Merge remote-tracking branch 'origin/main' into feat/account-level-proxy

# Conflicts:
#	src/server/routes/proxy/completions.ts
#	src/server/services/siteProxy.ts

src/server/routes/api/accountTokens.sync.test.ts

@@ -12,6 +12,8 @@ const createApiTokenMock = vi.fn();
 const getUserGroupsMock = vi.fn();
 const deleteApiTokenMock = vi.fn();
 
+type AccountTokenServiceModule = typeof import('../../services/accountTokenService.js');
+
 vi.mock('../../services/platforms/index.js', () => ({
   getAdapter: () => ({
     getApiTokens: (...args: unknown[]) => getApiTokensMock(...args),
@@ -28,6 +30,7 @@ describe('account tokens sync routes with site status', () => {
   let app: FastifyInstance;
   let db: DbModule['db'];
   let schema: DbModule['schema'];
+  let maskToken: AccountTokenServiceModule['maskToken'];
   let dataDir = '';
   let seedId = 0;
 
@@ -63,9 +66,11 @@ describe('account tokens sync routes with site status', () => {
 
     await import('../../db/migrate.js');
     const dbModule = await import('../../db/index.js');
+    const accountTokenServiceModule = await import('../../services/accountTokenService.js');
     const routesModule = await import('./accountTokens.js');
     db = dbModule.db;
     schema = dbModule.schema;
+    maskToken = accountTokenServiceModule.maskToken;
 
     app = Fastify();
     await app.register(routesModule.accountTokensRoutes);
@@ -196,6 +201,247 @@ describe('account tokens sync routes with site status', () => {
     ]);
   });
 
+  it('reuses an existing ready token when upstream only returns the matching masked token', async () => {
+    const { account } = await seedAccount({ siteStatus: 'active' });
+    const fullToken = 'sk-real-token-1234';
+    await db.insert(schema.accountTokens).values({
+      accountId: account.id,
+      name: 'masked-only',
+      token: fullToken,
+      source: 'manual',
+      enabled: true,
+      isDefault: true,
+      tokenGroup: 'default',
+      valueStatus: 'ready' as any,
+    }).run();
+
+    getApiTokensMock.mockResolvedValue([
+      { name: 'masked-only', key: maskToken(fullToken), enabled: true, tokenGroup: 'default' },
+    ]);
+    getApiTokenMock.mockResolvedValue(null);
+
+    const response = await app.inject({
+      method: 'POST',
+      url: `/api/account-tokens/sync/${account.id}`,
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json()).toMatchObject({
+      success: true,
+      synced: true,
+      status: 'synced',
+      created: 0,
+      updated: 1,
+      maskedPending: 0,
+      total: 1,
+    });
+
+    const tokenRows = await db.select()
+      .from(schema.accountTokens)
+      .where(eq(schema.accountTokens.accountId, account.id))
+      .all();
+    expect(tokenRows).toHaveLength(1);
+    expect(tokenRows[0]).toMatchObject({
+      name: 'masked-only',
+      token: fullToken,
+      source: 'sync',
+      enabled: true,
+      isDefault: true,
+      tokenGroup: 'default',
+    });
+    expect((tokenRows[0] as any).valueStatus).toBe('ready');
+  });
+
+  it('removes matching masked_pending placeholders after reusing a ready token', async () => {
+    const { account } = await seedAccount({ siteStatus: 'active' });
+    const fullToken = 'sk-real-token-1234';
+    const maskedToken = maskToken(fullToken);
+
+    await db.insert(schema.accountTokens).values({
+      accountId: account.id,
+      name: 'masked-only',
+      token: fullToken,
+      source: 'manual',
+      enabled: true,
+      isDefault: true,
+      tokenGroup: 'default',
+      valueStatus: 'ready' as any,
+    }).run();
+    await db.insert(schema.accountTokens).values({
+      accountId: account.id,
+      name: 'masked-only',
+      token: maskedToken,
+      source: 'sync',
+      enabled: false,
+      isDefault: false,
+      tokenGroup: 'default',
+      valueStatus: 'masked_pending' as any,
+    }).run();
+
+    getApiTokensMock.mockResolvedValue([
+      { name: 'masked-only', key: maskedToken, enabled: true, tokenGroup: 'default' },
+    ]);
+    getApiTokenMock.mockResolvedValue(null);
+
+    const response = await app.inject({
+      method: 'POST',
+      url: `/api/account-tokens/sync/${account.id}`,
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json()).toMatchObject({
+      success: true,
+      synced: true,
+      status: 'synced',
+      created: 0,
+      updated: 1,
+      maskedPending: 0,
+      total: 1,
+    });
+
+    const tokenRows = await db.select()
+      .from(schema.accountTokens)
+      .where(eq(schema.accountTokens.accountId, account.id))
+      .all();
+    expect(tokenRows).toHaveLength(1);
+    expect(tokenRows[0]).toMatchObject({
+      name: 'masked-only',
+      token: fullToken,
+      source: 'sync',
+      enabled: true,
+      isDefault: true,
+      tokenGroup: 'default',
+    });
+    expect((tokenRows[0] as any).valueStatus).toBe('ready');
+  });
+
+  it('does not reuse a different ready token when another logical token shares the same masked value', async () => {
+    const { account } = await seedAccount({ siteStatus: 'active' });
+    const firstFullToken = 'sk-real-token-1234';
+    const secondFullToken = 'sk-real-zzzzz-1234';
+    const sharedMaskedToken = maskToken(firstFullToken);
+
+    expect(maskToken(secondFullToken)).toBe(sharedMaskedToken);
+
+    await db.insert(schema.accountTokens).values({
+      accountId: account.id,
+      name: 'first-token',
+      token: firstFullToken,
+      source: 'manual',
+      enabled: true,
+      isDefault: true,
+      tokenGroup: 'default',
+      valueStatus: 'ready' as any,
+    }).run();
+    await db.insert(schema.accountTokens).values({
+      accountId: account.id,
+      name: 'second-token',
+      token: sharedMaskedToken,
+      source: 'sync',
+      enabled: false,
+      isDefault: false,
+      tokenGroup: 'default',
+      valueStatus: 'masked_pending' as any,
+    }).run();
+
+    getApiTokensMock.mockResolvedValue([
+      { name: 'second-token', key: sharedMaskedToken, enabled: true, tokenGroup: 'default' },
+    ]);
+    getApiTokenMock.mockResolvedValue(null);
+
+    const response = await app.inject({
+      method: 'POST',
+      url: `/api/account-tokens/sync/${account.id}`,
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json()).toMatchObject({
+      success: true,
+      synced: true,
+      status: 'synced',
+      created: 0,
+      updated: 1,
+      maskedPending: 1,
+      total: 2,
+    });
+
+    const tokenRows = await db.select()
+      .from(schema.accountTokens)
+      .where(eq(schema.accountTokens.accountId, account.id))
+      .all();
+    expect(tokenRows).toHaveLength(2);
+    expect(tokenRows.find((row) => row.token === firstFullToken)).toMatchObject({
+      name: 'first-token',
+      token: firstFullToken,
+      source: 'manual',
+      enabled: true,
+      isDefault: true,
+      tokenGroup: 'default',
+    });
+    const maskedRow = tokenRows.find((row) => row.name === 'second-token');
+    expect(maskedRow).toMatchObject({
+      token: sharedMaskedToken,
+      source: 'sync',
+      enabled: false,
+      isDefault: false,
+      tokenGroup: 'default',
+    });
+    expect((maskedRow as any)?.valueStatus).toBe('masked_pending');
+  });
+
+  it('keeps fully ambiguous short masks as masked_pending instead of reusing a ready token', async () => {
+    const { account } = await seedAccount({ siteStatus: 'active' });
+    const fullToken = 'sk-abcd';
+    await db.insert(schema.accountTokens).values({
+      accountId: account.id,
+      name: 'short-token',
+      token: fullToken,
+      source: 'manual',
+      enabled: true,
+      isDefault: true,
+      tokenGroup: 'default',
+      valueStatus: 'ready' as any,
+    }).run();
+
+    getApiTokensMock.mockResolvedValue([
+      { name: 'short-token', key: maskToken(fullToken), enabled: true, tokenGroup: 'default' },
+    ]);
+    getApiTokenMock.mockResolvedValue(null);
+
+    const response = await app.inject({
+      method: 'POST',
+      url: `/api/account-tokens/sync/${account.id}`,
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json()).toMatchObject({
+      success: true,
+      synced: true,
+      status: 'synced',
+      reason: 'upstream_masked_tokens',
+      created: 1,
+      updated: 0,
+      maskedPending: 1,
+      total: 2,
+    });
+
+    const tokenRows = await db.select()
+      .from(schema.accountTokens)
+      .where(eq(schema.accountTokens.accountId, account.id))
+      .all();
+    expect(tokenRows).toHaveLength(2);
+    expect(tokenRows.find((row) => row.token === fullToken)).toBeDefined();
+    const maskedRow = tokenRows.find((row) => row.token === 'sk-***');
+    expect(maskedRow).toMatchObject({
+      name: 'short-token',
+      source: 'sync',
+      enabled: false,
+      isDefault: false,
+      tokenGroup: 'default',
+    });
+    expect((maskedRow as any)?.valueStatus).toBe('masked_pending');
+  });
+
   it('rejects sync and token management for apikey connections', async () => {
     const { account } = await seedAccount({ siteStatus: 'active', accessToken: '' });
     await db.update(schema.accounts)

src/server/routes/api/settings.events.test.ts

@@ -273,6 +273,60 @@ describe('settings and auth events', () => {
     expect(runtime.systemProxyUrl).toBe('http://127.0.0.1:7890');
   });
 
+  it('splits proxy error keywords on newlines and commas when saving runtime settings', async () => {
+    const updateResponse = await app.inject({
+      method: 'PUT',
+      url: '/api/settings/runtime',
+      payload: {
+        proxyErrorKeywords: 'quota exceeded\nbad gateway,too many requests',
+        proxyEmptyContentFailEnabled: true,
+      },
+    });
+
+    expect(updateResponse.statusCode).toBe(200);
+    const updated = updateResponse.json() as {
+      proxyErrorKeywords?: string[];
+      proxyEmptyContentFailEnabled?: boolean;
+    };
+    expect(updated.proxyErrorKeywords).toEqual([
+      'quota exceeded',
+      'bad gateway',
+      'too many requests',
+    ]);
+    expect(updated.proxyEmptyContentFailEnabled).toBe(true);
+    expect(config.proxyErrorKeywords).toEqual([
+      'quota exceeded',
+      'bad gateway',
+      'too many requests',
+    ]);
+    expect(config.proxyEmptyContentFailEnabled).toBe(true);
+
+    const rows = await db.select().from(schema.settings).all();
+    const settingsMap = new Map(rows.map((row) => [row.key, row.value]));
+    expect(settingsMap.get('proxy_error_keywords')).toBe(JSON.stringify([
+      'quota exceeded',
+      'bad gateway',
+      'too many requests',
+    ]));
+    expect(settingsMap.get('proxy_empty_content_fail_enabled')).toBe(JSON.stringify(true));
+
+    const getResponse = await app.inject({
+      method: 'GET',
+      url: '/api/settings/runtime',
+    });
+    expect(getResponse.statusCode).toBe(200);
+    const runtime = getResponse.json() as {
+      proxyErrorKeywords?: string[];
+      proxyEmptyContentFailEnabled?: boolean;
+    };
+    expect(runtime.proxyErrorKeywords).toEqual([
+      'quota exceeded',
+      'bad gateway',
+      'too many requests',
+    ]);
+    expect(runtime.proxyEmptyContentFailEnabled).toBe(true);
+  });
+
   it('persists and returns log cleanup settings from runtime settings', async () => {
     const updateResponse = await app.inject({
       method: 'PUT',

src/server/routes/api/settings.ts

@@ -55,6 +55,8 @@ interface RuntimeSettingsBody {
   adminIpAllowlist?: string[] | string;
   routingFallbackUnitCost?: number;
   routingWeights?: Partial<RoutingWeights>;
+  proxyErrorKeywords?: string[] | string;
+  proxyEmptyContentFailEnabled?: boolean;
 }
 
 interface DatabaseMigrationBody {
@@ -127,6 +129,33 @@ function toStringList(value: unknown): string[] {
   return [];
 }
 
+function parseProxyErrorKeywords(value: unknown): string[] {
+  const splitKeywords = (input: string): string[] => input
+    .split(/\r?\n|,/)
+    .map((item) => item.trim())
+    .filter((item) => item.length > 0);
+
+  if (Array.isArray(value)) {
+    const keywords = value.flatMap((item) => {
+      if (typeof item !== 'string') return [];
+      return splitKeywords(item);
+    });
+    return keywords;
+  }
+
+  if (typeof value === 'string') {
+    const keywords = splitKeywords(value);
+    return keywords;
+  }
+
+  throw new Error('上游错误关键词格式无效：需要 string 或 string[]');
+}
+
+function parseBooleanFlag(value: unknown, label: string): boolean {
+  if (typeof value === 'boolean') return value;
+  throw new Error(`${label}格式无效：需要 boolean`);
+}
+
 function isValidHttpUrl(raw: string): boolean {
   const value = String(raw || '').trim();
   if (!value) return false;
@@ -197,6 +226,22 @@ function applyImportedSettingToRuntime(key: string, value: unknown) {
       config.systemProxyUrl = normalizeSiteProxyUrl(value) || '';
       return;
     }
+    case 'proxy_error_keywords': {
+      try {
+        config.proxyErrorKeywords = parseProxyErrorKeywords(value);
+      } catch {
+        return;
+      }
+      return;
+    }
+    case 'proxy_empty_content_fail_enabled': {
+      try {
+        config.proxyEmptyContentFailEnabled = parseBooleanFlag(value, '空内容判定失败开关');
+      } catch {
+        return;
+      }
+      return;
+    }
     case 'webhook_url': {
       if (typeof value !== 'string') return;
       config.webhookUrl = value.trim();
@@ -347,6 +392,8 @@ function getRuntimeSettingsResponse(currentAdminIp = '') {
     adminIpAllowlist: config.adminIpAllowlist,
     currentAdminIp,
     systemProxyUrl: config.systemProxyUrl,
+    proxyErrorKeywords: config.proxyErrorKeywords,
+    proxyEmptyContentFailEnabled: config.proxyEmptyContentFailEnabled,
     proxyTokenMasked: maskSecret(config.proxyToken),
   };
 }
@@ -603,6 +650,42 @@ export async function settingsRoutes(app: FastifyInstance) {
       invalidateSiteProxyCache();
     }
 
+    if (body.proxyErrorKeywords !== undefined) {
+      let nextKeywords: string[] = [];
+      try {
+        nextKeywords = parseProxyErrorKeywords(body.proxyErrorKeywords);
+      } catch (err: any) {
+        return reply.code(400).send({
+          success: false,
+          message: err?.message || '上游错误关键词格式无效',
+        });
+      }
+
+      if (JSON.stringify(nextKeywords) !== JSON.stringify(config.proxyErrorKeywords || [])) {
+        changedLabels.push('上游错误关键词');
+      }
+      config.proxyErrorKeywords = nextKeywords;
+      upsertSetting('proxy_error_keywords', config.proxyErrorKeywords);
+    }
+
+    if (body.proxyEmptyContentFailEnabled !== undefined) {
+      let nextValue = false;
+      try {
+        nextValue = parseBooleanFlag(body.proxyEmptyContentFailEnabled, '空内容判定失败开关');
+      } catch (err: any) {
+        return reply.code(400).send({
+          success: false,
+          message: err?.message || '空内容判定失败开关格式无效',
+        });
+      }
+
+      if (nextValue !== config.proxyEmptyContentFailEnabled) {
+        changedLabels.push('空内容判定失败');
+      }
+      config.proxyEmptyContentFailEnabled = nextValue;
+      upsertSetting('proxy_empty_content_fail_enabled', config.proxyEmptyContentFailEnabled);
+    }
+
     if (body.webhookUrl !== undefined) {
       if (String(body.webhookUrl || '').trim() !== config.webhookUrl) {
         changedLabels.push('Webhook 地址');

src/server/routes/proxy/chat.stream.test.ts

@@ -1,5 +1,6 @@
 import Fastify, { type FastifyInstance } from 'fastify';
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { config } from '../../config.js';
 
 const fetchMock = vi.fn();
 const selectChannelMock = vi.fn();
@@ -109,6 +110,8 @@ describe('chat proxy stream behavior', () => {
     });
     selectNextChannelMock.mockReturnValue(null);
     fetchModelPricingCatalogMock.mockResolvedValue(null);
+    config.proxyEmptyContentFailEnabled = false;
+    config.proxyErrorKeywords = [];
   });
 
   afterAll(async () => {
@@ -150,6 +153,77 @@ describe('chat proxy stream behavior', () => {
     expect(response.body).toContain('data: [DONE]');
   });
 
+  it('returns upstream_error for empty non-stream chat responses when empty-content failure is enabled', async () => {
+    config.proxyEmptyContentFailEnabled = true;
+
+    fetchMock.mockResolvedValue(new Response(JSON.stringify({
+      id: 'chatcmpl-empty',
+      object: 'chat.completion',
+      created: 1_706_000_000,
+      model: 'upstream-gpt',
+      choices: [{
+        index: 0,
+        message: { role: 'assistant', content: '' },
+        finish_reason: 'stop',
+      }],
+      usage: { prompt_tokens: 6, completion_tokens: 0, total_tokens: 6 },
+    }), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    }));
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/v1/chat/completions',
+      payload: {
+        model: 'gpt-4o-mini',
+        messages: [{ role: 'user', content: 'hi' }],
+      },
+    });
+
+    expect(response.statusCode).toBe(502);
+    expect(response.json()?.error?.type).toBe('upstream_error');
+    expect(response.json()?.error?.message).toContain('empty content');
+    expect(recordSuccessMock).not.toHaveBeenCalled();
+    expect(recordFailureMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('returns HTTP upstream_error instead of hijacking when streamed chat requests receive empty non-SSE payloads', async () => {
+    config.proxyEmptyContentFailEnabled = true;
+
+    fetchMock.mockResolvedValue(new Response(JSON.stringify({
+      id: 'chatcmpl-empty-stream',
+      object: 'chat.completion',
+      created: 1_706_000_000,
+      model: 'upstream-gpt',
+      choices: [{
+        index: 0,
+        message: { role: 'assistant', content: '' },
+        finish_reason: 'stop',
+      }],
+      usage: { prompt_tokens: 4, completion_tokens: 0, total_tokens: 4 },
+    }), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    }));
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/v1/chat/completions',
+      payload: {
+        model: 'gpt-4o-mini',
+        stream: true,
+        messages: [{ role: 'user', content: 'hi' }],
+      },
+    });
+
+    expect(response.statusCode).toBe(502);
+    expect(response.headers['content-type']).not.toContain('text/event-stream');
+    expect(response.json()?.error?.type).toBe('upstream_error');
+    expect(recordSuccessMock).not.toHaveBeenCalled();
+    expect(recordFailureMock).toHaveBeenCalledTimes(1);
+  });
+
   it('returns clear 400 when /v1/chat/completions receives responses-style input without messages', async () => {
     const response = await app.inject({
       method: 'POST',
@@ -1989,6 +2063,71 @@ describe('chat proxy stream behavior', () => {
     expect(targetUrl).toContain('/v1/responses');
   });
 
+  it('returns upstream_error for empty non-stream /v1/responses payloads when empty-content failure is enabled', async () => {
+    config.proxyEmptyContentFailEnabled = true;
+
+    fetchMock.mockResolvedValue(new Response(JSON.stringify({
+      id: 'resp-empty',
+      object: 'response',
+      model: 'gpt-5.4',
+      status: 'completed',
+      output: [],
+      output_text: '',
+      usage: { input_tokens: 3, output_tokens: 0, total_tokens: 3 },
+    }), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    }));
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/v1/responses',
+      payload: {
+        model: 'gpt-5.4',
+        input: 'hello',
+      },
+    });
+
+    expect(response.statusCode).toBe(502);
+    expect(response.json()?.error?.type).toBe('upstream_error');
+    expect(response.json()?.error?.message).toContain('empty content');
+    expect(recordSuccessMock).not.toHaveBeenCalled();
+    expect(recordFailureMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('returns HTTP upstream_error instead of hijacking when streamed /v1/responses receives empty non-SSE payloads', async () => {
+    config.proxyEmptyContentFailEnabled = true;
+
+    fetchMock.mockResolvedValue(new Response(JSON.stringify({
+      id: 'resp-empty-stream',
+      object: 'response',
+      model: 'gpt-5.4',
+      status: 'completed',
+      output: [],
+      output_text: '',
+      usage: { input_tokens: 2, output_tokens: 0, total_tokens: 2 },
+    }), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    }));
+
+    const response = await app.inject({
+      method: 'POST',
+      url: '/v1/responses',
+      payload: {
+        model: 'gpt-5.4',
+        input: 'hello',
+        stream: true,
+      },
+    });
+
+    expect(response.statusCode).toBe(502);
+    expect(response.headers['content-type']).not.toContain('text/event-stream');
+    expect(response.json()?.error?.type).toBe('upstream_error');
+    expect(recordSuccessMock).not.toHaveBeenCalled();
+    expect(recordFailureMock).toHaveBeenCalledTimes(1);
+  });
+
   it('prefers native /v1/responses for claude-family /v1/responses requests that include input_file file_url', async () => {
     selectChannelMock.mockReturnValue({
       channel: { id: 11, routeId: 22 },

src/server/routes/proxy/chat.ts

@@ -21,7 +21,8 @@ import {
   recordDownstreamCostUsage,
 } from './downstreamPolicy.js';
 import { composeProxyLogMessage } from './logPathMeta.js';
-import { executeEndpointFlow, type BuiltEndpointRequest } from './endpointFlow.js';
+import { executeEndpointFlow, withUpstreamPath, type BuiltEndpointRequest } from './endpointFlow.js';
+import { detectProxyFailure } from './proxyFailureJudge.js';
 import { formatUtcSqlDateTime } from '../../services/localTimeService.js';
 import { resolveProxyLogBilling } from './proxyBilling.js';
 import { openAiChatTransformer } from '../../transformers/openai/chat/index.js';
@@ -343,12 +344,15 @@ async function handleChatProxyRequest(
       const successfulUpstreamPath = endpointResult.upstreamPath;
 
       if (isStream) {
-        reply.hijack();
-        reply.raw.statusCode = 200;
-        reply.raw.setHeader('Content-Type', 'text/event-stream; charset=utf-8');
-        reply.raw.setHeader('Cache-Control', 'no-cache, no-transform');
-        reply.raw.setHeader('Connection', 'keep-alive');
-        reply.raw.setHeader('X-Accel-Buffering', 'no');
+        const upstreamContentType = (upstream.headers.get('content-type') || '').toLowerCase();
+        const startSseResponse = () => {
+          reply.hijack();
+          reply.raw.statusCode = 200;
+          reply.raw.setHeader('Content-Type', 'text/event-stream; charset=utf-8');
+          reply.raw.setHeader('Cache-Control', 'no-cache, no-transform');
+          reply.raw.setHeader('Connection', 'keep-alive');
+          reply.raw.setHeader('X-Accel-Buffering', 'no');
+        };
 
         let parsedUsage: ReturnType<typeof parseProxyUsage> = {
           promptTokens: 0,
@@ -378,10 +382,11 @@ async function handleChatProxyRequest(
             reply.raw.write(chunk);
           },
         });
+        let rawText = '';
 
-        const upstreamContentType = (upstream.headers.get('content-type') || '').toLowerCase();
         if (!upstreamContentType.includes('text/event-stream')) {
           const fallbackText = await upstream.text();
+          rawText = fallbackText;
           let fallbackData: unknown = null;
           try {
             fallbackData = JSON.parse(fallbackText);
@@ -391,7 +396,96 @@ async function handleChatProxyRequest(
           if (String(selected.site.platform || '').trim().toLowerCase() === 'gemini-cli') {
             fallbackData = unwrapGeminiCliPayload(fallbackData);
           }
+          parsedUsage = mergeProxyUsage(parsedUsage, parseProxyUsage(fallbackData));
+          const latency = Date.now() - startTime;
+          const failure = detectProxyFailure({ rawText, usage: parsedUsage });
+          if (failure) {
+            tokenRouter.recordFailure(selected.channel.id);
+            logProxy(
+              selected,
+              requestedModel,
+              'failed',
+              failure.status,
+              latency,
+              failure.reason,
+              retryCount,
+              downstreamPath,
+              parsedUsage.promptTokens,
+              parsedUsage.completionTokens,
+              parsedUsage.totalTokens,
+              0,
+              null,
+              successfulUpstreamPath,
+              clientContext,
+              logDownstreamApiKeyId ? downstreamApiKeyId : null,
+            );
+
+            if (shouldRetryProxyRequest(failure.status, failure.reason) && retryCount < MAX_RETRIES) {
+              retryCount += 1;
+              continue;
+            }
+
+            await reportProxyAllFailed({
+              model: requestedModel,
+              reason: failure.reason,
+            });
+
+            return reply.code(failure.status).send({
+              error: { message: failure.reason, type: 'upstream_error' },
+            });
+          }
+
+          startSseResponse();
           const streamResult = streamSession.consumeUpstreamFinalPayload(fallbackData, fallbackText, reply.raw);
+          if (streamResult.status === 'failed') {
+            tokenRouter.recordFailure(selected.channel.id);
+            logProxy(
+              selected,
+              requestedModel,
+              'failed',
+              200,
+              latency,
+              streamResult.errorMessage,
+              retryCount,
+              downstreamPath,
+              parsedUsage.promptTokens,
+              parsedUsage.completionTokens,
+              parsedUsage.totalTokens,
+              0,
+              null,
+              successfulUpstreamPath,
+              clientContext,
+              logDownstreamApiKeyId ? downstreamApiKeyId : null,
+            );
+            return;
+          }
+        } else {
+          startSseResponse();
+          // Preserve real SSE streaming instead of buffering the whole upstream body.
+          const upstreamReader = upstream.body?.getReader();
+          const baseReader = String(selected.site.platform || '').trim().toLowerCase() === 'gemini-cli' && upstreamReader
+            ? createGeminiCliStreamReader(upstreamReader)
+            : upstreamReader;
+          const decoder = new TextDecoder();
+          const reader = baseReader
+            ? {
+              async read() {
+                const result = await baseReader.read();
+                if (result.value) {
+                  rawText += decoder.decode(result.value, { stream: true });
+                }
+                return result;
+              },
+              async cancel(reason?: unknown) {
+                return baseReader.cancel(reason);
+              },
+              releaseLock() {
+                return baseReader.releaseLock();
+              },
+            }
+            : baseReader;
+          const streamResult = await streamSession.run(reader, reply.raw);
+          rawText += decoder.decode();
 
           const latency = Date.now() - startTime;
           if (streamResult.status === 'failed') {
@@ -417,83 +511,13 @@ async function handleChatProxyRequest(
             return;
           }
 
-          const resolvedUsage = await resolveProxyUsageWithSelfLogFallback({
-            site: selected.site,
-            account: selected.account,
-            tokenValue: selected.tokenValue,
-            tokenName: selected.tokenName,
-            modelName,
-            requestStartedAtMs: startTime,
-            requestEndedAtMs: startTime + latency,
-            localLatencyMs: latency,
-            usage: {
-              promptTokens: parsedUsage.promptTokens,
-              completionTokens: parsedUsage.completionTokens,
-              totalTokens: parsedUsage.totalTokens,
-            },
-          });
-
-          const { estimatedCost, billingDetails } = await resolveProxyLogBilling({
-            site: selected.site,
-            account: selected.account,
-            modelName,
-            parsedUsage,
-            resolvedUsage,
-          });
-
-          tokenRouter.recordSuccess(selected.channel.id, latency, estimatedCost);
-          recordDownstreamCostUsage(request, estimatedCost);
-          logProxy(
-            selected,
-            requestedModel,
-            'success',
-            200,
-            latency,
-            null,
-            retryCount,
-            downstreamPath,
-            resolvedUsage.promptTokens,
-            resolvedUsage.completionTokens,
-            resolvedUsage.totalTokens,
-            estimatedCost,
-            billingDetails,
-            successfulUpstreamPath,
-            clientContext,
-            logDownstreamApiKeyId ? downstreamApiKeyId : null,
-          );
-          return;
+          // Once SSE has been hijacked and streamed downstream, we can no longer
+          // safely fall back to an HTTP error response or retry by switching the
+          // channel mid-flight. Stream-level failures must be handled in-band by
+          // the proxy stream session itself.
         }
 
-        const upstreamReader = upstream.body?.getReader();
-        const reader = String(selected.site.platform || '').trim().toLowerCase() === 'gemini-cli' && upstreamReader
-          ? createGeminiCliStreamReader(upstreamReader)
-          : upstreamReader;
-        const streamResult = await streamSession.run(reader, reply.raw);
-
         const latency = Date.now() - startTime;
-        if (streamResult.status === 'failed') {
-          tokenRouter.recordFailure(selected.channel.id);
-          logProxy(
-            selected,
-            requestedModel,
-            'failed',
-            200,
-            latency,
-            streamResult.errorMessage,
-            retryCount,
-            downstreamPath,
-            parsedUsage.promptTokens,
-            parsedUsage.completionTokens,
-            parsedUsage.totalTokens,
-            0,
-            null,
-            successfulUpstreamPath,
-            clientContext,
-            logDownstreamApiKeyId ? downstreamApiKeyId : null,
-          );
-          return;
-        }
-
         const resolvedUsage = await resolveProxyUsageWithSelfLogFallback({
           site: selected.site,
           account: selected.account,
@@ -563,6 +587,42 @@ async function handleChatProxyRequest(
 
       const latency = Date.now() - startTime;
       const parsedUsage = parseProxyUsage(upstreamData);
+      const failure = detectProxyFailure({ rawText, usage: parsedUsage });
+      if (failure) {
+        tokenRouter.recordFailure(selected.channel.id);
+        logProxy(
+          selected,
+          requestedModel,
+          'failed',
+          failure.status,
+          latency,
+          failure.reason,
+          retryCount,
+          downstreamPath,
+          parsedUsage.promptTokens,
+          parsedUsage.completionTokens,
+          parsedUsage.totalTokens,
+          0,
+          null,
+          successfulUpstreamPath,
+          clientContext,
+          logDownstreamApiKeyId ? downstreamApiKeyId : null,
+        );
+
+        if (shouldRetryProxyRequest(failure.status, failure.reason) && retryCount < MAX_RETRIES) {
+          retryCount += 1;
+          continue;
+        }
+
+        await reportProxyAllFailed({
+          model: requestedModel,
+          reason: failure.reason,
+        });
+
+        return reply.code(failure.status).send({
+          error: { message: failure.reason, type: 'upstream_error' },
+        });
+      }
       const normalizedFinal = downstreamTransformer.transformFinalResponse(upstreamData, modelName, rawText);
       const downstreamResponse = downstreamTransformer.serializeFinalResponse(normalizedFinal, parsedUsage);
 

src/server/routes/proxy/completions.ts

@@ -13,6 +13,7 @@ import { withSiteRecordProxyRequestInit } from '../../services/siteProxy.js';
 import { getProxyUrlFromExtraConfig } from '../../services/accountExtraConfig.js';
 import { composeProxyLogMessage } from './logPathMeta.js';
 import { formatUtcSqlDateTime } from '../../services/localTimeService.js';
+import { detectProxyFailure } from './proxyFailureJudge.js';
 import { resolveProxyLogBilling } from './proxyBilling.js';
 import { getProxyAuthContext } from '../../middleware/auth.js';
 import { buildUpstreamUrl } from './upstreamUrl.js';
@@ -70,7 +71,7 @@ export async function completionsProxyRoute(app: FastifyInstance) {
             'Authorization': `Bearer ${selected.tokenValue}`,
           },
           body: JSON.stringify(forwardBody),
-        }, getProxyUrlFromExtraConfig(selected.account.extraConfig)));
+        }));
 
         if (!upstream.ok) {
           const errText = await upstream.text().catch(() => 'unknown error');
@@ -182,9 +183,45 @@ export async function completionsProxyRoute(app: FastifyInstance) {
           return;
         }
 
-        const data = await upstream.json() as any;
+        const rawText = await upstream.text();
+        let data: any = rawText;
+        try {
+          data = JSON.parse(rawText);
+        } catch {
+          data = rawText;
+        }
         const latency = Date.now() - startTime;
         const parsedUsage = parseProxyUsage(data);
+        const failure = detectProxyFailure({ rawText, usage: parsedUsage });
+        if (failure) {
+          const errText = failure.reason;
+          tokenRouter.recordFailure(selected.channel.id);
+          logProxy(
+            selected,
+            requestedModel,
+            'failed',
+            failure.status,
+            latency,
+            errText,
+            retryCount,
+            logDownstreamApiKeyId ? downstreamApiKeyId : null,
+          );
+
+          if (shouldRetryProxyRequest(failure.status, errText) && retryCount < MAX_RETRIES) {
+            retryCount += 1;
+            continue;
+          }
+
+          await reportProxyAllFailed({
+            model: requestedModel,
+            reason: failure.reason,
+          });
+
+          return reply.code(failure.status).send({
+            error: { message: errText, type: 'upstream_error' },
+          });
+        }
+
         const resolvedUsage = await resolveProxyUsageWithSelfLogFallback({
           site: selected.site,
           account: selected.account,

src/server/routes/proxy/proxyFailureJudge.test.ts

@@ -0,0 +1,139 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { config } from '../../config.js';
+import { detectProxyFailure } from './proxyFailureJudge.js';
+
+describe('detectProxyFailure (empty content)', () => {
+  const originalEmptyFail = config.proxyEmptyContentFailEnabled;
+  const originalKeywords = Array.isArray(config.proxyErrorKeywords) ? [...config.proxyErrorKeywords] : config.proxyErrorKeywords;
+
+  afterEach(() => {
+    config.proxyEmptyContentFailEnabled = originalEmptyFail;
+    config.proxyErrorKeywords = originalKeywords as any;
+  });
+
+  it('flags empty assistant content even when total tokens > 0', () => {
+    config.proxyEmptyContentFailEnabled = true;
+
+    const rawText = JSON.stringify({
+      id: 'chatcmpl_empty',
+      object: 'chat.completion',
+      choices: [{
+        index: 0,
+        message: { role: 'assistant', content: '' },
+        finish_reason: 'stop',
+      }],
+      usage: { prompt_tokens: 12, completion_tokens: 0, total_tokens: 12 },
+    });
+
+    const failure = detectProxyFailure({
+      rawText,
+      usage: { promptTokens: 12, completionTokens: 0, totalTokens: 12 },
+    });
+
+    expect(failure).toMatchObject({ status: 502 });
+  });
+
+  it('does not flag when output exists even if usage is missing', () => {
+    config.proxyEmptyContentFailEnabled = true;
+
+    const rawText = JSON.stringify({
+      id: 'chatcmpl_has_output',
+      object: 'chat.completion',
+      choices: [{
+        index: 0,
+        message: { role: 'assistant', content: 'hi' },
+        finish_reason: 'stop',
+      }],
+    });
+
+    const failure = detectProxyFailure({
+      rawText,
+      usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+    });
+
+    expect(failure).toBeNull();
+  });
+
+  it('does not treat tool call payloads as empty content', () => {
+    config.proxyEmptyContentFailEnabled = true;
+
+    const rawText = JSON.stringify({
+      id: 'resp_tool',
+      object: 'response',
+      status: 'completed',
+      output: [{
+        type: 'function_call',
+        id: 'fc_1',
+        call_id: 'call_abc',
+        name: 'Glob',
+        arguments: '{"pattern":"README*"}',
+      }],
+      output_text: '',
+    });
+
+    const failure = detectProxyFailure({
+      rawText,
+      usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+    });
+
+    expect(failure).toBeNull();
+  });
+
+  it('flags empty SSE streams that contain no content deltas', () => {
+    config.proxyEmptyContentFailEnabled = true;
+
+    const rawText = [
+      'data: {"id":"evt_1","choices":[{"delta":{}}]}',
+      '',
+      'data: [DONE]',
+      '',
+      '',
+    ].join('\n');
+
+    const failure = detectProxyFailure({
+      rawText,
+      usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+    });
+
+    expect(failure).toMatchObject({ status: 502 });
+  });
+
+  it('treats DONE-only SSE as no output and flags failure', () => {
+    config.proxyEmptyContentFailEnabled = true;
+
+    const rawText = [
+      'data: [DONE]',
+      '',
+      '',
+    ].join('\n');
+
+    const failure = detectProxyFailure({
+      rawText,
+      usage: { promptTokens: 0, completionTokens: 0, totalTokens: 0 },
+    });
+
+    expect(failure).toMatchObject({ status: 502 });
+  });
+
+  it('truncates fractional token counts before empty-content detection', () => {
+    config.proxyEmptyContentFailEnabled = true;
+
+    const rawText = JSON.stringify({
+      id: 'chatcmpl_fractional_empty',
+      object: 'chat.completion',
+      choices: [{
+        index: 0,
+        message: { role: 'assistant', content: '' },
+        finish_reason: 'stop',
+      }],
+      usage: { prompt_tokens: 3.9, completion_tokens: 0.6, total_tokens: 4.5 },
+    });
+
+    const failure = detectProxyFailure({
+      rawText,
+      usage: { promptTokens: 3.9, completionTokens: 0.6, totalTokens: 4.5 } as any,
+    });
+
+    expect(failure).toMatchObject({ status: 502 });
+  });
+});

src/server/routes/proxy/proxyFailureJudge.ts

@@ -0,0 +1,203 @@
+import { config } from '../../config.js';
+import { pullSseDataEvents } from '../../services/proxyUsageParser.js';
+
+type FailureResult = {
+  status: number;
+  reason: string;
+};
+
+type UsageSummary = {
+  promptTokens?: number;
+  completionTokens?: number;
+  totalTokens?: number;
+};
+
+function normalizeKeywords(values: string[]): string[] {
+  return values
+    .map((item) => (typeof item === 'string' ? item.trim() : ''))
+    .filter((item) => item.length > 0)
+    .map((item) => item.toLowerCase());
+}
+
+function toNonNegativeInt(value: unknown): number {
+  const n = typeof value === 'number' ? value : Number(value);
+  if (!Number.isFinite(n)) return 0;
+  return Math.max(0, Math.trunc(n));
+}
+
+function hasNonEmptyString(value: unknown): boolean {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+
+function hasToolCallLike(value: unknown): boolean {
+  if (!value) return false;
+  if (Array.isArray(value)) return value.length > 0;
+  if (isRecord(value)) return Object.keys(value).length > 0;
+  return false;
+}
+
+function hasCompletionContentFromChoice(choice: any): boolean {
+  if (hasNonEmptyString(choice?.text)) return true;
+  if (hasNonEmptyString(choice?.completion)) return true;
+  if (hasNonEmptyString(choice?.output_text)) return true;
+
+  const message = choice?.message;
+  if (hasNonEmptyString(message?.content)) return true;
+  if (Array.isArray(message?.content)) {
+    for (const part of message.content) {
+      if (hasNonEmptyString(part?.text) || hasNonEmptyString(part?.output_text) || hasNonEmptyString(part?.content)) {
+        return true;
+      }
+    }
+  }
+
+  if (hasNonEmptyString(message?.refusal)) return true;
+  if (hasToolCallLike(message?.tool_calls)) return true;
+  if (hasToolCallLike(message?.toolCalls)) return true;
+  if (hasToolCallLike(message?.function_call)) return true;
+  if (hasToolCallLike(message?.functionCall)) return true;
+
+  if (hasToolCallLike(choice?.tool_calls)) return true;
+  if (hasToolCallLike(choice?.toolCalls)) return true;
+  if (hasToolCallLike(choice?.function_call)) return true;
+  if (hasToolCallLike(choice?.functionCall)) return true;
+
+  const delta = choice?.delta;
+  if (hasNonEmptyString(delta?.content)) return true;
+  if (hasNonEmptyString(delta?.refusal)) return true;
+  if (hasToolCallLike(delta?.tool_calls)) return true;
+  if (hasToolCallLike(delta?.toolCalls)) return true;
+  if (hasToolCallLike(delta?.function_call)) return true;
+  if (hasToolCallLike(delta?.functionCall)) return true;
+
+  return false;
+}
+
+function hasCompletionContentFromPayload(payload: unknown): boolean {
+  if (!payload || typeof payload !== 'object') return false;
+  const obj: any = payload;
+
+  if (Array.isArray(obj?.choices)) {
+    for (const choice of obj.choices) {
+      if (hasCompletionContentFromChoice(choice)) return true;
+    }
+    if (hasCompletionContentFromChoice(obj)) return true;
+  }
+
+  if (hasNonEmptyString(obj?.output_text)) return true;
+  if (hasNonEmptyString(obj?.outputText)) return true;
+
+  if (Array.isArray(obj?.output)) {
+    for (const item of obj.output) {
+      if (!isRecord(item)) continue;
+      const type = String((item as any).type || '').toLowerCase();
+      if (type.includes('function_call') || type.includes('tool_call')) return true;
+
+      if (hasNonEmptyString((item as any).text) || hasNonEmptyString((item as any).output_text)) return true;
+
+      if (Array.isArray((item as any).content)) {
+        for (const part of (item as any).content) {
+          if (hasNonEmptyString((part as any)?.text) || hasNonEmptyString((part as any)?.output_text) || hasNonEmptyString((part as any)?.content)) {
+            return true;
+          }
+          const partType = String((part as any)?.type || '').toLowerCase();
+          if (partType.includes('function_call') || partType.includes('tool_call')) return true;
+        }
+      }
+
+      if (hasToolCallLike((item as any).tool_calls) || hasToolCallLike((item as any).toolCalls)) return true;
+      if (hasToolCallLike((item as any).function_call) || hasToolCallLike((item as any).functionCall)) return true;
+    }
+  }
+
+  if (Array.isArray(obj?.content)) {
+    for (const part of obj.content) {
+      if (hasNonEmptyString((part as any)?.text) || hasNonEmptyString((part as any)?.output_text) || hasNonEmptyString((part as any)?.content)) {
+        return true;
+      }
+      const partType = String((part as any)?.type || '').toLowerCase();
+      if (partType.includes('function_call') || partType.includes('tool_call')) return true;
+    }
+  }
+
+  if (hasNonEmptyString(obj?.delta)) return true;
+  if (hasNonEmptyString(obj?.text)) return true;
+  if (hasToolCallLike(obj?.tool_calls) || hasToolCallLike(obj?.toolCalls)) return true;
+  if (hasToolCallLike(obj?.function_call) || hasToolCallLike(obj?.functionCall)) return true;
+
+  return false;
+}
+
+function detectHasUpstreamOutput(rawText: string): boolean {
+  const text = typeof rawText === 'string' ? rawText : '';
+  const trimmed = text.trim();
+  if (!trimmed) return false;
+
+  try {
+    const parsed = JSON.parse(trimmed);
+    return hasCompletionContentFromPayload(parsed);
+  } catch {
+    // Important: don't trim before SSE parsing, otherwise `data: [DONE]\n\n` can be lost.
+    const pulled = pullSseDataEvents(text);
+    if (pulled.events.length > 0) {
+      for (const event of pulled.events) {
+        const payload = event.trim();
+        if (!payload || payload === '[DONE]') continue;
+        try {
+          const parsedEvent = JSON.parse(payload);
+          if (hasCompletionContentFromPayload(parsedEvent)) return true;
+        } catch {
+          // Non-JSON payload still counts as upstream output.
+          return true;
+        }
+      }
+      // SSE payloads exist but none contain output.
+      return false;
+    }
+
+    // Looks like SSE but contains no non-DONE payloads.
+    if (text.includes('data:')) return false;
+
+    // Not JSON and not SSE: assume it's plain text output.
+    return true;
+  }
+}
+
+export function detectProxyFailure(input: {
+  rawText: string;
+  usage?: UsageSummary | null;
+  // Backward-compatible fields (older call sites)
+  completionTokens?: number;
+  totalTokens?: number;
+}): FailureResult | null {
+  const rawText = typeof input.rawText === 'string' ? input.rawText : '';
+  const keywords = normalizeKeywords(config.proxyErrorKeywords || []);
+  if (keywords.length > 0) {
+    const normalizedText = rawText.toLowerCase();
+    const matched = keywords.find((keyword) => normalizedText.includes(keyword));
+    if (matched) {
+      return {
+        status: 502,
+        reason: `Upstream response matched failure keyword: ${matched}`,
+      };
+    }
+  }
+
+  if (config.proxyEmptyContentFailEnabled) {
+    const completionTokens = toNonNegativeInt(input.usage?.completionTokens ?? input.completionTokens);
+    const hasOutput = detectHasUpstreamOutput(rawText);
+
+    if (!hasOutput && completionTokens <= 0) {
+      return {
+        status: 502,
+        reason: 'Upstream returned empty content',
+      };
+    }
+  }
+
+  return null;
+}

src/server/routes/proxy/responses.ts

@@ -17,6 +17,7 @@ import {
 import { ensureModelAllowedForDownstreamKey, getDownstreamRoutingPolicy, recordDownstreamCostUsage } from './downstreamPolicy.js';
 import { composeProxyLogMessage } from './logPathMeta.js';
 import { executeEndpointFlow, withUpstreamPath, type BuiltEndpointRequest } from './endpointFlow.js';
+import { detectProxyFailure } from './proxyFailureJudge.js';
 import { formatUtcSqlDateTime } from '../../services/localTimeService.js';
 import { resolveProxyLogBilling } from './proxyBilling.js';
 import { getProxyAuthContext, getProxyResourceOwner } from '../../middleware/auth.js';
@@ -425,15 +426,140 @@ export async function responsesProxyRoute(app: FastifyInstance) {
       const successfulUpstreamPath = endpointResult.upstreamPath;
 
         if (isStream) {
-          reply.hijack();
-          reply.raw.statusCode = 200;
-          reply.raw.setHeader('Content-Type', 'text/event-stream; charset=utf-8');
-          reply.raw.setHeader('Cache-Control', 'no-cache, no-transform');
-          reply.raw.setHeader('Connection', 'keep-alive');
-          reply.raw.setHeader('X-Accel-Buffering', 'no');
+          const upstreamContentType = (upstream.headers.get('content-type') || '').toLowerCase();
+          const startSseResponse = () => {
+            reply.hijack();
+            reply.raw.statusCode = 200;
+            reply.raw.setHeader('Content-Type', 'text/event-stream; charset=utf-8');
+            reply.raw.setHeader('Cache-Control', 'no-cache, no-transform');
+            reply.raw.setHeader('Connection', 'keep-alive');
+            reply.raw.setHeader('X-Accel-Buffering', 'no');
+          };
+
+          if (!upstreamContentType.includes('text/event-stream')) {
+            const rawText = await upstream.text();
+            let upstreamData: unknown = rawText;
+            try {
+              upstreamData = JSON.parse(rawText);
+            } catch {
+              upstreamData = rawText;
+            }
+            if (String(selected.site.platform || '').trim().toLowerCase() === 'gemini-cli') {
+              upstreamData = unwrapGeminiCliPayload(upstreamData);
+            }
+
+            const parsedUsage = parseProxyUsage(upstreamData);
+            const latency = Date.now() - startTime;
+            const failure = detectProxyFailure({ rawText, usage: parsedUsage });
+            if (failure) {
+              tokenRouter.recordFailure(selected.channel.id);
+              logProxy(
+                selected,
+                requestedModel,
+                'failed',
+                failure.status,
+                latency,
+                failure.reason,
+                retryCount,
+                downstreamPath,
+                parsedUsage.promptTokens,
+                parsedUsage.completionTokens,
+                parsedUsage.totalTokens,
+                0,
+                null,
+                successfulUpstreamPath,
+                clientContext,
+                logDownstreamApiKeyId ? downstreamApiKeyId : null,
+              );
+
+              if (shouldRetryProxyRequest(failure.status, failure.reason) && retryCount < MAX_RETRIES) {
+                retryCount += 1;
+                continue;
+              }
+
+              await reportProxyAllFailed({
+                model: requestedModel,
+                reason: failure.reason,
+              });
+              return reply.code(failure.status).send({ error: { message: failure.reason, type: 'upstream_error' } });
+            }
+
+            const normalized = openAiResponsesTransformer.transformFinalResponse(
+              upstreamData,
+              modelName,
+              rawText,
+            );
+            const downstreamData = openAiResponsesTransformer.outbound.serializeFinal({
+              upstreamPayload: upstreamData,
+              normalized,
+              usage: parsedUsage,
+              serializationMode: 'response',
+            });
+            const resolvedUsage = await resolveProxyUsageWithSelfLogFallback({
+              site: selected.site,
+              account: selected.account,
+              tokenValue: selected.tokenValue,
+              tokenName: selected.tokenName,
+              modelName: selected.actualModel || requestedModel,
+              requestStartedAtMs: startTime,
+              requestEndedAtMs: startTime + latency,
+              localLatencyMs: latency,
+              usage: {
+                promptTokens: parsedUsage.promptTokens,
+                completionTokens: parsedUsage.completionTokens,
+                totalTokens: parsedUsage.totalTokens,
+              },
+            });
+            const { estimatedCost, billingDetails } = await resolveProxyLogBilling({
+              site: selected.site,
+              account: selected.account,
+              modelName: selected.actualModel || requestedModel,
+              parsedUsage,
+              resolvedUsage,
+            });
+
+            tokenRouter.recordSuccess(selected.channel.id, latency, estimatedCost);
+            recordDownstreamCostUsage(request, estimatedCost);
+            logProxy(
+              selected, requestedModel, 'success', 200, latency, null, retryCount, downstreamPath,
+              resolvedUsage.promptTokens, resolvedUsage.completionTokens, resolvedUsage.totalTokens, estimatedCost, billingDetails,
+              successfulUpstreamPath,
+              clientContext,
+              logDownstreamApiKeyId ? downstreamApiKeyId : null,
+            );
+
+            const streamPayload = isRecord(downstreamData) ? downstreamData : {
+              id: `resp_${Date.now()}`,
+              object: 'response',
+              status: 'completed',
+              model: modelName,
+              output: [],
+              output_text: '',
+              usage: {
+                input_tokens: parsedUsage.promptTokens,
+                output_tokens: parsedUsage.completionTokens,
+                total_tokens: parsedUsage.totalTokens,
+              },
+            };
+            const createdPayload = {
+              ...streamPayload,
+              status: 'in_progress',
+              output: [],
+              output_text: '',
+            };
+
+            startSseResponse();
+            reply.raw.write(`event: response.created\ndata: ${JSON.stringify({ type: 'response.created', response: createdPayload })}\n\n`);
+            reply.raw.write(`event: response.completed\ndata: ${JSON.stringify({ type: 'response.completed', response: streamPayload })}\n\n`);
+            reply.raw.write('data: [DONE]\n\n');
+            reply.raw.end();
+            return;
+          }
+
+          startSseResponse();
 
           const upstreamReader = upstream.body?.getReader();
-          const reader = String(selected.site.platform || '').trim().toLowerCase() === 'gemini-cli' && upstreamReader
+          const baseReader = String(selected.site.platform || '').trim().toLowerCase() === 'gemini-cli' && upstreamReader
             ? createGeminiCliStreamReader(upstreamReader)
             : upstreamReader;
           let parsedUsage: UsageSummary = {
@@ -444,6 +570,25 @@ export async function responsesProxyRoute(app: FastifyInstance) {
             cacheCreationTokens: 0,
             promptTokensIncludeCache: null,
           };
+          let rawText = '';
+          const decoder = new TextDecoder();
+          const reader = baseReader
+            ? {
+              async read() {
+                const result = await baseReader.read();
+                if (result.value) {
+                  rawText += decoder.decode(result.value, { stream: true });
+                }
+                return result;
+              },
+              async cancel(reason?: unknown) {
+                return baseReader.cancel(reason);
+              },
+              releaseLock() {
+                return baseReader.releaseLock();
+              },
+            }
+            : baseReader;
           const writeLines = (lines: string[]) => {
             for (const line of lines) reply.raw.write(line);
           };
@@ -465,6 +610,7 @@ export async function responsesProxyRoute(app: FastifyInstance) {
             },
           });
           const streamResult = await streamSession.run(reader, reply.raw);
+          rawText += decoder.decode();
 
           const latency = Date.now() - startTime;
           if (streamResult.status === 'failed') {
@@ -490,6 +636,11 @@ export async function responsesProxyRoute(app: FastifyInstance) {
             return;
           }
 
+          // Once SSE has been hijacked and bytes may already be on the wire, we
+          // must not attempt to convert stream failures into a fresh HTTP error
+          // response or retry on another channel. Responses stream failures are
+          // handled in-band by the proxy stream session.
+
           const resolvedUsage = await resolveProxyUsageWithSelfLogFallback({
             site: selected.site,
             account: selected.account,
@@ -545,6 +696,38 @@ export async function responsesProxyRoute(app: FastifyInstance) {
         }
         const latency = Date.now() - startTime;
         const parsedUsage = parseProxyUsage(upstreamData);
+        const failure = detectProxyFailure({ rawText, usage: parsedUsage });
+        if (failure) {
+          tokenRouter.recordFailure(selected.channel.id);
+          logProxy(
+            selected,
+            requestedModel,
+            'failed',
+            failure.status,
+            latency,
+            failure.reason,
+            retryCount,
+            downstreamPath,
+            parsedUsage.promptTokens,
+            parsedUsage.completionTokens,
+            parsedUsage.totalTokens,
+            0,
+            null,
+            successfulUpstreamPath,
+            clientContext,
+            logDownstreamApiKeyId ? downstreamApiKeyId : null,
+          );
+          if (shouldRetryProxyRequest(failure.status, failure.reason) && retryCount < MAX_RETRIES) {
+            retryCount += 1;
+            continue;
+          }
+
+          await reportProxyAllFailed({
+            model: requestedModel,
+            reason: failure.reason,
+          });
+          return reply.code(failure.status).send({ error: { message: failure.reason, type: 'upstream_error' } });
+        }
         const normalized = openAiResponsesTransformer.transformFinalResponse(
           upstreamData,
           modelName,