
 		},
+		details: {
+			type: "boolean",
+			description: "Show safe request, route and replay evidence for each probe (requires --deep)."
+		},
 		model: {
 			type: "string",
 			description: "Test only this exact upstream ID (requires --deep)."
@@ -5462,29 +5861,36 @@ const models = defineCommand({
 				if (!/^\d+$/.test(value) || !Number.isSafeInteger(number) || number <= 0 || number > 2147483) throw new Error("invalid option");
 				return number;
 			};
-			if (!args.deep && [
+			if (!args.deep && (args.details || [
 				args.model,
 				args.effort,
 				args["max-tokens"],
 				args.timeout,
 				args["total-timeout"]
-			].some((value) => value !== void 0)) throw new Error("deep required");
+			].some((value) => value !== void 0))) throw new Error("deep required");
 			if (args.effort !== void 0 && !isReasoningEffort(args.effort)) throw new Error("invalid effort");
 			const probeOptions = {
 				maxTokens: positive(args["max-tokens"], 4096),
 				timeoutMs: positive(args.timeout, 30) * 1e3,
 				totalTimeoutMs: positive(args["total-timeout"], 300) * 1e3,
-				effort: args.effort
+				effort: args.effort,
+				details: Boolean(args.details)
 			};
-			failure = "Could not load relay configuration";
-			const appConfig = await readAppConfig();
-			setLogLevel(appConfig.logLevel);
-			registerSensitiveOrigin(appConfig.copilotBaseUrl);
-			const config = readProxyConfig(appConfig);
-			failure = "Could not authenticate with GitHub Copilot";
-			await setupProxyAuth(config);
-			failure = "Could not fetch upstream model catalog";
-			const catalog = await loadCopilotModelCatalog(config);
+			const prepare = async () => {
+				failure = "Could not load relay configuration";
+				const appConfig = await readAppConfig();
+				setLogLevel(appConfig.logLevel);
+				registerSensitiveOrigin(appConfig.copilotBaseUrl);
+				const config$1 = readProxyConfig(appConfig);
+				failure = "Could not authenticate with GitHub Copilot";
+				await setupProxyAuth(config$1, args.deep ? { onDeviceCode: (url, code) => console.error(`Sign in: open ${terminalText(url)} and enter ${terminalText(code)}.`) } : void 0);
+				failure = "Could not fetch upstream model catalog";
+				return {
+					config: config$1,
+					catalog: await loadCopilotModelCatalog(config$1)
+				};
+			};
+			const { config, catalog } = args.deep ? await withoutConsoleLogging(prepare) : await prepare();
 			if (args.deep) {
 				failure = "Selected model is not advertised by upstream";
 				if (args.model !== void 0 && !catalog.models.has(args.model)) throw new Error("unknown model");
@@ -5504,6 +5910,8 @@ const models = defineCommand({
 			}
 			log.error(`${failure}: ${detail}`);
 			process.exitCode = 1;
+		} finally {
+			await flushLogs();
 		}
 	}
 });
@@ -5977,6 +6385,7 @@ const replayCapture = async (target) => {
 			return operation;
 		};
 		await withoutLogging(() => withRuntimeState(runtime, () => withRecordedTransport({
+			requestId: manifest.requestId,
 			fetch: async (request) => {
 				const operation = take("fetch");
 				if (operation.kind !== "fetch") throw new Error("Unrecorded replay attempt");
@@ -6104,23 +6513,45 @@ const commandArgs = (command) => {
 	if (tokens.join(" ") !== command.trim().replace(/\s+(?=(?:[^"']*["'][^"']*["'])*[^"']*$)/g, " ")) return [];
 	return tokens.map((token) => token.replace(/^(["'])(.*)\1$/, "$2").replaceAll("\\", "/"));
 };
-const isRelayStartProcess = (command, cwd) => {
-	const args = commandArgs(command);
-	const executable = posix.basename(args[0] ?? "");
-	const isDaemonCommand = (value) => value === "start" || value === "restart";
-	if (/^copilot-relay(?:\.cmd|\.exe)?$/i.test(executable)) return isDaemonCommand(args[1]);
-	if (!/^node(?:\.exe)?$/i.test(executable)) return false;
+const isDaemonCommand = (value) => value === "start" || value === "restart";
+const nodeDaemonEntry = (args) => {
+	if (!/^node(?:\.exe)?$/i.test(posix.basename(args[0] ?? ""))) return void 0;
 	let index = 1;
 	if (args[index] === "--import" && args[index + 1] === "tsx") index += 2;
 	else if (args[index] === "--import=tsx") index++;
 	const entry = args[index];
-	if (!entry || !isDaemonCommand(args[index + 1])) return false;
-	if (posix.basename(entry) === "copilot-relay") return true;
+	return entry && isDaemonCommand(args[index + 1]) ? entry : void 0;
+};
+const resolveEntry = (entry, cwd) => {
 	const normalizedCwd = cwd?.replaceAll("\\", "/");
 	const absolute = posix.isAbsolute(entry) || /^[A-Za-z]:\//.test(entry);
-	if (!absolute && !normalizedCwd) return false;
-	const resolved = posix.normalize(absolute ? entry : `${normalizedCwd}/${entry}`);
-	return /(?:^|\/)copilot-relay(?:-[A-Za-z0-9._-]+)?\/(?:dist\/main\.js|src\/main\.ts)$/.test(resolved);
+	if (!absolute && !normalizedCwd) return void 0;
+	return posix.normalize(absolute ? entry : `${normalizedCwd}/${entry}`);
+};
+const isRelayStartProcess = (command, cwd) => {
+	const args = commandArgs(command);
+	if (/^copilot-relay(?:\.cmd|\.exe)?$/i.test(posix.basename(args[0] ?? ""))) return isDaemonCommand(args[1]);
+	const entry = nodeDaemonEntry(args);
+	if (!entry) return false;
+	if (posix.basename(entry) === "copilot-relay") return true;
+	const resolved = resolveEntry(entry, cwd);
+	return resolved !== void 0 && /(?:^|\/)copilot-relay(?:-[A-Za-z0-9._-]+)?\/(?:dist\/main\.js|src\/main\.ts)$/.test(resolved);
+};
+const packagedEntryCandidate = (command, cwd) => {
+	const entry = nodeDaemonEntry(commandArgs(command));
+	const resolved = entry === void 0 ? void 0 : resolveEntry(entry, cwd);
+	return resolved && /\/(?:dist\/main\.js|src\/main\.ts)$/.test(resolved) ? resolved : void 0;
+};
+const packageEntryProof = async (entry) => {
+	try {
+		if (!(await fs.stat(entry)).isFile()) return "nonrelay";
+		const canonical = (await fs.realpath(entry)).replaceAll("\\", "/");
+		if (!/\/(?:dist\/main\.js|src\/main\.ts)$/.test(canonical)) return "nonrelay";
+		const manifest = JSON.parse(await fs.readFile(posix.join(posix.dirname(posix.dirname(canonical)), "package.json"), "utf8"));
+		return typeof manifest === "object" && manifest !== null && "name" in manifest && manifest.name === "copilot-relay" ? "relay" : "nonrelay";
+	} catch {
+		return "nonrelay";
+	}
 };
 var RelayInspectionError = class extends Error {
 	constructor(pid) {
@@ -6154,6 +6585,8 @@ const flatInvocation = (command) => {
 };
 const verifyCommand = async (command, cwd) => {
 	if (isRelayStartProcess(command, cwd)) return "relay";
+	const packaged = packagedEntryCandidate(command, cwd);
+	if (packaged && await packageEntryProof(packaged) === "relay") return "relay";
 	const flat = flatInvocation(command);
 	if (!flat) return "nonrelay";
 	if (!cwd) return "unknown";
@@ -6204,16 +6637,6 @@ const processState = (pid) => {
 	}
 };
 const isProcessAlive = (pid) => processState(pid) !== "gone";
-/**
-* Full pid-file record, for callers that need the listening address or start
-* time rather than just the pid.
-*
-* Deliberately tolerant: a corrupt or half-written pid file yields undefined
-* rather than throwing, because `status` must be able to report "not running"
-* instead of crashing on a file the user may have been mid-edit on.
-*
-* Returns undefined for the legacy bare-pid format, which carries no address.
-*/
 const readRelayPidFileEntry = async () => {
 	try {
 		const trimmed = (await fs.readFile(paths.pidPath, "utf8")).trim();
@@ -6416,7 +6839,7 @@ const findRelayProcesses = async (config, snapshot) => {
 	if (typeof config.port === "number" && Number.isInteger(config.port) && config.port > 0 && config.port <= 65535) for (const pid of await getPortListenerPids(config.port)) candidates.add(pid);
 	for (const { command, pid } of await getProcessList()) {
 		if (pid === process.pid) continue;
-		if (isRelayStartProcess(command) || flatInvocation(command) || isRelayStartProcess(command, "/copilot-relay")) candidates.add(pid);
+		if (isRelayStartProcess(command) || flatInvocation(command) || isRelayStartProcess(command, "/copilot-relay") || packagedEntryCandidate(command)) candidates.add(pid);
 	}
 	const relays = [];
 	for (const pid of candidates) {
@@ -6865,20 +7288,20 @@ const renderConfig = (config, running) => {
 * Pure state-to-lines mapping, kept free of IO so it can be tested directly
 * without spawning a relay or opening a socket.
 */
-const renderStatus = (status$1) => {
+const renderStatus = (status$1, color = false) => {
 	const lines = [`copilot-relay ${status$1.version}`];
 	if (!status$1.running) {
-		lines.push("  process    not running", `  log        ${status$1.logPath}`, `  config     ${status$1.configPath}`, ...renderConfig(status$1.config, false), "", "  Start it with: copilot-relay start");
+		lines.push(`  process    ${colorText("not running", "warning", color)}`, `  log        ${status$1.logPath}`, `  config     ${status$1.configPath}`, ...renderConfig(status$1.config, false), "", "  Start it with: copilot-relay start");
 		return lines;
 	}
-	lines.push(`  process    running (pid ${status$1.pid}, up ${formatUptime(status$1.startedAt)})`);
-	lines.push(status$1.daemonVersion === void 0 ? "  version    unknown (daemon predates version reporting — restart to report it)" : hasVersionMismatch(status$1) ? `  version    ${status$1.daemonVersion} — MISMATCH, ${status$1.version} is installed` : `  version    ${status$1.daemonVersion}`);
+	lines.push(`  process    ${colorText("running", "good", color)} (pid ${status$1.pid}, up ${formatUptime(status$1.startedAt)})`);
+	lines.push(status$1.daemonVersion === void 0 ? `  version    ${colorText("unknown", "muted", color)} (daemon predates version reporting — restart to report it)` : hasVersionMismatch(status$1) ? `  version    ${status$1.daemonVersion} — ${colorText("MISMATCH", "warning", color)}, ${status$1.version} is installed` : `  version    ${status$1.daemonVersion}`);
 	lines.push(`  listening  ${status$1.baseUrl}`);
 	const health = status$1.health;
-	lines.push(health?.ok ? `  health     ok (${health.ms}ms)` : `  health     FAILED${health?.detail ? ` — ${health.detail}` : ""}`);
-	lines.push(status$1.models?.length ? `  models     ${status$1.models.join(", ")}` : "  models     unavailable");
-	if (status$1.deep) lines.push(status$1.deep.ok ? `  upstream   ok (${status$1.deep.ms}ms) — ${status$1.deep.detail ?? "end-to-end Copilot round trip"}` : `  upstream   FAILED${status$1.deep.detail ? ` — ${status$1.deep.detail}` : ""}`);
-	else lines.push("  upstream   not checked (use --deep)");
+	lines.push(health?.ok ? `  health     ${colorText("ok", "good", color)} (${health.ms}ms)` : `  health     ${colorText("FAILED", "bad", color)}${health?.detail ? ` — ${health.detail}` : ""}`);
+	lines.push(status$1.models?.length ? `  models     ${status$1.models.join(", ")}` : `  models     ${colorText("unavailable", "warning", color)}`);
+	if (status$1.deep) lines.push(status$1.deep.ok ? `  upstream   ${colorText("ok", "good", color)} (${status$1.deep.ms}ms) — ${status$1.deep.detail ?? "end-to-end Copilot round trip"}` : `  upstream   ${colorText("FAILED", "bad", color)}${status$1.deep.detail ? ` — ${status$1.deep.detail}` : ""}`);
+	else lines.push(`  upstream   ${colorText("not checked", "muted", color)} (use --deep)`);
 	lines.push(`  log        ${status$1.logPath}`, `  config     ${status$1.configPath}`, ...renderConfig(status$1.config, true));
 	if (status$1.health?.ok && status$1.deep && !status$1.deep.ok) lines.push("", "  The relay is listening but cannot reach Copilot.", "  Try: copilot-relay auth");
 	if (hasVersionMismatch(status$1)) lines.push("", `  The running relay is ${status$1.daemonVersion}; ${status$1.version} is installed.`, "  Restart it to serve the installed version: copilot-relay restart");
@@ -7060,7 +7483,7 @@ const status = defineCommand({
 			return;
 		}
 		if (args.json) console.log(scrubSensitiveUrls(JSON.stringify(result, null, 2)));
-		else console.log(scrubSensitiveUrls(renderStatus(result).join("\n")));
+		else console.log(scrubSensitiveUrls(renderStatus(result, colorEnabled()).join("\n")));
 		process.exitCode = resolveExitCode(result);
 	}
 });