llm-cli-gateway 2.12.0 → 2.12.2

package/dist/config.js

@@ -185,6 +185,93 @@ export function loadPersistenceConfig(logger = noopLogger) {
         sources,
     };
 }
+export const DEFAULT_HTTP_MAX_SESSIONS = 100;
+export const DEFAULT_HTTP_SESSION_IDLE_TTL_MS = 30 * 60 * 1000;
+export const DEFAULT_HTTP_SESSION_REAPER_INTERVAL_MS = 60 * 1000;
+export const DEFAULT_MAX_RUNNING_JOBS = 32;
+export const DEFAULT_MAX_RUNNING_JOBS_PER_PROVIDER = 16;
+export const DEFAULT_MAX_QUEUED_JOBS = 128;
+export const DEFAULT_QUEUE_TIMEOUT_MS = 120000;
+export const DEFAULT_COMPLETED_JOB_MEMORY_TTL_MS = 60 * 60 * 1000;
+export const DEFAULT_MAX_JOB_OUTPUT_BYTES = 50 * 1024 * 1024;
+const HttpSessionLimitsSchema = z
+    .object({
+    max_sessions: z.number().int().positive().default(DEFAULT_HTTP_MAX_SESSIONS),
+    session_idle_ttl_ms: z.number().int().positive().default(DEFAULT_HTTP_SESSION_IDLE_TTL_MS),
+    session_reaper_interval_ms: z
+        .number()
+        .int()
+        .positive()
+        .default(DEFAULT_HTTP_SESSION_REAPER_INTERVAL_MS),
+})
+    .passthrough();
+const JobLimitsSchema = z
+    .object({
+    max_running_jobs: z.number().int().positive().default(DEFAULT_MAX_RUNNING_JOBS),
+    max_running_jobs_per_provider: z
+        .number()
+        .int()
+        .positive()
+        .default(DEFAULT_MAX_RUNNING_JOBS_PER_PROVIDER),
+    max_queued_jobs: z.number().int().positive().default(DEFAULT_MAX_QUEUED_JOBS),
+    queue_timeout_ms: z.number().int().positive().default(DEFAULT_QUEUE_TIMEOUT_MS),
+    completed_job_memory_ttl_ms: z
+        .number()
+        .int()
+        .positive()
+        .default(DEFAULT_COMPLETED_JOB_MEMORY_TTL_MS),
+    max_job_output_bytes: z.number().int().positive().default(DEFAULT_MAX_JOB_OUTPUT_BYTES),
+})
+    .strict();
+export const DEFAULT_HTTP_SESSION_LIMITS = {
+    maxSessions: DEFAULT_HTTP_MAX_SESSIONS,
+    sessionIdleTtlMs: DEFAULT_HTTP_SESSION_IDLE_TTL_MS,
+    sessionReaperIntervalMs: DEFAULT_HTTP_SESSION_REAPER_INTERVAL_MS,
+};
+export const DEFAULT_JOB_LIMITS = {
+    maxRunningJobs: DEFAULT_MAX_RUNNING_JOBS,
+    maxRunningJobsPerProvider: DEFAULT_MAX_RUNNING_JOBS_PER_PROVIDER,
+    maxQueuedJobs: DEFAULT_MAX_QUEUED_JOBS,
+    queueTimeoutMs: DEFAULT_QUEUE_TIMEOUT_MS,
+    completedJobMemoryTtlMs: DEFAULT_COMPLETED_JOB_MEMORY_TTL_MS,
+    maxJobOutputBytes: DEFAULT_MAX_JOB_OUTPUT_BYTES,
+};
+export function loadLimitsConfig(logger = noopLogger) {
+    const configPath = defaultGatewayConfigPath();
+    const { parsed, sourcePath } = readGatewayTomlFile(configPath, logger, "limits");
+    const rawHttp = parsed?.http ?? {};
+    const rawLimits = parsed?.limits ?? {};
+    let httpParsed;
+    try {
+        httpParsed = HttpSessionLimitsSchema.parse(rawHttp);
+    }
+    catch (err) {
+        throw new Error(`Invalid [http] session-limit config: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    let limitsParsed;
+    try {
+        limitsParsed = JobLimitsSchema.parse(rawLimits);
+    }
+    catch (err) {
+        throw new Error(`Invalid [limits] config: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return {
+        http: {
+            maxSessions: httpParsed.max_sessions,
+            sessionIdleTtlMs: httpParsed.session_idle_ttl_ms,
+            sessionReaperIntervalMs: httpParsed.session_reaper_interval_ms,
+        },
+        jobs: {
+            maxRunningJobs: limitsParsed.max_running_jobs,
+            maxRunningJobsPerProvider: limitsParsed.max_running_jobs_per_provider,
+            maxQueuedJobs: limitsParsed.max_queued_jobs,
+            queueTimeoutMs: limitsParsed.queue_timeout_ms,
+            completedJobMemoryTtlMs: limitsParsed.completed_job_memory_ttl_ms,
+            maxJobOutputBytes: limitsParsed.max_job_output_bytes,
+        },
+        sources: { configFile: sourcePath },
+    };
+}
 export const ANTHROPIC_TTL_SECONDS_VALUES = [300, 3600];
 export const DEFAULT_MIN_STABLE_TOKENS_FOR_CACHE_CONTROL = {
     sonnet: 1024,
@@ -386,6 +473,9 @@ export function isApiProviderEnabled(provider, env = process.env) {
         return true;
     return provider.kind === "openai-compatible" && isLoopbackUrl(provider.baseUrl);
 }
+export function apiProviderKeyPresent(provider, env = process.env) {
+    return resolveProviderKey(provider.apiKeyEnv, env) !== null;
+}
 export function enabledApiProviders(config, env = process.env) {
     const runtimes = [];
     for (const provider of Object.values(config.providers ?? {})) {
@@ -394,6 +484,7 @@ export function enabledApiProviders(config, env = process.env) {
         runtimes.push({
             name: provider.name,
             kind: provider.kind,
+            apiKeyEnv: provider.apiKeyEnv,
             baseUrl: provider.baseUrl,
             defaultModel: provider.defaultModel,
             models: provider.models,

package/dist/doctor.d.ts

@@ -1,7 +1,8 @@
 import { type EndpointExposureReport } from "./endpoint-exposure.js";
 import { type ProviderLoginStatus } from "./provider-status.js";
+import { type ApiProviderLoginGuidance } from "./provider-login-guidance.js";
 import type { FlightRecorderQuery } from "./flight-recorder.js";
-import { type CacheAwarenessConfig } from "./config.js";
+import { type CacheAwarenessConfig, type ProvidersConfig } from "./config.js";
 import { type ProviderCapabilityId, type ProviderKind } from "./provider-tool-capabilities.js";
 export type CliType = "claude" | "codex" | "gemini" | "grok" | "mistral" | "devin";
 export interface CacheAwarenessReport {
@@ -38,6 +39,22 @@ export interface ProviderCapabilitySummaryReport {
         warnings: string[];
     }>;
 }
+export interface ApiProviderHealthEntry {
+    name: string;
+    kind: "openai-compatible" | "anthropic" | "xai-responses";
+    base_url: string;
+    default_model: string;
+    models: string[] | null;
+    api_key_env: string | null;
+    api_key_present: boolean;
+    reachable: boolean | null;
+    reachability_error?: string;
+    login_guidance: ApiProviderLoginGuidance;
+}
+export interface ApiProviderHealthReport {
+    enabled_count: number;
+    providers: Record<string, ApiProviderHealthEntry>;
+}
 export interface VibeSessionLoggingStatus {
     config_path: string;
     config_present: boolean;
@@ -138,6 +155,7 @@ export interface DoctorReport {
     };
     cache_awareness: CacheAwarenessReport;
     provider_capabilities: ProviderCapabilitySummaryReport;
+    api_providers?: ApiProviderHealthReport;
     upstream: {
         note: string;
         recommendation: string;
@@ -154,8 +172,18 @@ export interface CreateDoctorReportOptions {
     flightRecorder?: FlightRecorderQuery;
     cacheAwareness?: CacheAwarenessConfig;
     probeUpstream?: boolean;
+    providersConfig?: ProvidersConfig;
+    apiReachability?: Record<string, {
+        reachable: boolean;
+        error?: string;
+    }>;
 }
 export declare function createDoctorReport(envOrOptions?: NodeJS.ProcessEnv | CreateDoctorReportOptions): DoctorReport;
 export declare function printDoctorJson(opts?: {
     probeUpstream?: boolean;
-}): void;
+    probeApiProviders?: boolean;
+}): Promise<void>;
+export declare function probeApiProviderReachability(baseUrl: string, timeoutMs?: number): Promise<{
+    reachable: boolean;
+    error?: string;
+}>;

package/dist/doctor.js

@@ -4,14 +4,15 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadAuthConfig } from "./auth.js";
 import { createEndpointExposureReport, redactDiagnosticUrl, } from "./endpoint-exposure.js";
-import { listProviderRuntimeStatuses, } from "./provider-status.js";
+import { getApiProviderStatus, listProviderRuntimeStatuses, } from "./provider-status.js";
+import { getApiProviderLoginGuidance, } from "./provider-login-guidance.js";
 import { CLAUDE_MCP_SERVER_NAMES } from "./claude-mcp-config.js";
-import { loadCacheAwarenessConfig, loadRemoteOAuthConfig, } from "./config.js";
+import { enabledApiProviders, loadCacheAwarenessConfig, loadProvidersConfig, loadRemoteOAuthConfig, } from "./config.js";
 import { loadWorkspaceRegistry } from "./workspace-registry.js";
 import { computeGlobalCacheStats } from "./cache-stats.js";
 import { FlightRecorder, resolveFlightRecorderDbPath } from "./flight-recorder.js";
 import { buildUpstreamContractReport } from "./upstream-contracts.js";
-import { getProviderToolCapabilities, providerCapabilityIds, } from "./provider-tool-capabilities.js";
+import { getProviderToolCapabilities, knownProviderCapabilityIds, } from "./provider-tool-capabilities.js";
 export function checkVibeSessionLogging(home = homedir()) {
     const configPath = join(home, ".vibe", "config.toml");
     if (!existsSync(configPath)) {
@@ -172,6 +173,34 @@ function chatGPTConnectorUrl(env, rawPublicUrl) {
         return null;
     return "<redacted>";
 }
+function buildApiProviderHealthReport(opts, env) {
+    const config = opts.providersConfig;
+    if (!config)
+        return undefined;
+    const providers = {};
+    for (const providerConfig of Object.values(config.providers)) {
+        const status = getApiProviderStatus(providerConfig, env);
+        if (!status.enabled)
+            continue;
+        const probe = opts.apiReachability?.[status.provider];
+        providers[status.provider] = {
+            name: status.provider,
+            kind: status.kind,
+            base_url: status.baseUrl,
+            default_model: status.defaultModel,
+            models: status.models,
+            api_key_env: status.apiKeyEnv,
+            api_key_present: status.apiKeyPresent,
+            reachable: probe ? probe.reachable : null,
+            ...(probe?.error ? { reachability_error: probe.error } : {}),
+            login_guidance: getApiProviderLoginGuidance(providerConfig),
+        };
+    }
+    const names = Object.keys(providers);
+    if (names.length === 0)
+        return undefined;
+    return { enabled_count: names.length, providers };
+}
 function buildCacheAwarenessReport(opts) {
     const enabled = [];
     if (opts.cacheAwareness?.emitAnthropicCacheControl) {
@@ -234,7 +263,7 @@ function buildProviderCapabilitySummary(providerStatuses) {
         includeUnsupported: true,
         includePaths: false,
     });
-    const providers = Object.fromEntries(providerCapabilityIds().map(provider => {
+    const providers = Object.fromEntries(knownProviderCapabilityIds().map(provider => {
         const capability = capabilities[provider];
         if (!capability) {
             throw new Error(`Missing provider capability record for ${provider}`);
@@ -264,7 +293,7 @@ function buildProviderCapabilitySummary(providerStatuses) {
         tool: "provider_tool_capabilities",
         resources: {
             catalog: "provider-tools://catalog",
-            providers: Object.fromEntries(providerCapabilityIds().map(provider => [provider, `provider-tools://${provider}`])),
+            providers: Object.fromEntries(knownProviderCapabilityIds().map(provider => [provider, `provider-tools://${provider}`])),
         },
         cache_ttl_ms: 60_000,
         providers,
@@ -364,6 +393,10 @@ export function createDoctorReport(envOrOptions = process.env) {
         upstream,
         next_actions: [],
     };
+    const apiProviders = buildApiProviderHealthReport(opts, env);
+    if (apiProviders) {
+        report.api_providers = apiProviders;
+    }
     if (transport === "http" && auth.required && !auth.tokenConfigured) {
         report.ok = false;
         report.next_actions.push("Set LLM_GATEWAY_AUTH_TOKEN before starting HTTP transport.");
@@ -402,9 +435,10 @@ export function createDoctorReport(envOrOptions = process.env) {
     }
     return report;
 }
-export function printDoctorJson(opts = {}) {
+export async function printDoctorJson(opts = {}) {
     let cacheAwareness;
     let flightRecorder;
+    let providersConfig;
     try {
         cacheAwareness = loadCacheAwarenessConfig();
     }
@@ -417,11 +451,25 @@ export function printDoctorJson(opts = {}) {
     }
     catch {
     }
+    try {
+        providersConfig = loadProvidersConfig();
+    }
+    catch {
+    }
+    let apiReachability;
+    if (opts.probeApiProviders && providersConfig) {
+        apiReachability = {};
+        for (const runtime of enabledApiProviders(providersConfig)) {
+            apiReachability[runtime.name] = await probeApiProviderReachability(runtime.baseUrl);
+        }
+    }
     const report = createDoctorReport({
         env: process.env,
         cacheAwareness,
         flightRecorder,
         probeUpstream: opts.probeUpstream,
+        providersConfig,
+        apiReachability,
     });
     process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
     if (flightRecorder) {
@@ -432,6 +480,30 @@ export function printDoctorJson(opts = {}) {
         }
     }
 }
+export async function probeApiProviderReachability(baseUrl, timeoutMs = 5_000) {
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        return { reachable: false, error: "invalid base_url" };
+    }
+    const transport = url.protocol === "http:" ? await import("node:http") : await import("node:https");
+    return new Promise(resolve => {
+        const request = transport.request(url, { method: "GET", timeout: timeoutMs }, response => {
+            response.resume();
+            resolve({ reachable: true });
+        });
+        request.on("timeout", () => {
+            request.destroy();
+            resolve({ reachable: false, error: `timed out after ${timeoutMs}ms` });
+        });
+        request.on("error", err => {
+            resolve({ reachable: false, error: err instanceof Error ? err.message : String(err) });
+        });
+        request.end();
+    });
+}
 function isCreateDoctorReportOptions(value) {
     if (value === null || typeof value !== "object")
         return false;

package/dist/endpoint-exposure.js

@@ -68,16 +68,28 @@ export function redactDiagnosticUrl(rawUrl) {
     const redactSensitivePairs = (value) => value.replace(new RegExp(`((${sensitiveKeyPattern.source})=)[^&\\s#]+`, "gi"), "$1<redacted>");
     try {
         const url = new URL(rawUrl);
-        if (url.username)
+        let redacted = false;
+        if (url.username) {
             url.username = "<redacted>";
-        if (url.password)
+            redacted = true;
+        }
+        if (url.password) {
             url.password = "<redacted>";
+            redacted = true;
+        }
         for (const key of Array.from(url.searchParams.keys())) {
             if (sensitiveKeyPattern.test(key)) {
                 url.searchParams.set(key, "<redacted>");
+                redacted = true;
             }
         }
-        url.hash = redactSensitivePairs(url.hash);
+        const redactedHash = redactSensitivePairs(url.hash);
+        if (redactedHash !== url.hash) {
+            url.hash = redactedHash;
+            redacted = true;
+        }
+        if (!redacted)
+            return rawUrl;
         return url.toString().replace(/%3Credacted%3E/gi, "<redacted>");
     }
     catch {

package/dist/http-transport.d.ts

@@ -1,12 +1,14 @@
 import { type Server } from "node:http";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { GatewayServerDeps } from "./index.js";
+import { type HttpSessionLimitsConfig } from "./config.js";
 export interface HttpTransportOptions {
     host?: string;
     port?: number;
     path?: string;
     deps?: GatewayServerDeps;
     createGatewayServer: (deps?: GatewayServerDeps) => McpServer;
+    httpLimits?: HttpSessionLimitsConfig;
     logger?: {
         info: (...args: any[]) => void;
         error: (...args: any[]) => void;
@@ -18,5 +20,6 @@ export interface HttpGatewayHandle {
     url: string;
     close: () => Promise<void>;
     sessionCount: () => number;
+    sessionHealth: () => Record<string, unknown>;
 }
 export declare function startHttpGateway(options: HttpTransportOptions): Promise<HttpGatewayHandle>;

package/dist/http-transport.js

@@ -3,7 +3,7 @@ import { randomUUID } from "node:crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { authorizeBearerRequest, getRequiredBearerToken, resolveTrustedPrincipal, writeAuthFailure, } from "./auth.js";
-import { loadRemoteOAuthConfig } from "./config.js";
+import { loadRemoteOAuthConfig, loadLimitsConfig } from "./config.js";
 import { OAuthServer, oauthBaseUrlFromRequest } from "./oauth.js";
 import { runWithRequestContext } from "./request-context.js";
 import { readCappedRawBody, maxHttpBodyBytes } from "./request-limits.js";
@@ -79,6 +79,8 @@ export async function startHttpGateway(options) {
     const noAuthPaths = parseNoAuthPaths(process.env.LLM_GATEWAY_NO_AUTH_PATHS, path);
     const logger = options.logger ?? noopLogger;
     const sessions = new Map();
+    let pendingInitializes = 0;
+    const httpLimits = options.httpLimits ?? loadLimitsConfig(logger).http;
     const token = getRequiredBearerToken();
     const oauthConfig = loadRemoteOAuthConfig(logger);
     if (oauthConfig.enabled &&
@@ -101,14 +103,33 @@ export async function startHttpGateway(options) {
             .catch(error => logger.error("HTTP transport close failed", error));
         await entry.server.close().catch(error => logger.error("HTTP MCP server close failed", error));
     }
-    async function createSession() {
+    function touchSessionComplete(entry) {
+        entry.inFlight = Math.max(0, entry.inFlight - 1);
+        entry.lastActivityAt = Date.now();
+    }
+    async function createSession(releaseInitializeReservation) {
         const gatewayServer = options.createGatewayServer(options.deps);
+        let entry;
         const transport = new StreamableHTTPServerTransport({
             sessionIdGenerator: () => randomUUID(),
             onsessioninitialized: sessionId => {
-                sessions.set(sessionId, { server: gatewayServer, transport });
+                const now = Date.now();
+                releaseInitializeReservation();
+                entry.sessionId = sessionId;
+                entry.createdAt = now;
+                entry.lastActivityAt = now;
+                entry.inFlight++;
+                sessions.set(sessionId, entry);
             },
         });
+        const now = Date.now();
+        entry = {
+            server: gatewayServer,
+            transport,
+            createdAt: now,
+            lastActivityAt: now,
+            inFlight: 0,
+        };
         transport.onclose = () => {
             if (transport.sessionId) {
                 sessions.delete(transport.sessionId);
@@ -116,7 +137,70 @@ export async function startHttpGateway(options) {
         };
         transport.onerror = error => logger.error("HTTP MCP transport error", error);
         await gatewayServer.connect(transport);
-        return { server: gatewayServer, transport };
+        return entry;
+    }
+    function reapIdleSessions() {
+        const now = Date.now();
+        for (const [sessionId, entry] of sessions) {
+            if (entry.inFlight > 0)
+                continue;
+            if (now - entry.lastActivityAt < httpLimits.sessionIdleTtlMs)
+                continue;
+            logger.info(`Reaping idle HTTP MCP session (idle ${now - entry.lastActivityAt}ms >= ${httpLimits.sessionIdleTtlMs}ms)`);
+            void closeSession(sessionId);
+        }
+    }
+    const reaperTimer = setInterval(reapIdleSessions, httpLimits.sessionReaperIntervalMs);
+    if (reaperTimer.unref)
+        reaperTimer.unref();
+    function sessionHealth() {
+        const now = Date.now();
+        let oldestAgeMs = 0;
+        for (const entry of sessions.values()) {
+            const age = now - entry.createdAt;
+            if (age > oldestAgeMs)
+                oldestAgeMs = age;
+        }
+        return {
+            current: sessions.size,
+            max: httpLimits.maxSessions,
+            oldestAgeMs,
+            idleTtlMs: httpLimits.sessionIdleTtlMs,
+            reaperIntervalMs: httpLimits.sessionReaperIntervalMs,
+            saturated: sessions.size + pendingInitializes >= httpLimits.maxSessions,
+        };
+    }
+    function healthPayload() {
+        const manager = options.deps?.asyncJobManager;
+        const mem = process.memoryUsage();
+        const payload = {
+            sessions: sessionHealth(),
+            memory: {
+                rss: mem.rss,
+                heapUsed: mem.heapUsed,
+                heapTotal: mem.heapTotal,
+                external: mem.external,
+            },
+        };
+        if (manager) {
+            const limiter = manager.getLimiterSnapshot();
+            const limits = manager.getConfiguredLimits();
+            payload.jobs = {
+                running: limiter.running,
+                queued: limiter.queued,
+                runningByProvider: limiter.runningByProvider,
+                queuedByProvider: limiter.queuedByProvider,
+                maxRunning: limiter.maxRunning,
+                maxRunningPerProvider: limiter.maxRunningPerProvider,
+                maxQueued: limiter.maxQueued,
+                rejected: limiter.rejected,
+                timedOut: limiter.timedOut,
+                saturated: limiter.saturated,
+                completedJobMemoryTtlMs: limits.completedJobMemoryTtlMs,
+                maxJobOutputBytes: limits.maxJobOutputBytes,
+            };
+        }
+        return payload;
     }
     const httpServer = createServer(async (req, res) => {
         try {
@@ -127,7 +211,7 @@ export async function startHttpGateway(options) {
             const resourceMetadataUrl = oauthServer && oauthOrigin ? oauthServer.resourceMetadataUrl(oauthOrigin) : undefined;
             if (url.pathname === "/healthz") {
                 res.writeHead(200, { "content-type": "application/json" });
-                res.end(JSON.stringify({ ok: true, sessions: sessions.size }));
+                res.end(JSON.stringify({ ok: true, ...healthPayload() }));
                 return;
             }
             if (oauthServer) {
@@ -188,7 +272,14 @@ export async function startHttpGateway(options) {
                     return;
                 }
                 const body = req.method === "POST" ? await readBody(req) : undefined;
-                await runWithRequestContext(requestContext, () => entry.transport.handleRequest(req, res, body));
+                entry.lastActivityAt = Date.now();
+                entry.inFlight++;
+                try {
+                    await runWithRequestContext(requestContext, () => entry.transport.handleRequest(req, res, body));
+                }
+                finally {
+                    touchSessionComplete(entry);
+                }
                 return;
             }
             if (req.method !== "POST") {
@@ -204,8 +295,45 @@ export async function startHttpGateway(options) {
                 jsonError(res, 400, "First request must be initialize");
                 return;
             }
-            const entry = await createSession();
-            await runWithRequestContext(requestContext, () => entry.transport.handleRequest(req, res, body));
+            const capacityInUse = sessions.size + pendingInitializes;
+            if (capacityInUse >= httpLimits.maxSessions) {
+                res.writeHead(429, {
+                    "content-type": "application/json",
+                    "retry-after": "5",
+                });
+                res.end(JSON.stringify({
+                    error: "Gateway at session capacity",
+                    code: "session_capacity",
+                    retryable: true,
+                    sessions: {
+                        current: sessions.size,
+                        pending: pendingInitializes,
+                        max: httpLimits.maxSessions,
+                    },
+                }));
+                logger.info(`Rejected new HTTP MCP session: at capacity (${capacityInUse}/${httpLimits.maxSessions})`);
+                return;
+            }
+            pendingInitializes++;
+            let reservationReleased = false;
+            const releaseInitializeReservation = () => {
+                if (reservationReleased)
+                    return;
+                reservationReleased = true;
+                pendingInitializes = Math.max(0, pendingInitializes - 1);
+            };
+            let entry;
+            try {
+                const created = await createSession(releaseInitializeReservation);
+                entry = created;
+                await runWithRequestContext(requestContext, () => created.transport.handleRequest(req, res, body));
+            }
+            finally {
+                releaseInitializeReservation();
+                if (entry?.sessionId && sessions.get(entry.sessionId) === entry && entry.inFlight > 0) {
+                    touchSessionComplete(entry);
+                }
+            }
         }
         catch (error) {
             logger.error("HTTP transport request failed", error);
@@ -241,11 +369,13 @@ export async function startHttpGateway(options) {
         server: httpServer,
         url,
         close: async () => {
+            clearInterval(reaperTimer);
             await Promise.all([...sessions.keys()].map(closeSession));
             await new Promise((resolve, reject) => {
                 httpServer.close(error => (error ? reject(error) : resolve()));
             });
         },
         sessionCount: () => sessions.size,
+        sessionHealth,
     };
 }

package/dist/index.d.ts

@@ -124,6 +124,20 @@ export declare function createErrorResponse(cli: string, code: number, stderr: s
     httpStatus?: number | null;
     responseBody?: string;
 }): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: boolean;
+    structuredContent: {
+        response: string;
+        correlationId: string | null;
+        cli: string;
+        exitCode: number;
+        errorCategory: string;
+        retryable: boolean;
+    };
+} | {
     content: {
         type: "text";
         text: string;
@@ -137,6 +151,7 @@ export declare function createErrorResponse(cli: string, code: number, stderr: s
         cli: string;
         exitCode: number;
         errorCategory: string;
+        retryable?: undefined;
     };
 };
 export declare function extractUsageAndCost(cli: "claude" | "codex" | "gemini" | "grok" | "mistral" | "devin", output: string, outputFormat?: string, ctx?: {