@antseed/cli 0.1.178 → 0.1.179

package/dist/proxy/buyer-proxy.test.js

@@ -803,6 +803,29 @@ test('conversation routing keeps the actual peer as a soft preference and fails
     assert.equal(route.statusCode, 200);
     assert.equal(JSON.parse(route.body).conversation.lastModel, `${rankedFirst.peerId}@Kimi K3`);
 });
+test('BuyerProxy does not forward the Expect header to the seller', async () => {
+    const peer = makePeer('c', ['openai']);
+    peer.providerServiceApiProtocols = {
+        openai: { services: { 'kimi-k3': ['openai-chat-completions'] } },
+    };
+    const proxy = makeBuyerProxyWithPeers([peer], [peer], permissiveRouter());
+    let forwardedHeaders;
+    proxy._node.sendRequest = async (_peer, request) => {
+        forwardedHeaders = request.headers;
+        return {
+            requestId: request.requestId,
+            statusCode: 200,
+            headers: { 'content-type': 'application/json' },
+            body: Buffer.from('{}'),
+        };
+    };
+    await invokeProxy(proxy, makeProxyRequest({
+        headers: { expect: '100-continue' },
+        body: { model: 'kimi-k3', messages: [{ role: 'user', content: 'hello' }] },
+    }));
+    assert.ok(forwardedHeaders);
+    assert.equal(forwardedHeaders['expect'], undefined);
+});
 test('model-only request applies a cached-input pricing reputation penalty', async () => {
     const priced = makePeer('a', ['openai']);
     priced.reputationScore = 75;
@@ -3403,6 +3426,60 @@ test('getSweepReceipt returns cached relayer receipts case-insensitively', () =>
     assert.equal(proxy.getSweepReceipt(nonce.toLowerCase()), receipt);
     assert.equal(proxy.getSweepReceipt('0x' + '00'.repeat(32)), null);
 });
+// Issue #1104: a client's own provider credentials must never reach a seller.
+// Sellers authenticate their upstream with their own keys; the buyer pays
+// on-chain. A malicious seller would otherwise read the raw key off the wire.
+const CLIENT_CREDENTIAL_HEADERS = {
+    authorization: 'Bearer sk-real',
+    'proxy-authorization': 'Basic cHJveHk6c2VjcmV0',
+    'x-api-key': 'sk-ant-real',
+    'x-goog-api-key': 'AIza-real',
+    'api-key': 'azure-real',
+    cookie: 'session=real',
+};
+test('buyer proxy does not forward client credential headers to the seller (buffered)', async () => {
+    const peer = makePeer('e', ['openai']);
+    const proxy = makeBuyerProxyWithPeers([peer], [peer], permissiveRouter());
+    let seen = null;
+    proxy._node.sendRequest = async (_peer, request) => {
+        seen = request.headers;
+        return { requestId: request.requestId, statusCode: 200, headers: { 'content-type': 'application/json' }, body: Buffer.from('{}') };
+    };
+    const res = await invokeProxy(proxy, makeProxyRequest({
+        headers: {
+            ...CLIENT_CREDENTIAL_HEADERS,
+            'x-antseed-pin-peer': peer.peerId,
+            'anthropic-version': '2023-06-01',
+            'x-antseed-spending-auth': 'signed-auth-payload',
+        },
+    }));
+    assert.equal(res.statusCode, 200);
+    assert.ok(seen, 'seller received a request');
+    const leaked = Object.keys(CLIENT_CREDENTIAL_HEADERS).filter((name) => seen[name] !== undefined);
+    assert.deepEqual(leaked, [], `credential headers reached the seller: ${leaked.join(', ')}`);
+    // Non-credential client headers still pass through.
+    assert.equal(seen['anthropic-version'], '2023-06-01');
+    assert.equal(seen['content-type'], 'application/json');
+    // AntSeed's own payment-auth header is not a client credential.
+    assert.equal(seen['x-antseed-spending-auth'], 'signed-auth-payload');
+});
+test('buyer proxy does not forward client credential headers to the seller (streaming)', async () => {
+    const peer = makePeer('f', ['openai']);
+    const proxy = makeBuyerProxyWithPeers([peer], [peer], permissiveRouter());
+    let seen = null;
+    proxy._node.sendRequestStream = async (_peer, request) => {
+        seen = request.headers;
+        return { requestId: request.requestId, statusCode: 200, headers: { 'content-type': 'application/json' }, body: Buffer.from('{}') };
+    };
+    proxy._node.sendRequest = proxy._node.sendRequestStream;
+    await invokeProxy(proxy, makeProxyRequest({
+        headers: { ...CLIENT_CREDENTIAL_HEADERS, accept: 'text/event-stream', 'x-antseed-pin-peer': peer.peerId },
+        body: { model: 'gpt-4o', stream: true, messages: [] },
+    }));
+    assert.ok(seen, 'seller received a request');
+    const leaked = Object.keys(CLIENT_CREDENTIAL_HEADERS).filter((name) => seen[name] !== undefined);
+    assert.deepEqual(leaked, [], `credential headers reached the seller: ${leaked.join(', ')}`);
+});
 test('switching a chat route while a request is in flight is not reverted when that request completes', async () => {
     const dir = await mkdtemp(join(tmpdir(), 'antseed-buyer-route-race-'));
     try {