@skaile/transform-proxy 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.2
+
+- Fail closed on malformed request bodies: the Anthropic, OpenAI chat and OpenAI responses walkers refuse a JSON body whose shape they cannot classify (a root that is not an object; a `system`, `messages`, `input`, `instructions`, message `content`, text, thinking, tool-call `arguments` or tool-result slot of an unexpected type) with 400 `unsupported_content` instead of forwarding it untransformed. Unknown part, block and item types still pass through.
+- Upstream response `content-type` is matched case-insensitively, so `Text/Event-Stream` and `Application/JSON; charset=utf-8` replies are restored instead of relayed with placeholders.
+- omp extension: a failed rebind of the active model is an activation failure. `/anon on` rolls the routes back, persists nothing and stays `anon off`; in required mode, or when a later turn's rebind fails, the footer shows `anon error`. While anon is on or in error, a `before_provider_request` handler replaces the payload of any request whose model bypasses the proxy with an empty object (omp has no hook that cancels a provider request).
+- omp extension: the proxy session follows the root omp session. On `session_switch` (`/new`, `/resume`, `/fork`) and on a root `session_start` with a new id, every provider is re-routed with the new `x-skaile-transform-session`, and the in-process proxy drops the old session; headless `print` sessions (subagents) keep the parent's id.
+
 ## 0.2.1
 
 - Anthropic walker: the pipeline `instruction` is appended after the host's system prompt (last text block, or after a blank line for a string `system`) instead of being prepended. Claude Code gateways such as TeamClaude answer 429 `rate_limit_error` for Sonnet when the system prompt does not start with the Claude Code blocks; with the instruction first, omp and Claude Code requests for `claude-sonnet-4-5` through the proxy were refused.

package/README.md

@@ -31,6 +31,7 @@ Embeddings are refused on purpose: a vector of pseudonymized input cannot be res
 ## Refusals
 
 - Attachments (image, document, file parts) are refused with 400 `unsupported_content`. Nothing is sent upstream.
+- A body that is not JSON is refused with 400 `invalid_json`. A JSON body whose shape the walker cannot classify is refused with 400 `unsupported_content`: a root that is not an object, or a `system`, `messages`, `input`, `instructions`, message `content`, text, thinking, tool-call `arguments` or tool-result slot of an unexpected type. Unknown part, block and item types still pass through untouched.
 - Unknown routes, pipelines and upstreams are refused before any body is read or transform is built.
 - A transform that throws refuses the request with 502 `transform_failed`. Nothing is sent upstream.
 - Bedrock (SigV4 covers the body) and Vertex are not routed. Refuse them in the caller.
@@ -91,13 +92,15 @@ The package ships an [omp](https://omp.sh) extension (subpath `@skaile/transform
 omp plugin install @skaile/transform-proxy
 ```
 
-It adds the command `/anon on|off|status` and the footer status `anon on` / `anon off`.
+It adds the command `/anon on|off|status` and the footer status `anon on`, `anon off` or `anon error`.
 
 - `/anon on` routes every provider of omp's model registry through the proxy: the provider's `baseUrl` becomes the proxy URL, and the original base URL travels in `x-skaile-transform-upstream`, next to `x-skaile-transform-session` (the omp session id) and the token. The provider's own headers and auth stay in place and are relayed.
   - With `SKAILE_TRANSFORM_PROXY_URL` (and `SKAILE_TRANSFORM_PROXY_TOKEN`) set, it uses that running proxy, and the proxy applies its `defaultPipeline`.
   - Otherwise it starts one proxy inside the omp process, from the config lookup of the CLI (`./.skaile/transform-proxy.yaml`, then `~/.config/skaile/transform-proxy.yaml`). That config must set `defaultPipeline`. Without a config, `/anon on` refuses and says where to put one.
   - Providers on a wire the proxy does not rewrite (Bedrock, Vertex, Gemini, agent bridges, providers without a base URL) are routed too, so the proxy refuses their requests: the setup fails closed. `/anon status` lists them as refused.
-  - The session's active model is rebound to the re-routed one, so the next request already uses the new base URL.
+  - The session's active model is rebound to the re-routed one, so the next request already uses the new base URL. A rebind that fails is an activation failure: `/anon on` rolls the routes back, saves nothing and stays off. When anon is required, or a later turn's rebind fails while anon is on, the footer shows `anon error`.
+- While anon is on or in error, a `before_provider_request` handler checks every model request: a request whose model does not target the proxy gets its payload replaced with an empty object, so no conversation text leaves, and an error notice names the model. omp has no hook that cancels a provider request, and a throwing handler is only logged, so this replacement is the block.
+- The proxy session follows the root omp session: on `/new`, `/resume`, `/fork` (`session_switch`) and on a root `session_start` with a new session id, every provider is re-routed with the new `x-skaile-transform-session`, and the in-process proxy drops the old session. A `session_start` of a headless `print` session (how omp runs subagents) keeps the parent's id, so subagents share its pseudonyms.
 - `/anon off` restores the original base URLs and headers.
 - `/anon status` shows the state, the proxy URL and its source, the pipeline, the session id, and the routed and refused providers.
 - The enabled flag is saved in `skaile-transform-proxy.json` in omp's agent dir (`~/.omp/agent`; `SKAILE_TRANSFORM_PROXY_OMP_STATE` overrides the path) and re-applied when a session starts.

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { d as createTransformProxy, o as resolveProxyConfig, v as errorMessage } from "./config-Xdn_LYpZ.mjs";
+import { d as createTransformProxy, o as resolveProxyConfig, v as errorMessage } from "./config-PKHxejC8.mjs";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";

package/dist/{config-Xdn_LYpZ.mjs → config-PKHxejC8.mjs}

@@ -315,24 +315,30 @@ const signatureKey$1 = (signature) => `anthropic:${signature}`;
 function refuse$1(block) {
 	if (typeof block.type === "string" && REFUSED_BLOCKS[block.type] === true) throw new UnsupportedContentError(`Anthropic ${block.type} content cannot be transformed`);
 }
+/** A slot the walker reads holds a value it cannot classify: refused, never forwarded untransformed. */
+function malformed$2(slot) {
+	throw new UnsupportedContentError(`Anthropic ${slot} has an unexpected shape`);
+}
 async function outbound$2(transform, text, leaf) {
 	return text === "" ? text : transform.outbound(text, leaf);
 }
-/** A string, or an array of blocks whose `text` blocks are rewritten. */
-async function rewriteText(content, leaf, transform) {
+/** A string, or an array of blocks whose `text` blocks are rewritten; anything else is refused. */
+async function rewriteText(content, slot, leaf, transform) {
 	if (typeof content === "string") return outbound$2(transform, content, leaf);
-	if (!Array.isArray(content)) return content;
+	if (!Array.isArray(content)) return malformed$2(slot);
 	const out = [];
 	for (const block of content) {
-		if (!isObj$2(block)) {
+		if (!isObj$2(block)) return malformed$2(`${slot} block`);
+		refuse$1(block);
+		if (block.type !== "text") {
 			out.push(block);
 			continue;
 		}
-		refuse$1(block);
-		out.push(block.type === "text" && typeof block.text === "string" ? {
+		if (typeof block.text !== "string") return malformed$2(`${slot} text block`);
+		out.push({
 			...block,
 			text: await outbound$2(transform, block.text, leaf)
-		} : block);
+		});
 	}
 	return out;
 }
@@ -364,6 +370,7 @@ function restoreStrings$1(value, transform) {
 }
 /** A thinking block: swaps in the cached model text when its signature is known, else rewrites it. */
 async function rewriteThinking(block, ctx) {
+	if (typeof block.thinking !== "string") return malformed$2("thinking block");
 	if (typeof block.signature === "string") {
 		const cached = ctx.signatures.get(signatureKey$1(block.signature));
 		if (cached !== void 0) return {
@@ -371,7 +378,6 @@ async function rewriteThinking(block, ctx) {
 			thinking: cached
 		};
 	}
-	if (typeof block.thinking !== "string") return block;
 	return {
 		...block,
 		thinking: await outbound$2(ctx.transform, block.thinking, { kind: "thinking" })
@@ -380,20 +386,18 @@ async function rewriteThinking(block, ctx) {
 async function rewriteContent$2(content, role, toolNames, ctx) {
 	const textKind = role === "assistant" ? "assistant" : "user";
 	if (typeof content === "string") return outbound$2(ctx.transform, content, { kind: textKind });
-	if (!Array.isArray(content)) return content;
+	if (!Array.isArray(content)) return malformed$2("message content");
 	const out = [];
 	for (const block of content) {
-		if (!isObj$2(block)) {
-			out.push(block);
-			continue;
-		}
+		if (!isObj$2(block)) return malformed$2("message content block");
 		refuse$1(block);
 		switch (block.type) {
 			case "text":
-				out.push(typeof block.text === "string" ? {
+				if (typeof block.text !== "string") return malformed$2("text block");
+				out.push({
 					...block,
 					text: await outbound$2(ctx.transform, block.text, { kind: textKind })
-				} : block);
+				});
 				break;
 			case "thinking":
 				out.push(await rewriteThinking(block, ctx));
@@ -410,10 +414,14 @@ async function rewriteContent$2(content, role, toolNames, ctx) {
 				break;
 			}
 			case "tool_result": {
+				if (block.content === void 0) {
+					out.push(block);
+					break;
+				}
 				const toolName = typeof block.tool_use_id === "string" ? toolNames.get(block.tool_use_id) : void 0;
 				out.push({
 					...block,
-					content: await rewriteText(block.content, {
+					content: await rewriteText(block.content, "tool_result content", {
 						kind: "toolResult",
 						toolName
 					}, ctx.transform)
@@ -557,17 +565,21 @@ function createStreamTransformer$2(ctx) {
 }
 const anthropicWalker = {
 	async request(body, ctx) {
-		if (!isObj$2(body)) return body;
+		if (!isObj$2(body)) return malformed$2("request body");
 		const out = { ...body };
-		if (body.system !== void 0) out.system = await rewriteText(body.system, { kind: "system" }, ctx.transform);
+		if (body.system !== void 0) out.system = await rewriteText(body.system, "system", { kind: "system" }, ctx.transform);
 		if (ctx.transform.instruction !== void 0) out.system = withInstruction(out.system, ctx.transform.instruction);
-		if (Array.isArray(body.messages)) {
+		if (body.messages !== void 0) {
+			if (!Array.isArray(body.messages)) return malformed$2("messages");
 			const toolNames = toolNamesById(body.messages);
 			const messages = [];
-			for (const message of body.messages) messages.push(isObj$2(message) ? {
-				...message,
-				content: await rewriteContent$2(message.content, message.role, toolNames, ctx)
-			} : message);
+			for (const message of body.messages) {
+				if (!isObj$2(message)) return malformed$2("message");
+				messages.push({
+					...message,
+					content: await rewriteContent$2(message.content, message.role, toolNames, ctx)
+				});
+			}
 			out.messages = messages;
 		}
 		return out;
@@ -615,21 +627,28 @@ const REASONING_FIELDS = ["reasoning_content", "reasoning"];
 async function outbound$1(transform, text, leaf) {
 	return text === "" ? text : transform.outbound(text, leaf);
 }
-/** A string, or an array of parts whose `text` parts are rewritten. */
+/** A slot the walker reads holds a value it cannot classify: refused, never forwarded untransformed. */
+function malformed$1(slot) {
+	throw new UnsupportedContentError(`OpenAI chat ${slot} has an unexpected shape`);
+}
+/** A string, or an array of parts whose `text` parts are rewritten; `null`/absent carries no text; anything else is refused. */
 async function rewriteContent$1(content, leaf, transform) {
 	if (typeof content === "string") return outbound$1(transform, content, leaf);
-	if (!Array.isArray(content)) return content;
+	if (content === void 0 || content === null) return content;
+	if (!Array.isArray(content)) return malformed$1("message content");
 	const out = [];
 	for (const part of content) {
-		if (!isObj$1(part)) {
+		if (!isObj$1(part)) return malformed$1("content part");
+		if (typeof part.type === "string" && REFUSED_PARTS$1[part.type] === true) throw new UnsupportedContentError(`OpenAI chat ${part.type} content cannot be transformed`);
+		if (part.type !== "text") {
 			out.push(part);
 			continue;
 		}
-		if (typeof part.type === "string" && REFUSED_PARTS$1[part.type] === true) throw new UnsupportedContentError(`OpenAI chat ${part.type} content cannot be transformed`);
-		out.push(part.type === "text" && typeof part.text === "string" ? {
+		if (typeof part.text !== "string") return malformed$1("text part");
+		out.push({
 			...part,
 			text: await outbound$1(transform, part.text, leaf)
-		} : part);
+		});
 	}
 	return out;
 }
@@ -677,17 +696,20 @@ function restoreArguments$1(args, transform) {
 	return JSON.stringify(restoreStrings(parsed, transform));
 }
 async function rewriteToolCalls(calls, transform, names) {
-	if (!Array.isArray(calls)) return calls;
+	if (calls === void 0 || calls === null) return calls;
+	if (!Array.isArray(calls)) return malformed$1("tool_calls");
 	const out = [];
 	for (const call of calls) {
-		if (!isObj$1(call) || !isObj$1(call.function)) {
+		if (!isObj$1(call)) return malformed$1("tool call");
+		if (call.type !== void 0 && call.type !== "function") {
 			out.push(call);
 			continue;
 		}
 		const fn = call.function;
+		if (!isObj$1(fn) || typeof fn.arguments !== "string") return malformed$1("function tool call");
 		const toolName = typeof fn.name === "string" ? fn.name : void 0;
 		if (typeof call.id === "string" && toolName !== void 0) names.set(call.id, toolName);
-		out.push(typeof fn.arguments === "string" ? {
+		out.push({
 			...call,
 			function: {
 				...fn,
@@ -696,7 +718,7 @@ async function rewriteToolCalls(calls, transform, names) {
 					toolName
 				}, transform)
 			}
-		} : call);
+		});
 	}
 	return out;
 }
@@ -714,6 +736,7 @@ async function rewriteMessage(message, transform, names) {
 			for (const field of REASONING_FIELDS) {
 				const value = message[field];
 				if (typeof value === "string") out[field] = await outbound$1(transform, value, { kind: "thinking" });
+				else if (value !== void 0 && value !== null) return malformed$1(`assistant ${field}`);
 			}
 			out.content = await rewriteContent$1(message.content, { kind: "assistant" }, transform);
 			out.tool_calls = await rewriteToolCalls(message.tool_calls, transform, names);
@@ -727,7 +750,15 @@ async function rewriteMessage(message, transform, names) {
 			}, transform);
 			break;
 		}
-		default: return message;
+		case "function": {
+			const toolName = typeof message.name === "string" ? message.name : void 0;
+			out.content = await rewriteContent$1(message.content, {
+				kind: "toolResult",
+				toolName
+			}, transform);
+			break;
+		}
+		default: return malformed$1("message role");
 	}
 	if (message.content === void 0) delete out.content;
 	return out;
@@ -874,12 +905,16 @@ function createStreamTransformer$1(ctx) {
 }
 const openaiChatWalker = {
 	async request(body, ctx) {
-		if (!isObj$1(body)) return body;
+		if (!isObj$1(body)) return malformed$1("request body");
 		const out = { ...body };
-		if (Array.isArray(body.messages)) {
+		if (body.messages !== void 0) {
+			if (!Array.isArray(body.messages)) return malformed$1("messages");
 			const names = /* @__PURE__ */ new Map();
 			const messages = [];
-			for (const message of body.messages) messages.push(isObj$1(message) ? await rewriteMessage(message, ctx.transform, names) : message);
+			for (const message of body.messages) {
+				if (!isObj$1(message)) return malformed$1("message");
+				messages.push(await rewriteMessage(message, ctx.transform, names));
+			}
 			if (ctx.transform.instruction !== void 0) messages.unshift({
 				role: "system",
 				content: ctx.transform.instruction
@@ -937,21 +972,27 @@ function refuse(part) {
 async function outbound(transform, text, leaf) {
 	return text === "" ? text : transform.outbound(text, leaf);
 }
-/** A string, or an array of parts whose `input_text`/`output_text` parts are rewritten. */
-async function rewriteContent(content, leaf, transform) {
+/** A slot the walker reads holds a value it cannot classify: refused, never forwarded untransformed. */
+function malformed(slot) {
+	throw new UnsupportedContentError(`OpenAI responses ${slot} has an unexpected shape`);
+}
+/** A string, or an array of parts whose `input_text`/`output_text` parts are rewritten; anything else is refused. */
+async function rewriteContent(content, slot, leaf, transform) {
 	if (typeof content === "string") return outbound(transform, content, leaf);
-	if (!Array.isArray(content)) return content;
+	if (!Array.isArray(content)) return malformed(slot);
 	const out = [];
 	for (const part of content) {
-		if (!isObj(part)) {
+		if (!isObj(part)) return malformed(`${slot} part`);
+		refuse(part);
+		if (part.type !== "input_text" && part.type !== "output_text") {
 			out.push(part);
 			continue;
 		}
-		refuse(part);
-		out.push((part.type === "input_text" || part.type === "output_text") && typeof part.text === "string" ? {
+		if (typeof part.text !== "string") return malformed(`${slot} ${part.type} part`);
+		out.push({
 			...part,
 			text: await outbound(transform, part.text, leaf)
-		} : part);
+		});
 	}
 	return out;
 }
@@ -1002,17 +1043,14 @@ function cachedSummary(item, ctx) {
 	return texts;
 }
 async function rewriteReasoning(item, ctx) {
-	if (!Array.isArray(item.summary)) return item;
+	if (item.summary === void 0) return item;
+	if (!Array.isArray(item.summary)) return malformed("reasoning summary");
+	for (const part of item.summary) if (!isObj(part) || typeof part.text !== "string") return malformed("reasoning summary part");
 	const cached = cachedSummary(item, ctx);
 	const summary = [];
-	for (const [i, part] of item.summary.entries()) if (!isObj(part) || typeof part.text !== "string") summary.push(part);
-	else if (cached !== void 0) summary.push({
+	for (const [i, part] of item.summary.entries()) summary.push({
 		...part,
-		text: cached[i]
-	});
-	else summary.push({
-		...part,
-		text: await outbound(ctx.transform, part.text, { kind: "thinking" })
+		text: cached !== void 0 ? cached[i] : await outbound(ctx.transform, part.text, { kind: "thinking" })
 	});
 	return {
 		...item,
@@ -1032,15 +1070,15 @@ function toolNamesByCallId(items) {
 async function rewriteItem(item, toolNames, ctx) {
 	if (item.type === "message" || item.type === void 0 && item.role !== void 0) {
 		const kind = roleKind(item.role);
-		if (kind === void 0) return item;
+		if (kind === void 0) return malformed("message role");
 		return {
 			...item,
-			content: await rewriteContent(item.content, { kind }, ctx.transform)
+			content: await rewriteContent(item.content, "message content", { kind }, ctx.transform)
 		};
 	}
 	switch (item.type) {
 		case "function_call": {
-			if (typeof item.arguments !== "string") return item;
+			if (typeof item.arguments !== "string") return malformed("function_call arguments");
 			const toolName = typeof item.name === "string" ? item.name : void 0;
 			return {
 				...item,
@@ -1054,7 +1092,7 @@ async function rewriteItem(item, toolNames, ctx) {
 			const toolName = typeof item.call_id === "string" ? toolNames.get(item.call_id) : void 0;
 			return {
 				...item,
-				output: await rewriteContent(item.output, {
+				output: await rewriteContent(item.output, "function_call_output output", {
 					kind: "toolResult",
 					toolName
 				}, ctx.transform)
@@ -1226,18 +1264,22 @@ function createStreamTransformer(ctx) {
 }
 const openaiResponsesWalker = {
 	async request(body, ctx) {
-		if (!isObj(body)) return body;
+		if (!isObj(body)) return malformed("request body");
 		const out = { ...body };
 		if (typeof body.instructions === "string") out.instructions = await outbound(ctx.transform, body.instructions, { kind: "system" });
+		else if (body.instructions !== void 0 && body.instructions !== null) return malformed("instructions");
 		const instruction = ctx.transform.instruction;
 		if (instruction !== void 0) out.instructions = typeof out.instructions === "string" && out.instructions !== "" ? `${instruction}\n\n${out.instructions}` : instruction;
 		if (typeof body.input === "string") out.input = await outbound(ctx.transform, body.input, { kind: "user" });
 		else if (Array.isArray(body.input)) {
 			const toolNames = toolNamesByCallId(body.input);
 			const input = [];
-			for (const item of body.input) input.push(isObj(item) ? await rewriteItem(item, toolNames, ctx) : item);
+			for (const item of body.input) {
+				if (!isObj(item)) return malformed("input item");
+				input.push(await rewriteItem(item, toolNames, ctx));
+			}
 			out.input = input;
-		}
+		} else if (body.input !== void 0) return malformed("input");
 		return out;
 	},
 	response(body, ctx) {
@@ -1465,7 +1507,7 @@ async function createTransformProxy(options) {
 	/** Relays an upstream response. With `rewrite`, a 2xx JSON or SSE body is restored on the way back. */
 	async function relayUpstream(res, upstreamRes, rewrite) {
 		if (upstreamRes === void 0) return;
-		const contentType = upstreamRes.headers.get("content-type") ?? "";
+		const contentType = (upstreamRes.headers.get("content-type") ?? "").toLowerCase();
 		const headers = relayHeaders(upstreamRes.headers);
 		if (rewrite !== void 0 && upstreamRes.ok && contentType.startsWith("text/event-stream")) return pipeStream(res, upstreamRes, headers, rewrite.wire.stream(rewrite.ctx), log);
 		if (rewrite !== void 0 && upstreamRes.ok && contentType.includes("application/json")) {

package/dist/index.mjs

@@ -1 +1 @@
-export { t as CONFIG_FILE_NAME, s as PIPELINE_HEADER, c as SESSION_HEADER, l as TOKEN_HEADER, u as UPSTREAM_HEADER, h as UnsupportedContentError, m as anthropicWalker, _ as composeTransforms, n as configCandidates, g as createSessionFacts, d as createTransformProxy, r as findProxyConfig, i as loadProxyConfig, p as openaiChatWalker, f as openaiResponsesWalker, a as parseProxyConfig, o as resolveProxyConfig, y as silentLogger } from "./config-Xdn_LYpZ.mjs";
+export { t as CONFIG_FILE_NAME, s as PIPELINE_HEADER, c as SESSION_HEADER, l as TOKEN_HEADER, u as UPSTREAM_HEADER, h as UnsupportedContentError, m as anthropicWalker, _ as composeTransforms, n as configCandidates, g as createSessionFacts, d as createTransformProxy, r as findProxyConfig, i as loadProxyConfig, p as openaiChatWalker, f as openaiResponsesWalker, a as parseProxyConfig, o as resolveProxyConfig, y as silentLogger } from "./config-PKHxejC8.mjs";

package/dist/omp/index.d.mts

@@ -4,6 +4,8 @@ interface OmpModel {
   readonly id: string;
   readonly api: string;
   readonly baseUrl?: string;
+  /** The provider headers projected onto the model, the transform-proxy headers included. */
+  readonly headers?: Readonly<Record<string, string>>;
 }
 /** A runtime provider override: omp merges `headers` into the provider's existing headers. */
 interface OmpProviderOverride {
@@ -35,15 +37,22 @@ interface OmpContext {
   readonly sessionManager: {
     getSessionId(): string;
   };
-  /** The session's active model: a snapshot that a provider override does not update. */
+  /**
+   * The session's active model: a snapshot that a provider override does not update. In
+   * `before_provider_request` it is the model of that request.
+   */
   readonly model: OmpModel | undefined;
+  /** False for headless sessions: subagents, print and RPC mode. */
+  readonly hasUI?: boolean;
+  /** `tui`, `rpc`, `json` or `print`; subagent sessions run as `print`. */
+  readonly mode?: string;
 }
 interface OmpAutocompleteItem {
   value: string;
   label: string;
   description?: string;
 }
-type OmpEventName = 'session_start' | 'before_agent_start' | 'turn_start';
+type OmpEventName = 'session_start' | 'session_switch' | 'before_agent_start' | 'turn_start' | 'before_provider_request';
 /** Per-session actions of the extension API. */
 interface OmpSessionActions {
   /** Rebinds the session's active model (without persisting it as the default). */
@@ -55,7 +64,8 @@ interface OmpExtensionApi extends OmpSessionActions {
     getArgumentCompletions?: (argumentPrefix: string) => OmpAutocompleteItem[] | null;
     handler: (args: string, ctx: OmpContext) => Promise<void>;
   }): void;
-  on(event: OmpEventName, handler: (event: unknown, ctx: OmpContext) => void | Promise<void>): void;
+  /** For `before_provider_request`, a non-undefined result replaces the request payload. */
+  on(event: OmpEventName, handler: (event: unknown, ctx: OmpContext) => unknown): void;
 }
 interface AnonControllerDeps {
   readonly env: Readonly<Record<string, string | undefined>>;
@@ -71,14 +81,30 @@ interface AnonController {
   /** Handles `/anon <args>`. `session` rebinds the session's active model after a switch. */
   command(args: string, ctx: OmpContext, session: OmpSessionActions): Promise<void>;
   completions(prefix: string): OmpAutocompleteItem[] | null;
-  /** Applies the persisted flag (or required mode) and refreshes the status bar. */
+  /**
+   * Applies the persisted flag (or required mode) and refreshes the status bar. A root session
+   * whose omp session id changed rotates the proxy session; subagents keep the parent's id.
+   */
   sessionStart(ctx: OmpContext, session: OmpSessionActions): Promise<void>;
-  /** While on: routes providers that appeared, or were reset, since the last pass. */
+  /** `/new`, `/resume`, `/fork`: the root session changed, so the proxy session rotates. */
+  sessionSwitch(ctx: OmpContext, session: OmpSessionActions): Promise<void>;
+  /** While on (or failed): routes providers that appeared, or were reset, since the last pass. */
   reapply(ctx: OmpContext, session: OmpSessionActions): Promise<void>;
+  /**
+   * `before_provider_request`: while anon is on, failed or required, a request whose model does
+   * not target the transform proxy gets a replacement payload without any conversation text.
+   * Returns `undefined` to keep the payload.
+   */
+  providerRequest(ctx: OmpContext): Record<string, never> | undefined;
 }
 /**
  * The process-wide `/anon` state machine. omp builds one extension instance per session
  * (subagents included) while they share one model registry, so one controller serves them all.
+ *
+ * `wanted`: model requests must go through the proxy (required mode, or `/anon on`).
+ * `enabled`: every provider is routed and the active model is rebound. `wanted` without
+ * `enabled` is the error state: the footer shows `anon error` and `providerRequest` refuses
+ * every request that would bypass the proxy.
  */
 export declare function createAnonController(deps: AnonControllerDeps): AnonController;
 /** `$SKAILE_TRANSFORM_PROXY_OMP_STATE`, else `skaile-transform-proxy.json` in omp's agent dir (`$PI_CODING_AGENT_DIR` or `~/.omp/agent`). */

package/dist/omp/index.mjs

@@ -1,4 +1,4 @@
-import { c as SESSION_HEADER, d as createTransformProxy, i as loadProxyConfig, l as TOKEN_HEADER, n as configCandidates, r as findProxyConfig, u as UPSTREAM_HEADER, v as errorMessage, y as silentLogger } from "../config-Xdn_LYpZ.mjs";
+import { c as SESSION_HEADER, d as createTransformProxy, i as loadProxyConfig, l as TOKEN_HEADER, n as configCandidates, r as findProxyConfig, u as UPSTREAM_HEADER, v as errorMessage, y as silentLogger } from "../config-PKHxejC8.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -43,6 +43,11 @@ const VERBS = [
 /**
 * The process-wide `/anon` state machine. omp builds one extension instance per session
 * (subagents included) while they share one model registry, so one controller serves them all.
+*
+* `wanted`: model requests must go through the proxy (required mode, or `/anon on`).
+* `enabled`: every provider is routed and the active model is rebound. `wanted` without
+* `enabled` is the error state: the footer shows `anon error` and `providerRequest` refuses
+* every request that would bypass the proxy.
 */
 function createAnonController(deps) {
 	const env = deps.env;
@@ -50,6 +55,7 @@ function createAnonController(deps) {
 	const statePath = deps.statePath ?? defaultStatePath(env, deps.home);
 	const startProxy = deps.startProxy ?? createTransformProxy;
 	const registries = /* @__PURE__ */ new WeakMap();
+	let wanted = required;
 	let enabled = false;
 	let endpoint;
 	let starting;
@@ -59,7 +65,7 @@ function createAnonController(deps) {
 		if (state === void 0) {
 			state = {
 				originals: /* @__PURE__ */ new Map(),
-				routed: /* @__PURE__ */ new Set()
+				routed: /* @__PURE__ */ new Map()
 			};
 			registries.set(registry, state);
 		}
@@ -94,27 +100,44 @@ function createAnonController(deps) {
 		}
 		const options = loadProxyConfig(path);
 		if (options.defaultPipeline === void 0) throw new Error(`${path} sets no defaultPipeline: the omp extension sends no pipeline header`);
+		const proxy = await startProxy({
+			...options,
+			log: silentLogger
+		});
 		return {
-			url: (await startProxy({
-				...options,
-				log: silentLogger
-			})).url,
+			url: proxy.url,
 			pipeline: options.defaultPipeline,
-			source: `in-process, config ${path}`
+			source: `in-process, config ${path}`,
+			proxy
 		};
 	}
 	function currentSessionId(ctx) {
-		if (sessionId === void 0) {
-			let id;
-			try {
-				id = ctx.sessionManager.getSessionId();
-			} catch {
-				id = void 0;
-			}
-			sessionId = typeof id === "string" && id !== "" ? id : randomUUID();
-		}
+		sessionId ??= readSessionId(ctx) ?? randomUUID();
 		return sessionId;
 	}
+	/**
+	* Adopts the session id of a root session and returns the id it replaced, if any. The first
+	* session of the process is the root; later `session_start`s are subagents (headless, `print`
+	* mode) unless the session has a UI or runs in another mode.
+	*/
+	function enterSession(ctx, root) {
+		const previous = sessionId;
+		if (previous === void 0) {
+			currentSessionId(ctx);
+			return;
+		}
+		if (root) sessionId = readSessionId(ctx) ?? previous;
+		return sessionId === previous ? void 0 : previous;
+	}
+	async function dropProxySession(ctx, id) {
+		const proxy = endpoint?.proxy;
+		if (proxy === void 0) return;
+		try {
+			await proxy.dropSession(id);
+		} catch (err) {
+			ctx.ui.notify(`anon: could not drop proxy session ${id}: ${errorMessage(err)}`, "warning");
+		}
+	}
 	function route(ctx, target) {
 		const registry = ctx.modelRegistry;
 		const state = stateOf(registry);
@@ -126,7 +149,7 @@ function createAnonController(deps) {
 				state.originals.set(provider, original);
 			}
 			if (original.preRouted) continue;
-			if (state.routed.has(provider) && registry.getProviderBaseUrl(provider) === target.url) continue;
+			if (state.routed.get(provider) === session && registry.getProviderBaseUrl(provider) === target.url) continue;
 			const headers = { [SESSION_HEADER]: session };
 			if (original.baseUrl !== void 0) headers[UPSTREAM_HEADER] = original.baseUrl;
 			if (target.token !== void 0) headers[TOKEN_HEADER] = target.token;
@@ -134,7 +157,7 @@ function createAnonController(deps) {
 				baseUrl: target.url,
 				headers
 			}, SOURCE_ID);
-			state.routed.add(provider);
+			state.routed.set(provider, session);
 		}
 	}
 	/** Clears the proxy overrides; re-applies the recorded original where another override was layered underneath. */
@@ -143,7 +166,7 @@ function createAnonController(deps) {
 		const state = stateOf(registry);
 		registry.clearSourceRegistrations(SOURCE_ID);
 		const lost = [];
-		for (const provider of state.routed) {
+		for (const provider of state.routed.keys()) {
 			const original = state.originals.get(provider);
 			const restored = registry.getProviderBaseUrl(provider);
 			if (original === void 0 || restored === original.baseUrl) continue;
@@ -159,26 +182,52 @@ function createAnonController(deps) {
 		state.routed.clear();
 		return lost;
 	}
-	async function turnOn(ctx, session) {
+	/**
+	* Routes every provider and rebinds the active model. Returns the failure, or `undefined`.
+	* A failed rebind leaves the session on a model that bypasses the proxy: outside required
+	* mode the routes are rolled back, so the registry matches the state shown.
+	*/
+	async function activate(ctx, session) {
 		let target;
 		try {
 			target = await resolveEndpoint(ctx);
 		} catch (err) {
-			ctx.ui.notify(`anon: ${errorMessage(err)}`, "error");
-			return false;
+			enabled = false;
+			return errorMessage(err);
 		}
 		route(ctx, target);
-		enabled = true;
-		await rebind(ctx, session);
-		return true;
+		if (await rebind(ctx, session)) {
+			enabled = true;
+			return;
+		}
+		if (!required) unroute(ctx);
+		enabled = false;
+		const active = ctx.model;
+		return `could not rebind the active model ${active?.provider}/${active?.id} to the transform proxy`;
 	}
 	/** The session holds its active model as a snapshot: swap in the registry's re-projected one. */
 	async function rebind(ctx, session) {
 		const active = ctx.model;
-		if (active === void 0) return;
+		if (active === void 0) return true;
 		const live = ctx.modelRegistry.find(active.provider, active.id);
-		if (live === void 0 || live.baseUrl === active.baseUrl) return;
-		if (!await session.setModel(live)) ctx.ui.notify(`anon: could not rebind the active model ${active.provider}/${active.id}; select it again`, "warning");
+		if (live === void 0) return false;
+		if (live.baseUrl === active.baseUrl && live.headers?.["x-skaile-transform-session"] === active.headers?.["x-skaile-transform-session"]) return true;
+		try {
+			return await session.setModel(live);
+		} catch {
+			return false;
+		}
+	}
+	/** Why a request of `model` would bypass the proxy, or `undefined` when it targets it. */
+	function bypassReason(ctx, model) {
+		if (model === void 0) return "the request names no model";
+		if (stateOf(ctx.modelRegistry).originals.get(model.provider)?.preRouted === true) return void 0;
+		const proxyOrigin = endpoint === void 0 ? void 0 : originOf(endpoint.url);
+		if (proxyOrigin === void 0) return "the transform proxy is not available";
+		if (model.baseUrl === void 0 || originOf(model.baseUrl) !== proxyOrigin) return `${model.provider}/${model.id} does not target the transform proxy`;
+	}
+	function refusalHint() {
+		return required ? `anon: required mode: model requests are refused until the transform proxy is routed (${MODE_ENV}=required)` : "anon: model requests are refused until /anon on succeeds; /anon off sends them directly";
 	}
 	function persist(ctx, value) {
 		try {
@@ -188,20 +237,23 @@ function createAnonController(deps) {
 			ctx.ui.notify(`anon: could not save ${statePath}: ${errorMessage(err)}`, "warning");
 		}
 	}
+	function stateLabel() {
+		return enabled ? "on" : wanted ? "error" : "off";
+	}
 	function showStatus(ctx) {
-		ctx.ui.setStatus(STATUS_KEY, enabled ? "anon on" : "anon off");
+		ctx.ui.setStatus(STATUS_KEY, `anon ${stateLabel()}`);
 	}
 	function statusText(ctx) {
 		const registry = ctx.modelRegistry;
 		const state = stateOf(registry);
 		const apis = providerApis(registry);
-		const lines = [`anon ${enabled ? "on" : "off"}${required ? " (required)" : ""}`];
+		const lines = [`anon ${stateLabel()}${required ? " (required)" : ""}`];
 		if (endpoint !== void 0) {
 			lines.push(`proxy: ${endpoint.url} (${endpoint.source})`);
 			lines.push(`pipeline: ${endpoint.pipeline ?? "the proxy default"}`);
 		}
 		if (sessionId !== void 0) lines.push(`session: ${sessionId}`);
-		const routed = [...state.routed].sort();
+		const routed = [...state.routed.keys()].sort();
 		const refused = routed.flatMap((provider) => {
 			const reason = refusalReason(apis.get(provider), state.originals.get(provider));
 			return reason === void 0 ? [] : [`${provider} (${reason})`];
@@ -212,26 +264,49 @@ function createAnonController(deps) {
 		if (preRouted.length > 0) lines.push(`routed by their own config (${preRouted.length}): ${preRouted.sort().join(", ")}`);
 		return lines.join("\n");
 	}
+	/** Session entry: rotate the proxy session for a new root, then (re-)apply routing when wanted. */
+	async function start(ctx, session, root) {
+		const previous = enterSession(ctx, root);
+		if (!wanted && readEnabled(statePath)) wanted = true;
+		if (wanted) {
+			const failure = await activate(ctx, session);
+			if (failure !== void 0) {
+				ctx.ui.notify(`anon: ${failure}`, "error");
+				ctx.ui.notify(refusalHint(), "error");
+			}
+		}
+		if (previous !== void 0) await dropProxySession(ctx, previous);
+		showStatus(ctx);
+	}
 	return {
 		required,
 		statePath,
 		async command(args, ctx, session) {
 			switch (args.trim().toLowerCase()) {
-				case "on":
-					if (await turnOn(ctx, session)) {
+				case "on": {
+					const before = wanted;
+					wanted = true;
+					const failure = await activate(ctx, session);
+					if (failure === void 0) {
 						persist(ctx, true);
 						const count = stateOf(ctx.modelRegistry).routed.size;
 						ctx.ui.notify(`anon on: ${count} provider(s) routed through ${endpoint?.url}`, "info");
+						break;
 					}
+					wanted = before || required;
+					ctx.ui.notify(`anon: ${failure}`, "error");
+					if (wanted) ctx.ui.notify(refusalHint(), "error");
 					break;
+				}
 				case "off": {
 					if (required) {
 						ctx.ui.notify(`anon: off refused: this session requires the transform proxy (${MODE_ENV}=required)`, "warning");
 						break;
 					}
 					const lost = unroute(ctx);
+					wanted = false;
 					enabled = false;
-					await rebind(ctx, session);
+					if (!await rebind(ctx, session)) ctx.ui.notify(`anon: could not rebind the active model ${ctx.model?.provider}/${ctx.model?.id}; select it again`, "warning");
 					persist(ctx, false);
 					ctx.ui.notify("anon off: original provider base URLs restored", "info");
 					if (lost.length > 0) ctx.ui.notify(`anon: ${lost.join(", ")} lost their runtime registration (registered by another extension); restart omp to restore them`, "warning");
@@ -250,20 +325,33 @@ function createAnonController(deps) {
 			const items = VERBS.filter((item) => item.value.startsWith(needle));
 			return items.length > 0 ? items : null;
 		},
-		async sessionStart(ctx, session) {
-			currentSessionId(ctx);
-			if (enabled && endpoint !== void 0) {
-				route(ctx, endpoint);
-				await rebind(ctx, session);
-			} else if (required || readEnabled(statePath)) {
-				if (!await turnOn(ctx, session) && required) ctx.ui.notify("anon: required mode, but no provider is routed through the transform proxy", "error");
-			}
-			showStatus(ctx);
+		sessionStart(ctx, session) {
+			return start(ctx, session, ctx.hasUI === true || ctx.mode !== void 0 && ctx.mode !== "print");
+		},
+		sessionSwitch(ctx, session) {
+			return start(ctx, session, true);
 		},
 		async reapply(ctx, session) {
-			if (!enabled || endpoint === void 0) return;
-			route(ctx, endpoint);
-			await rebind(ctx, session);
+			if (!wanted) return;
+			const was = enabled;
+			const failure = await activate(ctx, session);
+			if (failure !== void 0 && was) {
+				ctx.ui.notify(`anon: ${failure}`, "error");
+				ctx.ui.notify(refusalHint(), "error");
+			}
+			if (enabled !== was) showStatus(ctx);
+		},
+		providerRequest(ctx) {
+			if (!wanted) return void 0;
+			let reason;
+			try {
+				reason = bypassReason(ctx, ctx.model);
+			} catch (err) {
+				reason = errorMessage(err);
+			}
+			if (reason === void 0) return void 0;
+			ctx.ui.notify(`anon: model request refused: ${reason}`, "error");
+			return {};
 		}
 	};
 }
@@ -311,6 +399,22 @@ function refusalReason(apis, original) {
 	const unserved = [...apis ?? []].filter((api) => !Object.hasOwn(SERVED_APIS, api));
 	return unserved.length === 0 ? void 0 : unserved.join(", ");
 }
+function readSessionId(ctx) {
+	try {
+		const id = ctx.sessionManager.getSessionId();
+		return typeof id === "string" && id !== "" ? id : void 0;
+	} catch {
+		return;
+	}
+}
+/** The origin of an http(s) URL; `undefined` for anything else, which never matches the proxy. */
+function originOf(url) {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return;
+	}
+}
 // src/omp/index.ts
 /** omp re-imports the extension per session; the controller (proxy, recorded originals) is process-wide. */
 const CONTROLLER_KEY = Symbol.for("@skaile/transform-proxy/omp");
@@ -322,8 +426,10 @@ function registerAnonExtension(pi, controller) {
 		handler: (args, ctx) => guarded(ctx, () => controller.command(args, ctx, pi))
 	});
 	on(pi, "session_start", (ctx) => controller.sessionStart(ctx, pi));
+	on(pi, "session_switch", (ctx) => controller.sessionSwitch(ctx, pi));
 	on(pi, "before_agent_start", (ctx) => controller.reapply(ctx, pi));
 	on(pi, "turn_start", (ctx) => controller.reapply(ctx, pi));
+	pi.on("before_provider_request", (_event, ctx) => controller.providerRequest(ctx));
 }
 function anonExtension(pi) {
 	const scope = globalThis;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaile/transform-proxy",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "type": "module",
   "description": "Same-protocol passthrough proxy that runs model requests and replies through a chain of text transforms (Anthropic Messages, OpenAI chat, OpenAI responses)",
   "license": "MIT",