@rynfar/meridian 1.69.0 → 1.70.0

package/README.md

@@ -108,6 +108,7 @@ The Claude Agent SDK provides programmatic access to Claude. But your favorite c
 | [Prime Agent](https://www.npmjs.com/package/prime-agent) | ⚠️ Single-agent verified | Extension config (see [Agent Setup](docs/agents.md)) — reliable with one active agent. Concurrent RLM subagents receive distinct session keys, but are not yet production-safe; see [Prime Agent subagents](#prime-agent-subagents). The extension's `metadata.user_id` stamp is **required**, not optional. |
 | [Claude Code](https://docs.anthropic.com/en/docs/claude-code) | ✅ Verified | `ANTHROPIC_BASE_URL` — remote clients share a Max subscription over the network; client CWD preserved in system prompt |
 | [Cherry Studio](https://github.com/CherryHQ/cherry-studio) | ✅ Verified | `cherry` adapter (see [Agent Setup](docs/agents.md)) — chat client with Claude's built-in web search via internal mode |
+| [Polytoken](https://polytoken.dev/) | ✅ Verified | Provider config (see [Agent Setup](docs/agents.md#Polytoken)) — `X-Polytoken-Session` identity, mandatory client-owned tools (passthrough cannot be disabled), signed-thinking passthrough |
 | Jcode | ✅ Verified | `/v1/chat/completions` + `x-jcode-session` header — dedicated `jcode` adapter keeps append-only history intact, so retained sessions resume on one SDK session (90.9% cache hit on turn 2 of a two-turn Opus session) |
 | [Codex CLI](https://github.com/openai/codex) | ✅ Verified | `/v1/responses` (see [Agent Setup](docs/agents.md)) — Responses-API provider, passthrough tool execution; verified on 0.144 (plain + tool-driving turns) |
 | [Continue](https://github.com/continuedev/continue) | 🔲 Untested | OpenAI-compatible endpoints should work — set `apiBase` to `http://127.0.0.1:3456` |

package/dist/{cli-x1sv3bqf.js → cli-198xnjcn.js}

@@ -3338,6 +3338,93 @@ var init_cherry = __esm(() => {
   };
 });
 
+// src/proxy/transforms/polytoken.ts
+var polytokenTransforms;
+var init_polytoken = __esm(() => {
+  polytokenTransforms = [
+    {
+      name: "polytoken-core",
+      adapters: ["polytoken"],
+      onRequest(ctx) {
+        return {
+          ...ctx,
+          blockedTools: [],
+          incompatibleTools: [],
+          allowedMcpTools: [],
+          coreToolNames: [],
+          passthrough: true,
+          sdkAgents: {},
+          sdkHooks: undefined,
+          systemContext: ctx.systemContext,
+          supportsThinking: true,
+          shouldTrackFileChanges: false,
+          extractFileChangesFromToolUse: undefined
+        };
+      }
+    }
+  ];
+});
+
+// src/proxy/adapters/polytoken.ts
+function normalizePolytokenSessionId(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+var POLYTOKEN_SESSION_HEADER = "x-polytoken-session", polytokenAdapter;
+var init_polytoken2 = __esm(() => {
+  init_messages();
+  init_polytoken();
+  polytokenAdapter = {
+    name: "polytoken",
+    clientEnvironmentMayDifferFromProxy: true,
+    getSessionId(c) {
+      return normalizePolytokenSessionId(c.req.header(POLYTOKEN_SESSION_HEADER));
+    },
+    extractWorkingDirectory(_body) {
+      return;
+    },
+    extractClientWorkingDirectory(_body) {
+      return;
+    },
+    normalizeContent(content) {
+      return normalizeContent(content);
+    },
+    getBlockedBuiltinTools() {
+      return [];
+    },
+    getAgentIncompatibleTools() {
+      return [];
+    },
+    getMcpServerName() {
+      return "polytoken";
+    },
+    getAllowedMcpTools() {
+      return [];
+    },
+    getCoreToolNames() {
+      return [];
+    },
+    usesPassthrough() {
+      return true;
+    },
+    supportsThinking() {
+      return true;
+    },
+    shouldTrackFileChanges() {
+      return false;
+    },
+    buildSdkAgents(_body, _mcpToolNames) {
+      return {};
+    },
+    buildSdkHooks(_body, _sdkAgents) {
+      return;
+    },
+    buildSystemContextAddendum(_body, _sdkAgents) {
+      return "";
+    }
+  };
+});
+
 // src/proxy/adapterInstances.ts
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
 import { join as join5 } from "node:path";
@@ -3429,6 +3516,10 @@ __export(exports_detect, {
 function listAdapterNames() {
   return [...new Set(Object.values(ADAPTER_MAP).map((a) => a.name))];
 }
+function resolveDefaultAdapter() {
+  const current = (process.env.MERIDIAN_DEFAULT_AGENT || "").toLowerCase();
+  return ADAPTER_MAP[current] ?? openCodeAdapter;
+}
 function isLiteLLMRequest(c) {
   if ((c.req.header("user-agent") || "").startsWith("litellm/"))
     return true;
@@ -3456,19 +3547,20 @@ function detectAdapter(c) {
   }
   const instances = loadAdapterInstances();
   const instanceNames = Object.keys(instances);
-  if (instanceNames.length > 0) {
-    if (agentOverride && instances[agentOverride]) {
-      const inst = makeInstanceAdapter(agentOverride, instances[agentOverride]);
+  if (instanceNames.length > 0 && agentOverride && instances[agentOverride]) {
+    const inst = makeInstanceAdapter(agentOverride, instances[agentOverride]);
+    if (inst)
+      return inst;
+  }
+  if (normalizePolytokenSessionId(c.req.header("x-polytoken-session"))) {
+    return polytokenAdapter;
+  }
+  for (const name of instanceNames) {
+    if (matchesInstance(instances[name], (h) => c.req.header(h))) {
+      const inst = makeInstanceAdapter(name, instances[name]);
       if (inst)
         return inst;
     }
-    for (const name of instanceNames) {
-      if (matchesInstance(instances[name], (h) => c.req.header(h))) {
-        const inst = makeInstanceAdapter(name, instances[name]);
-        if (inst)
-          return inst;
-      }
-    }
   }
   if (c.req.header("x-opencode-session")) {
     return openCodeAdapter;
@@ -3486,6 +3578,9 @@ function detectAdapter(c) {
   if (userAgent.startsWith("Charm-Crush/")) {
     return crushAdapter;
   }
+  if (/^Polytoken(?:[\s/]|$)/.test(userAgent)) {
+    return polytokenAdapter;
+  }
   if (c.req.header("x-session-affinity")) {
     return openCodeAdapter;
   }
@@ -3499,9 +3594,9 @@ function detectAdapter(c) {
   if (isLiteLLMRequest(c)) {
     return passthroughAdapter;
   }
-  return defaultAdapter;
+  return resolveDefaultAdapter();
 }
-var ADAPTER_MAP, envDefault, defaultAdapter;
+var ADAPTER_MAP, envDefault;
 var init_detect = __esm(() => {
   init_opencode2();
   init_droid2();
@@ -3515,6 +3610,7 @@ var init_detect = __esm(() => {
   init_jcode();
   init_codex();
   init_cherry();
+  init_polytoken2();
   init_adapterInstances();
   ADAPTER_MAP = {
     opencode: openCodeAdapter,
@@ -3529,6 +3625,7 @@ var init_detect = __esm(() => {
     claudecode: claudeCodeAdapter,
     cherry: cherryAdapter,
     cherrystudio: cherryAdapter,
+    polytoken: polytokenAdapter,
     openai: openAiAdapter,
     jcode: jcodeAdapter,
     codex: codexAdapter
@@ -3537,7 +3634,6 @@ var init_detect = __esm(() => {
   if (envDefault && !ADAPTER_MAP[envDefault]) {
     console.warn(`[meridian] Unknown MERIDIAN_DEFAULT_AGENT="${envDefault}". ` + `Valid values: ${Object.keys(ADAPTER_MAP).join(", ")}. Falling back to opencode.`);
   }
-  defaultAdapter = ADAPTER_MAP[envDefault] ?? openCodeAdapter;
 });
 
 // src/proxy/sdkFeatures.ts
@@ -3693,6 +3789,14 @@ var init_sdkFeatures = __esm(() => {
     },
     codex: {
       codeSystemPrompt: false
+    },
+    polytoken: {
+      codeSystemPrompt: false,
+      clientSystemPrompt: true,
+      claudeMd: "off",
+      memory: false,
+      dreaming: false,
+      sharedMemory: false
     }
   };
   VALID_CLAUDE_MD_VALUES = new Set(["off", "project", "full"]);
@@ -23563,6 +23667,7 @@ var BILLING_SIGNALS = [
   /^\s*(?:(?:error|api error|claude code returned an error result):\s*)*credit balance is too low[.!]?\s*$/m,
   /^\s*(?:(?:error|api error|claude code returned an error result|subprocess stderr):\s*)*your (?:group|organization|org)(?:'|’)s usage limit is set to \$\d/m
 ];
+var SUBSCRIPTION_ACCESS_DISABLED = /^\s*(?:(?:error|api error|claude code returned an error result|subprocess stderr):\s*|failed to authenticate\.\s*)*(?:\d{3} )?your (?:organization|org) has disabled claude subscription access/m;
 var HIT_YOUR_LIMIT = /hit your (?:[\w-]+ )?limit/;
 var HIT_YOUR_SPEND_LIMIT = /^\s*(?:(?:error|api error|claude code returned an error result|subprocess stderr):\s*)*you(?:'|’)ve hit your (?:[\w'’-]+ ){0,4}(?:spend|usage) limit/m;
 var REACHED_YOUR_TIER_LIMIT = /^[ \t]*(?:(?:error|api error|claude code returned an error result|subprocess stderr):[ \t]*)*(?:\d{3}[ \t]+)?you(?:'|’)ve reached your (?:claude )?(?:fable|mythos|opus|sonnet|haiku)(?: \d+(?:\.\d+)*)? limit(?:(?:[.!][ \t]+|[ \t]+)(?:(?:run[ \t]+)?\/usage-credits(?:[ \t]+to[ \t]+continue)?(?:[ \t]+or[ \t]+switch[ \t]+models[ \t]+with[ \t]+\/model)?|\/model[ \t]+to[ \t]+switch[ \t]+models|switch[ \t]+to[ \t]+another[ \t]+model(?:[ \t]+to[ \t]+continue)?)\.?|[.!]?)[ \t\r]*$/m;
@@ -23591,6 +23696,13 @@ function classifyError(errMsg, model) {
       message: "Claude OAuth token has expired and could not be refreshed automatically. Run 'claude login' in your terminal to re-authenticate."
     };
   }
+  if (SUBSCRIPTION_ACCESS_DISABLED.test(lower)) {
+    return {
+      status: 402,
+      type: "billing_error",
+      message: "This account's organization has disabled Claude subscription access for Claude Code. Ask the organization admin to re-enable it, or serve this request from an API-key profile — an identical retry on this account fails the same way."
+    };
+  }
   if (HTTP_401.test(lower) || lower.includes("authentication") || lower.includes("invalid auth") || lower.includes("credentials")) {
     return {
       status: 401,
@@ -31905,6 +32017,7 @@ var claudeCodeTransforms = [
 ];
 
 // src/proxy/transforms/registry.ts
+init_polytoken();
 var ADAPTER_TRANSFORMS = {
   opencode: openCodeTransforms,
   crush: crushTransforms,
@@ -31917,7 +32030,8 @@ var ADAPTER_TRANSFORMS = {
   "claude-code": claudeCodeTransforms,
   openai: openCodeTransforms,
   jcode: openCodeTransforms,
-  codex: [...openCodeTransforms, ...codexTransforms]
+  codex: [...openCodeTransforms, ...codexTransforms],
+  polytoken: polytokenTransforms
 };
 function getAdapterTransforms(adapterName) {
   return ADAPTER_TRANSFORMS[adapterName] ?? [];
@@ -37525,7 +37639,7 @@ data: ${JSON.stringify(lastError)}
         resolvedProfileId = profile.id;
         const authStatus = await getClaudeAuthStatusAsync(profile.id !== "default" ? profile.id : undefined, Object.keys(profile.env).length > 0 ? profile.env : undefined);
         const requestSource = c.req.header("x-meridian-source")?.slice(0, 64) || undefined;
-        const declaredAgentMode = adapter.getAgentMode?.(c, body) ?? c.req.header("x-opencode-agent-mode") ?? null;
+        const declaredAgentMode = adapter.getAgentMode?.(c, body) ?? (adapter.baseName === "polytoken" || adapter.name === "polytoken" ? undefined : c.req.header("x-opencode-agent-mode")) ?? null;
         const isSubagentRequest = declaredAgentMode === "subagent" || requestSource?.startsWith("subagent-") === true;
         const agentMode = isSubagentRequest ? "subagent" : declaredAgentMode;
         const requestedModel = typeof body.model === "string" ? body.model : "sonnet";
@@ -37576,9 +37690,10 @@ data: ${JSON.stringify(lastError)}
           workingDirectory
         }), adapterBase);
         const stream3 = pipelineCtx.prefersStreaming !== undefined ? pipelineCtx.prefersStreaming : body.stream ?? false;
-        const effortHeader = c.req.header("x-opencode-effort");
-        const thinkingHeader = c.req.header("x-opencode-thinking");
-        const taskBudgetHeader = c.req.header("x-opencode-task-budget");
+        const isPolytokenBase = adapterBase === "polytoken";
+        const effortHeader = isPolytokenBase ? undefined : c.req.header("x-opencode-effort");
+        const thinkingHeader = isPolytokenBase ? undefined : c.req.header("x-opencode-thinking");
+        const taskBudgetHeader = isPolytokenBase ? undefined : c.req.header("x-opencode-task-budget");
         const rawBetaHeader = c.req.header("anthropic-beta");
         const betaFilter = filterBetasForProfile(rawBetaHeader, profile.type, getBetaPolicyFromEnv());
         if (betaFilter.stripped.length > 0) {
@@ -37733,7 +37848,7 @@ data: ${JSON.stringify(lastError)}
         const trailingSystemReminderOptions = adapterBase === "claude-code" ? { allowTrailingSystemReminder: true } : undefined;
         const durableCheckpointContinuation = durableCheckpointIds?.length && durableMappingAtTurn.status === "found" && matchesStoredLineagePrefix(durableMappingAtTurn.session, lineageMessages) ? coalesceCompleteToolResultContinuation((body.messages || []).slice(durableMappingAtTurn.session.messageCount), durableCheckpointIds, trailingSystemReminderOptions) : undefined;
         const advancesDurableCheckpoint = Boolean(durableCheckpointContinuation);
-        const passthrough = adapter.instancePassthrough !== undefined ? adapter.instancePassthrough : pipelineCtx.passthrough !== undefined ? pipelineCtx.passthrough : envBool("PASSTHROUGH");
+        const passthrough = adapterBase === "polytoken" ? true : adapter.instancePassthrough !== undefined ? adapter.instancePassthrough : pipelineCtx.passthrough !== undefined ? pipelineCtx.passthrough : envBool("PASSTHROUGH");
         if (advancesDurableCheckpoint && lineageResult.type !== "continuation" && lineageResult.type !== "compaction" && durableMappingAtTurn.status === "found") {
           const checkpointSession = getSessionByClaudeId(durableMappingAtTurn.session.claudeSessionId);
           if (checkpointSession) {
@@ -38174,7 +38289,7 @@ data: ${JSON.stringify(lastError)}
               }
               const clientTool = requestTools.find((t) => t.name === toolName);
               let toolInput = normalizeToolInput(input.tool_input, clientTool?.input_schema);
-              if (toolName.toLowerCase() === "task" && toolInput?.subagent_type && typeof toolInput.subagent_type === "string") {
+              if (adapterBase !== "polytoken" && toolName.toLowerCase() === "task" && toolInput?.subagent_type && typeof toolInput.subagent_type === "string") {
                 toolInput = { ...toolInput, subagent_type: resolveAgentAlias(toolInput.subagent_type, validAgentNames) };
               }
               const signature = toolUseSignature(toolName, toolInput);
@@ -39086,7 +39201,7 @@ data: ${JSON.stringify({
                 try {
                   const clientTool = requestTools.find((tool2) => tool2.name === buffered.name);
                   const parsed = normalizeToolInput(JSON.parse(buffered.json), clientTool?.input_schema);
-                  if (buffered.name.toLowerCase() === "task" && typeof parsed?.subagent_type === "string") {
+                  if (adapterBase !== "polytoken" && buffered.name.toLowerCase() === "task" && typeof parsed?.subagent_type === "string") {
                     parsed.subagent_type = resolveAgentAlias(parsed.subagent_type, validAgentNames);
                   }
                   fixed = JSON.stringify(parsed);

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   startProxyServer
-} from "./cli-x1sv3bqf.js";
+} from "./cli-198xnjcn.js";
 import"./cli-5jxyma6z.js";
 import"./cli-sry5aqdj.js";
 import"./cli-8yp89fan.js";