github-router 0.3.261 → 0.3.269

package/dist/{server-setup-BeeT8m-w.js → server-setup-Dd293T1O.js}

@@ -1,12 +1,12 @@
-import { A as searchWeb, B as readIteratorWithTimeout, Dt as toolbeltPathOverride, F as isAdvisorRequested, H as handleMcpDelete, I as buildAnthropicErrorEvent, It as withOneMSuffix, L as buildOpenAIErrorEvent, Lt as withInstallLock, M as ADVISOR_TOOL_INSTRUCTIONS, Mt as UPSTREAM_FETCH_TIMEOUT_MS, N as buildAdvisorStream, Nt as UPSTREAM_INACTIVITY_TIMEOUT_MS, P as injectAdvisorTool, Pt as generateRandomPort, R as isControllerClosedError, U as handleMcpPost, V as relayAnthropicStream, W as agentToolsEnabled, at as countTokens, ct as assembleResponsesPayload, dt as createResponses, ft as createChatCompletions, ht as parseJsonOrDiagnose, it as shimDefaultsToXhigh, j as ADVISOR_INTERNAL_TOOL_NAME, lt as resolveMcpToolTimeoutMs, mt as readResponseBodyCapped, ot as createMessages, pt as MAX_RESPONSE_BODY_BYTES, r as assertMcpToolSurfaceConsistent, st as getTokenCount, ut as pickEndpoint, w as toolbeltEnabled, z as logStreamError } from "./peer-mcp-personas-V4AXhm9B.js";
+import { A as searchWeb, B as readIteratorWithTimeout, Dt as toolbeltPathOverride, F as isAdvisorRequested, H as handleMcpDelete, I as buildAnthropicErrorEvent, It as withOneMSuffix, L as buildOpenAIErrorEvent, Lt as withInstallLock, M as ADVISOR_TOOL_INSTRUCTIONS, Mt as UPSTREAM_FETCH_TIMEOUT_MS, N as buildAdvisorStream, Nt as UPSTREAM_INACTIVITY_TIMEOUT_MS, P as injectAdvisorTool, Pt as generateRandomPort, R as isControllerClosedError, U as handleMcpPost, V as relayAnthropicStream, W as agentToolsEnabled, at as countTokens, ct as assembleResponsesPayload, dt as createResponses, ft as createChatCompletions, ht as parseJsonOrDiagnose, it as shimDefaultsToXhigh, j as ADVISOR_INTERNAL_TOOL_NAME, lt as resolveMcpToolTimeoutMs, mt as readResponseBodyCapped, ot as createMessages, pt as MAX_RESPONSE_BODY_BYTES, r as assertMcpToolSurfaceConsistent, st as getTokenCount, ut as pickEndpoint, w as toolbeltEnabled, z as logStreamError } from "./peer-mcp-personas-DSbBlgFt.js";
 import { t as getPackageVersion } from "./version-_Q1WpsQp.js";
-import { i as ensurePaths, t as PATHS } from "./paths-BXrbboAS.js";
-import { C as copilotHeaders, O as state, S as copilotBaseUrl, a as cacheCopilotVersion, c as filterBetaHeader, d as resolveModel, f as sleep, g as fetchWithTransientRetry, i as tryRefreshAndRetry, l as isNullish, n as setupGitHubAgentToken, o as cacheModels, r as setupGitHubToken, s as cacheVSCodeVersion, t as setupCopilotToken, v as HTTPError, y as forwardError } from "./token-DWknHe9M.js";
-import { t as getCopilotUsage } from "./get-copilot-usage-CYpAsYrM.js";
-import { a as resolveExecutable, n as killManagedTree, o as runCommandCapture, r as parseBoolEnv, s as runCommandVoid } from "./exec-DTO2oin0.js";
+import { i as ensurePaths, t as PATHS } from "./paths-Bg1_DWhi.js";
+import { C as copilotHeaders, O as state, S as copilotBaseUrl, a as cacheCopilotVersion, c as filterBetaHeader, d as resolveModel, f as sleep, g as fetchWithTransientRetry, i as tryRefreshAndRetry, l as isNullish, n as setupGitHubAgentToken, o as cacheModels, r as setupGitHubToken, s as cacheVSCodeVersion, t as setupCopilotToken, v as HTTPError, y as forwardError } from "./token-C_q95GF7.js";
+import { t as getCopilotUsage } from "./get-copilot-usage-CFEpeA7E.js";
+import { a as resolveExecutable, n as killManagedTree, o as runCommandCapture, r as parseBoolEnv, s as runCommandVoid } from "./exec-y8C_MU8A.js";
 import consola from "consola";
 import * as fs$2 from "node:fs";
-import { existsSync } from "node:fs";
+import fs, { existsSync } from "node:fs";
 import * as nodePath from "node:path";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
@@ -15,6 +15,7 @@ import os from "node:os";
 import process$1 from "node:process";
 import { spawn } from "node:child_process";
 import { Agent, ProxyAgent, setGlobalDispatcher } from "undici";
+import { Writable } from "node:stream";
 import { serve } from "srvx";
 import { createBodyTooLargeError, limitRequestBody } from "srvx/body-limit";
 import { getProxyForUrl } from "proxy-from-env";
@@ -353,6 +354,170 @@ async function runSelfUpdate(opts) {
 	}
 }
 //#endregion
+//#region src/lib/file-log-reporter.ts
+const MAX_LOG_BYTES = 1048576;
+const DEDUP_MAX = 1e3;
+const ARG_MAX_LEN = 2048;
+const DEDUP_KEY_MAX_LEN = 200;
+const CREDENTIAL_RE = /\b(eyJ[A-Za-z0-9_-]{20,}(?:\.[A-Za-z0-9_-]+){0,2}|gh[opsu]_[A-Za-z0-9_]{20,}|Bearer\s+\S{20,})\b/g;
+const ALLOWED_TYPES = /* @__PURE__ */ new Set([
+	"fatal",
+	"error",
+	"warn"
+]);
+function sanitize(line) {
+	return line.replace(CREDENTIAL_RE, "[REDACTED]");
+}
+function serializeArg(arg) {
+	if (typeof arg === "string") return arg;
+	if (arg instanceof Error) {
+		const parts = [arg.message];
+		if (arg.stack) parts.push(arg.stack);
+		return parts.join("\n");
+	}
+	return String(arg);
+}
+function formatLogLine(logObj) {
+	return sanitize(`${logObj.date.toISOString()} [${(logObj.type ?? "error").toUpperCase()}] ${logObj.args.map((a) => {
+		const s = serializeArg(a);
+		return s.length > ARG_MAX_LEN ? s.slice(0, ARG_MAX_LEN) + "…" : s;
+	}).join(" ").replace(/\r\n|\r|\n/g, "\\n")}\n`);
+}
+function makeDedupeKey(logObj) {
+	const firstArg = logObj.args.length > 0 ? serializeArg(logObj.args[0]) : "";
+	const key = `${logObj.type}:${firstArg}`;
+	return key.length > DEDUP_KEY_MAX_LEN ? key.slice(0, DEDUP_KEY_MAX_LEN) : key;
+}
+/**
+* Construction-time rotation: rename the log aside if it's already over the
+* cap before we start appending. Runs with no descriptor held (the instance
+* fd is opened lazily on the first `log()`), so a plain path stat + rename is
+* correct here. The per-`log()` ceiling check lives in `rotateIfNeeded()`.
+*/
+function rotateAtStartup(filePath) {
+	let size;
+	try {
+		size = fs.statSync(filePath).size;
+	} catch {
+		return;
+	}
+	if (size <= MAX_LOG_BYTES) return;
+	try {
+		fs.renameSync(filePath, filePath + ".1");
+	} catch {}
+}
+var FileLogReporter = class FileLogReporter {
+	filePath;
+	seen = /* @__PURE__ */ new Set();
+	bytesSinceCheck = 0;
+	static ROTATE_CHECK_BYTES = MAX_LOG_BYTES / 2;
+	fd;
+	constructor(filePath) {
+		this.filePath = filePath;
+		rotateAtStartup(filePath);
+	}
+	ensureFd() {
+		if (this.fd !== void 0) return this.fd;
+		try {
+			this.fd = fs.openSync(this.filePath, "a", 384);
+		} catch {
+			this.fd = void 0;
+		}
+		return this.fd;
+	}
+	closeFd() {
+		if (this.fd === void 0) return;
+		try {
+			fs.closeSync(this.fd);
+		} catch {}
+		this.fd = void 0;
+	}
+	/**
+	* Enforce the MAX_LOG_BYTES ceiling. Sizes the LIVE file (fstat on the open
+	* fd when we hold one — no path race — else a path stat), and on overflow
+	* CLOSES the fd before renaming. Closing first is load-bearing on Windows
+	* (renaming a file with an open handle fails with EBUSY/EPERM) and correct
+	* on POSIX too (a held append-fd would otherwise keep writing into the
+	* renamed `.1` inode). The fd is left closed so the next write reopens the
+	* freshly-created file.
+	*/
+	rotateIfNeeded() {
+		let size;
+		try {
+			size = this.fd !== void 0 ? fs.fstatSync(this.fd).size : fs.statSync(this.filePath).size;
+		} catch {
+			return;
+		}
+		if (size <= MAX_LOG_BYTES) return;
+		this.closeFd();
+		try {
+			fs.renameSync(this.filePath, this.filePath + ".1");
+		} catch {}
+	}
+	/**
+	* Close the held descriptor. Safe to call repeatedly and after a write
+	* failure. Optional for correctness (writeSync flushes immediately and the
+	* OS closes fds at process exit), but lets a long-lived host release the
+	* handle deterministically on shutdown.
+	*/
+	close() {
+		this.closeFd();
+	}
+	log(logObj, _ctx) {
+		if (!ALLOWED_TYPES.has(logObj.type)) return;
+		const key = makeDedupeKey(logObj);
+		if (this.seen.has(key)) return;
+		if (this.seen.size >= DEDUP_MAX) this.seen.clear();
+		this.seen.add(key);
+		const line = formatLogLine(logObj);
+		this.bytesSinceCheck += line.length;
+		if (this.bytesSinceCheck >= FileLogReporter.ROTATE_CHECK_BYTES) {
+			this.rotateIfNeeded();
+			this.bytesSinceCheck = 0;
+		}
+		const fd = this.ensureFd();
+		if (fd === void 0) return;
+		try {
+			fs.writeSync(fd, line);
+		} catch {
+			this.closeFd();
+		}
+	}
+};
+const nullStream = new Writable({ write(_chunk, _encoding, cb) {
+	cb();
+} });
+/**
+* Switch consola to file-only mode for TUI sessions.
+* Removes the terminal reporter and installs a file reporter that
+* persists errors and warnings to disk with dedup and credential scrubbing.
+*
+* Also sinks consola's stdout/stderr streams as belt-and-suspenders:
+* even if a terminal reporter is re-added, it cannot write to the terminal.
+* Crash handlers that call process.stderr.write() directly are unaffected.
+* FileLogReporter uses fs.writeSync() directly and is also unaffected.
+*/
+function enableFileLogging() {
+	const reporter = new FileLogReporter(PATHS.ERROR_LOG_PATH);
+	consola.options.throttle = 0;
+	consola.setReporters([reporter]);
+	consola.options.stdout = nullStream;
+	consola.options.stderr = nullStream;
+	fileLoggingActive = true;
+}
+/**
+* True once `enableFileLogging` has run. The file reporter accepts only
+* fatal/error/warn (`ALLOWED_TYPES`), so an `info`-level line — which is what
+* the per-request summary is — reaches no consumer at all in this mode.
+*
+* Exposed so callers can skip work whose ONLY purpose is to populate that
+* line. See `requestLogVisible` in `~/lib/request-log`.
+*/
+let fileLoggingActive = false;
+function isFileLoggingEnabled() {
+	return fileLoggingActive;
+}
+//#endregion
 //#region src/lib/model-validation.ts
 const ENDPOINT_ALIASES = {
 	"/chat/completions": "/chat/completions",
@@ -880,61 +1045,108 @@ function initProxyFromEnv() {
 	}
 }
 //#endregion
-//#region package.json
-var name = "github-router";
-var version = "0.3.261";
-//#endregion
-//#region src/lib/approval.ts
-const awaitApproval = async () => {
-	if (!await consola.prompt(`Accept incoming request?`, { type: "confirm" })) throw new HTTPError("Request rejected by user", Response.json({ message: "Request rejected by user" }, { status: 403 }));
-};
-//#endregion
-//#region src/lib/rate-limit.ts
-const RATE_LIMIT_QUEUE_TIMEOUT_MS = 5e3;
-let rateLimitChain = Promise.resolve();
-async function checkRateLimit(state) {
-	if (state.rateLimitSeconds === void 0) return;
-	const ticket = { aborted: false };
-	const myTurn = rateLimitChain.then(() => doCheck(state, ticket));
-	rateLimitChain = myTurn.catch(() => {});
-	return Promise.race([myTurn, sleep(RATE_LIMIT_QUEUE_TIMEOUT_MS).then(() => {
-		ticket.aborted = true;
-		throw new HTTPError("Rate limit queue wait exceeded", Response.json({
-			type: "error",
-			error: {
-				type: "rate_limit_error",
-				message: `Rate limit queue exceeded ${RATE_LIMIT_QUEUE_TIMEOUT_MS}ms; try again`
-			}
-		}, { status: 429 }));
-	})]);
+//#region src/lib/request-log.ts
+/**
+* Rolling request-body size distribution.
+*
+* Motivation: the cost of the `/v1/messages` prologue (substring guards, JSON
+* parses, re-serialization) scales with body size, but the proxy read
+* `content-length` and never recorded it — so there was no way to tell whether
+* a prologue optimization was worth anything. Benchmarks at 4.5 MiB mean
+* nothing if the real p50 is 40 KiB.
+*
+* Bounded by construction: a fixed-size ring, not a growing array.
+*/
+const BODY_SIZE_RING = 512;
+const bodySizes = new Float64Array(BODY_SIZE_RING);
+let bodySizeCount = 0;
+let bodySizeIdx = 0;
+/** Record one request body size (bytes). Cheap; safe to call per request. */
+function recordBodySize(bytes) {
+	if (!Number.isFinite(bytes) || bytes < 0) return;
+	bodySizes[bodySizeIdx] = bytes;
+	bodySizeIdx = (bodySizeIdx + 1) % BODY_SIZE_RING;
+	if (bodySizeCount < BODY_SIZE_RING) bodySizeCount++;
+}
+/** Percentile snapshot of observed body sizes, or undefined if none seen. */
+function bodySizeStats() {
+	if (bodySizeCount === 0) return void 0;
+	const s = Array.from(bodySizes.slice(0, bodySizeCount)).sort((a, b) => a - b);
+	const at = (q) => s[Math.min(s.length - 1, Math.floor(s.length * q))];
+	return {
+		count: bodySizeCount,
+		p50: at(.5),
+		p95: at(.95),
+		p99: at(.99),
+		max: s[s.length - 1]
+	};
 }
-async function doCheck(state, ticket) {
-	if (state.rateLimitSeconds === void 0) return;
-	if (ticket.aborted) return;
-	const now = Date.now();
-	if (!state.lastRequestTimestamp) {
-		state.lastRequestTimestamp = now;
-		return;
-	}
-	const elapsedSeconds = (now - state.lastRequestTimestamp) / 1e3;
-	if (elapsedSeconds > state.rateLimitSeconds) {
-		state.lastRequestTimestamp = now;
-		return;
-	}
-	const waitTimeSeconds = Math.ceil(state.rateLimitSeconds - elapsedSeconds);
-	if (!state.rateLimitWait) {
-		consola.warn(`Rate limit exceeded. Need to wait ${waitTimeSeconds} more seconds.`);
-		throw new HTTPError("Rate limit exceeded", Response.json({ message: "Rate limit exceeded" }, { status: 429 }));
-	}
-	const waitTimeMs = waitTimeSeconds * 1e3;
-	consola.warn(`Rate limit reached. Waiting ${waitTimeSeconds} seconds before proceeding...`);
-	await sleep(waitTimeMs);
-	if (ticket.aborted) return;
-	state.lastRequestTimestamp = Date.now();
-	consola.info("Rate limit wait completed, proceeding with request");
+/**
+* Print the observed body-size distribution, if any requests were seen.
+*
+* Without this the ring was WRITE-ONLY: `bodySizeStats()` had no caller
+* anywhere in `src/`, so the one number its own doc comment says the decision
+* needs ("benchmarks at 4.5 MiB mean nothing if the real p50 is 40 KiB") was
+* collected every request and readable by nobody.
+*
+* At `consola.info` because it is a once-per-session line answering a question
+* an operator or contributor actually asks; anything noisier would be a reason
+* to switch it off.
+*/
+function logBodySizeStats() {
+	const stats = bodySizeStats();
+	if (!stats) return void 0;
+	const line = `request body sizes (n=${stats.count}): p50 ${formatBytes(stats.p50)}, p95 ${formatBytes(stats.p95)}, p99 ${formatBytes(stats.p99)}, max ${formatBytes(stats.max)}`;
+	consola.info(line);
+	return line;
+}
+/**
+* Report the distribution once, on the way out.
+*
+* Self-registered rather than wired into each subcommand's shutdown chain
+* because `start` has NO `launchChild`/`onShutdown` to hang it on (see the
+* comment at its `startKeepAwake()` call), and a stat that only appeared under
+* `claude` would answer the question for one of three entry points. Same
+* pattern, and same reasoning, as `~/lib/keep-awake`'s own reaper.
+*
+* **Windows caveat, measured rather than assumed.** This reports on a clean
+* exit and on a signal the runtime actually delivers to JS (Ctrl-C in an
+* interactive console). It does NOT report when the process is killed by
+* another process on Windows: `child.kill(...)` and `taskkill` terminate
+* abruptly via `TerminateProcess`, dispatching no JS signal event, so NO
+* handler runs — not this one, and not `process.on("exit")` either. Verified
+* on a real win32 host: a child registering both handlers and killed by its
+* parent produced no output and exited with a null code.
+*
+* That is acceptable for a diagnostic — it is a measurement aid, not a
+* durability guarantee, and the interactive case it exists to serve (run a
+* session, Ctrl-C, read the distribution) does work. It is NOT acceptable for
+* anything durable: do not move credential, ledger, or cleanup work onto this
+* hook. The existing teardown paths that must survive a hard kill are built
+* differently on purpose (see `~/lib/keep-awake`, which relies on the OS
+* releasing a thread-scoped assertion rather than on a handler running, and
+* `~/lib/process-guard`, which uses a separate reaper process).
+*
+* Idempotent: `exit` can follow a signal handler, and both call this.
+*/
+let statsReported = false;
+function reportOnce() {
+	if (statsReported) return;
+	statsReported = true;
+	logBodySizeStats();
+}
+let exitHooksInstalled = false;
+function installBodySizeStatsExitHook() {
+	if (exitHooksInstalled) return;
+	exitHooksInstalled = true;
+	process.once("exit", reportOnce);
+}
+/** Format a byte count compactly (1.2M / 15.3K / 900B). */
+function formatBytes(n) {
+	if (n >= 1048576) return `${(n / 1048576).toFixed(1)}M`;
+	if (n >= 1024) return `${(n / 1024).toFixed(1)}K`;
+	return `${n}B`;
 }
-//#endregion
-//#region src/lib/request-log.ts
 /**
 * Format a number with K/M suffix for compact display.
 */
@@ -958,6 +1170,26 @@ function formatTokenInfo(inputTokens, outputTokens, model) {
 	return parts.join(" ");
 }
 /**
+* Will a per-request summary line actually reach a consumer?
+*
+* Two ways it will not:
+*   - consola's level is below `info` (3), so the line is filtered out; or
+*   - file-logging mode is active, whose reporter accepts only
+*     fatal/error/warn and drops `info` entirely.
+*
+* Callers use this to skip work that exists ONLY to populate that line — most
+* notably the BPE tokenization on the `/chat/completions` path, which is
+* synchronous, scales with prompt size, and sits ahead of the upstream call.
+*
+* Deliberately conservative: when in doubt this returns true, so the failure
+* mode is "did unnecessary work", never "silently dropped a field the operator
+* was looking at".
+*/
+function requestLogVisible() {
+	if (isFileLoggingEnabled()) return false;
+	return consola.level >= 3;
+}
+/**
 * Print a single summary line for a completed request.
 *
 * Examples:
@@ -972,10 +1204,12 @@ function logRequest(info, model, startTime) {
 	else if (info.resolvedModel ?? info.model) parts.push(info.resolvedModel ?? info.model);
 	const tokenInfo = formatTokenInfo(info.inputTokens, info.outputTokens, model);
 	if (tokenInfo) parts.push(tokenInfo);
+	if (info.bodyBytes !== void 0) parts.push(`body:${formatBytes(info.bodyBytes)}`);
 	if (info.status !== void 0) parts.push(String(info.status));
-	const elapsed = Date.now() - startTime;
-	const duration = elapsed >= 1e3 ? `${(elapsed / 1e3).toFixed(1)}s` : `${elapsed}ms`;
-	parts.push(info.streaming ? `${duration} stream` : duration);
+	const elapsed = info.streamMs ?? Date.now() - startTime;
+	const fmt = (ms) => ms >= 1e3 ? `${(ms / 1e3).toFixed(1)}s` : `${Math.round(ms)}ms`;
+	if (info.ttfbMs !== void 0) parts.push(`ttfb:${fmt(info.ttfbMs)}`);
+	parts.push(info.streaming ? `${fmt(elapsed)} stream` : fmt(elapsed));
 	const line = parts.join("  ");
 	if (detectCapabilityMismatch(info, model)) consola.error(`[MISMATCH] ${line}`);
 	else consola.info(line);
@@ -1041,6 +1275,60 @@ function collectToolFieldKeys(body) {
 	return [...seen].sort();
 }
 //#endregion
+//#region package.json
+var name = "github-router";
+var version = "0.3.269";
+//#endregion
+//#region src/lib/approval.ts
+const awaitApproval = async () => {
+	if (!await consola.prompt(`Accept incoming request?`, { type: "confirm" })) throw new HTTPError("Request rejected by user", Response.json({ message: "Request rejected by user" }, { status: 403 }));
+};
+//#endregion
+//#region src/lib/rate-limit.ts
+const RATE_LIMIT_QUEUE_TIMEOUT_MS = 5e3;
+let rateLimitChain = Promise.resolve();
+async function checkRateLimit(state) {
+	if (state.rateLimitSeconds === void 0) return;
+	const ticket = { aborted: false };
+	const myTurn = rateLimitChain.then(() => doCheck(state, ticket));
+	rateLimitChain = myTurn.catch(() => {});
+	return Promise.race([myTurn, sleep(RATE_LIMIT_QUEUE_TIMEOUT_MS).then(() => {
+		ticket.aborted = true;
+		throw new HTTPError("Rate limit queue wait exceeded", Response.json({
+			type: "error",
+			error: {
+				type: "rate_limit_error",
+				message: `Rate limit queue exceeded ${RATE_LIMIT_QUEUE_TIMEOUT_MS}ms; try again`
+			}
+		}, { status: 429 }));
+	})]);
+}
+async function doCheck(state, ticket) {
+	if (state.rateLimitSeconds === void 0) return;
+	if (ticket.aborted) return;
+	const now = Date.now();
+	if (!state.lastRequestTimestamp) {
+		state.lastRequestTimestamp = now;
+		return;
+	}
+	const elapsedSeconds = (now - state.lastRequestTimestamp) / 1e3;
+	if (elapsedSeconds > state.rateLimitSeconds) {
+		state.lastRequestTimestamp = now;
+		return;
+	}
+	const waitTimeSeconds = Math.ceil(state.rateLimitSeconds - elapsedSeconds);
+	if (!state.rateLimitWait) {
+		consola.warn(`Rate limit exceeded. Need to wait ${waitTimeSeconds} more seconds.`);
+		throw new HTTPError("Rate limit exceeded", Response.json({ message: "Rate limit exceeded" }, { status: 429 }));
+	}
+	const waitTimeMs = waitTimeSeconds * 1e3;
+	consola.warn(`Rate limit reached. Waiting ${waitTimeSeconds} seconds before proceeding...`);
+	await sleep(waitTimeMs);
+	if (ticket.aborted) return;
+	state.lastRequestTimestamp = Date.now();
+	consola.info("Rate limit wait completed, proceeding with request");
+}
+//#endregion
 //#region src/routes/chat-completions/handler.ts
 const ENCODER$1 = new TextEncoder();
 function formatSSE$1(chunk) {
@@ -1065,7 +1353,7 @@ async function handleCompletion$1(c) {
 	logEndpointMismatch(payload.model, "/chat/completions");
 	let inputTokens;
 	try {
-		if (selectedModel) inputTokens = (await getTokenCount(payload, selectedModel)).input;
+		if (selectedModel && requestLogVisible()) inputTokens = (await getTokenCount(payload, selectedModel)).input;
 	} catch {}
 	if (isNullish(payload.max_tokens)) {
 		payload = {
@@ -1242,11 +1530,13 @@ completionRoutes.post("/", async (c) => {
 //#region src/services/copilot/create-embeddings.ts
 const createEmbeddings = async (payload) => {
 	if (!state.copilotToken) throw new Error("Copilot token not found");
-	const response = await fetch(`${copilotBaseUrl(state)}/embeddings`, {
+	const body = JSON.stringify(payload);
+	const response = await fetchWithTransientRetry(() => tryRefreshAndRetry(() => fetch(`${copilotBaseUrl(state)}/embeddings`, {
 		method: "POST",
 		headers: copilotHeaders(state),
-		body: JSON.stringify(payload)
-	});
+		body,
+		...UPSTREAM_FETCH_TIMEOUT_MS > 0 ? { signal: AbortSignal.timeout(UPSTREAM_FETCH_TIMEOUT_MS) } : {}
+	}), "/embeddings"), { label: "/embeddings" });
 	if (!response.ok) throw new HTTPError("Failed to create embeddings", response);
 	return await response.json();
 };
@@ -1631,16 +1921,92 @@ function serializeAnthropicEvent(ev) {
 * converts a mid-stream generator throw into a terminal `event: error` frame.
 * On consumer cancel it invokes `onCancel` (abort the upstream fetch) and
 * `return()`s the generator so its `finally` tears down the upstream reader.
+*
+* `inactivityTimeoutMs` bounds how long a single `events.next()` may stall.
+* Without it a Copilot upstream that holds the socket open but stops emitting
+* hangs the caller FOREVER: `UPSTREAM_FETCH_TIMEOUT_MS` defaults to 0 (see
+* `~/lib/port`), so inactivity detection is the only stall defense, and every
+* sibling streaming path already has it (`readIteratorWithTimeout`). The clock
+* is per-read, NOT an absolute budget — a long-reasoning model legitimately
+* streams for many minutes, and only a gap between events is a stall.
+*
+* Three properties this must preserve, each pinned by a test in
+* `tests/anthropic-translate-inactivity.test.ts`:
+*
+*   - NO LEAK: on timeout we take the SAME teardown path as consumer cancel
+*     (`onCancel` aborts the upstream fetch, `events.return()` drives the
+*     generator's `finally`). Timing out without that leaves the fetch alive
+*     for the life of the process.
+*   - NO CRASH: the abandoned `events.next()` promise keeps running. If the
+*     upstream later errors, that rejection has no handler and would kill the
+*     process under Node's `--unhandled-rejections=throw`, so it is swallowed
+*     explicitly. (Same reasoning as the noop `.catch` in `stream-relay.ts`.)
+*   - NO TRUNCATION: a stream that keeps producing inside the deadline is
+*     never cut short, however long it runs in total.
 */
 function anthropicSseStreamFromEvents(events, opts) {
 	const enc = new TextEncoder();
 	let consumerCancelled = false;
 	let finished = false;
+	/** Sentinel identity — never a legitimate iterator result. */
+	const STALLED = Symbol("stalled");
+	/**
+	* `events.next()` bounded by an inactivity deadline. Resolves to `STALLED`
+	* rather than throwing so the caller can distinguish a stall (terminate with
+	* a stall-specific message) from a genuine upstream error.
+	*/
+	const nextWithTimeout = async (timeoutMs) => {
+		const pending = events.next();
+		let timer;
+		try {
+			return await Promise.race([pending, new Promise((resolve) => {
+				timer = setTimeout(() => resolve(STALLED), timeoutMs);
+				timer.unref?.();
+			})]);
+		} finally {
+			if (timer !== void 0) clearTimeout(timer);
+			pending.catch(() => void 0);
+		}
+	};
 	const safeClose = (controller) => {
 		try {
 			controller.close();
 		} catch {}
 	};
+	/**
+	* Tear down the upstream, exactly once, on a PREMATURE end of stream.
+	*
+	* Called from the three places a stream can end early — the stall branch,
+	* the error branch, and consumer `cancel()` — because all three leave the
+	* upstream fetch running and the generator suspended. Both halves matter:
+	* `onCancel` aborts the fetch, and `return()` drives the generator's
+	* `finally`; `return()` alone cannot release a generator parked on a
+	* never-settling await, since it queues behind that await.
+	*
+	* Two things this is deliberately NOT:
+	*
+	*   - **Not a `finally` around `pull`.** `pull` re-enters per chunk, so a
+	*     `finally` there would fire on every successful chunk.
+	*   - **Not called on normal completion** (`res.done`). Aborting an
+	*     AbortController whose fetch has already completed DESTROYS the socket
+	*     instead of returning it to the keep-alive pool, so every successful
+	*     turn would pay a fresh TLS handshake. Premature-only is the whole
+	*     correctness condition, and `tornDown` only makes it idempotent — it
+	*     does not make an unconditional call safe.
+	*/
+	let tornDown = false;
+	const teardownUpstream = () => {
+		if (tornDown) return;
+		tornDown = true;
+		try {
+			opts.onCancel?.();
+		} catch (err) {
+			consola.warn(`Anthropic-translate onCancel threw during teardown at ${opts.routePath}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		try {
+			events.return?.(void 0)?.catch?.(() => void 0);
+		} catch {}
+	};
 	return new ReadableStream({
 		async pull(controller) {
 			if (consumerCancelled || finished) {
@@ -1649,7 +2015,26 @@ function anthropicSseStreamFromEvents(events, opts) {
 			}
 			let res;
 			try {
-				res = await events.next();
+				const timeoutMs = opts.inactivityTimeoutMs;
+				const settled = timeoutMs !== void 0 && timeoutMs > 0 ? await nextWithTimeout(timeoutMs) : await events.next();
+				if (settled === STALLED) {
+					finished = true;
+					if (consumerCancelled) {
+						safeClose(controller);
+						return;
+					}
+					const message = `Upstream stalled: no stream activity for ${timeoutMs}ms`;
+					consola.error(`Anthropic-translate stream inactivity timeout at ${opts.routePath}: ${message}`);
+					teardownUpstream();
+					try {
+						controller.enqueue(enc.encode(buildAnthropicErrorEvent("timeout_error", message)));
+					} catch (enqueueError) {
+						if (!isControllerClosedError(enqueueError)) consola.warn(`Could not deliver error event to consumer at ${opts.routePath}: ${enqueueError instanceof Error ? enqueueError.message : String(enqueueError)}`);
+					}
+					safeClose(controller);
+					return;
+				}
+				res = settled;
 			} catch (err) {
 				finished = true;
 				if (consumerCancelled) {
@@ -1659,6 +2044,7 @@ function anthropicSseStreamFromEvents(events, opts) {
 				const name = err instanceof Error ? err.name : "Error";
 				const message = err instanceof Error ? err.message : String(err);
 				consola.error(`Anthropic-translate stream interrupted at ${opts.routePath}: ${name}: ${JSON.stringify(message)}`);
+				teardownUpstream();
 				try {
 					controller.enqueue(enc.encode(buildAnthropicErrorEvent(name, message)));
 				} catch (enqueueError) {
@@ -1689,8 +2075,7 @@ function anthropicSseStreamFromEvents(events, opts) {
 		cancel() {
 			consumerCancelled = true;
 			finished = true;
-			opts.onCancel?.();
-			events.return?.(void 0);
+			teardownUpstream();
 		}
 	});
 }
@@ -3038,7 +3423,8 @@ async function handleNonClaudeResponses(c, opts) {
 		}, opts.model, opts.startTime);
 		const stream = anthropicSseStreamFromEvents(synthAnthropicFromResponses(result, { modelId: opts.modelId }), {
 			routePath,
-			onCancel: () => aborter.abort()
+			onCancel: () => aborter.abort(),
+			inactivityTimeoutMs: UPSTREAM_INACTIVITY_TIMEOUT_MS
 		});
 		return new Response(stream, {
 			status: 200,
@@ -3094,7 +3480,8 @@ async function handleNonClaudeChat(c, opts) {
 		}, opts.model, opts.startTime);
 		const stream = anthropicSseStreamFromEvents(synthAnthropicFromChat(result, { modelId: opts.modelId }), {
 			routePath,
-			onCancel: () => aborter.abort()
+			onCancel: () => aborter.abort(),
+			inactivityTimeoutMs: UPSTREAM_INACTIVITY_TIMEOUT_MS
 		});
 		return new Response(stream, {
 			status: 200,
@@ -3258,6 +3645,7 @@ async function handleCompletion(c) {
 	const startTime = Date.now();
 	await checkRateLimit(state);
 	const rawBody = await c.req.text();
+	recordBodySize(rawBody.length);
 	const debugEnabled = consola.level >= 4;
 	if (debugEnabled) consola.debug("Anthropic request body:", rawBody.slice(0, 2e3));
 	if (process.env.GH_ROUTER_LOG_FIELDS === "1") {
@@ -3860,6 +4248,14 @@ modelRoutes.get("/", async (c) => {
 //#endregion
 //#region src/routes/responses/handler.ts
 const ENCODER = new TextEncoder();
+/**
+* Cap on CONSECUTIVE empty frames tolerated while discovering the first real
+* SSE event. Reset by any meaningful frame, so a legitimately slow upstream
+* that interleaves keepalives with progress is never cut off — only a source
+* that emits nothing BUT empty frames trips it. Generous by design: this is a
+* runaway backstop, not a policy knob.
+*/
+const MAX_CONSECUTIVE_EMPTY_DISCOVERY_FRAMES = 1e4;
 function formatSSE(chunk) {
 	const parts = [];
 	if (chunk.event) parts.push(`event: ${chunk.event}`);
@@ -3910,18 +4306,25 @@ async function handleResponses(c) {
 	const iterator = response[Symbol.asyncIterator]();
 	let firstChunk;
 	let upstreamFinished = false;
+	let consecutiveEmpty = 0;
 	while (true) {
 		const r = await readIteratorWithTimeout(iterator, UPSTREAM_INACTIVITY_TIMEOUT_MS);
 		if (r.done) {
 			upstreamFinished = true;
 			break;
 		}
-		if (r.value === void 0 || r.value === null) continue;
+		if (r.value === void 0 || r.value === null) {
+			if (++consecutiveEmpty > MAX_CONSECUTIVE_EMPTY_DISCOVERY_FRAMES) break;
+			continue;
+		}
 		if (r.value.data === "[DONE]") {
 			upstreamFinished = true;
 			break;
 		}
-		if (!r.value.data) continue;
+		if (!r.value.data) {
+			if (++consecutiveEmpty > MAX_CONSECUTIVE_EMPTY_DISCOVERY_FRAMES) break;
+			continue;
+		}
 		firstChunk = r.value;
 		break;
 	}
@@ -4454,6 +4857,7 @@ async function setupAndServe(options) {
 	await cacheModels();
 	consola.debug(`Available models: \n${state.models?.data.map((model) => `- ${model.id}`).join("\n")}`);
 	const serveOptions = buildServeOptions(server.fetch, options.silent);
+	installBodySizeStatsExitHook();
 	let srvxServer;
 	if (options.port !== void 0) srvxServer = serve({
 		...serveOptions,
@@ -4857,6 +5261,6 @@ function getCodexEnvVars(serverUrl) {
 	return vars;
 }
 //#endregion
-export { sharedServerArgs as a, listModelsForEndpoint as c, updateClaude as d, setupAndServe as i, runSelfUpdate as l, getCodexEnvVars as n, startKeepAwake as o, parseSharedArgs as r, stopKeepAwake as s, getClaudeCodeEnvVars as t, checkClaudeVersion as u };
+export { sharedServerArgs as a, listModelsForEndpoint as c, checkClaudeVersion as d, updateClaude as f, setupAndServe as i, enableFileLogging as l, getCodexEnvVars as n, startKeepAwake as o, parseSharedArgs as r, stopKeepAwake as s, getClaudeCodeEnvVars as t, runSelfUpdate as u };
 
-//# sourceMappingURL=server-setup-BeeT8m-w.js.map
+//# sourceMappingURL=server-setup-Dd293T1O.js.map