@bman654/clodex 1.2.1 → 1.2.2

package/README.md

@@ -219,8 +219,13 @@ clodex --version    # version
   FAT, exFAT, or a network mount that rejects hard links. An abrupt process kill
   during lock publication can leave a `providers.json.lock.*.tmp` file; it does
   not block later lock acquisition and can be removed when no Clodex process is
-  running.
+  running. A canonical `providers.json.lock` whose recorded PID is no longer
+  running is reclaimed automatically on the next lock acquisition. If it remains
+  while that PID is active, stop every Clodex process and verify the recorded PID
+  before removing the lock manually. Never remove the canonical lock while a
+  Clodex process is active.
 - Credentials live in the OS credential store (Keychain / Windows Credential Manager / Secret Service) under the `clodex` service. Set `CLODEX_CREDENTIAL_HELPER` to an absolute executable path to use an external secure store instead; see [credential helpers](docs/credential-helpers.md).
+- Proxied routes forward configured provider headers for API-key and OAuth authentication. Anonymous routes preserve non-credential headers while removing authorization, API-key, cookie, token, secret, and credential-bearing header names before dispatch.
 - `CLODEX_CLAUDE_PATH` overrides Claude Code binary discovery.
 - **Outbound proxy:** when `HTTP_PROXY`/`HTTPS_PROXY` (and optionally `NO_PROXY`) are set in clodex's environment, all clodex-originated network calls honor them — OAuth sign-in and token refresh, model-list and models.dev refreshes, upstream OpenAI API calls, and the ChatGPT/Codex OAuth WebSocket transport (tunneled via HTTP CONNECT).
 

package/dist/cli.js

@@ -202,7 +202,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "1.2.1",
+  version: "1.2.2",
   publishConfig: {
     access: "public"
   },
@@ -2731,13 +2731,12 @@ function providersForPicker(providers) {
   return providers.sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base", numeric: true }));
 }
 async function resolveLocalProviderApiKey(provider) {
-  if (provider.authRef === "none:anonymous") return "anonymous";
+  if (provider.authRef === "none:anonymous" || provider.authType === "none") return "";
   const direct = provider.apiKey?.trim();
   if (direct) return direct;
-  if (provider.authType === "none") return "anonymous";
   const template = getTemplateById(provider.id);
   if (template?.apiKeyOptional || template?.anonymousFreeModels) {
-    return "anonymous";
+    return "";
   }
   const reg = loadRegistry().providers.find((p13) => p13.id === provider.id);
   const authRef = provider.authRef ?? reg?.authRef ?? oauthAuthRef(provider.id);
@@ -4080,6 +4079,12 @@ function injectClaudeIdentity(body, providerData, seed) {
   return { sessionId, userId };
 }
 
+// src/credential-headers.ts
+var CREDENTIAL_BEARING_HEADER = /(?:^|[-_])(?:authorization|api[-_]?key|cookie|token|secret|credential)(?:$|[-_])/i;
+function isCredentialBearingHeader(name) {
+  return CREDENTIAL_BEARING_HEADER.test(name);
+}
+
 // src/provider-factory.ts
 var RESPONSES_ONLY_PREFIXES = [
   "gpt-5-codex",
@@ -4089,6 +4094,15 @@ var RESPONSES_ONLY_PREFIXES = [
   "o4"
 ];
 var factoryCache = /* @__PURE__ */ new Map();
+var fetchWithoutCredentialHeaders = (input, init) => {
+  const headers = new Headers(
+    init?.headers ?? (input instanceof Request ? input.headers : void 0)
+  );
+  for (const name of [...headers.keys()]) {
+    if (isCredentialBearingHeader(name)) headers.delete(name);
+  }
+  return fetch(input, { ...init, headers });
+};
 function modelPrefersResponsesApi(modelId) {
   const lower = modelId.toLowerCase();
   if (RESPONSES_ONLY_PREFIXES.some((prefix) => lower === prefix || lower.startsWith(`${prefix}-`))) {
@@ -4153,6 +4167,7 @@ async function createLanguageModel(spec) {
       apiKey,
       baseURL: "https://chatgpt.com/backend-api/codex",
       headers: {
+        ...spec.headers,
         ...accountId ? { "ChatGPT-Account-Id": accountId } : {},
         originator: "clodex",
         // Responses-Lite models (backend prefer_websockets/use_responses_lite,
@@ -4170,7 +4185,11 @@ async function createLanguageModel(spec) {
           onDiagnostic: spec.onWebSocketDiagnostic
         })
       } : {}
-    } : { apiKey };
+    } : spec.authType === "none" ? {
+      apiKey: "",
+      ...spec.headers ? { headers: spec.headers } : {},
+      fetch: fetchWithoutCredentialHeaders
+    } : { apiKey, ...spec.headers ? { headers: spec.headers } : {} };
     const openai = createOpenAI(oauthOptions);
     return useResponsesEndpoint ? openai.responses(modelId) : openai.chat(modelId);
   }
@@ -4190,7 +4209,7 @@ async function createLanguageModel(spec) {
           ).sessionId
         }
       } : {}
-    } : { apiKey };
+    } : spec.authType === "none" ? { apiKey: "", fetch: fetchWithoutCredentialHeaders } : { apiKey };
     if (spec.headers) {
       anthropicOptions.headers = { ...anthropicOptions.headers, ...spec.headers };
     }
@@ -4206,7 +4225,8 @@ async function createLanguageModel(spec) {
     const options = {
       name: spec.providerId ?? "openai-compatible",
       baseURL: baseURL ?? "",
-      ...apiKey.trim() ? { apiKey } : {},
+      ...spec.authType !== "none" && apiKey.trim() ? { apiKey } : {},
+      ...spec.authType === "none" ? { fetch: fetchWithoutCredentialHeaders } : {},
       ...spec.headers ? { headers: spec.headers } : {}
     };
     model = createOpenAICompatible({
@@ -4215,7 +4235,8 @@ async function createLanguageModel(spec) {
   } else {
     const create = await loadSdkProviderFactory(npm);
     const provider = create({
-      apiKey,
+      apiKey: spec.authType === "none" ? "" : apiKey,
+      ...spec.authType === "none" ? { fetch: fetchWithoutCredentialHeaders } : {},
       ...baseURL ? { baseURL } : {},
       ...spec.headers ? { headers: spec.headers } : {}
     });
@@ -4822,7 +4843,6 @@ function getLatestMessagePreview(messages, system) {
   return compactLogValue(preview, REQUEST_PREVIEW_MAX + 20);
 }
 var REDACTED_DIAGNOSTIC_HEADER = "[REDACTED]";
-var SENSITIVE_DIAGNOSTIC_HEADER = /(?:^|[-_])(?:authorization|api[-_]?key|cookie|token|secret|credential)(?:$|[-_])/i;
 var CONVERSATION_BODY_FIELDS = /* @__PURE__ */ new Set(["system", "messages", "tools"]);
 function canonicalDiagnosticValue(value) {
   if (Array.isArray(value)) return value.map(canonicalDiagnosticValue);
@@ -4841,7 +4861,7 @@ function sanitizeDiagnosticHeaders(headers) {
   const out = {};
   for (const [name, value] of Object.entries(headers).sort(([left], [right]) => left.localeCompare(right))) {
     if (value === void 0) continue;
-    out[name.toLowerCase()] = SENSITIVE_DIAGNOSTIC_HEADER.test(name) ? REDACTED_DIAGNOSTIC_HEADER : value;
+    out[name.toLowerCase()] = isCredentialBearingHeader(name) ? REDACTED_DIAGNOSTIC_HEADER : value;
   }
   return out;
 }
@@ -5397,6 +5417,9 @@ async function addProviderFromTemplate(template, apiKey, opts) {
 function credentialStillReferenced(authRef, remaining) {
   return remaining.some((p13) => p13.authRef === authRef);
 }
+function isStoredCredentialRef(authRef) {
+  return authRef.startsWith("keyring:") || authRef.startsWith("helper:");
+}
 async function removeProviderFromRegistry(id, opts) {
   const removal = await withRegistryWriteLock(() => {
     const registry = loadRegistry();
@@ -5421,7 +5444,7 @@ async function removeProviderFromRegistry(id, opts) {
         name: removedProvider.name,
         credentialDeleted: false
       },
-      authRefToDelete: opts?.deleteCredential !== false && !credentialStillReferenced(removedProvider.authRef, registry.providers) ? removedProvider.authRef : null
+      authRefToDelete: opts?.deleteCredential !== false && isStoredCredentialRef(removedProvider.authRef) && !credentialStillReferenced(removedProvider.authRef, registry.providers) ? removedProvider.authRef : null
     };
   });
   const authRefToDelete = removal.authRefToDelete;
@@ -6215,16 +6238,18 @@ async function authenticateProvider(providerId, _options = {}) {
         nativeDiagMsg = msg;
       }
     );
+    if (!saved) {
+      throw new Error(
+        `Could not save OAuth tokens to the credential store${nativeDiagMsg ? ` \u2014 ${nativeDiagMsg}` : " \u2014 check access and try again"}`
+      );
+    }
     const registryProvider2 = await upsertOAuthProvider(
       providerId,
       cred,
       authRef
     );
-    return { saved, nativeDiagMsg, registryProvider: registryProvider2 };
+    return { registryProvider: registryProvider2 };
   });
-  if (!persisted.saved) {
-    p2.log.warn(`Could not save OAuth tokens to the credential store \u2014 ${persisted.nativeDiagMsg || "session may not persist."}`);
-  }
   const { registryProvider } = persisted;
   const refreshSpinner = p2.spinner();
   refreshSpinner.start("Refreshing model list...");
@@ -7138,7 +7163,7 @@ function buildHttpProxyRoutes(providers, favorites, modelAliases = [], max = MAX
       continue;
     }
     const route = localModelToRoute(provider, model);
-    if (!route || !route.apiKey.trim()) {
+    if (!route || !route.apiKey.trim() && route.authType !== "none") {
       unavailable.push(favorite);
       continue;
     }
@@ -7319,13 +7344,21 @@ function extractBearerToken(value) {
 // src/upstream-forward.ts
 function anthropicUpstreamHeaders(apiKey, stream = false, inboundBeta, authType, claudeCodeSessionId, extraHeaders) {
   const key = sanitizeCredential(apiKey) ?? apiKey.trim();
-  const isOAuth = authType === "oauth";
+  const resolvedAuthType = authType ?? "api";
+  const isOAuth = resolvedAuthType === "oauth";
+  const forwardedExtraHeaders = resolvedAuthType === "none" ? Object.fromEntries(
+    Object.entries(extraHeaders ?? {}).filter(
+      ([name]) => !isCredentialBearingHeader(name)
+    )
+  ) : extraHeaders;
   const headers = {
-    ...extraHeaders,
+    ...forwardedExtraHeaders,
     "Content-Type": "application/json",
     "anthropic-version": "2023-06-01",
-    Authorization: `Bearer ${key}`,
-    ...isOAuth ? {} : { "x-api-key": key },
+    ...resolvedAuthType === "none" ? {} : {
+      Authorization: `Bearer ${key}`,
+      ...isOAuth ? {} : { "x-api-key": key }
+    },
     ...isOAuth ? { "User-Agent": CLAUDE_CODE_USER_AGENT, "x-app": "cli" } : {},
     ...isOAuth && claudeCodeSessionId ? { "X-Claude-Code-Session-Id": claudeCodeSessionId } : {},
     ...stream ? { Accept: "text/event-stream" } : {}
@@ -8297,6 +8330,77 @@ function anthropicPromptTooLongMessage(body, contextWindow) {
   return `prompt is too long: ${promptTokens} tokens > ${maximum} maximum`;
 }
 
+// src/listener-ready.ts
+import { connect } from "net";
+import { setTimeout as delay } from "timers/promises";
+var LISTENER_READY_TIMEOUT_MS = 1e3;
+var LISTENER_READY_RETRY_MS = 5;
+function connectHost(address) {
+  if (address === "0.0.0.0") return "127.0.0.1";
+  if (address === "::") return "::1";
+  return address;
+}
+function tcpListenerUrlHost(address) {
+  const host = connectHost(address);
+  return host.includes(":") ? `[${host}]` : host;
+}
+function probeTcpListener(host, port, timeoutMs) {
+  return new Promise((resolve2) => {
+    const socket = connect({ host, port });
+    let settled = false;
+    const finish = (ready) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve2(ready);
+    };
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.setTimeout(timeoutMs, () => finish(false));
+  });
+}
+async function closeAfterReadinessFailure(server) {
+  if (!server.listening) return;
+  await new Promise((resolve2) => server.close(() => resolve2()));
+}
+async function listenTcpServer(server, port, host) {
+  await new Promise((resolve2, reject) => {
+    const cleanup = () => server.off("error", onError);
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    server.once("error", onError);
+    try {
+      server.listen(port, host, () => {
+        cleanup();
+        resolve2();
+      });
+    } catch (error) {
+      cleanup();
+      reject(error);
+    }
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    await closeAfterReadinessFailure(server);
+    throw new Error("TCP server did not bind to a network address");
+  }
+  const probeHost = connectHost(address.address);
+  const deadline = Date.now() + LISTENER_READY_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    const remaining = deadline - Date.now();
+    if (await probeTcpListener(probeHost, address.port, Math.min(remaining, 50))) {
+      return address;
+    }
+    await delay(Math.min(LISTENER_READY_RETRY_MS, Math.max(1, deadline - Date.now())));
+  }
+  await closeAfterReadinessFailure(server);
+  throw new Error(
+    `TCP listener did not become reachable within ${LISTENER_READY_TIMEOUT_MS}ms: ${probeHost}:${address.port}`
+  );
+}
+
 // src/proxy.ts
 var STREAM_KEEPALIVE_INTERVAL_MS = 2e4;
 var STREAM_KEEPALIVE_PING = 'event: ping\ndata: {"type":"ping"}\n\n';
@@ -8426,11 +8530,11 @@ function lookupRoute(byAlias, id) {
   }
   return void 0;
 }
-function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPath, debugLogPath, webSocketDiagnosticsLogPath, modelAliases) {
+async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPath, debugLogPath, webSocketDiagnosticsLogPath, modelAliases) {
   const proxyToken = randomUUID6();
   silenceSdkWarnings();
   if (routes.length === 0) {
-    return Promise.reject(new Error("Proxy catalog requires at least one route"));
+    throw new Error("Proxy catalog requires at least one route");
   }
   const byAlias = new Map(routes.map((r) => [r.aliasId, r]));
   for (const alias of modelAliases ?? []) {
@@ -8507,8 +8611,9 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
       const route = lookupRoute(byAlias, originalModel) ?? defaultRoute;
       const apiKey = route.apiKey;
       const upstreamUrl = route.upstreamUrl;
+      const routeAuthType = route.authType ?? "api";
       plog(
-        () => `POST /v1/messages - alias=${originalModel} route=${route.realModelId} format=${route.modelFormat} key=${apiKey ? `len:${apiKey.length}` : "MISSING"}`
+        () => `POST /v1/messages - alias=${originalModel} route=${route.realModelId} format=${route.modelFormat} key=${routeAuthType === "none" ? "none" : apiKey ? `len:${apiKey.length}` : "MISSING"}`
       );
       const usesSdkAdapter = isSdkMigratedNpm(route.npm);
       if (messagesEndpoint === "count_tokens") {
@@ -8519,7 +8624,7 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
           sendJson(res, 200, { input_tokens: inputTokens });
           return;
         }
-        if (!apiKey) {
+        if (!apiKey && routeAuthType !== "none") {
           anthropicError(res, 401, "Missing API key");
           return;
         }
@@ -8527,11 +8632,11 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
         const inboundBeta = Array.isArray(betaHeaderRaw) ? betaHeaderRaw.join(",") : betaHeaderRaw;
         const forwardBody = { ...anthropicBody, model: route.realModelId };
         const targetUrl = `${upstreamUrl}/v1/messages/count_tokens`;
-        const isOAuth = route.authType === "oauth";
+        const isOAuth = routeAuthType === "oauth";
         try {
           await relayAnthropicMessages(res, targetUrl, forwardBody, apiKey, false, {
             inboundBeta,
-            authType: isOAuth ? "oauth" : "api",
+            authType: routeAuthType,
             log: (message) => plog(message),
             extraHeaders: route.headers,
             refreshToken: route.refreshToken,
@@ -8548,7 +8653,7 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
         }
         return;
       }
-      if (!apiKey && !usesSdkAdapter) {
+      if (!apiKey && routeAuthType !== "none" && !usesSdkAdapter) {
         anthropicError(res, 401, "Missing API key");
         return;
       }
@@ -8557,7 +8662,7 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
         const inboundBeta = Array.isArray(betaHeaderRaw) ? betaHeaderRaw.join(",") : betaHeaderRaw;
         const forwardBody = { ...anthropicBody, model: route.realModelId };
         const targetUrl = `${upstreamUrl}/v1/messages`;
-        const isOAuth = route.authType === "oauth";
+        const isOAuth = routeAuthType === "oauth";
         let effectiveBeta = inboundBeta;
         let claudeCodeSessionId;
         if (isOAuth) {
@@ -8574,7 +8679,7 @@ function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPa
         try {
           await relayAnthropicMessages(res, targetUrl, forwardBody, apiKey, clientWantsStream, {
             inboundBeta: effectiveBeta,
-            authType: isOAuth ? "oauth" : "api",
+            authType: routeAuthType,
             log: (message) => plog(message),
             claudeCodeSessionId,
             extraHeaders: route.headers,
@@ -8770,26 +8875,26 @@ data: ${JSON.stringify({
     }
     anthropicError(res, 404, `Unknown endpoint: ${req.method} ${req.url}`);
   });
-  return new Promise((resolve2, reject) => {
-    server.on("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const addr = server.address();
-      if (!addr || typeof addr === "string") {
-        reject(new Error("Failed to bind proxy"));
-        return;
-      }
-      plog(() => `started on port ${addr.port}, catalog=${routes.length} model(s), default=${defaultRoute.aliasId}`);
-      resolve2({
-        port: addr.port,
-        token: proxyToken,
-        close: () => {
-          process.off("unhandledRejection", onRejection);
-          process.off("uncaughtException", onException);
-          server.close();
-        }
-      });
-    });
-  });
+  let address;
+  try {
+    address = await listenTcpServer(server, 0, "127.0.0.1");
+  } catch (error) {
+    process.off("unhandledRejection", onRejection);
+    process.off("uncaughtException", onException);
+    throw error;
+  }
+  plog(
+    () => `started on port ${address.port}, catalog=${routes.length} model(s), default=${defaultRoute.aliasId}`
+  );
+  return {
+    port: address.port,
+    token: proxyToken,
+    close: () => {
+      process.off("unhandledRejection", onRejection);
+      process.off("uncaughtException", onException);
+      server.close();
+    }
+  };
 }
 function startProxy(completionsUrl, modelId, debug = false, contextWindow, sdk, apiKey) {
   const bareModelId = stripOneMContextSuffix(modelId);
@@ -8812,7 +8917,8 @@ function startProxy(completionsUrl, modelId, debug = false, contextWindow, sdk,
     reasoning: sdk?.reasoning,
     interleavedReasoningField: sdk?.interleavedReasoningField,
     useResponsesLite: sdk?.useResponsesLite,
-    preferWebSockets: sdk?.preferWebSockets
+    preferWebSockets: sdk?.preferWebSockets,
+    headers: sdk?.headers
   }], clientModelId, debug);
 }
 
@@ -9188,21 +9294,11 @@ async function startServer(options) {
   const server = createServer2((req, res) => {
     void routeRequest(req, res, options, languageModelCache, plog);
   });
-  await new Promise((resolve2, reject) => {
-    server.once("error", reject);
-    server.listen(options.port, options.host, () => {
-      server.off("error", reject);
-      resolve2();
-    });
-  });
-  const address = server.address();
-  if (!address || typeof address === "string") {
-    throw new Error("Server did not bind to a TCP port");
-  }
+  const address = await listenTcpServer(server, options.port, options.host);
   return {
     host: options.host,
     port: address.port,
-    url: `http://${options.host}:${address.port}`,
+    url: `http://${tcpListenerUrlHost(address.address)}:${address.port}`,
     server,
     inferenceLogPath: options.inferenceLogPath,
     close: () => new Promise((resolve2, reject) => {
@@ -9287,7 +9383,8 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
     const inboundBeta = Array.isArray(betaHeaderRaw) ? betaHeaderRaw.join(",") : betaHeaderRaw;
     const clientWantsStream = Boolean(body.stream);
     const forwardBody = { ...body, model: upstreamModelId(model) };
-    const isOAuth = model.authType === "oauth";
+    const authType = model.authType ?? "api";
+    const isOAuth = authType === "oauth";
     auditInference(options, {
       requestId,
       modelId: body.model,
@@ -9310,7 +9407,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
     plog(() => `anthropic-passthrough \u2192 ${messagesUrl} oauth=${isOAuth} stream=${clientWantsStream}`);
     await relayAnthropicMessages(res, messagesUrl, forwardBody, apiKey, clientWantsStream, {
       inboundBeta: effectiveBeta,
-      authType: isOAuth ? "oauth" : "api",
+      authType,
       log: (message) => plog(message),
       claudeCodeSessionId,
       extraHeaders: model.headers,
@@ -9466,6 +9563,8 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
       requestPreview: getLatestMessagePreview(body.messages, body.system)
     });
     await relayAnthropicMessages(res, completionsUrl, forwardBody, apiKey2, Boolean(body.stream), {
+      authType: model.authType ?? "api",
+      extraHeaders: model.headers,
       onUpstreamError: options.inferenceLogPath ? (statusCode, errorContent) => writeInferenceResponseErrorLog(options.inferenceLogPath, {
         modelId: body.model,
         provider: inferenceProvider(model),
@@ -10501,23 +10600,17 @@ async function startHttpProxy(options) {
       clientSocket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n", () => clientSocket.destroy());
     });
   });
+  let address;
   try {
-    await new Promise((resolve2, reject) => {
-      proxyServer.once("error", reject);
-      proxyServer.listen(options.port ?? 0, options.host ?? "127.0.0.1", () => {
-        proxyServer.off("error", reject);
-        resolve2();
-      });
-    });
+    address = await listenTcpServer(
+      proxyServer,
+      options.port ?? 0,
+      options.host ?? "127.0.0.1"
+    );
   } catch (err) {
     adapter?.close();
     throw err;
   }
-  const address = proxyServer.address();
-  if (!address || typeof address === "string") {
-    adapter?.close();
-    throw new Error("HTTP proxy did not bind to a TCP port");
-  }
   return {
     host: options.host ?? "127.0.0.1",
     port: address.port,
@@ -12836,7 +12929,8 @@ Error: ${launchPlan.error}
     return 0;
   }
   const launchApiKey = await resolveLocalProviderApiKey(activeProvider);
-  if (!launchApiKey?.trim()) {
+  const anonymousProvider = activeProvider.authType === "none";
+  if (!anonymousProvider && !launchApiKey?.trim()) {
     p12.log.error(
       `No credential found for ${activeProvider.name}. Add a key or sign in with clodex providers.`
     );
@@ -12845,7 +12939,8 @@ Error: ${launchPlan.error}
   let proxyHandle = null;
   let childEnv;
   const isOAuthAnthropic = selectedModel.modelFormat === "anthropic" && activeProvider.authType === "oauth";
-  if (isOAuthAnthropic) {
+  const usesAnthropicProxy = selectedModel.modelFormat === "anthropic" && (isOAuthAnthropic || anonymousProvider);
+  if (usesAnthropicProxy) {
     try {
       proxyHandle = await startProxy(
         selectedModel.baseUrl ?? "https://api.anthropic.com",
@@ -12854,16 +12949,17 @@ Error: ${launchPlan.error}
         selectedModel.contextWindow,
         {
           providerId: activeProvider.id,
-          authType: "oauth",
+          authType: activeProvider.authType,
           oauthAccountId: activeProvider.oauthAccountId,
           providerData: activeProvider.providerData,
-          modelFormat: "anthropic"
+          modelFormat: "anthropic",
+          headers: activeProvider.headers
         },
-        launchApiKey
+        launchApiKey ?? ""
       );
-      if (!isAgentStdoutMode()) p12.log.info(`OAuth proxy started on port ${proxyHandle.port}`);
+      if (!isAgentStdoutMode()) p12.log.info(`Anthropic proxy started on port ${proxyHandle.port}`);
     } catch (err) {
-      p12.log.error(`Failed to start OAuth proxy: ${err instanceof Error ? err.message : String(err)}`);
+      p12.log.error(`Failed to start Anthropic proxy: ${err instanceof Error ? err.message : String(err)}`);
       return 1;
     }
     childEnv = buildChildEnv(
@@ -12877,7 +12973,7 @@ Error: ${launchPlan.error}
     childEnv = buildChildEnv(
       selectedModel.baseUrl,
       selectedModel.id,
-      launchApiKey,
+      launchApiKey ?? "",
       void 0,
       selectedModel.contextWindow
     );
@@ -12899,9 +12995,10 @@ Error: ${launchPlan.error}
           reasoning: selectedModel.reasoning,
           interleavedReasoningField: selectedModel.interleavedReasoningField,
           useResponsesLite: selectedModel.useResponsesLite,
-          preferWebSockets: selectedModel.preferWebSockets
+          preferWebSockets: selectedModel.preferWebSockets,
+          headers: activeProvider.headers
         },
-        launchApiKey
+        launchApiKey ?? ""
       );
       if (!isAgentStdoutMode()) {
         p12.log.info(
@@ -12920,7 +13017,7 @@ Error: ${launchPlan.error}
       selectedModel.contextWindow
     );
   }
-  if (selectedModel.modelFormat === "anthropic" && !isOAuthAnthropic) {
+  if (selectedModel.modelFormat === "anthropic" && !usesAnthropicProxy) {
     childEnv["CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS"] = "1";
   }
   const debugLogPath = prepareClaudeTraceLog();