@codemieai/code 0.0.54 → 0.0.56

package/dist/providers/plugins/sso/proxy/plugins/claude-thinking-transformer.plugin.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Claude Thinking Transformer Plugin
+ * Priority: 16 (runs after Request Sanitizer at 15, before header injection at 20)
+ *
+ * Transforms thinking parameters for Claude models that require the new adaptive
+ * thinking API (e.g. claude-opus-4-7).
+ *
+ * Problem: Claude Code sends `thinking: { type: "enabled", budget_tokens: N }`
+ * for Opus models. claude-opus-4-7 rejects this with HTTP 400:
+ *   "thinking.type.enabled" is not supported for this model. Use
+ *   "thinking.type.adaptive" and "output_config.effort" instead.
+ *
+ * Fix: When the request model matches a Claude 4.7+ pattern:
+ *   - "enabled"  → thinking: { type: "adaptive" } + output_config.effort (derived
+ *                  from budget_tokens; only written if not already present)
+ *   - "disabled" → delete the thinking field entirely (model does not accept this value)
+ *
+ * Scope: Only enabled for codemie-claude agent (Claude Code via SSO proxy).
+ *
+ * To add support for a new model: append a pattern to ADAPTIVE_THINKING_MODEL_PATTERNS.
+ */
+import { ProxyPlugin, PluginContext, ProxyInterceptor } from './types.js';
+export declare class ClaudeThinkingTransformerPlugin implements ProxyPlugin {
+    id: string;
+    name: string;
+    version: string;
+    priority: number;
+    createInterceptor(context: PluginContext): Promise<ProxyInterceptor>;
+}
+//# sourceMappingURL=claude-thinking-transformer.plugin.d.ts.map

package/dist/providers/plugins/sso/proxy/plugins/claude-thinking-transformer.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-thinking-transformer.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/claude-thinking-transformer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAiC1E,qBAAa,+BAAgC,YAAW,WAAW;IACjE,EAAE,SAAgD;IAClD,IAAI,SAAiC;IACrC,OAAO,SAAW;IAClB,QAAQ,SAAM;IAER,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAS3E"}

package/dist/providers/plugins/sso/proxy/plugins/claude-thinking-transformer.plugin.js

@@ -0,0 +1,111 @@
+/**
+ * Claude Thinking Transformer Plugin
+ * Priority: 16 (runs after Request Sanitizer at 15, before header injection at 20)
+ *
+ * Transforms thinking parameters for Claude models that require the new adaptive
+ * thinking API (e.g. claude-opus-4-7).
+ *
+ * Problem: Claude Code sends `thinking: { type: "enabled", budget_tokens: N }`
+ * for Opus models. claude-opus-4-7 rejects this with HTTP 400:
+ *   "thinking.type.enabled" is not supported for this model. Use
+ *   "thinking.type.adaptive" and "output_config.effort" instead.
+ *
+ * Fix: When the request model matches a Claude 4.7+ pattern:
+ *   - "enabled"  → thinking: { type: "adaptive" } + output_config.effort (derived
+ *                  from budget_tokens; only written if not already present)
+ *   - "disabled" → delete the thinking field entirely (model does not accept this value)
+ *
+ * Scope: Only enabled for codemie-claude agent (Claude Code via SSO proxy).
+ *
+ * To add support for a new model: append a pattern to ADAPTIVE_THINKING_MODEL_PATTERNS.
+ */
+import { logger } from '../../../../../utils/logger.js';
+/**
+ * Model name patterns that require the adaptive thinking API.
+ * Matches claude-opus-4-7, claude-opus-4-7-20250514, and future date-tagged variants.
+ * Extend this list as Anthropic migrates additional models — see EPMCDME-11821.
+ */
+const ADAPTIVE_THINKING_MODEL_PATTERNS = [
+    /claude-opus-4-[7-9](?:[^0-9]|$)/i, // claude-opus-4-7/8/9 and date-tagged variants (e.g. claude-opus-4-7-20250514); excludes claude-opus-4-70+
+];
+function modelRequiresAdaptiveThinking(modelName) {
+    return ADAPTIVE_THINKING_MODEL_PATTERNS.some(p => p.test(modelName));
+}
+/**
+ * Map legacy budget_tokens to the closest output_config.effort level.
+ *
+ * budget_tokens was the maximum token budget for thinking in the old API.
+ * effort is a coarser control in the new API: low / medium / high.
+ */
+function budgetTokensToEffort(budgetTokens) {
+    const tokens = typeof budgetTokens === 'number' ? budgetTokens : 0;
+    if (tokens <= 2048)
+        return 'low';
+    if (tokens <= 8192)
+        return 'medium';
+    return 'high';
+}
+/** Agent that sends Claude API requests through the codemie proxy */
+const ALLOWED_AGENT = 'codemie-claude';
+export class ClaudeThinkingTransformerPlugin {
+    id = '@codemie/proxy-claude-thinking-transformer';
+    name = 'Claude Thinking Transformer';
+    version = '1.0.0';
+    priority = 16; // After RequestSanitizer (15), before HeaderInjection (20)
+    async createInterceptor(context) {
+        const clientType = context.config.clientType;
+        if (!clientType || clientType !== ALLOWED_AGENT) {
+            throw new Error(`Plugin disabled for agent: ${clientType}`);
+        }
+        // Pass the configured model as a fallback for requests that omit body.model
+        const configModel = context.config.model;
+        return new ClaudeThinkingTransformerInterceptor(configModel);
+    }
+}
+class ClaudeThinkingTransformerInterceptor {
+    configModel;
+    name = 'claude-thinking-transformer';
+    constructor(configModel) {
+        this.configModel = configModel;
+    }
+    async onRequest(context) {
+        if (!context.requestBody || !context.headers['content-type']?.includes('application/json')) {
+            return;
+        }
+        try {
+            const bodyStr = context.requestBody.toString('utf-8');
+            const body = JSON.parse(bodyStr);
+            const thinkingType = body.thinking?.type;
+            if (thinkingType !== 'enabled' && thinkingType !== 'disabled') {
+                return;
+            }
+            // Resolve model: prefer request body, fall back to proxy config
+            const model = (typeof body.model === 'string' && body.model) || this.configModel || '';
+            if (!model || !modelRequiresAdaptiveThinking(model)) {
+                return;
+            }
+            if (thinkingType === 'enabled') {
+                const effort = budgetTokensToEffort(body.thinking.budget_tokens);
+                // Replace old thinking object with new adaptive format
+                body.thinking = { type: 'adaptive' };
+                // Set output_config.effort only if the caller hasn't already specified it
+                if (!body.output_config?.effort) {
+                    body.output_config = { ...(body.output_config ?? {}), effort };
+                }
+                logger.debug(`[${this.name}] Transformed thinking: "enabled" → "adaptive", effort="${effort}" for model: ${model}`);
+            }
+            else {
+                // thinking.type === 'disabled': model does not accept this value — remove the field
+                delete body.thinking;
+                logger.debug(`[${this.name}] Removed unsupported thinking.type="disabled" for model: ${model}`);
+            }
+            const newBodyStr = JSON.stringify(body);
+            context.requestBody = Buffer.from(newBodyStr, 'utf-8');
+            context.headers['content-length'] = String(context.requestBody.length);
+        }
+        catch {
+            // Not valid JSON or unexpected structure — pass through unchanged
+        }
+    }
+}
+//# sourceMappingURL=claude-thinking-transformer.plugin.js.map

package/dist/providers/plugins/sso/proxy/plugins/claude-thinking-transformer.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-thinking-transformer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/claude-thinking-transformer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD;;;;GAIG;AACH,MAAM,gCAAgC,GAAa;IACjD,kCAAkC,EAAG,2GAA2G;CACjJ,CAAC;AAEF,SAAS,6BAA6B,CAAC,SAAiB;IACtD,OAAO,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,YAAqB;IACjD,MAAM,MAAM,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qEAAqE;AACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,OAAO,+BAA+B;IAC1C,EAAE,GAAG,4CAA4C,CAAC;IAClD,IAAI,GAAG,6BAA6B,CAAC;IACrC,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC,CAAC,2DAA2D;IAE1E,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,4EAA4E;QAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACzC,OAAO,IAAI,oCAAoC,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,oCAAoC;IAGX;IAF7B,IAAI,GAAG,6BAA6B,CAAC;IAErC,YAA6B,WAAoB;QAApB,gBAAW,GAAX,WAAW,CAAS;IAAG,CAAC;IAErD,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEjC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;YACzC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,gEAAgE;YAChE,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACvF,IAAI,CAAC,KAAK,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBAEjE,uDAAuD;gBACvD,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;gBAErC,0EAA0E;gBAC1E,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;oBAChC,IAAI,CAAC,aAAa,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;gBACjE,CAAC;gBAED,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,2DAA2D,MAAM,gBAAgB,KAAK,EAAE,CACtG,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,oFAAoF;gBACpF,OAAO,IAAI,CAAC,QAAQ,CAAC;gBAErB,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,6DAA6D,KAAK,EAAE,CAClF,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;CACF"}

package/dist/providers/plugins/sso/proxy/plugins/index.d.ts

@@ -4,18 +4,20 @@
  * KISS: Single file to register all core plugins
  * Extensibility: Easy to add new plugins
  */
+import { MCPAuthPlugin } from './mcp-auth.plugin.js';
 import { EndpointBlockerPlugin } from './endpoint-blocker.plugin.js';
 import { SSOAuthPlugin } from './sso-auth.plugin.js';
 import { JWTAuthPlugin } from './jwt-auth.plugin.js';
 import { HeaderInjectionPlugin } from './header-injection.plugin.js';
 import { RequestSanitizerPlugin } from './request-sanitizer.plugin.js';
+import { ClaudeThinkingTransformerPlugin } from './claude-thinking-transformer.plugin.js';
 import { LoggingPlugin } from './logging.plugin.js';
 /**
  * Register core plugins
  * Called at app startup
  */
 export declare function registerCorePlugins(): void;
-export { EndpointBlockerPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, LoggingPlugin };
+export { MCPAuthPlugin, EndpointBlockerPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeThinkingTransformerPlugin, LoggingPlugin, };
 export { SSOSessionSyncPlugin } from './sso.session-sync.plugin.js';
 export { getPluginRegistry, resetPluginRegistry } from './registry.js';
 export * from './types.js';

package/dist/providers/plugins/sso/proxy/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAW1C;AAMD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,EAAE,CAAC;AAC7H,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAa1C;AAMD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,+BAA+B,EAC/B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/index.js

@@ -5,11 +5,13 @@
  * Extensibility: Easy to add new plugins
  */
 import { getPluginRegistry } from './registry.js';
+import { MCPAuthPlugin } from './mcp-auth.plugin.js';
 import { EndpointBlockerPlugin } from './endpoint-blocker.plugin.js';
 import { SSOAuthPlugin } from './sso-auth.plugin.js';
 import { JWTAuthPlugin } from './jwt-auth.plugin.js';
 import { HeaderInjectionPlugin } from './header-injection.plugin.js';
 import { RequestSanitizerPlugin } from './request-sanitizer.plugin.js';
+import { ClaudeThinkingTransformerPlugin } from './claude-thinking-transformer.plugin.js';
 import { LoggingPlugin } from './logging.plugin.js';
 import { SSOSessionSyncPlugin } from './sso.session-sync.plugin.js';
 /**
@@ -19,10 +21,12 @@ import { SSOSessionSyncPlugin } from './sso.session-sync.plugin.js';
 export function registerCorePlugins() {
     const registry = getPluginRegistry();
     // Register in any order (priority determines execution order)
+    registry.register(new MCPAuthPlugin()); // Priority 3 - MCP auth relay routing
     registry.register(new EndpointBlockerPlugin()); // Priority 5 - blocks unwanted endpoints early
     registry.register(new SSOAuthPlugin());
     registry.register(new JWTAuthPlugin());
     registry.register(new RequestSanitizerPlugin()); // Priority 15 - strips unsupported reasoning params
+    registry.register(new ClaudeThinkingTransformerPlugin()); // Priority 16 - transforms thinking params for Claude 4.7+ models
     registry.register(new HeaderInjectionPlugin());
     registry.register(new LoggingPlugin()); // Always enabled - logs to log files at INFO level
     registry.register(new SSOSessionSyncPlugin()); // Priority 100 - syncs sessions via multiple processors
@@ -30,7 +34,7 @@ export function registerCorePlugins() {
 // Auto-register on import
 registerCorePlugins();
 // Re-export for convenience
-export { EndpointBlockerPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, LoggingPlugin };
+export { MCPAuthPlugin, EndpointBlockerPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeThinkingTransformerPlugin, LoggingPlugin, };
 export { SSOSessionSyncPlugin } from './sso.session-sync.plugin.js';
 export { getPluginRegistry, resetPluginRegistry } from './registry.js';
 export * from './types.js';

package/dist/providers/plugins/sso/proxy/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC,+CAA+C;IAC/F,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,oDAAoD;IACrG,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,mDAAmD;IAC3F,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,wDAAwD;AACzG,CAAC;AAED,0BAA0B;AAC1B,mBAAmB,EAAE,CAAC;AAEtB,4BAA4B;AAC5B,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,aAAa,EAAE,CAAC;AAC7H,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAU,sCAAsC;IACvF,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC,+CAA+C;IAC/F,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,oDAAoD;IACrG,QAAQ,CAAC,QAAQ,CAAC,IAAI,+BAA+B,EAAE,CAAC,CAAC,CAAC,kEAAkE;IAC5H,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,mDAAmD;IAC3F,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,wDAAwD;AACzG,CAAC;AAED,0BAA0B;AAC1B,mBAAmB,EAAE,CAAC;AAEtB,4BAA4B;AAC5B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,+BAA+B,EAC/B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/mcp-auth.plugin.d.ts

@@ -0,0 +1,34 @@
+/**
+ * MCP Authorization Proxy Plugin
+ * Priority: 3 (runs before endpoint blocker, auth, and all other plugins)
+ *
+ * Proxies the MCP OAuth authorization flow so that:
+ * 1. All auth traffic is routed through the CodeMie proxy
+ * 2. `client_name` is replaced with MCP_CLIENT_NAME env var (default "CodeMie CLI") in dynamic client registration
+ *
+ * URL scheme:
+ * - /mcp_auth?original=<url>                          → Initial MCP connection
+ * - /mcp_relay/<root_b64>/<relay_b64>/<path>          → Relayed requests (per-flow scoped)
+ *
+ * The root_b64 segment carries the root MCP server origin for per-flow isolation.
+ * The relay_b64 segment identifies the actual target origin (may differ from root
+ * when the auth server is on a separate host).
+ *
+ * Response URL rewriting replaces external URLs with proxy relay URLs so that
+ * the MCP client (Claude Code CLI) routes all subsequent requests through the proxy.
+ *
+ * Security:
+ * - SSRF protection: private/loopback origins are rejected (hostname + DNS resolution)
+ * - Per-flow origin scoping: discovered origins are tagged with their root MCP server
+ *   origin and relay requests validate the root-relay association
+ * - Buffering is restricted to auth metadata responses; post-auth MCP traffic streams through
+ */
+import { ProxyPlugin, PluginContext, ProxyInterceptor } from './types.js';
+export declare class MCPAuthPlugin implements ProxyPlugin {
+    id: string;
+    name: string;
+    version: string;
+    priority: number;
+    createInterceptor(context: PluginContext): Promise<ProxyInterceptor>;
+}
+//# sourceMappingURL=mcp-auth.plugin.d.ts.map

package/dist/providers/plugins/sso/proxy/plugins/mcp-auth.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-auth.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/mcp-auth.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA0O1E,qBAAa,aAAc,YAAW,WAAW;IAC/C,EAAE,SAA6B;IAC/B,IAAI,SAAoB;IACxB,OAAO,SAAW;IAClB,QAAQ,SAAK;IAEP,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAG3E"}