skalpel 2.0.13 → 2.0.15

package/dist/index.js

@@ -1,1124 +1,1512 @@
-// src/metadata.ts
-function extractMetadata(headers) {
-  const get = (name) => {
-    if (headers instanceof Headers) {
-      return headers.get(name);
-    }
-    return headers[name] ?? null;
-  };
-  const requestId = get("x-skalpel-request-id");
-  if (!requestId) return null;
-  return {
-    requestId,
-    optimization: get("x-skalpel-optimization") ?? "none",
-    originalModel: get("x-skalpel-original-model") ?? "",
-    actualModel: get("x-skalpel-actual-model") ?? "",
-    savingsUsd: parseFloat(get("x-skalpel-savings-usd") ?? "0"),
-    cacheHit: get("x-skalpel-cache-hit") === "true",
-    latencyMs: parseInt(get("x-skalpel-latency-ms") ?? "0", 10)
-  };
-}
-
-// src/errors.ts
-var SkalpelError = class extends Error {
-  code;
-  statusCode;
-  retryAfter;
-  constructor(message, code, statusCode, retryAfter) {
-    super(message);
-    this.name = "SkalpelError";
-    this.code = code;
-    this.statusCode = statusCode;
-    this.retryAfter = retryAfter;
-  }
-};
-var SkalpelAuthError = class extends SkalpelError {
-  constructor(message = "Skalpel authentication failed") {
-    super(message, "SKALPEL_AUTH_FAILED", 401);
-    this.name = "SkalpelAuthError";
-  }
-};
-var SkalpelTimeoutError = class extends SkalpelError {
-  constructor(message = "Skalpel request timed out") {
-    super(message, "SKALPEL_TIMEOUT");
-    this.name = "SkalpelTimeoutError";
-  }
-};
-var SkalpelRateLimitError = class extends SkalpelError {
-  constructor(message = "Skalpel rate limit exceeded", retryAfter) {
-    super(message, "SKALPEL_RATE_LIMITED", 429, retryAfter);
-    this.name = "SkalpelRateLimitError";
-  }
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var SkalpelUnavailableError = class extends SkalpelError {
-  constructor(message = "Skalpel service unavailable", statusCode) {
-    super(message, "SKALPEL_UNAVAILABLE", statusCode);
-    this.name = "SkalpelUnavailableError";
-  }
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
 };
-var SkalpelClientRequestError = class extends SkalpelError {
-  constructor(message, statusCode) {
-    super(message, "SKALPEL_CLIENT_REQUEST", statusCode);
-    this.name = "SkalpelClientRequestError";
+
+// src/proxy/dispatcher.ts
+import { Agent } from "undici";
+var skalpelDispatcher;
+var init_dispatcher = __esm({
+  "src/proxy/dispatcher.ts"() {
+    "use strict";
+    skalpelDispatcher = new Agent({
+      keepAliveTimeout: 1e4,
+      keepAliveMaxTimeout: 6e4,
+      connections: 100,
+      pipelining: 1
+    });
   }
-};
+});
 
-// src/fallback.ts
-var TRULY_CLIENT_4XX = /* @__PURE__ */ new Set([
-  400,
-  403,
-  404,
-  405,
-  409,
-  410,
-  411,
-  413,
-  415,
-  417,
-  418,
-  421,
-  422,
-  423,
-  424,
-  425,
-  426,
-  428,
-  431,
-  451
-]);
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+// src/proxy/envelope.ts
+function isAnthropicShaped(body) {
+  if (typeof body !== "object" || body === null) return false;
+  const b = body;
+  if (b.type !== "error") return false;
+  if (typeof b.error !== "object" || b.error === null) return false;
+  return true;
 }
-function classifyError(err) {
-  if (err instanceof SkalpelError) return err;
-  const error = err;
-  const status = error.status ?? error.statusCode;
-  const message = error.message ?? "Unknown error";
-  if (status === 401) {
-    return new SkalpelAuthError(message);
+function defaultErrorTypeFor(status) {
+  if (status === 400) return "invalid_request_error";
+  if (status === 401 || status === 403) return "authentication_error";
+  if (status === 404) return "not_found_error";
+  if (status === 408) return "timeout_error";
+  if (status === 429) return "rate_limit_error";
+  if (status >= 500) return "api_error";
+  if (status >= 400) return "invalid_request_error";
+  return "api_error";
+}
+function buildErrorEnvelope(status, upstreamBody, origin, hint, retryAfter) {
+  let parsed = upstreamBody;
+  if (typeof upstreamBody === "string" && upstreamBody.length > 0) {
+    try {
+      parsed = JSON.parse(upstreamBody);
+    } catch {
+      parsed = upstreamBody;
+    }
   }
-  if (status === 429) {
-    const retryAfter = error.headers?.["retry-after"] ? parseInt(error.headers["retry-after"], 10) : void 0;
-    return new SkalpelRateLimitError(message, retryAfter);
+  let type = defaultErrorTypeFor(status);
+  let message;
+  if (isAnthropicShaped(parsed)) {
+    const inner = parsed.error;
+    if (typeof inner.type === "string" && inner.type.length > 0) {
+      type = inner.type;
+    }
+    message = typeof inner.message === "string" && inner.message.length > 0 ? inner.message : defaultMessageForStatus(status);
+  } else if (typeof parsed === "string" && parsed.length > 0) {
+    message = parsed;
+  } else {
+    message = defaultMessageForStatus(status);
   }
-  if (status === 408) {
-    return new SkalpelTimeoutError(message);
+  const envelope = {
+    type: "error",
+    error: {
+      type,
+      message,
+      status_code: status,
+      origin
+    }
+  };
+  if (hint !== void 0) envelope.error.hint = hint;
+  if (retryAfter !== void 0) envelope.error.retry_after = retryAfter;
+  return envelope;
+}
+function defaultMessageForStatus(status) {
+  if (status === 401) return "Authentication failed";
+  if (status === 403) return "Forbidden";
+  if (status === 404) return "Not found";
+  if (status === 408) return "Request timed out";
+  if (status === 429) return "Rate limit exceeded";
+  if (status === 502) return "Bad gateway";
+  if (status === 503) return "Service unavailable";
+  if (status === 504) return "Gateway timeout";
+  if (status >= 500) return "Upstream error";
+  if (status >= 400) return "Client error";
+  return "Error";
+}
+var init_envelope = __esm({
+  "src/proxy/envelope.ts"() {
+    "use strict";
   }
-  if (error.code === "ETIMEDOUT" || error.code === "TIMEOUT" || error.code === "UND_ERR_HEADERS_TIMEOUT") {
-    return new SkalpelTimeoutError(message);
+});
+
+// src/proxy/recovery.ts
+import { createHash } from "crypto";
+function parseRetryAfterHeader(header) {
+  if (!header) return void 0;
+  const trimmed = header.trim();
+  if (!trimmed) return void 0;
+  const n = Number(trimmed);
+  if (Number.isFinite(n) && n >= 0) return Math.floor(n);
+  const dateMs = Date.parse(trimmed);
+  if (Number.isFinite(dateMs)) {
+    return Math.max(0, Math.ceil((dateMs - Date.now()) / 1e3));
   }
-  if (status && status >= 500) {
-    return new SkalpelUnavailableError(message, status);
+  return void 0;
+}
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function handle429WithRetryAfter(response, retryFn, logger) {
+  const headerVal = response.headers.get("retry-after");
+  const parsed = parseRetryAfterHeader(headerVal);
+  logger.debug(`429 recovery retryAfterHeader=${headerVal ?? "none"} parsed=${parsed ?? "none"}`);
+  if (parsed === void 0) {
+    await sleep2(DEFAULT_BACKOFF_SECONDS * 1e3);
+    const retried2 = await retryFn();
+    logger.info("proxy.recovery.429_retry_count increment");
+    return retried2;
   }
-  if (status && TRULY_CLIENT_4XX.has(status)) {
-    return new SkalpelClientRequestError(message, status);
+  if (parsed > MAX_RETRY_AFTER_SECONDS) {
+    logger.warn(`429 recovery capped: retryAfter=${parsed}s exceeds max=${MAX_RETRY_AFTER_SECONDS}s, passing 429 through`);
+    return response;
   }
-  if (status && status >= 400 && status < 500) {
-    return new SkalpelClientRequestError(message, status);
+  await sleep2(parsed * 1e3);
+  const retried = await retryFn();
+  logger.info("proxy.recovery.429_retry_count increment");
+  return retried;
+}
+async function handleTimeoutWithRetry(err, retryFn, logger) {
+  const code = err.code;
+  if (!code || !TIMEOUT_CODES.has(code)) {
+    throw err;
   }
-  return new SkalpelUnavailableError(message, status);
+  logger.warn(`timeout recovery code=${code}`);
+  await sleep2(DEFAULT_BACKOFF_SECONDS * 1e3);
+  const retried = await retryFn();
+  logger.info("proxy.recovery.timeout_retry_count increment");
+  return retried;
 }
-async function withFallback(primaryFn, fallbackFn, options = {}) {
-  const { retries = 2, verbose = false, onFallback, provider = "unknown", fallbackOnError = true } = options;
-  let lastError;
-  for (let attempt = 0; attempt <= retries; attempt++) {
-    try {
-      return await primaryFn();
-    } catch (err) {
-      lastError = classifyError(err);
-      if (lastError instanceof SkalpelAuthError) {
-        throw lastError;
-      }
-      if (lastError instanceof SkalpelClientRequestError) {
-        throw lastError;
-      }
-      if (lastError instanceof SkalpelRateLimitError && lastError.retryAfter && attempt < retries) {
-        await sleep(lastError.retryAfter * 1e3);
-        continue;
-      }
-      if (attempt < retries) {
-        await sleep(Math.pow(2, attempt) * 1e3);
-        continue;
+function tokenFingerprint(authHeader) {
+  if (authHeader === void 0) return "none";
+  return createHash("sha256").update(authHeader).digest("hex").slice(0, 12);
+}
+var MAX_RETRY_AFTER_SECONDS, DEFAULT_BACKOFF_SECONDS, TIMEOUT_CODES, MUTEX_MAX_ENTRIES, LruMutexMap, refreshMutex;
+var init_recovery = __esm({
+  "src/proxy/recovery.ts"() {
+    "use strict";
+    MAX_RETRY_AFTER_SECONDS = 60;
+    DEFAULT_BACKOFF_SECONDS = 2;
+    TIMEOUT_CODES = /* @__PURE__ */ new Set(["ETIMEDOUT", "TIMEOUT", "UND_ERR_HEADERS_TIMEOUT"]);
+    MUTEX_MAX_ENTRIES = 1024;
+    LruMutexMap = class extends Map {
+      set(key, value) {
+        if (this.has(key)) {
+          super.delete(key);
+        } else if (this.size >= MUTEX_MAX_ENTRIES) {
+          const oldest = this.keys().next().value;
+          if (oldest !== void 0) super.delete(oldest);
+        }
+        return super.set(key, value);
       }
-    }
-  }
-  if (fallbackOnError) {
-    if (verbose && lastError) {
-      console.warn(`[skalpel] Falling back to direct ${provider} call: ${lastError.message}`);
-    }
-    if (onFallback && lastError) {
-      onFallback(lastError, provider);
-    }
-    return fallbackFn();
+    };
+    refreshMutex = new LruMutexMap();
   }
-  throw lastError;
-}
+});
 
-// src/version.ts
-var VERSION = "1.0.5";
+// src/proxy/fetch-error.ts
+function formatFetchErrorForLog(err, url) {
+  if (err instanceof Error) {
+    const code = err.code;
+    const parts = [];
+    if (code) parts.push(code);
+    parts.push(err.message);
+    parts.push(`url=${url}`);
+    return parts.join(" ");
+  }
+  return `${String(err)} url=${url}`;
+}
+var init_fetch_error = __esm({
+  "src/proxy/fetch-error.ts"() {
+    "use strict";
+  }
+});
 
-// src/client.ts
-var AsyncMutex = class {
-  locked = false;
-  queue = [];
-  async acquire() {
-    if (this.locked) {
-      await new Promise((resolve) => this.queue.push(resolve));
-    }
-    this.locked = true;
-    return () => {
-      this.locked = false;
-      const next = this.queue.shift();
-      if (next) next();
-    };
+// src/proxy/streaming.ts
+function parseRetryAfter(header) {
+  if (!header) return void 0;
+  const trimmed = header.trim();
+  if (!trimmed) return void 0;
+  const n = Number(trimmed);
+  if (Number.isFinite(n) && n >= 0) return Math.floor(n);
+  const dateMs = Date.parse(trimmed);
+  if (Number.isFinite(dateMs)) {
+    const delta = Math.max(0, Math.ceil((dateMs - Date.now()) / 1e3));
+    return delta;
   }
-};
-function resolveConfig(options) {
-  return {
-    apiKey: options.apiKey,
-    baseURL: options.baseURL ?? "https://api.skalpel.ai",
-    workspace: options.workspace,
-    fallbackOnError: options.fallbackOnError ?? true,
-    timeout: options.timeout ?? 3e4,
-    retries: options.retries ?? 2,
-    verbose: options.verbose ?? false,
-    headers: options.headers ?? {},
-    onFallback: options.onFallback,
-    onMetadata: options.onMetadata
-  };
+  return void 0;
 }
-function buildSkalpelHeaders(config) {
-  const headers = {
-    "Authorization": `Bearer ${config.apiKey}`,
-    "X-Skalpel-SDK-Version": VERSION,
-    ...config.headers
-  };
-  if (config.workspace) {
-    headers["X-Skalpel-Workspace"] = config.workspace;
-  }
-  return headers;
+function stripSkalpelHeaders(headers) {
+  const cleaned = { ...headers };
+  delete cleaned["X-Skalpel-API-Key"];
+  delete cleaned["X-Skalpel-Source"];
+  delete cleaned["X-Skalpel-Agent-Type"];
+  delete cleaned["X-Skalpel-SDK-Version"];
+  delete cleaned["X-Skalpel-Auth-Mode"];
+  return cleaned;
 }
-function extractMetadataFromResponse(response, config) {
-  if (!response || typeof response !== "object") return;
-  const resp = response;
-  if (resp._response && typeof resp._response === "object") {
-    const raw = resp._response;
-    if (raw.headers) {
-      const metadata = extractMetadata(raw.headers);
-      if (metadata) {
-        config.onMetadata?.(metadata);
-        return;
+async function doStreamingFetch(url, body, headers) {
+  return fetch(url, { method: "POST", headers, body, dispatcher: skalpelDispatcher });
+}
+async function handleStreamingRequest(_req, res, _config, _source, body, skalpelUrl, directUrl, useSkalpel, forwardHeaders, logger) {
+  let response = null;
+  let fetchError = null;
+  let usedFallback = false;
+  if (useSkalpel) {
+    logger.info(`streaming fetch sending url=${skalpelUrl}`);
+    try {
+      response = await doStreamingFetch(skalpelUrl, body, forwardHeaders);
+    } catch (err) {
+      fetchError = err;
+    }
+    if (response && !fetchError) logger.info(`streaming fetch received status=${response.status} url=${skalpelUrl}`);
+    if (await isSkalpelBackendFailure(response, fetchError, logger)) {
+      logger.warn(`streaming: Skalpel backend failed (${fetchError ? formatFetchErrorForLog(fetchError, skalpelUrl) : `status ${response?.status}`}), falling back to direct Anthropic API`);
+      usedFallback = true;
+      response = null;
+      fetchError = null;
+      const directHeaders = stripSkalpelHeaders(forwardHeaders);
+      logger.info(`streaming fetch sending url=${directUrl} fallback=true`);
+      try {
+        response = await doStreamingFetch(directUrl, body, directHeaders);
+      } catch (err) {
+        fetchError = err;
       }
+      if (response && !fetchError) logger.info(`streaming fetch received status=${response.status} url=${directUrl} fallback=true`);
+    }
+  } else {
+    logger.info(`streaming fetch sending url=${directUrl}`);
+    try {
+      response = await doStreamingFetch(directUrl, body, forwardHeaders);
+    } catch (err) {
+      fetchError = err;
     }
+    if (response && !fetchError) logger.info(`streaming fetch received status=${response.status} url=${directUrl}`);
   }
-  if (resp.x_skalpel && typeof resp.x_skalpel === "object") {
-    const sk = resp.x_skalpel;
-    const metadata = {
-      requestId: sk.request_id ?? "",
-      optimization: sk.optimization ?? "none",
-      originalModel: sk.original_model ?? "",
-      actualModel: sk.actual_model ?? "",
-      savingsUsd: Number(sk.savings_usd ?? 0),
-      cacheHit: Boolean(sk.cache_hit),
-      latencyMs: Number(sk.latency_ms ?? 0)
-    };
-    config.onMetadata?.(metadata);
+  const finalUrl = usedFallback || !useSkalpel ? directUrl : skalpelUrl;
+  const finalHeaders = usedFallback ? stripSkalpelHeaders(forwardHeaders) : forwardHeaders;
+  if (fetchError) {
+    const code = fetchError.code;
+    if (code && TIMEOUT_CODES2.has(code)) {
+      try {
+        response = await handleTimeoutWithRetry(
+          fetchError,
+          () => doStreamingFetch(finalUrl, body, finalHeaders),
+          logger
+        );
+        fetchError = null;
+      } catch (retryErr) {
+        fetchError = retryErr;
+      }
+    }
   }
-}
-function isOpenAIClient(client) {
-  if (!client || typeof client !== "object") return false;
-  const c = client;
-  return c.chat !== void 0 && typeof c.chat === "object" && c.chat !== null && "completions" in c.chat;
-}
-function isAnthropicClient(client) {
-  if (!client || typeof client !== "object") return false;
-  const c = client;
-  return c.messages !== void 0 && typeof c.messages === "object" && c.messages !== null && typeof c.messages.create === "function";
-}
-function wrapOpenAI(client, config) {
-  const c = client;
-  const skalpelHeaders = buildSkalpelHeaders(config);
-  const originalBaseURL = c.baseURL;
-  const mutex = new AsyncMutex();
-  function createMethodProxy(target, methodName) {
-    const originalMethod = target[methodName];
-    return async function(...args) {
-      const primaryFn = async () => {
-        const release = await mutex.acquire();
-        try {
-          c.baseURL = `${config.baseURL}/v1`;
-          const requestArgs = args[0];
-          const extraHeaders = skalpelHeaders;
-          let callArgs;
-          if (args.length >= 2 && typeof args[1] === "object" && args[1] !== null) {
-            const opts = args[1];
-            opts.headers = { ...extraHeaders, ...opts.headers };
-            callArgs = [requestArgs, opts, ...args.slice(2)];
-          } else {
-            callArgs = [requestArgs, { headers: extraHeaders }, ...args.slice(2)];
-          }
-          try {
-            const result = await originalMethod.apply(target, callArgs);
-            extractMetadataFromResponse(result, config);
-            return result;
-          } finally {
-            c.baseURL = originalBaseURL;
-          }
-        } finally {
-          release();
-        }
-      };
-      const fallbackFn = async () => {
-        c.baseURL = originalBaseURL;
-        return originalMethod.apply(target, args);
-      };
-      return withFallback(primaryFn, fallbackFn, {
-        retries: config.retries,
-        verbose: config.verbose,
-        onFallback: config.onFallback,
-        provider: "openai",
-        fallbackOnError: config.fallbackOnError
-      });
-    };
+  if (response && response.status === 429) {
+    response = await handle429WithRetryAfter(
+      response,
+      () => doStreamingFetch(finalUrl, body, finalHeaders),
+      logger
+    );
   }
-  function createNamespaceProxy(namespace) {
-    return new Proxy(namespace, {
-      get(target, prop, receiver) {
-        const value = Reflect.get(target, prop, receiver);
-        if (typeof value === "function" && (prop === "create" || prop === "stream")) {
-          return createMethodProxy(target, prop);
-        }
-        if (value && typeof value === "object" && !Array.isArray(value)) {
-          return createNamespaceProxy(value);
-        }
-        return value;
-      }
+  if (!response || fetchError) {
+    const errMsg = fetchError ? formatFetchErrorForLog(fetchError, finalUrl) : "no response from upstream";
+    logger.error(`streaming fetch failed: ${errMsg}`);
+    res.writeHead(HTTP_BAD_GATEWAY, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache"
     });
+    const envelope = buildErrorEnvelope(HTTP_BAD_GATEWAY, errMsg, "skalpel-proxy");
+    res.write(`event: error
+data: ${JSON.stringify(envelope)}
+
+`);
+    res.end();
+    return;
   }
-  return new Proxy(client, {
-    get(target, prop, receiver) {
-      const value = Reflect.get(target, prop, receiver);
-      if (typeof value === "object" && value !== null && (prop === "chat" || prop === "completions" || prop === "embeddings")) {
-        return createNamespaceProxy(value);
-      }
-      return value;
+  if (usedFallback) {
+    logger.info("streaming: using direct Anthropic API fallback");
+  }
+  if (response.status >= 300) {
+    const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
+    const originHeader = response.headers.get("x-skalpel-origin");
+    let origin;
+    if (originHeader === "backend") origin = "skalpel-backend";
+    else if (originHeader === "provider") origin = "provider";
+    else origin = "provider";
+    let rawBody = "";
+    let bodyReadFailed = false;
+    try {
+      rawBody = Buffer.from(await response.arrayBuffer()).toString();
+    } catch (readErr) {
+      bodyReadFailed = true;
+      logger.error(`streaming body-read failed after upstream status: ${readErr.message}`);
     }
-  });
-}
-function wrapAnthropic(client, config) {
-  const c = client;
-  const skalpelHeaders = buildSkalpelHeaders(config);
-  const originalBaseURL = c.baseURL ?? c._client?.baseURL;
-  const mutex = new AsyncMutex();
-  function createMethodProxy(target, methodName) {
-    const originalMethod = target[methodName];
-    return async function(...args) {
-      const primaryFn = async () => {
-        const release = await mutex.acquire();
-        try {
-          const proxyURL = config.baseURL;
-          if ("baseURL" in c) c.baseURL = proxyURL;
-          if (c._client && "baseURL" in c._client) c._client.baseURL = proxyURL;
-          const requestArgs = args[0];
-          const extraHeaders = skalpelHeaders;
-          let callArgs;
-          if (args.length >= 2 && typeof args[1] === "object" && args[1] !== null) {
-            const opts = args[1];
-            opts.headers = { ...extraHeaders, ...opts.headers };
-            callArgs = [requestArgs, opts, ...args.slice(2)];
-          } else {
-            callArgs = [requestArgs, { headers: extraHeaders }, ...args.slice(2)];
-          }
+    if (!bodyReadFailed) {
+      logger.error(`streaming upstream error: status=${response.status} body=${rawBody.slice(0, 500)}`);
+    }
+    const envelope = bodyReadFailed ? buildErrorEnvelope(
+      response.status,
+      "",
+      "skalpel-proxy",
+      "mid-stream abort",
+      retryAfter
+    ) : buildErrorEnvelope(response.status, rawBody, origin, void 0, retryAfter);
+    res.writeHead(response.status, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache"
+    });
+    res.write(`event: error
+data: ${JSON.stringify(envelope)}
+
+`);
+    res.end();
+    return;
+  }
+  const sseHeaders = {};
+  for (const [key, value] of response.headers.entries()) {
+    if (!STRIP_HEADERS.has(key) && key !== "content-type") {
+      sseHeaders[key] = value;
+    }
+  }
+  sseHeaders["Content-Type"] = "text/event-stream";
+  sseHeaders["Cache-Control"] = "no-cache";
+  res.writeHead(response.status, sseHeaders);
+  if (!response.body) {
+    res.write(`event: error
+data: ${JSON.stringify({ error: "no response body" })}
+
+`);
+    res.end();
+    return;
+  }
+  try {
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let chunkCount = 0;
+    let totalBytes = 0;
+    logger.info("streaming started");
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      chunkCount++;
+      totalBytes += value.byteLength;
+      logger.debug(`streaming chunk #${chunkCount} bytes=${value.byteLength} totalBytes=${totalBytes}`);
+      const chunk = decoder.decode(value, { stream: true });
+      res.write(chunk);
+    }
+    logger.info(`streaming completed chunks=${chunkCount} totalBytes=${totalBytes}`);
+  } catch (err) {
+    logger.error(`streaming error: ${err.message}`);
+    const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
+    const envelope = buildErrorEnvelope(
+      response.status,
+      err.message,
+      "skalpel-proxy",
+      "mid-stream abort",
+      retryAfter
+    );
+    res.write(`event: error
+data: ${JSON.stringify(envelope)}
+
+`);
+  }
+  res.end();
+}
+var TIMEOUT_CODES2, HTTP_BAD_GATEWAY, HOP_BY_HOP, STRIP_HEADERS;
+var init_streaming = __esm({
+  "src/proxy/streaming.ts"() {
+    "use strict";
+    init_dispatcher();
+    init_handler();
+    init_envelope();
+    init_recovery();
+    init_fetch_error();
+    TIMEOUT_CODES2 = /* @__PURE__ */ new Set(["ETIMEDOUT", "TIMEOUT", "UND_ERR_HEADERS_TIMEOUT"]);
+    HTTP_BAD_GATEWAY = 502;
+    HOP_BY_HOP = /* @__PURE__ */ new Set([
+      "connection",
+      "keep-alive",
+      "proxy-authenticate",
+      "proxy-authorization",
+      "te",
+      "trailer",
+      "transfer-encoding",
+      "upgrade"
+    ]);
+    STRIP_HEADERS = /* @__PURE__ */ new Set([
+      ...HOP_BY_HOP,
+      "content-encoding",
+      "content-length"
+    ]);
+  }
+});
+
+// src/proxy/ws-client.ts
+import { EventEmitter } from "events";
+import WebSocket from "ws";
+function defaultBackoffBaseMs() {
+  const raw = process.env.SKALPEL_WS_BACKOFF_BASE_MS;
+  const parsed = raw === void 0 ? NaN : parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 1e3;
+}
+function computeBackoff(attempt, baseMs) {
+  const exp = Math.min(MAX_BACKOFF_MS, baseMs * Math.pow(2, attempt));
+  const jitter = exp * (0.2 * (Math.random() * 2 - 1));
+  return Math.max(0, Math.floor(exp + jitter));
+}
+var WS_SUBPROTOCOL, MAX_RECONNECTS, MAX_BACKOFF_MS, NON_TRANSIENT_CLOSE_CODES, BackendWsClient;
+var init_ws_client = __esm({
+  "src/proxy/ws-client.ts"() {
+    "use strict";
+    WS_SUBPROTOCOL = "skalpel-codex-v1";
+    MAX_RECONNECTS = 5;
+    MAX_BACKOFF_MS = 6e4;
+    NON_TRANSIENT_CLOSE_CODES = /* @__PURE__ */ new Set([4e3, 4001, 4002, 4004]);
+    BackendWsClient = class extends EventEmitter {
+      opts;
+      ws = null;
+      reconnectAttempts = 0;
+      closedByUser = false;
+      pendingReconnect = null;
+      constructor(opts) {
+        super();
+        this.opts = opts;
+      }
+      async connect() {
+        return new Promise((resolve, reject) => {
+          const ws = new WebSocket(this.opts.url, [WS_SUBPROTOCOL], {
+            headers: {
+              "X-Skalpel-API-Key": this.opts.apiKey,
+              Authorization: `Bearer ${this.opts.oauthToken}`,
+              "x-skalpel-source": this.opts.source
+            }
+          });
+          this.ws = ws;
+          ws.once("open", () => {
+            this.emit("open");
+            resolve();
+          });
+          ws.on("message", (data) => {
+            const text = data.toString("utf-8");
+            let parsed = null;
+            try {
+              parsed = JSON.parse(text);
+            } catch {
+              this.emit("error", new Error(`invalid frame: ${text.slice(0, 100)}`));
+              return;
+            }
+            this.emit("frame", parsed);
+          });
+          ws.on("error", (err) => {
+            this.opts.logger.debug(`ws-client error: ${err.message}`);
+            this.emit("error", err);
+          });
+          ws.once("close", (code, reasonBuf) => {
+            const reason = reasonBuf.toString("utf-8");
+            this.opts.logger.info(`ws-client close code=${code} reason=${reason}`);
+            this.ws = null;
+            if (this.closedByUser || code === 1e3) {
+              this.emit("close", code, reason);
+              return;
+            }
+            if (NON_TRANSIENT_CLOSE_CODES.has(code)) {
+              this.emit("close", code, reason);
+              this.emit("fallback", `close_${code}:${reason}`);
+              return;
+            }
+            this.scheduleReconnect(resolve, reject);
+            this.emit("close", code, reason);
+          });
+        });
+      }
+      scheduleReconnect(initialResolve, initialReject) {
+        if (this.reconnectAttempts >= MAX_RECONNECTS) {
+          this.emit("fallback", "reconnect_exhausted");
+          return;
+        }
+        this.reconnectAttempts += 1;
+        const delay = computeBackoff(this.reconnectAttempts, defaultBackoffBaseMs());
+        this.opts.logger.info(
+          `ws-client reconnect attempt=${this.reconnectAttempts} delay=${delay}ms`
+        );
+        this.pendingReconnect = setTimeout(() => {
+          this.pendingReconnect = null;
+          this.connect().catch((err) => {
+            this.opts.logger.debug(`reconnect failed: ${err.message}`);
+          });
+        }, delay);
+        void initialResolve;
+        void initialReject;
+      }
+      send(frame) {
+        if (this.ws === null || this.ws.readyState !== WebSocket.OPEN) {
+          throw new Error("ws-client send: socket not open");
+        }
+        this.ws.send(JSON.stringify(frame));
+      }
+      close(code = 1e3, reason = "client close") {
+        this.closedByUser = true;
+        if (this.pendingReconnect !== null) {
+          clearTimeout(this.pendingReconnect);
+          this.pendingReconnect = null;
+        }
+        if (this.ws !== null) {
           try {
-            const result = await originalMethod.apply(target, callArgs);
-            extractMetadataFromResponse(result, config);
-            return result;
-          } finally {
-            if ("baseURL" in c) c.baseURL = originalBaseURL;
-            if (c._client && "baseURL" in c._client) c._client.baseURL = originalBaseURL;
+            this.ws.close(code, reason);
+          } catch {
           }
-        } finally {
-          release();
+          this.ws = null;
         }
-      };
-      const fallbackFn = async () => {
-        if ("baseURL" in c) c.baseURL = originalBaseURL;
-        if (c._client && "baseURL" in c._client) c._client.baseURL = originalBaseURL;
-        return originalMethod.apply(target, args);
-      };
-      return withFallback(primaryFn, fallbackFn, {
-        retries: config.retries,
-        verbose: config.verbose,
-        onFallback: config.onFallback,
-        provider: "anthropic",
-        fallbackOnError: config.fallbackOnError
-      });
+      }
     };
   }
-  return new Proxy(client, {
-    get(target, prop, receiver) {
-      const value = Reflect.get(target, prop, receiver);
-      if (prop === "messages" && typeof value === "object" && value !== null) {
-        return new Proxy(value, {
-          get(msgTarget, msgProp, msgReceiver) {
-            const msgValue = Reflect.get(msgTarget, msgProp, msgReceiver);
-            if (typeof msgValue === "function" && (msgProp === "create" || msgProp === "stream")) {
-              return createMethodProxy(msgTarget, msgProp);
-            }
-            return msgValue;
-          }
-        });
-      }
-      return value;
-    }
+});
+
+// src/proxy/handler.ts
+var handler_exports = {};
+__export(handler_exports, {
+  buildForwardHeaders: () => buildForwardHeaders,
+  handleRequest: () => handleRequest,
+  handleWebSocketBridge: () => handleWebSocketBridge,
+  isSkalpelBackendFailure: () => isSkalpelBackendFailure,
+  shouldRouteToSkalpel: () => shouldRouteToSkalpel
+});
+function collectBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => resolve(Buffer.concat(chunks).toString()));
+    req.on("error", reject);
   });
 }
-function createSkalpelClient(client, options) {
-  const config = resolveConfig(options);
-  if (isOpenAIClient(client)) {
-    return wrapOpenAI(client, config);
-  }
-  if (isAnthropicClient(client)) {
-    return wrapAnthropic(client, config);
-  }
-  throw new Error(
-    "Unsupported client. createSkalpelClient supports OpenAI and Anthropic SDK clients."
-  );
+function shouldRouteToSkalpel(path4, source) {
+  if (source !== "claude-code") return true;
+  const pathname = path4.split("?")[0];
+  return SKALPEL_EXACT_PATHS.has(pathname);
 }
-async function contextRequest(config, path4, body) {
-  const url = `${config.baseURL}/api/workspaces${path4}`;
-  const headers = buildSkalpelHeaders(config);
-  headers["Content-Type"] = "application/json";
-  const controller = new AbortController();
-  const timeoutId = setTimeout(() => controller.abort(), config.timeout);
+async function isSkalpelBackendFailure(response, err, logger) {
+  if (err) return true;
+  if (!response) return true;
+  if (response.status < 500) return false;
+  const origin = response.headers?.get("x-skalpel-origin");
+  if (origin === "provider") return false;
+  if (origin === "backend") return true;
   try {
-    const response = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body),
-      signal: controller.signal
-    });
-    if (!response.ok) {
-      const text = await response.text().catch(() => "");
-      const message = `Skalpel context API error ${response.status}: ${text}`;
-      if (response.status >= 400 && response.status < 500) {
-        throw new SkalpelClientRequestError(message, response.status);
+    const text = await response.clone().text();
+    if (!text) {
+      logger?.debug(`isSkalpelBackendFailure heuristic: status=${response.status} result=true shape=non-anthropic`);
+      return true;
+    }
+    let shape = "non-anthropic";
+    try {
+      const parsed = JSON.parse(text);
+      if (parsed && typeof parsed === "object" && parsed.type === "error" && parsed.error && typeof parsed.error === "object" && typeof parsed.error.type === "string" && typeof parsed.error.message === "string") {
+        shape = "anthropic";
+        logger?.debug(`isSkalpelBackendFailure heuristic: status=${response.status} result=false shape=${shape}`);
+        return false;
       }
-      throw new SkalpelUnavailableError(message, response.status);
+    } catch {
     }
-    return await response.json();
-  } finally {
-    clearTimeout(timeoutId);
+    logger?.debug(`isSkalpelBackendFailure heuristic: status=${response.status} result=true shape=${shape}`);
+    return true;
+  } catch {
+    logger?.debug(`isSkalpelBackendFailure heuristic: status=${response?.status ?? "null"} result=true shape=non-anthropic`);
+    return true;
   }
 }
-async function createSnapshot(options, params) {
-  const config = resolveConfig(options);
-  const raw = await contextRequest(config, "/snapshots", {
-    workspace_id: params.workspaceId,
-    snapshot_hash: params.snapshotHash,
-    manifest: params.manifest ?? {},
-    metadata: params.metadata ?? null
-  });
-  return {
-    id: String(raw.id),
-    workspaceId: String(raw.workspace_id),
-    snapshotHash: String(raw.snapshot_hash),
-    manifest: raw.manifest ?? {},
-    metadata: raw.metadata ?? null,
-    createdAt: String(raw.created_at)
-  };
-}
-async function uploadChunks(options, params) {
-  const config = resolveConfig(options);
-  const raw = await contextRequest(config, "/chunks", {
-    workspace_id: params.workspaceId,
-    snapshot_id: params.snapshotId,
-    chunks: params.chunks.map((c) => ({
-      path: c.path,
-      chunk_hash: c.chunkHash,
-      chunk_text: c.chunkText,
-      symbol: c.symbol ?? null,
-      language: c.language ?? null,
-      token_count: c.tokenCount ?? 0,
-      metadata: c.metadata ?? null
-    }))
-  });
-  return (raw.items ?? []).map((item) => ({
-    id: String(item.id),
-    workspaceId: String(item.workspace_id),
-    snapshotId: String(item.snapshot_id),
-    path: String(item.path),
-    chunkHash: String(item.chunk_hash),
-    symbol: item.symbol != null ? String(item.symbol) : null,
-    language: item.language != null ? String(item.language) : null,
-    tokenCount: Number(item.token_count ?? 0),
-    metadata: item.metadata ?? null,
-    createdAt: String(item.created_at)
-  }));
+function buildForwardHeaders(req, config, source, useSkalpel) {
+  const forwardHeaders = {};
+  for (const [key, value] of Object.entries(req.headers)) {
+    if (value === void 0) continue;
+    if (FORWARD_HEADER_STRIP.has(key.toLowerCase())) continue;
+    forwardHeaders[key] = Array.isArray(value) ? value.join(", ") : value;
+  }
+  if (useSkalpel) {
+    forwardHeaders["X-Skalpel-API-Key"] = config.apiKey;
+    forwardHeaders["X-Skalpel-Source"] = source;
+    forwardHeaders["X-Skalpel-Agent-Type"] = source;
+    forwardHeaders["X-Skalpel-SDK-Version"] = "proxy-1.0.0";
+    forwardHeaders["X-Skalpel-Auth-Mode"] = "passthrough";
+    if (source === "claude-code" && !forwardHeaders["x-api-key"]) {
+      const authHeader = forwardHeaders["authorization"] ?? "";
+      if (authHeader.toLowerCase().startsWith("bearer ")) {
+        const token = authHeader.slice(7).trim();
+        if (token.startsWith("sk-ant-")) {
+          forwardHeaders["x-api-key"] = token;
+          delete forwardHeaders["authorization"];
+        }
+      }
+    }
+  }
+  return forwardHeaders;
 }
-async function resolveContext(options, params) {
-  const config = resolveConfig(options);
-  const raw = await contextRequest(config, "/context/resolve", {
-    workspace_id: params.workspaceId,
-    snapshot_id: params.snapshotId ?? null,
-    query: params.query,
-    changed_paths: params.changedPaths ?? [],
-    limit: params.limit ?? 8
-  });
-  const items = raw.items ?? [];
-  return {
-    workspaceId: String(raw.workspace_id),
-    snapshotId: raw.snapshot_id != null ? String(raw.snapshot_id) : null,
-    items: items.map((item) => ({
-      path: String(item.path),
-      symbol: item.symbol != null ? String(item.symbol) : null,
-      language: item.language != null ? String(item.language) : null,
-      tokenCount: Number(item.token_count ?? 0),
-      score: Number(item.score ?? 0),
-      reason: String(item.reason ?? "semantic"),
-      metadata: item.metadata ?? null,
-      preview: String(item.preview ?? "")
-    }))
-  };
+function stripSkalpelHeaders2(headers) {
+  const cleaned = { ...headers };
+  delete cleaned["X-Skalpel-API-Key"];
+  delete cleaned["X-Skalpel-Source"];
+  delete cleaned["X-Skalpel-Agent-Type"];
+  delete cleaned["X-Skalpel-SDK-Version"];
+  delete cleaned["X-Skalpel-Auth-Mode"];
+  return cleaned;
 }
-
-// src/url-swap.ts
-var SKALPEL_MANAGED_SENTINEL = "skalpel-managed";
-function buildHeaders(options) {
-  const headers = {
-    "X-Skalpel-SDK-Version": VERSION,
-    ...options.headers
-  };
-  if (options.workspace) {
-    headers["X-Skalpel-Workspace"] = options.workspace;
+function extractResponseHeaders(response) {
+  const headers = {};
+  for (const [key, value] of response.headers.entries()) {
+    if (!STRIP_RESPONSE_HEADERS.has(key)) {
+      headers[key] = value;
+    }
   }
   return headers;
 }
-async function createSkalpelOpenAI(options) {
-  const { default: OpenAI } = await import("openai");
-  const baseURL = `${options.baseURL ?? "https://api.skalpel.ai"}/v1`;
-  const sdkApiKey = options.providerApiKey ? options.providerApiKey : SKALPEL_MANAGED_SENTINEL;
-  return new OpenAI({
-    baseURL,
-    apiKey: sdkApiKey,
-    defaultHeaders: {
-      ...buildHeaders(options),
-      "Authorization": `Bearer ${options.apiKey}`
-    },
-    timeout: options.timeout ?? 3e4,
-    maxRetries: options.retries ?? 2
-  });
-}
-async function createSkalpelAnthropic(options) {
-  const { default: Anthropic } = await import("@anthropic-ai/sdk");
-  const baseURL = options.baseURL ?? "https://api.skalpel.ai";
-  const sdkApiKey = options.providerApiKey ? options.providerApiKey : SKALPEL_MANAGED_SENTINEL;
-  return new Anthropic({
-    baseURL,
-    apiKey: sdkApiKey,
-    defaultHeaders: {
-      ...buildHeaders(options),
-      "Authorization": `Bearer ${options.apiKey}`
-    },
-    timeout: options.timeout ?? 3e4,
-    maxRetries: options.retries ?? 2
-  });
-}
-
-// src/proxy/server.ts
-import http from "http";
-
-// src/proxy/dispatcher.ts
-import { Agent } from "undici";
-var skalpelDispatcher = new Agent({
-  keepAliveTimeout: 1e4,
-  keepAliveMaxTimeout: 6e4,
-  connections: 100,
-  pipelining: 1
-});
-
-// src/proxy/envelope.ts
-function isAnthropicShaped(body) {
-  if (typeof body !== "object" || body === null) return false;
-  const b = body;
-  if (b.type !== "error") return false;
-  if (typeof b.error !== "object" || b.error === null) return false;
-  return true;
-}
-function defaultErrorTypeFor(status) {
-  if (status === 400) return "invalid_request_error";
-  if (status === 401 || status === 403) return "authentication_error";
-  if (status === 404) return "not_found_error";
-  if (status === 408) return "timeout_error";
-  if (status === 429) return "rate_limit_error";
-  if (status >= 500) return "api_error";
-  if (status >= 400) return "invalid_request_error";
-  return "api_error";
+async function handleRequest(req, res, config, source, logger) {
+  const start = Date.now();
+  const method = req.method ?? "GET";
+  const path4 = req.url ?? "/";
+  const fp = tokenFingerprint(
+    typeof req.headers.authorization === "string" ? req.headers.authorization : void 0
+  );
+  logger.info(`${source} ${method} ${path4} token=${fp}`);
+  if (source === "codex") {
+    const ua = req.headers["user-agent"] ?? "";
+    const authScheme = typeof req.headers.authorization === "string" ? req.headers.authorization.split(" ")[0] ?? "none" : "none";
+    const upgrade = req.headers.upgrade ?? "";
+    const connection = req.headers.connection ?? "";
+    const contentType = req.headers["content-type"] ?? "";
+    logger.debug(`codex-diag method=${method} path=${path4} ua=${ua} authScheme=${authScheme} upgrade=${upgrade} connection=${connection} contentType=${contentType} hasBody=${method !== "GET" && method !== "HEAD"}`);
+  }
+  let response = null;
+  try {
+    const body = await collectBody(req);
+    logger.info(`body collected bytes=${body.length}`);
+    const useSkalpel = shouldRouteToSkalpel(path4, source);
+    logger.info(`routing useSkalpel=${useSkalpel}`);
+    const forwardHeaders = buildForwardHeaders(req, config, source, useSkalpel);
+    logger.debug(`headers built skalpelHeaders=${useSkalpel} authConverted=${!forwardHeaders["authorization"] && !!forwardHeaders["x-api-key"]}`);
+    let isStreaming = false;
+    if (body) {
+      try {
+        const parsed = JSON.parse(body);
+        isStreaming = parsed.stream === true;
+      } catch {
+      }
+    }
+    logger.info(`stream detection isStreaming=${isStreaming}`);
+    if (isStreaming) {
+      const skalpelUrl2 = `${config.remoteBaseUrl}${path4}`;
+      const directUrl2 = source === "claude-code" ? `${config.anthropicDirectUrl}${path4}` : source === "cursor" ? `${config.cursorDirectUrl}${path4}` : `${config.openaiDirectUrl}${path4}`;
+      await handleStreamingRequest(req, res, config, source, body, skalpelUrl2, directUrl2, useSkalpel, forwardHeaders, logger);
+      logger.info(`${method} ${path4} source=${source} streaming latency=${Date.now() - start}ms`);
+      return;
+    }
+    const skalpelUrl = `${config.remoteBaseUrl}${path4}`;
+    const directUrl = source === "claude-code" ? `${config.anthropicDirectUrl}${path4}` : source === "cursor" ? `${config.cursorDirectUrl}${path4}` : `${config.openaiDirectUrl}${path4}`;
+    const fetchBody = method !== "GET" && method !== "HEAD" ? body : void 0;
+    let fetchError = null;
+    let usedFallback = false;
+    if (useSkalpel) {
+      logger.info(`fetch sending url=${skalpelUrl} method=${method}`);
+      try {
+        response = await fetch(skalpelUrl, { method, headers: forwardHeaders, body: fetchBody, dispatcher: skalpelDispatcher });
+      } catch (err) {
+        fetchError = err;
+      }
+      if (response && !fetchError) logger.info(`fetch received status=${response.status} url=${skalpelUrl}`);
+      if (await isSkalpelBackendFailure(response, fetchError, logger)) {
+        logger.warn(`${method} ${path4} Skalpel backend failed (${fetchError ? formatFetchErrorForLog(fetchError, skalpelUrl) : `status ${response?.status}`}), falling back to direct Anthropic API`);
+        usedFallback = true;
+        response = null;
+        fetchError = null;
+        const directHeaders = stripSkalpelHeaders2(forwardHeaders);
+        logger.info(`fetch sending url=${directUrl} method=${method} fallback=true`);
+        try {
+          response = await fetch(directUrl, { method, headers: directHeaders, body: fetchBody, dispatcher: skalpelDispatcher });
+        } catch (err) {
+          fetchError = err;
+        }
+        if (response && !fetchError) logger.info(`fetch received status=${response.status} url=${directUrl} fallback=true`);
+      }
+    } else {
+      logger.info(`fetch sending url=${directUrl} method=${method}`);
+      try {
+        response = await fetch(directUrl, { method, headers: forwardHeaders, body: fetchBody, dispatcher: skalpelDispatcher });
+      } catch (err) {
+        fetchError = err;
+      }
+      if (response && !fetchError) logger.info(`fetch received status=${response.status} url=${directUrl}`);
+    }
+    const fetchUrl = usedFallback || !useSkalpel ? directUrl : skalpelUrl;
+    const fetchHeaders = usedFallback ? stripSkalpelHeaders2(forwardHeaders) : forwardHeaders;
+    if (fetchError) {
+      const code = fetchError.code;
+      if (code && TIMEOUT_CODES3.has(code)) {
+        logger.warn(`timeout detected code=${code} url=${fetchUrl}`);
+        try {
+          response = await handleTimeoutWithRetry(
+            fetchError,
+            () => fetch(fetchUrl, {
+              method,
+              headers: fetchHeaders,
+              body: fetchBody,
+              dispatcher: skalpelDispatcher
+            }),
+            logger
+          );
+          fetchError = null;
+        } catch (retryErr) {
+          fetchError = retryErr;
+        }
+      }
+    }
+    if (!response || fetchError) {
+      response = null;
+      throw fetchError ?? new Error("no response from upstream");
+    }
+    if (response.status === 429) {
+      logger.info(`429 received url=${fetchUrl}`);
+      response = await handle429WithRetryAfter(
+        response,
+        () => fetch(fetchUrl, {
+          method,
+          headers: fetchHeaders,
+          body: fetchBody,
+          dispatcher: skalpelDispatcher
+        }),
+        logger
+      );
+    }
+    if (response.status === 401 && (source === "claude-code" || source === "codex")) {
+      const fp2 = tokenFingerprint(
+        typeof req.headers.authorization === "string" ? req.headers.authorization : void 0
+      );
+      logger.debug(`handler: upstream 401 origin=provider token=${fp2} passthrough`);
+      const body401 = Buffer.from(await response.arrayBuffer());
+      const envelope = buildErrorEnvelope(401, body401.toString(), "provider");
+      res.writeHead(401, { "Content-Type": "application/json" });
+      res.end(JSON.stringify(envelope));
+      logger.info(`${method} ${path4} source=${source} status=401 (passthrough) latency=${Date.now() - start}ms`);
+      return;
+    }
+    const responseHeaders = extractResponseHeaders(response);
+    const responseBody = Buffer.from(await response.arrayBuffer());
+    responseHeaders["content-length"] = String(responseBody.length);
+    logger.info(`response forwarding status=${response.status} bodyBytes=${responseBody.length}`);
+    res.writeHead(response.status, responseHeaders);
+    res.end(responseBody);
+    logger.info(`${method} ${path4} source=${source} status=${response.status}${usedFallback ? " (fallback)" : ""} latency=${Date.now() - start}ms`);
+  } catch (err) {
+    logger.error(`${method} ${path4} source=${source} error=${formatFetchErrorForLog(err, path4)}`);
+    if (!res.headersSent) {
+      if (response !== null) {
+        const upstreamStatus = response.status;
+        const envelope = buildErrorEnvelope(
+          upstreamStatus,
+          "",
+          "skalpel-proxy",
+          "body read failed after upstream status"
+        );
+        res.writeHead(upstreamStatus, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(envelope));
+      } else {
+        const envelope = buildErrorEnvelope(
+          HTTP_BAD_GATEWAY2,
+          err.message,
+          "skalpel-proxy"
+        );
+        res.writeHead(HTTP_BAD_GATEWAY2, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(envelope));
+      }
+    }
+  }
 }
-function buildErrorEnvelope(status, upstreamBody, origin, hint, retryAfter) {
-  let parsed = upstreamBody;
-  if (typeof upstreamBody === "string" && upstreamBody.length > 0) {
+async function handleWebSocketBridge(clientWs, req, config, source, logger) {
+  const backendUrl = buildBackendWsUrl(config);
+  const oauthHeader = req.headers["authorization"] ?? "";
+  const oauthToken = oauthHeader.toLowerCase().startsWith("bearer ") ? oauthHeader.slice(7).trim() : "";
+  const backend = new BackendWsClient({
+    url: backendUrl,
+    apiKey: config.apiKey,
+    oauthToken,
+    source,
+    logger
+  });
+  let fallbackActive = false;
+  let backendOpen = false;
+  const pendingClientFrames = [];
+  const inflightRequests = /* @__PURE__ */ new Map();
+  const flushPending = () => {
+    if (!backendOpen || fallbackActive) return;
+    while (pendingClientFrames.length > 0) {
+      const frame = pendingClientFrames.shift();
+      if (frame === void 0) break;
+      try {
+        backend.send(frame);
+        if (frame.type === "request") {
+          const id = String(frame.id ?? "");
+          if (id) inflightRequests.set(id, frame);
+        }
+      } catch (err) {
+        logger.warn(`bridge: flush backend.send failed: ${err.message}`);
+        pendingClientFrames.unshift(frame);
+        return;
+      }
+    }
+  };
+  clientWs.on("message", (data) => {
+    const text = data.toString("utf-8");
+    let parsed;
     try {
-      parsed = JSON.parse(upstreamBody);
+      parsed = JSON.parse(text);
     } catch {
-      parsed = upstreamBody;
+      logger.warn("bridge: invalid client frame (dropped)");
+      return;
+    }
+    pendingClientFrames.push(parsed);
+    flushPending();
+  });
+  clientWs.on("close", (code, reason) => {
+    logger.info(`bridge: client closed code=${code} reason=${String(reason)}`);
+    backend.close(1e3, "client closed");
+  });
+  backend.on("open", () => {
+    backendOpen = true;
+    flushPending();
+  });
+  backend.on("frame", (frame) => {
+    try {
+      clientWs.send(JSON.stringify(frame));
+    } catch (err) {
+      logger.debug(`bridge: client.send failed: ${err.message}`);
     }
+    if (typeof frame === "object" && frame !== null) {
+      const fr = frame;
+      const t = fr.type;
+      if (t === "done" || t === "error") {
+        const id = String(fr.id ?? "");
+        if (id) inflightRequests.delete(id);
+      }
+    }
+  });
+  backend.on("close", (code, reason) => {
+    logger.info(`bridge: backend closed code=${code} reason=${reason}`);
+    backendOpen = false;
+  });
+  backend.on("error", (err) => {
+    logger.debug(`bridge: backend error: ${err.message}`);
+  });
+  backend.on("fallback", (reason) => {
+    fallbackActive = true;
+    backendOpen = false;
+    logger.warn(`bridge: backend fallback reason=${reason} \u2014 switching to HTTP POST`);
+    const replay = [
+      ...inflightRequests.values(),
+      ...pendingClientFrames.splice(0)
+    ];
+    inflightRequests.clear();
+    drainPendingToHttp(clientWs, config, source, logger, replay).catch((httpErr) => {
+      logger.error(`bridge HTTP drain failed: ${httpErr.message}`);
+      try {
+        clientWs.close(4003, "fallback drain failed");
+      } catch {
+      }
+    });
+  });
+  try {
+    await backend.connect();
+  } catch (err) {
+    logger.error(`bridge: initial connect failed: ${err.message}`);
   }
-  let type = defaultErrorTypeFor(status);
-  let message;
-  if (isAnthropicShaped(parsed)) {
-    const inner = parsed.error;
-    if (typeof inner.type === "string" && inner.type.length > 0) {
-      type = inner.type;
+}
+function buildBackendWsUrl(config) {
+  const base = config.remoteBaseUrl.replace(/^http/, "ws");
+  return `${base}/v1/responses`;
+}
+async function drainPendingToHttp(clientWs, config, source, logger, frames) {
+  for (const frame of frames) {
+    if (frame.type !== "request") continue;
+    const payload = frame.payload ?? {};
+    const id = String(frame.id ?? "");
+    try {
+      const resp = await fetch(`${config.remoteBaseUrl}/v1/responses`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-Skalpel-API-Key": config.apiKey,
+          "x-skalpel-source": source,
+          Accept: "text/event-stream"
+        },
+        body: JSON.stringify(payload)
+      });
+      if (!resp.ok || resp.body === null) {
+        clientWs.send(
+          JSON.stringify({
+            type: "error",
+            id,
+            payload: { code: resp.status, detail: `http fallback status ${resp.status}` }
+          })
+        );
+        continue;
+      }
+      const reader = resp.body.getReader();
+      const decoder = new TextDecoder("utf-8");
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        if (value === void 0) continue;
+        const chunkText = decoder.decode(value, { stream: true });
+        clientWs.send(
+          JSON.stringify({ type: "chunk", id, payload: { data: chunkText } })
+        );
+      }
+      clientWs.send(JSON.stringify({ type: "done", id, payload: {} }));
+    } catch (err) {
+      logger.warn(`http fallback frame failed: ${err.message}`);
+      clientWs.send(
+        JSON.stringify({
+          type: "error",
+          id,
+          payload: { code: 502, detail: err.message }
+        })
+      );
     }
-    message = typeof inner.message === "string" && inner.message.length > 0 ? inner.message : defaultMessageForStatus(status);
-  } else if (typeof parsed === "string" && parsed.length > 0) {
-    message = parsed;
-  } else {
-    message = defaultMessageForStatus(status);
   }
-  const envelope = {
-    type: "error",
-    error: {
-      type,
-      message,
-      status_code: status,
-      origin
+}
+var TIMEOUT_CODES3, HTTP_BAD_GATEWAY2, SKALPEL_EXACT_PATHS, FORWARD_HEADER_STRIP, STRIP_RESPONSE_HEADERS;
+var init_handler = __esm({
+  "src/proxy/handler.ts"() {
+    "use strict";
+    init_streaming();
+    init_dispatcher();
+    init_envelope();
+    init_ws_client();
+    init_recovery();
+    init_fetch_error();
+    TIMEOUT_CODES3 = /* @__PURE__ */ new Set(["ETIMEDOUT", "TIMEOUT", "UND_ERR_HEADERS_TIMEOUT"]);
+    HTTP_BAD_GATEWAY2 = 502;
+    SKALPEL_EXACT_PATHS = /* @__PURE__ */ new Set(["/v1/messages"]);
+    FORWARD_HEADER_STRIP = /* @__PURE__ */ new Set([
+      "host",
+      "connection",
+      "keep-alive",
+      "proxy-authenticate",
+      "proxy-authorization",
+      "te",
+      "trailer",
+      "transfer-encoding",
+      "upgrade"
+    ]);
+    STRIP_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
+      "connection",
+      "keep-alive",
+      "proxy-authenticate",
+      "proxy-authorization",
+      "te",
+      "trailer",
+      "transfer-encoding",
+      "upgrade",
+      "content-encoding",
+      "content-length"
+    ]);
+  }
+});
+
+// src/metadata.ts
+function extractMetadata(headers) {
+  const get = (name) => {
+    if (headers instanceof Headers) {
+      return headers.get(name);
     }
+    return headers[name] ?? null;
+  };
+  const requestId = get("x-skalpel-request-id");
+  if (!requestId) return null;
+  return {
+    requestId,
+    optimization: get("x-skalpel-optimization") ?? "none",
+    originalModel: get("x-skalpel-original-model") ?? "",
+    actualModel: get("x-skalpel-actual-model") ?? "",
+    savingsUsd: parseFloat(get("x-skalpel-savings-usd") ?? "0"),
+    cacheHit: get("x-skalpel-cache-hit") === "true",
+    latencyMs: parseInt(get("x-skalpel-latency-ms") ?? "0", 10)
   };
-  if (hint !== void 0) envelope.error.hint = hint;
-  if (retryAfter !== void 0) envelope.error.retry_after = retryAfter;
-  return envelope;
-}
-function defaultMessageForStatus(status) {
-  if (status === 401) return "Authentication failed";
-  if (status === 403) return "Forbidden";
-  if (status === 404) return "Not found";
-  if (status === 408) return "Request timed out";
-  if (status === 429) return "Rate limit exceeded";
-  if (status === 502) return "Bad gateway";
-  if (status === 503) return "Service unavailable";
-  if (status === 504) return "Gateway timeout";
-  if (status >= 500) return "Upstream error";
-  if (status >= 400) return "Client error";
-  return "Error";
 }
 
-// src/proxy/recovery.ts
-import { createHash } from "crypto";
-function parseRetryAfterHeader(header) {
-  if (!header) return void 0;
-  const trimmed = header.trim();
-  if (!trimmed) return void 0;
-  const n = Number(trimmed);
-  if (Number.isFinite(n) && n >= 0) return Math.floor(n);
-  const dateMs = Date.parse(trimmed);
-  if (Number.isFinite(dateMs)) {
-    return Math.max(0, Math.ceil((dateMs - Date.now()) / 1e3));
+// src/errors.ts
+var SkalpelError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  constructor(message, code, statusCode, retryAfter) {
+    super(message);
+    this.name = "SkalpelError";
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = retryAfter;
   }
-  return void 0;
-}
-function sleep2(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-var MAX_RETRY_AFTER_SECONDS = 60;
-var DEFAULT_BACKOFF_SECONDS = 2;
-async function handle429WithRetryAfter(response, retryFn, logger) {
-  const headerVal = response.headers.get("retry-after");
-  const parsed = parseRetryAfterHeader(headerVal);
-  if (parsed === void 0) {
-    await sleep2(DEFAULT_BACKOFF_SECONDS * 1e3);
-    const retried2 = await retryFn();
-    logger.info("proxy.recovery.429_retry_count increment");
-    return retried2;
+};
+var SkalpelAuthError = class extends SkalpelError {
+  constructor(message = "Skalpel authentication failed") {
+    super(message, "SKALPEL_AUTH_FAILED", 401);
+    this.name = "SkalpelAuthError";
   }
-  if (parsed > MAX_RETRY_AFTER_SECONDS) {
-    return response;
+};
+var SkalpelTimeoutError = class extends SkalpelError {
+  constructor(message = "Skalpel request timed out") {
+    super(message, "SKALPEL_TIMEOUT");
+    this.name = "SkalpelTimeoutError";
   }
-  await sleep2(parsed * 1e3);
-  const retried = await retryFn();
-  logger.info("proxy.recovery.429_retry_count increment");
-  return retried;
-}
-var TIMEOUT_CODES = /* @__PURE__ */ new Set(["ETIMEDOUT", "TIMEOUT", "UND_ERR_HEADERS_TIMEOUT"]);
-async function handleTimeoutWithRetry(err, retryFn, logger) {
-  const code = err.code;
-  if (!code || !TIMEOUT_CODES.has(code)) {
-    throw err;
+};
+var SkalpelRateLimitError = class extends SkalpelError {
+  constructor(message = "Skalpel rate limit exceeded", retryAfter) {
+    super(message, "SKALPEL_RATE_LIMITED", 429, retryAfter);
+    this.name = "SkalpelRateLimitError";
   }
-  await sleep2(DEFAULT_BACKOFF_SECONDS * 1e3);
-  const retried = await retryFn();
-  logger.info("proxy.recovery.timeout_retry_count increment");
-  return retried;
-}
-function tokenFingerprint(authHeader) {
-  if (authHeader === void 0) return "none";
-  return createHash("sha256").update(authHeader).digest("hex").slice(0, 12);
-}
-var MUTEX_MAX_ENTRIES = 1024;
-var LruMutexMap = class extends Map {
-  set(key, value) {
-    if (this.has(key)) {
-      super.delete(key);
-    } else if (this.size >= MUTEX_MAX_ENTRIES) {
-      const oldest = this.keys().next().value;
-      if (oldest !== void 0) super.delete(oldest);
-    }
-    return super.set(key, value);
+};
+var SkalpelUnavailableError = class extends SkalpelError {
+  constructor(message = "Skalpel service unavailable", statusCode) {
+    super(message, "SKALPEL_UNAVAILABLE", statusCode);
+    this.name = "SkalpelUnavailableError";
   }
 };
-var refreshMutex = new LruMutexMap();
-
-// src/proxy/streaming.ts
-var TIMEOUT_CODES2 = /* @__PURE__ */ new Set(["ETIMEDOUT", "TIMEOUT", "UND_ERR_HEADERS_TIMEOUT"]);
-var HTTP_BAD_GATEWAY = 502;
-function parseRetryAfter(header) {
-  if (!header) return void 0;
-  const trimmed = header.trim();
-  if (!trimmed) return void 0;
-  const n = Number(trimmed);
-  if (Number.isFinite(n) && n >= 0) return Math.floor(n);
-  const dateMs = Date.parse(trimmed);
-  if (Number.isFinite(dateMs)) {
-    const delta = Math.max(0, Math.ceil((dateMs - Date.now()) / 1e3));
-    return delta;
+var SkalpelClientRequestError = class extends SkalpelError {
+  constructor(message, statusCode) {
+    super(message, "SKALPEL_CLIENT_REQUEST", statusCode);
+    this.name = "SkalpelClientRequestError";
   }
-  return void 0;
-}
-var HOP_BY_HOP = /* @__PURE__ */ new Set([
-  "connection",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-]);
-var STRIP_HEADERS = /* @__PURE__ */ new Set([
-  ...HOP_BY_HOP,
-  "content-encoding",
-  "content-length"
-]);
-function stripSkalpelHeaders(headers) {
-  const cleaned = { ...headers };
-  delete cleaned["X-Skalpel-API-Key"];
-  delete cleaned["X-Skalpel-Source"];
-  delete cleaned["X-Skalpel-Agent-Type"];
-  delete cleaned["X-Skalpel-SDK-Version"];
-  delete cleaned["X-Skalpel-Auth-Mode"];
-  return cleaned;
-}
-async function doStreamingFetch(url, body, headers) {
-  return fetch(url, { method: "POST", headers, body, dispatcher: skalpelDispatcher });
-}
-async function handleStreamingRequest(_req, res, _config, _source, body, skalpelUrl, directUrl, useSkalpel, forwardHeaders, logger) {
-  let response = null;
-  let fetchError = null;
-  let usedFallback = false;
-  if (useSkalpel) {
-    try {
-      response = await doStreamingFetch(skalpelUrl, body, forwardHeaders);
-    } catch (err) {
-      fetchError = err;
-    }
-    if (await isSkalpelBackendFailure(response, fetchError, logger)) {
-      logger.warn(`streaming: Skalpel backend failed (${fetchError ? fetchError.message : `status ${response?.status}`}), falling back to direct Anthropic API`);
-      usedFallback = true;
-      response = null;
-      fetchError = null;
-      const directHeaders = stripSkalpelHeaders(forwardHeaders);
-      try {
-        response = await doStreamingFetch(directUrl, body, directHeaders);
-      } catch (err) {
-        fetchError = err;
-      }
-    }
-  } else {
-    try {
-      response = await doStreamingFetch(directUrl, body, forwardHeaders);
-    } catch (err) {
-      fetchError = err;
-    }
+};
+
+// src/fallback.ts
+var TRULY_CLIENT_4XX = /* @__PURE__ */ new Set([
+  400,
+  403,
+  404,
+  405,
+  409,
+  410,
+  411,
+  413,
+  415,
+  417,
+  418,
+  421,
+  422,
+  423,
+  424,
+  425,
+  426,
+  428,
+  431,
+  451
+]);
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function classifyError(err) {
+  if (err instanceof SkalpelError) return err;
+  const error = err;
+  const status = error.status ?? error.statusCode;
+  const message = error.message ?? "Unknown error";
+  if (status === 401) {
+    return new SkalpelAuthError(message);
   }
-  const finalUrl = usedFallback || !useSkalpel ? directUrl : skalpelUrl;
-  const finalHeaders = usedFallback ? stripSkalpelHeaders(forwardHeaders) : forwardHeaders;
-  if (fetchError) {
-    const code = fetchError.code;
-    if (code && TIMEOUT_CODES2.has(code)) {
-      try {
-        response = await handleTimeoutWithRetry(
-          fetchError,
-          () => doStreamingFetch(finalUrl, body, finalHeaders),
-          logger
-        );
-        fetchError = null;
-      } catch (retryErr) {
-        fetchError = retryErr;
-      }
-    }
+  if (status === 429) {
+    const retryAfter = error.headers?.["retry-after"] ? parseInt(error.headers["retry-after"], 10) : void 0;
+    return new SkalpelRateLimitError(message, retryAfter);
   }
-  if (response && response.status === 429) {
-    response = await handle429WithRetryAfter(
-      response,
-      () => doStreamingFetch(finalUrl, body, finalHeaders),
-      logger
-    );
+  if (status === 408) {
+    return new SkalpelTimeoutError(message);
   }
-  if (!response || fetchError) {
-    const errMsg = fetchError ? fetchError.message : "no response from upstream";
-    logger.error(`streaming fetch failed: ${errMsg}`);
-    res.writeHead(HTTP_BAD_GATEWAY, {
-      "Content-Type": "text/event-stream",
-      "Cache-Control": "no-cache"
-    });
-    const envelope = buildErrorEnvelope(HTTP_BAD_GATEWAY, errMsg, "skalpel-proxy");
-    res.write(`event: error
-data: ${JSON.stringify(envelope)}
-
-`);
-    res.end();
-    return;
+  if (error.code === "ETIMEDOUT" || error.code === "TIMEOUT" || error.code === "UND_ERR_HEADERS_TIMEOUT") {
+    return new SkalpelTimeoutError(message);
   }
-  if (usedFallback) {
-    logger.info("streaming: using direct Anthropic API fallback");
+  if (status && status >= 500) {
+    return new SkalpelUnavailableError(message, status);
   }
-  if (response.status >= 300) {
-    const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
-    const originHeader = response.headers.get("x-skalpel-origin");
-    let origin;
-    if (originHeader === "backend") origin = "skalpel-backend";
-    else if (originHeader === "provider") origin = "provider";
-    else origin = "provider";
-    let rawBody = "";
-    let bodyReadFailed = false;
+  if (status && TRULY_CLIENT_4XX.has(status)) {
+    return new SkalpelClientRequestError(message, status);
+  }
+  if (status && status >= 400 && status < 500) {
+    return new SkalpelClientRequestError(message, status);
+  }
+  return new SkalpelUnavailableError(message, status);
+}
+async function withFallback(primaryFn, fallbackFn, options = {}) {
+  const { retries = 2, verbose = false, onFallback, provider = "unknown", fallbackOnError = true } = options;
+  let lastError;
+  for (let attempt = 0; attempt <= retries; attempt++) {
     try {
-      rawBody = Buffer.from(await response.arrayBuffer()).toString();
-    } catch (readErr) {
-      bodyReadFailed = true;
-      logger.error(`streaming body-read failed after upstream status: ${readErr.message}`);
-    }
-    if (!bodyReadFailed) {
-      logger.error(`streaming upstream error: status=${response.status} body=${rawBody.slice(0, 500)}`);
+      return await primaryFn();
+    } catch (err) {
+      lastError = classifyError(err);
+      if (lastError instanceof SkalpelAuthError) {
+        throw lastError;
+      }
+      if (lastError instanceof SkalpelClientRequestError) {
+        throw lastError;
+      }
+      if (lastError instanceof SkalpelRateLimitError && lastError.retryAfter && attempt < retries) {
+        await sleep(lastError.retryAfter * 1e3);
+        continue;
+      }
+      if (attempt < retries) {
+        await sleep(Math.pow(2, attempt) * 1e3);
+        continue;
+      }
     }
-    const envelope = bodyReadFailed ? buildErrorEnvelope(
-      response.status,
-      "",
-      "skalpel-proxy",
-      "mid-stream abort",
-      retryAfter
-    ) : buildErrorEnvelope(response.status, rawBody, origin, void 0, retryAfter);
-    res.writeHead(response.status, {
-      "Content-Type": "text/event-stream",
-      "Cache-Control": "no-cache"
-    });
-    res.write(`event: error
-data: ${JSON.stringify(envelope)}
-
-`);
-    res.end();
-    return;
   }
-  const sseHeaders = {};
-  for (const [key, value] of response.headers.entries()) {
-    if (!STRIP_HEADERS.has(key) && key !== "content-type") {
-      sseHeaders[key] = value;
+  if (fallbackOnError) {
+    if (verbose && lastError) {
+      console.warn(`[skalpel] Falling back to direct ${provider} call: ${lastError.message}`);
     }
-  }
-  sseHeaders["Content-Type"] = "text/event-stream";
-  sseHeaders["Cache-Control"] = "no-cache";
-  res.writeHead(response.status, sseHeaders);
-  if (!response.body) {
-    res.write(`event: error
-data: ${JSON.stringify({ error: "no response body" })}
-
-`);
-    res.end();
-    return;
-  }
-  try {
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      const chunk = decoder.decode(value, { stream: true });
-      res.write(chunk);
+    if (onFallback && lastError) {
+      onFallback(lastError, provider);
     }
-  } catch (err) {
-    logger.error(`streaming error: ${err.message}`);
-    const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
-    const envelope = buildErrorEnvelope(
-      response.status,
-      err.message,
-      "skalpel-proxy",
-      "mid-stream abort",
-      retryAfter
-    );
-    res.write(`event: error
-data: ${JSON.stringify(envelope)}
-
-`);
+    return fallbackFn();
   }
-  res.end();
+  throw lastError;
 }
 
-// src/proxy/handler.ts
-var TIMEOUT_CODES3 = /* @__PURE__ */ new Set(["ETIMEDOUT", "TIMEOUT", "UND_ERR_HEADERS_TIMEOUT"]);
-var HTTP_BAD_GATEWAY2 = 502;
-var SKALPEL_EXACT_PATHS = /* @__PURE__ */ new Set(["/v1/messages"]);
-function collectBody(req) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    req.on("data", (chunk) => chunks.push(chunk));
-    req.on("end", () => resolve(Buffer.concat(chunks).toString()));
-    req.on("error", reject);
-  });
-}
-function shouldRouteToSkalpel(path4, source) {
-  if (source !== "claude-code") return true;
-  const pathname = path4.split("?")[0];
-  return SKALPEL_EXACT_PATHS.has(pathname);
-}
-async function isSkalpelBackendFailure(response, err, logger) {
-  if (err) return true;
-  if (!response) return true;
-  if (response.status < 500) return false;
-  const origin = response.headers?.get("x-skalpel-origin");
-  if (origin === "provider") return false;
-  if (origin === "backend") return true;
-  try {
-    const text = await response.clone().text();
-    if (!text) {
-      logger?.debug(`isSkalpelBackendFailure heuristic: status=${response.status} result=true shape=non-anthropic`);
-      return true;
-    }
-    let shape = "non-anthropic";
-    try {
-      const parsed = JSON.parse(text);
-      if (parsed && typeof parsed === "object" && parsed.type === "error" && parsed.error && typeof parsed.error === "object" && typeof parsed.error.type === "string" && typeof parsed.error.message === "string") {
-        shape = "anthropic";
-        logger?.debug(`isSkalpelBackendFailure heuristic: status=${response.status} result=false shape=${shape}`);
-        return false;
-      }
-    } catch {
+// src/version.ts
+var VERSION = "1.0.5";
+
+// src/client.ts
+var AsyncMutex = class {
+  locked = false;
+  queue = [];
+  async acquire() {
+    if (this.locked) {
+      await new Promise((resolve) => this.queue.push(resolve));
     }
-    logger?.debug(`isSkalpelBackendFailure heuristic: status=${response.status} result=true shape=${shape}`);
-    return true;
-  } catch {
-    logger?.debug(`isSkalpelBackendFailure heuristic: status=${response?.status ?? "null"} result=true shape=non-anthropic`);
-    return true;
+    this.locked = true;
+    return () => {
+      this.locked = false;
+      const next = this.queue.shift();
+      if (next) next();
+    };
   }
+};
+function resolveConfig(options) {
+  return {
+    apiKey: options.apiKey,
+    baseURL: options.baseURL ?? "https://api.skalpel.ai",
+    workspace: options.workspace,
+    fallbackOnError: options.fallbackOnError ?? true,
+    timeout: options.timeout ?? 3e4,
+    retries: options.retries ?? 2,
+    verbose: options.verbose ?? false,
+    headers: options.headers ?? {},
+    onFallback: options.onFallback,
+    onMetadata: options.onMetadata
+  };
 }
-var FORWARD_HEADER_STRIP = /* @__PURE__ */ new Set([
-  "host",
-  "connection",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-]);
-function buildForwardHeaders(req, config, source, useSkalpel) {
-  const forwardHeaders = {};
-  for (const [key, value] of Object.entries(req.headers)) {
-    if (value === void 0) continue;
-    if (FORWARD_HEADER_STRIP.has(key.toLowerCase())) continue;
-    forwardHeaders[key] = Array.isArray(value) ? value.join(", ") : value;
+function buildSkalpelHeaders(config) {
+  const headers = {
+    "Authorization": `Bearer ${config.apiKey}`,
+    "X-Skalpel-SDK-Version": VERSION,
+    ...config.headers
+  };
+  if (config.workspace) {
+    headers["X-Skalpel-Workspace"] = config.workspace;
   }
-  if (useSkalpel) {
-    forwardHeaders["X-Skalpel-API-Key"] = config.apiKey;
-    forwardHeaders["X-Skalpel-Source"] = source;
-    forwardHeaders["X-Skalpel-Agent-Type"] = source;
-    forwardHeaders["X-Skalpel-SDK-Version"] = "proxy-1.0.0";
-    forwardHeaders["X-Skalpel-Auth-Mode"] = "passthrough";
-    if (source === "claude-code" && !forwardHeaders["x-api-key"]) {
-      const authHeader = forwardHeaders["authorization"] ?? "";
-      if (authHeader.toLowerCase().startsWith("bearer ")) {
-        const token = authHeader.slice(7).trim();
-        if (token.startsWith("sk-ant-")) {
-          forwardHeaders["x-api-key"] = token;
-          delete forwardHeaders["authorization"];
-        }
+  return headers;
+}
+function extractMetadataFromResponse(response, config) {
+  if (!response || typeof response !== "object") return;
+  const resp = response;
+  if (resp._response && typeof resp._response === "object") {
+    const raw = resp._response;
+    if (raw.headers) {
+      const metadata = extractMetadata(raw.headers);
+      if (metadata) {
+        config.onMetadata?.(metadata);
+        return;
       }
     }
   }
-  return forwardHeaders;
+  if (resp.x_skalpel && typeof resp.x_skalpel === "object") {
+    const sk = resp.x_skalpel;
+    const metadata = {
+      requestId: sk.request_id ?? "",
+      optimization: sk.optimization ?? "none",
+      originalModel: sk.original_model ?? "",
+      actualModel: sk.actual_model ?? "",
+      savingsUsd: Number(sk.savings_usd ?? 0),
+      cacheHit: Boolean(sk.cache_hit),
+      latencyMs: Number(sk.latency_ms ?? 0)
+    };
+    config.onMetadata?.(metadata);
+  }
 }
-function stripSkalpelHeaders2(headers) {
-  const cleaned = { ...headers };
-  delete cleaned["X-Skalpel-API-Key"];
-  delete cleaned["X-Skalpel-Source"];
-  delete cleaned["X-Skalpel-Agent-Type"];
-  delete cleaned["X-Skalpel-SDK-Version"];
-  delete cleaned["X-Skalpel-Auth-Mode"];
-  return cleaned;
+function isOpenAIClient(client) {
+  if (!client || typeof client !== "object") return false;
+  const c = client;
+  return c.chat !== void 0 && typeof c.chat === "object" && c.chat !== null && "completions" in c.chat;
 }
-var STRIP_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
-  "connection",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade",
-  "content-encoding",
-  "content-length"
-]);
-function extractResponseHeaders(response) {
-  const headers = {};
-  for (const [key, value] of response.headers.entries()) {
-    if (!STRIP_RESPONSE_HEADERS.has(key)) {
-      headers[key] = value;
-    }
-  }
-  return headers;
+function isAnthropicClient(client) {
+  if (!client || typeof client !== "object") return false;
+  const c = client;
+  return c.messages !== void 0 && typeof c.messages === "object" && c.messages !== null && typeof c.messages.create === "function";
 }
-async function handleRequest(req, res, config, source, logger) {
-  const start = Date.now();
-  const method = req.method ?? "GET";
-  const path4 = req.url ?? "/";
-  const fp = tokenFingerprint(
-    typeof req.headers.authorization === "string" ? req.headers.authorization : void 0
-  );
-  logger.info(`${source} ${method} ${path4} token=${fp}`);
-  let response = null;
-  try {
-    const body = await collectBody(req);
-    const useSkalpel = shouldRouteToSkalpel(path4, source);
-    const forwardHeaders = buildForwardHeaders(req, config, source, useSkalpel);
-    let isStreaming = false;
-    if (body) {
-      try {
-        const parsed = JSON.parse(body);
-        isStreaming = parsed.stream === true;
-      } catch {
-      }
-    }
-    if (isStreaming) {
-      const skalpelUrl2 = `${config.remoteBaseUrl}${path4}`;
-      const directUrl2 = source === "claude-code" ? `${config.anthropicDirectUrl}${path4}` : source === "cursor" ? `${config.cursorDirectUrl}${path4}` : `${config.openaiDirectUrl}${path4}`;
-      await handleStreamingRequest(req, res, config, source, body, skalpelUrl2, directUrl2, useSkalpel, forwardHeaders, logger);
-      logger.info(`${method} ${path4} source=${source} streaming latency=${Date.now() - start}ms`);
-      return;
-    }
-    const skalpelUrl = `${config.remoteBaseUrl}${path4}`;
-    const directUrl = source === "claude-code" ? `${config.anthropicDirectUrl}${path4}` : source === "cursor" ? `${config.cursorDirectUrl}${path4}` : `${config.openaiDirectUrl}${path4}`;
-    const fetchBody = method !== "GET" && method !== "HEAD" ? body : void 0;
-    let fetchError = null;
-    let usedFallback = false;
-    if (useSkalpel) {
-      try {
-        response = await fetch(skalpelUrl, { method, headers: forwardHeaders, body: fetchBody, dispatcher: skalpelDispatcher });
-      } catch (err) {
-        fetchError = err;
-      }
-      if (await isSkalpelBackendFailure(response, fetchError, logger)) {
-        logger.warn(`${method} ${path4} Skalpel backend failed (${fetchError ? fetchError.message : `status ${response?.status}`}), falling back to direct Anthropic API`);
-        usedFallback = true;
-        response = null;
-        fetchError = null;
-        const directHeaders = stripSkalpelHeaders2(forwardHeaders);
+function wrapOpenAI(client, config) {
+  const c = client;
+  const skalpelHeaders = buildSkalpelHeaders(config);
+  const originalBaseURL = c.baseURL;
+  const mutex = new AsyncMutex();
+  function createMethodProxy(target, methodName) {
+    const originalMethod = target[methodName];
+    return async function(...args) {
+      const primaryFn = async () => {
+        const release = await mutex.acquire();
         try {
-          response = await fetch(directUrl, { method, headers: directHeaders, body: fetchBody, dispatcher: skalpelDispatcher });
-        } catch (err) {
-          fetchError = err;
+          c.baseURL = `${config.baseURL}/v1`;
+          const requestArgs = args[0];
+          const extraHeaders = skalpelHeaders;
+          let callArgs;
+          if (args.length >= 2 && typeof args[1] === "object" && args[1] !== null) {
+            const opts = args[1];
+            opts.headers = { ...extraHeaders, ...opts.headers };
+            callArgs = [requestArgs, opts, ...args.slice(2)];
+          } else {
+            callArgs = [requestArgs, { headers: extraHeaders }, ...args.slice(2)];
+          }
+          try {
+            const result = await originalMethod.apply(target, callArgs);
+            extractMetadataFromResponse(result, config);
+            return result;
+          } finally {
+            c.baseURL = originalBaseURL;
+          }
+        } finally {
+          release();
+        }
+      };
+      const fallbackFn = async () => {
+        c.baseURL = originalBaseURL;
+        return originalMethod.apply(target, args);
+      };
+      return withFallback(primaryFn, fallbackFn, {
+        retries: config.retries,
+        verbose: config.verbose,
+        onFallback: config.onFallback,
+        provider: "openai",
+        fallbackOnError: config.fallbackOnError
+      });
+    };
+  }
+  function createNamespaceProxy(namespace) {
+    return new Proxy(namespace, {
+      get(target, prop, receiver) {
+        const value = Reflect.get(target, prop, receiver);
+        if (typeof value === "function" && (prop === "create" || prop === "stream")) {
+          return createMethodProxy(target, prop);
+        }
+        if (value && typeof value === "object" && !Array.isArray(value)) {
+          return createNamespaceProxy(value);
         }
+        return value;
       }
-    } else {
-      try {
-        response = await fetch(directUrl, { method, headers: forwardHeaders, body: fetchBody, dispatcher: skalpelDispatcher });
-      } catch (err) {
-        fetchError = err;
+    });
+  }
+  return new Proxy(client, {
+    get(target, prop, receiver) {
+      const value = Reflect.get(target, prop, receiver);
+      if (typeof value === "object" && value !== null && (prop === "chat" || prop === "completions" || prop === "embeddings")) {
+        return createNamespaceProxy(value);
       }
+      return value;
     }
-    const fetchUrl = usedFallback || !useSkalpel ? directUrl : skalpelUrl;
-    const fetchHeaders = usedFallback ? stripSkalpelHeaders2(forwardHeaders) : forwardHeaders;
-    if (fetchError) {
-      const code = fetchError.code;
-      if (code && TIMEOUT_CODES3.has(code)) {
+  });
+}
+function wrapAnthropic(client, config) {
+  const c = client;
+  const skalpelHeaders = buildSkalpelHeaders(config);
+  const originalBaseURL = c.baseURL ?? c._client?.baseURL;
+  const mutex = new AsyncMutex();
+  function createMethodProxy(target, methodName) {
+    const originalMethod = target[methodName];
+    return async function(...args) {
+      const primaryFn = async () => {
+        const release = await mutex.acquire();
         try {
-          response = await handleTimeoutWithRetry(
-            fetchError,
-            () => fetch(fetchUrl, {
-              method,
-              headers: fetchHeaders,
-              body: fetchBody,
-              dispatcher: skalpelDispatcher
-            }),
-            logger
-          );
-          fetchError = null;
-        } catch (retryErr) {
-          fetchError = retryErr;
+          const proxyURL = config.baseURL;
+          if ("baseURL" in c) c.baseURL = proxyURL;
+          if (c._client && "baseURL" in c._client) c._client.baseURL = proxyURL;
+          const requestArgs = args[0];
+          const extraHeaders = skalpelHeaders;
+          let callArgs;
+          if (args.length >= 2 && typeof args[1] === "object" && args[1] !== null) {
+            const opts = args[1];
+            opts.headers = { ...extraHeaders, ...opts.headers };
+            callArgs = [requestArgs, opts, ...args.slice(2)];
+          } else {
+            callArgs = [requestArgs, { headers: extraHeaders }, ...args.slice(2)];
+          }
+          try {
+            const result = await originalMethod.apply(target, callArgs);
+            extractMetadataFromResponse(result, config);
+            return result;
+          } finally {
+            if ("baseURL" in c) c.baseURL = originalBaseURL;
+            if (c._client && "baseURL" in c._client) c._client.baseURL = originalBaseURL;
+          }
+        } finally {
+          release();
         }
+      };
+      const fallbackFn = async () => {
+        if ("baseURL" in c) c.baseURL = originalBaseURL;
+        if (c._client && "baseURL" in c._client) c._client.baseURL = originalBaseURL;
+        return originalMethod.apply(target, args);
+      };
+      return withFallback(primaryFn, fallbackFn, {
+        retries: config.retries,
+        verbose: config.verbose,
+        onFallback: config.onFallback,
+        provider: "anthropic",
+        fallbackOnError: config.fallbackOnError
+      });
+    };
+  }
+  return new Proxy(client, {
+    get(target, prop, receiver) {
+      const value = Reflect.get(target, prop, receiver);
+      if (prop === "messages" && typeof value === "object" && value !== null) {
+        return new Proxy(value, {
+          get(msgTarget, msgProp, msgReceiver) {
+            const msgValue = Reflect.get(msgTarget, msgProp, msgReceiver);
+            if (typeof msgValue === "function" && (msgProp === "create" || msgProp === "stream")) {
+              return createMethodProxy(msgTarget, msgProp);
+            }
+            return msgValue;
+          }
+        });
       }
+      return value;
     }
-    if (!response || fetchError) {
-      response = null;
-      throw fetchError ?? new Error("no response from upstream");
-    }
-    if (response.status === 429) {
-      response = await handle429WithRetryAfter(
-        response,
-        () => fetch(fetchUrl, {
-          method,
-          headers: fetchHeaders,
-          body: fetchBody,
-          dispatcher: skalpelDispatcher
-        }),
-        logger
-      );
-    }
-    if (response.status === 401 && (source === "claude-code" || source === "codex")) {
-      const fp2 = tokenFingerprint(
-        typeof req.headers.authorization === "string" ? req.headers.authorization : void 0
-      );
-      logger.debug(`handler: upstream 401 origin=provider token=${fp2} passthrough`);
-      const body401 = Buffer.from(await response.arrayBuffer());
-      const envelope = buildErrorEnvelope(401, body401.toString(), "provider");
-      res.writeHead(401, { "Content-Type": "application/json" });
-      res.end(JSON.stringify(envelope));
-      logger.info(`${method} ${path4} source=${source} status=401 (passthrough) latency=${Date.now() - start}ms`);
-      return;
-    }
-    const responseHeaders = extractResponseHeaders(response);
-    const responseBody = Buffer.from(await response.arrayBuffer());
-    responseHeaders["content-length"] = String(responseBody.length);
-    res.writeHead(response.status, responseHeaders);
-    res.end(responseBody);
-    logger.info(`${method} ${path4} source=${source} status=${response.status}${usedFallback ? " (fallback)" : ""} latency=${Date.now() - start}ms`);
-  } catch (err) {
-    logger.error(`${method} ${path4} source=${source} error=${err.message}`);
-    if (!res.headersSent) {
-      if (response !== null) {
-        const upstreamStatus = response.status;
-        const envelope = buildErrorEnvelope(
-          upstreamStatus,
-          "",
-          "skalpel-proxy",
-          "body read failed after upstream status"
-        );
-        res.writeHead(upstreamStatus, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(envelope));
-      } else {
-        const envelope = buildErrorEnvelope(
-          HTTP_BAD_GATEWAY2,
-          err.message,
-          "skalpel-proxy"
-        );
-        res.writeHead(HTTP_BAD_GATEWAY2, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(envelope));
+  });
+}
+function createSkalpelClient(client, options) {
+  const config = resolveConfig(options);
+  if (isOpenAIClient(client)) {
+    return wrapOpenAI(client, config);
+  }
+  if (isAnthropicClient(client)) {
+    return wrapAnthropic(client, config);
+  }
+  throw new Error(
+    "Unsupported client. createSkalpelClient supports OpenAI and Anthropic SDK clients."
+  );
+}
+async function contextRequest(config, path4, body) {
+  const url = `${config.baseURL}/api/workspaces${path4}`;
+  const headers = buildSkalpelHeaders(config);
+  headers["Content-Type"] = "application/json";
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), config.timeout);
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      const message = `Skalpel context API error ${response.status}: ${text}`;
+      if (response.status >= 400 && response.status < 500) {
+        throw new SkalpelClientRequestError(message, response.status);
       }
+      throw new SkalpelUnavailableError(message, response.status);
     }
+    return await response.json();
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+async function createSnapshot(options, params) {
+  const config = resolveConfig(options);
+  const raw = await contextRequest(config, "/snapshots", {
+    workspace_id: params.workspaceId,
+    snapshot_hash: params.snapshotHash,
+    manifest: params.manifest ?? {},
+    metadata: params.metadata ?? null
+  });
+  return {
+    id: String(raw.id),
+    workspaceId: String(raw.workspace_id),
+    snapshotHash: String(raw.snapshot_hash),
+    manifest: raw.manifest ?? {},
+    metadata: raw.metadata ?? null,
+    createdAt: String(raw.created_at)
+  };
+}
+async function uploadChunks(options, params) {
+  const config = resolveConfig(options);
+  const raw = await contextRequest(config, "/chunks", {
+    workspace_id: params.workspaceId,
+    snapshot_id: params.snapshotId,
+    chunks: params.chunks.map((c) => ({
+      path: c.path,
+      chunk_hash: c.chunkHash,
+      chunk_text: c.chunkText,
+      symbol: c.symbol ?? null,
+      language: c.language ?? null,
+      token_count: c.tokenCount ?? 0,
+      metadata: c.metadata ?? null
+    }))
+  });
+  return (raw.items ?? []).map((item) => ({
+    id: String(item.id),
+    workspaceId: String(item.workspace_id),
+    snapshotId: String(item.snapshot_id),
+    path: String(item.path),
+    chunkHash: String(item.chunk_hash),
+    symbol: item.symbol != null ? String(item.symbol) : null,
+    language: item.language != null ? String(item.language) : null,
+    tokenCount: Number(item.token_count ?? 0),
+    metadata: item.metadata ?? null,
+    createdAt: String(item.created_at)
+  }));
+}
+async function resolveContext(options, params) {
+  const config = resolveConfig(options);
+  const raw = await contextRequest(config, "/context/resolve", {
+    workspace_id: params.workspaceId,
+    snapshot_id: params.snapshotId ?? null,
+    query: params.query,
+    changed_paths: params.changedPaths ?? [],
+    limit: params.limit ?? 8
+  });
+  const items = raw.items ?? [];
+  return {
+    workspaceId: String(raw.workspace_id),
+    snapshotId: raw.snapshot_id != null ? String(raw.snapshot_id) : null,
+    items: items.map((item) => ({
+      path: String(item.path),
+      symbol: item.symbol != null ? String(item.symbol) : null,
+      language: item.language != null ? String(item.language) : null,
+      tokenCount: Number(item.token_count ?? 0),
+      score: Number(item.score ?? 0),
+      reason: String(item.reason ?? "semantic"),
+      metadata: item.metadata ?? null,
+      preview: String(item.preview ?? "")
+    }))
+  };
+}
+
+// src/url-swap.ts
+var SKALPEL_MANAGED_SENTINEL = "skalpel-managed";
+function buildHeaders(options) {
+  const headers = {
+    "X-Skalpel-SDK-Version": VERSION,
+    ...options.headers
+  };
+  if (options.workspace) {
+    headers["X-Skalpel-Workspace"] = options.workspace;
   }
+  return headers;
+}
+async function createSkalpelOpenAI(options) {
+  const { default: OpenAI } = await import("openai");
+  const baseURL = `${options.baseURL ?? "https://api.skalpel.ai"}/v1`;
+  const sdkApiKey = options.providerApiKey ? options.providerApiKey : SKALPEL_MANAGED_SENTINEL;
+  return new OpenAI({
+    baseURL,
+    apiKey: sdkApiKey,
+    defaultHeaders: {
+      ...buildHeaders(options),
+      "Authorization": `Bearer ${options.apiKey}`
+    },
+    timeout: options.timeout ?? 3e4,
+    maxRetries: options.retries ?? 2
+  });
+}
+async function createSkalpelAnthropic(options) {
+  const { default: Anthropic } = await import("@anthropic-ai/sdk");
+  const baseURL = options.baseURL ?? "https://api.skalpel.ai";
+  const sdkApiKey = options.providerApiKey ? options.providerApiKey : SKALPEL_MANAGED_SENTINEL;
+  return new Anthropic({
+    baseURL,
+    apiKey: sdkApiKey,
+    defaultHeaders: {
+      ...buildHeaders(options),
+      "Authorization": `Bearer ${options.apiKey}`
+    },
+    timeout: options.timeout ?? 3e4,
+    maxRetries: options.retries ?? 2
+  });
 }
 
+// src/proxy/server.ts
+init_handler();
+import http from "http";
+
 // src/proxy/health.ts
-function handleHealthRequest(res, config, startTime) {
+function handleHealthRequest(res, config, startTime, logger) {
+  logger?.debug("health check served");
   const body = JSON.stringify({
     status: "ok",
     uptime: Date.now() - startTime,
@@ -1212,6 +1600,20 @@ function removePid(pidFile) {
   }
 }
 
+// src/proxy/health-check.ts
+async function isProxyAlive(port, timeoutMs = 2e3) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(`http://localhost:${port}/health`, { signal: controller.signal });
+    return res.ok;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // src/proxy/logger.ts
 import fs2 from "fs";
 import path2 from "path";
@@ -1278,6 +1680,67 @@ var Logger = class _Logger {
   }
 };
 
+// src/proxy/ws-server.ts
+import { WebSocketServer } from "ws";
+var WS_SUBPROTOCOL2 = "skalpel-codex-v1";
+var wss = new WebSocketServer({ noServer: true });
+function reject426(socket, payload) {
+  const body = JSON.stringify(payload);
+  socket.write(
+    `HTTP/1.1 426 Upgrade Required\r
+Content-Type: application/json\r
+Content-Length: ${Buffer.byteLength(body)}\r
+Connection: close\r
+\r
+` + body
+  );
+  socket.destroy();
+}
+function handleCodexUpgrade(req, socket, head, config, logger) {
+  const wsFlag = process.env.SKALPEL_CODEX_WS ?? "1";
+  if (wsFlag === "0") {
+    logger.warn("ws-upgrade rejected: feature flag SKALPEL_CODEX_WS=0");
+    reject426(socket, { error: "ws_disabled" });
+    return;
+  }
+  const offered = req.headers["sec-websocket-protocol"] ?? "";
+  const tokens = offered.split(",").map((t) => t.trim()).filter(Boolean);
+  if (!tokens.includes(WS_SUBPROTOCOL2)) {
+    logger.warn(`ws-upgrade rejected: unsupported subprotocol offered="${offered}"`);
+    reject426(socket, { error: "unsupported_subprotocol" });
+    return;
+  }
+  wss.handleUpgrade(req, socket, head, (clientWs) => {
+    logger.info(`ws-upgrade accepted path=${req.url ?? ""} subproto=${WS_SUBPROTOCOL2}`);
+    Promise.resolve().then(() => (init_handler(), handler_exports)).then((mod) => {
+      const bridge = mod.handleWebSocketBridge;
+      if (typeof bridge !== "function") {
+        clientWs.send(
+          JSON.stringify({
+            type: "error",
+            payload: { code: "not_implemented" }
+          })
+        );
+        clientWs.close(4003, "bridge pending");
+        return;
+      }
+      void bridge(clientWs, req, config, "codex", logger);
+    }).catch((err) => {
+      logger.error(`ws bridge import failed: ${err?.message ?? String(err)}`);
+      try {
+        clientWs.send(
+          JSON.stringify({
+            type: "error",
+            payload: { code: "bridge_import_failed" }
+          })
+        );
+      } catch {
+      }
+      clientWs.close(4003, "bridge import failed");
+    });
+  });
+}
+
 // src/proxy/server.ts
 var proxyStartTime = 0;
 var connCounter = 0;
@@ -1294,7 +1757,7 @@ function startProxy(config) {
   proxyStartTime = Date.now();
   const anthropicServer = http.createServer((req, res) => {
     if (req.url === "/health" && req.method === "GET") {
-      handleHealthRequest(res, config, startTime);
+      handleHealthRequest(res, config, startTime, logger.child("health"));
       return;
     }
     const connId = computeConnId(req);
@@ -1302,7 +1765,7 @@ function startProxy(config) {
   });
   const openaiServer = http.createServer((req, res) => {
     if (req.url === "/health" && req.method === "GET") {
-      handleHealthRequest(res, config, startTime);
+      handleHealthRequest(res, config, startTime, logger.child("health"));
       return;
     }
     const connId = computeConnId(req);
@@ -1310,12 +1773,71 @@ function startProxy(config) {
   });
   const cursorServer = http.createServer((req, res) => {
     if (req.url === "/health" && req.method === "GET") {
-      handleHealthRequest(res, config, startTime);
+      handleHealthRequest(res, config, startTime, logger.child("health"));
       return;
     }
     const connId = computeConnId(req);
     handleRequest(req, res, config, "cursor", logger.child(connId));
   });
+  anthropicServer.on("upgrade", (req, socket, _head) => {
+    const ua = req.headers["user-agent"] ?? "";
+    logger.warn(`upgrade-attempt port=${config.anthropicPort} method=${req.method} url=${req.url} ua=${ua} origin=${req.headers.origin ?? ""}`);
+    const body = JSON.stringify({
+      error: "upgrade_required",
+      message: "Skalpel proxy is HTTP-only",
+      hint: 'Use wire_api="responses" over HTTP in your Codex config. See docs/codex-integration-fix.md.'
+    });
+    socket.write(
+      `HTTP/1.1 426 Upgrade Required\r
+Content-Type: application/json\r
+Content-Length: ${Buffer.byteLength(body)}\r
+Connection: close\r
+\r
+` + body
+    );
+    socket.destroy();
+  });
+  openaiServer.on("upgrade", (req, socket, head) => {
+    const ua = req.headers["user-agent"] ?? "";
+    logger.warn(`upgrade-attempt port=${config.openaiPort} method=${req.method} url=${req.url} ua=${ua} origin=${req.headers.origin ?? ""}`);
+    const pathname = (req.url ?? "").split("?")[0];
+    if (pathname === "/v1/responses") {
+      handleCodexUpgrade(req, socket, head, config, logger);
+      return;
+    }
+    const body = JSON.stringify({
+      error: "upgrade_required",
+      message: "Skalpel proxy is HTTP-only",
+      hint: 'Use wire_api="responses" over HTTP in your Codex config. See docs/codex-integration-fix.md.'
+    });
+    socket.write(
+      `HTTP/1.1 426 Upgrade Required\r
+Content-Type: application/json\r
+Content-Length: ${Buffer.byteLength(body)}\r
+Connection: close\r
+\r
+` + body
+    );
+    socket.destroy();
+  });
+  cursorServer.on("upgrade", (req, socket, _head) => {
+    const ua = req.headers["user-agent"] ?? "";
+    logger.warn(`upgrade-attempt port=${config.cursorPort} method=${req.method} url=${req.url} ua=${ua} origin=${req.headers.origin ?? ""}`);
+    const body = JSON.stringify({
+      error: "upgrade_required",
+      message: "Skalpel proxy is HTTP-only",
+      hint: 'Use wire_api="responses" over HTTP in your Codex config. See docs/codex-integration-fix.md.'
+    });
+    socket.write(
+      `HTTP/1.1 426 Upgrade Required\r
+Content-Type: application/json\r
+Content-Length: ${Buffer.byteLength(body)}\r
+Connection: close\r
+\r
+` + body
+    );
+    socket.destroy();
+  });
   anthropicServer.on("error", (err) => {
     if (err.code === "EADDRINUSE") {
       logger.error(`Port ${config.anthropicPort} is already in use. Another Skalpel proxy or process may be running.`);
@@ -1343,17 +1865,26 @@ function startProxy(config) {
     removePid(config.pidFile);
     process.exit(1);
   });
+  let bound = 0;
+  const onBound = () => {
+    bound++;
+    if (bound === 3) {
+      writePid(config.pidFile);
+      logger.info(`Proxy started (pid=${process.pid}) ports=${config.anthropicPort},${config.openaiPort},${config.cursorPort}`);
+    }
+  };
   anthropicServer.listen(config.anthropicPort, () => {
     logger.info(`Anthropic proxy listening on port ${config.anthropicPort}`);
+    onBound();
   });
   openaiServer.listen(config.openaiPort, () => {
     logger.info(`OpenAI proxy listening on port ${config.openaiPort}`);
+    onBound();
   });
   cursorServer.listen(config.cursorPort, () => {
     logger.info(`Cursor proxy listening on port ${config.cursorPort}`);
+    onBound();
   });
-  writePid(config.pidFile);
-  logger.info(`Proxy started (pid=${process.pid}) ports=${config.anthropicPort},${config.openaiPort},${config.cursorPort}`);
   const cleanup = () => {
     logger.info("Shutting down proxy...");
     anthropicServer.close();
@@ -1386,12 +1917,23 @@ function stopProxy(config) {
   removePid(config.pidFile);
   return true;
 }
-function getProxyStatus(config) {
+async function getProxyStatus(config) {
   const pid = readPid(config.pidFile);
+  if (pid !== null) {
+    return {
+      running: true,
+      pid,
+      uptime: proxyStartTime > 0 ? Date.now() - proxyStartTime : 0,
+      anthropicPort: config.anthropicPort,
+      openaiPort: config.openaiPort,
+      cursorPort: config.cursorPort
+    };
+  }
+  const alive = await isProxyAlive(config.anthropicPort);
   return {
-    running: pid !== null,
-    pid,
-    uptime: proxyStartTime > 0 ? Date.now() - proxyStartTime : 0,
+    running: alive,
+    pid: null,
+    uptime: 0,
     anthropicPort: config.anthropicPort,
     openaiPort: config.openaiPort,
     cursorPort: config.cursorPort