@codemieai/code 0.1.0 → 0.2.1

package/dist/frameworks/plugins/codebase-memory.plugin.js

@@ -0,0 +1,131 @@
+/**
+ * Codebase Memory MCP Framework Plugin
+ *
+ * Integration for DeusData/codebase-memory-mcp with the graph visualization UI.
+ */
+import { existsSync } from 'fs';
+import { join } from 'path';
+import { exec, commandExists } from '../../utils/processes.js';
+import { logger } from '../../utils/logger.js';
+import { BaseFrameworkAdapter } from '../core/BaseFrameworkAdapter.js';
+const INSTALLER_URL = 'https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh';
+const WINDOWS_INSTALLER_URL = 'https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.ps1';
+export const CodebaseMemoryMetadata = {
+    name: 'codebase-memory',
+    displayName: 'Codebase Memory MCP',
+    description: 'Persistent code intelligence graph with MCP tools and 3D visualization UI',
+    docsUrl: 'https://github.com/DeusData/codebase-memory-mcp',
+    repoUrl: 'https://github.com/DeusData/codebase-memory-mcp',
+    requiresInstallation: true,
+    installMethod: 'manual',
+    packageName: 'codebase-memory-mcp',
+    cliCommand: 'codebase-memory-mcp',
+    isAgentSpecific: false,
+    supportedAgents: [],
+    initDirectory: '.codebase-memory',
+};
+export class CodebaseMemoryPlugin extends BaseFrameworkAdapter {
+    constructor() {
+        super(CodebaseMemoryMetadata);
+    }
+    async install() {
+        this.logInstallStart();
+        try {
+            if (process.platform === 'win32') {
+                await exec('powershell', [
+                    '-NoProfile',
+                    '-ExecutionPolicy',
+                    'Bypass',
+                    '-Command',
+                    `$installer = Join-Path $env:TEMP 'codebase-memory-install.ps1'; ` +
+                        `Invoke-WebRequest -Uri '${WINDOWS_INSTALLER_URL}' -OutFile $installer; ` +
+                        `& $installer --ui`,
+                ], { timeout: 300000 });
+            }
+            else {
+                await exec('bash', ['-c', `curl -fsSL ${INSTALLER_URL} | bash -s -- --ui`], { timeout: 300000 });
+            }
+            const version = await this.getVersion();
+            this.logInstallSuccess(version || undefined);
+        }
+        catch (error) {
+            this.logInstallError(error);
+            throw error;
+        }
+    }
+    async uninstall() {
+        this.logUninstallStart();
+        try {
+            await exec('codebase-memory-mcp', ['uninstall'], { timeout: 60000 });
+            this.logUninstallSuccess();
+            logger.info('The codebase-memory-mcp binary and local graph databases were left in place.');
+        }
+        catch (error) {
+            this.logUninstallError(error);
+            throw error;
+        }
+    }
+    async init(agentName, options) {
+        const cwd = options?.cwd || process.cwd();
+        this.logInitStart(agentName);
+        if (!(await this.isInstalled())) {
+            logger.warn('Codebase Memory MCP not found. Installing the UI variant...');
+            await this.install();
+        }
+        try {
+            await exec('codebase-memory-mcp', ['install', '-y'], {
+                cwd,
+                timeout: 120000,
+            });
+            await exec('codebase-memory-mcp', ['config', 'set', 'auto_index', 'true'], {
+                cwd,
+                timeout: 30000,
+            });
+            await exec('codebase-memory-mcp', ['cli', 'index_repository', JSON.stringify({ repo_path: cwd })], {
+                cwd,
+                timeout: 300000,
+            });
+            this.logInitSuccess(cwd);
+            logger.info('Open the graph UI with: codemie codebase ui');
+        }
+        catch (error) {
+            this.logInitError(error);
+            throw error;
+        }
+    }
+    async isInitialized(cwd = process.cwd()) {
+        if (existsSync(join(cwd, '.codebase-memory'))) {
+            return true;
+        }
+        if (!(await this.isInstalled())) {
+            return false;
+        }
+        try {
+            const result = await exec('codebase-memory-mcp', ['cli', 'index_status', JSON.stringify({ repo_path: cwd })], { cwd, timeout: 10000 });
+            return result.code === 0 && /indexed|ready|complete|success/i.test(result.stdout);
+        }
+        catch {
+            return false;
+        }
+    }
+    async isInstalled() {
+        if (!(await commandExists('codebase-memory-mcp'))) {
+            return false;
+        }
+        try {
+            const result = await exec('codebase-memory-mcp', ['--help'], { timeout: 5000 });
+            const helpText = `${result.stdout}\n${result.stderr}`;
+            if (result.code !== 0 || !/--ui|ui=true|graph visualization/i.test(helpText)) {
+                return false;
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    getAgentMapping(codemieAgentName) {
+        return codemieAgentName;
+    }
+}
+//# sourceMappingURL=codebase-memory.plugin.js.map

package/dist/frameworks/plugins/codebase-memory.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codebase-memory.plugin.js","sourceRoot":"","sources":["../../../src/frameworks/plugins/codebase-memory.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAGvE,MAAM,aAAa,GAAG,gFAAgF,CAAC;AACvG,MAAM,qBAAqB,GAAG,iFAAiF,CAAC;AAEhH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,qBAAqB;IAClC,WAAW,EAAE,2EAA2E;IACxF,OAAO,EAAE,iDAAiD;IAC1D,OAAO,EAAE,iDAAiD;IAC1D,oBAAoB,EAAE,IAAI;IAC1B,aAAa,EAAE,QAAQ;IACvB,WAAW,EAAE,qBAAqB;IAClC,UAAU,EAAE,qBAAqB;IACjC,eAAe,EAAE,KAAK;IACtB,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,kBAAkB;CAClC,CAAC;AAEF,MAAM,OAAO,oBAAqB,SAAQ,oBAAoB;IAC5D;QACE,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,eAAe,EAAE,CAAC;QAEvB,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,MAAM,IAAI,CACR,YAAY,EACZ;oBACE,YAAY;oBACZ,kBAAkB;oBAClB,QAAQ;oBACR,UAAU;oBACV,kEAAkE;wBAChE,2BAA2B,qBAAqB,yBAAyB;wBACzE,mBAAmB;iBACtB,EACD,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CACR,MAAM,EACN,CAAC,IAAI,EAAE,cAAc,aAAa,oBAAoB,CAAC,EACvD,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,iBAAiB,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,OAA8B;QAC1D,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE1C,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAE7B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YAC3E,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE;gBACnD,GAAG;gBACH,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE;gBACzE,GAAG;gBACH,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,MAAM,IAAI,CACR,qBAAqB,EACrB,CAAC,KAAK,EAAE,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAC/D;gBACE,GAAG;gBACH,OAAO,EAAE,MAAM;aAChB,CACF,CAAC;YAEF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;QAC7C,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CACvB,qBAAqB,EACrB,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAC3D,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CACxB,CAAC;YACF,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7E,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,eAAe,CAAC,gBAAwB;QACtC,OAAO,gBAAgB,CAAC;IAC1B,CAAC;CACF"}

package/dist/frameworks/plugins/index.d.ts

@@ -5,4 +5,5 @@
  */
 export { SpeckitPlugin } from './speckit.plugin.js';
 export { BmadPlugin } from './bmad.plugin.js';
+export { CodebaseMemoryPlugin } from './codebase-memory.plugin.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/frameworks/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/frameworks/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/frameworks/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/frameworks/plugins/index.js

@@ -6,10 +6,13 @@
 import { FrameworkRegistry } from '../core/registry.js';
 import { SpeckitPlugin } from './speckit.plugin.js';
 import { BmadPlugin } from './bmad.plugin.js';
+import { CodebaseMemoryPlugin } from './codebase-memory.plugin.js';
 // Export plugins
 export { SpeckitPlugin } from './speckit.plugin.js';
 export { BmadPlugin } from './bmad.plugin.js';
+export { CodebaseMemoryPlugin } from './codebase-memory.plugin.js';
 // Auto-register plugins
 FrameworkRegistry.registerFramework(new SpeckitPlugin());
 FrameworkRegistry.registerFramework(new BmadPlugin());
+FrameworkRegistry.registerFramework(new CodebaseMemoryPlugin());
 //# sourceMappingURL=index.js.map

package/dist/frameworks/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/frameworks/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,iBAAiB;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,wBAAwB;AACxB,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;AACzD,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/frameworks/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,iBAAiB;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,wBAAwB;AACxB,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;AACzD,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;AACtD,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.d.ts

@@ -16,7 +16,7 @@
  * - Haiku models reject thinking field with HTTP 400
  * - Opus 4-7+ requires adaptive thinking format with output_config.effort
  *
- * Scope: Only enabled for codemie-claude agent (Claude Code via SSO proxy).
+ * Scope: Enabled for codemie-claude (Claude Code via SSO proxy) and claude-desktop (Desktop 3P mode).
  *
  * To add model support: update NO_THINKING_MODEL_PATTERNS or ADAPTIVE_THINKING_MODEL_PATTERNS.
  */

package/dist/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.js

@@ -16,7 +16,7 @@
  * - Haiku models reject thinking field with HTTP 400
  * - Opus 4-7+ requires adaptive thinking format with output_config.effort
  *
- * Scope: Only enabled for codemie-claude agent (Claude Code via SSO proxy).
+ * Scope: Enabled for codemie-claude (Claude Code via SSO proxy) and claude-desktop (Desktop 3P mode).
  *
  * To add model support: update NO_THINKING_MODEL_PATTERNS or ADAPTIVE_THINKING_MODEL_PATTERNS.
  */
@@ -94,8 +94,8 @@ function handleAdaptiveThinkingTransform(body, model) {
     }
     return true;
 }
-/** Agent that sends Claude API requests through the codemie proxy */
-const ALLOWED_AGENT = 'codemie-claude';
+/** Agents whose Claude API requests need thinking normalization */
+const ALLOWED_AGENTS = ['codemie-claude', 'claude-desktop'];
 export class ClaudeRequestNormalizerPlugin {
     id = '@codemie/proxy-claude-request-normalizer';
     name = 'Claude Request Normalizer';
@@ -103,7 +103,7 @@ export class ClaudeRequestNormalizerPlugin {
     priority = 14; // Before RequestSanitizer (15)
     async createInterceptor(context) {
         const clientType = context.config.clientType;
-        if (!clientType || clientType !== ALLOWED_AGENT) {
+        if (!clientType || !ALLOWED_AGENTS.includes(clientType)) {
             throw new Error(`Plugin disabled for agent: ${clientType}`);
         }
         // Pass the configured model as a fallback for requests that omit body.model

package/dist/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-request-normalizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD;;;GAGG;AACH,MAAM,0BAA0B,GAAa;IAC3C,qCAAqC,EAAG,iDAAiD;CAC1F,CAAC;AAEF;;;;GAIG;AACH,MAAM,gCAAgC,GAAa;IACjD,kCAAkC,EAAG,2GAA2G;CACjJ,CAAC;AAEF,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CAAC,SAAiB;IACtD,OAAO,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,YAAqB;IACjD,MAAM,MAAM,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAS,EAAE,KAAa;IACtD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACrB,MAAM,CAAC,KAAK,CAAC,8EAA8E,KAAK,EAAE,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,+BAA+B,CAAC,IAAS,EAAE,KAAa;IAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;IACzC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAErC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC;QAED,MAAM,CAAC,KAAK,CACV,qFAAqF,MAAM,gBAAgB,KAAK,EAAE,CACnH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,MAAM,CAAC,KAAK,CACV,uFAAuF,KAAK,EAAE,CAC/F,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,OAAO,6BAA6B;IACxC,EAAE,GAAG,0CAA0C,CAAC;IAChD,IAAI,GAAG,2BAA2B,CAAC;IACnC,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC,CAAC,+BAA+B;IAE9C,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,4EAA4E;QAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACzC,OAAO,IAAI,kCAAkC,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,kCAAkC;IAGT;IAF7B,IAAI,GAAG,2BAA2B,CAAC;IAEnC,YAA6B,WAAoB;QAApB,gBAAW,GAAX,WAAW,CAAS;IAAG,CAAC;IAErD,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEjC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACvF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,MAAM,QAAQ,GACZ,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC;gBACnC,+BAA+B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAE/C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACvD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"claude-request-normalizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD;;;GAGG;AACH,MAAM,0BAA0B,GAAa;IAC3C,qCAAqC,EAAG,iDAAiD;CAC1F,CAAC;AAEF;;;;GAIG;AACH,MAAM,gCAAgC,GAAa;IACjD,kCAAkC,EAAG,2GAA2G;CACjJ,CAAC;AAEF,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CAAC,SAAiB;IACtD,OAAO,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,YAAqB;IACjD,MAAM,MAAM,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAS,EAAE,KAAa;IACtD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACrB,MAAM,CAAC,KAAK,CAAC,8EAA8E,KAAK,EAAE,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,+BAA+B,CAAC,IAAS,EAAE,KAAa;IAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;IACzC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAErC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC;QAED,MAAM,CAAC,KAAK,CACV,qFAAqF,MAAM,gBAAgB,KAAK,EAAE,CACnH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,MAAM,CAAC,KAAK,CACV,uFAAuF,KAAK,EAAE,CAC/F,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,MAAM,cAAc,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;AAE5D,MAAM,OAAO,6BAA6B;IACxC,EAAE,GAAG,0CAA0C,CAAC;IAChD,IAAI,GAAG,2BAA2B,CAAC;IACnC,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC,CAAC,+BAA+B;IAE9C,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,4EAA4E;QAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACzC,OAAO,IAAI,kCAAkC,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,kCAAkC;IAGT;IAF7B,IAAI,GAAG,2BAA2B,CAAC;IAEnC,YAA6B,WAAoB;QAApB,gBAAW,GAAX,WAAW,CAAS;IAAG,CAAC;IAErD,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEjC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACvF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,MAAM,QAAQ,GACZ,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC;gBACnC,+BAA+B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAE/C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACvD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;CACF"}

package/dist/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Codex Encrypted Content Sanitizer
+ * Priority: 16 (after generic request sanitizer, before header injection)
+ *
+ * LiteLLM/Azure can reject Responses API follow-up requests when encrypted
+ * reasoning content is load-balanced to a different deployment/API key than
+ * the one that created it. Server-side encrypted_content_affinity is the
+ * correct fix. This client-side sanitizer is a defensive fallback for Codex:
+ * it removes encrypted reasoning state so the session can continue instead of
+ * failing with invalid_encrypted_content.
+ */
+import { ProxyPlugin, PluginContext, ProxyInterceptor } from './types.js';
+export declare class CodexEncryptedContentSanitizerPlugin implements ProxyPlugin {
+    id: string;
+    name: string;
+    version: string;
+    priority: number;
+    createInterceptor(context: PluginContext): Promise<ProxyInterceptor>;
+}
+//# sourceMappingURL=codex-encrypted-content-sanitizer.plugin.d.ts.map

package/dist/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-encrypted-content-sanitizer.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAa1E,qBAAa,oCAAqC,YAAW,WAAW;IACtE,EAAE,SAAsD;IACxD,IAAI,SAAuC;IAC3C,OAAO,SAAW;IAClB,QAAQ,SAAM;IAER,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQ3E"}

package/dist/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.js

@@ -0,0 +1,104 @@
+/**
+ * Codex Encrypted Content Sanitizer
+ * Priority: 16 (after generic request sanitizer, before header injection)
+ *
+ * LiteLLM/Azure can reject Responses API follow-up requests when encrypted
+ * reasoning content is load-balanced to a different deployment/API key than
+ * the one that created it. Server-side encrypted_content_affinity is the
+ * correct fix. This client-side sanitizer is a defensive fallback for Codex:
+ * it removes encrypted reasoning state so the session can continue instead of
+ * failing with invalid_encrypted_content.
+ */
+import { logger } from '../../../../../utils/logger.js';
+const ALLOWED_AGENT = 'codemie-codex';
+const ENCRYPTED_CONTENT_INCLUDE = 'reasoning.encrypted_content';
+export class CodexEncryptedContentSanitizerPlugin {
+    id = '@codemie/proxy-codex-encrypted-content-sanitizer';
+    name = 'Codex Encrypted Content Sanitizer';
+    version = '1.0.0';
+    priority = 16;
+    async createInterceptor(context) {
+        const clientType = context.config.clientType;
+        if (clientType !== ALLOWED_AGENT) {
+            throw new Error(`Plugin disabled for agent: ${clientType}`);
+        }
+        return new CodexEncryptedContentSanitizerInterceptor();
+    }
+}
+class CodexEncryptedContentSanitizerInterceptor {
+    name = 'codex-encrypted-content-sanitizer';
+    async onRequest(context) {
+        if (!context.requestBody || !context.headers['content-type']?.includes('application/json')) {
+            return;
+        }
+        try {
+            const body = JSON.parse(context.requestBody.toString('utf-8'));
+            const sanitized = sanitizeValue(body);
+            if (!sanitized.modified) {
+                return;
+            }
+            const newBodyStr = JSON.stringify(sanitized.value);
+            context.requestBody = Buffer.from(newBodyStr, 'utf-8');
+            context.headers['content-length'] = String(context.requestBody.length);
+            logger.debug(`[${this.name}] Removed encrypted reasoning content from Codex request: ${sanitized.removedCount} item(s)`);
+        }
+        catch {
+            // Not valid JSON or unexpected structure — pass through unchanged.
+        }
+    }
+}
+function sanitizeValue(value) {
+    if (Array.isArray(value)) {
+        let modified = false;
+        let removedCount = 0;
+        const sanitizedItems = [];
+        for (const item of value) {
+            if (isEncryptedReasoningItem(item)) {
+                modified = true;
+                removedCount++;
+                continue;
+            }
+            const sanitized = sanitizeValue(item);
+            modified = modified || sanitized.modified;
+            removedCount += sanitized.removedCount;
+            sanitizedItems.push(sanitized.value);
+        }
+        return { value: sanitizedItems, modified, removedCount };
+    }
+    if (!isPlainObject(value)) {
+        return { value, modified: false, removedCount: 0 };
+    }
+    let modified = false;
+    let removedCount = 0;
+    const result = {};
+    for (const [key, childValue] of Object.entries(value)) {
+        if (key === 'encrypted_content') {
+            modified = true;
+            removedCount++;
+            continue;
+        }
+        if (key === 'include' && Array.isArray(childValue)) {
+            const filteredInclude = childValue.filter(item => item !== ENCRYPTED_CONTENT_INCLUDE);
+            if (filteredInclude.length !== childValue.length) {
+                modified = true;
+                removedCount += childValue.length - filteredInclude.length;
+            }
+            result[key] = filteredInclude;
+            continue;
+        }
+        const sanitized = sanitizeValue(childValue);
+        modified = modified || sanitized.modified;
+        removedCount += sanitized.removedCount;
+        result[key] = sanitized.value;
+    }
+    return { value: result, modified, removedCount };
+}
+function isEncryptedReasoningItem(value) {
+    return isPlainObject(value) &&
+        value.type === 'reasoning' &&
+        typeof value.encrypted_content === 'string';
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=codex-encrypted-content-sanitizer.plugin.js.map

package/dist/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-encrypted-content-sanitizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-encrypted-content-sanitizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAQhE,MAAM,OAAO,oCAAoC;IAC/C,EAAE,GAAG,kDAAkD,CAAC;IACxD,IAAI,GAAG,mCAAmC,CAAC;IAC3C,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,yCAAyC,EAAE,CAAC;IACzD,CAAC;CACF;AAED,MAAM,yCAAyC;IAC7C,IAAI,GAAG,mCAAmC,CAAC;IAE3C,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAY,CAAC;YAC1E,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAEtC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAEvE,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,6DAA6D,SAAS,CAAC,YAAY,UAAU,CAC3G,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,cAAc,GAAc,EAAE,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACtC,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;YAC1C,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC;YACvC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;YAChC,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;YACtF,IAAI,eAAe,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACjD,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,IAAI,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAC5C,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;QAC1C,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;IAChC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,aAAa,CAAC,KAAK,CAAC;QACzB,KAAK,CAAC,IAAI,KAAK,WAAW;QAC1B,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/gateway-key.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-key.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/gateway-key.plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAK/E,qBAAa,gBAAiB,YAAW,WAAW;IAClD,EAAE,SAAgC;IAClC,IAAI,SAAsB;IAC1B,OAAO,SAAW;IAClB,QAAQ,SAAK;IAEb,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,gBAAgB;CAoC5D"}
+{"version":3,"file":"gateway-key.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/gateway-key.plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAM/E,qBAAa,gBAAiB,YAAW,WAAW;IAClD,EAAE,SAAgC;IAClC,IAAI,SAAsB;IAC1B,OAAO,SAAW;IAClB,QAAQ,SAAK;IAEb,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,gBAAgB;CAqE5D"}

package/dist/providers/plugins/sso/proxy/plugins/gateway-key.plugin.js

@@ -1,4 +1,5 @@
 import { logger } from '../../../../../utils/logger.js';
+import { sanitizeLogArgs } from '../../../../../utils/security.js';
 export class GatewayKeyPlugin {
     id = '@codemie/proxy-gateway-key';
     name = 'Gateway Key Auth';
@@ -6,6 +7,10 @@ export class GatewayKeyPlugin {
     priority = 7;
     createInterceptor(context) {
         const gatewayKey = context.config.gatewayKey;
+        logger.info('[gateway-key] Initializing gateway auth interceptor', ...sanitizeLogArgs({
+            enabled: Boolean(gatewayKey),
+            configuredGatewayKey: gatewayKey,
+        }));
         return {
             name: this.name,
             async handleRequest(ctx, _req, res, _httpClient) {
@@ -13,10 +18,22 @@ export class GatewayKeyPlugin {
                     return false;
                 if (ctx.metadata.gatewayKeyValidated)
                     return false;
-                const authHeader = ctx.headers['authorization'];
+                const authHeader = ctx.headers['authorization'] ?? ctx.headers['Authorization'];
                 const expected = `Bearer ${gatewayKey}`;
+                logger.info('[gateway-key] Validating incoming gateway authorization header', ...sanitizeLogArgs({
+                    url: ctx.url,
+                    hasAuthorizationHeader: Boolean(authHeader),
+                    authorizationHeader: authHeader,
+                    expectedAuthorizationHeader: expected,
+                    headerKeys: Object.keys(ctx.headers),
+                }));
                 if (!authHeader || authHeader !== expected) {
-                    logger.debug('[gateway-key] Rejected: invalid or missing gateway key');
+                    logger.warn('[gateway-key] Rejected request: invalid or missing gateway key', ...sanitizeLogArgs({
+                        url: ctx.url,
+                        hasAuthorizationHeader: Boolean(authHeader),
+                        authorizationHeader: authHeader,
+                        expectedAuthorizationHeader: expected,
+                    }));
                     res.statusCode = 401;
                     res.setHeader('Content-Type', 'application/json');
                     res.end(JSON.stringify({
@@ -26,8 +43,12 @@ export class GatewayKeyPlugin {
                     return true;
                 }
                 delete ctx.headers['authorization'];
+                delete ctx.headers['Authorization'];
                 ctx.metadata.gatewayKeyValidated = true;
-                logger.debug('[gateway-key] Gateway key validated, authorization header stripped');
+                logger.info('[gateway-key] Gateway key validated and authorization header stripped', ...sanitizeLogArgs({
+                    url: ctx.url,
+                    remainingHeaderKeys: Object.keys(ctx.headers),
+                }));
                 return false;
             },
         };

package/dist/providers/plugins/sso/proxy/plugins/gateway-key.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-key.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/gateway-key.plugin.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,OAAO,gBAAgB;IAC3B,EAAE,GAAG,4BAA4B,CAAC;IAClC,IAAI,GAAG,kBAAkB,CAAC;IAC1B,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,CAAC,CAAC;IAEb,iBAAiB,CAAC,OAAsB;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAE7C,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YAEf,KAAK,CAAC,aAAa,CACjB,GAAiB,EACjB,IAAqB,EACrB,GAAmB,EACnB,WAA4B;gBAE5B,IAAI,CAAC,UAAU;oBAAE,OAAO,KAAK,CAAC;gBAC9B,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB;oBAAE,OAAO,KAAK,CAAC;gBAEnD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBAChD,MAAM,QAAQ,GAAG,UAAU,UAAU,EAAE,CAAC;gBAExC,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;oBAC3C,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;oBACvE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBACpE,CAAC,CAAC,CAAC;oBACJ,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACpC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,GAAG,IAAI,CAAC;gBACxC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBACnF,OAAO,KAAK,CAAC;YACf,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"gateway-key.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/gateway-key.plugin.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,MAAM,OAAO,gBAAgB;IAC3B,EAAE,GAAG,4BAA4B,CAAC;IAClC,IAAI,GAAG,kBAAkB,CAAC;IAC1B,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,CAAC,CAAC;IAEb,iBAAiB,CAAC,OAAsB;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,MAAM,CAAC,IAAI,CACT,qDAAqD,EACrD,GAAG,eAAe,CAAC;YACjB,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC;YAC5B,oBAAoB,EAAE,UAAU;SACjC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YAEf,KAAK,CAAC,aAAa,CACjB,GAAiB,EACjB,IAAqB,EACrB,GAAmB,EACnB,WAA4B;gBAE5B,IAAI,CAAC,UAAU;oBAAE,OAAO,KAAK,CAAC;gBAC9B,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB;oBAAE,OAAO,KAAK,CAAC;gBAEnD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBAChF,MAAM,QAAQ,GAAG,UAAU,UAAU,EAAE,CAAC;gBAExC,MAAM,CAAC,IAAI,CACT,gEAAgE,EAChE,GAAG,eAAe,CAAC;oBACjB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,sBAAsB,EAAE,OAAO,CAAC,UAAU,CAAC;oBAC3C,mBAAmB,EAAE,UAAU;oBAC/B,2BAA2B,EAAE,QAAQ;oBACrC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;iBACrC,CAAC,CACH,CAAC;gBAEF,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;oBAC3C,MAAM,CAAC,IAAI,CACT,gEAAgE,EAChE,GAAG,eAAe,CAAC;wBACjB,GAAG,EAAE,GAAG,CAAC,GAAG;wBACZ,sBAAsB,EAAE,OAAO,CAAC,UAAU,CAAC;wBAC3C,mBAAmB,EAAE,UAAU;wBAC/B,2BAA2B,EAAE,QAAQ;qBACtC,CAAC,CACH,CAAC;oBACF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;oBAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;wBACrB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBACpE,CAAC,CAAC,CAAC;oBACJ,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACpC,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBACpC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,GAAG,IAAI,CAAC;gBACxC,MAAM,CAAC,IAAI,CACT,uEAAuE,EACvE,GAAG,eAAe,CAAC;oBACjB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;iBAC9C,CAAC,CACH,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/providers/plugins/sso/proxy/plugins/header-injection.plugin.js

@@ -26,6 +26,11 @@ class HeaderInjectionInterceptor {
         // Request and session ID headers
         context.headers['X-CodeMie-Request-ID'] = context.requestId;
         context.headers['X-CodeMie-Session-ID'] = context.sessionId;
+        // LiteLLM can use these headers for Responses API session affinity when
+        // its router is configured with session-aware pre-call checks.
+        if (this.context.config.clientType === 'codemie-codex') {
+            context.headers['x-litellm-session-id'] = context.sessionId;
+        }
         // Add CLI version header
         const cliVersion = this.context.config.version || '0.0.0';
         context.headers['X-CodeMie-CLI'] = `codemie-cli/${cliVersion}`;

package/dist/providers/plugins/sso/proxy/plugins/header-injection.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"header-injection.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/header-injection.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,OAAO,qBAAqB;IAChC,EAAE,GAAG,wBAAwB,CAAC;IAC9B,IAAI,GAAG,kBAAkB,CAAC;IAC1B,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;CACF;AAED,MAAM,0BAA0B;IAGV;IAFpB,IAAI,GAAG,kBAAkB,CAAC;IAE1B,YAAoB,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAE9C,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,iCAAiC;QACjC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5D,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAE5D,yBAAyB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;QAC1D,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,UAAU,EAAE,CAAC;QAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,gDAAgD;QAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,QAAQ,EAAE,gBAAgB,EAAE,mBAAmB,KAAK,IAAI,CAAC;QAErF,uDAAuD;QACvD,IAAI,mBAAmB,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAChD,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;QAClE,CAAC;QAED,qDAAqD;QACrD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACxD,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;QAED,6CAA6C;QAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACxD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;IAC1D,CAAC;CACF"}
+{"version":3,"file":"header-injection.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/header-injection.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,OAAO,qBAAqB;IAChC,EAAE,GAAG,wBAAwB,CAAC;IAC9B,IAAI,GAAG,kBAAkB,CAAC;IAC1B,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;CACF;AAED,MAAM,0BAA0B;IAGV;IAFpB,IAAI,GAAG,kBAAkB,CAAC;IAE1B,YAAoB,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAE9C,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,iCAAiC;QACjC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5D,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAE5D,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YACvD,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9D,CAAC;QAED,yBAAyB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;QAC1D,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,UAAU,EAAE,CAAC;QAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,gDAAgD;QAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,QAAQ,EAAE,gBAAgB,EAAE,mBAAmB,KAAK,IAAI,CAAC;QAErF,uDAAuD;QACvD,IAAI,mBAAmB,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAChD,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;QAClE,CAAC;QAED,qDAAqD;QACrD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACxD,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;QAED,6CAA6C;QAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACxD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/providers/plugins/sso/proxy/plugins/index.d.ts

@@ -6,18 +6,20 @@
  */
 import { MCPAuthPlugin } from "./mcp-auth.plugin.js";
 import { EndpointBlockerPlugin } from "./endpoint-blocker.plugin.js";
+import { GatewayKeyPlugin } from "./gateway-key.plugin.js";
 import { SSOAuthPlugin } from "./sso-auth.plugin.js";
 import { JWTAuthPlugin } from "./jwt-auth.plugin.js";
 import { HeaderInjectionPlugin } from "./header-injection.plugin.js";
 import { RequestSanitizerPlugin } from "./request-sanitizer.plugin.js";
 import { ClaudeRequestNormalizerPlugin } from "./claude-request-normalizer.plugin.js";
+import { CodexEncryptedContentSanitizerPlugin } from "./codex-encrypted-content-sanitizer.plugin.js";
 import { LoggingPlugin } from "./logging.plugin.js";
 /**
  * Register core plugins
  * Called at app startup
  */
 export declare function registerCorePlugins(): void;
-export { MCPAuthPlugin, EndpointBlockerPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, LoggingPlugin, };
+export { MCPAuthPlugin, EndpointBlockerPlugin, GatewayKeyPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, CodexEncryptedContentSanitizerPlugin, LoggingPlugin, };
 export { SSOSessionSyncPlugin } from "./sso.session-sync.plugin.js";
 export { getPluginRegistry, resetPluginRegistry } from "./registry.js";
 export * from "./types.js";

package/dist/providers/plugins/sso/proxy/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAa1C;AAMD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAe1C;AAMD,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,oCAAoC,EACpC,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/index.js

@@ -7,11 +7,13 @@
 import { getPluginRegistry } from "./registry.js";
 import { MCPAuthPlugin } from "./mcp-auth.plugin.js";
 import { EndpointBlockerPlugin } from "./endpoint-blocker.plugin.js";
+import { GatewayKeyPlugin } from "./gateway-key.plugin.js";
 import { SSOAuthPlugin } from "./sso-auth.plugin.js";
 import { JWTAuthPlugin } from "./jwt-auth.plugin.js";
 import { HeaderInjectionPlugin } from "./header-injection.plugin.js";
 import { RequestSanitizerPlugin } from "./request-sanitizer.plugin.js";
 import { ClaudeRequestNormalizerPlugin } from "./claude-request-normalizer.plugin.js";
+import { CodexEncryptedContentSanitizerPlugin } from "./codex-encrypted-content-sanitizer.plugin.js";
 import { LoggingPlugin } from "./logging.plugin.js";
 import { SSOSessionSyncPlugin } from "./sso.session-sync.plugin.js";
 /**
@@ -23,10 +25,12 @@ export function registerCorePlugins() {
     // Register in any order (priority determines execution order)
     registry.register(new MCPAuthPlugin()); // Priority 3 - MCP auth relay routing
     registry.register(new EndpointBlockerPlugin()); // Priority 5 - blocks unwanted endpoints early
+    registry.register(new GatewayKeyPlugin()); // Priority 7 - validates local gateway auth, strips header before upstream
     registry.register(new SSOAuthPlugin());
     registry.register(new JWTAuthPlugin());
     registry.register(new ClaudeRequestNormalizerPlugin()); // Priority 14 - normalizes thinking params for claude models
     registry.register(new RequestSanitizerPlugin()); // Priority 15 - strips unsupported reasoning params
+    registry.register(new CodexEncryptedContentSanitizerPlugin()); // Priority 16 - strips encrypted reasoning state for Codex
     registry.register(new HeaderInjectionPlugin());
     registry.register(new LoggingPlugin()); // Always enabled - logs to log files at INFO level
     registry.register(new SSOSessionSyncPlugin()); // Priority 100 - syncs sessions via multiple processors
@@ -34,7 +38,7 @@ export function registerCorePlugins() {
 // Auto-register on import
 registerCorePlugins();
 // Re-export for convenience
-export { MCPAuthPlugin, EndpointBlockerPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, LoggingPlugin, };
+export { MCPAuthPlugin, EndpointBlockerPlugin, GatewayKeyPlugin, SSOAuthPlugin, JWTAuthPlugin, HeaderInjectionPlugin, RequestSanitizerPlugin, ClaudeRequestNormalizerPlugin, CodexEncryptedContentSanitizerPlugin, LoggingPlugin, };
 export { SSOSessionSyncPlugin } from "./sso.session-sync.plugin.js";
 export { getPluginRegistry, resetPluginRegistry } from "./registry.js";
 export * from "./types.js";

package/dist/providers/plugins/sso/proxy/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,sCAAsC;IAC9E,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC,+CAA+C;IAC/F,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,6DAA6D;IACrH,QAAQ,CAAC,QAAQ,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,oDAAoD;IACrG,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,mDAAmD;IAC3F,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,wDAAwD;AACzG,CAAC;AAED,0BAA0B;AAC1B,mBAAmB,EAAE,CAAC;AAEtB,4BAA4B;AAC5B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,oCAAoC,EAAE,MAAM,+CAA+C,CAAC;AACrG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,sCAAsC;IAC9E,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC,+CAA+C;IAC/F,QAAQ,CAAC,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,2EAA2E;IACtH,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,IAAI,6BAA6B,EAAE,CAAC,CAAC,CAAC,6DAA6D;IACrH,QAAQ,CAAC,QAAQ,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,oDAAoD;IACrG,QAAQ,CAAC,QAAQ,CAAC,IAAI,oCAAoC,EAAE,CAAC,CAAC,CAAC,2DAA2D;IAC1H,QAAQ,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,mDAAmD;IAC3F,QAAQ,CAAC,QAAQ,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,wDAAwD;AACzG,CAAC;AAED,0BAA0B;AAC1B,mBAAmB,EAAE,CAAC;AAEtB,4BAA4B;AAC5B,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,oCAAoC,EACpC,aAAa,GACd,CAAC;AACF,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvE,cAAc,YAAY,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/logging.plugin.js

@@ -44,9 +44,10 @@ class LoggingInterceptor {
             this.responseContentType = null;
             // Get request content type
             const contentType = context.headers['content-type'] || context.headers['Content-Type'] || 'unknown';
+            const isSessionSyncEndpoint = this.isSessionSyncEndpoint(context.url);
             // Parse request body based on content type
             let requestBodyParsed = null;
-            if (context.requestBody) {
+            if (context.requestBody && !isSessionSyncEndpoint) {
                 try {
                     const bodyString = context.requestBody.toString('utf-8');
                     if (contentType.includes('application/json')) {
@@ -73,7 +74,7 @@ class LoggingInterceptor {
                 contentType,
                 bodySize: context.requestBody?.length || 0,
                 headers: this.sanitizeHeaders(context.headers),
-                requestBody: requestBodyParsed
+                requestBody: isSessionSyncEndpoint ? '[omitted: session sync payload]' : requestBodyParsed
             });
         }
         catch (error) {
@@ -135,6 +136,7 @@ class LoggingInterceptor {
             const chunkCount = this.chunkCount;
             const totalBytes = this.totalBytes;
             const contentType = this.responseContentType || 'unknown';
+            const isSessionSyncEndpoint = this.isSessionSyncEndpoint(context.url);
             // CRITICAL: Clear state immediately for next request
             this.responseChunks = [];
             this.chunkCount = 0;
@@ -146,7 +148,7 @@ class LoggingInterceptor {
                 try {
                     let responseBodyParsed = null;
                     let isStreaming = false;
-                    if (chunksToLog.length > 0) {
+                    if (chunksToLog.length > 0 && !isSessionSyncEndpoint) {
                         const fullBody = Buffer.concat(chunksToLog).toString('utf-8');
                         // Check if this is a streaming response (SSE)
                         isStreaming = contentType.includes('text/event-stream') || fullBody.startsWith('event:');
@@ -196,6 +198,7 @@ class LoggingInterceptor {
                         totalChunks: chunkCount,
                         totalBytesStreamed: totalBytes,
                         responseBody: responseBodyParsed
+                            ?? (isSessionSyncEndpoint ? '[omitted: session sync payload]' : null)
                     });
                     // Log completion marker to track if we reach this point
                     logger.debug(`[proxy-complete] Request fully processed for ${context.url}`, {
@@ -252,5 +255,9 @@ class LoggingInterceptor {
         }
         return filtered;
     }
+    isSessionSyncEndpoint(url) {
+        return /^\/v1\/metrics(?:[/?#]|$)/i.test(url) ||
+            /^\/v1\/conversations(?:[/?#]|$)/i.test(url);
+    }
 }
 //# sourceMappingURL=logging.plugin.js.map