@gajae-code/ai 0.18.8 → 0.18.9

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 ## [Unreleased]
 
+## [0.18.9] - 2026-10-11
+
+### Fixed
+
+- Exclude Claude Code and OAuth beta headers from API-key requests so subscription-provided API credits can be used, while preserving OAuth headers and feature betas.
+
+- Anthropic API-key requests no longer send the Claude Code `X-App: cli` marker, and Anthropic API-key model discovery (`/v1/models`) no longer sends the Claude Code beta list (`claude-code-20250219`, `oauth-2025-04-20`, …). Anthropic classified requests carrying these markers as Claude Code usage, which excluded them from API credit grants such as the Max plan's monthly API credit. OAuth requests are unchanged.
+
+- Finalize all outstanding SQLite auth statements on close, including usage-fetch leases, so Windows releases database file handles immediately.
+
+- Auth broker credential requests do not follow redirects, so a 307 or 308 cannot replay the JSON body to another host.
+
+- Preserve bounded terminal errors when Codex Responses times out mid-tool-call by dropping unvalidated partial arguments, retaining the call identity, and reporting `request_timeout`.
+
+- A project `.env` can no longer add Foundry request headers through `ANTHROPIC_CUSTOM_HEADERS`.
+
+- A project `.env` can no longer choose the Foundry CA or mTLS client certificate, including when the declaration uses `$` or backticks, and later deleting that file or changing directory does not turn the loaded value into an operator setting.
+
+- A tokenless auth gateway rejects data requests whose Host header is not the loopback bind.
+
+- HTTP 400 request dumps redact `x-goog-api-key` and `cf-aig-authorization` before the dump JSON is written, and the dump file is created owner-readable only.
+
+- Finalize cached SQLite statements when closing the shared model cache so Windows releases its database file handle before temporary roots are removed.
+
 ## [0.18.8] - 2026-10-08
 
 ### Added

package/dist/types/utils/parse-bind.d.ts

@@ -25,8 +25,11 @@ export declare function isLoopbackHostname(hostname: string): boolean;
  */
 export declare function assertAuthenticatedOrLoopback(bind: ParsedBind, bearerTokenCount: number, serverName: string): void;
 /**
- * Tokenless loopback brokers accept a request only when its Host header is the
- * bound hostname and port. A DNS-rebound same-origin GET sends the attacker's
- * name and no Origin header.
+ * Tokenless loopback servers accept a request only when its Host header is the
+ * bound hostname and effective port. Default-port forms that stay allowed:
+ * a Host with no port, or an explicit :80, on an HTTP listener on port 80;
+ * an explicit :443 on a listener on port 443. Any other omitted port is
+ * rejected. A DNS-rebound same-origin GET sends the attacker's name and no
+ * Origin header.
  */
 export declare function hostHeaderMatchesBind(hostHeader: string | null, bind: ParsedBind): boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.18.8",
+	"version": "0.18.9",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -41,8 +41,8 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/natives": "0.18.8",
-		"@gajae-code/utils": "0.18.8",
+		"@gajae-code/natives": "0.18.9",
+		"@gajae-code/utils": "0.18.9",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-broker/client.ts

@@ -421,6 +421,7 @@ export class AuthBrokerClient {
 					headers,
 					body: payload,
 					signal,
+					redirect: "error",
 				});
 				if (!response.ok && response.status !== 304) {
 					const text = await response.text();

package/src/auth-gateway/server.ts

@@ -39,7 +39,7 @@ import type {
 	SimpleStreamOptions,
 } from "../types";
 import { beginAttempt, classifyFallbackTrigger } from "../utils/fallback-transport";
-import { assertAuthenticatedOrLoopback, parseBind } from "../utils/parse-bind";
+import { assertAuthenticatedOrLoopback, hostHeaderMatchesBind, parseBind } from "../utils/parse-bind";
 import { REPETITION_GUARD_ERROR_CODE } from "../utils/stream-repetition-guard";
 import {
 	captureRequestHeaders,
@@ -1281,6 +1281,7 @@ export function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServe
 	assertAuthenticatedOrLoopback(bind, tokens.size, "auth-gateway");
 	const version = opts.version;
 
+	let listenPort = bind.port;
 	const server = Bun.serve({
 		hostname: bind.hostname,
 		port: bind.port,
@@ -1297,6 +1298,19 @@ export function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServe
 				});
 				return json(403, { error: "no-auth rejects requests carrying Origin" });
 			}
+			if (
+				tokens.size === 0 &&
+				!(req.method === "GET" && pathname === "/healthz") &&
+				!hostHeaderMatchesBind(req.headers.get("host"), { hostname: bind.hostname, port: listenPort })
+			) {
+				logger.info("auth-gateway no-auth host rejected", {
+					method: req.method,
+					path: pathname,
+					peer,
+					hostPresent: req.headers.has("host"),
+				});
+				return json(403, { error: "no-auth rejects a host that is not the loopback bind" });
+			}
 			// CORS preflight is always answered without auth — browsers send
 			// preflights pre-authentication and a 401 here breaks the actual
 			// request before the bearer is ever attached.
@@ -1391,8 +1405,9 @@ export function startAuthGateway(opts: AuthGatewayBootOptions): AuthGatewayServe
 		idleTimeout: 255,
 	});
 
+	listenPort = server.port ?? listenPort;
 	const boundHost = server.hostname ?? bind.hostname;
-	const boundPort = server.port ?? bind.port;
+	const boundPort = server.port ?? listenPort;
 	return {
 		url: `http://${boundHost}:${boundPort}`,
 		port: boundPort,

package/src/auth-storage.ts

@@ -8281,8 +8281,10 @@ export class SqliteAuthCredentialStore implements AuthCredentialStore {
 		this.#getCacheStmt.finalize();
 		this.#getCacheIncludingExpiredStmt.finalize();
 		this.#upsertCacheStmt.finalize();
+		this.#claimUsageFetchLeaseStmt.finalize();
+		this.#releaseUsageFetchLeaseStmt.finalize();
 		this.#deleteCachePrefixStmt.finalize();
 		this.#deleteExpiredCacheStmt.finalize();
-		this.#db.close();
+		this.#db.close(true);
 	}
 }

package/src/model-cache.ts

@@ -77,7 +77,7 @@ function getDb(dbPath?: string): Database {
 export function closeModelCache(dbPath?: string): boolean {
 	const resolvedPath = dbPath ?? getModelDbPath();
 	if (!sharedDb || sharedDbPath !== resolvedPath) return false;
-	sharedDb.close();
+	sharedDb.close(true);
 	sharedDb = null;
 	sharedDbPath = null;
 	return true;

package/src/provider-models/openai-compat.ts

@@ -148,9 +148,11 @@ function buildAnthropicDiscoveryHeaders(apiKey: string): Record<string, string>
 	const headers: Record<string, string> = {
 		"anthropic-version": "2023-06-01",
 		"anthropic-dangerous-direct-browser-access": "true",
-		"anthropic-beta": ANTHROPIC_OAUTH_BETA,
 	};
 	if (oauthToken) {
+		// Claude Code identity betas are OAuth-only; API-key requests carrying them are
+		// classified as Claude Code usage and excluded from API credit grants.
+		headers["anthropic-beta"] = ANTHROPIC_OAUTH_BETA;
 		headers.Authorization = `Bearer ${apiKey}`;
 	} else {
 		headers["x-api-key"] = apiKey;

package/src/providers/anthropic.ts

@@ -19,7 +19,9 @@ import {
 	isUnexpectedSocketCloseMessage,
 	logger,
 	readSseEvents,
+	startupProjectEnvSnapshot,
 } from "@gajae-code/utils";
+import { canonicalEnvKey, type ProjectEnvSnapshot } from "@gajae-code/utils/env-file";
 import {
 	anthropicProviderDiagnosticFromError,
 	anthropicProviderDiagnosticFromSseErrorData,
@@ -167,12 +169,8 @@ export function buildBetaHeader(baseBetas: string[], extraBetas: string[]): stri
 	return result.join(",");
 }
 
-const claudeCodeBetaDefaults = [
-	"claude-code-20250219",
-	"oauth-2025-04-20",
-	"context-management-2025-06-27",
-	"prompt-caching-scope-2026-01-05",
-];
+const featureBetaDefaults = ["context-management-2025-06-27", "prompt-caching-scope-2026-01-05"];
+const claudeCodeBetaDefaults = ["claude-code-20250219", "oauth-2025-04-20", ...featureBetaDefaults];
 const fineGrainedToolStreamingBeta = "fine-grained-tool-streaming-2025-05-14";
 const interleavedThinkingBeta = "interleaved-thinking-2025-05-14";
 const fastModeBeta = "fast-mode-2026-02-01";
@@ -207,6 +205,12 @@ const sharedHeaders = {
 	"Content-Type": "application/json",
 	"Anthropic-Version": "2023-06-01",
 	"Anthropic-Dangerous-Direct-Browser-Access": "true",
+};
+
+// Claude Code client marker. Like the claude-code/oauth betas it is sent only with
+// OAuth credentials: Anthropic classifies API-key requests carrying it as Claude
+// Code usage, which excludes them from API credit grants.
+const claudeCodeAppHeaders = {
 	"X-App": "cli",
 };
 
@@ -275,7 +279,7 @@ export function buildAnthropicHeaders(options: AnthropicHeaderOptions): Record<s
 	const oauthToken = options.isOAuth ?? isAnthropicOAuthToken(options.apiKey);
 	const extraBetas = options.extraBetas ?? [];
 	const stream = options.stream ?? false;
-	const betaHeader = buildBetaHeader(claudeCodeBetaDefaults, extraBetas);
+	const betaHeader = buildBetaHeader(oauthToken ? claudeCodeBetaDefaults : featureBetaDefaults, extraBetas);
 	const acceptHeader = stream ? "text/event-stream" : "application/json";
 	const modelHeaders = Object.fromEntries(
 		Object.entries(options.modelHeaders ?? {}).filter(([key]) => !enforcedHeaderKeys.has(key.toLowerCase())),
@@ -302,6 +306,7 @@ export function buildAnthropicHeaders(options: AnthropicHeaderOptions): Record<s
 			Accept: acceptHeader,
 			Authorization: `Bearer ${options.apiKey}`,
 			...sharedHeaders,
+			...claudeCodeAppHeaders,
 			"Anthropic-Beta": betaHeader,
 			"User-Agent": userAgent,
 		};
@@ -1241,13 +1246,76 @@ function parseAnthropicCustomHeaders(rawHeaders: string | undefined): Record<str
 function resolveAnthropicCustomHeaders(model: Model<"anthropic-messages">): Record<string, string> | undefined {
 	if (model.provider !== "anthropic") return undefined;
 	if (!isFoundryEnabled()) return undefined;
-	return parseAnthropicCustomHeaders($env.ANTHROPIC_CUSTOM_HEADERS);
+	return parseAnthropicCustomHeaders(
+		trustedFoundryHeaderValue("ANTHROPIC_CUSTOM_HEADERS", startupProjectEnvSnapshot()),
+	);
 }
 
 function looksLikeFilePath(value: string): boolean {
 	return value.includes("/") || value.includes("\\") || /\.(pem|crt|cer|key)$/i.test(value);
 }
 
+/**
+ * Bun turns `\n` and `\r` inside double-quoted dotenv values into control
+ * characters before they reach `process.env`. The project snapshot keeps the
+ * source text, so a literal compare would miss that rewrite.
+ */
+function unescapeProjectDotenvControls(value: string): string {
+	let decoded = "";
+	for (let index = 0; index < value.length; index++) {
+		const current = value[index];
+		const next = value[index + 1];
+		if (current === "\\" && next === "n") {
+			decoded += "\n";
+			index++;
+			continue;
+		}
+		if (current === "\\" && next === "r") {
+			decoded += "\r";
+			index++;
+			continue;
+		}
+		decoded += current ?? "";
+	}
+	return decoded;
+}
+
+/**
+ * Operator environment only. `$env` already contains the project dotenv, and a
+ * value equal to that declaration — or produced from a `$` / backtick
+ * declaration — must not become the Foundry trust anchor or client identity.
+ */
+function trustedFoundryTlsValue(name: string, snapshot: ProjectEnvSnapshot): string | undefined {
+	const raw = $env[name];
+	if (!raw) return undefined;
+	const key = canonicalEnvKey(name);
+	const declared = snapshot.values[key];
+	if (
+		declared !== undefined &&
+		(snapshot.dynamic.has(key) || declared === raw || unescapeProjectDotenvControls(declared) === raw)
+	) {
+		return undefined;
+	}
+	return raw;
+}
+
+/**
+ * Operator environment only, for Foundry request headers.
+ *
+ * A `$` / backtick declaration, or a value equal to the project declaration,
+ * is ignored. Literal `\n` in that declaration is not decoded: Bun decodes it
+ * only inside double quotes, and decoding every declaration would also drop
+ * an operator value that is a real newline.
+ */
+function trustedFoundryHeaderValue(name: string, snapshot: ProjectEnvSnapshot): string | undefined {
+	const raw = $env[name];
+	if (!raw) return undefined;
+	const key = canonicalEnvKey(name);
+	const declared = snapshot.values[key];
+	if (declared !== undefined && (snapshot.dynamic.has(key) || declared === raw)) return undefined;
+	return raw;
+}
+
 function resolvePemValue(value: string | undefined, name: string): string | undefined {
 	const trimmed = value?.trim();
 	if (!trimmed) return undefined;
@@ -1275,9 +1343,13 @@ function resolveFoundryTlsOptions(model: Model<"anthropic-messages">): FoundryTl
 	if (model.provider !== "anthropic") return undefined;
 	if (!isFoundryEnabled()) return undefined;
 
-	const ca = resolvePemValue($env.NODE_EXTRA_CA_CERTS, "NODE_EXTRA_CA_CERTS");
-	const cert = resolvePemValue($env.CLAUDE_CODE_CLIENT_CERT, "CLAUDE_CODE_CLIENT_CERT");
-	const key = resolvePemValue($env.CLAUDE_CODE_CLIENT_KEY, "CLAUDE_CODE_CLIENT_KEY");
+	const projectEnv = startupProjectEnvSnapshot();
+	const ca = resolvePemValue(trustedFoundryTlsValue("NODE_EXTRA_CA_CERTS", projectEnv), "NODE_EXTRA_CA_CERTS");
+	const cert = resolvePemValue(
+		trustedFoundryTlsValue("CLAUDE_CODE_CLIENT_CERT", projectEnv),
+		"CLAUDE_CODE_CLIENT_CERT",
+	);
+	const key = resolvePemValue(trustedFoundryTlsValue("CLAUDE_CODE_CLIENT_KEY", projectEnv), "CLAUDE_CODE_CLIENT_KEY");
 
 	if ((cert && !key) || (!cert && key)) {
 		throw new Error("Both CLAUDE_CODE_CLIENT_CERT and CLAUDE_CODE_CLIENT_KEY must be set for mTLS.");

package/src/providers/openai-codex-responses.ts

@@ -2779,6 +2779,11 @@ async function handleCodexStreamFailure(
 	error: unknown,
 ): Promise<AssistantMessage> {
 	const { output } = context;
+	// Preserve failed-call identities for diagnostics, but not their unvalidated
+	// arguments: a stalled call can otherwise make the terminal error oversized.
+	for (const block of output.content) {
+		if (block.type === "toolCall" && "partialJson" in block) block.arguments = {};
+	}
 	removeTransientBlockIndices(output);
 	if (context.requestContext.websocketState) {
 		resetCodexWebSocketAppendState(context.requestContext.websocketState);
@@ -2794,6 +2799,7 @@ async function handleCodexStreamFailure(
 		codexError !== undefined && CODEX_TYPED_TRANSPORT_PROVIDER_CODES.has(codexError.code ?? "")
 			? codexError.code
 			: undefined;
+	if (codexError?.code === "request_timeout") output.errorCode = codexError.code;
 	output.transportFailure = typedProviderCode
 		? explicitTerminalVeto
 			? undefined

package/src/utils/http-inspector.ts

@@ -26,7 +26,16 @@ type ErrorWithStatus = {
 	status?: unknown;
 };
 
-const SENSITIVE_HEADERS = ["authorization", "x-api-key", "api-key", "cookie", "set-cookie", "proxy-authorization"];
+const SENSITIVE_HEADERS = [
+	"authorization",
+	"x-api-key",
+	"api-key",
+	"cookie",
+	"set-cookie",
+	"proxy-authorization",
+	"x-goog-api-key",
+	"cf-aig-authorization",
+];
 
 /**
  * Connection-level failure codes, meaning the request never reached the
@@ -162,7 +171,8 @@ export async function appendRawHttpRequestDumpFor400(
 	const filePath = path.join(dumpDir, fileName);
 
 	try {
-		await Bun.write(filePath, `${JSON.stringify(sanitizedDump, null, 2)}\n`);
+		await fs.mkdir(dumpDir, { recursive: true });
+		await fs.writeFile(filePath, `${JSON.stringify(sanitizedDump, null, 2)}\n`, { mode: 0o600 });
 		await pruneHttpRequestDumps(dumpDir);
 		return `${message}\nraw-http-request=${filePath}\n${RAW_HTTP_REQUEST_PRIVACY_NOTE}`;
 	} catch (writeError) {

package/src/utils/parse-bind.ts

@@ -87,18 +87,20 @@ function parseHostPort(raw: string): number | null {
 	return port;
 }
 
-/** Split an HTTP Host header into a hostname and an explicit port. */
-function parseHostHeader(value: string): { hostname: string; port: number } | null {
+/** Split an HTTP Host header into a hostname and an explicit port, if present. */
+function parseHostHeader(value: string): { hostname: string; port: number | null } | null {
 	if (value.startsWith("[")) {
 		const end = value.indexOf("]");
 		if (end <= 1) return null;
 		const rest = value.slice(end + 1);
+		if (rest.length === 0) return { hostname: value.slice(1, end), port: null };
 		if (!rest.startsWith(":")) return null;
 		const port = parseHostPort(rest.slice(1));
 		if (port === null) return null;
 		return { hostname: value.slice(1, end), port };
 	}
 	const colon = value.lastIndexOf(":");
+	if (colon === -1) return { hostname: value, port: null };
 	if (colon <= 0 || value.indexOf(":") !== colon) return null;
 	const port = parseHostPort(value.slice(colon + 1));
 	if (port === null) return null;
@@ -108,19 +110,24 @@ function parseHostHeader(value: string): { hostname: string; port: number } | nu
 }
 
 /**
- * Tokenless loopback brokers accept a request only when its Host header is the
- * bound hostname and port. A DNS-rebound same-origin GET sends the attacker's
- * name and no Origin header.
+ * Tokenless loopback servers accept a request only when its Host header is the
+ * bound hostname and effective port. Default-port forms that stay allowed:
+ * a Host with no port, or an explicit :80, on an HTTP listener on port 80;
+ * an explicit :443 on a listener on port 443. Any other omitted port is
+ * rejected. A DNS-rebound same-origin GET sends the attacker's name and no
+ * Origin header.
  */
 export function hostHeaderMatchesBind(hostHeader: string | null, bind: ParsedBind): boolean {
 	if (hostHeader === null) return false;
 	const trimmed = hostHeader.trim();
 	if (trimmed.length === 0 || /[\s@]/.test(trimmed)) return false;
 	const parsed = parseHostHeader(trimmed);
-	if (!parsed) return false;
+	if (!parsed || parsed.hostname.length === 0) return false;
+	const port = parsed.port ?? (bind.port === 80 ? 80 : null);
+	if (port === null) return false;
 	const bindHost = bind.hostname
 		.trim()
 		.toLowerCase()
 		.replace(/^\[|\]$/g, "");
-	return parsed.hostname.toLowerCase() === bindHost && parsed.port === bind.port;
+	return parsed.hostname.toLowerCase() === bindHost && port === bind.port;
 }