@miller-tech/uap 1.170.0 → 1.170.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.170.0",
+  "version": "1.170.1",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/tools/agents/scripts/anthropic_proxy.py

@@ -161,8 +161,9 @@ PROXY_PORT = int(os.environ.get("PROXY_PORT", "4000"))
 # PROXY_AUTH_TOKEN so the exposure is credential-gated.
 PROXY_HOST = os.environ.get("PROXY_HOST", "127.0.0.1")
 # Optional shared secret. When set, every request to a model route must present
-# it as `Authorization: Bearer <token>` or `X-Uap-Proxy-Token: <token>`. Unset
-# (default) = no check, which is safe only because the default bind is loopback.
+# it as `Authorization: Bearer <token>`, `X-Uap-Proxy-Token: <token>`, or
+# `X-Api-Key: <token>`. Unset (default) = no check, which is safe only because
+# the default bind is loopback.
 # The health probe stays open so liveness checks don't need the secret.
 PROXY_AUTH_TOKEN = os.environ.get("PROXY_AUTH_TOKEN", "").strip()
 PROXY_LOG_LEVEL = os.environ.get("PROXY_LOG_LEVEL", "INFO").upper()
@@ -3584,8 +3585,9 @@ async def _shared_secret_auth(request: Request, call_next):
     No-op when the token is unset (the default; safe only because the default
     bind is loopback). When set — the intended posture for a shared LAN service
     (PROXY_HOST=0.0.0.0) — a request must present the token as
-    `Authorization: Bearer <token>` or `X-Uap-Proxy-Token: <token>`; otherwise
-    401. Uses a constant-time compare to avoid a timing oracle.
+    `Authorization: Bearer <token>`, `X-Uap-Proxy-Token: <token>`, or
+    `X-Api-Key: <token>`; otherwise 401. Uses a constant-time compare to avoid a
+    timing oracle.
     """
     if PROXY_AUTH_TOKEN and request.url.path not in _PROXY_AUTH_OPEN_PATHS and request.method != "OPTIONS":
         provided = request.headers.get("x-uap-proxy-token", "")
@@ -3593,6 +3595,13 @@ async def _shared_secret_auth(request: Request, call_next):
             auth = request.headers.get("authorization", "")
             if auth.lower().startswith("bearer "):
                 provided = auth[7:].strip()
+        if not provided:
+            # This proxy emulates the Anthropic Messages API, whose SDK clients
+            # (opencode's @ai-sdk/anthropic, claude-code, factory, …) send their
+            # credential in the x-api-key header rather than Authorization/
+            # X-Uap-Proxy-Token. Accept it as an equivalent token source so any
+            # Anthropic-native client can authenticate without custom headers.
+            provided = request.headers.get("x-api-key", "").strip()
         import hmac as _hmac
 
         if not (provided and _hmac.compare_digest(provided, PROXY_AUTH_TOKEN)):
@@ -3602,7 +3611,7 @@ async def _shared_secret_auth(request: Request, call_next):
                         "type": "error",
                         "error": {
                             "type": "authentication_error",
-                            "message": "missing or invalid proxy token (set X-Uap-Proxy-Token or Authorization: Bearer)",
+                            "message": "missing or invalid proxy token (set X-Uap-Proxy-Token, Authorization: Bearer, or X-Api-Key)",
                         },
                     }
                 ),

package/tools/agents/tests/test_proxy_auth_headers.py

@@ -0,0 +1,82 @@
+"""Tests for the shared-secret auth middleware header sources.
+
+The proxy emulates the Anthropic Messages API. Its clients authenticate in one
+of three ways depending on the SDK: `X-Uap-Proxy-Token`, `Authorization: Bearer`,
+or — for Anthropic-native SDKs like opencode's @ai-sdk/anthropic and claude-code
+— `x-api-key`. All three must be accepted; a wrong or missing token must 401.
+"""
+import asyncio
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+def _load_proxy_module():
+    proxy_path = Path(__file__).resolve().parents[1] / "scripts" / "anthropic_proxy.py"
+    spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+proxy = _load_proxy_module()
+
+_TOKEN = "proxy-secret-token"
+_SENTINEL = object()
+
+
+class _FakeURL:
+    def __init__(self, path):
+        self.path = path
+
+
+class _FakeReq:
+    def __init__(self, headers, path="/v1/messages", method="POST"):
+        self.headers = headers
+        self.url = _FakeURL(path)
+        self.method = method
+
+
+async def _call_next(_request):
+    return _SENTINEL
+
+
+def _run_auth(headers):
+    """Drive the async middleware; return _SENTINEL when auth passes, else the 401 Response."""
+    req = _FakeReq(headers)
+    return asyncio.run(proxy._shared_secret_auth(req, _call_next))
+
+
+class ProxyAuthHeaderTest(unittest.TestCase):
+    def setUp(self):
+        self._prev = proxy.PROXY_AUTH_TOKEN
+        proxy.PROXY_AUTH_TOKEN = _TOKEN
+
+    def tearDown(self):
+        proxy.PROXY_AUTH_TOKEN = self._prev
+
+    def test_x_api_key_accepted(self):
+        # NEW behavior: Anthropic-native SDKs send the token as x-api-key.
+        self.assertIs(_run_auth({"x-api-key": _TOKEN}), _SENTINEL)
+
+    def test_x_api_key_wrong_token_rejected(self):
+        resp = _run_auth({"x-api-key": "not-the-token"})
+        self.assertEqual(getattr(resp, "status_code", None), 401)
+
+    def test_x_uap_proxy_token_still_accepted(self):
+        self.assertIs(_run_auth({"x-uap-proxy-token": _TOKEN}), _SENTINEL)
+
+    def test_authorization_bearer_still_accepted(self):
+        self.assertIs(_run_auth({"authorization": f"Bearer {_TOKEN}"}), _SENTINEL)
+
+    def test_no_credentials_rejected(self):
+        resp = _run_auth({})
+        self.assertEqual(getattr(resp, "status_code", None), 401)
+
+    def test_no_op_when_token_unset(self):
+        proxy.PROXY_AUTH_TOKEN = ""
+        self.assertIs(_run_auth({}), _SENTINEL)
+
+
+if __name__ == "__main__":
+    unittest.main()