@juspay/neurolink 9.38.0 → 9.40.0

package/dist/lib/models/anthropicModels.d.ts

@@ -20,8 +20,10 @@ export declare enum AnthropicModel {
     CLAUDE_3_5_SONNET = "claude-3-5-sonnet-20241022",
     CLAUDE_3_5_SONNET_V2 = "claude-3-5-sonnet-v2-20241022",
     CLAUDE_SONNET_4 = "claude-sonnet-4-20250514",
+    CLAUDE_SONNET_4_6 = "claude-sonnet-4-6",
     CLAUDE_3_OPUS = "claude-3-opus-20240229",
-    CLAUDE_OPUS_4 = "claude-opus-4-20250514"
+    CLAUDE_OPUS_4 = "claude-opus-4-20250514",
+    CLAUDE_OPUS_4_6 = "claude-opus-4-6"
 }
 /**
  * Model access mapping by subscription tier

package/dist/lib/models/anthropicModels.js

@@ -27,10 +27,14 @@ export var AnthropicModel;
     AnthropicModel["CLAUDE_3_5_SONNET_V2"] = "claude-3-5-sonnet-v2-20241022";
     // Claude Sonnet 4 (Latest Sonnet)
     AnthropicModel["CLAUDE_SONNET_4"] = "claude-sonnet-4-20250514";
+    // Claude Sonnet 4.6
+    AnthropicModel["CLAUDE_SONNET_4_6"] = "claude-sonnet-4-6";
     // Claude 3 Opus (Legacy flagship)
     AnthropicModel["CLAUDE_3_OPUS"] = "claude-3-opus-20240229";
     // Claude Opus 4 (Latest flagship)
     AnthropicModel["CLAUDE_OPUS_4"] = "claude-opus-4-20250514";
+    // Claude Opus 4.6
+    AnthropicModel["CLAUDE_OPUS_4_6"] = "claude-opus-4-6";
 })(AnthropicModel || (AnthropicModel = {}));
 // ============================================================================
 // MODEL TIER ACCESS DEFINITIONS
@@ -56,6 +60,7 @@ export const MODEL_TIER_ACCESS = {
         AnthropicModel.CLAUDE_3_5_SONNET,
         AnthropicModel.CLAUDE_3_5_SONNET_V2,
         AnthropicModel.CLAUDE_SONNET_4,
+        AnthropicModel.CLAUDE_SONNET_4_6,
     ],
     // Max tier: All models including Opus
     max: ["*"], // All models
@@ -167,6 +172,32 @@ export const MODEL_METADATA = {
         family: "opus",
         description: "Latest flagship model with advanced reasoning",
     },
+    // Claude Sonnet 4.6
+    [AnthropicModel.CLAUDE_SONNET_4_6]: {
+        displayName: "Claude Sonnet 4.6",
+        contextWindow: 1000000,
+        maxOutputTokens: 64000,
+        supportsVision: true,
+        supportsExtendedThinking: true,
+        supportsToolUse: true,
+        supportsStreaming: true,
+        deprecated: false,
+        family: "sonnet",
+        description: "Claude 4.6 Sonnet with 1M context window",
+    },
+    // Claude Opus 4.6
+    [AnthropicModel.CLAUDE_OPUS_4_6]: {
+        displayName: "Claude Opus 4.6",
+        contextWindow: 1000000,
+        maxOutputTokens: 64000,
+        supportsVision: true,
+        supportsExtendedThinking: true,
+        supportsToolUse: true,
+        supportsStreaming: true,
+        deprecated: false,
+        family: "opus",
+        description: "Claude 4.6 Opus flagship with 1M context window",
+    },
 };
 // ============================================================================
 // DEFAULT MODELS BY TIER
@@ -417,11 +448,16 @@ export function getLatestModelsByFamily() {
     const familyPriority = {
         haiku: [AnthropicModel.CLAUDE_3_5_HAIKU, AnthropicModel.CLAUDE_3_HAIKU],
         sonnet: [
+            AnthropicModel.CLAUDE_SONNET_4_6,
             AnthropicModel.CLAUDE_SONNET_4,
             AnthropicModel.CLAUDE_3_5_SONNET_V2,
             AnthropicModel.CLAUDE_3_5_SONNET,
         ],
-        opus: [AnthropicModel.CLAUDE_OPUS_4, AnthropicModel.CLAUDE_3_OPUS],
+        opus: [
+            AnthropicModel.CLAUDE_OPUS_4_6,
+            AnthropicModel.CLAUDE_OPUS_4,
+            AnthropicModel.CLAUDE_3_OPUS,
+        ],
     };
     for (const family of Object.keys(familyPriority)) {
         for (const model of familyPriority[family]) {

package/dist/lib/neurolink.d.ts

@@ -181,6 +181,10 @@ export declare class NeuroLink {
     private registerMemoryRetrievalTools;
     /** Format memory context for prompt inclusion */
     private formatMemoryContext;
+    /**
+     * Format memory context from multiple users into a labeled block.
+     */
+    private formatMultiUserMemoryContext;
     /**
      * Determine whether memory should be read (retrieved) for this call.
      * Respects both the global memory SDK config and per-call overrides.
@@ -192,13 +196,14 @@ export declare class NeuroLink {
      */
     private shouldWriteMemory;
     /**
-     * Retrieve condensed memory for a user.
+     * Retrieve condensed memory for a user (and optionally additional users).
      * Returns the input text enhanced with memory context, or unchanged if no memory.
      */
     private retrieveMemory;
     /**
      * Store a conversation turn in memory (non-blocking).
      * Calls add(userId, content) which internally condenses old + new via LLM.
+     * Supports additional users with per-user prompt and maxWords overrides.
      */
     private storeMemoryInBackground;
     /**

package/dist/lib/neurolink.js

@@ -823,6 +823,20 @@ export class NeuroLink {
 
 ${memoryContext}
 
+Current user's request: ${currentInput}`;
+    }
+    /**
+     * Format memory context from multiple users into a labeled block.
+     */
+    formatMultiUserMemoryContext(memories, currentInput) {
+        const memoryBlocks = [];
+        for (const [label, memory] of memories) {
+            memoryBlocks.push(`[${label}]\n${memory}`);
+        }
+        return `Context from previous conversations:
+
+${memoryBlocks.join("\n\n")}
+
 Current user's request: ${currentInput}`;
     }
     /**
@@ -863,32 +877,71 @@ Current user's request: ${currentInput}`;
         return true;
     }
     /**
-     * Retrieve condensed memory for a user.
+     * Retrieve condensed memory for a user (and optionally additional users).
      * Returns the input text enhanced with memory context, or unchanged if no memory.
      */
-    async retrieveMemory(inputText, userId) {
+    async retrieveMemory(inputText, userId, additionalUsers) {
         const client = this.ensureMemoryReady();
         if (!client) {
             return inputText;
         }
-        const memory = await client.get(userId);
-        if (!memory) {
+        // Collect all user IDs to read (primary + additional users with read !== false)
+        const readableAdditional = (additionalUsers || []).filter((u) => u.read !== false);
+        if (readableAdditional.length === 0) {
+            // Single user — use original fast path
+            const memory = await client.get(userId);
+            if (!memory) {
+                return inputText;
+            }
+            return this.formatMemoryContext(memory, inputText);
+        }
+        // Multi-user: fetch all memories in parallel
+        // Build entries with labels for formatting
+        const entries = [
+            { id: userId, label: "User" },
+            ...readableAdditional.map((u) => ({
+                id: u.userId,
+                label: u.label || u.userId,
+            })),
+        ];
+        const results = await Promise.all(entries.map(async (entry) => {
+            const memory = await client.get(entry.id);
+            return { ...entry, memory };
+        }));
+        const memories = new Map();
+        for (const { label, memory } of results) {
+            if (memory) {
+                memories.set(label, memory);
+            }
+        }
+        if (memories.size === 0) {
             return inputText;
         }
-        return this.formatMemoryContext(memory, inputText);
+        return this.formatMultiUserMemoryContext(memories, inputText);
     }
     /**
      * Store a conversation turn in memory (non-blocking).
      * Calls add(userId, content) which internally condenses old + new via LLM.
+     * Supports additional users with per-user prompt and maxWords overrides.
      */
-    storeMemoryInBackground(originalPrompt, responseContent, userId) {
+    storeMemoryInBackground(originalPrompt, responseContent, userId, additionalUsers) {
         setImmediate(async () => {
             try {
                 const client = this.ensureMemoryReady();
-                if (client) {
-                    const content = `User: ${originalPrompt}\nAssistant: ${responseContent}`;
-                    await client.add(userId, content);
+                if (!client) {
+                    return;
                 }
+                const content = `User: ${originalPrompt}\nAssistant: ${responseContent}`;
+                // Collect all users to write: primary + additional users with write !== false
+                const writeOps = [client.add(userId, content)];
+                const writableAdditional = (additionalUsers || []).filter((u) => u.write !== false);
+                for (const user of writableAdditional) {
+                    const addOptions = user.prompt || user.maxWords
+                        ? { prompt: user.prompt, maxWords: user.maxWords }
+                        : undefined;
+                    writeOps.push(client.add(user.userId, content, addOptions));
+                }
+                await Promise.all(writeOps);
             }
             catch (error) {
                 logger.warn("Memory storage failed:", error);
@@ -2428,6 +2481,17 @@ Current user's request: ${currentInput}`;
                                 });
                             }
                         }
+                        // Memory retrieval for generate path
+                        if (this.shouldReadMemory(options.memory, options.context?.userId) &&
+                            options.context?.userId) {
+                            try {
+                                options.input.text = await this.retrieveMemory(options.input.text, options.context.userId, options.memory?.additionalUsers);
+                                logger.debug("Memory retrieval successful (generate)");
+                            }
+                            catch (error) {
+                                logger.warn("Memory retrieval failed (generate):", error);
+                            }
+                        }
                         // 🔧 CRITICAL FIX: Convert to TextGenerationOptions while preserving the input object for multimodal support
                         const baseOptions = {
                             prompt: options.input.text,
@@ -2613,7 +2677,7 @@ Current user's request: ${currentInput}`;
         // Memory storage
         if (this.shouldWriteMemory(options.memory, options.context?.userId, generateResult.content) &&
             options.context?.userId) {
-            this.storeMemoryInBackground(originalPrompt ?? "", generateResult.content.trim(), options.context.userId);
+            this.storeMemoryInBackground(originalPrompt ?? "", generateResult.content.trim(), options.context.userId, options.memory?.additionalUsers);
         }
     }
     /**
@@ -4411,7 +4475,7 @@ Current user's request: ${currentInput}`;
         if (this.shouldReadMemory(options.memory, options.context?.userId) &&
             options.context?.userId) {
             try {
-                options.input.text = await this.retrieveMemory(options.input.text, options.context.userId);
+                options.input.text = await this.retrieveMemory(options.input.text, options.context.userId, options.memory?.additionalUsers);
                 logger.debug("Memory retrieval successful");
             }
             catch (error) {
@@ -4724,7 +4788,7 @@ Current user's request: ${currentInput}`;
             }
         }
         if (this.shouldWriteMemory(enhancedOptions.memory, enhancedOptions.context?.userId, accumulatedContent)) {
-            this.storeMemoryInBackground(originalPrompt ?? "", accumulatedContent.trim(), enhancedOptions.context?.userId);
+            this.storeMemoryInBackground(originalPrompt ?? "", accumulatedContent.trim(), enhancedOptions.context?.userId, enhancedOptions.memory?.additionalUsers);
         }
     }
     /**

package/dist/lib/providers/anthropic.js

@@ -140,7 +140,24 @@ const detectSubscriptionTier = (oauthToken) => {
  * OAuth takes precedence over API key if both are available.
  */
 const detectAuthMethod = (oauthToken) => {
-    // OAuth takes precedence if available
+    // Explicit env var takes highest precedence — allows forcing api_key mode
+    // even when OAuth credentials exist (e.g., when using a proxy that handles auth)
+    const explicit = process.env.ANTHROPIC_AUTH_METHOD?.toLowerCase();
+    if (explicit === "api_key" || explicit === "apikey") {
+        logger.debug("[detectAuthMethod] Forced to api_key by ANTHROPIC_AUTH_METHOD env var");
+        return "api_key";
+    }
+    if (explicit === "oauth") {
+        if (oauthToken) {
+            logger.debug("[detectAuthMethod] Forced to oauth by ANTHROPIC_AUTH_METHOD env var");
+            return "oauth";
+        }
+        logger.warn("[detectAuthMethod] ANTHROPIC_AUTH_METHOD=oauth but no OAuth token found; falling through to auto-detection");
+    }
+    else if (explicit) {
+        logger.warn("[detectAuthMethod] Unrecognized ANTHROPIC_AUTH_METHOD value; falling through to auto-detection", { value: explicit });
+    }
+    // Auto-detect: OAuth takes precedence if available
     const method = oauthToken ? "oauth" : "api_key";
     logger.debug("[detectAuthMethod] Auth method resolved", {
         method,
@@ -200,11 +217,22 @@ export class AnthropicProvider extends BaseProvider {
     constructor(modelName, sdk, config) {
         // Pre-compute effective model with tier validation before calling super
         const oauthToken = config?.oauthToken ?? getOAuthToken();
-        const subscriptionTier = config?.subscriptionTier ?? detectSubscriptionTier(oauthToken);
+        // Resolve auth method FIRST so that tier detection uses the chosen method.
+        // If ANTHROPIC_AUTH_METHOD=api_key wins over an existing OAuth token, the
+        // tier must reflect api_key mode (full model access) rather than the OAuth
+        // token's subscription level.
+        const authMethod = config?.authMethod ?? detectAuthMethod(oauthToken);
+        const subscriptionTier = config?.subscriptionTier ??
+            (authMethod === "oauth" ? detectSubscriptionTier(oauthToken) : "api");
         const targetModel = modelName || getDefaultAnthropicModel();
-        // Determine effective model based on tier access
+        // Determine effective model based on tier access.
+        // Skip tier validation when a proxy is in use (ANTHROPIC_BASE_URL is set)
+        // — the proxy handles model access and auth, so the SDK should pass
+        // the requested model through without downgrading.
         let effectiveModel = targetModel;
-        if (subscriptionTier !== "api" &&
+        const usingProxy = !!process.env.ANTHROPIC_BASE_URL;
+        if (!usingProxy &&
+            subscriptionTier !== "api" &&
             !isModelAvailableForTier(targetModel, subscriptionTier)) {
             effectiveModel = getRecommendedModelForTier(subscriptionTier);
             logger.warn("Model not available for subscription tier, using recommended model", {
@@ -219,8 +247,8 @@ export class AnthropicProvider extends BaseProvider {
         // Store computed values
         this.oauthToken = oauthToken;
         this.subscriptionTier = subscriptionTier;
-        // Determine auth method - config takes precedence, then auto-detect
-        this.authMethod = config?.authMethod ?? detectAuthMethod(this.oauthToken);
+        // Use the auth method already resolved above (before tier computation)
+        this.authMethod = authMethod;
         // Build headers based on auth method and subscription tier
         const headers = this.getAuthHeaders();
         // Create Anthropic instance based on auth method
@@ -348,6 +376,10 @@ export class AnthropicProvider extends BaseProvider {
      * ```
      */
     validateModelAccess(model) {
+        // Proxy mode: bypass tier validation entirely — the proxy handles model access
+        if (process.env.ANTHROPIC_BASE_URL) {
+            return true;
+        }
         // API tier has access to all models
         if (this.subscriptionTier === "api") {
             return true;

package/dist/lib/server/routes/claudeProxyRoutes.js

@@ -9,6 +9,9 @@
  * provider/model pairs (e.g. "claude-sonnet-4-20250514" -> vertex/gemini-2.5-pro).
  * Without a router, models are passed through to the Anthropic provider.
  */
+import { readFile, access } from "node:fs/promises";
+import { join } from "node:path";
+import { homedir } from "node:os";
 import { parseClaudeRequest, serializeClaudeResponse, ClaudeStreamSerializer, buildClaudeError, generateToolUseId, } from "../../proxy/claudeFormat.js";
 import { logger } from "../../utils/logger.js";
 import { recordRequest, recordSuccess, recordError, recordCooldown, } from "../../proxy/usageStats.js";
@@ -81,6 +84,127 @@ function advancePrimaryIfCurrent(accountKey, enabledCount, primaryAccountKey) {
     primaryAccountIndex = (primaryAccountIndex + 1) % enabledCount;
 }
 // ---------------------------------------------------------------------------
+// OAuth polyfill helpers (extracted to reduce block nesting)
+// ---------------------------------------------------------------------------
+const snapshotCache = new Map();
+const SNAPSHOT_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Load a header snapshot captured from a real Claude Code session and apply
+ * any headers the client didn't send.  This makes non-Claude-Code requests
+ * (e.g. from Curator, custom apps) appear identical to Claude Code.
+ */
+async function applyHeaderSnapshot(headers, accountLabel) {
+    try {
+        // Sanitize accountLabel to prevent directory traversal
+        const safeLabel = accountLabel.replace(/[^a-zA-Z0-9._@-]/g, "_");
+        // Check cache first
+        const cached = snapshotCache.get(safeLabel);
+        if (cached && Date.now() - cached.loadedAt < SNAPSHOT_CACHE_TTL_MS) {
+            for (const [sk, sv] of Object.entries(cached.headers)) {
+                const lower = sk.toLowerCase();
+                if (typeof sv === "string" &&
+                    !headers[lower] &&
+                    !BLOCKED_UPSTREAM_HEADERS.has(lower) &&
+                    lower !== "authorization" &&
+                    lower !== "x-api-key") {
+                    headers[lower] = sv;
+                }
+            }
+            return;
+        }
+        const snapshotPath = join(homedir(), ".neurolink", "header-snapshots", `anthropic_${safeLabel}.json`);
+        try {
+            await access(snapshotPath);
+        }
+        catch {
+            return;
+        }
+        const snapshot = JSON.parse(await readFile(snapshotPath, "utf8"));
+        if (!snapshot.headers) {
+            return;
+        }
+        // Store in cache
+        snapshotCache.set(safeLabel, {
+            headers: snapshot.headers,
+            loadedAt: Date.now(),
+        });
+        for (const [sk, sv] of Object.entries(snapshot.headers)) {
+            const lower = sk.toLowerCase();
+            if (typeof sv === "string" &&
+                !headers[lower] &&
+                !BLOCKED_UPSTREAM_HEADERS.has(lower) &&
+                lower !== "authorization" &&
+                lower !== "x-api-key") {
+                headers[lower] = sv;
+            }
+        }
+    }
+    catch {
+        // Snapshot missing or corrupt — continue without it
+    }
+}
+/**
+ * Polyfill the request body for OAuth accounts.
+ * Claude Code injects a billing header, agent block, and metadata.user_id
+ * into the body.  Non-CC clients (Curator, custom apps) don't send these —
+ * Anthropic rejects without them.
+ */
+function polyfillOAuthBody(bodyStr, accountToken) {
+    try {
+        const parsed = JSON.parse(bodyStr);
+        // Billing header block (required by Anthropic for OAuth)
+        const randomHex = Math.random().toString(16).substring(2, 5);
+        const billingBlock = {
+            type: "text",
+            text: `x-anthropic-billing-header: cc_version=2.1.86.${randomHex}; cc_entrypoint=cli; cch=proxy;`,
+        };
+        const agentBlock = {
+            type: "text",
+            text: "You are a Claude agent, built on Anthropic's Claude Agent SDK.",
+        };
+        // Normalise system to array and prepend billing + agent
+        if (parsed.system) {
+            if (typeof parsed.system === "string") {
+                parsed.system = [{ type: "text", text: parsed.system }];
+            }
+            if (Array.isArray(parsed.system)) {
+                const hasBilling = parsed.system.some((b) => typeof b.text === "string" &&
+                    b.text.includes("x-anthropic-billing-header"));
+                const hasAgent = parsed.system.some((b) => typeof b.text === "string" && b.text.includes("Claude Agent SDK"));
+                const toInsert = [];
+                if (!hasBilling) {
+                    toInsert.push(billingBlock);
+                }
+                if (!hasAgent) {
+                    toInsert.push(agentBlock);
+                }
+                if (toInsert.length > 0) {
+                    parsed.system = [...toInsert, ...parsed.system];
+                }
+            }
+        }
+        else {
+            parsed.system = [billingBlock, agentBlock];
+        }
+        // Inject metadata.user_id (required for OAuth)
+        if (!parsed.metadata?.user_id) {
+            const tokenPrefix = accountToken.substring(0, Math.min(20, accountToken.length));
+            const hash = Array.from(new TextEncoder().encode(tokenPrefix))
+                .reduce((a, b) => ((a << 5) - a + b) | 0, 0)
+                .toString(16)
+                .replace("-", "");
+            parsed.metadata = {
+                ...parsed.metadata,
+                user_id: `proxy-${hash}`,
+            };
+        }
+        return JSON.stringify(parsed);
+    }
+    catch {
+        return bodyStr; // JSON parse failed — use original body
+    }
+}
+// ---------------------------------------------------------------------------
 // Legacy credential refresh helper (extracted to reduce block nesting)
 // ---------------------------------------------------------------------------
 async function tryLoadLegacyAccount(creds, legacyCredPath) {
@@ -158,17 +282,29 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                 handler: async (ctx) => {
                     const body = ctx.body;
                     // 1. Validate
-                    if (!body?.model || !body?.messages) {
+                    if (typeof body?.model !== "string" ||
+                        !Array.isArray(body?.messages)) {
                         return buildClaudeError(400, "Missing required fields: model, messages");
                     }
                     // 2. Resolve model via router (or pass through to anthropic)
+                    // Guard: without a model router, only Claude models are allowed.
+                    const modelLower = body.model.toLowerCase();
+                    if (!modelRouter && !modelLower.startsWith("claude-")) {
+                        return buildClaudeError(404, `Model '${body.model}' is not an Anthropic model. ` +
+                            `The proxy only supports Claude models. ` +
+                            `Use a model router to route non-Claude models to other providers.`);
+                    }
                     const route = modelRouter?.resolve(body.model) ?? {
                         provider: "anthropic",
                         model: body.model,
                     };
                     try {
                         // 3. Route based on target provider
-                        const isClaudeTarget = route.provider === "anthropic" || route.provider === null;
+                        if (route.provider === null) {
+                            return buildClaudeError(404, `Model '${body.model}' is not a Claude model. ` +
+                                `Use a model router to route it to another provider.`);
+                        }
+                        const isClaudeTarget = route.provider === "anthropic";
                         if (isClaudeTarget) {
                             // ─── PASSTHROUGH MODE (Claude → Claude) ───────────────
                             const fs = await import("fs");
@@ -435,27 +571,54 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                 headers["content-type"] = "application/json";
                                 if (isOAuth) {
                                     headers["authorization"] = `Bearer ${account.token}`;
+                                    delete headers["x-api-key"];
                                 }
                                 else {
                                     headers["x-api-key"] = account.token;
                                     delete headers["authorization"];
                                 }
-                                // Defaults: only set when client didn't send them
+                                // Apply header snapshot defaults for OAuth accounts
+                                if (isOAuth) {
+                                    await applyHeaderSnapshot(headers, account.label);
+                                }
+                                // Hard defaults for anything still missing
                                 if (!headers["user-agent"]) {
-                                    headers["user-agent"] = "claude-cli/2.1.80 (external, cli)";
+                                    headers["user-agent"] = "claude-cli/2.1.86 (external, cli)";
                                 }
                                 if (!headers["anthropic-version"]) {
                                     headers["anthropic-version"] = "2023-06-01";
                                 }
-                                // Ensure oauth beta is always present in the beta list
-                                const existingBetas = headers["anthropic-beta"] ?? "";
-                                if (!existingBetas) {
-                                    headers["anthropic-beta"] = "oauth-2025-04-20";
+                                if (!headers["anthropic-dangerous-direct-browser-access"]) {
+                                    headers["anthropic-dangerous-direct-browser-access"] = "true";
+                                }
+                                // Manage anthropic-beta header based on auth type.
+                                // OAuth requires specific betas; API-key must NOT carry them.
+                                if (isOAuth) {
+                                    const existing = new Set((headers["anthropic-beta"] ?? "")
+                                        .split(",")
+                                        .map((s) => s.trim())
+                                        .filter(Boolean));
+                                    existing.add("oauth-2025-04-20");
+                                    existing.add("claude-code-20250219");
+                                    headers["anthropic-beta"] = [...existing].join(",");
                                 }
-                                else if (!existingBetas.includes("oauth")) {
-                                    headers["anthropic-beta"] =
-                                        `${existingBetas},oauth-2025-04-20`;
+                                else {
+                                    // Strip OAuth-specific betas that may have leaked from client
+                                    const cleaned = (headers["anthropic-beta"] ?? "")
+                                        .split(",")
+                                        .map((s) => s.trim())
+                                        .filter((s) => s && s !== "oauth-2025-04-20")
+                                        .join(",");
+                                    if (cleaned) {
+                                        headers["anthropic-beta"] = cleaned;
+                                    }
+                                    else {
+                                        delete headers["anthropic-beta"];
+                                    }
                                 }
+                                // Polyfill request body for OAuth accounts
+                                const buildUpstreamBody = () => isOAuth ? polyfillOAuthBody(bodyStr, account.token) : bodyStr;
+                                const finalBodyStr = buildUpstreamBody();
                                 logger.always(`[proxy] → account=${account.label} (${account.type})`);
                                 recordRequest(account.label, account.type);
                                 // Log full request for debugging (written to ~/.neurolink/logs/proxy-debug-*.jsonl)
@@ -465,7 +628,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                     response = await fetch(url, {
                                         method: "POST",
                                         headers,
-                                        body: bodyStr,
+                                        body: finalBodyStr,
                                         signal: AbortSignal.timeout(UPSTREAM_FETCH_TIMEOUT_MS),
                                     });
                                 }
@@ -497,6 +660,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                         }
                                         else {
                                             const date = new Date(retryAfter);
+                                            // eslint-disable-next-line max-depth
                                             if (!Number.isNaN(date.getTime())) {
                                                 cooldownMs = Math.max(date.getTime() - Date.now(), 1000);
                                             }
@@ -530,12 +694,14 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                             authRetryError = `refresh failed for account=${account.label} attempt ${authRetry + 1}/${MAX_AUTH_RETRIES}: ${refreshSucceeded.error?.slice(0, 200) ?? "unknown"}`;
                                             lastError = authRetryError;
                                             logger.always(`[proxy] ⚠ account=${account.label} refresh failed on attempt ${authRetry + 1}`);
+                                            // eslint-disable-next-line max-depth
                                             if (accountState.consecutiveRefreshFailures >=
                                                 MAX_CONSECUTIVE_REFRESH_FAILURES) {
                                                 await disableAccountUntilReauth(account, accountState);
                                                 authFailureMessage = formatReauthMessage(account.label);
                                                 break;
                                             }
+                                            // eslint-disable-next-line max-depth
                                             if (authRetry < MAX_AUTH_RETRIES - 1) {
                                                 await sleep(2000);
                                             }
@@ -549,9 +715,10 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                             const retryResp = await fetch(url, {
                                                 method: "POST",
                                                 headers,
-                                                body: bodyStr,
+                                                body: buildUpstreamBody(),
                                                 signal: AbortSignal.timeout(UPSTREAM_FETCH_TIMEOUT_MS),
                                             });
+                                            // eslint-disable-next-line max-depth
                                             if (retryResp.ok) {
                                                 authRetrySucceeded = true;
                                                 accountState.consecutiveRefreshFailures = 0;
@@ -647,6 +814,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                             lastError = retryBody;
                                             logger.debug(`[proxy] retry ${authRetry + 1} failed: ${retryStatus} ${retryBody.substring(0, 120)}`);
                                             recordError(account.label, account.type, retryStatus);
+                                            // eslint-disable-next-line max-depth
                                             if (retryStatus === 429) {
                                                 sawRateLimit = true;
                                                 const retryAfter = retryResp.headers.get("retry-after");
@@ -659,6 +827,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                                 recordCooldown(account.label, account.type, accountState.coolingUntil, accountState.backoffLevel);
                                                 break;
                                             }
+                                            // eslint-disable-next-line max-depth
                                             if (retryStatus === 401 ||
                                                 retryStatus === 402 ||
                                                 retryStatus === 403) {
@@ -668,12 +837,14 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                                 }
                                                 continue;
                                             }
+                                            // eslint-disable-next-line max-depth
                                             if (isTransientHttpFailure(retryStatus, retryBody)) {
                                                 // Decision 8: No cooldown for transient errors — rotate immediately
                                                 sawTransientFailure = true;
                                                 break;
                                             }
                                             logAttempt(retryStatus, "api_error", summarizeErrorMessage(retryBody));
+                                            // eslint-disable-next-line max-depth
                                             try {
                                                 return JSON.parse(retryBody);
                                             }
@@ -695,7 +866,9 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                         }
                                     }
                                     if (!authRetrySucceeded) {
+                                        // eslint-disable-next-line max-depth
                                         if (!accountState.permanentlyDisabled) {
+                                            // eslint-disable-next-line max-depth
                                             if (!accountState.coolingUntil ||
                                                 accountState.coolingUntil <= Date.now()) {
                                                 accountState.coolingUntil =
@@ -953,6 +1126,7 @@ export function createClaudeProxyRoutes(modelRouter, basePath = "", accountStrat
                                             "anthropic-ratelimit-tokens-limit",
                                         ]) {
                                             const val = response.headers.get(h);
+                                            // eslint-disable-next-line max-depth
                                             if (val) {
                                                 responseHeaders[h] = val;
                                             }