@openhoo/hoopilot 2.1.9 → 2.1.10

package/dist/codexx.js

@@ -3,7 +3,7 @@ import {
   buildCodexxInvocation,
   main,
   verifyCodexxModel
-} from "./chunk-FH6WSFOC.js";
+} from "./chunk-2GIR4W4A.js";
 export {
   buildCodexxInvocation,
   main,

package/dist/index.js

@@ -3,6 +3,7 @@ import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync }
 import { dirname, join } from "path";
 
 // src/util.ts
+import { isIP } from "net";
 function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
@@ -39,9 +40,16 @@ function parseUrl(rawUrl) {
   }
   return url;
 }
-var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
 function isLoopbackHostname(host) {
-  return LOOPBACK_HOSTNAMES.has(host);
+  const normalized = host.trim().toLowerCase();
+  const address = normalized.startsWith("[") && normalized.endsWith("]") ? normalized.slice(1, -1) : normalized;
+  if (address === "localhost") {
+    return true;
+  }
+  if (isIP(address) === 4) {
+    return address.startsWith("127.");
+  }
+  return isIP(address) === 6 && (address === "::1" || address === "0:0:0:0:0:0:0:1");
 }
 function isLoopbackHttpUrl(url) {
   return url.protocol === "http:" && isLoopbackHostname(url.hostname);
@@ -2409,7 +2417,7 @@ function anthropicMessagesToResponsesInput(messages) {
             arguments: JSON.stringify(asRecord(part.input)),
             cache_control: anthropicCacheControl(part.cache_control),
             call_id: textValue(part.id) || `call_hoopilot_${fallbackToolCallIndex++}`,
-            name: textValue(part.name),
+            name: requiredAnthropicText(part.name, "tool_use name"),
             type: "function_call"
           })
         );
@@ -2555,7 +2563,7 @@ function anthropicTools(tools) {
     return removeUndefined({
       cache_control: anthropicCacheControl(record.cache_control),
       description: record.description,
-      name: record.name,
+      name: requiredAnthropicText(record.name, "tool name"),
       parameters: record.input_schema,
       strict: record.strict,
       type: "function"
@@ -2628,12 +2636,19 @@ function anthropicToolChoice(toolChoice) {
     return "none";
   }
   if (type === "tool") {
-    return { name: textValue(record.name), type: "function" };
+    return { name: requiredAnthropicText(record.name, "tool_choice name"), type: "function" };
   }
   throw new AnthropicCompatibilityError(
     `Anthropic tool_choice type "${type || "unknown"}" is not supported.`
   );
 }
+function requiredAnthropicText(value, field) {
+  const text = textValue(value).trim();
+  if (!text) {
+    throw new AnthropicCompatibilityError(`Anthropic ${field} is required.`);
+  }
+  return text;
+}
 function anthropicThinkingToReasoning(thinking) {
   const record = asRecord(thinking);
   if (Object.keys(record).length === 0) {
@@ -3922,6 +3937,17 @@ function isLoopbackOrigin(origin) {
 }
 
 // src/http/responses.ts
+var HOP_BY_HOP_HEADERS = [
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+];
+var STALE_BODY_HEADERS = ["content-encoding", "content-length"];
 function jsonResponse(body, status = 200) {
   return new Response(JSON.stringify(body), {
     headers: {
@@ -3961,9 +3987,7 @@ function responseFromText(source, text) {
 }
 function proxyResponse(upstream) {
   const headers = new Headers(upstream.headers);
-  headers.delete("content-encoding");
-  headers.delete("content-length");
-  headers.delete("transfer-encoding");
+  stripProxyUnsafeHeaders(headers);
   for (const [key, value] of Object.entries(corsHeaders())) {
     headers.set(key, value);
   }
@@ -3989,6 +4013,23 @@ function websocketUnsupportedResponse() {
   response.headers.set("upgrade", "websocket");
   return response;
 }
+function stripProxyUnsafeHeaders(headers) {
+  const connection = headers.get("connection");
+  if (connection) {
+    for (const name of connection.split(",")) {
+      const trimmed = name.trim();
+      if (trimmed) {
+        headers.delete(trimmed);
+      }
+    }
+  }
+  for (const name of HOP_BY_HOP_HEADERS) {
+    headers.delete(name);
+  }
+  for (const name of STALE_BODY_HEADERS) {
+    headers.delete(name);
+  }
+}
 
 // src/version.ts
 var BAKED_VERSION = typeof HOOPILOT_VERSION !== "undefined" ? HOOPILOT_VERSION : void 0;
@@ -4851,7 +4892,7 @@ function dashboardResponse() {
 }
 async function handleUsage(metrics, readUsage, request) {
   const view = new URL(request.url).searchParams.get("view");
-  const { copilot, error } = await readUsage(request.signal);
+  const { copilot, error } = await readUsage();
   const proxy = view === DASHBOARD_USAGE_VIEW ? metrics.snapshot({
     excludeRoutes: DASHBOARD_EXCLUDED_ROUTES,
     excludeUpstreamPaths: DASHBOARD_EXCLUDED_UPSTREAM_PATHS