llm-relay 0.44.0 → 0.46.0

package/README.md

@@ -37,6 +37,7 @@ at login.
 
 - **Credential fleets** — give one provider multiple labeled, env-backed keys; the relay walks
   slots breadth-first and keeps account faults and limits separate. [Configure fleets](docs/reference.md#provider-credential-fleets).
+- **Encrypted key custody** — add, rotate, revoke, import, and encrypted-only export through an OS-keyring- or passphrase-protected keystore. [Manage keys](docs/reference.md#key-custody).
 - **Pools with failover** — `model: "pool/medium"` expands to a ranked candidate list; 429s
   and outages cascade to the next member. Free-model pools update themselves from live catalogs.
 - **Passthrough** — Claude traffic keeps your own credentials and reaches real Anthropic

package/dist/authEnv.d.ts

@@ -12,6 +12,10 @@
  * key-shaped. A heuristic match could ship one provider's credential to another
  * provider's endpoint, which is a credential leak, not a convenience.
  */
+import type { CredentialId } from "./credential-id.js";
+import { keyIsPresent, type KeystoreOptions } from "./keystore.js";
+/** The one credential-presence predicate, owned by the lower-level keystore surface. */
+export { keyIsPresent };
 /**
  * The curated aliases only, without the provider-name-derived candidates used by
  * `candidateEnvNames()`. Importers need this narrower surface: accepting a credential from a
@@ -24,6 +28,12 @@ export declare function curatedEnvNames(providerName: string): string[];
  * the declared name, then curated aliases, then names derived from the provider name.
  */
 export declare function candidateEnvNames(providerName: string, declared?: string): string[];
+/**
+ * The complete legacy credential-name walk, shared by resolution and custody
+ * coverage diagnostics. An env-name-implied provider family is considered before
+ * candidates derived from the configured provider name.
+ */
+export declare function credentialCandidateEnvNames(declaredAuthEnv: string | undefined, providerName?: string): string[];
 export interface AuthEnvResolution {
     /** The name to read the key from — the first candidate that is set, else the declared name. */
     name: string | undefined;
@@ -36,15 +46,13 @@ export interface CredentialResolution {
     state: CredentialState;
     value: string | undefined;
     envName: string | undefined;
+    source: CredentialSource | undefined;
+    provenance?: {
+        entryId: CredentialId;
+        provider: string;
+    };
 }
-/**
- * Whether a credential value counts as PRESENT. The single predicate — three
- * call sites used to disagree (config.ts tested Boolean() with no trim while
- * server.ts and candidates.ts trimmed), so a whitespace-only key read present
- * to the active-key filter and absent to header construction. That gap is how a
- * blank credential slipped past containment entirely.
- */
-export declare function keyIsPresent(value: string | undefined): boolean;
+export type CredentialSource = "env" | "env-file" | "keystore";
 /**
  * Whether a provider's credential handling is DECLARED, and if so whether the
  * key is actually there.
@@ -60,15 +68,15 @@ export declare function keyIsPresent(value: string | undefined): boolean;
  */
 export type CredentialState = "not-declared" | "declared-present" | "declared-missing";
 export declare function resolveTargetAuthEnv(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv, providerName?: string): string | undefined;
-export declare function credentialState(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv, providerName?: string): CredentialState;
-export declare function readCredential(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv, providerName?: string): string | undefined;
-export declare function resolveCredential(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv, providerName?: string): CredentialResolution;
+export declare function credentialState(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv, providerName?: string, keystoreOptions?: KeystoreOptions): CredentialState;
+export declare function readCredential(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv, providerName?: string, keystoreOptions?: KeystoreOptions): string | undefined;
+export declare function resolveCredential(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv, providerName?: string, keystoreOptions?: KeystoreOptions): CredentialResolution;
 /**
  * Resolve one explicitly-declared fleet slot. Unlike the legacy single `authEnv` form this
  * intentionally does not consult curated or provider-derived aliases: alias fallback could make
  * two slots share one environment variable and therefore share a quota domain.
  */
-export declare function resolveCredentialExact(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv): CredentialResolution;
+export declare function resolveCredentialExact(declaredAuthEnv: string | undefined, env?: NodeJS.ProcessEnv, keystoreOptions?: KeystoreOptions): CredentialResolution;
 /**
  * Which header a provider's credential is injected into.
  *

package/dist/authEnv.js

@@ -12,6 +12,10 @@
  * key-shaped. A heuristic match could ship one provider's credential to another
  * provider's endpoint, which is a credential leak, not a convenience.
  */
+import { keyIsPresent, lookupByEnvNames, } from "./keystore.js";
+import { wasEnvNameLoadedFromFile } from "./dotenv.js";
+/** The one credential-presence predicate, owned by the lower-level keystore surface. */
+export { keyIsPresent };
 /** Known alternate spellings, per provider, in preference order after the declared name. */
 const PROVIDER_ENV_ALIASES = {
     gemini: [
@@ -58,18 +62,13 @@ export function candidateEnvNames(providerName, declared) {
     return [...new Set(ordered)];
 }
 /**
- * Whether a credential value counts as PRESENT. The single predicate — three
- * call sites used to disagree (config.ts tested Boolean() with no trim while
- * server.ts and candidates.ts trimmed), so a whitespace-only key read present
- * to the active-key filter and absent to header construction. That gap is how a
- * blank credential slipped past containment entirely.
+ * The complete legacy credential-name walk, shared by resolution and custody
+ * coverage diagnostics. An env-name-implied provider family is considered before
+ * candidates derived from the configured provider name.
  */
-export function keyIsPresent(value) {
-    return (value ?? "").trim().length > 0;
-}
-export function resolveTargetAuthEnv(declaredAuthEnv, env = process.env, providerName) {
+export function credentialCandidateEnvNames(declaredAuthEnv, providerName) {
     if (!declaredAuthEnv)
-        return undefined;
+        return [];
     // A configured provider can be named differently from the provider family
     // implied by its declared env name (for example, `claude` declaring
     // `ANTHROPIC_API_KEY`). Search the declared family first so that a curated
@@ -81,32 +80,64 @@ export function resolveTargetAuthEnv(declaredAuthEnv, env = process.env, provide
             break;
         }
     }
-    const candidates = [
-        declaredAuthEnv,
-        ...(declaredFamily ? PROVIDER_ENV_ALIASES[declaredFamily] ?? [] : []),
-        ...(providerName ? candidateEnvNames(providerName).filter((name) => name !== declaredAuthEnv) : []),
-    ];
-    const found = [...new Set(candidates)].find((name) => keyIsPresent(env[name]));
+    return [...new Set([
+            declaredAuthEnv,
+            ...(declaredFamily ? PROVIDER_ENV_ALIASES[declaredFamily] ?? [] : []),
+            ...(providerName ? candidateEnvNames(providerName).filter((name) => name !== declaredAuthEnv) : []),
+        ])];
+}
+export function resolveTargetAuthEnv(declaredAuthEnv, env = process.env, providerName) {
+    if (!declaredAuthEnv)
+        return undefined;
+    const candidates = credentialCandidateEnvNames(declaredAuthEnv, providerName);
+    const found = candidates.find((name) => keyIsPresent(env[name]));
     return found ?? declaredAuthEnv;
 }
-export function credentialState(declaredAuthEnv, env = process.env, providerName) {
-    return resolveCredential(declaredAuthEnv, env, providerName).state;
+function envCredentialSource(envName, env) {
+    return env === process.env && wasEnvNameLoadedFromFile(envName) ? "env-file" : "env";
 }
-export function readCredential(declaredAuthEnv, env = process.env, providerName) {
-    return resolveCredential(declaredAuthEnv, env, providerName).value;
+function resolveKeystoreCandidates(candidates, keystoreOptions) {
+    // The keystore is a third source of NAMED VALUES with env-var parity. A provider declaring this
+    // name in operator-authored config expresses the same intent as an env var, which would serve
+    // every provider declaring it. AAD authenticates envName against tampering; entry id/provider
+    // are provenance metadata only, never lookup filters or credential identity.
+    const stored = lookupByEnvNames(candidates, keystoreOptions);
+    if (stored === null || !keyIsPresent(stored.value))
+        return null;
+    return {
+        state: "declared-present",
+        value: stored.value.trim(),
+        envName: stored.envName,
+        source: "keystore",
+        provenance: { entryId: stored.entryId, provider: stored.provider },
+    };
 }
-export function resolveCredential(declaredAuthEnv, env = process.env, providerName) {
+export function credentialState(declaredAuthEnv, env = process.env, providerName, keystoreOptions) {
+    return resolveCredential(declaredAuthEnv, env, providerName, keystoreOptions).state;
+}
+export function readCredential(declaredAuthEnv, env = process.env, providerName, keystoreOptions) {
+    return resolveCredential(declaredAuthEnv, env, providerName, keystoreOptions).value;
+}
+export function resolveCredential(declaredAuthEnv, env = process.env, providerName, keystoreOptions) {
     const normalized = declaredAuthEnv?.trim();
     if (!normalized) {
-        return { state: "not-declared", value: undefined, envName: undefined };
+        return { state: "not-declared", value: undefined, envName: undefined, source: undefined };
     }
-    const envName = resolveTargetAuthEnv(normalized, env, providerName);
-    const raw = envName ? env[envName] : undefined;
-    const value = keyIsPresent(raw) ? raw.trim() : undefined;
-    return {
-        state: value ? "declared-present" : "declared-missing",
-        value,
-        envName,
+    const candidates = credentialCandidateEnvNames(normalized, providerName);
+    const envName = candidates.find((name) => keyIsPresent(env[name]));
+    if (envName !== undefined) {
+        return {
+            state: "declared-present",
+            value: env[envName].trim(),
+            envName,
+            source: envCredentialSource(envName, env),
+        };
+    }
+    return resolveKeystoreCandidates(candidates, keystoreOptions) ?? {
+        state: "declared-missing",
+        value: undefined,
+        envName: normalized,
+        source: undefined,
     };
 }
 /**
@@ -114,16 +145,25 @@ export function resolveCredential(declaredAuthEnv, env = process.env, providerNa
  * intentionally does not consult curated or provider-derived aliases: alias fallback could make
  * two slots share one environment variable and therefore share a quota domain.
  */
-export function resolveCredentialExact(declaredAuthEnv, env = process.env) {
+export function resolveCredentialExact(declaredAuthEnv, env = process.env, keystoreOptions) {
     const normalized = declaredAuthEnv?.trim();
-    if (!normalized)
-        return { state: "not-declared", value: undefined, envName: undefined };
+    if (!normalized) {
+        return { state: "not-declared", value: undefined, envName: undefined, source: undefined };
+    }
     const raw = env[normalized];
-    const value = keyIsPresent(raw) ? raw.trim() : undefined;
-    return {
-        state: value ? "declared-present" : "declared-missing",
-        value,
+    if (keyIsPresent(raw)) {
+        return {
+            state: "declared-present",
+            value: raw.trim(),
+            envName: normalized,
+            source: envCredentialSource(normalized, env),
+        };
+    }
+    return resolveKeystoreCandidates([normalized], keystoreOptions) ?? {
+        state: "declared-missing",
+        value: undefined,
         envName: normalized,
+        source: undefined,
     };
 }
 /**

package/dist/authEnv.js.map

@@ -1 +1 @@
-{"version":3,"file":"authEnv.js","sourceRoot":"","sources":["../src/authEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,4FAA4F;AAC5F,MAAM,oBAAoB,GAA6B;IACrD,MAAM,EAAE;QACN,gBAAgB;QAChB,kBAAkB;QAClB,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,gBAAgB;KACjB;IACD,GAAG,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,CAAC;IAC5D,UAAU,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IACzD,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,OAAO,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;IACjD,QAAQ,EAAE,CAAC,kBAAkB,CAAC;IAC9B,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,SAAS,EAAE,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;CACzD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,4FAA4F;AAC5F,SAAS,IAAI,CAAC,YAAoB;IAChC,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,QAAiB;IACvE,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,oBAAoB,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAiBD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACzC,CAAC;AAiBD,MAAM,UAAU,oBAAoB,CAClC,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAqB;IAErB,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,0EAA0E;IAC1E,oEAAoE;IACpE,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,cAAkC,CAAC;IACvC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACvE,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,cAAc,GAAG,QAAQ,CAAC;YAC1B,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG;QACjB,eAAe;QACf,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACpG,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,KAAK,IAAI,eAAe,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAqB;IAErB,OAAO,iBAAiB,CAAC,eAAe,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAqB;IAErB,OAAO,iBAAiB,CAAC,eAAe,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAqB;IAErB,MAAM,UAAU,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;QACtD,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACxF,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;QACtD,KAAK;QACL,OAAO,EAAE,UAAU;KACpB,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAuB,EACvB,UAA0B;IAE1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,GAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QACnC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,YAAoB,EACpB,QAA4B,EAC5B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,QAAQ;QACvB,QAAQ,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,CAAC;QAC9C,UAAU;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authEnv.js","sourceRoot":"","sources":["../src/authEnv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,YAAY,EACZ,gBAAgB,GAEjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,wFAAwF;AACxF,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,4FAA4F;AAC5F,MAAM,oBAAoB,GAA6B;IACrD,MAAM,EAAE;QACN,gBAAgB;QAChB,kBAAkB;QAClB,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,gBAAgB;KACjB;IACD,GAAG,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,CAAC;IAC5D,UAAU,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;IACzD,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,OAAO,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;IACjD,QAAQ,EAAE,CAAC,kBAAkB,CAAC;IAC9B,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,SAAS,EAAE,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;CACzD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,YAAoB;IAClD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,4FAA4F;AAC5F,SAAS,IAAI,CAAC,YAAoB;IAChC,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,QAAiB;IACvE,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,oBAAoB,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,eAAmC,EACnC,YAAqB;IAErB,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IAEhC,0EAA0E;IAC1E,oEAAoE;IACpE,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,cAAkC,CAAC;IACvC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACvE,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,cAAc,GAAG,QAAQ,CAAC;YAC1B,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;YACjB,eAAe;YACf,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACpG,CAAC,CAAC,CAAC;AACN,CAAC;AAuCD,MAAM,UAAU,oBAAoB,CAClC,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAqB;IAErB,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,UAAU,GAAG,2BAA2B,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,KAAK,IAAI,eAAe,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe,EAAE,GAAsB;IAClE,OAAO,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;AACvF,CAAC;AAED,SAAS,yBAAyB,CAChC,UAA6B,EAC7B,eAAiC;IAEjC,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,6EAA6E;IAC7E,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO;QACL,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAqB,EACrB,eAAiC;IAEjC,OAAO,iBAAiB,CAAC,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAqB,EACrB,eAAiC;IAEjC,OAAO,iBAAiB,CAAC,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAqB,EACrB,eAAiC;IAEjC,MAAM,UAAU,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,UAAU,GAAG,2BAA2B,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,kBAAkB;YACzB,KAAK,EAAE,GAAG,CAAC,OAAO,CAAE,CAAC,IAAI,EAAE;YAC3B,OAAO;YACP,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC;SAC1C,CAAC;IACJ,CAAC;IACD,OAAO,yBAAyB,CAAC,UAAU,EAAE,eAAe,CAAC,IAAI;QAC/D,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,eAAmC,EACnC,MAAyB,OAAO,CAAC,GAAG,EACpC,eAAiC;IAEjC,MAAM,UAAU,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5B,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,kBAAkB;YACzB,KAAK,EAAE,GAAI,CAAC,IAAI,EAAE;YAClB,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC;SAC7C,CAAC;IACJ,CAAC;IACD,OAAO,yBAAyB,CAAC,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,IAAI;QACjE,KAAK,EAAE,kBAAkB;QACzB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAuB,EACvB,UAA0B;IAE1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,GAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QACnC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,YAAoB,EACpB,QAA4B,EAC5B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,QAAQ;QACvB,QAAQ,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,KAAK,QAAQ,CAAC;QAC9C,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/backend.d.ts

@@ -1,4 +1,5 @@
 import type { ResolvedAttempt } from "./resolved-attempt.js";
+import { type DialectRefusalSignal } from "./tool-dialects.js";
 import { type RecoveredOpenAiChatProcessor } from "./openai-dialect.js";
 import { type UsageAccumulator } from "./usage-observer.js";
 /**
@@ -11,6 +12,20 @@ export declare class DialectUnparseableError extends Error {
     readonly dialect: string;
     constructor(dialect: string);
 }
+/**
+ * A tool call recovered from assistant TEXT names a tool on the operator's destructive list.
+ *
+ * Unlike `DialectUnparseableError` this is NOT a statement about the host: the envelope parsed
+ * fine. It is a config decision, so it is carried as a LOCAL failure — the walk must not fail over
+ * (re-asking N models to produce the same refused action) and the deployment must not be charged,
+ * the same rule under which a hard cap "never registers on the breaker — it is config, not
+ * health". See docs/dialect-rescue-destructive-refusal-2026-08-24.md.
+ */
+export declare class DialectDestructiveError extends Error {
+    readonly dialect: string;
+    readonly refused: string[];
+    constructor(dialect: string, refused: string[]);
+}
 /**
  * Response header stating who produced an error status: the provider, or this proxy.
  *
@@ -117,6 +132,7 @@ export declare const HARD_CAP_HEADER = "x-llm-relay-capped";
 export declare const PAID_HEADER = "x-llm-relay-paid";
 /** This response contains a tool call reconstructed from a recognized text dialect envelope. */
 export declare const TOOL_DIALECT_HEADER = "x-llm-relay-tool-dialect";
+export declare function dialectRefusalSignalOf(response: Response): DialectRefusalSignal | undefined;
 /**
  * `tool_use` ids in this response were MINTED by the relay because the host reused ones the
  * conversation already carried — value `"<n> rewritten"`.
@@ -200,6 +216,12 @@ export declare function fetchBackend(attempt: ResolvedAttempt, args: {
     reqJson: unknown;
     anthropicHeaders: Record<string, string>;
     wantsStream: boolean;
+    /**
+     * The operator's configured destructive-tool set (`destructiveMatcher`). REQUIRED, not
+     * optional: it reaches the four dialect-rescue commit points, and an optional field here would
+     * let a caller silently disable the refusal — the failure mode that gap existed as.
+     */
+    isDestructive: (name: string) => boolean;
     usage?: UsageAccumulator;
     signal: AbortSignal;
     onEgress?: OnEgress;
@@ -212,12 +234,12 @@ export declare function fetchBackend(attempt: ResolvedAttempt, args: {
  * without this reaches the client as markup it treats as a final answer (see
  * docs/tool-call-dialect-leak.md). Omitting it keeps the pure translation behaviour.
  */
-export declare function openAiResponseToAnthropic(j: Record<string, unknown>, model: string, schemas?: Map<string, {
+export declare function openAiResponseToAnthropic(j: Record<string, unknown>, model: string, schemas: Map<string, {
     type?: unknown;
     properties?: Record<string, {
         type?: unknown;
     }>;
-}>): object;
+}> | undefined, isDestructive: (name: string) => boolean): object;
 export type OpenAiFrontProtocol = "chat" | "responses";
 /**
  * Turn an Anthropic Message response into the response envelope expected by an OpenAI client.
@@ -264,6 +286,8 @@ export declare function fetchOpenAiFront(attempt: ResolvedAttempt, args: {
     signal: AbortSignal;
     protocol?: OpenAiFrontProtocol;
     anthropicHeaders?: Record<string, string>;
+    /** See `fetchBackend`'s field of the same name: required so no caller can silently opt out. */
+    isDestructive: (name: string) => boolean;
     processRecoveredChat?: RecoveredOpenAiChatProcessor;
     usage?: UsageAccumulator;
     onEgress?: OnEgress;

package/dist/backend.js

@@ -3,7 +3,7 @@ import { buildAuthHeaders } from "./authEnv.js";
 import { DocumentError, transcodeDocuments } from "./documents.js";
 import { anthropicRequestToOpenAi, RequestMappingError } from "./openai-request.js";
 import { openaiResponsesRequestToAnthropic } from "./responses-request.js";
-import { recoverToolCalls } from "./tool-dialects.js";
+import { DIALECT_REFUSED_DESTRUCTIVE_CODE, describeRefused, dialectRefusalSignal, recoverToolCalls } from "./tool-dialects.js";
 import { recoverDialectInStream } from "./dialect-stream.js";
 import { toolSchemaMap } from "./anthropic.js";
 import { stripOpeningThinkTag, stripThinkTagsInStream } from "./think-tags.js";
@@ -25,6 +25,25 @@ export class DialectUnparseableError extends Error {
         this.name = "DialectUnparseableError";
     }
 }
+/**
+ * A tool call recovered from assistant TEXT names a tool on the operator's destructive list.
+ *
+ * Unlike `DialectUnparseableError` this is NOT a statement about the host: the envelope parsed
+ * fine. It is a config decision, so it is carried as a LOCAL failure — the walk must not fail over
+ * (re-asking N models to produce the same refused action) and the deployment must not be charged,
+ * the same rule under which a hard cap "never registers on the breaker — it is config, not
+ * health". See docs/dialect-rescue-destructive-refusal-2026-08-24.md.
+ */
+export class DialectDestructiveError extends Error {
+    dialect;
+    refused;
+    constructor(dialect, refused) {
+        super(`refused a ${dialect} tool call recovered from text because it names a destructive tool: ${describeRefused(refused)}`);
+        this.dialect = dialect;
+        this.refused = refused;
+        this.name = "DialectDestructiveError";
+    }
+}
 /**
  * Response header stating who produced an error status: the provider, or this proxy.
  *
@@ -141,6 +160,19 @@ export const HARD_CAP_HEADER = "x-llm-relay-capped";
 export const PAID_HEADER = "x-llm-relay-paid";
 /** This response contains a tool call reconstructed from a recognized text dialect envelope. */
 export const TOOL_DIALECT_HEADER = "x-llm-relay-tool-dialect";
+/**
+ * Per-response proof that a streamed dialect refusal was the RELAY's, not the upstream's.
+ *
+ * A WeakMap rather than a header or a body field, for the reason the signal exists at all: anything
+ * on the wire can be echoed by a counterparty. The server hands this to `probeStreamForCommit`, and
+ * a lane the relay never wrapped simply has no entry — so its bytes can never earn `local`
+ * provenance. Same shape as `attachUpstreamMetadata`, and deliberately not merged into it: that
+ * carries log METADATA about a finished response, this is live state for one in-flight stream.
+ */
+const dialectRefusalSignals = new WeakMap();
+export function dialectRefusalSignalOf(response) {
+    return dialectRefusalSignals.get(response);
+}
 /**
  * `tool_use` ids in this response were MINTED by the relay because the host reused ones the
  * conversation already carried — value `"<n> rewritten"`.
@@ -651,7 +683,10 @@ export async function fetchBackend(attempt, args, fetchFn = fetch) {
             // declaring tools: with none declared there is no call to recover, and wrapping the stream
             // would add holdback latency for nothing.
             const schemas = toolSchemaMap(args.reqJson);
-            const recovered = schemas.size > 0 ? recoverDialectInStream(strippedStream, schemas) : strippedStream;
+            const refusalSignal = dialectRefusalSignal();
+            const recovered = schemas.size > 0
+                ? recoverDialectInStream(strippedStream, schemas, args.isDestructive, refusalSignal)
+                : strippedStream;
             // AFTER recovery, so a call the relay reconstructed is covered too, and BEFORE anything that
             // watches for the first `tool_use` — validation and repair must see the ids the client will.
             // The taken-set is a thunk: a response with no tool call never walks the conversation.
@@ -668,7 +703,7 @@ export async function fetchBackend(attempt, args, fetchFn = fetch) {
             if (sentinelsStamped > 0)
                 metadata.thoughtSignatureSentinels = sentinelsStamped;
             const body = rewriteToolUseIdsInStream(recovered, () => knownToolUseIds(args.reqJson), (count) => { metadata.toolUseIdRewrites = count; });
-            return attachUpstreamMetadata(new Response(body, {
+            const streamResponse = attachUpstreamMetadata(new Response(body, {
                 status: res.status,
                 headers: {
                     "content-type": "text/event-stream",
@@ -677,6 +712,8 @@ export async function fetchBackend(attempt, args, fetchFn = fetch) {
                     ...(toolCallIdsRewritten > 0 ? { [TOOL_CALL_IDS_HEADER]: `${toolCallIdsRewritten} rewritten` } : {}),
                 },
             }), metadata);
+            dialectRefusalSignals.set(streamResponse, refusalSignal);
+            return streamResponse;
         }
         catch (e) {
             return anthropicError(502, `llm-relay: response translation failed: ${e.message}`, "local", {}, "relay_mapper_defect");
@@ -702,7 +739,7 @@ export async function fetchBackend(attempt, args, fetchFn = fetch) {
     let anthropicJson;
     try {
         const schemas = toolSchemaMap(args.reqJson);
-        anthropicJson = openAiResponseToAnthropic(upstreamJson, target.model ?? "", schemas);
+        anthropicJson = openAiResponseToAnthropic(upstreamJson, target.model ?? "", schemas, args.isDestructive);
     }
     catch (e) {
         if (e instanceof DialectUnparseableError) {
@@ -711,6 +748,12 @@ export async function fetchBackend(attempt, args, fetchFn = fetch) {
             // that parses its models' dialect. 502 is retriable, which is what drives the walk.
             return anthropicError(502, `llm-relay: ${e.message}`, "upstream", {}, "tool_dialect_unparseable");
         }
+        if (e instanceof DialectDestructiveError) {
+            // "local" is the load-bearing part: it makes `localFailure` true in the walk, so the request
+            // is NOT rerolled onto another candidate and the deployment is not blamed. A refusal is a
+            // config decision, not a health signal — the same line the hard cap draws.
+            return anthropicError(502, `llm-relay: ${e.message}`, "local", { [TOOL_DIALECT_HEADER]: "refused-destructive" }, DIALECT_REFUSED_DESTRUCTIVE_CODE);
+        }
         // The provider returned a valid source envelope, so a failure after this point belongs to
         // the relay mapper rather than the provider or its failure budget.
         return anthropicError(502, `llm-relay: response translation failed: ${e.message}`, "local", {}, "relay_mapper_defect");
@@ -782,7 +825,7 @@ function recoveredDialectOf(message) {
  * without this reaches the client as markup it treats as a final answer (see
  * docs/tool-call-dialect-leak.md). Omitting it keeps the pure translation behaviour.
  */
-export function openAiResponseToAnthropic(j, model, schemas) {
+export function openAiResponseToAnthropic(j, model, schemas, isDestructive) {
     const choice = j.choices?.[0] ?? {};
     const msg = choice.message ?? {};
     const content = [];
@@ -794,12 +837,17 @@ export function openAiResponseToAnthropic(j, model, schemas) {
     // spoken; second-guessing it here would be inference, not translation.
     let recovered = [];
     if (toolCalls.length === 0 && messageText !== null && messageText.length > 0) {
-        const out = recoverToolCalls(messageText, schemas ?? new Map());
+        const out = recoverToolCalls(messageText, schemas ?? new Map(), isDestructive);
         if (out.status === "parsed") {
             recovered = out.calls;
             if (out.text.length > 0)
                 content.push({ type: "text", text: out.text });
         }
+        else if (out.status === "refused-destructive") {
+            // The relay reconstructed a destructive call out of prose. Refuse it whole rather than
+            // commit it — "refused, never fabricated". Terminal, not retriable: see the error class.
+            throw new DialectDestructiveError(out.dialect, out.refused);
+        }
         else if (out.status === "detected") {
             // Framing present, nothing parseable — a truncated or unmodelled envelope. Fail clean so
             // failover reaches a host that parses, exactly as repair fails clean on an unrepairable
@@ -1263,15 +1311,17 @@ export async function fetchOpenAiFront(attempt, args, fetchFn = fetch) {
             }
             let response = null;
             let recovered = false;
+            const chatRefusalSignal = dialectRefusalSignal();
             const responseBody = schemas.size > 0
-                ? recoverDialectInOpenAiChatStream(preflight.body, schemas, () => {
+                ? recoverDialectInOpenAiChatStream(preflight.body, schemas, args.isDestructive, () => {
                     recovered = true;
                     response?.headers.set(TOOL_DIALECT_HEADER, "recovered");
-                }, args.processRecoveredChat)
+                }, args.processRecoveredChat, chatRefusalSignal)
                 : preflight.body;
             response = new Response(relayAddedUsage ? suppressRelayAddedOpenAiUsageFrames(responseBody) : responseBody, { status: res.status, headers: res.headers });
             if (recovered)
                 response.headers.set(TOOL_DIALECT_HEADER, "recovered");
+            dialectRefusalSignals.set(response, chatRefusalSignal);
             return attachUpstreamMetadata(response, preflight.metadata);
         }
         let responseBody;
@@ -1289,11 +1339,17 @@ export async function fetchOpenAiFront(attempt, args, fetchFn = fetch) {
         }
         let recovery;
         try {
-            recovery = await inspectDialectInOpenAiChat(responseBody, schemas, args.processRecoveredChat);
+            recovery = await inspectDialectInOpenAiChat(responseBody, schemas, args.isDestructive, args.processRecoveredChat);
         }
         catch (error) {
             return openaiError(502, `llm-relay: ${error instanceof Error ? error.message : String(error)}`, "upstream", "tool_call_recovery_failed");
         }
+        if (recovery.status === "refused-destructive") {
+            // "local" keeps this out of the failover walk and off the deployment's failure budget: the
+            // envelope parsed fine, the relay refused to commit what it reconstructed. Config, not
+            // health — the same line the hard cap draws.
+            return openaiError(502, `llm-relay: refused a ${recovery.dialect} tool call recovered from text because it names a destructive tool: ${describeRefused(recovery.refused)}`, "local", DIALECT_REFUSED_DESTRUCTIVE_CODE, { [TOOL_DIALECT_HEADER]: "refused-destructive" });
+        }
         if (recovery.status === "detected") {
             return openaiError(502, `llm-relay: backend returned an unparseable ${recovery.dialect} tool-call envelope as text`, "upstream", "tool_dialect_unparseable");
         }
@@ -1340,6 +1396,7 @@ export async function fetchOpenAiFront(attempt, args, fetchFn = fetch) {
         reqJson: anthropicBody,
         anthropicHeaders: args.anthropicHeaders ?? {},
         wantsStream: args.wantsStream,
+        isDestructive: args.isDestructive,
         ...(args.usage ? { usage: args.usage } : {}),
         signal: args.signal,
         ...(args.onEgress ? { onEgress: args.onEgress } : {}),
@@ -1356,9 +1413,15 @@ export async function fetchOpenAiFront(attempt, args, fetchFn = fetch) {
             return attachPostHeaderBodyFailure(backendRes, cause);
         }
         const origin = errorOrigin(backendRes) ?? "upstream";
+        // Same rule as the two id-rewrite counters below: rebuilding the response must not swallow the
+        // announcement of a decision the relay made one Response ago. A dialect-rescue destructive
+        // refusal arrives here as a 502 from `fetchBackend` carrying `refused-destructive`, and a
+        // Responses/Messages-front client is entitled to the same marker the Messages front gets.
+        const dialect = backendRes.headers.get(TOOL_DIALECT_HEADER);
         const headers = {
             "content-type": "application/json",
             [ERROR_ORIGIN_HEADER]: origin,
+            ...(dialect ? { [TOOL_DIALECT_HEADER]: dialect } : {}),
             ...retryAfterHeader(backendRes.headers),
         };
         return new Response(anthropicErrorToOpenAi(raw, backendRes.status), { status: backendRes.status, headers });
@@ -1389,6 +1452,13 @@ export async function fetchOpenAiFront(attempt, args, fetchFn = fetch) {
                     ...(rewritten ? { [TOOL_CALL_IDS_HEADER]: rewritten } : {}),
                 },
             });
+            // Carry the refusal SIGNAL across the rebuild for the same reason as the header above: this
+            // Response is the one the server probes, and the object it must consult was registered
+            // against the inner Response one hop ago. The signal is the same live object, so a refusal
+            // the wrapper marks after this line is still visible.
+            const innerRefusal = dialectRefusalSignals.get(backendRes);
+            if (innerRefusal)
+                dialectRefusalSignals.set(response, innerRefusal);
             return metadata ? attachUpstreamMetadata(response, metadata) : response;
         }
         catch (e) {