github-router 0.3.271 → 0.3.273

package/dist/{server-setup-B02Myghc.js → server-setup-I5KYkuxE.js}

@@ -1,8 +1,8 @@
-import { A as searchWeb, B as buildAnthropicErrorEvent, Bt as withOneMSuffix, F as isAdvisorRequested, G as relayAnthropicStream, H as isControllerClosedError, I as formatThinkingRepairDecline, It as UPSTREAM_FETCH_TIMEOUT_MS, J as agentToolsEnabled, K as handleMcpDelete, L as rememberThinkingHistoryRepair, Lt as UPSTREAM_INACTIVITY_TIMEOUT_MS, M as ADVISOR_TOOL_INSTRUCTIONS, N as buildAdvisorStream, P as injectAdvisorTool, R as repairKnownThinkingHistory, Rt as generateRandomPort, U as logStreamError, V as buildOpenAIErrorEvent, Vt as withInstallLock, W as readIteratorWithTimeout, _t as MAX_RESPONSE_BODY_BYTES, ct as shimDefaultsToXhigh, dt as getTokenCount, ft as assembleResponsesPayload, gt as createChatCompletions, ht as createResponses, j as ADVISOR_INTERNAL_TOOL_NAME, jt as toolbeltPathOverride, lt as countTokens, mt as pickEndpoint, pt as resolveMcpToolTimeoutMs, q as handleMcpPost, r as assertMcpToolSurfaceConsistent, ut as createMessages, vt as readResponseBodyCapped, w as toolbeltEnabled, yt as parseJsonOrDiagnose, z as repairRejectedThinkingHistory } from "./peer-mcp-personas-CN8xaXcV.js";
+import { A as searchWeb, B as buildAnthropicErrorEvent, Bt as upstreamAllowH2, F as isAdvisorRequested, G as relayAnthropicStream, H as isControllerClosedError, Ht as withOneMSuffix, I as formatThinkingRepairDecline, It as UPSTREAM_FETCH_TIMEOUT_MS, J as agentToolsEnabled, K as handleMcpDelete, L as rememberThinkingHistoryRepair, Lt as UPSTREAM_INACTIVITY_TIMEOUT_MS, M as ADVISOR_TOOL_INSTRUCTIONS, N as buildAdvisorStream, P as injectAdvisorTool, R as repairKnownThinkingHistory, Rt as generateRandomPort, U as logStreamError, Ut as withInstallLock, V as buildOpenAIErrorEvent, Vt as upstreamMaxConnections, W as readIteratorWithTimeout, _t as MAX_RESPONSE_BODY_BYTES, ct as shimDefaultsToXhigh, dt as getTokenCount, ft as assembleResponsesPayload, gt as createChatCompletions, ht as createResponses, j as ADVISOR_INTERNAL_TOOL_NAME, jt as toolbeltPathOverride, lt as countTokens, mt as pickEndpoint, pt as resolveMcpToolTimeoutMs, q as handleMcpPost, r as assertMcpToolSurfaceConsistent, ut as createMessages, vt as readResponseBodyCapped, w as toolbeltEnabled, yt as parseJsonOrDiagnose, z as repairRejectedThinkingHistory } from "./peer-mcp-personas-DAZU1OfN.js";
 import { t as getPackageVersion } from "./version-_Q1WpsQp.js";
 import { i as ensurePaths, t as PATHS } from "./paths-Bg1_DWhi.js";
-import { A as state, T as copilotHeaders, _ as forwardError, a as cacheCopilotVersion, c as filterBetaHeader, d as resolveModel, f as sleep, g as HTTPError, i as tryRefreshAndRetry, l as isNullish, n as setupGitHubAgentToken, o as cacheModels, r as setupGitHubToken, s as cacheVSCodeVersion, t as setupCopilotToken, w as copilotBaseUrl, y as fetchWithTransientRetry } from "./token-iaSGp76k.js";
-import { t as getCopilotUsage } from "./get-copilot-usage-Ds09xSmH.js";
+import { A as state, T as copilotHeaders, _ as forwardError, a as cacheCopilotVersion, c as filterBetaHeader, d as resolveModel, f as sleep, g as HTTPError, i as tryRefreshAndRetry, l as isNullish, n as setupGitHubAgentToken, o as cacheModels, r as setupGitHubToken, s as cacheVSCodeVersion, t as setupCopilotToken, w as copilotBaseUrl, y as fetchWithTransientRetry } from "./token-Bz7iN8US.js";
+import { t as getCopilotUsage } from "./get-copilot-usage-nZXbvSi8.js";
 import { a as resolveExecutable, n as killManagedTree, o as runCommandCapture, r as parseBoolEnv, s as runCommandVoid } from "./exec-y8C_MU8A.js";
 import consola from "consola";
 import * as fs$2 from "node:fs";
@@ -14,7 +14,7 @@ import fs$1 from "node:fs/promises";
 import os from "node:os";
 import process$1 from "node:process";
 import { spawn } from "node:child_process";
-import { Agent, ProxyAgent, setGlobalDispatcher } from "undici";
+import { Agent, ProxyAgent, buildConnector, setGlobalDispatcher } from "undici";
 import { Writable } from "node:stream";
 import { serve } from "srvx";
 import { createBodyTooLargeError, limitRequestBody } from "srvx/body-limit";
@@ -1081,10 +1081,79 @@ function wireDaemonTeardown(handle, opts = {}) {
 }
 //#endregion
 //#region src/lib/proxy.ts
+let socketCounter = 0;
+/**
+* Wrap undici's connector so every upstream socket records its identity.
+* Purely observational: it forwards the original callback unchanged, and any
+* failure to read a property must not break connection setup.
+*
+* `allowH2` MUST be threaded in here, not just onto the Agent. ALPN is chosen
+* by the connector (`undici/lib/core/connect.js` — `ALPNProtocols: allowH2 ?
+* ['h2','http/1.1'] : ['http/1.1']`), so supplying a custom `connect` built
+* from `buildConnector({})` silently restores h2 no matter what the Agent
+* says. Verified against the live upstream, which negotiated h2 with
+* `allowH2:false` on the Agent until this argument was added.
+*/
+function instrumentedConnector(allowH2) {
+	const base = buildConnector({ allowH2 });
+	return ((options, callback) => {
+		return base(options, (err, socket) => {
+			if (err || !socket) {
+				callback(err ?? /* @__PURE__ */ new Error("upstream connect failed"), null);
+				return;
+			}
+			try {
+				const tls = socket;
+				++socketCounter, String(options.hostname ?? ""), typeof tls.alpnProtocol === "string" && tls.alpnProtocol, tls.isSessionReused?.();
+			} catch {}
+			callback(null, socket);
+		});
+	});
+}
+/**
+* Options every upstream dispatcher this module builds must carry, so the
+* direct agent and the per-proxy agents cannot drift apart on transport policy.
+*/
+function upstreamAgentOptions() {
+	return {
+		allowH2: upstreamAllowH2(),
+		connections: upstreamMaxConnections()
+	};
+}
+/**
+* Pin the transport policy for every upstream `fetch()` in the process.
+*
+* This runs UNCONDITIONALLY, unlike `initProxyFromEnv` below, which is gated on
+* `--proxy-env` (default false) and therefore never executes in a normal
+* launch. That gating is why an earlier attempt to set `allowH2` on the agent
+* inside `initProxyFromEnv` would have changed nothing in production: the
+* dispatcher actually serving `/v1/messages` is the one undici installs for
+* itself on import (`lib/global.js`), not anything this module built.
+*
+* No-op under Bun, which does not route `fetch()` through undici dispatchers
+* and negotiates HTTP/1.1 regardless.
+*/
+function initUpstreamTransport() {
+	if (typeof Bun !== "undefined") return;
+	try {
+		const options = upstreamAgentOptions();
+		setGlobalDispatcher(new Agent({
+			...options,
+			connect: instrumentedConnector(options.allowH2)
+		}));
+		consola.debug(`Upstream transport: allowH2=${options.allowH2} connections=${options.connections}`);
+	} catch (err) {
+		consola.debug("Upstream transport setup skipped:", err);
+	}
+}
 function initProxyFromEnv() {
 	if (typeof Bun !== "undefined") return;
 	try {
-		const direct = new Agent();
+		const options = upstreamAgentOptions();
+		const direct = new Agent({
+			...options,
+			connect: instrumentedConnector(options.allowH2)
+		});
 		const proxies = /* @__PURE__ */ new Map();
 		setGlobalDispatcher({
 			dispatch(options, handler) {
@@ -1098,7 +1167,10 @@ function initProxyFromEnv() {
 					}
 					let agent = proxies.get(proxyUrl);
 					if (!agent) {
-						agent = new ProxyAgent(proxyUrl);
+						agent = new ProxyAgent({
+							uri: proxyUrl,
+							...upstreamAgentOptions()
+						});
 						proxies.set(proxyUrl, agent);
 					}
 					let label = proxyUrl;
@@ -1357,7 +1429,7 @@ function collectToolFieldKeys(body) {
 //#endregion
 //#region package.json
 var name = "github-router";
-var version = "0.3.271";
+var version = "0.3.273";
 //#endregion
 //#region src/lib/approval.ts
 const awaitApproval = async () => {
@@ -1409,6 +1481,471 @@ async function doCheck(state, ticket) {
 	consola.info("Rate limit wait completed, proceeding with request");
 }
 //#endregion
+//#region src/lib/tool-loop-guard.ts
+/**
+* Tool results a CLIENT emits to say "you already made this exact call". These
+* are the strongest loop signal available: the client has already adjudicated
+* that the call was redundant, so no inference is needed and there is no
+* polling ambiguity (a status poll never produces one of these).
+*
+* Matched by WHOLE-RESULT equality, never substring — the text below also lives
+* in this repository's docs and in stored session transcripts, so a substring
+* match would fire on an agent reading its own project. `tests/canaries/`
+* pins this set against the installed client so a reword fails loudly instead
+* of silently switching Tier A off.
+*/
+const CLIENT_REDUNDANCY_MARKERS = /* @__PURE__ */ new Set(["Wasted call — file unchanged since your last Read. Refer to that earlier tool_result instead."]);
+const DEFAULT_NUDGE_AT = 4;
+const DEFAULT_ABORT_AT = 7;
+/**
+* Results are compared by equality, and a single `read` can return megabytes.
+* Anything longer than this is compared by digest instead so a comparison stays
+* cheap and bounded; below it the raw text is kept so short results stay
+* readable in a failing test.
+*/
+const RESULT_DIGEST_THRESHOLD = 4096;
+/**
+* Strict env parse. Modelled on `envInt` in `~/lib/port.ts` (digits only, warn
+* rather than silently misconfigure) with one deliberate difference: `0` is a
+* MEANINGFUL value here — it disables a stage — so it is accepted instead of
+* being treated as absent.
+*/
+function envThreshold(key, fallback) {
+	const raw = process.env[key];
+	if (!raw) return fallback;
+	if (!/^[0-9]+$/.test(raw.trim())) {
+		consola.warn(`${key}=${JSON.stringify(raw)} is not a non-negative integer; using fallback ${fallback}`);
+		return fallback;
+	}
+	const parsed = Number.parseInt(raw.trim(), 10);
+	return Number.isSafeInteger(parsed) ? parsed : fallback;
+}
+function loopNudgeAt() {
+	return envThreshold("GH_ROUTER_LOOP_NUDGE_AT", DEFAULT_NUDGE_AT);
+}
+function loopAbortAt() {
+	return envThreshold("GH_ROUTER_LOOP_ABORT_AT", DEFAULT_ABORT_AT);
+}
+const NO_LOOP = {
+	action: "none",
+	tier: null,
+	repeats: 0
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function digest(value) {
+	return createHash("sha256").update(value).digest("base64url");
+}
+function boundedText(value) {
+	return value.length > RESULT_DIGEST_THRESHOLD ? `#${digest(value)}` : value;
+}
+/**
+* Canonical string for a tool result.
+*
+* Under-specifying this is a correctness bug in both directions: dropping
+* non-text blocks makes DIFFERENT results compare equal (an image that changed
+* every turn would look like a loop), and serializing whole wire objects makes
+* IDENTICAL results compare unequal (a re-encrypted id would mask a real loop).
+* So every block contributes, identified by type, and `is_error` participates —
+* a call that starts failing is not the same result as one that succeeded.
+*/
+function normalizeResult(content, isError) {
+	return `${isError === true ? "E" : "N"}|${normalizeResultBody(content)}`;
+}
+function normalizeResultBody(content) {
+	if (content === null || content === void 0) return "∅";
+	if (typeof content === "string") return `s:${boundedText(content)}`;
+	if (Array.isArray(content)) return content.map((block) => normalizeResultBlock(block)).join("");
+	return `j:${boundedText(safeJson(content))}`;
+}
+function normalizeResultBlock(block) {
+	if (typeof block === "string") return `s:${boundedText(block)}`;
+	if (!isRecord(block)) return `j:${boundedText(safeJson(block))}`;
+	const type = typeof block.type === "string" ? block.type : "unknown";
+	if (type === "text" && typeof block.text === "string") return `t:${boundedText(block.text)}`;
+	return `${type}:${digest(safeJson(block))}`;
+}
+function safeJson(value) {
+	try {
+		return JSON.stringify(value) ?? "";
+	} catch {
+		return "";
+	}
+}
+function argsKeyFor(name, args) {
+	return `${name}:${safeJson(args)}`;
+}
+function buildCall(name, args, content, isError) {
+	const raw = typeof content === "string" ? content : void 0;
+	let cached;
+	return {
+		name,
+		argsKey: argsKeyFor(name, args),
+		resultKey: () => cached ??= normalizeResult(content, isError),
+		isMarker: raw !== void 0 && CLIENT_REDUNDANCY_MARKERS.has(raw)
+	};
+}
+/**
+* Signature of a whole turn: every (call, result) pair, sorted so the order the
+* client happened to serialize parallel calls and their results in cannot
+* change the answer.
+*/
+function turnSignature(turn) {
+	return turn.calls.map((call) => `${call.argsKey}${call.resultKey()}`).sort().join("");
+}
+/**
+* Decide whether the tail of a conversation is a stuck tool loop.
+*
+* Compares WHOLE TURNS, not individual calls. Flattening a parallel-tool turn
+* into a call sequence is wrong in both directions: a turn issuing calls A and
+* B flattens to `A,B,A,B,…`, where no two neighbours match, so a repeating
+* parallel batch never registers; and seven identical calls inside ONE turn
+* look like a run of seven even though the model has observed no results at all
+* and completed zero feedback cycles.
+*
+* Only an immediately-repeating turn counts. A cycle with a period longer than
+* one turn (turn A, turn B, turn A, …) is NOT detected — a deliberate scope
+* limit, matching the single-slot reset semantics of the in-process worker
+* guard rather than trying to be a general cycle finder.
+*/
+function detectToolLoop(turns, options = {}) {
+	const nudgeAt = options.nudgeAt ?? loopNudgeAt();
+	const abortAt = options.abortAt ?? loopAbortAt();
+	const active = [nudgeAt, abortAt].filter((n) => n > 0);
+	if (active.length === 0 || turns.length === 0) return NO_LOOP;
+	const limit = Math.max(...active);
+	const last = turns[turns.length - 1];
+	if (!last || last.calls.length === 0) return NO_LOOP;
+	const signature = turnSignature(last);
+	const run = [last];
+	for (let i = turns.length - 2; i >= 0 && run.length < limit; i--) {
+		const turn = turns[i];
+		if (!turn || turn.calls.length === 0) break;
+		if (turnSignature(turn) !== signature) break;
+		run.push(turn);
+	}
+	const repeats = run.length;
+	const toolName = uniqueToolName(last);
+	const markerRun = run.every((turn) => turn.calls.every((call) => call.isMarker));
+	if (abortAt > 0 && repeats >= abortAt) {
+		if (markerRun) return {
+			action: "abort",
+			tier: "A",
+			repeats,
+			toolName
+		};
+		if (!run.some((turn) => turn.hasNarration)) return {
+			action: "abort",
+			tier: "B",
+			repeats,
+			toolName
+		};
+	}
+	if (nudgeAt > 0 && repeats >= nudgeAt) return {
+		action: "nudge",
+		tier: markerRun ? "A" : "B",
+		repeats,
+		toolName
+	};
+	return NO_LOOP;
+}
+function uniqueToolName(turn) {
+	const names = new Set(turn.calls.map((call) => call.name));
+	return names.size === 1 ? [...names][0] : void 0;
+}
+/** Text injected as a sibling block when a loop is suspected but not certain. */
+function nudgeText(verdict) {
+	return `[github-router] The same ${verdict.toolName ? `\`${verdict.toolName}\` call` : "tool call"} has now been repeated ${verdict.repeats}× in a row with an identical result. Nothing has changed and nothing will change by repeating it. Use the result you already have, try a materially different approach, or stop and report what you found.`;
+}
+/** Message returned to the client when the loop is aborted. */
+function abortMessage(verdict) {
+	return `Request blocked by github-router: the same ${verdict.toolName ? `\`${verdict.toolName}\` call` : "tool call"} has been repeated ${verdict.repeats}× consecutively with an identical result and no intervening progress. Continuing would burn inference with no possible change in outcome. Vary the call or end the turn. Tune or disable this with GH_ROUTER_LOOP_ABORT_AT.`;
+}
+/**
+* Cheap pre-check so a request with no tool traffic never pays for a parse.
+* Substring test against the raw body: false positives merely cost the parse
+* the guard would have done anyway, and there are no false negatives because
+* every wire format spells its result marker literally.
+*/
+function mayContainToolTraffic(rawBody) {
+	return rawBody.includes("tool_result") || rawBody.includes("tool_call_id") || rawBody.includes("function_call_output");
+}
+function blockType(block) {
+	return isRecord(block) && typeof block.type === "string" ? block.type : void 0;
+}
+/** Anthropic Messages: assistant `tool_use` blocks ↔ user `tool_result` blocks. */
+function extractAnthropicTurns(body) {
+	if (!isRecord(body) || !Array.isArray(body.messages)) return [];
+	const turns = [];
+	for (let i = 0; i < body.messages.length; i++) {
+		const message = body.messages[i];
+		if (!isRecord(message) || message.role !== "assistant") continue;
+		if (!Array.isArray(message.content)) continue;
+		const uses = message.content.filter((b) => blockType(b) === "tool_use");
+		if (uses.length === 0) {
+			turns.push({
+				calls: [],
+				hasNarration: anthropicHasNarration(message.content)
+			});
+			continue;
+		}
+		const results = /* @__PURE__ */ new Map();
+		for (let j = i + 1; j < body.messages.length; j++) {
+			const next = body.messages[j];
+			if (!isRecord(next) || next.role !== "user") break;
+			if (!Array.isArray(next.content)) break;
+			for (const block of next.content) {
+				if (!isRecord(block) || blockType(block) !== "tool_result") continue;
+				const id = block.tool_use_id;
+				if (typeof id === "string") results.set(id, block);
+			}
+		}
+		const calls = [];
+		for (const use of uses) {
+			if (!isRecord(use)) continue;
+			const name = typeof use.name === "string" ? use.name : "unknown";
+			const id = typeof use.id === "string" ? use.id : void 0;
+			const result = id === void 0 ? void 0 : results.get(id);
+			if (!result) continue;
+			calls.push(buildCall(name, use.input, result.content, result.is_error));
+		}
+		if (calls.length === 0) continue;
+		turns.push({
+			calls,
+			hasNarration: anthropicHasNarration(message.content)
+		});
+	}
+	return turns;
+}
+function anthropicHasNarration(content) {
+	return content.some((block) => {
+		const type = blockType(block);
+		if (type === "thinking" || type === "redacted_thinking") return true;
+		return type === "text" && isRecord(block) && typeof block.text === "string" && block.text.trim() !== "";
+	});
+}
+/** OpenAI Chat Completions: assistant `tool_calls[]` ↔ `role:"tool"` messages. */
+function extractChatTurns(body) {
+	if (!isRecord(body) || !Array.isArray(body.messages)) return [];
+	const turns = [];
+	for (let i = 0; i < body.messages.length; i++) {
+		const message = body.messages[i];
+		if (!isRecord(message) || message.role !== "assistant") continue;
+		if (!Array.isArray(message.tool_calls) || message.tool_calls.length === 0) {
+			turns.push({
+				calls: [],
+				hasNarration: chatHasNarration(message.content)
+			});
+			continue;
+		}
+		const results = /* @__PURE__ */ new Map();
+		for (let j = i + 1; j < body.messages.length; j++) {
+			const next = body.messages[j];
+			if (!isRecord(next) || next.role !== "tool") break;
+			const id = next.tool_call_id;
+			if (typeof id === "string") results.set(id, next);
+		}
+		const calls = [];
+		for (const call of message.tool_calls) {
+			if (!isRecord(call)) continue;
+			const fn = isRecord(call.function) ? call.function : void 0;
+			const name = typeof fn?.name === "string" ? fn.name : "unknown";
+			const id = typeof call.id === "string" ? call.id : void 0;
+			const result = id === void 0 ? void 0 : results.get(id);
+			if (!result) continue;
+			calls.push(buildCall(name, fn?.arguments, result.content));
+		}
+		if (calls.length === 0) continue;
+		turns.push({
+			calls,
+			hasNarration: chatHasNarration(message.content)
+		});
+	}
+	return turns;
+}
+/**
+* OpenAI allows assistant `content` to be either a string or an array of
+* multimodal parts. Treating only the string form as narration would classify
+* an array-narrating model as silent and expose it to the Tier B abort.
+*/
+function chatHasNarration(content) {
+	if (typeof content === "string") return content.trim() !== "";
+	if (!Array.isArray(content)) return false;
+	return content.some((part) => isRecord(part) && typeof part.text === "string" && part.text.trim() !== "");
+}
+/** OpenAI Responses: `function_call` items ↔ `function_call_output` items. */
+function extractResponsesTurns(body) {
+	if (!isRecord(body) || !Array.isArray(body.input)) return [];
+	const items = body.input;
+	const results = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		if (!isRecord(item) || item.type !== "function_call_output") continue;
+		const id = item.call_id;
+		if (typeof id === "string") results.set(id, item);
+	}
+	const turns = [];
+	let i = 0;
+	while (i < items.length) {
+		const item = items[i];
+		if (!isRecord(item) || item.type !== "function_call") {
+			i++;
+			continue;
+		}
+		const batch = [];
+		while (i < items.length) {
+			const candidate = items[i];
+			if (!isRecord(candidate) || candidate.type !== "function_call") break;
+			batch.push(candidate);
+			i++;
+		}
+		const calls = [];
+		for (const call of batch) {
+			const name = typeof call.name === "string" ? call.name : "unknown";
+			const id = typeof call.call_id === "string" ? call.call_id : void 0;
+			const result = id === void 0 ? void 0 : results.get(id);
+			if (!result) continue;
+			calls.push(buildCall(name, call.arguments, result.output));
+		}
+		if (calls.length === 0) continue;
+		turns.push({
+			calls,
+			hasNarration: responsesHasNarration(items, i - batch.length)
+		});
+	}
+	return turns;
+}
+/**
+* Responses has no turn envelope, so narration is whatever the model emitted
+* immediately before the call batch: an assistant/message item or a reasoning
+* item.
+*/
+function responsesHasNarration(items, batchStart) {
+	for (let i = batchStart - 1; i >= 0; i--) {
+		const item = items[i];
+		if (!isRecord(item)) return false;
+		if (item.type === "function_call_output") continue;
+		if (item.type === "reasoning") return true;
+		if (item.type === "message" || item.role === "assistant") return responsesItemHasText(item);
+		return false;
+	}
+	return false;
+}
+function responsesItemHasText(item) {
+	if (typeof item.content === "string") return item.content.trim() !== "";
+	if (!Array.isArray(item.content)) return false;
+	return item.content.some((block) => isRecord(block) && typeof block.text === "string" && block.text.trim() !== "");
+}
+function injectAnthropicNudge(body, text) {
+	if (!isRecord(body) || !Array.isArray(body.messages)) return false;
+	const messages = body.messages;
+	const last = messages[messages.length - 1];
+	if (!isRecord(last) || last.role !== "user") return false;
+	if (!Array.isArray(last.content)) return false;
+	messages[messages.length - 1] = {
+		...last,
+		content: [...last.content, {
+			type: "text",
+			text
+		}]
+	};
+	return true;
+}
+function injectChatNudge(body, text) {
+	if (!isRecord(body) || !Array.isArray(body.messages)) return false;
+	body.messages = [...body.messages, {
+		role: "user",
+		content: text
+	}];
+	return true;
+}
+function injectResponsesNudge(body, text) {
+	if (!isRecord(body) || !Array.isArray(body.input)) return false;
+	body.input = [...body.input, {
+		role: "user",
+		content: [{
+			type: "input_text",
+			text
+		}]
+	}];
+	return true;
+}
+const NO_ACTION = {
+	action: "none",
+	verdict: NO_LOOP
+};
+function report(verdict, route) {
+	consola.warn(`[LOOP-GUARD] ${verdict.action} on ${route}: tier=${verdict.tier} repeats=${verdict.repeats} tool=${verdict.toolName ?? "multiple"}`);
+}
+/**
+* Anthropic Messages. Takes and returns the raw body string because that path
+* is otherwise a passthrough; the body is re-serialized ONLY when a nudge is
+* injected, mirroring `resolveModelInBody`'s `modified ? stringify : raw`
+* contract so detection alone can never perturb values JavaScript cannot round
+* -trip exactly (`9007199254740993` becomes `…992`).
+*
+* Injecting a nudge inherently requires re-serializing, so on the rare request
+* that would otherwise pass through raw a nudge does extend that exposure. It
+* is not a NEW class of hazard — `resolveModelInBody` already re-serializes
+* whenever it changed anything, which for Claude Code is essentially every
+* request, since the model slug is rewritten.
+*/
+function guardAnthropicBody(rawBody) {
+	if (!mayContainToolTraffic(rawBody)) return NO_ACTION;
+	let parsed;
+	try {
+		parsed = JSON.parse(rawBody);
+	} catch {
+		return NO_ACTION;
+	}
+	const verdict = detectToolLoop(extractAnthropicTurns(parsed));
+	if (verdict.action === "none") return NO_ACTION;
+	report(verdict, "/v1/messages");
+	if (verdict.action === "abort") return {
+		action: "abort",
+		message: abortMessage(verdict),
+		verdict
+	};
+	if (!injectAnthropicNudge(parsed, nudgeText(verdict))) return NO_ACTION;
+	return {
+		action: "nudge",
+		body: JSON.stringify(parsed),
+		verdict
+	};
+}
+/** OpenAI Chat Completions. Mutates the already-parsed payload in place. */
+function guardChatPayload(payload) {
+	const verdict = detectToolLoop(extractChatTurns(payload));
+	if (verdict.action === "none") return NO_ACTION;
+	report(verdict, "/v1/chat/completions");
+	if (verdict.action === "abort") return {
+		action: "abort",
+		message: abortMessage(verdict),
+		verdict
+	};
+	if (!injectChatNudge(payload, nudgeText(verdict))) return NO_ACTION;
+	return {
+		action: "nudge",
+		verdict
+	};
+}
+/** OpenAI Responses. Mutates the already-parsed payload in place. */
+function guardResponsesPayload(payload) {
+	const verdict = detectToolLoop(extractResponsesTurns(payload));
+	if (verdict.action === "none") return NO_ACTION;
+	report(verdict, "/v1/responses");
+	if (verdict.action === "abort") return {
+		action: "abort",
+		message: abortMessage(verdict),
+		verdict
+	};
+	if (!injectResponsesNudge(payload, nudgeText(verdict))) return NO_ACTION;
+	return {
+		action: "nudge",
+		verdict
+	};
+}
+//#endregion
 //#region src/routes/chat-completions/handler.ts
 const ENCODER$1 = new TextEncoder();
 function formatSSE$1(chunk) {
@@ -1425,6 +1962,11 @@ async function handleCompletion$1(c) {
 	const debugEnabled = consola.level >= 4;
 	if (debugEnabled) consola.debug("Request payload:", JSON.stringify(payload).slice(-400));
 	if (state.manualApprove) await awaitApproval();
+	const loopGuard = guardChatPayload(payload);
+	if (loopGuard.action === "abort") return c.json({ error: {
+		type: "invalid_request_error",
+		message: loopGuard.message
+	} }, 400, { "x-should-retry": "false" });
 	await injectWebSearchIfNeeded$1(payload);
 	const originalModel = payload.model;
 	const resolvedModel = resolveModel(payload.model);
@@ -3820,6 +4362,15 @@ async function handleCompletion(c) {
 	const advisorEnabled = isAdvisorRequested(incomingBeta);
 	let finalBody = await processWebSearch(rawBody);
 	finalBody = sanitizeAnthropicBody(finalBody);
+	const loopGuard = guardAnthropicBody(finalBody);
+	if (loopGuard.action === "abort") return c.json({
+		type: "error",
+		error: {
+			type: "invalid_request_error",
+			message: loopGuard.message
+		}
+	}, 400, { "x-should-retry": "false" });
+	if (loopGuard.body !== void 0) finalBody = loopGuard.body;
 	if (advisorEnabled) {
 		finalBody = injectAdvisorTool(finalBody);
 		consola.info("ADVISOR enabled for this request — injecting __anthropic_advisor tool; will translate tool_use → server_tool_use{advisor} on the SSE stream");
@@ -4455,6 +5006,11 @@ async function handleResponses(c) {
 	const payload = await c.req.json();
 	const debugEnabled = consola.level >= 4;
 	if (debugEnabled) consola.debug("Responses request payload:", JSON.stringify(payload).slice(-400));
+	const loopGuard = guardResponsesPayload(payload);
+	if (loopGuard.action === "abort") return c.json({ error: {
+		type: "invalid_request_error",
+		message: loopGuard.message
+	} }, 400, { "x-should-retry": "false" });
 	const originalModel = payload.model;
 	const resolvedModel = resolveModel(payload.model);
 	if (resolvedModel !== payload.model) payload.model = resolvedModel;
@@ -5011,6 +5567,7 @@ function buildServeOptions(fetchHandler, silent) {
 	};
 }
 async function setupAndServe(options) {
+	initUpstreamTransport();
 	if (options.proxyEnv) initProxyFromEnv();
 	if (options.verbose) {
 		consola.level = 5;
@@ -5449,4 +6006,4 @@ function getCodexEnvVars(serverUrl) {
 //#endregion
 export { sharedServerArgs as a, listModelsForEndpoint as c, checkClaudeVersion as d, updateClaude as f, setupAndServe as i, enableFileLogging as l, getCodexEnvVars as n, startKeepAwake as o, parseSharedArgs as r, stopKeepAwake as s, getClaudeCodeEnvVars as t, runSelfUpdate as u };
 
-//# sourceMappingURL=server-setup-B02Myghc.js.map
+//# sourceMappingURL=server-setup-I5KYkuxE.js.map