Module forward 

The route handler: hello probe, path parsing, splice, re-header, and the streaming forward.

Routing rules, in the order they are checked:

• <segments>/api/hello answers 404 and never constructs the upstream leg - the CLI’s connectivity probe must not become an authenticated request to a third party on a path that needs no auth.
• <segments>/v1/messages (query ignored) resolves the binding and forwards to the bound account’s upstream with the real credential attached and the CLI’s dummy stripped. A bound session keeps its account for its whole life: an account the config removes is retired rather than dropped, and a model the account does not declare is still forwarded, because the account was the spawn’s choice and a running session is not reconfigured. An unbound session selects an account now, from the model in its own body.
• The failing response streams back to the CLI untouched, but the triggers it carries mark the account exhausted and rotate the binding, so the CLI’s retry lands on the next account with nothing replayed.

Re-exports

use std::collections::HashMap; 🔒

use std::sync::Arc; 🔒

use std::time::Duration; 🔒

use std::time::SystemTime; 🔒

use bytes::Bytes; 🔒

use futures_util::StreamExt; 🔒

use hyper::body::Frame; 🔒

use hyper::header::CONTENT_LENGTH; 🔒

use hyper::header::TRANSFER_ENCODING; 🔒

use hyper::HeaderMap; 🔒

use hyper::Method; 🔒

use hyper::Request; 🔒

use hyper::StatusCode; 🔒

use crate::account::AccountKey; 🔒

use crate::binding::Bindings; 🔒

use crate::binding::DUMMY_CREDENTIAL; 🔒

use crate::binding::credential_variable_for; 🔒

use crate::listener::RouteHandler; 🔒

use crate::listener::StreamBody; 🔒

use crate::listener::text_response; 🔒

use crate::rotation::RotationState; 🔒

use crate::splice::splice_model; 🔒

Structs

Gateway

The gateway’s route handler: bindings + the account pool + rotation state + the upstream client.

Enums

SelectFailure

Why a request could not be bound to an account.

Constants

ANTHROPIC_UPSTREAM 🔒

The upstream an account with no base URL of its own talks to: the four Anthropic accounts declare none today, and the CLI’s default host is what they have always used.

FORWARD_CONNECT_TIMEOUT

How long the connect and the TLS handshake may take before the request is abandoned. Well under the idle bound: a host that blackholes the SYN never reaches the first byte, so the idle bound alone would hold the turn open for it, longer than the kernel’s own connect timeout did before the leg carried any bound at all.

FORWARD_IDLE_TIMEOUT

How long the upstream may produce nothing at all before the forwarded turn is abandoned. An idle bound, not a deadline for the whole response: a turn streams for as long as the model takes, and only silence means the leg is wedged.

Functions

header_value_is 🔒

Case-insensitive header comparison against a wire literal.

retry_after 🔒

The Retry-After header, as seconds. Zero reads as absent: a cooldown ending the instant it starts is the same as none, and the next arm of the cooldown rule should decide instead.

Type Aliases

BoxError 🔒

The error type a streamed body yields.