@combycode/llm-sdk 1.5.0 → 1.5.1

package/CHANGELOG.md

@@ -6,6 +6,14 @@ All notable changes to `@combycode/llm-sdk` are documented here. The format foll
 
 ## [Unreleased]
 
+## [1.5.1] - 2026-07-06
+
+### Fixed
+- **Anthropic file retrieval from the browser** was blocked by CORS. `retrieveFile` /
+  `streamFile` now send Anthropic's `anthropic-dangerous-direct-browser-access: true` header
+  when running in a browser (matching the completion adapter), so hosted code-execution files
+  download directly. No effect on Node/Bun.
+
 ## [1.5.0] - 2026-07-06
 
 ### Added

package/dist/index.browser.js

@@ -22471,7 +22471,11 @@ function contentRequest(ctx, file) {
         "x-api-key": ctx.apiKey,
         "anthropic-version": "2023-06-01",
         "anthropic-beta": "files-api-2025-04-14",
-        accept: "application/binary"
+        accept: "application/binary",
+        // Enable CORS for direct browser requests (same header the completion
+        // adapter sets); harmless on Node/Bun. Without it the browser blocks the
+        // file download by CORS.
+        ...isBrowser() ? { "anthropic-dangerous-direct-browser-access": "true" } : {}
       }
     };
   }
@@ -22492,7 +22496,11 @@ function providerAuth(ctx, url) {
   const base = ctx.baseURL ?? DEFAULT_BASE[ctx.provider];
   if (!url.startsWith(base)) return {};
   if (ctx.provider === "anthropic") {
-    return { "x-api-key": ctx.apiKey, "anthropic-version": "2023-06-01" };
+    return {
+      "x-api-key": ctx.apiKey,
+      "anthropic-version": "2023-06-01",
+      ...isBrowser() ? { "anthropic-dangerous-direct-browser-access": "true" } : {}
+    };
   }
   if (ctx.provider === "google") return { "x-goog-api-key": ctx.apiKey };
   return { authorization: `Bearer ${ctx.apiKey}` };

package/dist/index.js

@@ -22398,7 +22398,11 @@ function contentRequest(ctx, file) {
         "x-api-key": ctx.apiKey,
         "anthropic-version": "2023-06-01",
         "anthropic-beta": "files-api-2025-04-14",
-        accept: "application/binary"
+        accept: "application/binary",
+        // Enable CORS for direct browser requests (same header the completion
+        // adapter sets); harmless on Node/Bun. Without it the browser blocks the
+        // file download by CORS.
+        ...isBrowser() ? { "anthropic-dangerous-direct-browser-access": "true" } : {}
       }
     };
   }
@@ -22419,7 +22423,11 @@ function providerAuth(ctx, url) {
   const base = ctx.baseURL ?? DEFAULT_BASE[ctx.provider];
   if (!url.startsWith(base)) return {};
   if (ctx.provider === "anthropic") {
-    return { "x-api-key": ctx.apiKey, "anthropic-version": "2023-06-01" };
+    return {
+      "x-api-key": ctx.apiKey,
+      "anthropic-version": "2023-06-01",
+      ...isBrowser() ? { "anthropic-dangerous-direct-browser-access": "true" } : {}
+    };
   }
   if (ctx.provider === "google") return { "x-goog-api-key": ctx.apiKey };
   return { authorization: `Bearer ${ctx.apiKey}` };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@combycode/llm-sdk",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Unified, pluggable AI SDK for accessing the LLMs of every major provider (Anthropic, OpenAI, Google, xAI, OpenRouter) through one API. Cross-environment: Node, Bun, and the browser.",
   "type": "module",
   "main": "./dist/index.js",