devinfra-bridge 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/index.js

@@ -184,6 +184,8 @@ var BytedcliProvider = class {
   controller = new AbortController();
   pending;
   cached;
+  latestJwt;
+  recovery;
   timeoutMs;
   outputBytes;
   cacheMs;
@@ -191,24 +193,50 @@ var BytedcliProvider = class {
     if (this.controller.signal.aborted || signal?.aborted) {
       return Promise.reject(new CredentialError("AUTH_CANCELLED"));
     }
+    if (this.pending) return this.wait(this.pending, signal);
     if (this.cached && this.cached.until > Date.now()) return Promise.resolve(this.cached.jwt);
-    if (!this.pending) {
-      this.pending = this.acquire().finally(() => {
-        this.pending = void 0;
-      });
+    return this.wait(this.track(this.acquire()), signal);
+  }
+  refreshJwt(failedJwt, { signal } = {}) {
+    if (this.controller.signal.aborted || signal?.aborted) {
+      return Promise.reject(new CredentialError("AUTH_CANCELLED"));
+    }
+    if (this.latestJwt && this.latestJwt !== failedJwt) {
+      return this.getJwt({ signal });
     }
-    const pending = this.pending;
+    if (this.recovery?.failedJwt === failedJwt) return this.wait(this.recovery.promise, signal);
+    this.cached = void 0;
+    const earlier = this.pending;
+    const recovery = (async () => {
+      await earlier?.catch(() => {
+      });
+      if (this.controller.signal.aborted) throw new CredentialError("AUTH_CANCELLED");
+      if (this.latestJwt && this.latestJwt !== failedJwt) return this.latestJwt;
+      return this.acquire(true);
+    })();
+    this.recovery = { failedJwt, promise: recovery };
+    return this.wait(this.track(recovery), signal);
+  }
+  track(acquisition) {
+    const pending = acquisition.finally(() => {
+      if (this.pending === pending) this.pending = void 0;
+    });
+    this.pending = pending;
+    return pending;
+  }
+  wait(pending, signal) {
     return new Promise((resolve, reject) => {
       const onAbort = () => reject(new CredentialError("AUTH_CANCELLED"));
       signal?.addEventListener("abort", onAbort, { once: true });
       pending.then(resolve, reject).finally(() => signal?.removeEventListener("abort", onAbort));
+      if (signal?.aborted) onAbort();
     });
   }
-  async acquire() {
+  async acquire(forceRefresh = false) {
     const script = [".js", ".mjs", ".cjs"].includes(extname2(this.executable));
     const stdout = await runCredentialCommand(
       script ? process.execPath : this.executable,
-      script ? [this.executable, ...JWT_ARGS] : JWT_ARGS,
+      script ? [this.executable, ...JWT_ARGS, ...forceRefresh ? ["--force-refresh"] : []] : [...JWT_ARGS, ...forceRefresh ? ["--force-refresh"] : []],
       { signal: this.controller.signal, timeoutMs: this.timeoutMs, outputBytes: this.outputBytes }
     );
     let result;
@@ -227,7 +255,8 @@ var BytedcliProvider = class {
       }
     } catch {
     }
-    if (until > Date.now()) this.cached = { jwt, until };
+    this.latestJwt = jwt;
+    this.cached = until > Date.now() ? { jwt, until } : void 0;
     return jwt;
   }
   async close() {
@@ -235,6 +264,8 @@ var BytedcliProvider = class {
     this.controller.abort();
     await this.pending?.catch(() => {
     });
+    this.latestJwt = void 0;
+    this.recovery = void 0;
   }
 };
 
@@ -298,36 +329,6 @@ import { randomUUID } from "node:crypto";
 import { createServer } from "node:http";
 import { Agent } from "node:https";
 
-// src/proxy/forward-messages.ts
-import { request } from "node:https";
-import { pipeline } from "node:stream/promises";
-
-// src/proxy/errors.ts
-var ProxyError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
-    this.status = status;
-    this.code = code;
-  }
-  status;
-  code;
-};
-function sendError(res, error) {
-  if (res.destroyed) return;
-  if (res.headersSent) {
-    res.destroy();
-    return;
-  }
-  const type = error.status === 429 ? "rate_limit_error" : error.status === 413 ? "request_too_large" : error.status >= 500 ? "api_error" : "invalid_request_error";
-  const body = JSON.stringify({ type: "error", error: { type, message: error.message } });
-  res.writeHead(error.status, {
-    "content-type": "application/json",
-    "content-length": Buffer.byteLength(body),
-    connection: "close"
-  });
-  res.end(body);
-}
-
 // src/agents/identity.ts
 var AGENT_IDENTITIES = [
   { id: "cc", client: /^claude-cli(?:\/|\s|$)/i },
@@ -355,6 +356,121 @@ function identifyAgent(headers) {
   return "x";
 }
 
+// src/proxy/forward-model-request.ts
+import { request } from "node:https";
+import { pipeline } from "node:stream/promises";
+
+// src/util/logger.ts
+import {
+  constants as constants3,
+  closeSync,
+  existsSync,
+  lstatSync,
+  openSync,
+  renameSync,
+  unlinkSync,
+  writeSync
+} from "node:fs";
+import { join as join2 } from "node:path";
+var silentLogger = { write() {
+} };
+function safeTraceId(value) {
+  return typeof value === "string" && value.length <= 256 && /^[A-Za-z0-9]/.test(value) && !/[^A-Za-z0-9._:-]/.test(value) ? value : void 0;
+}
+function createLogger(stateRoot, maxBytes = 5 * 1024 * 1024) {
+  const path = join2(stateRoot, "daemon.log");
+  const safeFile = (file) => {
+    const info = lstatSync(file);
+    if (!info.isFile() || info.isSymbolicLink() || process.platform !== "win32" && info.uid !== process.getuid?.())
+      throw new Error();
+    return info;
+  };
+  return {
+    write(record) {
+      try {
+        const line = `${JSON.stringify({
+          time: (/* @__PURE__ */ new Date()).toISOString(),
+          event: record.event,
+          request_id: record.request_id,
+          gateway_logid: safeTraceId(record.gateway_logid),
+          gateway_request_id: safeTraceId(record.gateway_request_id),
+          gateway_x_request_id: safeTraceId(record.gateway_x_request_id),
+          path: record.path,
+          protocol: record.protocol,
+          agent: record.agent,
+          duration_ms: record.duration_ms,
+          status: record.status,
+          exit_code: record.exit_code,
+          code: record.code
+        })}
+`;
+        if (existsSync(path) && safeFile(path).size + Buffer.byteLength(line) > maxBytes) {
+          for (let i = 2; i >= 1; i--) {
+            const from = `${path}.${i}`;
+            const to = `${path}.${i + 1}`;
+            if (existsSync(from)) {
+              safeFile(from);
+              if (existsSync(to)) {
+                safeFile(to);
+                unlinkSync(to);
+              }
+              if (i === 2) unlinkSync(from);
+              else renameSync(from, to);
+            }
+          }
+          renameSync(path, `${path}.1`);
+        }
+        const fd = openSync(
+          path,
+          constants3.O_WRONLY | constants3.O_APPEND | constants3.O_CREAT | constants3.O_NOFOLLOW,
+          384
+        );
+        try {
+          writeSync(fd, line);
+        } finally {
+          closeSync(fd);
+        }
+      } catch {
+      }
+    }
+  };
+}
+
+// src/proxy/errors.ts
+var ProxyError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+};
+function sendError(res, error, protocol = "messages") {
+  if (res.destroyed) return;
+  if (res.headersSent) {
+    res.destroy();
+    return;
+  }
+  const type = error.status === 429 ? "rate_limit_error" : error.status === 413 ? "request_too_large" : error.status >= 500 ? "api_error" : "invalid_request_error";
+  const body = JSON.stringify(
+    protocol === "responses" ? {
+      error: {
+        type: error.status >= 500 ? "server_error" : type,
+        message: error.message,
+        code: error.code,
+        param: null
+      }
+    } : { type: "error", error: { type, message: error.message } }
+  );
+  res.writeHead(error.status, {
+    "content-type": "application/json",
+    "content-length": Buffer.byteLength(body),
+    connection: "close"
+  });
+  res.end(body);
+}
+
 // src/proxy/headers.ts
 var HOP = /* @__PURE__ */ new Set([
   "connection",
@@ -368,14 +484,31 @@ var HOP = /* @__PURE__ */ new Set([
   "proxy-connection"
 ]);
 var REQUEST = /* @__PURE__ */ new Set([
-  "anthropic-version",
-  "anthropic-beta",
   "content-type",
   "accept",
   "accept-encoding",
   "x-request-id",
-  "request-id"
+  "request-id",
+  "user-agent"
+]);
+var REQUEST_MESSAGES = /* @__PURE__ */ new Set(["anthropic-version", "anthropic-beta"]);
+var REQUEST_RESPONSES = /* @__PURE__ */ new Set([
+  "originator",
+  "session-id",
+  "thread-id",
+  "session_id",
+  "conversation_id",
+  "x-client-request-id",
+  "openai-beta",
+  "x-codex-installation-id",
+  "x-codex-turn-state",
+  "x-codex-turn-metadata",
+  "x-codex-parent-thread-id",
+  "x-codex-window-id",
+  "x-codex-beta-features",
+  "x-openai-subagent"
 ]);
+var RESPONSE_RESPONSES = /* @__PURE__ */ new Set(["x-codex-turn-state", "openai-model", "x-reasoning-included"]);
 var RESPONSE = /* @__PURE__ */ new Set([
   "x-tt-logid",
   "content-type",
@@ -391,11 +524,13 @@ function blocked(headers) {
     set.add(name.trim().toLowerCase());
   return set;
 }
-function requestHeaders(incoming, jwt, bytes, agent) {
+function requestHeaders(incoming, jwt, bytes, agent, protocol = "messages") {
   const result = {};
   const deny = blocked(incoming);
+  const native = protocol === "responses" ? REQUEST_RESPONSES : REQUEST_MESSAGES;
   for (const [name, value] of Object.entries(incoming)) {
-    if (REQUEST.has(name) && !deny.has(name) && value !== void 0) result[name] = value;
+    if ((REQUEST.has(name) || native.has(name)) && !deny.has(name) && value !== void 0)
+      result[name] = value;
   }
   result["content-length"] = bytes;
   result["x-identity-token"] = jwt;
@@ -407,17 +542,81 @@ function requestHeaders(incoming, jwt, bytes, agent) {
   result["x-tt-env"] = "ppe_devinfra_bridge";
   return result;
 }
-function responseHeaders(incoming) {
+function responseHeaders(incoming, protocol = "messages") {
   const result = {};
   const deny = blocked(incoming);
   for (const [name, value] of Object.entries(incoming)) {
-    if (!deny.has(name) && value !== void 0 && (RESPONSE.has(name) || /^anthropic-ratelimit-[a-z0-9-]+$/.test(name)))
+    if (!deny.has(name) && value !== void 0 && (RESPONSE.has(name) || (protocol === "messages" ? /^anthropic-ratelimit-[a-z0-9-]+$/.test(name) : RESPONSE_RESPONSES.has(name) || /^x-ratelimit-[a-z0-9-]+$/.test(name) || /^x-codex-(?:primary|secondary)-(?:used-percent|window-minutes|reset-at)$/.test(name))))
       result[name] = value;
   }
   return result;
 }
 
-// src/proxy/forward-messages.ts
+// src/proxy/jwt-expired.ts
+import { Readable } from "node:stream";
+import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
+var ERROR_BYTES = 64 * 1024;
+async function probeJwtExpired(response, idleMs) {
+  const type = String(response.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase();
+  const encoding = String(response.headers["content-encoding"] ?? "identity").toLowerCase();
+  if (type !== "application/json" && !type?.endsWith("+json") || !["identity", "gzip", "deflate", "br"].includes(encoding)) {
+    return { source: response, expired: false };
+  }
+  const iterator = response.iterator({ destroyOnReturn: false });
+  const chunks = [];
+  let bytes = 0;
+  let timer;
+  try {
+    while (true) {
+      timer = setTimeout(
+        () => response.destroy(
+          new ProxyError(504, "UPSTREAM_STREAM_TIMEOUT", "Gateway stream timed out.")
+        ),
+        idleMs
+      );
+      const next = await iterator.next();
+      clearTimeout(timer);
+      if (next.done) break;
+      const chunk = Buffer.isBuffer(next.value) ? next.value : Buffer.from(next.value);
+      chunks.push(chunk);
+      bytes += chunk.length;
+      if (bytes > ERROR_BYTES) {
+        return {
+          expired: false,
+          source: Readable.from(
+            (async function* () {
+              try {
+                yield* chunks;
+                while (true) {
+                  const next2 = await iterator.next();
+                  if (next2.done) break;
+                  yield next2.value;
+                }
+              } finally {
+                await iterator.return?.();
+              }
+            })()
+          )
+        };
+      }
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+  const body = Buffer.concat(chunks);
+  let expired = false;
+  try {
+    const options = { maxOutputLength: ERROR_BYTES };
+    const decoded = encoding === "gzip" ? gunzipSync(body, options) : encoding === "deflate" ? inflateSync(body, options) : encoding === "br" ? brotliDecompressSync(body, options) : encoding === "identity" ? body : void 0;
+    if (!decoded) throw new Error();
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decoded));
+    expired = value?.error?.code === "JWT_EXPIRED";
+  } catch {
+  }
+  return { source: Readable.from([body]), expired };
+}
+
+// src/proxy/forward-model-request.ts
 async function readBody(req, context, signal) {
   const { bodyBytes, bodyIdleMs } = context.limits;
   const length = req.headers["content-length"];
@@ -466,16 +665,8 @@ async function readBody(req, context, signal) {
     if (signal.aborted) onAbort();
   });
 }
-async function forwardMessages(req, res, context, signal, agent, onUpstreamHeaders) {
+async function forwardModelRequest(req, res, context, signal, agent, protocol, onUpstreamHeaders, requestId) {
   const body = await readBody(req, context, signal);
-  try {
-    const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(body);
-    const parsed = JSON.parse(text);
-    if (!parsed || Array.isArray(parsed) || typeof parsed.model !== "string" || !parsed.model.trim())
-      throw new Error();
-  } catch {
-    throw new ProxyError(400, "INVALID_BODY", "Expected a JSON object with a nonempty model.");
-  }
   let jwt;
   try {
     jwt = await context.credentialProvider.getJwt({ signal });
@@ -487,6 +678,53 @@ async function forwardMessages(req, res, context, signal, agent, onUpstreamHeade
     );
   }
   if (signal.aborted) return;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    let nextJwt;
+    const retry = await forwardAttempt(
+      req,
+      res,
+      context,
+      signal,
+      agent,
+      protocol,
+      body,
+      jwt,
+      onUpstreamHeaders,
+      attempt === 0 && context.credentialProvider.refreshJwt ? async (headers) => {
+        const log = (event, code) => context.logger.write({
+          event,
+          request_id: requestId,
+          path: protocol === "messages" ? "/v1/messages" : "/v1/responses",
+          protocol,
+          agent: identifyAgent(req.headers),
+          code,
+          gateway_logid: safeTraceId(headers["x-tt-logid"]),
+          gateway_request_id: safeTraceId(headers["request-id"]),
+          gateway_x_request_id: safeTraceId(headers["x-request-id"])
+        });
+        log("jwt_refresh_started");
+        try {
+          nextJwt = await context.credentialProvider.refreshJwt?.(jwt, { signal });
+          if (signal.aborted) return false;
+          log("jwt_refresh_succeeded");
+          log("query_retry", "JWT_EXPIRED");
+          return true;
+        } catch (error) {
+          if (!signal.aborted)
+            log(
+              "jwt_refresh_failed",
+              error instanceof CredentialError ? error.code : "AUTH_UNAVAILABLE"
+            );
+          return false;
+        }
+      } : void 0
+    );
+    if (!retry || !nextJwt || signal.aborted) return;
+    jwt = nextJwt;
+  }
+}
+async function forwardAttempt(req, res, context, signal, agent, protocol, body, jwt, onUpstreamHeaders, recover) {
+  if (signal.aborted) return false;
   const transfer = new AbortController();
   const abort = () => transfer.abort(signal.reason);
   signal.addEventListener("abort", abort, { once: true });
@@ -494,10 +732,10 @@ async function forwardMessages(req, res, context, signal, agent, onUpstreamHeade
   let idleTimer;
   let cleanupStreamTimer;
   let upstreamResponse;
-  const target = new URL(req.url ?? "/v1/messages", context.config.gatewayOrigin);
+  const target = new URL(req.url ?? "/", context.config.gatewayOrigin);
   const upstream = request(target, {
     method: "POST",
-    headers: requestHeaders(req.headers, jwt, body.length, agent),
+    headers: requestHeaders(req.headers, jwt, body.length, agent, protocol),
     agent: context.httpsAgent,
     signal: transfer.signal
   });
@@ -520,6 +758,14 @@ async function forwardMessages(req, res, context, signal, agent, onUpstreamHeade
       response.destroy();
       throw new ProxyError(502, "UPSTREAM_REDIRECT", "Gateway redirection is not supported.");
     }
+    let source = response;
+    if (response.statusCode === 401 && recover) {
+      const inspected = await probeJwtExpired(response, context.limits.streamIdleMs);
+      if (signal.aborted) return false;
+      if (inspected.expired && await recover(response.headers)) return true;
+      if (signal.aborted) return false;
+      source = inspected.source;
+    }
     let backpressured = false;
     let streamEnded = false;
     const resetIdle = () => {
@@ -546,25 +792,26 @@ async function forwardMessages(req, res, context, signal, agent, onUpstreamHeade
       streamEnded = true;
       clearTimeout(idleTimer);
     };
-    response.on("pause", onPause);
-    response.on("resume", onResume);
-    response.once("end", onEnd);
-    response.on("data", resetIdle);
+    source.on("pause", onPause);
+    source.on("resume", onResume);
+    source.once("end", onEnd);
+    source.on("data", resetIdle);
     cleanupStreamTimer = () => {
       clearTimeout(idleTimer);
-      response.off("pause", onPause);
-      response.off("resume", onResume);
-      response.off("end", onEnd);
-      response.off("data", resetIdle);
+      source.off("pause", onPause);
+      source.off("resume", onResume);
+      source.off("end", onEnd);
+      source.off("data", resetIdle);
     };
     resetIdle();
-    res.writeHead(response.statusCode ?? 502, responseHeaders(response.headers));
+    res.writeHead(response.statusCode ?? 502, responseHeaders(response.headers, protocol));
     res.flushHeaders();
-    await pipeline(response, res, { signal: transfer.signal });
+    await pipeline(source, res, { signal: transfer.signal });
+    return false;
   } catch (error) {
     if (transfer.signal.reason instanceof ProxyError) throw transfer.signal.reason;
     if (error instanceof ProxyError) throw error;
-    if (signal.aborted) return;
+    if (signal.aborted) return false;
     throw new ProxyError(502, "UPSTREAM_CONNECTION", "Gateway connection failed.");
   } finally {
     clearTimeout(headerTimer);
@@ -578,82 +825,24 @@ async function forwardMessages(req, res, context, signal, agent, onUpstreamHeade
 
 // src/agents/registry.ts
 var AGENT_ROUTES = Object.freeze([
-  { agent: "claude-code", path: "/v1/messages", method: "POST", forward: forwardMessages }
+  {
+    agent: "claude-code",
+    protocol: "messages",
+    path: "/v1/messages",
+    method: "POST",
+    allowedQueries: ["", "?beta=true"],
+    forward: forwardModelRequest
+  },
+  {
+    agent: "codex",
+    protocol: "responses",
+    path: "/v1/responses",
+    method: "POST",
+    allowedQueries: [""],
+    forward: forwardModelRequest
+  }
 ]);
 
-// src/util/logger.ts
-import {
-  constants as constants3,
-  closeSync,
-  existsSync,
-  lstatSync,
-  openSync,
-  renameSync,
-  unlinkSync,
-  writeSync
-} from "node:fs";
-import { join as join2 } from "node:path";
-var silentLogger = { write() {
-} };
-function safeTraceId(value) {
-  return typeof value === "string" && value.length <= 256 && /^[A-Za-z0-9]/.test(value) && !/[^A-Za-z0-9._:-]/.test(value) ? value : void 0;
-}
-function createLogger(stateRoot, maxBytes = 5 * 1024 * 1024) {
-  const path = join2(stateRoot, "daemon.log");
-  const safeFile = (file) => {
-    const info = lstatSync(file);
-    if (!info.isFile() || info.isSymbolicLink() || process.platform !== "win32" && info.uid !== process.getuid?.())
-      throw new Error();
-    return info;
-  };
-  return {
-    write(record) {
-      try {
-        const line = `${JSON.stringify({
-          time: (/* @__PURE__ */ new Date()).toISOString(),
-          event: record.event,
-          request_id: record.request_id,
-          gateway_logid: safeTraceId(record.gateway_logid),
-          gateway_request_id: safeTraceId(record.gateway_request_id),
-          gateway_x_request_id: safeTraceId(record.gateway_x_request_id),
-          path: record.path,
-          duration_ms: record.duration_ms,
-          status: record.status,
-          code: record.code
-        })}
-`;
-        if (existsSync(path) && safeFile(path).size + Buffer.byteLength(line) > maxBytes) {
-          for (let i = 2; i >= 1; i--) {
-            const from = `${path}.${i}`;
-            const to = `${path}.${i + 1}`;
-            if (existsSync(from)) {
-              safeFile(from);
-              if (existsSync(to)) {
-                safeFile(to);
-                unlinkSync(to);
-              }
-              if (i === 2) unlinkSync(from);
-              else renameSync(from, to);
-            }
-          }
-          renameSync(path, `${path}.1`);
-        }
-        const fd = openSync(
-          path,
-          constants3.O_WRONLY | constants3.O_APPEND | constants3.O_CREAT | constants3.O_NOFOLLOW,
-          384
-        );
-        try {
-          writeSync(fd, line);
-        } finally {
-          closeSync(fd);
-        }
-      } catch {
-      }
-    }
-  };
-}
-
 // src/proxy/server.ts
 function createProxyContext(config, credentialProvider, options = {}) {
   return {
@@ -671,28 +860,19 @@ function createProxyHandler(context) {
     void (async () => {
       const raw = req.url ?? "";
       const route = AGENT_ROUTES.find((item) => item.path === raw.split("?")[0]);
-      if (!route)
-        return sendError(res, new ProxyError(404, "UNKNOWN_ROUTE", "Route is not supported."));
+      const protocol = route?.protocol ?? (raw.split("?")[0]?.startsWith("/v1/responses") ? "responses" : "messages");
+      const fail2 = (error) => sendError(res, error, protocol);
+      if (!route) return fail2(new ProxyError(404, "UNKNOWN_ROUTE", "Route is not supported."));
       if (req.method !== route.method) {
         res.setHeader("allow", route.method);
-        return sendError(
-          res,
-          new ProxyError(405, "METHOD_NOT_ALLOWED", "Method is not supported.")
-        );
+        return fail2(new ProxyError(405, "METHOD_NOT_ALLOWED", "Method is not supported."));
       }
-      if (raw !== route.path && raw !== `${route.path}?beta=true`) {
-        return sendError(
-          res,
-          new ProxyError(400, "INVALID_QUERY", "Query parameters are not supported.")
-        );
+      if (!route.allowedQueries.some((query) => raw === `${route.path}${query}`)) {
+        return fail2(new ProxyError(400, "INVALID_QUERY", "Query parameters are not supported."));
       }
-      if (context.closing)
-        return sendError(res, new ProxyError(503, "SHUTTING_DOWN", "Daemon is stopping."));
+      if (context.closing) return fail2(new ProxyError(503, "SHUTTING_DOWN", "Daemon is stopping."));
       if (context.active.size >= context.limits.concurrency) {
-        return sendError(
-          res,
-          new ProxyError(429, "CONCURRENCY_LIMIT", "Too many active requests.")
-        );
+        return fail2(new ProxyError(429, "CONCURRENCY_LIMIT", "Too many active requests."));
       }
       const controller = new AbortController();
       context.active.add(controller);
@@ -707,13 +887,22 @@ function createProxyHandler(context) {
       req.once("aborted", onAbort);
       res.once("close", onClose);
       try {
-        await route.forward(req, res, context, controller.signal, route.agent, (headers) => {
-          upstreamHeaders = headers;
-        });
+        await route.forward(
+          req,
+          res,
+          context,
+          controller.signal,
+          route.agent,
+          route.protocol,
+          (headers) => {
+            upstreamHeaders = headers;
+          },
+          requestId
+        );
       } catch (error) {
         const failure = error instanceof ProxyError ? error : new ProxyError(502, "PROXY_FAILURE", "Request forwarding failed.");
         code = failure.code;
-        sendError(res, failure);
+        fail2(failure);
       } finally {
         req.off("aborted", onAbort);
         res.off("close", onClose);
@@ -724,7 +913,9 @@ function createProxyHandler(context) {
           gateway_logid: safeTraceId(upstreamHeaders?.["x-tt-logid"]),
           gateway_request_id: safeTraceId(upstreamHeaders?.["request-id"]),
           gateway_x_request_id: safeTraceId(upstreamHeaders?.["x-request-id"]),
-          path: "/v1/messages",
+          path: route.path,
+          protocol: route.protocol,
+          agent: identifyAgent(req.headers),
           duration_ms: Date.now() - started,
           status: res.statusCode,
           code
@@ -771,29 +962,175 @@ async function prepareStateRoot(path) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.0-alpha.2" : "0.1.0-dev";
+var VERSION = true ? "0.1.0-alpha.4" : "0.1.0-dev";
+
+// src/daemon/auto-sync.ts
+import { spawn as spawn2 } from "node:child_process";
+import { lstat as lstat2, readFile as readFile2, stat as stat2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, join as join3 } from "node:path";
+var AUTO_SYNC_STARTUP_MS = 3e4;
+var AUTO_SYNC_INTERVAL_MS = 6e5;
+var AUTO_SYNC_TIMEOUT_MS = 12e4;
+var SYNC_ARGS = ["sync", "--yes", "--non-interactive"];
+async function registration(stateRoot) {
+  const path = join3(stateRoot, "auto-sync.json");
+  try {
+    const info = await lstat2(path);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 16 * 1024 || process.platform !== "win32" && (info.uid !== process.getuid?.() || (info.mode & 18) !== 0)) {
+      throw new Error("Invalid auto-sync registration");
+    }
+    const value = JSON.parse(await readFile2(path, "utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error("Invalid registration");
+    const config = value;
+    if (config.enabled !== void 0 && typeof config.enabled !== "boolean")
+      throw new Error("Invalid enabled");
+    if (config.claude_config_dir !== void 0 && (typeof config.claude_config_dir !== "string" || !isAbsolute2(config.claude_config_dir) || config.claude_config_dir.includes("\0")))
+      throw new Error("Invalid directory");
+    return config;
+  } catch (error) {
+    if (error.code === "ENOENT") return {};
+    throw error;
+  }
+}
+function terminate(child, force) {
+  if (!child.pid) return;
+  if (process.platform === "win32") {
+    const killer = spawn2("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
+      shell: false,
+      windowsHide: true,
+      stdio: "ignore"
+    });
+    killer.on("error", () => child.kill("SIGKILL"));
+    return;
+  }
+  try {
+    process.kill(-child.pid, force ? "SIGKILL" : "SIGTERM");
+  } catch {
+  }
+}
+async function runAutoSync(stateRoot, logger, options) {
+  const started = Date.now();
+  let config;
+  try {
+    config = await registration(stateRoot);
+  } catch {
+    logger.write({ event: "auto_sync_failed", code: "AUTO_SYNC_CONFIG_INVALID" });
+    return;
+  }
+  if (config.enabled === false || options.signal.aborted) return;
+  let useEntry = false;
+  if (typeof config.cli_entry === "string" && isAbsolute2(config.cli_entry) && !config.cli_entry.includes("\0")) {
+    useEntry = await stat2(config.cli_entry).then(
+      (info) => info.isFile(),
+      () => false
+    );
+  }
+  if (options.signal.aborted) return;
+  if (!useEntry) logger.write({ event: "auto_sync_fallback", code: "CLI_ENTRY_UNAVAILABLE" });
+  const env = {
+    ...options.env ?? process.env,
+    DEVINFRA_BRIDGE_STATE_ROOT: stateRoot
+  };
+  if (config.claude_config_dir) env.CLAUDE_CONFIG_DIR = config.claude_config_dir;
+  const command = useEntry ? process.execPath : "devinfra-bridge-cli";
+  const args = useEntry ? [config.cli_entry, ...SYNC_ARGS] : SYNC_ARGS;
+  logger.write({ event: "auto_sync_started" });
+  await new Promise((resolve) => {
+    const child = spawn2(command, args, {
+      shell: false,
+      windowsHide: true,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"],
+      env
+    });
+    child.stdout.resume();
+    child.stderr.resume();
+    let reason;
+    let killTimer;
+    const stop = (code) => {
+      if (reason) return;
+      reason = code;
+      terminate(child, false);
+      killTimer = setTimeout(() => terminate(child, true), options.killGraceMs ?? 1e3);
+    };
+    const onAbort = () => stop("AUTO_SYNC_CANCELLED");
+    options.signal.addEventListener("abort", onAbort, { once: true });
+    const timer = setTimeout(
+      () => stop("AUTO_SYNC_TIMEOUT"),
+      options.timeoutMs ?? AUTO_SYNC_TIMEOUT_MS
+    );
+    child.on("error", () => {
+      reason ??= "CLI_UNAVAILABLE";
+    });
+    child.once("close", (exitCode) => {
+      clearTimeout(timer);
+      if (reason && killTimer) terminate(child, true);
+      clearTimeout(killTimer);
+      options.signal.removeEventListener("abort", onAbort);
+      logger.write({
+        event: reason || exitCode !== 0 ? "auto_sync_failed" : "auto_sync_finished",
+        code: reason ?? (exitCode === 0 ? "AUTO_SYNC_SUCCEEDED" : "CLI_SYNC_FAILED"),
+        duration_ms: Date.now() - started,
+        exit_code: exitCode ?? void 0
+      });
+      resolve();
+    });
+    if (options.signal.aborted) onAbort();
+  });
+}
+function startAutoSync(stateRoot, logger, options = {}) {
+  const controller = new AbortController();
+  let timer;
+  let running = Promise.resolve();
+  const schedule = (delay) => {
+    timer = setTimeout(() => {
+      if (controller.signal.aborted) return;
+      running = (async () => {
+        try {
+          if (options.run) await options.run(controller.signal);
+          else await runAutoSync(stateRoot, logger, { signal: controller.signal });
+        } catch {
+          logger.write({ event: "auto_sync_failed", code: "AUTO_SYNC_FAILED" });
+        } finally {
+          if (!controller.signal.aborted) schedule(options.intervalMs ?? AUTO_SYNC_INTERVAL_MS);
+        }
+      })();
+    }, delay);
+    timer.unref();
+  };
+  schedule(options.startupMs ?? AUTO_SYNC_STARTUP_MS);
+  return {
+    close() {
+      clearTimeout(timer);
+      controller.abort();
+      return running;
+    }
+  };
+}
 
 // src/daemon/single-instance.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { readFile as readFile2, rename, unlink, writeFile } from "node:fs/promises";
-import { join as join3 } from "node:path";
-async function bindSingleInstance(server) {
+import { readFile as readFile3, rename, unlink, writeFile } from "node:fs/promises";
+import { join as join4 } from "node:path";
+async function bindSingleInstance(server, port = PORT) {
   await new Promise((resolve, reject) => {
-    const onError = () => reject(new Error("Cannot bind 127.0.0.1:18765; port is occupied or unavailable."));
+    const onError = () => reject(new Error(`Cannot bind ${HOST}:${port}; port is occupied or unavailable.`));
     server.once("error", onError);
-    server.listen({ host: HOST, port: PORT, exclusive: true }, () => {
+    server.listen({ host: HOST, port, exclusive: true }, () => {
       server.off("error", onError);
       resolve();
     });
   });
+  return server.address().port;
 }
-async function writeInstance(stateRoot, id, version) {
-  const path = join3(stateRoot, "instance.json");
-  const temp = join3(stateRoot, `.instance-${randomUUID2()}.tmp`);
+async function writeInstance(stateRoot, id, version, port = PORT) {
+  const path = join4(stateRoot, "instance.json");
+  const temp = join4(stateRoot, `.instance-${randomUUID2()}.tmp`);
   try {
     await writeFile(
       temp,
-      `${JSON.stringify({ instance_id: id, pid: process.pid, host: HOST, port: PORT, version })}
+      `${JSON.stringify({ instance_id: id, pid: process.pid, host: HOST, port, version })}
 `,
       { flag: "wx", mode: 384 }
     );
@@ -804,14 +1141,14 @@ async function writeInstance(stateRoot, id, version) {
   }
   return async () => {
     try {
-      if (JSON.parse(await readFile2(path, "utf8")).instance_id === id) await unlink(path);
+      if (JSON.parse(await readFile3(path, "utf8")).instance_id === id) await unlink(path);
     } catch {
     }
   };
 }
 
 // src/daemon/daemon.ts
-async function startDaemon(config) {
+async function startDaemon(config, { port: requestedPort = PORT } = {}) {
   const stateRoot = await prepareStateRoot(config.stateRoot);
   const logger = createLogger(stateRoot);
   const provider = createCredentialProvider(config.auth);
@@ -824,9 +1161,10 @@ async function startDaemon(config) {
   });
   const instanceId = randomUUID3();
   let cleanup;
+  let port;
   try {
-    await bindSingleInstance(server);
-    cleanup = await writeInstance(stateRoot, instanceId, VERSION);
+    port = await bindSingleInstance(server, requestedPort);
+    cleanup = await writeInstance(stateRoot, instanceId, VERSION, port);
   } catch (error) {
     context.closing = true;
     for (const controller of context.active) controller.abort();
@@ -836,6 +1174,7 @@ async function startDaemon(config) {
     await provider.close();
     throw error;
   }
+  const autoSync = startAutoSync(stateRoot, logger);
   let closing;
   const onSignal = () => {
     void close().catch(() => logger.write({ event: "shutdown_error" }));
@@ -843,6 +1182,7 @@ async function startDaemon(config) {
   const close = ({ drainMs = 1e4 } = {}) => {
     if (closing) return closing;
     context.closing = true;
+    const syncStopped = autoSync.close();
     process.off("SIGINT", onSignal);
     process.off("SIGTERM", onSignal);
     closing = (async () => {
@@ -862,6 +1202,7 @@ async function startDaemon(config) {
         for (const controller of context.active) controller.abort();
         context.httpsAgent.destroy();
         await provider.close();
+        await syncStopped;
         await cleanup?.();
         logger.write({ event: "stopped" });
       }
@@ -871,7 +1212,7 @@ async function startDaemon(config) {
   process.on("SIGINT", onSignal);
   process.on("SIGTERM", onSignal);
   logger.write({ event: "ready" });
-  return { instanceId, host: HOST, port: PORT, close };
+  return { instanceId, host: HOST, port, close };
 }
 export {
   CC_PLACEHOLDER_TOKEN,