@juspay/neurolink 9.38.0 → 9.39.0

package/dist/server/routes/claudeProxyRoutes.js

@@ -9,6 +9,9 @@
  * provider/model pairs (e.g. "claude-sonnet-4-20250514" -> vertex/gemini-2.5-pro).
  * Without a router, models are passed through to the Anthropic provider.
  */
+import { readFile, access } from "node:fs/promises";
+import { join } from "node:path";
+import { homedir } from "node:os";
 import { parseClaudeRequest, serializeClaudeResponse, ClaudeStreamSerializer, buildClaudeError, generateToolUseId, } from "../../proxy/claudeFormat.js";
 import { logger } from "../../utils/logger.js";
 import { recordRequest, recordSuccess, recordError, recordCooldown, } from "../../proxy/usageStats.js";
@@ -81,6 +84,127 @@ function advancePrimaryIfCurrent(accountKey, enabledCount, primaryAccountKey) {
     primaryAccountIndex = (primaryAccountIndex + 1) % enabledCount;
 }
 // ---------------------------------------------------------------------------
+// OAuth polyfill helpers (extracted to reduce block nesting)
+// ---------------------------------------------------------------------------
+const snapshotCache = new Map();
+const SNAPSHOT_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Load a header snapshot captured from a real Claude Code session and apply
+ * any headers the client didn't send.  This makes non-Claude-Code requests
+ * (e.g. from Curator, custom apps) appear identical to Claude Code.
+ */
+async function applyHeaderSnapshot(headers, accountLabel) {
+    try {
+        // Sanitize accountLabel to prevent directory traversal
+        const safeLabel = accountLabel.replace(/[^a-zA-Z0-9._@-]/g, "_");
+        // Check cache first
+        const cached = snapshotCache.get(safeLabel);
+        if (cached && Date.now() - cached.loadedAt < SNAPSHOT_CACHE_TTL_MS) {
+            for (const [sk, sv] of Object.entries(cached.headers)) {
+                const lower = sk.toLowerCase();
+                if (typeof sv === "string" &&
+                    !headers[lower] &&
+                    !BLOCKED_UPSTREAM_HEADERS.has(lower) &&
+                    lower !== "authorization" &&
+                    lower !== "x-api-key") {
+                    headers[lower] = sv;
+                }
+            }
+            return;
+        }
+        const snapshotPath = join(homedir(), ".neurolink", "header-snapshots", `anthropic_${safeLabel}.json`);
+        try {
+            await access(snapshotPath);
+        }
+        catch {
+            return;
+        }
+        const snapshot = JSON.parse(await readFile(snapshotPath, "utf8"));
+        if (!snapshot.headers) {
+            return;
+        }
+        // Store in cache
+        snapshotCache.set(safeLabel, {
+            headers: snapshot.headers,
+            loadedAt: Date.now(),
+        });
+        for (const [sk, sv] of Object.entries(snapshot.headers)) {
+            const lower = sk.toLowerCase();
+            if (typeof sv === "string" &&
+                !headers[lower] &&
+                !BLOCKED_UPSTREAM_HEADERS.has(lower) &&
+                lower !== "authorization" &&
+                lower !== "x-api-key") {
+                headers[lower] = sv;
+            }
+        }
+    }
+    catch {
+        // Snapshot missing or corrupt — continue without it
+    }
+}
+/**
+ * Polyfill the request body for OAuth accounts.
+ * Claude Code injects a billing header, agent block, and metadata.user_id
+ * into the body.  Non-CC clients (Curator, custom apps) don't send these —
+ * Anthropic rejects without them.
+ */
+function polyfillOAuthBody(bodyStr, accountToken) {
+    try {
+        const parsed = JSON.parse(bodyStr);
+        // Billing header block (required by Anthropic for OAuth)
+        const randomHex = Math.random().toString(16).substring(2, 5);
+        const billingBlock = {
+            type: "text",
+            text: `x-anthropic-billing-header: cc_version=2.1.86.${randomHex}; cc_entrypoint=cli; cch=proxy;`,
+        };
+        const agentBlock = {
+            type: "text",
+            text: "You are a Claude agent, built on Anthropic's Claude Agent SDK.",
+        };
+        // Normalise system to array and prepend billing + agent
+        if (parsed.system) {
+            if (typeof parsed.system === "string") {
+                parsed.system = [{ type: "text", text: parsed.system }];
+            }
+            if (Array.isArray(parsed.system)) {
+                const hasBilling = parsed.system.some((b) => typeof b.text === "string" &&
+                    b.text.includes("x-anthropic-billing-header"));
+                const hasAgent = parsed.system.some((b) => typeof b.text === "string" && b.text.includes("Claude Agent SDK"));
+                const toInsert = [];
+                if (!hasBilling) {
+                    toInsert.push(billingBlock);
+                }
+                if (!hasAgent) {
+                    toInsert.push(agentBlock);
+                }
+                if (toInsert.length > 0) {
+                    parsed.system = [...toInsert, ...parsed.system];
+                }
+            }
+        }
+        else {
+            parsed.system = [billingBlock, agentBlock];
+        }
+        // Inject metadata.user_id (required for OAuth)
+        if (!parsed.metadata?.user_id) {
+            const tokenPrefix = accountToken.substring(0, Math.min(20, accountToken.length));
+            const hash = Array.from(new TextEncoder().encode(tokenPrefix))
+                .reduce((a, b) => ((a << 5) - a + b) | 0, 0)
+                .toString(16)
+                .replace("-", "");
+            parsed.metadata = {
+                ...parsed.metadata,
+                user_id: `proxy-${hash}`,
+            };
+        }
+        return JSON.stringify(parsed);
+    }
+    catch {
+        return bodyStr; // JSON parse failed — use original body
+    }
+}
+// ---------------------------------------------------------------------------
 // Legacy credential refresh helper (extracted to reduce block nesting)
 // ---------------------------------------------------------------------------
 async function tryLoadLegacyAccount(creds, legacyCredPath) {
@@ -158,17 +282,29 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                 handler: async (ctx) => {
                     const body = ctx.body;
                     // 1. Validate
-                    if (!body?.model || !body?.messages) {
+                    if (typeof body?.model !== "string" ||
+                        !Array.isArray(body?.messages)) {
                         return buildClaudeError(400, "Missing required fields: model, messages");
                     }
                     // 2. Resolve model via router (or pass through to anthropic)
+                    // Guard: without a model router, only Claude models are allowed.
+                    const modelLower = body.model.toLowerCase();
+                    if (!modelRouter && !modelLower.startsWith("claude-")) {
+                        return buildClaudeError(404, `Model '${body.model}' is not an Anthropic model. ` +
+                            `The proxy only supports Claude models. ` +
+                            `Use a model router to route non-Claude models to other providers.`);
+                    }
                     const route = modelRouter?.resolve(body.model) ?? {
                         provider: "anthropic",
                         model: body.model,
                     };
                     try {
                         // 3. Route based on target provider
-                        const isClaudeTarget = route.provider === "anthropic" || route.provider === null;
+                        if (route.provider === null) {
+                            return buildClaudeError(404, `Model '${body.model}' is not a Claude model. ` +
+                                `Use a model router to route it to another provider.`);
+                        }
+                        const isClaudeTarget = route.provider === "anthropic";
                         if (isClaudeTarget) {
                             // ─── PASSTHROUGH MODE (Claude → Claude) ───────────────
                             const fs = await import("fs");
@@ -435,27 +571,54 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                 headers["content-type"] = "application/json";
                                 if (isOAuth) {
                                     headers["authorization"] = `Bearer ${account.token}`;
+                                    delete headers["x-api-key"];
                                 }
                                 else {
                                     headers["x-api-key"] = account.token;
                                     delete headers["authorization"];
                                 }
-                                // Defaults: only set when client didn't send them
+                                // Apply header snapshot defaults for OAuth accounts
+                                if (isOAuth) {
+                                    await applyHeaderSnapshot(headers, account.label);
+                                }
+                                // Hard defaults for anything still missing
                                 if (!headers["user-agent"]) {
-                                    headers["user-agent"] = "claude-cli/2.1.80 (external, cli)";
+                                    headers["user-agent"] = "claude-cli/2.1.86 (external, cli)";
                                 }
                                 if (!headers["anthropic-version"]) {
                                     headers["anthropic-version"] = "2023-06-01";
                                 }
-                                // Ensure oauth beta is always present in the beta list
-                                const existingBetas = headers["anthropic-beta"] ?? "";
-                                if (!existingBetas) {
-                                    headers["anthropic-beta"] = "oauth-2025-04-20";
+                                if (!headers["anthropic-dangerous-direct-browser-access"]) {
+                                    headers["anthropic-dangerous-direct-browser-access"] = "true";
+                                }
+                                // Manage anthropic-beta header based on auth type.
+                                // OAuth requires specific betas; API-key must NOT carry them.
+                                if (isOAuth) {
+                                    const existing = new Set((headers["anthropic-beta"] ?? "")
+                                        .split(",")
+                                        .map((s) => s.trim())
+                                        .filter(Boolean));
+                                    existing.add("oauth-2025-04-20");
+                                    existing.add("claude-code-20250219");
+                                    headers["anthropic-beta"] = [...existing].join(",");
                                 }
-                                else if (!existingBetas.includes("oauth")) {
-                                    headers["anthropic-beta"] =
-                                        `${existingBetas},oauth-2025-04-20`;
+                                else {
+                                    // Strip OAuth-specific betas that may have leaked from client
+                                    const cleaned = (headers["anthropic-beta"] ?? "")
+                                        .split(",")
+                                        .map((s) => s.trim())
+                                        .filter((s) => s && s !== "oauth-2025-04-20")
+                                        .join(",");
+                                    if (cleaned) {
+                                        headers["anthropic-beta"] = cleaned;
+                                    }
+                                    else {
+                                        delete headers["anthropic-beta"];
+                                    }
                                 }
+                                // Polyfill request body for OAuth accounts
+                                const buildUpstreamBody = () => isOAuth ? polyfillOAuthBody(bodyStr, account.token) : bodyStr;
+                                const finalBodyStr = buildUpstreamBody();
                                 logger.always(`[proxy] → account=${account.label} (${account.type})`);
                                 recordRequest(account.label, account.type);
                                 // Log full request for debugging (written to ~/.neurolink/logs/proxy-debug-*.jsonl)
@@ -465,7 +628,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                     response = await fetch(url, {
                                         method: "POST",
                                         headers,
-                                        body: bodyStr,
+                                        body: finalBodyStr,
                                         signal: AbortSignal.timeout(UPSTREAM_FETCH_TIMEOUT_MS),
                                     });
                                 }
@@ -497,6 +660,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                         }
                                         else {
                                             const date = new Date(retryAfter);
+                                            // eslint-disable-next-line max-depth
                                             if (!Number.isNaN(date.getTime())) {
                                                 cooldownMs = Math.max(date.getTime() - Date.now(), 1000);
                                             }
@@ -530,12 +694,14 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                             authRetryError = `refresh failed for account=${account.label} attempt ${authRetry + 1}/${MAX_AUTH_RETRIES}: ${refreshSucceeded.error?.slice(0, 200) ?? "unknown"}`;
                                             lastError = authRetryError;
                                             logger.always(`[proxy] ⚠ account=${account.label} refresh failed on attempt ${authRetry + 1}`);
+                                            // eslint-disable-next-line max-depth
                                             if (accountState.consecutiveRefreshFailures >=
                                                 MAX_CONSECUTIVE_REFRESH_FAILURES) {
                                                 await disableAccountUntilReauth(account, accountState);
                                                 authFailureMessage = formatReauthMessage(account.label);
                                                 break;
                                             }
+                                            // eslint-disable-next-line max-depth
                                             if (authRetry < MAX_AUTH_RETRIES - 1) {
                                                 await sleep(2000);
                                             }
@@ -549,9 +715,10 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                             const retryResp = await fetch(url, {
                                                 method: "POST",
                                                 headers,
-                                                body: bodyStr,
+                                                body: buildUpstreamBody(),
                                                 signal: AbortSignal.timeout(UPSTREAM_FETCH_TIMEOUT_MS),
                                             });
+                                            // eslint-disable-next-line max-depth
                                             if (retryResp.ok) {
                                                 authRetrySucceeded = true;
                                                 accountState.consecutiveRefreshFailures = 0;
@@ -647,6 +814,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                             lastError = retryBody;
                                             logger.debug(`[proxy] retry ${authRetry + 1} failed: ${retryStatus} ${retryBody.substring(0, 120)}`);
                                             recordError(account.label, account.type, retryStatus);
+                                            // eslint-disable-next-line max-depth
                                             if (retryStatus === 429) {
                                                 sawRateLimit = true;
                                                 const retryAfter = retryResp.headers.get("retry-after");
@@ -659,6 +827,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                                 recordCooldown(account.label, account.type, accountState.coolingUntil, accountState.backoffLevel);
                                                 break;
                                             }
+                                            // eslint-disable-next-line max-depth
                                             if (retryStatus === 401 ||
                                                 retryStatus === 402 ||
                                                 retryStatus === 403) {
@@ -668,12 +837,14 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                                 }
                                                 continue;
                                             }
+                                            // eslint-disable-next-line max-depth
                                             if (isTransientHttpFailure(retryStatus, retryBody)) {
                                                 // Decision 8: No cooldown for transient errors — rotate immediately
                                                 sawTransientFailure = true;
                                                 break;
                                             }
                                             logAttempt(retryStatus, "api_error", summarizeErrorMessage(retryBody));
+                                            // eslint-disable-next-line max-depth
                                             try {
                                                 return JSON.parse(retryBody);
                                             }
@@ -695,7 +866,9 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                         }
                                     }
                                     if (!authRetrySucceeded) {
+                                        // eslint-disable-next-line max-depth
                                         if (!accountState.permanentlyDisabled) {
+                                            // eslint-disable-next-line max-depth
                                             if (!accountState.coolingUntil ||
                                                 accountState.coolingUntil <= Date.now()) {
                                                 accountState.coolingUntil =
@@ -953,6 +1126,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                             "anthropic-ratelimit-tokens-limit",
                                         ]) {
                                             const val = response.headers.get(h);
+                                            // eslint-disable-next-line max-depth
                                             if (val) {
                                                 responseHeaders[h] = val;
                                             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@juspay/neurolink",
-  "version": "9.38.0",
+  "version": "9.39.0",
   "description": "Universal AI Development Platform with working MCP integration, multi-provider support, and professional CLI. Built-in tools operational, 58+ external MCP servers discoverable. Connect to filesystem, GitHub, database operations, and more. Build, test, and deploy AI applications with 13 providers: OpenAI, Anthropic, Google AI, AWS Bedrock, Azure, Hugging Face, Ollama, and Mistral AI.",
   "author": {
     "name": "Juspay Technologies",