github-router 0.3.35 → 0.3.37

package/dist/main.js

@@ -2892,8 +2892,28 @@ function buildInstallRequired(reason, autoInstalled) {
 * model. Side effect: when reason is `extension_not_loaded`, attempts
 * to install the NMH manifest for every detected browser so that the
 * extension can connect immediately on load.
+*
+* Single-flight: concurrent calls share one in-flight Promise so that
+* `installNativeHostForAll` (which writes files and spawns reg.exe on
+* Windows) is called exactly once per check cycle, regardless of how
+* many browser_* tool calls arrive concurrently.
+*/
+let _inFlightReady;
+/**
+* @internal — counts how many times _ensureBridgeReadyImpl has started.
+* Used by regression tests for the single-flight property (Bug #6).
+* Always 0 in production (only incremented when imported by tests).
 */
+let __implInvocationsForTests = 0;
 async function ensureBridgeReady() {
+	if (_inFlightReady) return _inFlightReady;
+	_inFlightReady = _ensureBridgeReadyImpl().finally(() => {
+		_inFlightReady = void 0;
+	});
+	return _inFlightReady;
+}
+async function _ensureBridgeReadyImpl() {
+	__implInvocationsForTests++;
 	const browsers = detectSupportedBrowsers();
 	if (browsers.length === 0) return buildInstallRequired("no_supported_browser", []);
 	if (!bridgeBundleExists()) return buildInstallRequired("bridge_bundle_missing", []);
@@ -3035,10 +3055,11 @@ async function bridgeCall(endpoint, tool, args, timeoutMs, signal) {
 		const id = randomUUID();
 		const ws = new WebSocket(`ws://127.0.0.1:${endpoint.port}`, { headers: { authorization: `Bearer ${endpoint.token}` } });
 		let settled = false;
+		let timer = void 0;
 		const finish = (fn) => {
 			if (settled) return;
 			settled = true;
-			clearTimeout(timer);
+			if (timer !== void 0) clearTimeout(timer);
 			if (signal) signal.removeEventListener("abort", onAbort);
 			try {
 				ws.close();
@@ -3053,8 +3074,14 @@ async function bridgeCall(endpoint, tool, args, timeoutMs, signal) {
 			}
 			signal.addEventListener("abort", onAbort, { once: true });
 		}
-		const timer = setTimeout(() => finish(() => reject(/* @__PURE__ */ new Error(`timeout after ${timeoutMs}ms`))), timeoutMs);
+		timer = setTimeout(() => finish(() => reject(/* @__PURE__ */ new Error(`timeout after ${timeoutMs}ms`))), timeoutMs);
 		ws.on("open", () => {
+			if (settled) {
+				try {
+					ws.close();
+				} catch {}
+				return;
+			}
 			ws.send(JSON.stringify({
 				id,
 				tool,
@@ -5155,6 +5182,117 @@ async function acquireWorkerSlot(signal) {
 	};
 }
 
+//#endregion
+//#region src/lib/diagnose-response.ts
+const PREVIEW_LIMIT = 200;
+async function parseJsonOrDiagnose(response, routePath) {
+	const cloned = response.clone();
+	try {
+		return await response.json();
+	} catch (error) {
+		const contentType = response.headers.get("content-type") ?? "(none)";
+		const bodyText = await cloned.text().catch(() => "(unreadable)");
+		const preview = bodyText.length > PREVIEW_LIMIT ? bodyText.slice(0, PREVIEW_LIMIT) + "...(truncated)" : bodyText;
+		consola.error(`Upstream JSON parse failed at ${routePath}: status=${response.status} content-type="${contentType}" body[0..${PREVIEW_LIMIT}]=${JSON.stringify(preview)}`);
+		throw error;
+	}
+}
+
+//#endregion
+//#region src/lib/response-cap.ts
+/**
+* Hard byte cap for non-streaming upstream response bodies.
+*
+* Anthropic responses with large tool_use blocks can legitimately reach
+* several MB, but a multi-GB body is either a buggy upstream or a malicious
+* one. Buffering it would OOM the proxy and crash all in-flight requests.
+*
+* Applies to /v1/messages, /v1/chat/completions, and /v1/responses.
+*/
+const MAX_RESPONSE_BODY_BYTES = 10 * 1024 * 1024;
+/**
+* Read a Response body with a hard byte cap, then parse as JSON.
+*
+* Falls back to the fast path (response.json()) when Content-Length is
+* present and within the cap, avoiding the streaming-reader overhead for
+* the vast majority of normal responses.
+*
+* When the cap is hit:
+*   - the reader is cancelled to release the upstream socket
+*   - a structured Anthropic-format error is returned to the caller
+*     (the caller wraps it in c.json(), not throws — the client gets a
+*     clean 413 error, not an unhandled-rejection crash)
+*
+* Returns `{ ok: true, value }` on success or `{ ok: false, errorResponse, status }`
+* on cap exceeded.
+*/
+async function readResponseBodyCapped(response, routePath, capBytes = MAX_RESPONSE_BODY_BYTES) {
+	const contentLengthHeader = response.headers.get("content-length");
+	const contentLength = contentLengthHeader ? parseInt(contentLengthHeader, 10) : NaN;
+	if (!isNaN(contentLength) && contentLength <= capBytes) return {
+		ok: true,
+		value: await parseJsonOrDiagnose(response, routePath)
+	};
+	const reader = response.body?.getReader();
+	if (!reader) return {
+		ok: true,
+		value: await parseJsonOrDiagnose(response, routePath)
+	};
+	const chunks = [];
+	let totalBytes = 0;
+	let capped = false;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			totalBytes += value.byteLength;
+			if (totalBytes > capBytes) {
+				capped = true;
+				try {
+					await reader.cancel("size_cap");
+				} catch {}
+				break;
+			}
+			chunks.push(value);
+		}
+	} catch (err) {
+		if (!capped) consola.warn(`readResponseBodyCapped: read error at ${routePath}:`, err);
+	}
+	if (capped) {
+		consola.warn(`Non-streaming upstream response at ${routePath} exceeded ${capBytes} bytes (10 MiB cap); dropping body to prevent OOM. Check upstream health.`);
+		return {
+			ok: false,
+			status: 502,
+			errorResponse: {
+				type: "error",
+				error: {
+					type: "api_error",
+					message: `Upstream response body exceeded the 10 MiB size cap for non-streaming ${routePath}. The upstream may be misbehaving. Try enabling streaming (stream: true) which handles large responses chunk-by-chunk.`
+				}
+			}
+		};
+	}
+	const merged = new Uint8Array(totalBytes);
+	let offset = 0;
+	for (const chunk of chunks) {
+		merged.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	const text = new TextDecoder().decode(merged);
+	try {
+		return {
+			ok: true,
+			value: JSON.parse(text)
+		};
+	} catch (err) {
+		const preview = text.slice(0, 200);
+		const contentType = response.headers.get("content-type") ?? "(none)";
+		consola.error(`Upstream JSON parse failed at ${routePath}: status=${response.status} content-type="${contentType}" body[0..200]=${JSON.stringify(preview)}`);
+		throw err;
+	}
+}
+
 //#endregion
 //#region src/services/copilot/create-chat-completions.ts
 const createChatCompletions = async (payload, modelHeaders, callerSignal) => {
@@ -5196,7 +5334,12 @@ const createChatCompletions = async (payload, modelHeaders, callerSignal) => {
 		}));
 	}
 	if (payload.stream) return events(response);
-	return await response.json();
+	const cappedResult = await readResponseBodyCapped(response, "/v1/chat/completions", MAX_RESPONSE_BODY_BYTES);
+	if (!cappedResult.ok) throw new HTTPError("Upstream /v1/chat/completions response exceeded 10 MiB size cap", new Response(JSON.stringify(cappedResult.errorResponse), {
+		status: cappedResult.status,
+		headers: { "content-type": "application/json" }
+	}));
+	return cappedResult.value;
 };
 
 //#endregion
@@ -5857,7 +6000,12 @@ const createResponses = async (payload, modelHeaders, callerSignal) => {
 		throw new HTTPError("Failed to create responses", response);
 	}
 	if (payload.stream) return events(response);
-	return await response.json();
+	const cappedResult = await readResponseBodyCapped(response, "/v1/responses", MAX_RESPONSE_BODY_BYTES);
+	if (!cappedResult.ok) throw new HTTPError("Upstream /v1/responses response exceeded 10 MiB size cap", new Response(JSON.stringify(cappedResult.errorResponse), {
+		status: cappedResult.status,
+		headers: { "content-type": "application/json" }
+	}));
+	return cappedResult.value;
 };
 function detectVision(input) {
 	if (typeof input === "string") return false;
@@ -5882,40 +6030,25 @@ function detectAgentCall(input) {
 const MCP_PROTOCOL_VERSION = "2025-06-18";
 const SERVER_NAME = "github-router-peers";
 const SERVER_VERSION = "1";
-/** Bounded concurrency. Originally capped at 2 (commit 4317a25) as a defensive
-*  pre-launch guess against Opus's natural pattern of fanning out to all three
-*  critics at once. Raised to 8 (Phase 2D of the peer-MCP plan) so the
-*  decomposition pattern Phase 2B teaches Opus — "split a >20 KB artifact
-*  into 2-4 batches and call in parallel" — can actually run in parallel
-*  without the (3+)th call returning isError "queue full". The persona
-*  handlers (`callPersona`) hold no shared mutable state — there's no race
-*  the cap is hiding; the upstream Copilot's own rate-limit (surfaced as a
-*  per-call 429 → tool isError) is the real backpressure mechanism. 8 covers
-*  a 7-fork wave with one slot of headroom and is still a hard upper bound
-*  against runaway clients. See docs/research/peer-mcp-investigation.md
-*  § "Concurrency cap investigation" for the full justification.
-*
-*  The counter itself lives in `src/lib/mcp-inflight.ts` so the
-*  worker-agent's nested `peer_review` / `advisor` tools share the
-*  same budget — otherwise a worker could fan out unboundedly to
-*  peers without showing up in the MCP-side cap. */
-/**
-* Per-request AbortController registry for `notifications/cancelled`
-* (Phase D P1.5). When a client times out a tools/call before the
-* upstream Copilot fetch completes, the JSON-RPC notification:
-*   { jsonrpc:"2.0", method:"notifications/cancelled",
-*     params:{ requestId: "<id>", reason?: "..." } }
-* arrives. Without handling, the upstream fetch keeps running until
-* natural completion, leaking the inFlightToolsCall slot for tens of
-* minutes. Tracking the AbortController lets us abort the fetch and
-* free the slot immediately.
-*
-* Important: per CLAUDE.md "Bun request-signal quirk", we use OUR own
-* AbortController (NOT c.req.raw.signal which fires after request body
-* is consumed). The signal is threaded into createResponses /
-* createChatCompletions's `callerSignal` parameter.
-*/
 const inflightAborts = /* @__PURE__ */ new Map();
+/**
+* Idempotent teardown for an in-flight tools/call. Aborts the upstream
+* fetch, frees the concurrency slot, and removes the registry entry.
+* Safe to call from both `notifications/cancelled` and the SSE
+* `ReadableStream.cancel()` callback, in either order, and any number
+* of times — the second call is a no-op.
+*/
+function cancelInflight(key, reason) {
+	const entry = inflightAborts.get(key);
+	if (!entry) return;
+	inflightAborts.delete(key);
+	try {
+		entry.aborter.abort(new Error(reason));
+	} catch {}
+	try {
+		entry.release();
+	} catch {}
+}
 const RPC_PARSE_ERROR = -32700;
 const RPC_INVALID_REQUEST = -32600;
 const RPC_METHOD_NOT_FOUND = -32601;
@@ -6388,9 +6521,14 @@ async function handleToolsCall(body) {
 	const startedAt = Date.now();
 	const abortKey = body.id !== void 0 && body.id !== null ? body.id : void 0;
 	let aborter;
+	let inflightEntry;
 	if (abortKey !== void 0) {
 		aborter = new AbortController();
-		inflightAborts.set(abortKey, aborter);
+		inflightEntry = {
+			aborter,
+			release
+		};
+		inflightAborts.set(abortKey, inflightEntry);
 	}
 	const telemetryName = persona ? persona.agentName : nonPersonaTool.toolNameHttp;
 	const telemetryModel = persona ? persona.model : "(non-persona)";
@@ -6421,7 +6559,9 @@ async function handleToolsCall(body) {
 		});
 	} finally {
 		release();
-		if (abortKey !== void 0) inflightAborts.delete(abortKey);
+		if (abortKey !== void 0 && inflightEntry !== void 0) {
+			if (inflightAborts.get(abortKey) === inflightEntry) inflightAborts.delete(abortKey);
+		}
 	}
 }
 /**
@@ -6436,9 +6576,7 @@ function handleCancelledNotification(body) {
 		consola.debug(`[mcp] notifications/cancelled missing or invalid requestId: ${JSON.stringify(requestId)}`);
 		return;
 	}
-	const aborter = inflightAborts.get(requestId);
-	if (!aborter) return;
-	aborter.abort(/* @__PURE__ */ new Error("client requested cancellation"));
+	cancelInflight(requestId, "client requested cancellation");
 }
 async function handleRpc(_c, body) {
 	if (body === null || typeof body !== "object" || Array.isArray(body)) return {
@@ -6637,6 +6775,7 @@ const SSE_HEARTBEAT_INTERVAL_MS = 5e3;
 async function handleToolsCallSSE(body) {
 	const encoder = new TextEncoder();
 	const callPromise = handleToolsCall(body);
+	let heartbeatHandle;
 	const stream = new ReadableStream({
 		async start(controller) {
 			let closed = false;
@@ -6669,23 +6808,27 @@ async function handleToolsCallSSE(body) {
 				}
 			});
 			safeEnqueue(heartbeatFrame());
-			const heartbeatHandle = setInterval(() => safeEnqueue(heartbeatFrame()), SSE_HEARTBEAT_INTERVAL_MS);
+			heartbeatHandle = setInterval(() => safeEnqueue(heartbeatFrame()), SSE_HEARTBEAT_INTERVAL_MS);
 			try {
 				safeEnqueue(sseFrame(await callPromise));
 			} catch (err) {
 				consola.error("/mcp SSE upstream error:", err);
 				safeEnqueue(sseFrame(rpcError(body.id ?? null, RPC_INTERNAL_ERROR, err instanceof Error ? err.message : String(err))));
 			} finally {
-				clearInterval(heartbeatHandle);
+				if (heartbeatHandle !== void 0) {
+					clearInterval(heartbeatHandle);
+					heartbeatHandle = void 0;
+				}
 				safeClose();
 			}
 		},
 		cancel() {
-			const abortKey = body.id !== void 0 && body.id !== null ? body.id : void 0;
-			if (abortKey !== void 0) {
-				const aborter = inflightAborts.get(abortKey);
-				if (aborter) aborter.abort(/* @__PURE__ */ new Error("client disconnected SSE stream"));
+			if (heartbeatHandle !== void 0) {
+				clearInterval(heartbeatHandle);
+				heartbeatHandle = void 0;
 			}
+			const abortKey = body.id !== void 0 && body.id !== null ? body.id : void 0;
+			if (abortKey !== void 0) cancelInflight(abortKey, "client disconnected SSE stream");
 		}
 	});
 	return new Response(stream, {
@@ -6826,6 +6969,34 @@ async function readWithInactivityTimeout(reader, timeoutMs) {
 	}
 }
 /**
+* Race an `AsyncIterableIterator.next()` call against an inactivity timeout.
+*
+* Follows the same pattern as `readWithInactivityTimeout` (including the
+* noop catcher to avoid Node 24 unhandled-rejection crashes) but works
+* with typed iterators that yield parsed objects rather than raw bytes.
+*
+* On timeout, throws an `InactivityTimeout` error (same classification as
+* the byte-reader variant — surfaced to the consumer as `timeout_error` via
+* `buildOpenAIErrorEvent`).
+*
+* @param iterator - An AsyncIterableIterator whose `.next()` we want to race.
+* @param timeoutMs - Milliseconds before the timeout fires.
+*/
+async function readIteratorWithTimeout(iterator, timeoutMs) {
+	let timeoutHandle;
+	const timeoutPromise = new Promise((_, reject) => {
+		timeoutHandle = setTimeout(() => {
+			reject(Object.assign(/* @__PURE__ */ new Error("upstream_inactive"), { name: "InactivityTimeout" }));
+		}, timeoutMs);
+	});
+	timeoutPromise.catch(() => {});
+	try {
+		return await Promise.race([iterator.next(), timeoutPromise]);
+	} finally {
+		if (timeoutHandle !== void 0) clearTimeout(timeoutHandle);
+	}
+}
+/**
 * Build the SSE wire bytes for an Anthropic-format streaming error event.
 * Per Anthropic streaming spec, errors are sent as:
 *   event: error
@@ -7047,7 +7218,8 @@ function renderConversationAsText(conversation, maxChars = ADVISOR_MAX_CONVERSAT
 * Anthropic's own ADVISOR ("see the whole task + every tool call +
 * every result").
 */
-async function runAdvisor(conversation, advisorModel, advisorEffort) {
+async function runAdvisor(conversation, advisorModel, advisorEffort, signal) {
+	if (signal?.aborted) throw new Error("advisor call aborted before dispatch");
 	const advisorSystem = "You are an expert advisor reviewing an in-progress Claude Code session. The transcript below is the work-in-progress (turns numbered, with tool calls and results inlined). Read carefully and provide concrete, actionable advice on the next step or course-correction. Be specific — cite the parts of the transcript you're responding to. If the assistant is on the right track, say so explicitly. If they're stuck or off-track, name the specific assumption or step to revisit. Aim for 2-5 paragraphs of substantive guidance.";
 	const conversationText = renderConversationAsText(conversation);
 	const resolvedAdvisorModel = resolveModel(advisorModel);
@@ -7064,7 +7236,7 @@ async function runAdvisor(conversation, advisorModel, advisorEffort) {
 			}],
 			stream: false,
 			reasoning: { effort: advisorEffort }
-		});
+		}, void 0, signal);
 		const out = [];
 		for (const item of response.output) {
 			if (typeof item !== "object" || item === null) continue;
@@ -7091,7 +7263,7 @@ async function runAdvisor(conversation, advisorModel, advisorEffort) {
 			content: conversationText
 		}],
 		stream: false
-	}), {})).json();
+	}), {}, signal)).json();
 	const text = (Array.isArray(json.content) ? json.content : []).filter((b) => b.type === "text" && typeof b.text === "string").map((b) => b.text).join("\n\n");
 	if (!text) throw new Error(`Advisor model ${resolvedAdvisorModel} returned empty response`);
 	return text;
@@ -7140,284 +7312,305 @@ function sseEvent(type, data) {
 function buildAdvisorStream(opts) {
 	const advisorModel = opts.advisorModel ?? ADVISOR_DEFAULT_MODEL;
 	const advisorEffort = opts.advisorEffort ?? ADVISOR_DEFAULT_EFFORT;
-	return new ReadableStream({ async start(controller) {
-		const conversation = [...opts.initialConversation];
-		let messageStartForwarded = false;
-		let nextSyntheticIndex = 0;
-		let turnsRun = 0;
-		const safeEnqueue = (bytes) => {
-			try {
-				controller.enqueue(bytes);
-				return true;
-			} catch (err) {
-				if (isControllerClosedError(err)) return false;
-				throw err;
-			}
-		};
-		const safeEnqueueEvent = (type, data) => safeEnqueue(ENCODER$2.encode(sseEvent(type, data)));
-		async function processOneTurn(response) {
-			const capturedBlocks = [];
-			let advisorToolUse = null;
-			const indexToBlock = /* @__PURE__ */ new Map();
-			for await (const ev of events(response)) {
-				if (!ev.event || !ev.data) continue;
-				let payload;
+	const aborter = opts.externalAborter ?? new AbortController();
+	let conversation = [...opts.initialConversation];
+	return new ReadableStream({
+		async start(controller) {
+			let messageStartForwarded = false;
+			let nextSyntheticIndex = 0;
+			let turnsRun = 0;
+			const safeEnqueue = (bytes) => {
 				try {
-					payload = JSON.parse(ev.data);
-				} catch {
-					if (!safeEnqueue(ENCODER$2.encode(`event: ${ev.event}\ndata: ${ev.data}\n\n`))) return {
-						capturedBlocks,
-						advisorToolUse
-					};
-					continue;
+					controller.enqueue(bytes);
+					return true;
+				} catch (err) {
+					if (isControllerClosedError(err)) {
+						if (!aborter.signal.aborted) aborter.abort(/* @__PURE__ */ new Error("advisor stream consumer disconnected"));
+						return false;
+					}
+					throw err;
 				}
-				switch (ev.event) {
-					case "message_start":
-						if (!messageStartForwarded) {
-							if (!safeEnqueueEvent(ev.event, payload)) return {
-								capturedBlocks,
-								advisorToolUse
-							};
-							messageStartForwarded = true;
-						}
+			};
+			const safeEnqueueEvent = (type, data) => safeEnqueue(ENCODER$2.encode(sseEvent(type, data)));
+			async function processOneTurn(response) {
+				const capturedBlocks = [];
+				let advisorToolUse = null;
+				const indexToBlock = /* @__PURE__ */ new Map();
+				for await (const ev of events(response)) {
+					if (!ev.event || !ev.data) continue;
+					let payload;
+					try {
+						payload = JSON.parse(ev.data);
+					} catch {
+						if (!safeEnqueue(ENCODER$2.encode(`event: ${ev.event}\ndata: ${ev.data}\n\n`))) return {
+							capturedBlocks,
+							advisorToolUse
+						};
 						continue;
-					case "content_block_start": {
-						const block = payload.content_block;
-						const upstreamIndex = payload.index;
-						if (block && upstreamIndex !== void 0) {
-							const myIndex = nextSyntheticIndex++;
-							if (block.type === "tool_use" && block.name === ADVISOR_INTERNAL_TOOL_NAME) {
-								const id = typeof block.id === "string" ? block.id : `toolu_advisor_${myIndex}`;
-								advisorToolUse = {
-									index: myIndex,
-									id,
-									clientId: toClientServerToolUseId(id, myIndex),
-									inputJson: ""
-								};
-								const translated = {
-									...payload,
-									index: myIndex,
-									content_block: {
-										type: "server_tool_use",
-										id: advisorToolUse.clientId,
-										name: ADVISOR_CLIENT_TOOL_NAME,
-										input: {}
-									}
-								};
-								if (!safeEnqueueEvent(ev.event, translated)) return {
+					}
+					switch (ev.event) {
+						case "message_start":
+							if (!messageStartForwarded) {
+								if (!safeEnqueueEvent(ev.event, payload)) return {
 									capturedBlocks,
 									advisorToolUse
 								};
-								const captured = {
-									block: {
-										type: "tool_use",
+								messageStartForwarded = true;
+							}
+							continue;
+						case "content_block_start": {
+							const block = payload.content_block;
+							const upstreamIndex = payload.index;
+							if (block && upstreamIndex !== void 0) {
+								const myIndex = nextSyntheticIndex++;
+								if (block.type === "tool_use" && block.name === ADVISOR_INTERNAL_TOOL_NAME) {
+									const id = typeof block.id === "string" ? block.id : `toolu_advisor_${myIndex}`;
+									advisorToolUse = {
+										index: myIndex,
 										id,
-										name: ADVISOR_INTERNAL_TOOL_NAME,
-										input: {}
-									},
-									partialJson: "",
-									advisorReplay: { id }
-								};
-								capturedBlocks.push(captured);
-								indexToBlock.set(upstreamIndex, captured);
-							} else {
+										clientId: toClientServerToolUseId(id, myIndex),
+										inputJson: ""
+									};
+									const translated = {
+										...payload,
+										index: myIndex,
+										content_block: {
+											type: "server_tool_use",
+											id: advisorToolUse.clientId,
+											name: ADVISOR_CLIENT_TOOL_NAME,
+											input: {}
+										}
+									};
+									if (!safeEnqueueEvent(ev.event, translated)) return {
+										capturedBlocks,
+										advisorToolUse
+									};
+									const captured = {
+										block: {
+											type: "tool_use",
+											id,
+											name: ADVISOR_INTERNAL_TOOL_NAME,
+											input: {}
+										},
+										partialJson: "",
+										advisorReplay: { id }
+									};
+									capturedBlocks.push(captured);
+									indexToBlock.set(upstreamIndex, captured);
+								} else {
+									const reindexed = {
+										...payload,
+										index: myIndex
+									};
+									if (!safeEnqueueEvent(ev.event, reindexed)) return {
+										capturedBlocks,
+										advisorToolUse
+									};
+									const captured = {
+										block: { ...block },
+										partialJson: ""
+									};
+									capturedBlocks.push(captured);
+									indexToBlock.set(upstreamIndex, captured);
+								}
+							}
+							continue;
+						}
+						case "content_block_delta": {
+							const upstreamIndex = payload.index;
+							const delta = payload.delta;
+							if (upstreamIndex !== void 0) {
+								const captured = upstreamIndex !== void 0 ? indexToBlock.get(upstreamIndex) : void 0;
 								const reindexed = {
 									...payload,
-									index: myIndex
+									index: captured ? capturedBlocks.indexOf(captured) >= 0 ? nextSyntheticIndex - capturedBlocks.length + capturedBlocks.indexOf(captured) : upstreamIndex : upstreamIndex
 								};
 								if (!safeEnqueueEvent(ev.event, reindexed)) return {
 									capturedBlocks,
 									advisorToolUse
 								};
-								const captured = {
-									block: { ...block },
-									partialJson: ""
-								};
-								capturedBlocks.push(captured);
-								indexToBlock.set(upstreamIndex, captured);
-							}
+								if (captured && delta) {
+									if (delta.type === "text_delta" && typeof delta.text === "string") captured.block.text = (captured.block.text ?? "") + delta.text;
+									else if (delta.type === "thinking_delta" && typeof delta.thinking === "string") captured.block.thinking = (captured.block.thinking ?? "") + delta.thinking;
+									else if (delta.type === "signature_delta" && typeof delta.signature === "string") captured.block.signature = (captured.block.signature ?? "") + delta.signature;
+									else if (delta.type === "input_json_delta" && typeof delta.partial_json === "string") captured.partialJson += delta.partial_json;
+									else if (delta.type === "citations_delta" && delta.citation) {
+										if (!Array.isArray(captured.block.citations)) captured.block.citations = [];
+										captured.block.citations.push(delta.citation);
+									}
+								}
+							} else if (!safeEnqueueEvent(ev.event, payload)) return {
+								capturedBlocks,
+								advisorToolUse
+							};
+							continue;
 						}
-						continue;
-					}
-					case "content_block_delta": {
-						const upstreamIndex = payload.index;
-						const delta = payload.delta;
-						if (upstreamIndex !== void 0) {
+						case "content_block_stop": {
+							const upstreamIndex = payload.index;
 							const captured = upstreamIndex !== void 0 ? indexToBlock.get(upstreamIndex) : void 0;
 							const reindexed = {
 								...payload,
-								index: captured ? capturedBlocks.indexOf(captured) >= 0 ? nextSyntheticIndex - capturedBlocks.length + capturedBlocks.indexOf(captured) : upstreamIndex : upstreamIndex
+								index: captured ? nextSyntheticIndex - capturedBlocks.length + capturedBlocks.indexOf(captured) : upstreamIndex ?? 0
 							};
 							if (!safeEnqueueEvent(ev.event, reindexed)) return {
 								capturedBlocks,
 								advisorToolUse
 							};
-							if (captured && delta) {
-								if (delta.type === "text_delta" && typeof delta.text === "string") captured.block.text = (captured.block.text ?? "") + delta.text;
-								else if (delta.type === "thinking_delta" && typeof delta.thinking === "string") captured.block.thinking = (captured.block.thinking ?? "") + delta.thinking;
-								else if (delta.type === "signature_delta" && typeof delta.signature === "string") captured.block.signature = (captured.block.signature ?? "") + delta.signature;
-								else if (delta.type === "input_json_delta" && typeof delta.partial_json === "string") captured.partialJson += delta.partial_json;
-								else if (delta.type === "citations_delta" && delta.citation) {
-									if (!Array.isArray(captured.block.citations)) captured.block.citations = [];
-									captured.block.citations.push(delta.citation);
+							if (captured) {
+								if (captured.block.type === "tool_use" && captured.partialJson.length > 0) try {
+									captured.block.input = JSON.parse(captured.partialJson);
+								} catch (err) {
+									consola.warn(`advisor: malformed input_json_delta for tool_use id=${captured.block.id ?? "?"} name=${captured.block.name ?? "?"} partialJson.length=${captured.partialJson.length} parseError=${err instanceof Error ? err.message : String(err)}`);
+									captured.block.input = {};
 								}
+								if (captured.block.type === "text" && (typeof captured.block.text !== "string" || captured.block.text.length === 0)) captured.dropFromReplay = true;
 							}
-						} else if (!safeEnqueueEvent(ev.event, payload)) return {
-							capturedBlocks,
-							advisorToolUse
-						};
-						continue;
-					}
-					case "content_block_stop": {
-						const upstreamIndex = payload.index;
-						const captured = upstreamIndex !== void 0 ? indexToBlock.get(upstreamIndex) : void 0;
-						const reindexed = {
-							...payload,
-							index: captured ? nextSyntheticIndex - capturedBlocks.length + capturedBlocks.indexOf(captured) : upstreamIndex ?? 0
-						};
-						if (!safeEnqueueEvent(ev.event, reindexed)) return {
-							capturedBlocks,
-							advisorToolUse
-						};
-						if (captured) {
-							if (captured.block.type === "tool_use" && captured.partialJson.length > 0) try {
-								captured.block.input = JSON.parse(captured.partialJson);
-							} catch (err) {
-								consola.warn(`advisor: malformed input_json_delta for tool_use id=${captured.block.id ?? "?"} name=${captured.block.name ?? "?"} partialJson.length=${captured.partialJson.length} parseError=${err instanceof Error ? err.message : String(err)}`);
-								captured.block.input = {};
-							}
-							if (captured.block.type === "text" && (typeof captured.block.text !== "string" || captured.block.text.length === 0)) captured.dropFromReplay = true;
+							continue;
 						}
-						continue;
-					}
-					case "message_delta":
-						if (!safeEnqueueEvent(ev.event, payload)) return {
-							capturedBlocks,
-							advisorToolUse
-						};
-						continue;
-					case "message_stop":
-						if (advisorToolUse) return {
-							capturedBlocks,
-							advisorToolUse
-						};
-						if (!safeEnqueueEvent(ev.event, payload)) return {
-							capturedBlocks,
-							advisorToolUse
-						};
-						return {
+						case "message_delta":
+							if (!safeEnqueueEvent(ev.event, payload)) return {
+								capturedBlocks,
+								advisorToolUse
+							};
+							continue;
+						case "message_stop":
+							if (advisorToolUse) return {
+								capturedBlocks,
+								advisorToolUse
+							};
+							if (!safeEnqueueEvent(ev.event, payload)) return {
+								capturedBlocks,
+								advisorToolUse
+							};
+							return {
+								capturedBlocks,
+								advisorToolUse
+							};
+						default: if (!safeEnqueueEvent(ev.event, payload)) return {
 							capturedBlocks,
 							advisorToolUse
 						};
-					default: if (!safeEnqueueEvent(ev.event, payload)) return {
-						capturedBlocks,
-						advisorToolUse
-					};
+					}
 				}
+				return {
+					capturedBlocks,
+					advisorToolUse
+				};
 			}
-			return {
-				capturedBlocks,
-				advisorToolUse
-			};
-		}
-		try {
-			let response = opts.firstResponse;
-			for (turnsRun = 0; turnsRun < ADVISOR_MAX_TURNS; turnsRun++) {
-				const { capturedBlocks, advisorToolUse } = await processOneTurn(response);
-				if (!advisorToolUse) return;
-				const assistantTurn = {
-					role: "assistant",
-					content: capturedBlocks.filter((c) => !c.dropFromReplay).map((c) => {
-						if (c.advisorReplay) {
-							const input = typeof c.block.input === "object" && c.block.input !== null ? c.block.input : {};
-							return {
-								type: "tool_use",
-								id: c.advisorReplay.id,
-								name: ADVISOR_INTERNAL_TOOL_NAME,
-								input
-							};
+			try {
+				let response = opts.firstResponse;
+				for (turnsRun = 0; turnsRun < ADVISOR_MAX_TURNS; turnsRun++) {
+					if (aborter.signal.aborted) return;
+					if (conversation === null) return;
+					const { capturedBlocks, advisorToolUse } = await processOneTurn(response);
+					if (!advisorToolUse) return;
+					if (aborter.signal.aborted) return;
+					if (conversation === null) return;
+					const assistantTurn = {
+						role: "assistant",
+						content: capturedBlocks.filter((c) => !c.dropFromReplay).map((c) => {
+							if (c.advisorReplay) {
+								const input = typeof c.block.input === "object" && c.block.input !== null ? c.block.input : {};
+								return {
+									type: "tool_use",
+									id: c.advisorReplay.id,
+									name: ADVISOR_INTERNAL_TOOL_NAME,
+									input
+								};
+							}
+							return c.block;
+						})
+					};
+					conversation.push(assistantTurn);
+					let advisorText;
+					try {
+						advisorText = await runAdvisor(conversation, advisorModel, advisorEffort, aborter.signal);
+					} catch (err) {
+						if (aborter.signal.aborted) return;
+						const msg = err instanceof Error ? err.message : String(err);
+						consola.warn(`Advisor model call failed: ${msg}`);
+						advisorText = `[Advisor unavailable: ${msg}. Continuing without external review — proceed with caution and consider self-checking against your primary-source evidence.]`;
+					}
+					if (aborter.signal.aborted) return;
+					if (conversation === null) return;
+					const resultIndex = nextSyntheticIndex++;
+					if (!safeEnqueueEvent("content_block_start", {
+						type: "content_block_start",
+						index: resultIndex,
+						content_block: {
+							type: "advisor_tool_result",
+							tool_use_id: advisorToolUse.clientId,
+							content: {
+								type: "advisor_result",
+								text: advisorText
+							}
 						}
-						return c.block;
-					})
-				};
-				conversation.push(assistantTurn);
-				let advisorText;
-				try {
-					advisorText = await runAdvisor(conversation, advisorModel, advisorEffort);
-				} catch (err) {
-					const msg = err instanceof Error ? err.message : String(err);
-					consola.warn(`Advisor model call failed: ${msg}`);
-					advisorText = `[Advisor unavailable: ${msg}. Continuing without external review — proceed with caution and consider self-checking against your primary-source evidence.]`;
+					})) return;
+					if (!safeEnqueueEvent("content_block_stop", {
+						type: "content_block_stop",
+						index: resultIndex
+					})) return;
+					conversation.push({
+						role: "user",
+						content: [{
+							type: "tool_result",
+							tool_use_id: advisorToolUse.id,
+							content: advisorText
+						}]
+					});
+					if (aborter.signal.aborted) return;
+					response = await createMessages(JSON.stringify({
+						...opts.baseBody,
+						messages: conversation,
+						stream: true
+					}), opts.requestHeaders, aborter.signal);
 				}
-				const resultIndex = nextSyntheticIndex++;
-				if (!safeEnqueueEvent("content_block_start", {
+				if (aborter.signal.aborted) return;
+				const finalIndex = nextSyntheticIndex++;
+				safeEnqueueEvent("content_block_start", {
 					type: "content_block_start",
-					index: resultIndex,
+					index: finalIndex,
 					content_block: {
-						type: "advisor_tool_result",
-						tool_use_id: advisorToolUse.clientId,
-						content: {
-							type: "advisor_result",
-							text: advisorText
-						}
+						type: "text",
+						text: ""
+					}
+				});
+				safeEnqueueEvent("content_block_delta", {
+					type: "content_block_delta",
+					index: finalIndex,
+					delta: {
+						type: "text_delta",
+						text: `\n\n[Advisor loop exceeded ${ADVISOR_MAX_TURNS} turns; halting]`
 					}
-				})) return;
-				if (!safeEnqueueEvent("content_block_stop", {
+				});
+				safeEnqueueEvent("content_block_stop", {
 					type: "content_block_stop",
-					index: resultIndex
-				})) return;
-				conversation.push({
-					role: "user",
-					content: [{
-						type: "tool_result",
-						tool_use_id: advisorToolUse.id,
-						content: advisorText
-					}]
+					index: finalIndex
 				});
-				response = await createMessages(JSON.stringify({
-					...opts.baseBody,
-					messages: conversation,
-					stream: true
-				}), opts.requestHeaders);
+				safeEnqueueEvent("message_stop", { type: "message_stop" });
+			} catch (err) {
+				if (aborter.signal.aborted) return;
+				const msg = err instanceof Error ? err.message : String(err);
+				consola.error(`Advisor stream error: ${msg}`);
+				safeEnqueueEvent("error", {
+					type: "error",
+					error: {
+						type: "api_error",
+						message: `advisor loop failed: ${msg}`
+					}
+				});
+			} finally {
+				conversation = null;
+				try {
+					controller.close();
+				} catch {}
 			}
-			const finalIndex = nextSyntheticIndex++;
-			safeEnqueueEvent("content_block_start", {
-				type: "content_block_start",
-				index: finalIndex,
-				content_block: {
-					type: "text",
-					text: ""
-				}
-			});
-			safeEnqueueEvent("content_block_delta", {
-				type: "content_block_delta",
-				index: finalIndex,
-				delta: {
-					type: "text_delta",
-					text: `\n\n[Advisor loop exceeded ${ADVISOR_MAX_TURNS} turns; halting]`
-				}
-			});
-			safeEnqueueEvent("content_block_stop", {
-				type: "content_block_stop",
-				index: finalIndex
-			});
-			safeEnqueueEvent("message_stop", { type: "message_stop" });
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			consola.error(`Advisor stream error: ${msg}`);
-			safeEnqueueEvent("error", {
-				type: "error",
-				error: {
-					type: "api_error",
-					message: `advisor loop failed: ${msg}`
-				}
-			});
-		} finally {
-			try {
-				controller.close();
-			} catch {}
+		},
+		cancel(reason) {
+			if (!aborter.signal.aborted) aborter.abort(/* @__PURE__ */ new Error(`advisor stream cancelled: ${reason instanceof Error ? reason.message : String(reason ?? "no reason")}`));
+			conversation = null;
 		}
-	} });
+	});
 }
 
 //#endregion
@@ -7480,22 +7673,24 @@ function mcpHeaders(sid) {
 	if (sid) headers["Mcp-Session-Id"] = sid;
 	return headers;
 }
-async function postMcp(body, sid, retry = true) {
+async function postMcp(body, sid, retry = true, signal) {
 	const url = `${copilotBaseUrl(state)}/mcp`;
 	const res = await fetch(url, {
 		method: "POST",
 		headers: mcpHeaders(sid),
-		body: JSON.stringify(body)
+		body: JSON.stringify(body),
+		signal
 	});
 	if (!res.ok && retry && res.status >= 500) {
 		await sleep(500);
-		return postMcp(body, sid, false);
+		return postMcp(body, sid, false, signal);
 	}
 	return res;
 }
-async function searchWeb(query) {
+async function searchWeb(query, signal) {
 	await throttleSearch();
 	consola.info(`Web search (MCP): "${query.slice(0, 80)}"`);
+	if (signal?.aborted) throw new Error("web search aborted before dispatch");
 	const callId = Math.floor(Math.random() * 1e9);
 	let sid;
 	try {
@@ -7511,7 +7706,7 @@ async function searchWeb(query) {
 					version: copilotVersion(state)
 				}
 			}
-		});
+		}, void 0, true, signal);
 		if (!initRes.ok) {
 			consola.error("MCP initialize failed", initRes.status);
 			throw new HTTPError("MCP initialize failed", initRes);
@@ -7521,7 +7716,7 @@ async function searchWeb(query) {
 		const notifRes = await postMcp({
 			jsonrpc: "2.0",
 			method: "notifications/initialized"
-		}, sid);
+		}, sid, true, signal);
 		if (!notifRes.ok && notifRes.status !== 202) {
 			consola.error("MCP notifications/initialized failed", notifRes.status);
 			throw new HTTPError("MCP notifications/initialized failed", notifRes);
@@ -7534,13 +7729,14 @@ async function searchWeb(query) {
 				name: "web_search",
 				arguments: { query }
 			}
-		}, sid);
+		}, sid, true, signal);
 		if (!callRes.ok) {
 			consola.error("MCP tools/call failed", callRes.status);
 			throw new HTTPError("MCP tools/call failed", callRes);
 		}
 		let rpc;
 		for await (const ev of events(callRes)) {
+			if (signal?.aborted) throw new Error("web search aborted during SSE stream");
 			if (!ev.data) continue;
 			let parsedJson;
 			try {
@@ -9880,7 +10076,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 				description: "The search query string. Natural-language queries work best — the upstream provider rewrites for the search index."
 			} }
 		},
-		async handler(args, _signal) {
+		async handler(args, signal) {
 			const query = typeof args.query === "string" ? args.query : "";
 			if (!query) return {
 				content: [{
@@ -9892,7 +10088,7 @@ const NON_PERSONA_MCP_TOOLS = Object.freeze([
 			try {
 				return { content: [{
 					type: "text",
-					text: formatWebSearchResult(await searchWeb(query))
+					text: formatWebSearchResult(await searchWeb(query, signal))
 				}] };
 			} catch (err) {
 				return {
@@ -10752,9 +10948,11 @@ function rotateIfNeeded(filePath) {
 		fs$1.renameSync(filePath, filePath + ".1");
 	} catch {}
 }
-var FileLogReporter = class {
+var FileLogReporter = class FileLogReporter {
 	filePath;
 	seen = /* @__PURE__ */ new Set();
+	bytesSinceCheck = 0;
+	static ROTATE_CHECK_BYTES = MAX_LOG_BYTES / 2;
 	constructor(filePath) {
 		this.filePath = filePath;
 		rotateIfNeeded(filePath);
@@ -10766,6 +10964,11 @@ var FileLogReporter = class {
 		if (this.seen.size >= DEDUP_MAX) this.seen.clear();
 		this.seen.add(key);
 		const line = formatLogLine(logObj);
+		this.bytesSinceCheck += line.length;
+		if (this.bytesSinceCheck >= FileLogReporter.ROTATE_CHECK_BYTES) {
+			rotateIfNeeded(this.filePath);
+			this.bytesSinceCheck = 0;
+		}
 		let fd;
 		try {
 			fd = fs$1.openSync(this.filePath, "a", 384);
@@ -10895,7 +11098,7 @@ function initProxyFromEnv() {
 //#endregion
 //#region package.json
 var name = "github-router";
-var version = "0.3.35";
+var version = "0.3.37";
 
 //#endregion
 //#region src/lib/approval.ts
@@ -11312,7 +11515,7 @@ async function handleCompletion$1(c) {
 		return c.json(response);
 	}
 	const iterator = response[Symbol.asyncIterator]();
-	const firstResult = await iterator.next();
+	const firstResult = await readIteratorWithTimeout(iterator, UPSTREAM_INACTIVITY_TIMEOUT_MS);
 	if (firstResult.done) consola.warn(`Upstream /chat/completions returned an empty stream at ${c.req.path}`);
 	let pendingFirstChunk = firstResult.done ? void 0 : firstResult.value;
 	let upstreamFinished = firstResult.done;
@@ -11352,7 +11555,7 @@ async function handleCompletion$1(c) {
 				return;
 			}
 			try {
-				const result = await iterator.next();
+				const result = await readIteratorWithTimeout(iterator, UPSTREAM_INACTIVITY_TIMEOUT_MS);
 				if (consumerCancelled) {
 					safeClose(controller);
 					return;
@@ -11673,22 +11876,6 @@ function sanitizeAnthropicBody(rawBody) {
 	return JSON.stringify(parsed);
 }
 
-//#endregion
-//#region src/lib/diagnose-response.ts
-const PREVIEW_LIMIT = 200;
-async function parseJsonOrDiagnose(response, routePath) {
-	const cloned = response.clone();
-	try {
-		return await response.json();
-	} catch (error) {
-		const contentType = response.headers.get("content-type") ?? "(none)";
-		const bodyText = await cloned.text().catch(() => "(unreadable)");
-		const preview = bodyText.length > PREVIEW_LIMIT ? bodyText.slice(0, PREVIEW_LIMIT) + "...(truncated)" : bodyText;
-		consola.error(`Upstream JSON parse failed at ${routePath}: status=${response.status} content-type="${contentType}" body[0..${PREVIEW_LIMIT}]=${JSON.stringify(preview)}`);
-		throw error;
-	}
-}
-
 //#endregion
 //#region src/routes/messages/count-tokens-handler.ts
 const isWebSearchTool$1 = (tool) => typeof tool.type === "string" && tool.type.startsWith("web_search") || tool.name === "web_search";
@@ -11998,12 +12185,13 @@ async function handleCompletion(c) {
 	const modelId = resolvedModel ?? originalModel;
 	if (modelId) logEndpointMismatch(modelId, "/v1/messages");
 	const effectiveBetas = applyDefaultBetas(betaHeaders, resolvedModel ?? originalModel);
+	const advisorAborter = advisorEnabled ? new AbortController() : void 0;
 	let response;
 	try {
 		response = await createMessages(resolvedBody, {
 			...selectedModel?.requestHeaders,
 			...effectiveBetas
-		});
+		}, advisorAborter?.signal);
 	} catch (error) {
 		if (error instanceof HTTPError) {
 			const errorBody = await error.response.clone().text().catch(() => "");
@@ -12061,7 +12249,8 @@ async function handleCompletion(c) {
 				requestHeaders: {
 					...selectedModel?.requestHeaders,
 					...effectiveBetas
-				}
+				},
+				externalAborter: advisorAborter
 			}), {
 				status: response.status,
 				headers: streamHeaders
@@ -12072,7 +12261,9 @@ async function handleCompletion(c) {
 			headers: streamHeaders
 		});
 	}
-	const responseBody = await parseJsonOrDiagnose(response, c.req.path);
+	const cappedResult = await readResponseBodyCapped(response, c.req.path, MAX_RESPONSE_BODY_BYTES);
+	if (!cappedResult.ok) return c.json(cappedResult.errorResponse, cappedResult.status);
+	const responseBody = cappedResult.value;
 	logRequest({
 		method: "POST",
 		path: c.req.path,
@@ -12423,7 +12614,7 @@ async function handleResponses(c) {
 	let firstChunk;
 	let upstreamFinished = false;
 	while (true) {
-		const r = await iterator.next();
+		const r = await readIteratorWithTimeout(iterator, UPSTREAM_INACTIVITY_TIMEOUT_MS);
 		if (r.done) {
 			upstreamFinished = true;
 			break;
@@ -12475,7 +12666,7 @@ async function handleResponses(c) {
 				return;
 			}
 			try {
-				const result = await iterator.next();
+				const result = await readIteratorWithTimeout(iterator, UPSTREAM_INACTIVITY_TIMEOUT_MS);
 				if (consumerCancelled) {
 					safeClose(controller);
 					return;
@@ -12584,11 +12775,14 @@ async function handleResponsesCompact(c) {
 	if (!state.copilotToken) throw new Error("Copilot token not found");
 	if (state.manualApprove) await awaitApproval();
 	const body = await c.req.json();
-	const response = await fetch(`${copilotBaseUrl(state)}/responses/compact`, {
+	const compactUrl = `${copilotBaseUrl(state)}/responses/compact`;
+	const doFetch = () => fetch(compactUrl, {
 		method: "POST",
 		headers: copilotHeaders(state),
-		body: JSON.stringify(body)
+		body: JSON.stringify(body),
+		signal: AbortSignal.timeout(UPSTREAM_FETCH_TIMEOUT_MS || 3e5)
 	});
+	const response = await tryRefreshAndRetry(doFetch, "/responses/compact");
 	if (response.ok) {
 		logRequest({
 			method: "POST",
@@ -12599,6 +12793,7 @@ async function handleResponsesCompact(c) {
 	}
 	if (response.status === 404) {
 		consola.debug("Copilot API does not support /responses/compact, using synthetic compaction");
+		await response.body?.cancel().catch(() => {});
 		return await syntheticCompact(c, body, startTime);
 	}
 	logRequest({