@codemieai/code 0.14.1 → 0.15.0

package/dist/providers/plugins/ollama/ollama.template.js

@@ -17,15 +17,66 @@ export const OllamaTemplate = registerProvider({
     authType: 'none',
     recommendedModels: [
         'qwen2.5-coder',
-        'qwen3-vl:235b-cloud',
-        'deepseek-coder-v2',
-        'deepseek-v3.1:671b-cloud'
+        'gpt-oss:120b-cloud',
+        'deepseek-coder-v2'
     ],
+    modelMetadata: {
+        'qwen2.5-coder': {
+            name: 'Qwen 2.5 Coder',
+            description: 'Excellent coding model with tool support (7B, ~5GB download)',
+            popular: true,
+            minMemoryGb: 8
+        },
+        'gpt-oss:120b-cloud': {
+            name: 'GPT-OSS 120B (cloud)',
+            description: 'OpenAI open-weight model on Ollama cloud - no local memory required',
+            popular: true
+            // No minMemoryGb: runs on ollama.com, not on the local machine
+        },
+        'deepseek-coder-v2': {
+            name: 'DeepSeek Coder V2',
+            description: 'Advanced coding model with tool support (16B, ~9GB download)',
+            popular: true,
+            minMemoryGb: 12
+        }
+    },
     capabilities: ['streaming', 'tools', 'embeddings', 'model-management'],
     supportsModelInstallation: true,
     healthCheckEndpoint: '/api/version',
     // Agent lifecycle hooks
-    agentHooks: {},
+    agentHooks: {
+        // Wildcard hook: adjust env for ALL agents when running against Ollama.
+        // Chained before each agent's own default hooks (see resolveHook).
+        '*': {
+            beforeRun: async (env, config) => {
+                // Claude Code speaks the Anthropic Messages API, which Ollama serves
+                // at the host root (https://docs.ollama.com/api/anthropic-compatibility),
+                // while the profile baseUrl carries the OpenAI-compatible /v1 suffix.
+                if (env.ANTHROPIC_BASE_URL) {
+                    env.ANTHROPIC_BASE_URL = env.ANTHROPIC_BASE_URL.replace(/\/v1\/?$/, '');
+                    // Ollama ignores the token but Claude Code requires it to be set.
+                    // A real ollama.com API key is used when configured (cloud access).
+                    env.ANTHROPIC_AUTH_TOKEN =
+                        config.apiKey && config.apiKey !== 'not-required' ? config.apiKey : 'ollama';
+                    // Model tiers: ollama model names never match the haiku/sonnet/opus
+                    // auto-selection, so route every tier to the selected model instead
+                    // of letting Claude Code fall back to its built-in claude-* defaults.
+                    if (env.CODEMIE_MODEL) {
+                        if (!env.ANTHROPIC_DEFAULT_HAIKU_MODEL) {
+                            env.ANTHROPIC_DEFAULT_HAIKU_MODEL = env.CODEMIE_MODEL;
+                        }
+                        if (!env.ANTHROPIC_DEFAULT_SONNET_MODEL) {
+                            env.ANTHROPIC_DEFAULT_SONNET_MODEL = env.CODEMIE_MODEL;
+                        }
+                        if (!env.ANTHROPIC_DEFAULT_OPUS_MODEL) {
+                            env.ANTHROPIC_DEFAULT_OPUS_MODEL = env.CODEMIE_MODEL;
+                        }
+                    }
+                }
+                return env;
+            }
+        }
+    },
     setupInstructions: `
 # Ollama Setup Instructions
 
@@ -47,12 +98,21 @@ Download from: https://ollama.com/download
 **Important**: Some agents require models with function calling/tool support.
 
 - **qwen2.5-coder**: Excellent for coding tasks with tool support (7B, ~5GB)
-- **qwen3-vl:235b-cloud**: Latest Qwen with vision and tool support (235B)
+- **gpt-oss:120b-cloud**: OpenAI's open-weight model via Ollama cloud (120B, no download)
 - **deepseek-coder-v2**: Advanced coding model with tool support (16B, ~9GB)
-- **deepseek-v3.1:671b-cloud**: Latest DeepSeek with advanced reasoning (671B)
 
 **Note**: Models without tool support (like codellama) will fail with agents that require function calling.
 
+## Ollama Cloud (ollama.com)
+
+Signed in locally via \`ollama signin\`? The local daemon authenticates cloud
+models automatically - no extra configuration needed to *run* \`-cloud\` models.
+The cloud model catalog is listed automatically during setup (public endpoint).
+
+An optional API key from https://ollama.com/settings/keys additionally enables:
+- Running cloud models directly on ollama.com (no local daemon required)
+- Ollama's web search / web fetch API
+
 ## Documentation
 
 - Official website: https://ollama.com

package/dist/providers/plugins/ollama/ollama.template.js.map

@@ -1 +1 @@
-{"version":3,"file":"ollama.template.js","sourceRoot":"","sources":["../../../../src/providers/plugins/ollama/ollama.template.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAmB;IAC/D,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,QAAQ;IACrB,WAAW,EAAE,2EAA2E;IACxF,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,wBAAwB;IACxC,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,MAAM;IAChB,iBAAiB,EAAE;QACjB,eAAe;QACf,qBAAqB;QACrB,mBAAmB;QACnB,0BAA0B;KAC3B;IACD,YAAY,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,kBAAkB,CAAC;IACtE,yBAAyB,EAAE,IAAI;IAC/B,mBAAmB,EAAE,cAAc;IAEnC,wBAAwB;IACxB,UAAU,EAAE,EAAE;IAEd,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCpB;CACA,CAAC,CAAC"}
+{"version":3,"file":"ollama.template.js","sourceRoot":"","sources":["../../../../src/providers/plugins/ollama/ollama.template.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAmB;IAC/D,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,QAAQ;IACrB,WAAW,EAAE,2EAA2E;IACxF,WAAW,EAAE,KAAK;IAClB,cAAc,EAAE,wBAAwB;IACxC,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,MAAM;IAChB,iBAAiB,EAAE;QACjB,eAAe;QACf,oBAAoB;QACpB,mBAAmB;KACpB;IACD,aAAa,EAAE;QACb,eAAe,EAAE;YACf,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,8DAA8D;YAC3E,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,CAAC;SACf;QACD,oBAAoB,EAAE;YACpB,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,qEAAqE;YAClF,OAAO,EAAE,IAAI;YACb,+DAA+D;SAChE;QACD,mBAAmB,EAAE;YACnB,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,8DAA8D;YAC3E,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,EAAE;SAChB;KACF;IACD,YAAY,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,kBAAkB,CAAC;IACtE,yBAAyB,EAAE,IAAI;IAC/B,mBAAmB,EAAE,cAAc;IAEnC,wBAAwB;IACxB,UAAU,EAAE;QACV,wEAAwE;QACxE,mEAAmE;QACnE,GAAG,EAAE;YACH,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;gBAC/B,qEAAqE;gBACrE,0EAA0E;gBAC1E,sEAAsE;gBACtE,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC3B,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;oBAExE,kEAAkE;oBAClE,oEAAoE;oBACpE,GAAG,CAAC,oBAAoB;wBACtB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAE/E,oEAAoE;oBACpE,oEAAoE;oBACpE,sEAAsE;oBACtE,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;wBACtB,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE,CAAC;4BACvC,GAAG,CAAC,6BAA6B,GAAG,GAAG,CAAC,aAAa,CAAC;wBACxD,CAAC;wBACD,IAAI,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC;4BACxC,GAAG,CAAC,8BAA8B,GAAG,GAAG,CAAC,aAAa,CAAC;wBACzD,CAAC;wBACD,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,CAAC;4BACtC,GAAG,CAAC,4BAA4B,GAAG,GAAG,CAAC,aAAa,CAAC;wBACvD,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,OAAO,GAAG,CAAC;YACb,CAAC;SACF;KACF;IAED,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCpB;CACA,CAAC,CAAC"}

package/dist/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.d.ts

@@ -1,29 +1,7 @@
 /**
- * Claude Request Normalizer Plugin
- * Priority: 14 (runs before RequestSanitizer at 15)
- *
- * Normalizes Claude API requests to match model-specific requirements.
- * Handles thinking parameter variations across Claude model versions:
- *
- * 1. Models that DO NOT support thinking (e.g. claude-haiku-4-5, 4-6):
- *    → strips the thinking field entirely to prevent API errors
- *
- * 2. Models that require adaptive thinking API (e.g. claude-opus-4-7+, claude-sonnet-5):
- *    → "enabled"  → thinking: { type: "adaptive" } + output_config.effort
- *    → "disabled" → either preserve or delete the field depending on model support
- *
- * 3. Models that deprecate sampling parameters (e.g. claude-sonnet-5):
- *    → strips temperature / top_p / top_k entirely to prevent API errors
- *
- * Problem: Claude Code sends `thinking: { type: "enabled", budget_tokens: N }`.
- * - Haiku models reject thinking field with HTTP 400
- * - Opus 4-7+ requires adaptive thinking format with output_config.effort
- * - Sonnet 5 rejects manual extended thinking and sampling parameters
- *
- * Scope: Enabled for codemie-claude (Claude Code via SSO proxy), codemie-copilot
- * (GitHub Copilot CLI via BYOK Anthropic shape), and claude-desktop (Desktop 3P mode).
- *
- * To add model support: update NO_THINKING_MODEL_PATTERNS or ADAPTIVE_THINKING_MODEL_PATTERNS.
+ * Normalizes Claude API requests per model. Every model-specific decision reads
+ * from MODEL_CAPABILITY_TABLE; add/edit a row to change support. Priority 14
+ * (before RequestSanitizer at 15). See EPMCDME-14035.
  */
 import { ProxyPlugin, PluginContext, ProxyInterceptor } from './types.js';
 export declare class ClaudeRequestNormalizerPlugin implements ProxyPlugin {

package/dist/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-request-normalizer.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAqI1E,qBAAa,6BAA8B,YAAW,WAAW;IAC/D,EAAE,SAA8C;IAChD,IAAI,SAA+B;IACnC,OAAO,SAAW;IAClB,QAAQ,SAAM;IAER,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAS3E"}
+{"version":3,"file":"claude-request-normalizer.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA8J1E,qBAAa,6BAA8B,YAAW,WAAW;IAC/D,EAAE,SAA8C;IAChD,IAAI,SAA+B;IACnC,OAAO,SAAW;IAClB,QAAQ,SAAM;IAER,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQ3E"}

package/dist/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.js

@@ -1,65 +1,44 @@
 /**
- * Claude Request Normalizer Plugin
- * Priority: 14 (runs before RequestSanitizer at 15)
- *
- * Normalizes Claude API requests to match model-specific requirements.
- * Handles thinking parameter variations across Claude model versions:
- *
- * 1. Models that DO NOT support thinking (e.g. claude-haiku-4-5, 4-6):
- *    → strips the thinking field entirely to prevent API errors
- *
- * 2. Models that require adaptive thinking API (e.g. claude-opus-4-7+, claude-sonnet-5):
- *    → "enabled"  → thinking: { type: "adaptive" } + output_config.effort
- *    → "disabled" → either preserve or delete the field depending on model support
- *
- * 3. Models that deprecate sampling parameters (e.g. claude-sonnet-5):
- *    → strips temperature / top_p / top_k entirely to prevent API errors
- *
- * Problem: Claude Code sends `thinking: { type: "enabled", budget_tokens: N }`.
- * - Haiku models reject thinking field with HTTP 400
- * - Opus 4-7+ requires adaptive thinking format with output_config.effort
- * - Sonnet 5 rejects manual extended thinking and sampling parameters
- *
- * Scope: Enabled for codemie-claude (Claude Code via SSO proxy), codemie-copilot
- * (GitHub Copilot CLI via BYOK Anthropic shape), and claude-desktop (Desktop 3P mode).
- *
- * To add model support: update NO_THINKING_MODEL_PATTERNS or ADAPTIVE_THINKING_MODEL_PATTERNS.
+ * Normalizes Claude API requests per model. Every model-specific decision reads
+ * from MODEL_CAPABILITY_TABLE; add/edit a row to change support. Priority 14
+ * (before RequestSanitizer at 15). See EPMCDME-14035.
  */
 import { logger } from '../../../../../utils/logger.js';
-/**
- * Model name patterns that DO NOT support thinking at all.
- * Matches claude-haiku-3-5, 4-5, and date-tagged variants (e.g. claude-haiku-4-5-20251001).
- */
-const NO_THINKING_MODEL_PATTERNS = [
-    /claude-haiku-(3-5|4-5)(?:[^0-9]|$)/i, // claude-haiku-3-5, 4-5 and date-tagged variants
-];
-/**
- * Model name patterns that require the adaptive thinking API.
- * Matches claude-opus-4-7, claude-opus-4-7-20250514, and future date-tagged variants.
- * Extend this list as Anthropic migrates additional models — see EPMCDME-11821.
- */
-const ADAPTIVE_THINKING_MODEL_PATTERNS = [
-    /claude-opus-4-[7-9](?:[^0-9]|$)/i, // claude-opus-4-7/8/9 and date-tagged variants (e.g. claude-opus-4-7-20250514); excludes claude-opus-4-70+
-    /claude-sonnet-5(?:[^0-9]|$)/i, // claude-sonnet-5 and date-tagged variants
+// Applied when no MODEL_CAPABILITY_TABLE row matches.
+const DEFAULT_CAPABILITIES = {
+    thinking: 'standard',
+    effort: false,
+    sampling: true,
+    preserveDisabledThinking: false,
+};
+// Pattern → capabilities, first match wins. The `(?:[^0-9]|$)` after each version
+// stops `4-7` from matching `4-70`. See EPMCDME-11821 / EPMCDME-14035.
+const MODEL_CAPABILITY_TABLE = [
+    {
+        // claude-haiku-3-5 / 4-5 (+ date-tagged): no extended thinking at all.
+        pattern: /claude-haiku-(3-5|4-5)(?:[^0-9]|$)/i,
+        capabilities: { thinking: 'none', effort: false, sampling: true, preserveDisabledThinking: false },
+    },
+    {
+        // claude-opus-4-7/8/9 (+ date-tagged; excludes 4-70+): adaptive thinking + effort.
+        pattern: /claude-opus-4-[7-9](?:[^0-9]|$)/i,
+        capabilities: { thinking: 'adaptive', effort: true, sampling: true, preserveDisabledThinking: false },
+    },
+    {
+        // claude-sonnet-5 (+ date-tagged): adaptive thinking + effort; rejects manual
+        // sampling params; keeps thinking.type="disabled".
+        pattern: /claude-sonnet-5(?:[^0-9]|$)/i,
+        capabilities: { thinking: 'adaptive', effort: true, sampling: false, preserveDisabledThinking: true },
+    },
 ];
-function modelDisablesThinking(modelName) {
-    return NO_THINKING_MODEL_PATTERNS.some(p => p.test(modelName));
-}
-function modelRequiresAdaptiveThinking(modelName) {
-    return ADAPTIVE_THINKING_MODEL_PATTERNS.some(p => p.test(modelName));
-}
-function modelPreservesDisabledThinking(modelName) {
-    return /claude-sonnet-5(?:[^0-9]|$)/i.test(modelName);
-}
-function modelDisablesSamplingParameters(modelName) {
-    return /claude-sonnet-5(?:[^0-9]|$)/i.test(modelName);
+function capabilitiesFor(model) {
+    for (const entry of MODEL_CAPABILITY_TABLE) {
+        if (entry.pattern.test(model))
+            return entry.capabilities;
+    }
+    return DEFAULT_CAPABILITIES;
 }
-/**
- * Map legacy budget_tokens to the closest output_config.effort level.
- *
- * budget_tokens was the maximum token budget for thinking in the old API.
- * effort is a coarser control in the new API: low / medium / high.
- */
+// Map legacy budget_tokens to the coarser new-API effort level.
 function budgetTokensToEffort(budgetTokens) {
     const tokens = typeof budgetTokens === 'number' ? budgetTokens : 0;
     if (tokens <= 2048)
@@ -68,50 +47,66 @@ function budgetTokensToEffort(budgetTokens) {
         return 'medium';
     return 'high';
 }
-/**
- * Handler: strips thinking field for models that don't support it.
- * Returns true if thinking was stripped (early exit), false to continue chain.
- */
-function handleNoThinkingModels(body, model) {
-    if (!modelDisablesThinking(model)) {
-        return false;
-    }
-    delete body.thinking;
-    logger.debug(`[claude-request-normalizer] Stripped thinking field for unsupported model: ${model}`);
-    return true;
-}
-/**
- * Handler: transforms thinking.type "enabled"/"disabled" to adaptive API format.
- * Returns true if transformation applied, false if nothing changed.
- */
-function handleAdaptiveThinkingTransform(body, model) {
-    const thinkingType = body.thinking?.type;
-    if (thinkingType !== 'enabled' && thinkingType !== 'disabled') {
-        return false;
-    }
-    if (!modelRequiresAdaptiveThinking(model)) {
-        return false;
+// Normalize the thinking field per caps.thinking. Called only when body.thinking is set.
+function handleThinkingField(body, caps, model) {
+    if (caps.thinking === 'none') {
+        delete body.thinking;
+        logger.debug(`[claude-request-normalizer] Stripped thinking field for unsupported model: ${model}`);
+        return true;
     }
-    if (thinkingType === 'enabled') {
-        const effort = budgetTokensToEffort(body.thinking.budget_tokens);
-        body.thinking = { type: 'adaptive' };
-        if (!body.output_config?.effort) {
-            body.output_config = { ...(body.output_config ?? {}), effort };
+    if (caps.thinking === 'adaptive') {
+        const thinkingType = body.thinking?.type;
+        if (thinkingType !== 'enabled' && thinkingType !== 'disabled') {
+            return false;
         }
-        logger.debug(`[claude-request-normalizer] Transformed thinking: "enabled" → "adaptive", effort="${effort}" for model: ${model}`);
-    }
-    else {
-        if (modelPreservesDisabledThinking(model)) {
+        if (thinkingType === 'enabled') {
+            const effort = budgetTokensToEffort(body.thinking.budget_tokens);
+            body.thinking = { type: 'adaptive' };
+            if (!body.output_config?.effort) {
+                body.output_config = { ...(body.output_config ?? {}), effort };
+            }
+            logger.debug(`[claude-request-normalizer] Transformed thinking: "enabled" → "adaptive", effort="${effort}" for model: ${model}`);
+            return true;
+        }
+        // thinkingType === 'disabled'
+        if (caps.preserveDisabledThinking) {
             logger.debug(`[claude-request-normalizer] Preserved thinking.type="disabled" for model: ${model}`);
             return false;
         }
         delete body.thinking;
         logger.debug(`[claude-request-normalizer] Removed unsupported thinking.type="disabled" for model: ${model}`);
+        return true;
     }
-    return true;
+    // 'standard' — leave the thinking field untouched.
+    return false;
+}
+// Strip effort for models that reject it: Claude Code's --effort flag becomes
+// output_config.effort (or top-level effort) and 400s on e.g. claude-4-5-sonnet.
+function handleUnsupportedEffort(body, caps, model) {
+    if (caps.effort) {
+        return false;
+    }
+    let stripped = false;
+    const outputConfig = body.output_config;
+    if (outputConfig && typeof outputConfig === 'object' && 'effort' in outputConfig) {
+        delete outputConfig.effort;
+        stripped = true;
+        if (Object.keys(outputConfig).length === 0) {
+            delete body.output_config;
+        }
+    }
+    if ('effort' in body) {
+        delete body.effort;
+        stripped = true;
+    }
+    if (stripped) {
+        logger.debug(`[claude-request-normalizer] Stripped unsupported effort parameter for model: ${model}`);
+    }
+    return stripped;
 }
-function handleDeprecatedSamplingParams(body, model) {
-    if (!modelDisablesSamplingParameters(model)) {
+// Strip sampling params (temperature/top_p/top_k) for models that reject them.
+function handleDeprecatedSamplingParams(body, caps, model) {
+    if (caps.sampling) {
         return false;
     }
     const stripped = [];
@@ -127,7 +122,6 @@ function handleDeprecatedSamplingParams(body, model) {
     logger.debug(`[claude-request-normalizer] Stripped deprecated sampling params for model ${model}: ${stripped.join(', ')}`);
     return true;
 }
-/** Agents whose Claude API requests need thinking normalization */
 const ALLOWED_AGENTS = ['codemie-claude', 'codemie-copilot', 'claude-desktop'];
 export class ClaudeRequestNormalizerPlugin {
     id = '@codemie/proxy-claude-request-normalizer';
@@ -139,7 +133,6 @@ export class ClaudeRequestNormalizerPlugin {
         if (!clientType || !ALLOWED_AGENTS.includes(clientType)) {
             throw new Error(`Plugin disabled for agent: ${clientType}`);
         }
-        // Pass the configured model as a fallback for requests that omit body.model
         const configModel = context.config.model;
         return new ClaudeRequestNormalizerInterceptor(configModel);
     }
@@ -161,15 +154,15 @@ class ClaudeRequestNormalizerInterceptor {
             if (!model) {
                 return;
             }
-            const modifiedBySampling = handleDeprecatedSamplingParams(body, model);
+            const caps = capabilitiesFor(model);
+            const modifiedBySampling = handleDeprecatedSamplingParams(body, caps, model);
+            // Not behind the thinking guard: Claude Code can send effort without thinking.
+            const modifiedByEffort = handleUnsupportedEffort(body, caps, model);
             let modifiedByThinking = false;
             if (body.thinking) {
-                // Chain handlers: first match wins and modifies body
-                modifiedByThinking =
-                    handleNoThinkingModels(body, model) ||
-                        handleAdaptiveThinkingTransform(body, model);
+                modifiedByThinking = handleThinkingField(body, caps, model);
             }
-            if (modifiedBySampling || modifiedByThinking) {
+            if (modifiedBySampling || modifiedByEffort || modifiedByThinking) {
                 const newBodyStr = JSON.stringify(body);
                 context.requestBody = Buffer.from(newBodyStr, 'utf-8');
                 context.headers['content-length'] = String(context.requestBody.length);

package/dist/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-request-normalizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD;;;GAGG;AACH,MAAM,0BAA0B,GAAa;IAC3C,qCAAqC,EAAG,iDAAiD;CAC1F,CAAC;AAEF;;;;GAIG;AACH,MAAM,gCAAgC,GAAa;IACjD,kCAAkC,EAAG,2GAA2G;IAChJ,8BAA8B,EAAO,2CAA2C;CACjF,CAAC;AAEF,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,6BAA6B,CAAC,SAAiB;IACtD,OAAO,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,8BAA8B,CAAC,SAAiB;IACvD,OAAO,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,+BAA+B,CAAC,SAAiB;IACxD,OAAO,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,YAAqB;IACjD,MAAM,MAAM,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,IAAS,EAAE,KAAa;IACtD,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC,QAAQ,CAAC;IACrB,MAAM,CAAC,KAAK,CAAC,8EAA8E,KAAK,EAAE,CAAC,CAAC;IACpG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,+BAA+B,CAAC,IAAS,EAAE,KAAa;IAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;IACzC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAErC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC;QAED,MAAM,CAAC,KAAK,CACV,qFAAqF,MAAM,gBAAgB,KAAK,EAAE,CACnH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,KAAK,CACV,6EAA6E,KAAK,EAAE,CACrF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,MAAM,CAAC,KAAK,CACV,uFAAuF,KAAK,EAAE,CAC/F,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,8BAA8B,CAAC,IAAS,EAAE,KAAa;IAC9D,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QAC7D,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,KAAK,CACV,6EAA6E,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,MAAM,cAAc,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAE/E,MAAM,OAAO,6BAA6B;IACxC,EAAE,GAAG,0CAA0C,CAAC;IAChD,IAAI,GAAG,2BAA2B,CAAC;IACnC,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC,CAAC,+BAA+B;IAE9C,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,4EAA4E;QAC5E,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACzC,OAAO,IAAI,kCAAkC,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,kCAAkC;IAGT;IAF7B,IAAI,GAAG,2BAA2B,CAAC;IAEnC,YAA6B,WAAoB;QAApB,gBAAW,GAAX,WAAW,CAAS;IAAG,CAAC;IAErD,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEjC,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACvF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YAED,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAEvE,IAAI,kBAAkB,GAAG,KAAK,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,qDAAqD;gBACrD,kBAAkB;oBAChB,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC;wBACnC,+BAA+B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,kBAAkB,IAAI,kBAAkB,EAAE,CAAC;gBAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACvD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"claude-request-normalizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/claude-request-normalizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAcxD,sDAAsD;AACtD,MAAM,oBAAoB,GAAsB;IAC9C,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,KAAK;IACb,QAAQ,EAAE,IAAI;IACd,wBAAwB,EAAE,KAAK;CAChC,CAAC;AAEF,kFAAkF;AAClF,uEAAuE;AACvE,MAAM,sBAAsB,GAAwE;IAClG;QACE,uEAAuE;QACvE,OAAO,EAAE,qCAAqC;QAC9C,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE;KACnG;IACD;QACE,mFAAmF;QACnF,OAAO,EAAE,kCAAkC;QAC3C,YAAY,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE;KACtG;IACD;QACE,8EAA8E;QAC9E,mDAAmD;QACnD,OAAO,EAAE,8BAA8B;QACvC,YAAY,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE;KACtG;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,KAAa;IACpC,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,YAAY,CAAC;IAC3D,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,gEAAgE;AAChE,SAAS,oBAAoB,CAAC,YAAqB;IACjD,MAAM,MAAM,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yFAAyF;AACzF,SAAS,mBAAmB,CAAC,IAAS,EAAE,IAAuB,EAAE,KAAa;IAC5E,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,8EAA8E,KAAK,EAAE,CAAC,CAAC;QACpG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;QACzC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACjE,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAErC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,aAAa,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;YACjE,CAAC;YAED,MAAM,CAAC,KAAK,CACV,qFAAqF,MAAM,gBAAgB,KAAK,EAAE,CACnH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,6EAA6E,KAAK,EAAE,CAAC,CAAC;YACnG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,MAAM,CAAC,KAAK,CAAC,uFAAuF,KAAK,EAAE,CAAC,CAAC;QAC7G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mDAAmD;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,IAAS,EAAE,IAAuB,EAAE,KAAa;IAChF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC;IACxC,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;QACjF,OAAO,YAAY,CAAC,MAAM,CAAC;QAC3B,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,aAAa,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC;QACnB,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gFAAgF,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,SAAS,8BAA8B,CAAC,IAAS,EAAE,IAAuB,EAAE,KAAa;IACvF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QAC7D,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,KAAK,CACV,6EAA6E,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAE/E,MAAM,OAAO,6BAA6B;IACxC,EAAE,GAAG,0CAA0C,CAAC;IAChD,IAAI,GAAG,2BAA2B,CAAC;IACnC,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC,CAAC,+BAA+B;IAE9C,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACzC,OAAO,IAAI,kCAAkC,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC;CACF;AAED,MAAM,kCAAkC;IAGT;IAF7B,IAAI,GAAG,2BAA2B,CAAC;IAEnC,YAA6B,WAAoB;QAApB,gBAAW,GAAX,WAAW,CAAS;IAAG,CAAC;IAErD,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEjC,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YACvF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YAEpC,MAAM,kBAAkB,GAAG,8BAA8B,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAE7E,+EAA+E;YAC/E,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAEpE,IAAI,kBAAkB,GAAG,KAAK,CAAC;YAC/B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,kBAAkB,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;YAED,IAAI,kBAAkB,IAAI,gBAAgB,IAAI,kBAAkB,EAAE,CAAC;gBACjE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACvD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;CACF"}

package/dist/providers/plugins/sso/proxy/plugins/codex-request-normalizer.plugin.js

@@ -185,8 +185,13 @@ class CodexRequestNormalizerInterceptor {
      */
     resolveFallbackModel() {
         const pinned = this.context.config.model;
-        if (pinned && this.availableModels.includes(pinned))
-            return pinned;
+        if (pinned) {
+            // The pinned value may be the profile's undated picker name; resolve it to
+            // its dated deployment the same way an in-flight request is resolved.
+            const resolution = resolveCodexDeployment(pinned, this.availableModels, undefined);
+            if (resolution.kind === 'exact' || resolution.kind === 'resolved')
+                return resolution.model;
+        }
         return rankDeploymentsByRecency(this.availableModels)[0];
     }
     /**

package/dist/providers/plugins/sso/proxy/plugins/codex-request-normalizer.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-request-normalizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-request-normalizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,eAAe,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1C,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;GAKG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,UAAU,2BAA2B,CAAC,IAAa;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,OAAO,EAAU,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnF,MAAM,UAAU,GAAG,IAA+B,CAAC;IACnD,IAAI,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAEvD,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,UAAU,CAAC,WAAW,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,KAAa,EAAE,IAAqB;IAC/D,IAAI,KAAK,GAAG,cAAc;QAAE,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IAExD,4EAA4E;IAC5E,gDAAgD;IAChD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEf,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAA+B,CAAC;IAE/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,eAAe,CAAC,IAAI,CAAC;oBAAE,QAAQ,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,iDAAiD;QACjD,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,4BAA4B;IACvC,EAAE,GAAG,yCAAyC,CAAC;IAC/C,IAAI,GAAG,0BAA0B,CAAC;IAClC,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,iCAAiC,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;CACF;AAED,MAAM,iCAAiC;IAQR;IAP7B,IAAI,GAAG,0BAA0B,CAAC;IAE1B,eAAe,GAAa,EAAE,CAAC;IAC/B,QAAQ,GAAG,CAAC,CAAC;IACb,aAAa,GAAG,CAAC,CAAC;IAClB,QAAQ,GAAyB,IAAI,CAAC;IAE9C,YAA6B,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAEvD,kFAAkF;IAClF,yBAAyB,CAAC,MAAgB;QACxC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;YACrC,OAAO;QACT,CAAC;QAED,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,oBAAoB,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,cAAc,oBAAoB,iDAAiD,CACjG,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACxD,IAAI,oBAAoB,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,oBAAoB,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CACvC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,oBAAoB,EAAE,CAC5B,CAAC;QAEF,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACpE,IAAI,oBAAoB,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACT,IAAI,IAAI,CAAC,IAAI,oCAAoC,UAAU,CAAC,SAAS,KAAK;gBAC1E,uBAAuB,UAAU,CAAC,KAAK,WAAW,CACnD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,eAAe,IAAI,CAAC,KAAK,oBAAoB,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,uFAAuF;IAC/E,SAAS,CAAC,OAAqB,EAAE,IAA6B;QACpE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACzC,IAAI,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACnE,OAAO,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC;QAC1F,IAAI,KAAK;YAAE,OAAO;QAElB,0EAA0E;QAC1E,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,KAAK,CAAC;eACtC,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,sBAAsB,CAAC;QACvD,IAAI,UAAU;YAAE,OAAO;QAEvB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,gEAAgE,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YACtE,MAAM,MAAM,GAAG,SAAS,IAAI,WAAW;gBACrC,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC1D,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAE3D,IAAI,CAAC,eAAe,GAAG,MAAM;iBAC1B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;iBAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,SAAS,CAAC;iBACxD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChD,qEAAqE;iBACpE,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE3B,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,eAAe,CAAC,MAAM,mCAAmC,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2CAA2C;YAC3C,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,6DAA6D;gBAC1E,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"codex-request-normalizer.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/codex-request-normalizer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,eAAe,GAAG,CAAC,eAAe,CAAC,CAAC;AAE1C,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;GAKG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,UAAU,2BAA2B,CAAC,IAAa;IACvD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,OAAO,EAAU,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnF,MAAM,UAAU,GAAG,IAA+B,CAAC;IACnD,IAAI,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAEvD,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,OAAO,UAAU,CAAC,WAAW,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,KAAa,EAAE,IAAqB;IAC/D,IAAI,KAAK,GAAG,cAAc;QAAE,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IAExD,4EAA4E;IAC5E,gDAAgD;IAChD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEf,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAA+B,CAAC;IAE/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,eAAe,CAAC,IAAI,CAAC;oBAAE,QAAQ,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,iDAAiD;QACjD,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,4BAA4B;IACvC,EAAE,GAAG,yCAAyC,CAAC;IAC/C,IAAI,GAAG,0BAA0B,CAAC;IAClC,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,iCAAiC,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;CACF;AAED,MAAM,iCAAiC;IAQR;IAP7B,IAAI,GAAG,0BAA0B,CAAC;IAE1B,eAAe,GAAa,EAAE,CAAC;IAC/B,QAAQ,GAAG,CAAC,CAAC;IACb,aAAa,GAAG,CAAC,CAAC;IAClB,QAAQ,GAAyB,IAAI,CAAC;IAE9C,YAA6B,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAEvD,kFAAkF;IAClF,yBAAyB,CAAC,MAAgB;QACxC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QAED,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;YACrC,OAAO;QACT,CAAC;QAED,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,oBAAoB,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,cAAc,oBAAoB,iDAAiD,CACjG,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACxD,IAAI,oBAAoB,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,oBAAoB,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CACvC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,oBAAoB,EAAE,CAC5B,CAAC;QAEF,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACpE,IAAI,oBAAoB,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CACT,IAAI,IAAI,CAAC,IAAI,oCAAoC,UAAU,CAAC,SAAS,KAAK;gBAC1E,uBAAuB,UAAU,CAAC,KAAK,WAAW,CACnD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,eAAe,IAAI,CAAC,KAAK,oBAAoB,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,uFAAuF;IAC/E,SAAS,CAAC,OAAqB,EAAE,IAA6B;QACpE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,2EAA2E;YAC3E,sEAAsE;YACtE,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;YACnF,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;QAC7F,CAAC;QACD,OAAO,wBAAwB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,kBAAkB,CAAC;QAC1F,IAAI,KAAK;YAAE,OAAO;QAElB,0EAA0E;QAC1E,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,KAAK,CAAC;eACtC,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,sBAAsB,CAAC;QACvD,IAAI,UAAU;YAAE,OAAO;QAEvB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QAExC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,gEAAgE,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YACtE,MAAM,MAAM,GAAG,SAAS,IAAI,WAAW;gBACrC,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC;gBAC1D,CAAC,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YAE3D,IAAI,CAAC,eAAe,GAAG,MAAM;iBAC1B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;iBAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,SAAS,CAAC;iBACxD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChD,qEAAqE;iBACpE,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE3B,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,eAAe,CAAC,MAAM,mCAAmC,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2CAA2C;YAC3C,MAAM,CAAC,KAAK,CACV,IAAI,IAAI,CAAC,IAAI,6DAA6D;gBAC1E,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/providers/plugins/sso/proxy/plugins/header-injection.plugin.js

@@ -25,7 +25,11 @@ class HeaderInjectionInterceptor {
     async onRequest(context) {
         // Request and session ID headers
         context.headers['X-CodeMie-Request-ID'] = context.requestId;
-        context.headers['X-CodeMie-Session-ID'] = context.sessionId;
+        // Omit the session header entirely when there is no real session id, rather
+        // than forwarding the 'unknown' sentinel that context.sessionId defaults to.
+        if (context.sessionId && context.sessionId !== 'unknown') {
+            context.headers['X-CodeMie-Session-ID'] = context.sessionId;
+        }
         // LiteLLM can use these headers for Responses API session affinity when
         // its router is configured with session-aware pre-call checks.
         if (this.context.config.clientType === 'codemie-codex' || this.context.config.clientType === 'codemie-copilot') {

package/dist/providers/plugins/sso/proxy/plugins/header-injection.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"header-injection.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/header-injection.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,OAAO,qBAAqB;IAChC,EAAE,GAAG,wBAAwB,CAAC;IAC9B,IAAI,GAAG,kBAAkB,CAAC;IAC1B,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;CACF;AAED,MAAM,0BAA0B;IAGV;IAFpB,IAAI,GAAG,kBAAkB,CAAC;IAE1B,YAAoB,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAE9C,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,iCAAiC;QACjC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5D,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAE5D,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC/G,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9D,CAAC;QAED,yBAAyB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;QAC1D,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,UAAU,EAAE,CAAC;QAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,gDAAgD;QAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,QAAQ,EAAE,gBAAgB,EAAE,mBAAmB,KAAK,IAAI,CAAC;QAErF,uDAAuD;QACvD,IAAI,mBAAmB,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAChD,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;QAClE,CAAC;QAED,qDAAqD;QACrD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACxD,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;QAED,6CAA6C;QAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACxD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;IAC1D,CAAC;CACF"}
+{"version":3,"file":"header-injection.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/header-injection.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,OAAO,qBAAqB;IAChC,EAAE,GAAG,wBAAwB,CAAC;IAC9B,IAAI,GAAG,kBAAkB,CAAC;IAC1B,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,OAAO,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;CACF;AAED,MAAM,0BAA0B;IAGV;IAFpB,IAAI,GAAG,kBAAkB,CAAC;IAE1B,YAAoB,OAAsB;QAAtB,YAAO,GAAP,OAAO,CAAe;IAAG,CAAC;IAE9C,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,iCAAiC;QACjC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5D,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzD,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9D,CAAC;QAED,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;YAC/G,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9D,CAAC;QAED,yBAAyB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;QAC1D,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,UAAU,EAAE,CAAC;QAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAEnC,gDAAgD;QAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,QAAQ,EAAE,gBAAgB,EAAE,mBAAmB,KAAK,IAAI,CAAC;QAErF,uDAAuD;QACvD,IAAI,mBAAmB,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAChD,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;QAClE,CAAC;QAED,qDAAqD;QACrD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACxD,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,yBAAyB;QACzB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;QAED,6CAA6C;QAC7C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACxD,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/providers/plugins/sso/proxy/plugins/sso-auth.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-auth.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/sso-auth.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAK1E,qBAAa,aAAc,YAAW,WAAW;IAC/C,EAAE,SAA6B;IAC/B,IAAI,SAAwB;IAC5B,OAAO,SAAW;IAClB,QAAQ,SAAM;IAER,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQ3E"}
+{"version":3,"file":"sso-auth.plugin.d.ts","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/sso-auth.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAM1E,qBAAa,aAAc,YAAW,WAAW;IAC/C,EAAE,SAA6B;IAC/B,IAAI,SAAwB;IAC5B,OAAO,SAAW;IAClB,QAAQ,SAAM;IAER,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAQ3E"}

package/dist/providers/plugins/sso/proxy/plugins/sso-auth.plugin.js

@@ -6,6 +6,7 @@
  * KISS: Simple interceptor, one clear purpose
  */
 import { logger } from '../../../../../utils/logger.js';
+import { AuthenticationError } from '../proxy-errors.js';
 export class SSOAuthPlugin {
     id = '@codemie/proxy-sso-auth';
     name = 'SSO Authentication';
@@ -35,10 +36,38 @@ class SSOAuthInterceptor {
     constructor(credentials) {
         this.credentials = credentials;
     }
+    hasInvalidHeaderChars(value) {
+        // RFC 7230 field-vchar / obs-text; disallow control chars except HTAB.
+        for (let i = 0; i < value.length; i++) {
+            const code = value.charCodeAt(i);
+            if ((code <= 0x1f && code !== 0x09) || code === 0x7f) {
+                return true;
+            }
+        }
+        return false;
+    }
     async onRequest(context) {
-        const cookieHeader = Object.entries(this.credentials.cookies)
-            .map(([key, value]) => `${key}=${value}`)
-            .join('; ');
+        const invalidCookieKeys = [];
+        const cookiePairs = [];
+        for (const [key, value] of Object.entries(this.credentials.cookies)) {
+            const safeKey = String(key).trim();
+            const safeValue = String(value);
+            if (!safeKey || this.hasInvalidHeaderChars(safeKey) || this.hasInvalidHeaderChars(safeValue)) {
+                invalidCookieKeys.push(safeKey || '<empty>');
+                continue;
+            }
+            cookiePairs.push(`${safeKey}=${safeValue}`);
+        }
+        if (invalidCookieKeys.length > 0) {
+            logger.warn(`[${this.name}] Ignoring invalid cookie entries`, {
+                invalidCookieCount: invalidCookieKeys.length,
+                invalidCookieNames: invalidCookieKeys,
+            });
+        }
+        if (cookiePairs.length === 0) {
+            throw new AuthenticationError('Stored SSO session cookies are invalid. Run `codemie profile login` and reconnect the proxy.');
+        }
+        const cookieHeader = cookiePairs.join('; ');
         // Use lowercase 'cookie' to match Node.js HTTP header conventions
         context.headers['cookie'] = cookieHeader;
         logger.debug(`[${this.name}] Injected SSO cookies:`, {

package/dist/providers/plugins/sso/proxy/plugins/sso-auth.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-auth.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/sso-auth.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAExD,MAAM,OAAO,aAAa;IACxB,EAAE,GAAG,yBAAyB,CAAC;IAC/B,IAAI,GAAG,oBAAoB,CAAC;IAC5B,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,+CAA+C;QAC/C,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,WAA6B,CAAC,CAAC;IACvE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,eAAe;IACA;IAAnB,YAAmB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;CACpC;AAED,MAAM,kBAAkB;IAGF;IAFpB,IAAI,GAAG,UAAU,CAAC;IAElB,YAAoB,WAA2B;QAA3B,gBAAW,GAAX,WAAW,CAAgB;IAAG,CAAC;IAEnD,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;aAC1D,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;aACxC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,kEAAkE;QAClE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC;QAEzC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,yBAAyB,EAAE;YACnD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM;YACzD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAClD,YAAY,EAAE,YAAY,CAAC,MAAM;SAClC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sso-auth.plugin.js","sourceRoot":"","sources":["../../../../../../src/providers/plugins/sso/proxy/plugins/sso-auth.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,OAAO,aAAa;IACxB,EAAE,GAAG,yBAAyB,CAAC;IAC/B,IAAI,GAAG,oBAAoB,CAAC;IAC5B,OAAO,GAAG,OAAO,CAAC;IAClB,QAAQ,GAAG,EAAE,CAAC;IAEd,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,+CAA+C;QAC/C,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,WAA6B,CAAC,CAAC;IACvE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,eAAe;IACA;IAAnB,YAAmB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;CACpC;AAED,MAAM,kBAAkB;IAGF;IAFpB,IAAI,GAAG,UAAU,CAAC;IAElB,YAAoB,WAA2B;QAA3B,gBAAW,GAAX,WAAW,CAAgB;IAAG,CAAC;IAE3C,qBAAqB,CAAC,KAAa;QACzC,uEAAuE;QACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACrD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAqB;QACnC,MAAM,iBAAiB,GAAa,EAAE,CAAC;QACvC,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7F,iBAAiB,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,mCAAmC,EAAE;gBAC5D,kBAAkB,EAAE,iBAAiB,CAAC,MAAM;gBAC5C,kBAAkB,EAAE,iBAAiB;aACtC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,mBAAmB,CAC3B,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE5C,kEAAkE;QAClE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC;QAEzC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,yBAAyB,EAAE;YACnD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM;YACzD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAClD,YAAY,EAAE,YAAY,CAAC,MAAM;SAClC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/providers/plugins/sso/proxy/proxy-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-errors.d.ts","sourceRoot":"","sources":["../../../../../src/providers/plugins/sso/proxy/proxy-errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAGjB,UAAU,EAAE,MAAM;aAClB,IAAI,EAAE,MAAM;aACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAHjD,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;IAOnD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQlC;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,UAAU;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,UAAU;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,UAAU;gBAC/B,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAInF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CA8C5F"}
+{"version":3,"file":"proxy-errors.d.ts","sourceRoot":"","sources":["../../../../../src/providers/plugins/sso/proxy/proxy-errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAGjB,UAAU,EAAE,MAAM;aAClB,IAAI,EAAE,MAAM;aACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAHjD,OAAO,EAAE,MAAM,EACC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;IAOnD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQlC;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,UAAU;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,UAAU;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,UAAU;gBAC/B,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAInF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAsF5F"}

package/dist/providers/plugins/sso/proxy/proxy-errors.js

@@ -72,9 +72,35 @@ export function normalizeError(error, context) {
         return error;
     }
     if (error instanceof Error) {
+        const errorCode = error.code;
+        const message = error.message || '';
+        // Node may throw synchronously for malformed header values (for example,
+        // corrupted/invalid cookie bytes). Treat this as an auth/session issue so
+        // users get a recovery action instead of a generic 500.
+        if (errorCode === 'ERR_INVALID_CHAR' ||
+            errorCode === 'ERR_HTTP_INVALID_HEADER_VALUE' ||
+            /header content|header value|cookie/i.test(message)) {
+            return new AuthenticationError('Invalid authentication session data. Run `codemie profile login` and restart the proxy.', {
+                originalError: message,
+                errorCode,
+                ...context,
+            });
+        }
         // Network errors
         if ('code' in error) {
-            const code = error.code;
+            const code = errorCode;
+            if (message.includes('self-signed certificate in certificate chain') ||
+                message.includes('unable to verify the first certificate') ||
+                message.includes('certificate has expired') ||
+                code === 'SELF_SIGNED_CERT_IN_CHAIN' ||
+                code === 'UNABLE_TO_VERIFY_LEAF_SIGNATURE' ||
+                code === 'CERT_HAS_EXPIRED') {
+                return new UpstreamError(502, 'TLS validation failed when connecting to upstream. Check corporate proxy certificate chain or trust settings.', {
+                    originalError: message,
+                    errorCode: code,
+                    ...context,
+                });
+            }
             if (code === 'ECONNREFUSED' || code === 'ENOTFOUND' || code === 'ECONNRESET') {
                 return new NetworkError(`Cannot connect to upstream server: ${error.message}`, {
                     originalError: error.message,