@nevescloud/pip 3.8.1 → 3.8.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nevescloud/pip",
-  "version": "3.8.1",
+  "version": "3.8.3",
   "description": "Floating assistant bubble + panel + chat runtime. ESM, no build.",
   "type": "module",
   "main": "pip-core.esm.js",

package/providers/anthropic.esm.js

@@ -23,8 +23,14 @@ export function anthropic({
   effort,
   cacheControl,
   extraHeaders = {},
+  // When true, the host is routing through a proxy/bridge that injects
+  // auth + version headers server-side. The provider then sends only
+  // content-type; this avoids the CORS preflight burden of x-api-key /
+  // anthropic-version / anthropic-dangerous-direct-browser-access on
+  // proxies that haven't allowlisted those headers.
+  proxied = false,
 } = {}) {
-  if (!apiKey) throw new Error('anthropic provider: apiKey is required');
+  if (!proxied && !apiKey) throw new Error('anthropic provider: apiKey is required (or set proxied: true when routing through a bridge that injects auth)');
 
   return async function* anthropicProvider({ messages, tools, system, signal }) {
     const body = {
@@ -45,15 +51,16 @@ export function anthropic({
     if (effort) body.output_config = { effort };
     if (cacheControl) body.cache_control = { type: cacheControl };
 
+    const headers = { 'content-type': 'application/json', ...extraHeaders };
+    if (!proxied) {
+      headers['x-api-key'] = apiKey;
+      headers['anthropic-version'] = ANTHROPIC_VERSION;
+      headers['anthropic-dangerous-direct-browser-access'] = 'true';
+    }
+
     const res = await fetch(`${baseUrl}/v1/messages`, {
       method: 'POST',
-      headers: {
-        'content-type': 'application/json',
-        'x-api-key': apiKey,
-        'anthropic-version': ANTHROPIC_VERSION,
-        'anthropic-dangerous-direct-browser-access': 'true',
-        ...extraHeaders,
-      },
+      headers,
       body: JSON.stringify(body),
       signal,
     });

package/runtime.esm.js

@@ -236,12 +236,27 @@ export function createRuntime({
       return { clearedUI: true };
     }
     if (cmd === 'tools') {
-      // The slash autocomplete dropdown enumerates registered tools via
-      // complete() — listing them as a chat turn duplicates that surface
-      // and pollutes history. Reopen the dropdown in arg-mode instead;
-      // same primitive /help and /model adopted via openCompletions.
+      // No-arg form opens the autocomplete dropdown (same surface /help and
+      // /model adopted via openCompletions) so users can browse without
+      // polluting chat history. With an arg the user picked a specific
+      // tool — render its description + schema as a reply so the dropdown
+      // selection has a meaningful outcome instead of looping back.
       if (registeredTools.size === 0) return { reply: 'No tools registered.' };
-      return { openCompletions: true };
+      const arg = args.trim();
+      if (!arg) return { openCompletions: true };
+      const tool = registeredTools.get(arg);
+      if (!tool) {
+        const all = Array.from(registeredTools.keys()).map((n) => `\`${n}\``).join(', ');
+        return { reply: `Unknown tool \`${arg}\`. Available: ${all}` };
+      }
+      const lines = [`**\`${tool.name}\`** — ${tool.description || '(no description)'}`];
+      const schema = tool.schema || tool.input_schema;
+      if (schema && Object.keys(schema.properties || {}).length > 0) {
+        lines.push('', '```json', JSON.stringify(schema, null, 2), '```');
+      } else if (schema) {
+        lines.push('', '(no arguments)');
+      }
+      return { reply: lines.join('\n') };
     }
     if (cmd === 'model' && models.length) {
       const arg = args.trim();