@ex-machina/opencode-anthropic-auth 2.0.0-next.1 → 2.0.0-next.2

package/dist/transform.js

@@ -1,8 +1,167 @@
+import { Buffer } from 'node:buffer';
+import { createHash } from 'node:crypto';
 import { buildBillingHeaderValue } from "./cch.js";
 import { CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_IDENTITY, CLAUDE_CODE_VERSION, formatUserAgent, OPENCODE_IDENTITY_PREFIX, PARAGRAPH_REMOVAL_ANCHORS, REQUIRED_BETAS, TEXT_REPLACEMENTS, TOOL_PREFIX, } from "./constants.js";
+import { assertWellFormedUtf16, createBoundedJsonToolNameStream, MAX_JSON_NODES, MAX_JSON_OBJECT_KEYS, MAX_JSON_TOOL_NAME_BYTES, } from "./json-response-stream.js";
 // Bound an incomplete SSE line so malformed streams cannot grow memory forever.
 export const MAX_SSE_LINE_BYTES = 5 * 1024 * 1024;
-function headersAfterBodyTransform(source) {
+export const MAX_SSE_EVENT_BYTES = 8 * 1024 * 1024;
+export { MAX_JSON_TOOL_NAME_BYTES };
+const SHORT_TOOL_ALIAS_PREFIX = `${TOOL_PREFIX}T`;
+const LONG_TOOL_ALIAS_PREFIX = `${TOOL_PREFIX}H`;
+const MAX_TOOL_ALIAS_BYTES = 64;
+const MAX_INLINE_TOOL_NAME_BYTES = 44;
+const DEFAULT_ALIAS_ENTRIES = 4096;
+const DEFAULT_ALIAS_BYTES = 256 * 1024;
+const utf8Encoder = new TextEncoder();
+const utf8Decoder = new TextDecoder('utf-8', { fatal: true });
+function base64url(bytes) {
+    return Buffer.from(bytes).toString('base64url');
+}
+/**
+ * Reversible tool-name aliases bounded to Anthropic's 64-byte limit.
+ *
+ * Names up to 44 UTF-8 bytes are encoded inline. Longer names use a stable
+ * SHA-256 alias and are retained in a bounded table because a lossless,
+ * stateless 64-byte source -> 60-byte payload mapping is impossible.
+ */
+export class ToolNameAliasTable {
+    maxEntries;
+    maxBytes;
+    longByName = new Map();
+    longByAlias = new Map();
+    retainedBytes = 0;
+    disposed = false;
+    constructor(options = {}) {
+        this.maxEntries = options.maxEntries ?? DEFAULT_ALIAS_ENTRIES;
+        this.maxBytes = options.maxBytes ?? DEFAULT_ALIAS_BYTES;
+        if (!Number.isSafeInteger(this.maxEntries) ||
+            this.maxEntries < 0 ||
+            !Number.isSafeInteger(this.maxBytes) ||
+            this.maxBytes < 0) {
+            throw new TypeError('Tool-name alias limits must be safe non-negative integers');
+        }
+    }
+    assertActive() {
+        if (this.disposed)
+            throw new Error('Tool-name alias table is disposed');
+    }
+    encode(name) {
+        this.assertActive();
+        assertWellFormedUtf16(name);
+        const bytes = utf8Encoder.encode(name);
+        if (bytes.byteLength === 0) {
+            throw new Error('Tool names must not be empty');
+        }
+        if (bytes.byteLength <= MAX_INLINE_TOOL_NAME_BYTES) {
+            const alias = `${SHORT_TOOL_ALIAS_PREFIX}${base64url(bytes)}`;
+            if (utf8Encoder.encode(alias).byteLength > MAX_TOOL_ALIAS_BYTES) {
+                throw new Error('Encoded tool name exceeds Anthropic alias limit');
+            }
+            return alias;
+        }
+        const existing = this.longByName.get(name);
+        if (existing)
+            return existing;
+        const alias = `${LONG_TOOL_ALIAS_PREFIX}${createHash('sha256')
+            .update(bytes)
+            .digest('base64url')}`;
+        const collision = this.longByAlias.get(alias);
+        if (collision !== undefined && collision !== name) {
+            throw new Error('Tool-name alias collision');
+        }
+        if (this.longByName.size >= this.maxEntries) {
+            throw new Error('Tool-name alias entry limit exceeded');
+        }
+        if (bytes.byteLength > this.maxBytes - this.retainedBytes) {
+            throw new Error('Tool-name alias byte limit exceeded');
+        }
+        this.longByName.set(name, alias);
+        this.longByAlias.set(alias, name);
+        this.retainedBytes += bytes.byteLength;
+        return alias;
+    }
+    decode(alias) {
+        this.assertActive();
+        if (alias.startsWith(SHORT_TOOL_ALIAS_PREFIX)) {
+            const encoded = alias.slice(SHORT_TOOL_ALIAS_PREFIX.length);
+            if (!encoded || !/^[A-Za-z0-9_-]+$/.test(encoded))
+                return undefined;
+            try {
+                const bytes = Buffer.from(encoded, 'base64url');
+                if (bytes.byteLength > MAX_INLINE_TOOL_NAME_BYTES)
+                    return undefined;
+                if (base64url(bytes) !== encoded)
+                    return undefined;
+                const name = utf8Decoder.decode(bytes);
+                const canonical = `${SHORT_TOOL_ALIAS_PREFIX}${base64url(utf8Encoder.encode(name))}`;
+                return canonical === alias ? name : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        }
+        if (alias.startsWith(LONG_TOOL_ALIAS_PREFIX)) {
+            return this.longByAlias.get(alias);
+        }
+        return undefined;
+    }
+    get hasStatefulAliases() {
+        this.assertActive();
+        return this.longByName.size > 0;
+    }
+    dispose() {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        this.longByName.clear();
+        this.longByAlias.clear();
+        this.retainedBytes = 0;
+    }
+}
+function statelessToolNameAliases() {
+    return new ToolNameAliasTable({ maxEntries: 0, maxBytes: 0 });
+}
+function finalizeStream(stream, finalize) {
+    const reader = stream.getReader();
+    let released = false;
+    const release = () => {
+        if (released)
+            return;
+        released = true;
+        reader.releaseLock();
+    };
+    return new ReadableStream({
+        async pull(controller) {
+            try {
+                const result = await reader.read();
+                if (result.done) {
+                    release();
+                    finalize();
+                    controller.close();
+                }
+                else {
+                    controller.enqueue(result.value);
+                }
+            }
+            catch (error) {
+                release();
+                finalize();
+                controller.error(error);
+            }
+        },
+        async cancel(reason) {
+            try {
+                await reader.cancel(reason);
+            }
+            finally {
+                release();
+                finalize();
+            }
+        },
+    });
+}
+export function headersAfterBodyTransform(source) {
     const headers = new Headers(source);
     for (const name of [
         'content-digest',
@@ -17,210 +176,6 @@ function headersAfterBodyTransform(source) {
     }
     return headers;
 }
-const JSON_NAME_KEY_SUFFIX = new TextEncoder().encode('name"');
-const JSON_TOOL_PREFIX = new TextEncoder().encode(TOOL_PREFIX);
-const UTF8_ENCODER = new TextEncoder();
-const UTF8_FATAL_DECODER = new TextDecoder('utf-8', { fatal: true });
-export const MAX_JSON_TOOL_NAME_BYTES = 1024;
-function isJsonWhitespace(byte) {
-    return byte === 0x20 || byte === 0x09 || byte === 0x0a || byte === 0x0d;
-}
-/**
- * Rewrite JSON `name` string values without buffering the whole document.
- * Only a bounded tool-name candidate is retained across chunks; all document
- * content outside that string value is emitted immediately.
- */
-function createJsonToolNameStream(body) {
-    let state = 'outside';
-    let held = [];
-    let candidateIndex = 0;
-    let escaped = false;
-    const enterStringAfter = (byte) => {
-        if (byte === 0x22) {
-            state = 'outside';
-            escaped = false;
-            return;
-        }
-        state = 'string';
-        escaped = byte === 0x5c;
-    };
-    return body.pipeThrough(new TransformStream({
-        transform(chunk, controller) {
-            const output = new Uint8Array(chunk.byteLength + 32);
-            let outputLength = 0;
-            const write = (byte) => {
-                output[outputLength++] = byte;
-            };
-            const enqueueOutput = () => {
-                if (outputLength === 0)
-                    return;
-                controller.enqueue(output.slice(0, outputLength));
-                outputLength = 0;
-            };
-            const writeHeld = () => {
-                for (const byte of held)
-                    write(byte);
-                held = [];
-            };
-            const processOutside = (byte) => {
-                if (byte === 0x22) {
-                    held = [byte];
-                    candidateIndex = 0;
-                    state = 'key-candidate';
-                    return;
-                }
-                write(byte);
-            };
-            for (const byte of chunk) {
-                if (state === 'outside') {
-                    processOutside(byte);
-                    continue;
-                }
-                if (state === 'key-candidate') {
-                    if (byte === JSON_NAME_KEY_SUFFIX[candidateIndex]) {
-                        held.push(byte);
-                        candidateIndex++;
-                        if (candidateIndex === JSON_NAME_KEY_SUFFIX.byteLength) {
-                            writeHeld();
-                            state = 'after-name-key';
-                        }
-                        continue;
-                    }
-                    writeHeld();
-                    write(byte);
-                    enterStringAfter(byte);
-                    continue;
-                }
-                if (state === 'string') {
-                    write(byte);
-                    if (escaped) {
-                        escaped = false;
-                    }
-                    else if (byte === 0x5c) {
-                        escaped = true;
-                    }
-                    else if (byte === 0x22) {
-                        state = 'outside';
-                    }
-                    continue;
-                }
-                if (state === 'after-name-key') {
-                    if (isJsonWhitespace(byte)) {
-                        write(byte);
-                    }
-                    else if (byte === 0x3a) {
-                        write(byte);
-                        state = 'after-colon';
-                    }
-                    else {
-                        processOutside(byte);
-                    }
-                    continue;
-                }
-                if (state === 'after-colon') {
-                    if (isJsonWhitespace(byte)) {
-                        write(byte);
-                    }
-                    else if (byte === 0x22) {
-                        write(byte);
-                        held = [];
-                        candidateIndex = 0;
-                        state = 'prefix-candidate';
-                    }
-                    else {
-                        processOutside(byte);
-                    }
-                    continue;
-                }
-                if (state === 'prefix-candidate') {
-                    if (byte === JSON_TOOL_PREFIX[candidateIndex]) {
-                        held.push(byte);
-                        candidateIndex++;
-                        if (candidateIndex === JSON_TOOL_PREFIX.byteLength) {
-                            held = [];
-                            candidateIndex = 0;
-                            escaped = false;
-                            state = 'tool-name-candidate';
-                        }
-                        continue;
-                    }
-                    writeHeld();
-                    write(byte);
-                    enterStringAfter(byte);
-                    continue;
-                }
-                if (escaped) {
-                    held.push(byte);
-                    escaped = false;
-                    if (held.length > MAX_JSON_TOOL_NAME_BYTES) {
-                        throw new Error(`JSON tool name exceeds ${MAX_JSON_TOOL_NAME_BYTES} byte limit`);
-                    }
-                    continue;
-                }
-                if (byte === 0x5c) {
-                    held.push(byte);
-                    escaped = true;
-                    if (held.length > MAX_JSON_TOOL_NAME_BYTES) {
-                        throw new Error(`JSON tool name exceeds ${MAX_JSON_TOOL_NAME_BYTES} byte limit`);
-                    }
-                    continue;
-                }
-                if (byte === 0x22) {
-                    let replacement;
-                    if (held.length === 0) {
-                        replacement = JSON_TOOL_PREFIX;
-                    }
-                    else {
-                        try {
-                            replacement = UTF8_ENCODER.encode(unprefixName(UTF8_FATAL_DECODER.decode(Uint8Array.from(held))));
-                        }
-                        catch {
-                            replacement = Uint8Array.from([...JSON_TOOL_PREFIX, ...held]);
-                        }
-                    }
-                    enqueueOutput();
-                    controller.enqueue(replacement);
-                    write(byte);
-                    held = [];
-                    candidateIndex = 0;
-                    state = 'outside';
-                    continue;
-                }
-                held.push(byte);
-                if (held.length > MAX_JSON_TOOL_NAME_BYTES) {
-                    throw new Error(`JSON tool name exceeds ${MAX_JSON_TOOL_NAME_BYTES} byte limit`);
-                }
-            }
-            enqueueOutput();
-        },
-        flush(controller) {
-            const trailing = Uint8Array.from(state === 'tool-name-candidate'
-                ? [...JSON_TOOL_PREFIX, ...held]
-                : held);
-            if (trailing.byteLength === 0)
-                return;
-            controller.enqueue(trailing);
-        },
-    }));
-}
-/**
- * Prefix a tool name with TOOL_PREFIX and uppercase the first character.
- * Claude Code uses PascalCase tool names (e.g. mcp_Bash, mcp_Read);
- * lowercase names (mcp_bash, mcp_read) are flagged as non-Claude-Code clients.
- */
-function prefixName(name) {
-    return `${TOOL_PREFIX}${name.charAt(0).toUpperCase()}${name.slice(1)}`;
-}
-/**
- * Reverse prefixName: strip TOOL_PREFIX and restore the original leading case.
- */
-function unprefixName(name) {
-    // StructuredOutput is still used as StructuredOutput
-    if (name === 'StructuredOutput') {
-        return name;
-    }
-    return `${name.charAt(0).toLowerCase()}${name.slice(1)}`;
-}
 /**
  * Merge headers from a Request object and/or a RequestInit headers value
  * into a single Headers instance.
@@ -271,9 +226,6 @@ export function mergeBetaHeaders(headers) {
 /**
  * Set OAuth-required headers on the request: authorization, beta, user-agent.
  * Removes x-api-key since we're using OAuth.
- *
- * `version` must be the same value passed to rewriteRequestBody for the same
- * request, otherwise the two reported versions disagree.
  */
 export function setOAuthHeaders(headers, accessToken, version = CLAUDE_CODE_VERSION) {
     headers.set('authorization', `Bearer ${accessToken}`);
@@ -286,24 +238,28 @@ export function setOAuthHeaders(headers, accessToken, version = CLAUDE_CODE_VERS
  * Add TOOL_PREFIX to tool names in the request body.
  * Prefixes both tool definitions and tool_use blocks in messages.
  */
-export function prefixToolNames(parsed) {
+export function prefixToolNames(parsed, alreadyPrefixed = false, aliases = statelessToolNameAliases()) {
+    const prefix = (name) => alreadyPrefixed && name.startsWith(TOOL_PREFIX)
+        ? name
+        : aliases.encode(name);
     if (parsed.tools && Array.isArray(parsed.tools)) {
-        parsed.tools = parsed.tools.map((tool) => ({
-            ...tool,
-            name: tool.name ? prefixName(tool.name) : tool.name,
-        }));
+        parsed.tools = parsed.tools.map((tool) => isRecord(tool) && typeof tool.name === 'string' && tool.name.length > 0
+            ? { ...tool, name: prefix(tool.name) }
+            : tool);
     }
     if (parsed.messages && Array.isArray(parsed.messages)) {
-        parsed.messages = parsed.messages.map((msg) => {
-            if (msg.content && Array.isArray(msg.content)) {
-                msg.content = msg.content.map((block) => {
-                    if (block.type === 'tool_use' && block.name) {
-                        return { ...block, name: prefixName(block.name) };
-                    }
-                    return block;
-                });
-            }
-            return msg;
+        parsed.messages = parsed.messages.map((message) => {
+            if (!isRecord(message) || !Array.isArray(message.content))
+                return message;
+            return {
+                ...message,
+                content: message.content.map((block) => isRecord(block) &&
+                    block.type === 'tool_use' &&
+                    typeof block.name === 'string' &&
+                    block.name.length > 0
+                    ? { ...block, name: prefix(block.name) }
+                    : block),
+            };
         });
     }
     return JSON.stringify(parsed);
@@ -311,23 +267,324 @@ export function prefixToolNames(parsed) {
 /**
  * Strip TOOL_PREFIX from tool names in streaming response text.
  */
-export function stripToolPrefix(text) {
-    return text.replace(/"name"\s*:\s*"mcp_([^"]+)"/g, (_match, name) => `"name": "${unprefixName(name)}"`);
+export function stripToolPrefix(text, aliases = statelessToolNameAliases()) {
+    return text.replace(/"name"\s*:\s*"(mcp_[A-Za-z0-9_-]+)"/g, (match, alias) => {
+        const name = aliases.decode(alias);
+        return name === undefined ? match : `"name": ${JSON.stringify(name)}`;
+    });
 }
-/**
- * Check if TLS verification should be skipped for custom API endpoints.
- * Only effective when ANTHROPIC_BASE_URL is also set.
- */
+const MAX_RESPONSE_JSON_DEPTH = 256;
+function isToolUseWithAlias(value) {
+    return (isRecord(value) &&
+        value.type === 'tool_use' &&
+        typeof value.name === 'string' &&
+        value.name.startsWith(TOOL_PREFIX));
+}
+function validateResponseToolName(name) {
+    assertWellFormedUtf16(name);
+    if (utf8Encoder.encode(name).byteLength > MAX_JSON_TOOL_NAME_BYTES) {
+        throw new Error(`JSON tool name exceeds ${MAX_JSON_TOOL_NAME_BYTES} byte limit`);
+    }
+}
+function responseToolNameReplacements(value, aliases) {
+    if (!isRecord(value))
+        return [];
+    if (value.type === 'content_block_start' &&
+        isToolUseWithAlias(value.content_block)) {
+        validateResponseToolName(value.content_block.name);
+        const name = aliases.decode(value.content_block.name);
+        return name === undefined
+            ? []
+            : [{ path: ['content_block', 'name'], value: name }];
+    }
+    if (value.type !== 'message' || !Array.isArray(value.content))
+        return [];
+    const replacements = [];
+    for (let index = 0; index < value.content.length; index++) {
+        const block = value.content[index];
+        if (!isToolUseWithAlias(block))
+            continue;
+        validateResponseToolName(block.name);
+        const name = aliases.decode(block.name);
+        if (name !== undefined) {
+            replacements.push({ path: ['content', index, 'name'], value: name });
+        }
+    }
+    return replacements;
+}
+function pathKey(path) {
+    return JSON.stringify(path);
+}
+function rewriteJsonStringTokens(text, replacements) {
+    const wanted = new Map(replacements.map((replacement) => [
+        pathKey(replacement.path),
+        JSON.stringify(replacement.value),
+    ]));
+    const edits = new Map();
+    let visited = 0;
+    let objectKeys = 0;
+    function failLimits() {
+        throw new Error('Anthropic response JSON exceeds traversal limits');
+    }
+    function skipWhitespace(offset) {
+        while (/\s/.test(text[offset] ?? ''))
+            offset++;
+        return offset;
+    }
+    function scanString(offset) {
+        let cursor = offset + 1;
+        while (cursor < text.length) {
+            const char = text[cursor];
+            if (char === '"')
+                return cursor + 1;
+            if (char === '\\')
+                cursor++;
+            cursor++;
+        }
+        return text.length;
+    }
+    function walkValue(offset, path, depth) {
+        visited++;
+        if (visited > MAX_JSON_NODES || depth > MAX_RESPONSE_JSON_DEPTH) {
+            failLimits();
+        }
+        let cursor = skipWhitespace(offset);
+        const char = text[cursor];
+        if (char === '"') {
+            const end = scanString(cursor);
+            const key = pathKey(path);
+            const replacement = wanted.get(key);
+            if (replacement !== undefined) {
+                edits.set(key, { start: cursor, end, value: replacement });
+            }
+            return end;
+        }
+        if (char === '{') {
+            cursor = skipWhitespace(cursor + 1);
+            const seenKeys = new Set();
+            while (text[cursor] !== '}' && cursor < text.length) {
+                const keyStart = cursor;
+                const keyEnd = scanString(keyStart);
+                const key = JSON.parse(text.slice(keyStart, keyEnd));
+                objectKeys += 1;
+                if (objectKeys > MAX_JSON_OBJECT_KEYS) {
+                    throw new Error('Anthropic response JSON exceeds object-key limit');
+                }
+                if (seenKeys.has(key)) {
+                    throw new Error('Malformed Anthropic response JSON: duplicate object key');
+                }
+                seenKeys.add(key);
+                cursor = skipWhitespace(keyEnd);
+                cursor = skipWhitespace(cursor + 1);
+                cursor = walkValue(cursor, [...path, key], depth + 1);
+                cursor = skipWhitespace(cursor);
+                if (text[cursor] === ',')
+                    cursor = skipWhitespace(cursor + 1);
+            }
+            return cursor + 1;
+        }
+        if (char === '[') {
+            cursor = skipWhitespace(cursor + 1);
+            let index = 0;
+            while (text[cursor] !== ']' && cursor < text.length) {
+                cursor = walkValue(cursor, [...path, index], depth + 1);
+                index++;
+                cursor = skipWhitespace(cursor);
+                if (text[cursor] === ',')
+                    cursor = skipWhitespace(cursor + 1);
+            }
+            return cursor + 1;
+        }
+        while (cursor < text.length && !/[\s,\]}]/.test(text[cursor] ?? '')) {
+            cursor++;
+        }
+        return cursor;
+    }
+    walkValue(0, [], 0);
+    let output = text;
+    const orderedEdits = [...edits.values()].sort((left, right) => right.start - left.start);
+    for (const edit of orderedEdits) {
+        output = output.slice(0, edit.start) + edit.value + output.slice(edit.end);
+    }
+    return output;
+}
+function rewriteResponseJson(text, aliases) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    return rewriteJsonStringTokens(text, responseToolNameReplacements(value, aliases));
+}
+function splitSseLines(event) {
+    const lines = [];
+    let offset = 0;
+    while (offset < event.length) {
+        let cursor = offset;
+        while (cursor < event.length &&
+            event[cursor] !== '\r' &&
+            event[cursor] !== '\n') {
+            cursor += 1;
+        }
+        let ending = '';
+        if (event[cursor] === '\r' && event[cursor + 1] === '\n')
+            ending = '\r\n';
+        else if (event[cursor] === '\r')
+            ending = '\r';
+        else if (event[cursor] === '\n')
+            ending = '\n';
+        lines.push({ content: event.slice(offset, cursor), ending });
+        offset = cursor + ending.length;
+    }
+    return lines;
+}
+function sseDataValue(line) {
+    if (line === 'data')
+        return '';
+    if (!line.startsWith('data:'))
+        return undefined;
+    const value = line.slice('data:'.length);
+    return value.startsWith(' ') ? value.slice(1) : value;
+}
+function transformSseEvent(bytes, aliases) {
+    const decoder = new TextDecoder('utf-8', { fatal: true });
+    const encoder = new TextEncoder();
+    const event = decoder.decode(bytes);
+    const lines = splitSseLines(event);
+    const dataIndexes = [];
+    const dataValues = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        const value = sseDataValue(lines[index]?.content ?? '');
+        if (value === undefined)
+            continue;
+        dataIndexes.push(index);
+        dataValues.push(value);
+    }
+    if (dataIndexes.length === 0)
+        return bytes;
+    const payload = dataValues.join('\n');
+    if (payload.trim() === '[DONE]')
+        return bytes;
+    const firstPayloadCharacter = payload.trimStart()[0];
+    const jsonLooking = firstPayloadCharacter === '{' || firstPayloadCharacter === '[';
+    if (!payload.includes(TOOL_PREFIX) && !jsonLooking)
+        return bytes;
+    const rewritten = rewriteResponseJson(payload, aliases);
+    if (rewritten === undefined) {
+        if (jsonLooking) {
+            throw new Error('Malformed or truncated Anthropic response JSON');
+        }
+        return bytes;
+    }
+    if (rewritten === payload)
+        return bytes;
+    const canonical = /[\r\n]/.test(rewritten) || dataIndexes.length > 1
+        ? JSON.stringify(JSON.parse(rewritten))
+        : rewritten;
+    const firstIndex = dataIndexes[0];
+    const dataIndexSet = new Set(dataIndexes);
+    const output = lines
+        .map((line, index) => {
+        if (index === firstIndex)
+            return `data: ${canonical}${line.ending}`;
+        if (dataIndexSet.has(index))
+            return '';
+        return `${line.content}${line.ending}`;
+    })
+        .join('');
+    return encoder.encode(output);
+}
+function createBoundedSseToolNameStream(body, aliases) {
+    let event = new Uint8Array(1024);
+    let eventLength = 0;
+    let lineLength = 0;
+    let pendingCr = false;
+    const appendEvent = (bytes) => {
+        const required = eventLength + bytes.byteLength;
+        if (required > MAX_SSE_EVENT_BYTES) {
+            throw new Error(`SSE event exceeds ${MAX_SSE_EVENT_BYTES} byte limit`);
+        }
+        if (required > event.byteLength) {
+            let capacity = event.byteLength;
+            while (capacity < required) {
+                capacity = Math.min(MAX_SSE_EVENT_BYTES, capacity * 2);
+            }
+            const expanded = new Uint8Array(capacity);
+            expanded.set(event.subarray(0, eventLength));
+            event = expanded;
+        }
+        event.set(bytes, eventLength);
+        eventLength = required;
+    };
+    const appendContent = (bytes) => {
+        if (lineLength + bytes.byteLength > MAX_SSE_LINE_BYTES) {
+            throw new Error(`SSE line exceeds ${MAX_SSE_LINE_BYTES} byte limit`);
+        }
+        lineLength += bytes.byteLength;
+        appendEvent(bytes);
+    };
+    const dispatch = (controller) => {
+        if (eventLength === 0)
+            return;
+        controller.enqueue(transformSseEvent(event.slice(0, eventLength), aliases));
+        eventLength = 0;
+    };
+    const finishLine = (controller) => {
+        const blank = lineLength === 0;
+        lineLength = 0;
+        if (blank)
+            dispatch(controller);
+    };
+    return body.pipeThrough(new TransformStream({
+        transform(chunk, controller) {
+            let segmentStart = 0;
+            if (pendingCr) {
+                pendingCr = false;
+                if (chunk[0] === 0x0a) {
+                    appendEvent(chunk.subarray(0, 1));
+                    segmentStart = 1;
+                }
+                finishLine(controller);
+            }
+            for (let index = segmentStart; index < chunk.byteLength; index += 1) {
+                const byte = chunk[index];
+                if (byte !== 0x0d && byte !== 0x0a)
+                    continue;
+                appendContent(chunk.subarray(segmentStart, index));
+                appendEvent(chunk.subarray(index, index + 1));
+                if (byte === 0x0d && index + 1 === chunk.byteLength) {
+                    pendingCr = true;
+                    segmentStart = index + 1;
+                    break;
+                }
+                if (byte === 0x0d && chunk[index + 1] === 0x0a) {
+                    appendEvent(chunk.subarray(index + 1, index + 2));
+                    index += 1;
+                }
+                finishLine(controller);
+                segmentStart = index + 1;
+            }
+            appendContent(chunk.subarray(segmentStart));
+        },
+        flush(controller) {
+            if (pendingCr) {
+                pendingCr = false;
+                finishLine(controller);
+            }
+            dispatch(controller);
+        },
+    }));
+}
+/** Check whether TLS verification was explicitly requested off for a custom endpoint. */
 export function isInsecure() {
     if (!process.env.ANTHROPIC_BASE_URL?.trim())
         return false;
     const raw = process.env.ANTHROPIC_INSECURE?.trim();
     return raw === '1' || raw === 'true';
 }
-/**
- * Parse ANTHROPIC_BASE_URL from the environment.
- * Returns a valid HTTP(S) URL or null if unset/invalid.
- */
+/** Resolve the configured custom endpoint without accepting embedded credentials. */
 function resolveBaseUrl() {
     const raw = process.env.ANTHROPIC_BASE_URL?.trim();
     if (!raw)
@@ -339,6 +596,11 @@ function resolveBaseUrl() {
             baseUrl.password) {
             return null;
         }
+        const loopback = baseUrl.hostname === 'localhost' ||
+            baseUrl.hostname === '127.0.0.1' ||
+            baseUrl.hostname === '[::1]';
+        if (baseUrl.protocol === 'http:' && !loopback)
+            return null;
         return baseUrl;
     }
     catch {
@@ -346,10 +608,26 @@ function resolveBaseUrl() {
     }
 }
 /**
- * Rewrite the request URL to add ?beta=true for /v1/messages requests.
- * When ANTHROPIC_BASE_URL is set, overrides the origin (protocol + host)
- * for all API requests flowing through the fetch wrapper.
- * Returns the modified input and URL (if applicable).
+ * Allow OAuth bearer credentials only for Anthropic's official API or the
+ * exact origin of an explicitly configured, validated custom endpoint.
+ */
+export function isTrustedAnthropicUrl(input) {
+    try {
+        const url = new URL(input.toString());
+        const configuredOrigin = resolveBaseUrl()?.origin;
+        return (url.username === '' &&
+            url.password === '' &&
+            (url.origin === 'https://api.anthropic.com' ||
+                (configuredOrigin !== undefined && url.origin === configuredOrigin)));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Rewrite the request URL to add ?beta=true for /v1/messages requests. When
+ * ANTHROPIC_BASE_URL is set, override the origin for API requests while
+ * retaining the original path and query.
  */
 export function rewriteUrl(input) {
     let requestUrl = null;
@@ -436,77 +714,114 @@ export function prependClaudeCodeIdentity(system) {
         return [identityBlock];
     if (typeof system === 'string') {
         const sanitized = sanitizeSystemText(system);
-        if (sanitized === CLAUDE_CODE_IDENTITY)
+        if (!sanitized || sanitized === CLAUDE_CODE_IDENTITY) {
             return [identityBlock];
+        }
         return [identityBlock, { type: 'text', text: sanitized }];
     }
     if (isRecord(system)) {
-        const type = typeof system.type === 'string' ? system.type : 'text';
-        const text = typeof system.text === 'string' ? system.text : '';
-        return [identityBlock, { ...system, type, text: sanitizeSystemText(text) }];
+        if (system.type !== 'text' || typeof system.text !== 'string') {
+            return [identityBlock];
+        }
+        const text = sanitizeSystemText(system.text);
+        if (!text || text === CLAUDE_CODE_IDENTITY)
+            return [identityBlock];
+        return [identityBlock, { ...system, type: 'text', text }];
     }
     if (!Array.isArray(system))
         return [identityBlock];
-    const sanitized = system.map((item) => {
+    const sanitized = [];
+    for (const item of system) {
         if (typeof item === 'string') {
-            return { type: 'text', text: sanitizeSystemText(item) };
+            const text = sanitizeSystemText(item);
+            if (text && text !== CLAUDE_CODE_IDENTITY) {
+                sanitized.push({ type: 'text', text });
+            }
+            continue;
         }
         if (isRecord(item) &&
             item.type === 'text' &&
             typeof item.text === 'string') {
-            return {
-                ...item,
-                type: 'text',
-                text: sanitizeSystemText(item.text),
-            };
+            const text = sanitizeSystemText(item.text);
+            if (text && text !== CLAUDE_CODE_IDENTITY) {
+                sanitized.push({ ...item, type: 'text', text });
+            }
         }
-        return { type: 'text', text: String(item) };
-    });
-    // Idempotency: don't double-prepend if first block already has the identity
-    if (sanitized[0]?.text === CLAUDE_CODE_IDENTITY) {
-        return sanitized;
     }
     return [identityBlock, ...sanitized];
 }
+const BILLING_HEADER_PREFIX = 'x-anthropic-billing-header:';
+function isBillingBlock(value) {
+    return (isRecord(value) &&
+        value.type === 'text' &&
+        typeof value.text === 'string' &&
+        value.text.startsWith(BILLING_HEADER_PREFIX));
+}
+function hasRewriteMarker(parsed) {
+    if (!Array.isArray(parsed.system))
+        return false;
+    const hasIdentity = parsed.system.some((block) => isRecord(block) && block.text === CLAUDE_CODE_IDENTITY);
+    if (!hasIdentity)
+        return false;
+    const hasUser = Array.isArray(parsed.messages) &&
+        parsed.messages.some((message) => isRecord(message) && message.role === 'user');
+    return !hasUser || parsed.system.some(isBillingBlock);
+}
 /**
  * Rewrite the full request body: sanitize system prompt and prefix tool names.
- *
- * `version` must be the same value passed to setOAuthHeaders for the same
- * request, otherwise the two reported versions disagree.
  */
-export function rewriteRequestBody(body, version = CLAUDE_CODE_VERSION) {
+export function rewriteRequestBody(body, version = CLAUDE_CODE_VERSION, aliases = statelessToolNameAliases()) {
+    let value;
     try {
-        const parsed = JSON.parse(body);
-        const billingHeader = Array.isArray(parsed.messages) &&
-            parsed.messages.some((message) => message.role === 'user')
-            ? buildBillingHeaderValue(parsed.messages, version, CLAUDE_CODE_ENTRYPOINT)
-            : null;
-        // Sanitize system prompt and prepend Claude Code identity
-        parsed.system = prependClaudeCodeIdentity(parsed.system);
-        // Prepend the billing header as a separate system block so the
-        // final layout is: [billing header, identity, ...rest]
-        if (billingHeader && Array.isArray(parsed.system)) {
-            parsed.system.unshift({ type: 'text', text: billingHeader });
-        }
-        return prefixToolNames(parsed);
+        value = JSON.parse(body);
     }
     catch {
         return body;
     }
+    if (!isRecord(value))
+        return body;
+    const parsed = value;
+    const alreadyPrefixed = hasRewriteMarker(parsed);
+    const billingHeader = Array.isArray(parsed.messages) &&
+        parsed.messages.some((message) => isRecord(message) && message.role === 'user')
+        ? buildBillingHeaderValue(parsed.messages, version, CLAUDE_CODE_ENTRYPOINT)
+        : null;
+    // Sanitize system prompt and prepend Claude Code identity
+    const system = prependClaudeCodeIdentity(parsed.system).filter((block) => !isBillingBlock(block));
+    // Prepend the billing header as a separate system block so the
+    // final layout is: [billing header, identity, ...rest]
+    if (billingHeader) {
+        system.unshift({ type: 'text', text: billingHeader });
+    }
+    parsed.system = system;
+    return prefixToolNames(parsed, alreadyPrefixed, aliases);
 }
 /**
  * Create a streaming response that strips the tool prefix from tool names.
  */
-export function createStrippedStream(response) {
+export function createStrippedStream(response, aliases = statelessToolNameAliases(), onFinalize = () => { }) {
+    let finalized = false;
+    const finalize = () => {
+        if (finalized)
+            return;
+        finalized = true;
+        onFinalize();
+    };
+    if (!response.ok) {
+        finalize();
+        return response;
+    }
     const mediaType = response.headers
         .get('content-type')
         ?.split(';', 1)[0]
         ?.trim()
         .toLowerCase();
-    if (!response.body)
+    if (!response.body) {
+        finalize();
         return response;
+    }
     if (mediaType === 'application/json' || mediaType?.endsWith('+json')) {
-        const stream = createJsonToolNameStream(response.body);
+        const stream = finalizeStream(createBoundedJsonToolNameStream(response.body, TOOL_PREFIX, (alias) => aliases.decode(alias)), finalize);
         const headers = headersAfterBodyTransform(response.headers);
         return new Response(stream, {
             status: response.status,
@@ -514,63 +829,11 @@ export function createStrippedStream(response) {
             headers,
         });
     }
-    if (mediaType !== 'text/event-stream')
+    if (mediaType !== 'text/event-stream') {
+        finalize();
         return response;
-    const decoder = new TextDecoder();
-    const encoder = new TextEncoder();
-    let pending = new Uint8Array(0);
-    let pendingLength = 0;
-    const appendPending = (bytes) => {
-        const requiredLength = pendingLength + bytes.byteLength;
-        if (requiredLength > MAX_SSE_LINE_BYTES) {
-            throw new Error(`SSE line exceeds ${MAX_SSE_LINE_BYTES} byte limit`);
-        }
-        if (requiredLength > pending.byteLength) {
-            let capacity = Math.max(1024, pending.byteLength);
-            while (capacity < requiredLength) {
-                capacity = Math.min(MAX_SSE_LINE_BYTES, capacity * 2);
-            }
-            const expanded = new Uint8Array(capacity);
-            expanded.set(pending.subarray(0, pendingLength));
-            pending = expanded;
-        }
-        pending.set(bytes, pendingLength);
-        pendingLength = requiredLength;
-    };
-    const stream = response.body.pipeThrough(new TransformStream({
-        transform(chunk, controller) {
-            let lastLineBreak = -1;
-            let lineLength = pendingLength;
-            for (let index = 0; index < chunk.byteLength; index++) {
-                if (chunk[index] === 0x0a || chunk[index] === 0x0d) {
-                    lastLineBreak = index;
-                    lineLength = 0;
-                }
-                else {
-                    lineLength++;
-                    if (lineLength > MAX_SSE_LINE_BYTES) {
-                        throw new Error(`SSE line exceeds ${MAX_SSE_LINE_BYTES} byte limit`);
-                    }
-                }
-            }
-            if (lastLineBreak < 0) {
-                appendPending(chunk);
-                return;
-            }
-            const completeLines = decoder.decode(pending.subarray(0, pendingLength), {
-                stream: true,
-            }) + decoder.decode(chunk.subarray(0, lastLineBreak + 1));
-            pendingLength = 0;
-            appendPending(chunk.subarray(lastLineBreak + 1));
-            controller.enqueue(encoder.encode(stripToolPrefix(completeLines)));
-        },
-        flush(controller) {
-            const trailing = decoder.decode(pending.subarray(0, pendingLength));
-            if (trailing) {
-                controller.enqueue(encoder.encode(stripToolPrefix(trailing)));
-            }
-        },
-    }));
+    }
+    const stream = finalizeStream(createBoundedSseToolNameStream(response.body, aliases), finalize);
     const headers = headersAfterBodyTransform(response.headers);
     return new Response(stream, {
         status: response.status,