@dianshuv/copilot-api 0.10.0 → 0.11.0

package/README.md

@@ -57,7 +57,7 @@ make down
 | Option | Description | Default |
 |--------|-------------|---------|
 | `--port`, `-p` | Port to listen on | 4141 |
-| `--host`, `-H` | Host/interface to bind to | (all interfaces) |
+| `--host`, `-H` | Host/interface to bind to (`0.0.0.0` = all interfaces) | `127.0.0.1` |
 | `--verbose`, `-v` | Enable verbose logging | false |
 | `--account-type`, `-a` | Account type (individual, business, enterprise) | individual |
 | `--manual` | Manual request approval mode | false |
@@ -200,17 +200,23 @@ The startup banner prints whether auth is on/off and, when on, the source
 
 ### Network binding
 
-The proxy **binds all interfaces (`0.0.0.0`) by default**, so a key-less
-instance is reachable from anywhere on your network. For a local-only,
-unauthenticated instance, bind loopback explicitly:
+The proxy **binds loopback (`127.0.0.1`) by default**, so an unconfigured
+instance is reachable only from the local machine. To expose it on your network
+— behind auth, a tunnel, or inside a container — opt into an all-interfaces
+bind explicitly:
 
 ```sh
-copilot-api start --host 127.0.0.1
+copilot-api start --host 0.0.0.0
 ```
 
-The startup banner reports the **real** bind address (`0.0.0.0` for an
-all-interfaces bind, or the narrowed host you passed), so a wide-open bind is
-never hidden.
+The bind host resolves with **`--host` flag > `HOST` env > `127.0.0.1`**. Note
+that a `HOST` env var — inherited from your shell or a container — also widens
+the bind: `HOST=0.0.0.0` opens all interfaces just like the flag. A *blank*
+`HOST` (`HOST=`, or `HOST=$UNSET`) is ignored and falls back to the loopback
+default, so an accidentally-empty env var can't silently expose the proxy. The
+startup banner always reports the **real** bind address (`127.0.0.1` for the
+loopback default, `0.0.0.0` for an all-interfaces bind, or the narrowed host you
+passed), so a wide-open bind is never hidden.
 
 ### Choosing a key
 
@@ -277,8 +283,8 @@ a custom header, so when auth is on they stop working:
 
 Workarounds:
 
-- Run a **separate local, unauthenticated instance** (`--host 127.0.0.1` with no
-  `--api-key`) for the browser UI, or
+- Run a **separate local, unauthenticated instance** (no `--api-key`; the
+  default `127.0.0.1` bind keeps it local) for the browser UI, or
 - Hit the history JSON API directly with a key, e.g.
   `curl -H "Authorization: Bearer $COPILOT_API_KEY" http://127.0.0.1:4141/history/api/entries`.
 

package/dist/main.mjs

@@ -1348,7 +1348,7 @@ const patchClaude = defineCommand({
 
 //#endregion
 //#region package.json
-var version = "0.10.0";
+var version = "0.11.0";
 
 //#endregion
 //#region src/lib/adaptive-rate-limiter.ts
@@ -1762,6 +1762,44 @@ function resolveProxyApiKey(sources) {
 	};
 }
 /**
+* Resolve the hostname the server will *actually* bind to, decided at the CLI
+* edge with flag-over-env precedence and a **safe loopback default** — the same
+* flag-over-env shape this codebase already uses to reconcile a CLI flag with
+* its env twin (`--api-key`/`COPILOT_API_KEY`, `--github-token`/`GH_TOKEN`).
+*
+*  - `--host` flag wins when present; otherwise the `HOST` env; otherwise the
+*    default `127.0.0.1`.
+*  - The default is **loopback, not all-interfaces**: an unconfigured instance
+*    must not expose `/token` (which echoes the plaintext Copilot token) and the
+*    otherwise-unauthenticated API to the whole network. Binding every interface
+*    is now an explicit opt-in — pass `--host 0.0.0.0` (or `HOST=0.0.0.0`).
+*  - **flag vs env asymmetry on a blank value** (the security-critical part): an
+*    explicit `--host` flag is the operator's deliberate choice, so a blank flag
+*    (`--host ""` / whitespace) is taken as the wildcard-bind escape hatch and
+*    canonicalized to an explicit `0.0.0.0` (rather than left as `""` to lean on
+*    srvx's undocumented empty-string handling). But a *set-but-blank* `HOST` env
+*    (`HOST=`, or `HOST=$UNSET` in a shell / compose where the var is unset →
+*    empty — NOT a deliberate keystroke) is accidental plumbing, so it is treated
+*    as **not provided** and falls through to the loopback default. This mirrors
+*    `resolveProxyApiKey` trimming `""` to not-provided, so an empty `HOST` can't
+*    silently reopen the all-interfaces-unauthenticated exposure the loopback
+*    default exists to prevent.
+*  - **Both sources are trimmed**: a padded `--host " 10.0.0.5 "` or
+*    `HOST=" 10.0.0.5 "` would otherwise reach the socket bind verbatim and fail
+*    with `ENOTFOUND`. Trimming also decides blank-ness for the rules above.
+*
+* `env` is passed in (not read here) to keep the function pure and unit-testable.
+*/
+function resolveBindHost(flag, env) {
+	if (flag !== void 0) {
+		const trimmed = flag.trim();
+		return trimmed === "" ? "0.0.0.0" : trimmed;
+	}
+	const envTrimmed = env?.trim() ?? "";
+	if (envTrimmed !== "") return envTrimmed;
+	return "127.0.0.1";
+}
+/**
 * Resolve the address the server will *actually* bind to for the startup banner
 * (Issue 04).
 *
@@ -8011,6 +8049,472 @@ function translateErrorToAnthropicErrorEvent(error) {
 	};
 }
 
+//#endregion
+//#region src/routes/messages/tool-call-recovery.ts
+const ENVELOPE = String.raw`(?:<(?:antml:)?function_calls>|call)`;
+const INVOKE_BODY = String.raw`<(?:antml:)?invoke\s+name="[^"]+">[\s\S]*?</(?:antml:)?invoke>`;
+const LEAKED_REGION_RE = new RegExp(String.raw`(?:^|\n)[ \t]*` + ENVELOPE + String.raw`[ \t\n]*(?:` + INVOKE_BODY + String.raw`\s*)+(?:</(?:antml:)?function_calls>)?`, "g");
+const INCOMPLETE_LEAK_TAIL_RE = new RegExp(String.raw`(?:^|\n)[ \t]*` + ENVELOPE + String.raw`[ \t\n]*<(?:antml:)?invoke\b[\s\S]*$`);
+const LEAK_OPEN_RE = new RegExp(String.raw`(?:^|\n)[ \t]*` + ENVELOPE + String.raw`[ \t\n]*<(?:antml:)?invoke\s+name="`);
+const INVOKE_RE = /<(?:antml:)?invoke\s+name="([^"]+)">([\s\S]*?)<\/(?:antml:)?invoke>/g;
+const PARAMETER_RE = /<(?:antml:)?parameter\s+name="([^"]+)">([\s\S]*?)<\/(?:antml:)?parameter>/g;
+function coerceParamValue(raw) {
+	const trimmed = raw.trim();
+	if (trimmed.startsWith("{") && trimmed.endsWith("}") || trimmed.startsWith("[") && trimmed.endsWith("]")) try {
+		return JSON.parse(trimmed);
+	} catch {
+		return raw;
+	}
+	return raw;
+}
+function parseRegionInvokes(region, knownTools) {
+	const calls = [];
+	for (const invokeMatch of region.matchAll(INVOKE_RE)) {
+		const name = invokeMatch[1];
+		if (knownTools && !knownTools.has(name)) continue;
+		const input = {};
+		for (const paramMatch of invokeMatch[2].matchAll(PARAMETER_RE)) input[paramMatch[1]] = coerceParamValue(paramMatch[2]);
+		calls.push({
+			name,
+			input
+		});
+	}
+	return calls;
+}
+/**
+* Split assistant text into ordered segments — dropping leaked envelope markup
+* (and undeclared-tool invokes) while preserving the natural-language on either
+* side and the pre/tool/post ordering. Returns a single text segment when there
+* is no leak. Shared by both response recovery paths so they cannot diverge.
+*/
+function recoverSegments(text, knownTools) {
+	const segments = [];
+	let cursor = 0;
+	let sawRegion = false;
+	for (const region of text.matchAll(LEAKED_REGION_RE)) {
+		sawRegion = true;
+		const pre = text.slice(cursor, region.index);
+		if (pre.trim() !== "") segments.push({
+			kind: "text",
+			text: pre
+		});
+		for (const call of parseRegionInvokes(region[0], knownTools)) segments.push({
+			kind: "tool",
+			call
+		});
+		cursor = region.index + region[0].length;
+	}
+	if (!sawRegion) return [{
+		kind: "text",
+		text
+	}];
+	const post = text.slice(cursor);
+	if (post.trim() !== "") segments.push({
+		kind: "text",
+		text: post
+	});
+	return segments;
+}
+/** True when `text` contains at least one complete, envelope-wrapped leak. */
+function containsLeakedToolCall(text) {
+	if (!text.includes("invoke")) return false;
+	for (const _region of text.matchAll(LEAKED_REGION_RE)) return true;
+	return false;
+}
+/**
+* Remove complete leaked tool-call regions from assistant text, preserving the
+* surrounding natural-language on both sides.
+*/
+function stripLeakedToolCalls(text) {
+	if (!text.includes("invoke")) return text;
+	const stripped = text.replaceAll(LEAKED_REGION_RE, "");
+	if (stripped === text) return text;
+	return stripped.replace(/[ \t\n]+$/, "");
+}
+/**
+* Declared CLIENT tool names for a payload. Server-side tools are excluded (they
+* are not client-executable, so a leaked server-tool invoke must not become a
+* client tool_use). Always returns a set — an empty set means "no declared
+* tools", which correctly drops every leaked invoke rather than trusting it.
+*/
+function toolNameSet(tools) {
+	return new Set((tools ?? []).filter((tool) => !isServerToolType(tool.type)).map((tool) => tool.name));
+}
+const EMPTIED_ASSISTANT_PLACEHOLDER = "[malformed tool call removed by proxy]";
+function historyHasLeak(text) {
+	if (!text.includes("invoke")) return false;
+	return containsLeakedToolCall(text) || INCOMPLETE_LEAK_TAIL_RE.test(text);
+}
+function scrubHistoryText(text) {
+	const stripped = stripLeakedToolCalls(text);
+	const final = stripped.replace(INCOMPLETE_LEAK_TAIL_RE, "");
+	return final === stripped ? stripped : final.replace(/[ \t\n]+$/, "");
+}
+/**
+* Request-side de-poison. Strips leaked tool-call markup (complete and truncated)
+* from assistant text in the inbound history so the model never sees a
+* text-format exemplar to imitate — breaking the self-reinforcing poisoning
+* loop. When stripping empties an assistant message, the message is kept with a
+* short placeholder rather than dropped, so role alternation is preserved.
+*/
+function dePoisonAssistantMessages(payload) {
+	if (!payload.messages.some((m) => m.role === "assistant" && (typeof m.content === "string" ? m.content.includes("invoke") : m.content.some((b) => b.type === "text" && b.text.includes("invoke"))))) return payload;
+	let changed = false;
+	const messages = [];
+	for (const msg of payload.messages) {
+		if (msg.role !== "assistant") {
+			messages.push(msg);
+			continue;
+		}
+		if (typeof msg.content === "string") {
+			if (!historyHasLeak(msg.content)) {
+				messages.push(msg);
+				continue;
+			}
+			changed = true;
+			const cleaned = scrubHistoryText(msg.content);
+			messages.push({
+				...msg,
+				content: cleaned.trim() === "" ? EMPTIED_ASSISTANT_PLACEHOLDER : cleaned
+			});
+			continue;
+		}
+		if (!msg.content.some((b) => b.type === "text" && historyHasLeak(b.text))) {
+			messages.push(msg);
+			continue;
+		}
+		changed = true;
+		const content = msg.content.flatMap((b) => {
+			if (b.type !== "text" || !historyHasLeak(b.text)) return [b];
+			const cleaned = scrubHistoryText(b.text);
+			return cleaned.trim() === "" ? [] : [{
+				...b,
+				text: cleaned
+			}];
+		});
+		messages.push(content.length > 0 ? {
+			...msg,
+			content
+		} : {
+			...msg,
+			content: EMPTIED_ASSISTANT_PLACEHOLDER
+		});
+	}
+	return changed ? {
+		...payload,
+		messages
+	} : payload;
+}
+let recoveryCounter = 0;
+function nextToolUseId() {
+	recoveryCounter += 1;
+	return `toolu_recovered_${Date.now().toString(36)}_${recoveryCounter}`;
+}
+/**
+* Non-streaming recovery: rewrites any assistant text block that contains a
+* leaked tool call into ordered [pre-text, tool_use(s), post-text] blocks,
+* dropping the leak markup and undeclared-tool invokes. stop_reason is flipped to
+* tool_use only when a real call was recovered AND upstream reported a plain
+* end-of-turn (so max_tokens / refusal / pause_turn survive).
+*/
+function recoverLeakedToolCallsInResponse(response, knownTools) {
+	let changed = false;
+	let recoveredCall = false;
+	const content = [];
+	for (const block of response.content) {
+		if (block.type !== "text" || !containsLeakedToolCall(block.text)) {
+			content.push(block);
+			continue;
+		}
+		changed = true;
+		for (const segment of recoverSegments(block.text, knownTools)) if (segment.kind === "text") content.push({
+			type: "text",
+			text: segment.text
+		});
+		else {
+			recoveredCall = true;
+			content.push({
+				type: "tool_use",
+				id: nextToolUseId(),
+				name: segment.call.name,
+				input: segment.call.input
+			});
+		}
+	}
+	if (!changed) return response;
+	const flip = recoveredCall && (response.stop_reason === "end_turn" || response.stop_reason === null);
+	return {
+		...response,
+		content,
+		stop_reason: flip ? "tool_use" : response.stop_reason
+	};
+}
+function out(event) {
+	return {
+		event,
+		data: JSON.stringify(event)
+	};
+}
+const TAIL_GUARD = 48;
+const MAX_CAPTURE = 65536;
+/**
+* Per-response streaming transformer. Feed it each parsed upstream Anthropic
+* event (plus the original `data` string); forward whatever it returns; call
+* `flush()` once the upstream stream ends.
+*
+* Identity passthrough until an envelope appears in a text block; from there it
+* suppresses the leaked markup, emits structured tool_use block(s) (declared
+* tools only) plus any trailing prose, shifts the indices of later blocks, and
+* flips a plain end-of-turn stop_reason to tool_use.
+*/
+var LeakedToolCallStreamRecovery = class {
+	extraBlocks = 0;
+	text = null;
+	converted = false;
+	knownTools;
+	constructor(knownTools) {
+		this.knownTools = knownTools;
+	}
+	process(event, rawData) {
+		switch (event.type) {
+			case "content_block_start": return this.onBlockStart(event, rawData);
+			case "content_block_delta": return this.onBlockDelta(event, rawData);
+			case "content_block_stop": return this.onBlockStop(event, rawData);
+			case "message_delta": return this.onMessageDelta(event, rawData);
+			default: return [{
+				event,
+				data: rawData
+			}];
+		}
+	}
+	/** Flush any pending (buffered/capturing) text block at end of stream. */
+	flush() {
+		return this.flushPending();
+	}
+	reindexed(event, rawData) {
+		if (this.extraBlocks === 0) return {
+			event,
+			data: rawData
+		};
+		const shifted = {
+			...event,
+			index: event.index + this.extraBlocks
+		};
+		return {
+			event: shifted,
+			data: JSON.stringify(shifted)
+		};
+	}
+	onBlockStart(event, rawData) {
+		if (event.content_block.type === "text") {
+			this.text = {
+				upstreamIndex: event.index,
+				opened: false,
+				buffer: "",
+				forwarded: 0,
+				capturing: false,
+				captureStart: 0,
+				abandoned: false
+			};
+			return [];
+		}
+		return [this.reindexed(event, rawData)];
+	}
+	onBlockDelta(event, rawData) {
+		const t = this.text;
+		if (!t || event.index !== t.upstreamIndex || event.delta.type !== "text_delta") return [this.reindexed(event, rawData)];
+		t.buffer += event.delta.text;
+		if (t.capturing) {
+			if (t.buffer.length - t.captureStart > MAX_CAPTURE) return this.abandonCapture(t);
+			return [];
+		}
+		if (!t.abandoned) {
+			const open = LEAK_OPEN_RE.exec(t.buffer);
+			if (open) return this.beginCapture(t, open.index);
+		}
+		return this.flushSafe(t);
+	}
+	onBlockStop(event, rawData) {
+		const t = this.text;
+		if (!t || event.index !== t.upstreamIndex) return [this.reindexed(event, rawData)];
+		return this.flushPending();
+	}
+	onMessageDelta(event, rawData) {
+		const flushed = this.flushPending();
+		const isNaturalEnd = event.delta.stop_reason === "end_turn" || event.delta.stop_reason === null;
+		if (!this.converted || !isNaturalEnd) return [...flushed, {
+			event,
+			data: rawData
+		}];
+		const rewritten = {
+			...event,
+			delta: {
+				...event.delta,
+				stop_reason: "tool_use"
+			}
+		};
+		return [...flushed, out(rewritten)];
+	}
+	emitText(t, chunk) {
+		const idx = t.upstreamIndex + this.extraBlocks;
+		const events = [];
+		if (!t.opened) {
+			events.push(out({
+				type: "content_block_start",
+				index: idx,
+				content_block: {
+					type: "text",
+					text: ""
+				}
+			}));
+			t.opened = true;
+		}
+		events.push(out({
+			type: "content_block_delta",
+			index: idx,
+			delta: {
+				type: "text_delta",
+				text: chunk
+			}
+		}));
+		return events;
+	}
+	flushSafe(t) {
+		const safeEnd = t.buffer.length - TAIL_GUARD;
+		if (safeEnd <= t.forwarded) return [];
+		const chunk = t.buffer.slice(t.forwarded, safeEnd);
+		t.forwarded = safeEnd;
+		return this.emitText(t, chunk);
+	}
+	beginCapture(t, start) {
+		t.captureStart = start;
+		t.capturing = true;
+		if (start > t.forwarded) {
+			const preamble = t.buffer.slice(t.forwarded, start);
+			t.forwarded = start;
+			return this.emitText(t, preamble);
+		}
+		return [];
+	}
+	abandonCapture(t) {
+		t.capturing = false;
+		t.abandoned = true;
+		const events = this.emitText(t, t.buffer.slice(t.forwarded));
+		t.forwarded = t.buffer.length;
+		return events;
+	}
+	emitTextBlock(index, text) {
+		return [
+			out({
+				type: "content_block_start",
+				index,
+				content_block: {
+					type: "text",
+					text: ""
+				}
+			}),
+			out({
+				type: "content_block_delta",
+				index,
+				delta: {
+					type: "text_delta",
+					text
+				}
+			}),
+			out({
+				type: "content_block_stop",
+				index
+			})
+		];
+	}
+	emitToolBlock(index, call) {
+		return [
+			out({
+				type: "content_block_start",
+				index,
+				content_block: {
+					type: "tool_use",
+					id: nextToolUseId(),
+					name: call.name,
+					input: {}
+				}
+			}),
+			out({
+				type: "content_block_delta",
+				index,
+				delta: {
+					type: "input_json_delta",
+					partial_json: JSON.stringify(call.input)
+				}
+			}),
+			out({
+				type: "content_block_stop",
+				index
+			})
+		];
+	}
+	flushPending() {
+		const t = this.text;
+		if (!t) return [];
+		this.text = null;
+		if (t.capturing) return this.finishCapture(t);
+		const events = [];
+		if (t.buffer.length > t.forwarded) events.push(...this.emitText(t, t.buffer.slice(t.forwarded)));
+		const idx = t.upstreamIndex + this.extraBlocks;
+		if (!t.opened) {
+			events.push(out({
+				type: "content_block_start",
+				index: idx,
+				content_block: {
+					type: "text",
+					text: ""
+				}
+			}));
+			t.opened = true;
+		}
+		events.push(out({
+			type: "content_block_stop",
+			index: idx
+		}));
+		return events;
+	}
+	finishCapture(t) {
+		const segments = recoverSegments(t.buffer.slice(t.captureStart), this.knownTools);
+		const hasTool = segments.some((s) => s.kind === "tool");
+		const base = t.upstreamIndex + this.extraBlocks;
+		const events = [];
+		if (!hasTool) {
+			const text = segments.map((s) => s.kind === "text" ? s.text : "").join("");
+			if (text !== "") events.push(...this.emitText(t, text), out({
+				type: "content_block_stop",
+				index: base
+			}));
+			else if (t.opened) events.push(out({
+				type: "content_block_stop",
+				index: base
+			}));
+			else this.extraBlocks -= 1;
+			return events;
+		}
+		this.converted = true;
+		let cursor = base;
+		if (t.opened) {
+			events.push(out({
+				type: "content_block_stop",
+				index: base
+			}));
+			cursor = base + 1;
+		}
+		for (const [i, segment] of segments.entries()) {
+			const idx = cursor + i;
+			events.push(...segment.kind === "text" ? this.emitTextBlock(idx, segment.text) : this.emitToolBlock(idx, segment.call));
+		}
+		const clientBlocks = (t.opened ? 1 : 0) + segments.length;
+		this.extraBlocks += clientBlocks - 1;
+		return events;
+	}
+};
+
 //#endregion
 //#region src/routes/messages/direct-anthropic-handler.ts
 /**
@@ -8069,7 +8573,7 @@ async function handleDirectAnthropicCompletion(c, anthropicPayload, ctx, initiat
 				});
 			});
 		}
-		return handleDirectAnthropicNonStreamingResponse(c, response, ctx, truncateResult, effectivePayload);
+		return handleDirectAnthropicNonStreamingResponse(c, recoverLeakedToolCallsInResponse(response, toolNameSet(effectivePayload.tools)), ctx, truncateResult, effectivePayload);
 	} catch (error) {
 		if (error instanceof HTTPError && error.status === 413) logPayloadSizeInfoAnthropic(effectivePayload, selectedModel);
 		recordErrorResponse(ctx, anthropicPayload.model, error, "messages", anthropicPayload.stream ?? false);
@@ -8187,6 +8691,19 @@ async function handleDirectAnthropicStreamingResponse(opts) {
 	const acc = createAnthropicStreamAccumulator();
 	const checkRepetition = createStreamRepetitionChecker(`anthropic:${anthropicPayload.model}`);
 	const serverToolFilter = createServerToolBlockFilter();
+	const recovery = new LeakedToolCallStreamRecovery(toolNameSet(anthropicPayload.tools));
+	const forward = async (recovered) => {
+		const outEvent = recovered.event;
+		processAnthropicEvent(outEvent, acc);
+		if (outEvent.type === "content_block_start") logServerToolBlock(outEvent.content_block);
+		const forwardData = serverToolFilter.rewriteEvent(outEvent, recovered.data);
+		if (forwardData === null) return;
+		const echoedData = echoForwardData(forwardData, outEvent.type, ctx);
+		await stream.writeSSE({
+			event: outEvent.type,
+			data: echoedData
+		});
+	};
 	try {
 		for await (const rawEvent of response) {
 			consola.debug("Direct Anthropic raw stream event:", JSON.stringify(rawEvent));
@@ -8199,17 +8716,10 @@ async function handleDirectAnthropicStreamingResponse(opts) {
 				consola.error("Failed to parse Anthropic stream event:", parseError, rawEvent.data);
 				continue;
 			}
-			processAnthropicEvent(event, acc);
-			if (event.type === "content_block_start") logServerToolBlock(event.content_block);
 			if (event.type === "content_block_delta" && event.delta.type === "text_delta") checkRepetition(event.delta.text);
-			const forwardData = serverToolFilter.rewriteEvent(event, rawEvent.data);
-			if (forwardData === null) continue;
-			const echoedData = echoForwardData(forwardData, event.type, ctx);
-			await stream.writeSSE({
-				event: rawEvent.event || event.type,
-				data: echoedData
-			});
+			for (const recovered of recovery.process(event, rawEvent.data)) await forward(recovered);
 		}
+		for (const recovered of recovery.flush()) await forward(recovered);
 		recordAnthropicStreamingResponse(acc, anthropicPayload.model, ctx);
 		completeTracking(ctx.trackingId, acc.inputTokens, acc.outputTokens, ctx.queueWaitMs, void 0, {
 			model: acc.model || anthropicPayload.model,
@@ -8536,12 +9046,13 @@ async function handleCompletion(c) {
 			system: extractSystemPrompt(p.system)
 		})
 	});
-	logToolInfo(anthropicPayload);
-	const subagentMarker = parseSubagentMarkerFromFirstUser(anthropicPayload);
+	const sanitizedPayload = dePoisonAssistantMessages(anthropicPayload);
+	logToolInfo(sanitizedPayload);
+	const subagentMarker = parseSubagentMarkerFromFirstUser(sanitizedPayload);
 	const initiatorOverride = subagentMarker ? "agent" : void 0;
 	if (subagentMarker) consola.debug("Detected Subagent marker:", JSON.stringify(subagentMarker));
-	if (supportsDirectAnthropicApi(anthropicPayload.model)) return handleDirectAnthropicCompletion(c, anthropicPayload, ctx, initiatorOverride);
-	return handleTranslatedCompletion(c, anthropicPayload, ctx, initiatorOverride);
+	if (supportsDirectAnthropicApi(sanitizedPayload.model)) return handleDirectAnthropicCompletion(c, sanitizedPayload, ctx, initiatorOverride);
+	return handleTranslatedCompletion(c, sanitizedPayload, ctx, initiatorOverride);
 }
 /**
 * Log tool-related information for debugging
@@ -9283,7 +9794,7 @@ async function runServer(options) {
 	const visibleModels = allModels.filter((m) => !isHiddenModel(m.id, state.showAllModels));
 	if (visibleModels.length === 0) consola.warn("All upstream models are filtered by the hardcoded blacklist. /v1/models will return an empty list, but explicit POSTs with a hidden id still pass through to upstream. Restart with --show-all-models to see the full catalogue.");
 	else consola.info(`Available models:\n${visibleModels.map((m) => formatModelInfo(m)).join("\n")}`);
-	const serverUrl = `http://${resolveClientHost(options.host, process.env.HOST)}:${options.port}`;
+	const serverUrl = `http://${resolveClientHost(options.host, void 0)}:${options.port}`;
 	if (options.claudeCode) {
 		if (visibleModels.length === 0) {
 			consola.error("--claude-code interactive setup needs at least one visible model. Restart with --show-all-models or update src/lib/hidden-models.ts.");
@@ -9319,7 +9830,7 @@ async function runServer(options) {
 	consola.box(`🌐 Usage Viewer: https://ericc-ch.github.io/copilot-api?endpoint=${serverUrl}/usage${options.history ? `\n📜 History UI: ${serverUrl}/history` : ""}`);
 	for (const line of buildStartupAuthLines({
 		source: options.apiKeySource,
-		bindAddress: resolveBindAddress(options.host, process.env.HOST)
+		bindAddress: resolveBindAddress(options.host, void 0)
 	})) process.stdout.write(`${line}\n`);
 	setupShutdownHandlers();
 	setServerInstance(serve({
@@ -9369,7 +9880,7 @@ const start = defineCommand({
 		host: {
 			alias: "H",
 			type: "string",
-			description: "Host/interface to bind to (e.g., 127.0.0.1 for localhost only, 0.0.0.0 for all interfaces)"
+			description: "Host/interface to bind to. Default: 127.0.0.1 (loopback only); pass 0.0.0.0 to bind all interfaces. Falls back to the HOST env var when the flag is omitted."
 		},
 		verbose: {
 			alias: "v",
@@ -9495,7 +10006,7 @@ const start = defineCommand({
 		});
 		return runServer({
 			port: Number.parseInt(args.port, 10),
-			host: args.host,
+			host: resolveBindHost(args.host, process.env.HOST),
 			verbose: args.verbose,
 			accountType: args["account-type"],
 			manual: args.manual,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dianshuv/copilot-api",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code!",
   "author": "dianshuv",
   "type": "module",