@oar-sh/oar 0.9.16 → 0.9.18

package/server/services/usage-limit-pause-service.mjs

@@ -175,10 +175,11 @@ export function createUsageLimitPauseService({
    * Decide whether a refused turn is paused. Returns the plan, or null when
    * the response is to be handled as the terminal failure it says it is.
    */
-  function planPause({ terminalError, conversationId, providerType, queueRow = null, partialText = '' } = {}) {
+  function planPause({ terminalError, conversationId, providerType, chatProviderType = null, queueRow = null, partialText = '' } = {}) {
     if (!isUsageLimitTerminalError(terminalError)) return null;
     // Claude sessions, local and in the cloud: both run Claude Code on the
-    // same account and report the same limit.
+    // same account and report the same limit. `providerType` is what the
+    // refused turn ran on.
     if (!['claude', 'claude-cloud'].includes(String(providerType || '').trim().toLowerCase())) return null;
     if (!String(conversationId || '').trim()) return null;
     const at = now();
@@ -187,6 +188,21 @@ export function createUsageLimitPauseService({
     // What the turn had written before the refusal stays above the note.
     const written = String(partialText || '').trim();
     const withWritten = (note) => (written ? `${written}\n\n${note}` : note);
+    // The chat moved to the API key while this subscription turn ran: its
+    // follow-up is not held for the subscription's reset, it runs on the key
+    // at once (a row on the key is never held for the usage limit).
+    if (String(chatProviderType || '').trim().toLowerCase() === 'claude-api') {
+      return {
+        conversationId: String(conversationId),
+        rateLimitType,
+        resetsAt: null,
+        resumeAt: null,
+        auto: false,
+        retries: 0,
+        onApiKey: true,
+        noteText: withWritten(`⏸ Stopped at the Claude ${label}. This chat now runs on the Claude API key, so the turn carries on there.`),
+      };
+    }
     const resetsAtMs = Date.parse(String(terminalError.resetsAt || ''));
     if (!Number.isFinite(resetsAtMs) || resetsAtMs <= at) {
       // Counted along the follow-ups: the refused row is one itself when the
@@ -232,7 +248,8 @@ export function createUsageLimitPauseService({
   function schedulePause(plan, { queueRow = null } = {}) {
     if (!plan?.conversationId) return null;
     const at = new Date(now()).toISOString();
-    const heldUntil = plan.auto ? plan.resumeAt : HELD_UNTIL_RESUMED;
+    // On the key: due now, never held.
+    const heldUntil = plan.onApiKey ? null : (plan.auto ? plan.resumeAt : HELD_UNTIL_RESUMED);
     // What this refusal cut off. A refused follow-up stands for what it
     // quoted; a turn of the CLI's own has no prompt.
     const refusedFollowUp = parseJson(queueRow?.usage_limit_pause);
@@ -251,6 +268,7 @@ export function createUsageLimitPauseService({
         resetsAt: plan.resetsAt,
         auto: plan.auto,
         retries: Number(plan.retries || 0),
+        ...(plan.onApiKey ? { onApiKey: true, resumedAt: at, resumedBy: 'billing-switch' } : {}),
         pausedAt: at,
         refusedMessageId: queueRow?.id ? String(queueRow.id) : null,
         prompts,
@@ -345,8 +363,15 @@ export function createUsageLimitPauseService({
       } catch {}
     }
     const state = getPause(plan.conversationId);
-    try { logger.log?.(`[usage-limit] conv=${plan.conversationId.slice(0, 8)} paused at the ${usageLimitWindowLabel(plan.rateLimitType)}; ${plan.auto ? `resumes ${plan.resumeAt}` : `resets ${plan.resetsAt}, waits for the user`}`); } catch {}
+    try {
+      logger.log?.(`[usage-limit] conv=${plan.conversationId.slice(0, 8)} ${plan.onApiKey
+        ? `stopped at the ${usageLimitWindowLabel(plan.rateLimitType)}; carries on on the API key`
+        : `paused at the ${usageLimitWindowLabel(plan.rateLimitType)}; ${plan.auto ? `resumes ${plan.resumeAt}` : `resets ${plan.resetsAt}, waits for the user`}`}`);
+    } catch {}
     emitPause(plan.conversationId, state);
+    if (plan.onApiKey) {
+      try { onQueueChanged('usage-limit-on-api-key'); } catch {}
+    }
     return { messageId, created: Boolean(created), state };
   }
 
@@ -375,6 +400,31 @@ export function createUsageLimitPauseService({
     return { resumed: true, messageId: String(row.id), state: null };
   }
 
+  /**
+   * Release the held follow-up because the chat moved to the API key: it
+   * runs now, on the key (the billing switch re-stamped it). Called inside
+   * the switch's transaction; `announce()` tells the clients once that has
+   * committed. Null when nothing is held.
+   */
+  function releaseForBillingSwitch({ conversationId, by = 'billing-switch' } = {}) {
+    const id = String(conversationId || '').trim();
+    const row = id ? findPausedRowForConversation.get(id) : null;
+    if (!row || !stateFromRow(row)) return null;
+    const pause = parseJson(row.usage_limit_pause) || {};
+    const at = new Date(now()).toISOString();
+    setPause.run(null, JSON.stringify({ ...pause, resumedAt: at, resumedBy: String(by || 'billing-switch') }), row.id);
+    const messageId = String(row.id);
+    return {
+      messageId,
+      announce() {
+        try { logger.log?.(`[usage-limit] conv=${id.slice(0, 8)} released by the switch to the API key`); } catch {}
+        emitPause(id, null);
+        try { emit('message_status', { messageId, conversationId: id, status: 'pending' }); } catch {}
+        try { onQueueChanged('usage-limit-billing-switch'); } catch {}
+      },
+    };
+  }
+
   /** Drop the held follow-up: the paused turn is not carried on. */
   function cancel({ conversationId } = {}) {
     const id = String(conversationId || '').trim();
@@ -436,6 +486,7 @@ export function createUsageLimitPauseService({
     getPause,
     listPauses,
     resumeNow,
+    releaseForBillingSwitch,
     cancel,
     recordReport,
     getAccountState: accountState,

package/server/services/worker-secret-redaction.mjs

@@ -0,0 +1,320 @@
+// A provider's saved key out of what session workers post.
+//
+// A provider whose key the relay keeps in its settings (DeepSeek) hands that
+// key to its own workers, and their agent can see it: in its shell's
+// environment, in a file it reads, in an error the API quotes. Whatever the
+// agent prints can come back to the relay as a reply, a stream update, a
+// thought, tool activity, a sub-agent's text, a question or task output. So
+// every occurrence of a saved key is replaced with `[redacted]` in the body of
+// every request a session worker sends, before any route stores, broadcasts
+// or logs it. This keeps the key out of what the relay stores and shows; it
+// is no boundary against the agent, which can change the text, call the
+// relay's API without the worker header or read the relay's database.
+//
+// - One choke point: a middleware after the JSON body parser. A worker
+//   request is one that carries the `X-Relay-Session-Id` header every
+//   worker's API client sends, even empty (the Copilot extension sends it
+//   empty until its session is up); browsers never send it.
+// - Every worker's posts lose every saved key, not only those of the
+//   provider the key belongs to: a chat that changes provider between turns,
+//   or an agent that reads the relay's own files, would otherwise slip past.
+// - A key changed or removed in Settings is still redacted: a worker started
+//   before the change still holds the old one. The middleware keeps the keys
+//   saved since the relay started (MAX_REMEMBERED_SECRETS, in memory only,
+//   never logged): those it reads when it is created, each one the settings
+//   save path notes (noteSavedSetting) and those it reads on each post.
+// - The first part of a key that was cut goes too (redactString): at the
+//   end of a text, since stream and thought updates carry the text so far and
+//   go out before the key is complete, and before an ellipsis anywhere in a
+//   text, since a worker clips a long text and may go on after the clip (the
+//   remote-relay activity line ends in `…”`). The last part of a key at the
+//   very start of a text goes as well: a task-output snapshot is the output's
+//   last 8 KiB and can begin halfway through a key.
+// - Property names are rewritten like values (`{ "<key>": 1 }` becomes
+//   `{ "[redacted]": 1 }`), so a key cannot ride along as one.
+// - A key shorter than MIN_REDACTED_SECRET_LENGTH is left alone, so a
+//   mistyped setting cannot mangle ordinary text.
+// - The settings routes are never rewritten: a key saved there must arrive
+//   as it was typed.
+// - Task output the relay reads from a task's file does not pass here; it
+//   goes through cleanTaskOutput (shared/task-output-text.mjs), whose rules
+//   take out `sk-` keys (DeepSeek's and Anthropic's shape) and any other long
+//   random-looking token, though not by the exact saved text. The snapshots
+//   a worker posts for a task without a file do pass here.
+//
+// A provider registers its key by one entry in SAVED_PROVIDER_KEY_SETTINGS.
+
+import { DEEPSEEK_PROVIDER_TYPE } from '../../shared/deepseek-models.mjs';
+import { CLAUDE_API_KEY_SETTING_KEY, CLAUDE_API_PROVIDER_TYPE } from './claude-api-settings-service.mjs';
+import { DEEPSEEK_API_KEY_SETTING_KEY } from './deepseek-settings-service.mjs';
+
+export const REDACTED_SECRET_TEXT = '[redacted]';
+export const MIN_REDACTED_SECRET_LENGTH = 8;
+// The shortest part of a key that is taken out where a text was cut (its
+// first part) or at a text's start (its last part). A shorter part stays. It
+// holds at most 7 characters of the key, for DeepSeek's shape (`sk-` and 32
+// hex digits) the public `sk-` and four digits, too few to help anyone guess
+// it. And a shorter run of ordinary text, the bare `sk-` or a word a key
+// happens to start with, is no key and must not turn into `[redacted]`.
+export const MIN_REDACTED_KEY_PREFIX_LENGTH = 8;
+// How many keys the middleware remembers; the oldest goes first. A saved key
+// is changed by hand, so this many covers every worker still running.
+export const MAX_REMEMBERED_SECRETS = 16;
+export const WORKER_SESSION_HEADER = 'x-relay-session-id';
+
+/** The providers whose workers get a key saved in the relay's settings. */
+export const SAVED_PROVIDER_KEY_SETTINGS = Object.freeze([
+  Object.freeze({ provider: DEEPSEEK_PROVIDER_TYPE, settingKey: DEEPSEEK_API_KEY_SETTING_KEY }),
+  Object.freeze({ provider: CLAUDE_API_PROVIDER_TYPE, settingKey: CLAUDE_API_KEY_SETTING_KEY }),
+]);
+
+// JSON bodies are shallow in practice; a deeper one is left as it is below
+// this depth rather than walked without end.
+const MAX_DEPTH = 64;
+// What a worker puts after a text it cut short (a tool line at 140
+// characters, the remote-relay line's quoted text at 60), with the space
+// some put before it. Matched where a key's first part stops: the text may go
+// on after it (`…”`, `…” (now)`, `…)`).
+const ELLIPSIS_AT = /\s*(?:…|⋯|\.{2,}|\[truncated\])/y;
+// The same marks at the start of a text that begins inside something.
+const LEADING_ELLIPSIS = /^(?:(?:…|⋯|\.{2,}|\[truncated\])\s*)?/;
+
+function normalizeSecrets(secrets) {
+  const unique = new Set();
+  for (const entry of Array.isArray(secrets) ? secrets : []) {
+    const value = String(entry ?? '').trim();
+    if (value.length >= MIN_REDACTED_SECRET_LENGTH) unique.add(value);
+  }
+  // Longest first; where secrets overlap in a text, redactString joins what
+  // each of them covers.
+  return [...unique].sort((a, b) => b.length - a.length);
+}
+
+/** Whether a key's first part that stops at `at` was cut there: the text ends, or an ellipsis follows. */
+function isCutAt(text, at) {
+  if (at === text.length) return true;
+  ELLIPSIS_AT.lastIndex = at;
+  return ELLIPSIS_AT.test(text);
+}
+
+/**
+ * Pushes `[start, end)` for each run in `text` that is the first
+ * MIN_REDACTED_KEY_PREFIX_LENGTH or more characters of `secret` (not all of
+ * it) and is cut: at the end of the text or before an ellipsis, wherever that
+ * is. Of the runs at one place, the longest that is cut counts.
+ */
+function pushKeyPrefixRanges(text, secret, ranges) {
+  if (secret.length <= MIN_REDACTED_KEY_PREFIX_LENGTH) return;
+  const head = secret.slice(0, MIN_REDACTED_KEY_PREFIX_LENGTH);
+  for (let index = text.indexOf(head); index !== -1; index = text.indexOf(head, index + 1)) {
+    // How far the text goes on as the key does (short of the whole key, a
+    // range of its own).
+    const most = Math.min(secret.length - 1, text.length - index);
+    let matched = MIN_REDACTED_KEY_PREFIX_LENGTH;
+    while (matched < most && text.charCodeAt(index + matched) === secret.charCodeAt(matched)) matched += 1;
+    for (let length = matched; length >= MIN_REDACTED_KEY_PREFIX_LENGTH; length -= 1) {
+      if (isCutAt(text, index + length)) {
+        ranges.push([index, index + length]);
+        break;
+      }
+    }
+  }
+}
+
+/**
+ * Pushes `[start, end)` when `text`, from `start` on, begins with the last
+ * MIN_REDACTED_KEY_PREFIX_LENGTH or more characters of `secret` (not all of
+ * it): the longest such end of the key.
+ */
+function pushKeySuffixRange(text, start, secret, ranges) {
+  if (secret.length <= MIN_REDACTED_KEY_PREFIX_LENGTH) return;
+  const lead = text.slice(start, start + MIN_REDACTED_KEY_PREFIX_LENGTH);
+  if (lead.length < MIN_REDACTED_KEY_PREFIX_LENGTH) return;
+  // Where in the key the text may start, from 1 (not the whole key) on: the
+  // first place that fits leaves the longest end.
+  for (let at = secret.indexOf(lead, 1); at !== -1; at = secret.indexOf(lead, at + 1)) {
+    if (text.startsWith(secret.slice(at), start)) {
+      ranges.push([start, start + secret.length - at]);
+      return;
+    }
+  }
+}
+
+/** `text` with each range replaced; ranges that overlap or touch become one, so the longest part wins. */
+function replaceRanges(text, ranges) {
+  if (!ranges.length) return text;
+  ranges.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+  let output = '';
+  let emitted = 0;
+  let [start, end] = ranges[0];
+  for (let index = 1; index < ranges.length; index += 1) {
+    const [nextStart, nextEnd] = ranges[index];
+    if (nextStart <= end) {
+      end = Math.max(end, nextEnd);
+      continue;
+    }
+    output += `${text.slice(emitted, start)}${REDACTED_SECRET_TEXT}`;
+    emitted = end;
+    [start, end] = [nextStart, nextEnd];
+  }
+  return `${output}${text.slice(emitted, start)}${REDACTED_SECRET_TEXT}${text.slice(end)}`;
+}
+
+/**
+ * `text` with every secret and the parts of one a cut left in it replaced:
+ * each whole occurrence, its first part where the text was cut
+ * (pushKeyPrefixRanges) and its last part at the very start of the text,
+ * after an ellipsis it may begin with (pushKeySuffixRange). All are found in
+ * the text as it came, of every secret, and replaced together, so where they
+ * overlap the longest wins: a key that holds another saved key goes whole,
+ * also when only a part of it is there.
+ */
+function redactString(text, secrets) {
+  const ranges = [];
+  const start = LEADING_ELLIPSIS.exec(text)[0].length;
+  for (const secret of secrets) {
+    for (let index = text.indexOf(secret); index !== -1; index = text.indexOf(secret, index + 1)) {
+      ranges.push([index, index + secret.length]);
+    }
+    pushKeyPrefixRanges(text, secret, ranges);
+    pushKeySuffixRange(text, start, secret, ranges);
+  }
+  return replaceRanges(text, ranges);
+}
+
+/**
+ * `text` with every occurrence of each secret replaced, a first part of one
+ * cut at the text's end or before an ellipsis and a last part of one the text
+ * starts with; anything that is not a string as it is.
+ */
+export function redactSecretsInText(text, secrets = []) {
+  if (typeof text !== 'string' || !text) return text;
+  return redactString(text, normalizeSecrets(secrets));
+}
+
+function redactValue(value, secrets, depth) {
+  if (typeof value === 'string') return value ? redactString(value, secrets) : value;
+  if (!value || typeof value !== 'object' || depth >= MAX_DEPTH) return value;
+  if (Array.isArray(value)) {
+    let copy = null;
+    for (let index = 0; index < value.length; index += 1) {
+      const next = redactValue(value[index], secrets, depth + 1);
+      if (next !== value[index]) {
+        copy ||= value.slice();
+        copy[index] = next;
+      }
+    }
+    return copy || value;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) return value;
+  // Property names too: a key can be one (`{ "<key>": 1 }`). Once a name or a
+  // value changes, the entries are copied in their order; two names that come
+  // out the same keep the later value.
+  const entries = Object.entries(value);
+  let copied = null;
+  for (let index = 0; index < entries.length; index += 1) {
+    const [key, entry] = entries[index];
+    const nextKey = key ? redactString(key, secrets) : key;
+    const next = redactValue(entry, secrets, depth + 1);
+    if (!copied) {
+      if (nextKey === key && next === entry) continue;
+      copied = entries.slice(0, index);
+    }
+    copied.push([nextKey, next]);
+  }
+  // fromEntries defines each property, so a `__proto__` name stays a name.
+  return copied ? Object.fromEntries(copied) : value;
+}
+
+/**
+ * Every string in a JSON value (plain objects and arrays, at any depth),
+ * property names included, with the secrets replaced. The value itself comes
+ * back when nothing changed; otherwise only the changed branches are copies.
+ */
+export function redactSecretsDeep(value, secrets = []) {
+  const normalized = normalizeSecrets(secrets);
+  if (!normalized.length) return value;
+  return redactValue(value, normalized, 0);
+}
+
+/** The saved keys of the registered providers, as `readSetting(settingKey)` has them. */
+export function readSavedProviderKeys({ readSetting = () => '', entries = SAVED_PROVIDER_KEY_SETTINGS } = {}) {
+  return normalizeSecrets(entries.map((entry) => readSetting(entry.settingKey)));
+}
+
+/** Whether a request is a session worker's post with a body to scrub: the header present, even empty. */
+export function isWorkerPostRequest(req) {
+  const method = String(req?.method || '').toUpperCase();
+  if (method === 'GET' || method === 'HEAD' || method === 'OPTIONS') return false;
+  if (req?.headers?.[WORKER_SESSION_HEADER] === undefined) return false;
+  return !/^\/api\/settings(?:\/|$)/.test(String(req?.path || ''));
+}
+
+/**
+ * The middleware: mounted after `express.json()`, before every route. It
+ * reads the saved keys once when it is created (the relay's start) and per
+ * request (one settings read per provider), so a key saved applies to the
+ * next post, and redacts them with every key read or noted before (see the
+ * note on key changes above). `noteSavedSetting(settingKey, value)`, on the
+ * function returned, is for the settings save path: a registered key saved
+ * there is remembered at once, so it stays redacted even when it is changed
+ * again before any worker posts.
+ */
+export function createWorkerPostRedaction({
+  readSetting = () => '',
+  entries = SAVED_PROVIDER_KEY_SETTINGS,
+  log = (line) => console.warn(line),
+} = {}) {
+  let warned = false;
+  // Oldest first; a key read again moves to the end.
+  const remembered = new Set();
+  let secrets = [];
+  const settingKeys = new Set(entries.map((entry) => entry.settingKey));
+
+  function remember(current) {
+    let changed = false;
+    for (const key of current) {
+      if (remembered.delete(key)) {
+        remembered.add(key);
+        continue;
+      }
+      remembered.add(key);
+      changed = true;
+    }
+    while (remembered.size > MAX_REMEMBERED_SECRETS) {
+      remembered.delete(remembered.values().next().value);
+      changed = true;
+    }
+    if (changed) secrets = normalizeSecrets([...remembered]);
+  }
+
+  function readAndRemember() {
+    try {
+      remember(readSavedProviderKeys({ readSetting, entries }));
+    } catch (error) {
+      // The settings could not be read: the post loses the keys read before,
+      // and the relay says so once rather than refusing every worker post.
+      if (!warned) {
+        warned = true;
+        try { log(`worker post redaction: the saved provider keys could not be read, only those read before are redacted (${error?.message || error})`); } catch {}
+      }
+    }
+  }
+
+  function workerPostRedaction(req, _res, next) {
+    if (!isWorkerPostRequest(req) || !req.body || typeof req.body !== 'object') return next();
+    readAndRemember();
+    if (secrets.length) req.body = redactValue(req.body, secrets, 0);
+    return next();
+  }
+
+  /** Remembers `value` when `settingKey` is a registered provider key; any other setting is ignored. */
+  workerPostRedaction.noteSavedSetting = function noteSavedSetting(settingKey, value) {
+    if (!settingKeys.has(settingKey)) return;
+    remember(normalizeSecrets([value]));
+  };
+
+  readAndRemember();
+  return workerPostRedaction;
+}

package/shared/anthropic-api.mjs

@@ -0,0 +1,202 @@
+// A small client for the one Anthropic endpoint the relay calls itself with a
+// Claude API key: `GET /v1/models`, the model discovery of the Claude API
+// provider (Settings → Providers → Claude API). Turns do not go through here:
+// the session worker runs Claude Code on the key.
+//
+// The key goes to the Anthropic API and nowhere else. The only other target
+// is a fake API on the loopback interface, named by OAR_ANTHROPIC_API_BASE_URL
+// for tests; any other value of that variable is ignored (the rule of
+// shared/claude-cloud/base-url.mjs, which this module reuses). There is no
+// base-URL setting and no parameter that takes one.
+//
+// The key is in no error this module produces: a response body is quoted only
+// after the key has been taken out of it.
+
+import { loopbackBaseUrlOrNull } from './claude-cloud/base-url.mjs';
+
+export const ANTHROPIC_API_BASE_URL = 'https://api.anthropic.com';
+export const ANTHROPIC_API_BASE_URL_ENV = 'OAR_ANTHROPIC_API_BASE_URL';
+export const ANTHROPIC_API_VERSION = '2023-06-01';
+
+const DEFAULT_TIMEOUT_MS = 10_000;
+// The largest page `GET /v1/models` serves.
+const MODELS_PAGE_LIMIT = 1000;
+// One page holds every model today; the cap keeps a cursor that never ends
+// from turning into an endless walk.
+const MAX_MODEL_PAGES = 20;
+const MAX_DETAIL_CHARS = 240;
+// The effort levels the Models API reports per model, in ladder order.
+const EFFORT_LEVELS = Object.freeze(['low', 'medium', 'high', 'xhigh', 'max']);
+
+/**
+ * The base URL for the client: the loopback URL named by
+ * OAR_ANTHROPIC_API_BASE_URL, else the Anthropic API.
+ */
+export function resolveAnthropicApiBaseUrl(env = process.env) {
+  return loopbackBaseUrlOrNull(env?.[ANTHROPIC_API_BASE_URL_ENV]) || ANTHROPIC_API_BASE_URL;
+}
+
+export class AnthropicApiError extends Error {
+  constructor(message, { code = 'error', status = null } = {}) {
+    super(message);
+    this.name = 'AnthropicApiError';
+    this.code = code;
+    this.status = status;
+  }
+}
+
+function codeForStatus(status) {
+  if (status === 401) return 'unauthorized';
+  if (status === 403) return 'forbidden';
+  if (status === 402) return 'billing';
+  if (status === 429) return 'rate_limited';
+  if (status >= 500) return 'transient';
+  return 'error';
+}
+
+function redact(text, apiKey) {
+  const value = String(text ?? '');
+  const key = String(apiKey ?? '').trim();
+  return key ? value.split(key).join('[redacted]') : value;
+}
+
+function toText(value) {
+  return String(value ?? '').trim();
+}
+
+function positiveInteger(value) {
+  const number = Number(value);
+  return Number.isFinite(number) && number > 0 ? Math.trunc(number) : null;
+}
+
+/**
+ * A capability as the API writes it (`{ supported: true }`) or as a plain
+ * boolean; null when it is missing or of another shape.
+ */
+function capabilitySupported(value) {
+  if (typeof value === 'boolean') return value;
+  if (value && typeof value === 'object' && typeof value.supported === 'boolean') return value.supported;
+  return null;
+}
+
+/** `{ type: 'error', error: { type, message } }` as one line, or the raw text. */
+function errorDetail(text) {
+  const raw = toText(text);
+  if (!raw) return '';
+  try {
+    const parsed = JSON.parse(raw);
+    const type = toText(parsed?.error?.type);
+    const message = toText(parsed?.error?.message);
+    if (type || message) return [type, message].filter(Boolean).join(': ');
+  } catch {
+    // Not JSON: the text as it came.
+  }
+  return raw;
+}
+
+/**
+ * One entry of `GET /v1/models` in OAR's terms, or null without an id:
+ * `{ id, displayName, contextWindow, maxOutput, imageInput, effort,
+ * effortLevels, thinking, thinkingTypes }`. Every field but the id may be
+ * missing in an answer, so each one is null (or an empty list) then.
+ */
+export function mapAnthropicModel(entry) {
+  const id = toText(entry?.id);
+  if (!id) return null;
+  const capabilities = entry?.capabilities && typeof entry.capabilities === 'object' ? entry.capabilities : {};
+  const effort = capabilities.effort;
+  const effortObject = effort && typeof effort === 'object' ? effort : {};
+  const thinking = capabilities.thinking;
+  const thinkingTypesObject = thinking && typeof thinking === 'object' && thinking.types && typeof thinking.types === 'object'
+    ? thinking.types
+    : {};
+  return {
+    id,
+    displayName: toText(entry?.display_name) || id,
+    contextWindow: positiveInteger(entry?.max_input_tokens),
+    maxOutput: positiveInteger(entry?.max_tokens),
+    imageInput: capabilitySupported(capabilities.image_input),
+    effort: capabilitySupported(effort),
+    effortLevels: EFFORT_LEVELS.filter((level) => capabilitySupported(effortObject[level]) === true),
+    thinking: capabilitySupported(thinking),
+    thinkingTypes: Object.keys(thinkingTypesObject)
+      .filter((type) => capabilitySupported(thinkingTypesObject[type]) === true)
+      .map((type) => type.toLowerCase()),
+  };
+}
+
+export function createAnthropicApiClient({
+  apiKey = '',
+  env = process.env,
+  fetchImpl = globalThis.fetch,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+} = {}) {
+  const baseUrl = resolveAnthropicApiBaseUrl(env);
+  const key = toText(apiKey);
+
+  async function getJson(pathname, what) {
+    if (!key) throw new AnthropicApiError('Claude API key is not configured', { code: 'not_configured' });
+    let response;
+    try {
+      response = await fetchImpl(`${baseUrl}${pathname}`, {
+        headers: {
+          'x-api-key': key,
+          'anthropic-version': ANTHROPIC_API_VERSION,
+          accept: 'application/json',
+        },
+        signal: AbortSignal.timeout(timeoutMs),
+      });
+    } catch (error) {
+      const timedOut = error?.name === 'TimeoutError' || error?.name === 'AbortError';
+      throw new AnthropicApiError(
+        timedOut
+          ? `Anthropic ${what} timed out after ${timeoutMs} ms`
+          : `Anthropic ${what} failed: ${redact(error?.message || error, key)}`,
+        { code: timedOut ? 'timeout' : 'network' },
+      );
+    }
+    if (!response.ok) {
+      const detail = redact(errorDetail(await response.text().catch(() => '')), key).slice(0, MAX_DETAIL_CHARS);
+      throw new AnthropicApiError(
+        `Anthropic ${what} failed (${response.status})${detail ? `: ${detail}` : ''}`,
+        { code: codeForStatus(response.status), status: response.status },
+      );
+    }
+    try {
+      return await response.json();
+    } catch {
+      throw new AnthropicApiError(`Anthropic ${what} returned invalid JSON`, { code: 'invalid_response' });
+    }
+  }
+
+  return {
+    baseUrl,
+
+    /**
+     * Every model the key may use (mapAnthropicModel), in the API's order,
+     * without duplicates. Follows `has_more` / `last_id` page by page.
+     */
+    async listModels() {
+      const models = [];
+      const seen = new Set();
+      const cursors = new Set();
+      let afterId = '';
+      for (let page = 0; page < MAX_MODEL_PAGES; page += 1) {
+        const query = new URLSearchParams({ limit: String(MODELS_PAGE_LIMIT) });
+        if (afterId) query.set('after_id', afterId);
+        const payload = await getJson(`/v1/models?${query.toString()}`, 'model discovery');
+        for (const entry of Array.isArray(payload?.data) ? payload.data : []) {
+          const model = mapAnthropicModel(entry);
+          if (!model || seen.has(model.id)) continue;
+          seen.add(model.id);
+          models.push(model);
+        }
+        const lastId = toText(payload?.last_id);
+        if (payload?.has_more !== true || !lastId || cursors.has(lastId)) break;
+        cursors.add(lastId);
+        afterId = lastId;
+      }
+      return models;
+    },
+  };
+}

package/shared/context-window-fallbacks.mjs

@@ -50,6 +50,9 @@ export const MODEL_FALLBACK_LIMITS = Object.freeze({
   // (public xAI docs values); also reachable through the Cursor catalog.
   'grok-4': 256000,
   'grok-code-fast-1': 256000,
+  // DeepSeek (api-docs.deepseek.com, list-models: context_window 1048576).
+  'deepseek-flash': 1048576,
+  'deepseek-v4-pro': 1048576,
 });
 
 /**