@skaile/transform-proxy 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.2.3
+
+- omp extension: without `SKAILE_TRANSFORM_PROXY_URL`, `/anon on` starts the proxy as a child process under the system Node (`SKAILE_TRANSFORM_PROXY_NODE`, else `node` from `PATH`; Node ≥ 22) instead of inside omp. omp is a compiled Bun executable whose resolver cannot load transform modules with native or ML dependencies from `node_modules`: under omp 18.14.2, `/anon on` failed with `transform "anon": cannot load module @skaile/forge-anon/proxy: Cannot find package 'ibantools'`. The child runs this package's CLI with the found config, `--port 0 --host 127.0.0.1 --exit-with-stdin` and a random token, which every routed provider sends as `x-skaile-transform-token`. A child that exits before `listening <url>` or stays silent for 60 s fails `/anon on` with its last stderr lines (token redacted). The child exits with omp, does not keep omp's event loop alive, and is replaced on the next turn when it dies. A rotated-out proxy session is no longer dropped: the child keeps its state in memory until it exits, and no request carries that id again.
+- CLI: `--exit-with-stdin` stops the proxy when its stdin closes, so a parent that spawns it with a stdin pipe takes it down on exit, SIGKILL included.
+
+## 0.2.2
+
+- Fail closed on malformed request bodies: the Anthropic, OpenAI chat and OpenAI responses walkers refuse a JSON body whose shape they cannot classify (a root that is not an object; a `system`, `messages`, `input`, `instructions`, message `content`, text, thinking, tool-call `arguments` or tool-result slot of an unexpected type) with 400 `unsupported_content` instead of forwarding it untransformed. Unknown part, block and item types still pass through.
+- Upstream response `content-type` is matched case-insensitively, so `Text/Event-Stream` and `Application/JSON; charset=utf-8` replies are restored instead of relayed with placeholders.
+- omp extension: a failed rebind of the active model is an activation failure. `/anon on` rolls the routes back, persists nothing and stays `anon off`; in required mode, or when a later turn's rebind fails, the footer shows `anon error`. While anon is on or in error, a `before_provider_request` handler replaces the payload of any request whose model bypasses the proxy with an empty object (omp has no hook that cancels a provider request).
+- omp extension: the proxy session follows the root omp session. On `session_switch` (`/new`, `/resume`, `/fork`) and on a root `session_start` with a new id, every provider is re-routed with the new `x-skaile-transform-session`, and the in-process proxy drops the old session; headless `print` sessions (subagents) keep the parent's id.
+
 ## 0.2.1
 
 - Anthropic walker: the pipeline `instruction` is appended after the host's system prompt (last text block, or after a blank line for a string `system`) instead of being prepended. Claude Code gateways such as TeamClaude answer 429 `rate_limit_error` for Sonnet when the system prompt does not start with the Claude Code blocks; with the instruction first, omp and Claude Code requests for `claude-sonnet-4-5` through the proxy were refused.

package/README.md

@@ -31,6 +31,7 @@ Embeddings are refused on purpose: a vector of pseudonymized input cannot be res
 ## Refusals
 
 - Attachments (image, document, file parts) are refused with 400 `unsupported_content`. Nothing is sent upstream.
+- A body that is not JSON is refused with 400 `invalid_json`. A JSON body whose shape the walker cannot classify is refused with 400 `unsupported_content`: a root that is not an object, or a `system`, `messages`, `input`, `instructions`, message `content`, text, thinking, tool-call `arguments` or tool-result slot of an unexpected type. Unknown part, block and item types still pass through untouched.
 - Unknown routes, pipelines and upstreams are refused before any body is read or transform is built.
 - A transform that throws refuses the request with 502 `transform_failed`. Nothing is sent upstream.
 - Bedrock (SigV4 covers the body) and Vertex are not routed. Refuse them in the caller.
@@ -59,12 +60,13 @@ Keys are exactly the option fields. An unknown top-level key is an error. Module
 ## CLI
 
 ```sh
-skaile-transform-proxy [--config <file>] [--port <n>] [--host <h>] [--token <t>]
+skaile-transform-proxy [--config <file>] [--port <n>] [--host <h>] [--token <t>] [--exit-with-stdin]
 ```
 
 - The token comes from `--token` or `SKAILE_TRANSFORM_PROXY_TOKEN`.
 - Without `--config`, the proxy reads `./.skaile/transform-proxy.yaml`, then `~/.config/skaile/transform-proxy.yaml`.
 - On start it prints `listening <url>`. It stops on SIGINT or SIGTERM.
+- `--exit-with-stdin` also stops it when its stdin closes. A parent process that spawns the proxy with a stdin pipe and never writes to it takes the proxy down when it exits, even on SIGKILL.
 
 ## Library
 
@@ -91,13 +93,16 @@ The package ships an [omp](https://omp.sh) extension (subpath `@skaile/transform
 omp plugin install @skaile/transform-proxy
 ```
 
-It adds the command `/anon on|off|status` and the footer status `anon on` / `anon off`.
+It adds the command `/anon on|off|status` and the footer status `anon on`, `anon off` or `anon error`. Unless `SKAILE_TRANSFORM_PROXY_URL` names a running proxy, it needs Node ≥ 22 on `PATH` (or its path in `SKAILE_TRANSFORM_PROXY_NODE`).
 
 - `/anon on` routes every provider of omp's model registry through the proxy: the provider's `baseUrl` becomes the proxy URL, and the original base URL travels in `x-skaile-transform-upstream`, next to `x-skaile-transform-session` (the omp session id) and the token. The provider's own headers and auth stay in place and are relayed.
   - With `SKAILE_TRANSFORM_PROXY_URL` (and `SKAILE_TRANSFORM_PROXY_TOKEN`) set, it uses that running proxy, and the proxy applies its `defaultPipeline`.
-  - Otherwise it starts one proxy inside the omp process, from the config lookup of the CLI (`./.skaile/transform-proxy.yaml`, then `~/.config/skaile/transform-proxy.yaml`). That config must set `defaultPipeline`. Without a config, `/anon on` refuses and says where to put one.
+  - Otherwise it starts one proxy per omp process as a child process: the system Node (`SKAILE_TRANSFORM_PROXY_NODE`, else `node` from `PATH`) runs this package's CLI with the config lookup of the CLI (`./.skaile/transform-proxy.yaml`, then `~/.config/skaile/transform-proxy.yaml`), `--port 0 --host 127.0.0.1 --exit-with-stdin` and a random token in `SKAILE_TRANSFORM_PROXY_TOKEN`, which every routed provider sends. That config must set `defaultPipeline`. Without a config, `/anon on` refuses and says where to put one. A child that exits before printing `listening <url>`, or stays silent for 60 s, fails `/anon on` with its last stderr lines.
+  - omp is a compiled Bun executable, and its resolver cannot load transform modules with native or ML dependencies (`onnxruntime-node`, `@huggingface/transformers`, `ibantools`) from `node_modules`; Node can. The child exits with omp: its stdin pipe closes when omp exits (SIGKILL included), and omp kills it on a normal exit. It does not keep omp's event loop alive. A child that dies later is replaced on the next turn.
   - Providers on a wire the proxy does not rewrite (Bedrock, Vertex, Gemini, agent bridges, providers without a base URL) are routed too, so the proxy refuses their requests: the setup fails closed. `/anon status` lists them as refused.
-  - The session's active model is rebound to the re-routed one, so the next request already uses the new base URL.
+  - The session's active model is rebound to the re-routed one, so the next request already uses the new base URL. A rebind that fails is an activation failure: `/anon on` rolls the routes back, saves nothing and stays off. When anon is required, or a later turn's rebind fails while anon is on, the footer shows `anon error`.
+- While anon is on or in error, a `before_provider_request` handler checks every model request: a request whose model does not target the proxy gets its payload replaced with an empty object, so no conversation text leaves, and an error notice names the model. omp has no hook that cancels a provider request, and a throwing handler is only logged, so this replacement is the block.
+- The proxy session follows the root omp session: on `/new`, `/resume`, `/fork` (`session_switch`) and on a root `session_start` with a new session id, every provider is re-routed with the new `x-skaile-transform-session`. The proxy keeps the old session's state in memory until it exits; no request carries that id again. A `session_start` of a headless `print` session (how omp runs subagents) keeps the parent's id, so subagents share its pseudonyms.
 - `/anon off` restores the original base URLs and headers.
 - `/anon status` shows the state, the proxy URL and its source, the pipeline, the session id, and the routed and refused providers.
 - The enabled flag is saved in `skaile-transform-proxy.json` in omp's agent dir (`~/.omp/agent`; `SKAILE_TRANSFORM_PROXY_OMP_STATE` overrides the path) and re-applied when a session starts.

package/dist/cli.d.mts

@@ -12,6 +12,8 @@ export interface CliEnvironment {
 export interface CliRun {
   readonly code: number;
   readonly proxy?: TransformProxy;
+  /** `--exit-with-stdin`: the caller stops the proxy when its stdin closes (the parent process is gone). */
+  readonly exitWithStdin?: boolean;
 }
 /** Parses the arguments, loads the config and starts the proxy. Never installs signal handlers. */
 export declare function runCli(argv: readonly string[], io: CliEnvironment): Promise<CliRun>;

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { d as createTransformProxy, o as resolveProxyConfig, v as errorMessage } from "./config-Xdn_LYpZ.mjs";
+import { d as createTransformProxy, o as resolveProxyConfig, v as errorMessage } from "./config-PKHxejC8.mjs";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
@@ -7,7 +7,7 @@ import { parseArgs } from "node:util";
 // src/cli.ts
 /** Environment variable that supplies the client token when `--token` is absent. */
 const TOKEN_ENV = "SKAILE_TRANSFORM_PROXY_TOKEN";
-const USAGE = "usage: skaile-transform-proxy [--config <file>] [--port <n>] [--host <h>] [--token <t>]";
+const USAGE = "usage: skaile-transform-proxy [--config <file>] [--port <n>] [--host <h>] [--token <t>] [--exit-with-stdin]";
 /** Parses the arguments, loads the config and starts the proxy. Never installs signal handlers. */
 async function runCli(argv, io) {
 	let values;
@@ -23,7 +23,8 @@ async function runCli(argv, io) {
 				help: {
 					type: "boolean",
 					short: "h"
-				}
+				},
+				"exit-with-stdin": { type: "boolean" }
 			}
 		}));
 	} catch (err) {
@@ -67,7 +68,8 @@ async function runCli(argv, io) {
 		io.stdout(`listening ${proxy.url}`);
 		return {
 			code: 0,
-			proxy
+			proxy,
+			exitWithStdin: values["exit-with-stdin"] === true
 		};
 	} catch (err) {
 		io.stderr(errorMessage(err));
@@ -103,7 +105,10 @@ if (isEntryPoint()) {
 	if (run.proxy === void 0) process.exitCode = run.code;
 	else {
 		const proxy = run.proxy;
+		let stopping = false;
 		const stop = () => {
+			if (stopping) return;
+			stopping = true;
 			proxy.close().then(() => process.exit(0), (err) => {
 				console.error(errorMessage(err));
 				process.exit(1);
@@ -111,6 +116,11 @@ if (isEntryPoint()) {
 		};
 		process.once("SIGINT", stop);
 		process.once("SIGTERM", stop);
+		if (run.exitWithStdin === true) {
+			process.stdin.once("end", stop);
+			process.stdin.once("close", stop);
+			process.stdin.resume();
+		}
 	}
 }
 export { TOKEN_ENV, runCli };

package/dist/{config-Xdn_LYpZ.mjs → config-PKHxejC8.mjs}

@@ -315,24 +315,30 @@ const signatureKey$1 = (signature) => `anthropic:${signature}`;
 function refuse$1(block) {
 	if (typeof block.type === "string" && REFUSED_BLOCKS[block.type] === true) throw new UnsupportedContentError(`Anthropic ${block.type} content cannot be transformed`);
 }
+/** A slot the walker reads holds a value it cannot classify: refused, never forwarded untransformed. */
+function malformed$2(slot) {
+	throw new UnsupportedContentError(`Anthropic ${slot} has an unexpected shape`);
+}
 async function outbound$2(transform, text, leaf) {
 	return text === "" ? text : transform.outbound(text, leaf);
 }
-/** A string, or an array of blocks whose `text` blocks are rewritten. */
-async function rewriteText(content, leaf, transform) {
+/** A string, or an array of blocks whose `text` blocks are rewritten; anything else is refused. */
+async function rewriteText(content, slot, leaf, transform) {
 	if (typeof content === "string") return outbound$2(transform, content, leaf);
-	if (!Array.isArray(content)) return content;
+	if (!Array.isArray(content)) return malformed$2(slot);
 	const out = [];
 	for (const block of content) {
-		if (!isObj$2(block)) {
+		if (!isObj$2(block)) return malformed$2(`${slot} block`);
+		refuse$1(block);
+		if (block.type !== "text") {
 			out.push(block);
 			continue;
 		}
-		refuse$1(block);
-		out.push(block.type === "text" && typeof block.text === "string" ? {
+		if (typeof block.text !== "string") return malformed$2(`${slot} text block`);
+		out.push({
 			...block,
 			text: await outbound$2(transform, block.text, leaf)
-		} : block);
+		});
 	}
 	return out;
 }
@@ -364,6 +370,7 @@ function restoreStrings$1(value, transform) {
 }
 /** A thinking block: swaps in the cached model text when its signature is known, else rewrites it. */
 async function rewriteThinking(block, ctx) {
+	if (typeof block.thinking !== "string") return malformed$2("thinking block");
 	if (typeof block.signature === "string") {
 		const cached = ctx.signatures.get(signatureKey$1(block.signature));
 		if (cached !== void 0) return {
@@ -371,7 +378,6 @@ async function rewriteThinking(block, ctx) {
 			thinking: cached
 		};
 	}
-	if (typeof block.thinking !== "string") return block;
 	return {
 		...block,
 		thinking: await outbound$2(ctx.transform, block.thinking, { kind: "thinking" })
@@ -380,20 +386,18 @@ async function rewriteThinking(block, ctx) {
 async function rewriteContent$2(content, role, toolNames, ctx) {
 	const textKind = role === "assistant" ? "assistant" : "user";
 	if (typeof content === "string") return outbound$2(ctx.transform, content, { kind: textKind });
-	if (!Array.isArray(content)) return content;
+	if (!Array.isArray(content)) return malformed$2("message content");
 	const out = [];
 	for (const block of content) {
-		if (!isObj$2(block)) {
-			out.push(block);
-			continue;
-		}
+		if (!isObj$2(block)) return malformed$2("message content block");
 		refuse$1(block);
 		switch (block.type) {
 			case "text":
-				out.push(typeof block.text === "string" ? {
+				if (typeof block.text !== "string") return malformed$2("text block");
+				out.push({
 					...block,
 					text: await outbound$2(ctx.transform, block.text, { kind: textKind })
-				} : block);
+				});
 				break;
 			case "thinking":
 				out.push(await rewriteThinking(block, ctx));
@@ -410,10 +414,14 @@ async function rewriteContent$2(content, role, toolNames, ctx) {
 				break;
 			}
 			case "tool_result": {
+				if (block.content === void 0) {
+					out.push(block);
+					break;
+				}
 				const toolName = typeof block.tool_use_id === "string" ? toolNames.get(block.tool_use_id) : void 0;
 				out.push({
 					...block,
-					content: await rewriteText(block.content, {
+					content: await rewriteText(block.content, "tool_result content", {
 						kind: "toolResult",
 						toolName
 					}, ctx.transform)
@@ -557,17 +565,21 @@ function createStreamTransformer$2(ctx) {
 }
 const anthropicWalker = {
 	async request(body, ctx) {
-		if (!isObj$2(body)) return body;
+		if (!isObj$2(body)) return malformed$2("request body");
 		const out = { ...body };
-		if (body.system !== void 0) out.system = await rewriteText(body.system, { kind: "system" }, ctx.transform);
+		if (body.system !== void 0) out.system = await rewriteText(body.system, "system", { kind: "system" }, ctx.transform);
 		if (ctx.transform.instruction !== void 0) out.system = withInstruction(out.system, ctx.transform.instruction);
-		if (Array.isArray(body.messages)) {
+		if (body.messages !== void 0) {
+			if (!Array.isArray(body.messages)) return malformed$2("messages");
 			const toolNames = toolNamesById(body.messages);
 			const messages = [];
-			for (const message of body.messages) messages.push(isObj$2(message) ? {
-				...message,
-				content: await rewriteContent$2(message.content, message.role, toolNames, ctx)
-			} : message);
+			for (const message of body.messages) {
+				if (!isObj$2(message)) return malformed$2("message");
+				messages.push({
+					...message,
+					content: await rewriteContent$2(message.content, message.role, toolNames, ctx)
+				});
+			}
 			out.messages = messages;
 		}
 		return out;
@@ -615,21 +627,28 @@ const REASONING_FIELDS = ["reasoning_content", "reasoning"];
 async function outbound$1(transform, text, leaf) {
 	return text === "" ? text : transform.outbound(text, leaf);
 }
-/** A string, or an array of parts whose `text` parts are rewritten. */
+/** A slot the walker reads holds a value it cannot classify: refused, never forwarded untransformed. */
+function malformed$1(slot) {
+	throw new UnsupportedContentError(`OpenAI chat ${slot} has an unexpected shape`);
+}
+/** A string, or an array of parts whose `text` parts are rewritten; `null`/absent carries no text; anything else is refused. */
 async function rewriteContent$1(content, leaf, transform) {
 	if (typeof content === "string") return outbound$1(transform, content, leaf);
-	if (!Array.isArray(content)) return content;
+	if (content === void 0 || content === null) return content;
+	if (!Array.isArray(content)) return malformed$1("message content");
 	const out = [];
 	for (const part of content) {
-		if (!isObj$1(part)) {
+		if (!isObj$1(part)) return malformed$1("content part");
+		if (typeof part.type === "string" && REFUSED_PARTS$1[part.type] === true) throw new UnsupportedContentError(`OpenAI chat ${part.type} content cannot be transformed`);
+		if (part.type !== "text") {
 			out.push(part);
 			continue;
 		}
-		if (typeof part.type === "string" && REFUSED_PARTS$1[part.type] === true) throw new UnsupportedContentError(`OpenAI chat ${part.type} content cannot be transformed`);
-		out.push(part.type === "text" && typeof part.text === "string" ? {
+		if (typeof part.text !== "string") return malformed$1("text part");
+		out.push({
 			...part,
 			text: await outbound$1(transform, part.text, leaf)
-		} : part);
+		});
 	}
 	return out;
 }
@@ -677,17 +696,20 @@ function restoreArguments$1(args, transform) {
 	return JSON.stringify(restoreStrings(parsed, transform));
 }
 async function rewriteToolCalls(calls, transform, names) {
-	if (!Array.isArray(calls)) return calls;
+	if (calls === void 0 || calls === null) return calls;
+	if (!Array.isArray(calls)) return malformed$1("tool_calls");
 	const out = [];
 	for (const call of calls) {
-		if (!isObj$1(call) || !isObj$1(call.function)) {
+		if (!isObj$1(call)) return malformed$1("tool call");
+		if (call.type !== void 0 && call.type !== "function") {
 			out.push(call);
 			continue;
 		}
 		const fn = call.function;
+		if (!isObj$1(fn) || typeof fn.arguments !== "string") return malformed$1("function tool call");
 		const toolName = typeof fn.name === "string" ? fn.name : void 0;
 		if (typeof call.id === "string" && toolName !== void 0) names.set(call.id, toolName);
-		out.push(typeof fn.arguments === "string" ? {
+		out.push({
 			...call,
 			function: {
 				...fn,
@@ -696,7 +718,7 @@ async function rewriteToolCalls(calls, transform, names) {
 					toolName
 				}, transform)
 			}
-		} : call);
+		});
 	}
 	return out;
 }
@@ -714,6 +736,7 @@ async function rewriteMessage(message, transform, names) {
 			for (const field of REASONING_FIELDS) {
 				const value = message[field];
 				if (typeof value === "string") out[field] = await outbound$1(transform, value, { kind: "thinking" });
+				else if (value !== void 0 && value !== null) return malformed$1(`assistant ${field}`);
 			}
 			out.content = await rewriteContent$1(message.content, { kind: "assistant" }, transform);
 			out.tool_calls = await rewriteToolCalls(message.tool_calls, transform, names);
@@ -727,7 +750,15 @@ async function rewriteMessage(message, transform, names) {
 			}, transform);
 			break;
 		}
-		default: return message;
+		case "function": {
+			const toolName = typeof message.name === "string" ? message.name : void 0;
+			out.content = await rewriteContent$1(message.content, {
+				kind: "toolResult",
+				toolName
+			}, transform);
+			break;
+		}
+		default: return malformed$1("message role");
 	}
 	if (message.content === void 0) delete out.content;
 	return out;
@@ -874,12 +905,16 @@ function createStreamTransformer$1(ctx) {
 }
 const openaiChatWalker = {
 	async request(body, ctx) {
-		if (!isObj$1(body)) return body;
+		if (!isObj$1(body)) return malformed$1("request body");
 		const out = { ...body };
-		if (Array.isArray(body.messages)) {
+		if (body.messages !== void 0) {
+			if (!Array.isArray(body.messages)) return malformed$1("messages");
 			const names = /* @__PURE__ */ new Map();
 			const messages = [];
-			for (const message of body.messages) messages.push(isObj$1(message) ? await rewriteMessage(message, ctx.transform, names) : message);
+			for (const message of body.messages) {
+				if (!isObj$1(message)) return malformed$1("message");
+				messages.push(await rewriteMessage(message, ctx.transform, names));
+			}
 			if (ctx.transform.instruction !== void 0) messages.unshift({
 				role: "system",
 				content: ctx.transform.instruction
@@ -937,21 +972,27 @@ function refuse(part) {
 async function outbound(transform, text, leaf) {
 	return text === "" ? text : transform.outbound(text, leaf);
 }
-/** A string, or an array of parts whose `input_text`/`output_text` parts are rewritten. */
-async function rewriteContent(content, leaf, transform) {
+/** A slot the walker reads holds a value it cannot classify: refused, never forwarded untransformed. */
+function malformed(slot) {
+	throw new UnsupportedContentError(`OpenAI responses ${slot} has an unexpected shape`);
+}
+/** A string, or an array of parts whose `input_text`/`output_text` parts are rewritten; anything else is refused. */
+async function rewriteContent(content, slot, leaf, transform) {
 	if (typeof content === "string") return outbound(transform, content, leaf);
-	if (!Array.isArray(content)) return content;
+	if (!Array.isArray(content)) return malformed(slot);
 	const out = [];
 	for (const part of content) {
-		if (!isObj(part)) {
+		if (!isObj(part)) return malformed(`${slot} part`);
+		refuse(part);
+		if (part.type !== "input_text" && part.type !== "output_text") {
 			out.push(part);
 			continue;
 		}
-		refuse(part);
-		out.push((part.type === "input_text" || part.type === "output_text") && typeof part.text === "string" ? {
+		if (typeof part.text !== "string") return malformed(`${slot} ${part.type} part`);
+		out.push({
 			...part,
 			text: await outbound(transform, part.text, leaf)
-		} : part);
+		});
 	}
 	return out;
 }
@@ -1002,17 +1043,14 @@ function cachedSummary(item, ctx) {
 	return texts;
 }
 async function rewriteReasoning(item, ctx) {
-	if (!Array.isArray(item.summary)) return item;
+	if (item.summary === void 0) return item;
+	if (!Array.isArray(item.summary)) return malformed("reasoning summary");
+	for (const part of item.summary) if (!isObj(part) || typeof part.text !== "string") return malformed("reasoning summary part");
 	const cached = cachedSummary(item, ctx);
 	const summary = [];
-	for (const [i, part] of item.summary.entries()) if (!isObj(part) || typeof part.text !== "string") summary.push(part);
-	else if (cached !== void 0) summary.push({
+	for (const [i, part] of item.summary.entries()) summary.push({
 		...part,
-		text: cached[i]
-	});
-	else summary.push({
-		...part,
-		text: await outbound(ctx.transform, part.text, { kind: "thinking" })
+		text: cached !== void 0 ? cached[i] : await outbound(ctx.transform, part.text, { kind: "thinking" })
 	});
 	return {
 		...item,
@@ -1032,15 +1070,15 @@ function toolNamesByCallId(items) {
 async function rewriteItem(item, toolNames, ctx) {
 	if (item.type === "message" || item.type === void 0 && item.role !== void 0) {
 		const kind = roleKind(item.role);
-		if (kind === void 0) return item;
+		if (kind === void 0) return malformed("message role");
 		return {
 			...item,
-			content: await rewriteContent(item.content, { kind }, ctx.transform)
+			content: await rewriteContent(item.content, "message content", { kind }, ctx.transform)
 		};
 	}
 	switch (item.type) {
 		case "function_call": {
-			if (typeof item.arguments !== "string") return item;
+			if (typeof item.arguments !== "string") return malformed("function_call arguments");
 			const toolName = typeof item.name === "string" ? item.name : void 0;
 			return {
 				...item,
@@ -1054,7 +1092,7 @@ async function rewriteItem(item, toolNames, ctx) {
 			const toolName = typeof item.call_id === "string" ? toolNames.get(item.call_id) : void 0;
 			return {
 				...item,
-				output: await rewriteContent(item.output, {
+				output: await rewriteContent(item.output, "function_call_output output", {
 					kind: "toolResult",
 					toolName
 				}, ctx.transform)
@@ -1226,18 +1264,22 @@ function createStreamTransformer(ctx) {
 }
 const openaiResponsesWalker = {
 	async request(body, ctx) {
-		if (!isObj(body)) return body;
+		if (!isObj(body)) return malformed("request body");
 		const out = { ...body };
 		if (typeof body.instructions === "string") out.instructions = await outbound(ctx.transform, body.instructions, { kind: "system" });
+		else if (body.instructions !== void 0 && body.instructions !== null) return malformed("instructions");
 		const instruction = ctx.transform.instruction;
 		if (instruction !== void 0) out.instructions = typeof out.instructions === "string" && out.instructions !== "" ? `${instruction}\n\n${out.instructions}` : instruction;
 		if (typeof body.input === "string") out.input = await outbound(ctx.transform, body.input, { kind: "user" });
 		else if (Array.isArray(body.input)) {
 			const toolNames = toolNamesByCallId(body.input);
 			const input = [];
-			for (const item of body.input) input.push(isObj(item) ? await rewriteItem(item, toolNames, ctx) : item);
+			for (const item of body.input) {
+				if (!isObj(item)) return malformed("input item");
+				input.push(await rewriteItem(item, toolNames, ctx));
+			}
 			out.input = input;
-		}
+		} else if (body.input !== void 0) return malformed("input");
 		return out;
 	},
 	response(body, ctx) {
@@ -1465,7 +1507,7 @@ async function createTransformProxy(options) {
 	/** Relays an upstream response. With `rewrite`, a 2xx JSON or SSE body is restored on the way back. */
 	async function relayUpstream(res, upstreamRes, rewrite) {
 		if (upstreamRes === void 0) return;
-		const contentType = upstreamRes.headers.get("content-type") ?? "";
+		const contentType = (upstreamRes.headers.get("content-type") ?? "").toLowerCase();
 		const headers = relayHeaders(upstreamRes.headers);
 		if (rewrite !== void 0 && upstreamRes.ok && contentType.startsWith("text/event-stream")) return pipeStream(res, upstreamRes, headers, rewrite.wire.stream(rewrite.ctx), log);
 		if (rewrite !== void 0 && upstreamRes.ok && contentType.includes("application/json")) {

package/dist/index.mjs

@@ -1 +1 @@
-export { t as CONFIG_FILE_NAME, s as PIPELINE_HEADER, c as SESSION_HEADER, l as TOKEN_HEADER, u as UPSTREAM_HEADER, h as UnsupportedContentError, m as anthropicWalker, _ as composeTransforms, n as configCandidates, g as createSessionFacts, d as createTransformProxy, r as findProxyConfig, i as loadProxyConfig, p as openaiChatWalker, f as openaiResponsesWalker, a as parseProxyConfig, o as resolveProxyConfig, y as silentLogger } from "./config-Xdn_LYpZ.mjs";
+export { t as CONFIG_FILE_NAME, s as PIPELINE_HEADER, c as SESSION_HEADER, l as TOKEN_HEADER, u as UPSTREAM_HEADER, h as UnsupportedContentError, m as anthropicWalker, _ as composeTransforms, n as configCandidates, g as createSessionFacts, d as createTransformProxy, r as findProxyConfig, i as loadProxyConfig, p as openaiChatWalker, f as openaiResponsesWalker, a as parseProxyConfig, o as resolveProxyConfig, y as silentLogger } from "./config-PKHxejC8.mjs";

package/dist/omp/index.d.mts

@@ -1,9 +1,11 @@
-import { a as TransformProxyOptions, i as TransformProxy } from "../server-C_eKyCTV.mjs";
+import { Readable, Writable } from "node:stream";
 interface OmpModel {
   readonly provider: string;
   readonly id: string;
   readonly api: string;
   readonly baseUrl?: string;
+  /** The provider headers projected onto the model, the transform-proxy headers included. */
+  readonly headers?: Readonly<Record<string, string>>;
 }
 /** A runtime provider override: omp merges `headers` into the provider's existing headers. */
 interface OmpProviderOverride {
@@ -35,15 +37,22 @@ interface OmpContext {
   readonly sessionManager: {
     getSessionId(): string;
   };
-  /** The session's active model: a snapshot that a provider override does not update. */
+  /**
+   * The session's active model: a snapshot that a provider override does not update. In
+   * `before_provider_request` it is the model of that request.
+   */
   readonly model: OmpModel | undefined;
+  /** False for headless sessions: subagents, print and RPC mode. */
+  readonly hasUI?: boolean;
+  /** `tui`, `rpc`, `json` or `print`; subagent sessions run as `print`. */
+  readonly mode?: string;
 }
 interface OmpAutocompleteItem {
   value: string;
   label: string;
   description?: string;
 }
-type OmpEventName = 'session_start' | 'before_agent_start' | 'turn_start';
+type OmpEventName = 'session_start' | 'session_switch' | 'before_agent_start' | 'turn_start' | 'before_provider_request';
 /** Per-session actions of the extension API. */
 interface OmpSessionActions {
   /** Rebinds the session's active model (without persisting it as the default). */
@@ -55,15 +64,37 @@ interface OmpExtensionApi extends OmpSessionActions {
     getArgumentCompletions?: (argumentPrefix: string) => OmpAutocompleteItem[] | null;
     handler: (args: string, ctx: OmpContext) => Promise<void>;
   }): void;
-  on(event: OmpEventName, handler: (event: unknown, ctx: OmpContext) => void | Promise<void>): void;
+  /** For `before_provider_request`, a non-undefined result replaces the request payload. */
+  on(event: OmpEventName, handler: (event: unknown, ctx: OmpContext) => unknown): void;
+}
+/** How the extension spawns its proxy child. */
+interface ProxySpawnOptions {
+  readonly cwd: string;
+  readonly env: Readonly<Record<string, string | undefined>>;
+  readonly stdio: readonly ['pipe', 'pipe', 'pipe'];
+}
+/** The slice of a `node:child_process` `ChildProcess` the extension uses. */
+interface ProxyChildProcess {
+  readonly pid?: number | undefined;
+  readonly stdin: Writable | null;
+  readonly stdout: Readable | null;
+  readonly stderr: Readable | null;
+  kill(signal?: NodeJS.Signals): boolean;
+  unref(): void;
+  on(event: 'exit', listener: (code: number | null, signal: NodeJS.Signals | null) => void): unknown;
+  on(event: 'error', listener: (err: Error) => void): unknown;
 }
 interface AnonControllerDeps {
   readonly env: Readonly<Record<string, string | undefined>>;
   readonly home: string;
   /** Default: `$SKAILE_TRANSFORM_PROXY_OMP_STATE`, else `<omp agent dir>/skaile-transform-proxy.json`. */
   readonly statePath?: string;
-  /** Default: `createTransformProxy`. */
-  readonly startProxy?: (options: TransformProxyOptions) => Promise<TransformProxy>;
+  /** Spawns the proxy child. Default: `node:child_process` `spawn`. */
+  readonly spawnChild?: (command: string, args: readonly string[], options: ProxySpawnOptions) => ProxyChildProcess;
+  /** The CLI the child runs. Default: this package's `dist/cli.mjs`, next to the built extension's `dist/omp/`. */
+  readonly cliPath?: string;
+  /** How long the child may take to print `listening <url>`. Default: 60 s (transform modules may load ML models). */
+  readonly listenTimeoutMs?: number;
 }
 interface AnonController {
   readonly required: boolean;
@@ -71,14 +102,30 @@ interface AnonController {
   /** Handles `/anon <args>`. `session` rebinds the session's active model after a switch. */
   command(args: string, ctx: OmpContext, session: OmpSessionActions): Promise<void>;
   completions(prefix: string): OmpAutocompleteItem[] | null;
-  /** Applies the persisted flag (or required mode) and refreshes the status bar. */
+  /**
+   * Applies the persisted flag (or required mode) and refreshes the status bar. A root session
+   * whose omp session id changed rotates the proxy session; subagents keep the parent's id.
+   */
   sessionStart(ctx: OmpContext, session: OmpSessionActions): Promise<void>;
-  /** While on: routes providers that appeared, or were reset, since the last pass. */
+  /** `/new`, `/resume`, `/fork`: the root session changed, so the proxy session rotates. */
+  sessionSwitch(ctx: OmpContext, session: OmpSessionActions): Promise<void>;
+  /** While on (or failed): routes providers that appeared, or were reset, since the last pass. */
   reapply(ctx: OmpContext, session: OmpSessionActions): Promise<void>;
+  /**
+   * `before_provider_request`: while anon is on, failed or required, a request whose model does
+   * not target the transform proxy gets a replacement payload without any conversation text.
+   * Returns `undefined` to keep the payload.
+   */
+  providerRequest(ctx: OmpContext): Record<string, never> | undefined;
 }
 /**
  * The process-wide `/anon` state machine. omp builds one extension instance per session
  * (subagents included) while they share one model registry, so one controller serves them all.
+ *
+ * `wanted`: model requests must go through the proxy (required mode, or `/anon on`).
+ * `enabled`: every provider is routed and the active model is rebound. `wanted` without
+ * `enabled` is the error state: the footer shows `anon error` and `providerRequest` refuses
+ * every request that would bypass the proxy.
  */
 export declare function createAnonController(deps: AnonControllerDeps): AnonController;
 /** `$SKAILE_TRANSFORM_PROXY_OMP_STATE`, else `skaile-transform-proxy.json` in omp's agent dir (`$PI_CODING_AGENT_DIR` or `~/.omp/agent`). */
@@ -86,4 +133,4 @@ export declare function defaultStatePath(env: Readonly<Record<string, string | u
 /** Registers the `/anon` command and the event handlers on one session's extension API. */
 export declare function registerAnonExtension(pi: OmpExtensionApi, controller: AnonController): void;
 export default function anonExtension(pi: OmpExtensionApi): void;
-export type { AnonController, AnonControllerDeps, OmpAutocompleteItem, OmpContext, OmpEventName, OmpExtensionApi, OmpModel, OmpModelRegistry, OmpNotifyType, OmpProviderOverride, OmpSessionActions, OmpUi };
+export type { AnonController, AnonControllerDeps, OmpAutocompleteItem, OmpContext, OmpEventName, OmpExtensionApi, OmpModel, OmpModelRegistry, OmpNotifyType, OmpProviderOverride, OmpSessionActions, OmpUi, ProxyChildProcess, ProxySpawnOptions };

package/dist/omp/index.mjs

@@ -1,13 +1,17 @@
-import { c as SESSION_HEADER, d as createTransformProxy, i as loadProxyConfig, l as TOKEN_HEADER, n as configCandidates, r as findProxyConfig, u as UPSTREAM_HEADER, v as errorMessage, y as silentLogger } from "../config-Xdn_LYpZ.mjs";
-import { randomUUID } from "node:crypto";
+import { c as SESSION_HEADER, i as loadProxyConfig, l as TOKEN_HEADER, n as configCandidates, r as findProxyConfig, u as UPSTREAM_HEADER, v as errorMessage } from "../config-PKHxejC8.mjs";
+import { randomBytes, randomUUID } from "node:crypto";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
+import { spawn } from "node:child_process";
 // src/omp/anon.ts
 /** A running proxy the extension routes to. */
 const URL_ENV = "SKAILE_TRANSFORM_PROXY_URL";
-/** The client token of that proxy. */
+/** The client token of that proxy; also how the extension hands its own proxy child a random token. */
 const TOKEN_ENV = "SKAILE_TRANSFORM_PROXY_TOKEN";
+/** The Node binary that runs the proxy child; default: `node` from `PATH`. */
+const NODE_ENV = "SKAILE_TRANSFORM_PROXY_NODE";
 /** `required` (set by a skaile session in required mode): routing is forced on and `/anon off` is refused. */
 const MODE_ENV = "SKAILE_TRANSFORM_PROXY_MODE";
 /** Overrides the path of the persisted enabled flag. */
@@ -43,13 +47,20 @@ const VERBS = [
 /**
 * The process-wide `/anon` state machine. omp builds one extension instance per session
 * (subagents included) while they share one model registry, so one controller serves them all.
+*
+* `wanted`: model requests must go through the proxy (required mode, or `/anon on`).
+* `enabled`: every provider is routed and the active model is rebound. `wanted` without
+* `enabled` is the error state: the footer shows `anon error` and `providerRequest` refuses
+* every request that would bypass the proxy.
 */
 function createAnonController(deps) {
 	const env = deps.env;
 	const required = env[MODE_ENV] === "required";
 	const statePath = deps.statePath ?? defaultStatePath(env, deps.home);
-	const startProxy = deps.startProxy ?? createTransformProxy;
+	const spawnChild = deps.spawnChild ?? spawnNode;
+	const listenTimeoutMs = deps.listenTimeoutMs ?? 6e4;
 	const registries = /* @__PURE__ */ new WeakMap();
+	let wanted = required;
 	let enabled = false;
 	let endpoint;
 	let starting;
@@ -59,14 +70,14 @@ function createAnonController(deps) {
 		if (state === void 0) {
 			state = {
 				originals: /* @__PURE__ */ new Map(),
-				routed: /* @__PURE__ */ new Set()
+				routed: /* @__PURE__ */ new Map()
 			};
 			registries.set(registry, state);
 		}
 		return state;
 	}
 	async function resolveEndpoint(ctx) {
-		if (endpoint !== void 0) return endpoint;
+		if (endpoint !== void 0 && endpoint.child?.exited !== true) return endpoint;
 		const url = env[URL_ENV];
 		if (url !== void 0 && url !== "") {
 			const token = env[TOKEN_ENV];
@@ -77,13 +88,17 @@ function createAnonController(deps) {
 			};
 			return endpoint;
 		}
-		starting ??= startInProcess(ctx.cwd).finally(() => {
+		starting ??= startChild(ctx.cwd).finally(() => {
 			starting = void 0;
 		});
 		endpoint = await starting;
 		return endpoint;
 	}
-	async function startInProcess(cwd) {
+	/**
+	* Runs the proxy CLI under the system Node: omp is a compiled Bun executable whose resolver
+	* cannot load transform modules with native or ML dependencies from `node_modules`.
+	*/
+	async function startChild(cwd) {
 		const path = findProxyConfig({
 			cwd,
 			home: deps.home
@@ -94,27 +109,60 @@ function createAnonController(deps) {
 		}
 		const options = loadProxyConfig(path);
 		if (options.defaultPipeline === void 0) throw new Error(`${path} sets no defaultPipeline: the omp extension sends no pipeline header`);
+		const token = randomBytes(32).toString("base64url");
+		const node = env["SKAILE_TRANSFORM_PROXY_NODE"] || "node";
+		const cli = deps.cliPath ?? fileURLToPath(new URL("../cli.mjs", import.meta.url));
+		const child = spawnChild(node, [
+			cli,
+			"--config",
+			path,
+			"--port",
+			"0",
+			"--host",
+			"127.0.0.1",
+			"--exit-with-stdin"
+		], {
+			cwd,
+			env: {
+				...env,
+				[TOKEN_ENV]: token
+			},
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		const state = { exited: false };
+		child.on("exit", () => {
+			state.exited = true;
+			if (endpoint?.child === state) endpoint = void 0;
+		});
 		return {
-			url: (await startProxy({
-				...options,
-				log: silentLogger
-			})).url,
+			url: await waitForListening(child, {
+				node,
+				token,
+				timeoutMs: listenTimeoutMs
+			}),
+			token,
 			pipeline: options.defaultPipeline,
-			source: `in-process, config ${path}`
+			source: `child process ${child.pid}, config ${path}`,
+			child: state
 		};
 	}
 	function currentSessionId(ctx) {
-		if (sessionId === void 0) {
-			let id;
-			try {
-				id = ctx.sessionManager.getSessionId();
-			} catch {
-				id = void 0;
-			}
-			sessionId = typeof id === "string" && id !== "" ? id : randomUUID();
-		}
+		sessionId ??= readSessionId(ctx) ?? randomUUID();
 		return sessionId;
 	}
+	/**
+	* Adopts the session id of a root session. The first session of the process is the root;
+	* later `session_start`s are subagents (headless, `print` mode) unless the session has a UI
+	* or runs in another mode.
+	*/
+	function enterSession(ctx, root) {
+		if (sessionId === void 0) currentSessionId(ctx);
+		else if (root) sessionId = readSessionId(ctx) ?? sessionId;
+	}
 	function route(ctx, target) {
 		const registry = ctx.modelRegistry;
 		const state = stateOf(registry);
@@ -126,7 +174,7 @@ function createAnonController(deps) {
 				state.originals.set(provider, original);
 			}
 			if (original.preRouted) continue;
-			if (state.routed.has(provider) && registry.getProviderBaseUrl(provider) === target.url) continue;
+			if (state.routed.get(provider) === session && registry.getProviderBaseUrl(provider) === target.url) continue;
 			const headers = { [SESSION_HEADER]: session };
 			if (original.baseUrl !== void 0) headers[UPSTREAM_HEADER] = original.baseUrl;
 			if (target.token !== void 0) headers[TOKEN_HEADER] = target.token;
@@ -134,7 +182,7 @@ function createAnonController(deps) {
 				baseUrl: target.url,
 				headers
 			}, SOURCE_ID);
-			state.routed.add(provider);
+			state.routed.set(provider, session);
 		}
 	}
 	/** Clears the proxy overrides; re-applies the recorded original where another override was layered underneath. */
@@ -143,7 +191,7 @@ function createAnonController(deps) {
 		const state = stateOf(registry);
 		registry.clearSourceRegistrations(SOURCE_ID);
 		const lost = [];
-		for (const provider of state.routed) {
+		for (const provider of state.routed.keys()) {
 			const original = state.originals.get(provider);
 			const restored = registry.getProviderBaseUrl(provider);
 			if (original === void 0 || restored === original.baseUrl) continue;
@@ -159,26 +207,52 @@ function createAnonController(deps) {
 		state.routed.clear();
 		return lost;
 	}
-	async function turnOn(ctx, session) {
+	/**
+	* Routes every provider and rebinds the active model. Returns the failure, or `undefined`.
+	* A failed rebind leaves the session on a model that bypasses the proxy: outside required
+	* mode the routes are rolled back, so the registry matches the state shown.
+	*/
+	async function activate(ctx, session) {
 		let target;
 		try {
 			target = await resolveEndpoint(ctx);
 		} catch (err) {
-			ctx.ui.notify(`anon: ${errorMessage(err)}`, "error");
-			return false;
+			enabled = false;
+			return errorMessage(err);
 		}
 		route(ctx, target);
-		enabled = true;
-		await rebind(ctx, session);
-		return true;
+		if (await rebind(ctx, session)) {
+			enabled = true;
+			return;
+		}
+		if (!required) unroute(ctx);
+		enabled = false;
+		const active = ctx.model;
+		return `could not rebind the active model ${active?.provider}/${active?.id} to the transform proxy`;
 	}
 	/** The session holds its active model as a snapshot: swap in the registry's re-projected one. */
 	async function rebind(ctx, session) {
 		const active = ctx.model;
-		if (active === void 0) return;
+		if (active === void 0) return true;
 		const live = ctx.modelRegistry.find(active.provider, active.id);
-		if (live === void 0 || live.baseUrl === active.baseUrl) return;
-		if (!await session.setModel(live)) ctx.ui.notify(`anon: could not rebind the active model ${active.provider}/${active.id}; select it again`, "warning");
+		if (live === void 0) return false;
+		if (live.baseUrl === active.baseUrl && live.headers?.["x-skaile-transform-session"] === active.headers?.["x-skaile-transform-session"]) return true;
+		try {
+			return await session.setModel(live);
+		} catch {
+			return false;
+		}
+	}
+	/** Why a request of `model` would bypass the proxy, or `undefined` when it targets it. */
+	function bypassReason(ctx, model) {
+		if (model === void 0) return "the request names no model";
+		if (stateOf(ctx.modelRegistry).originals.get(model.provider)?.preRouted === true) return void 0;
+		const proxyOrigin = endpoint === void 0 ? void 0 : originOf(endpoint.url);
+		if (proxyOrigin === void 0) return "the transform proxy is not available";
+		if (model.baseUrl === void 0 || originOf(model.baseUrl) !== proxyOrigin) return `${model.provider}/${model.id} does not target the transform proxy`;
+	}
+	function refusalHint() {
+		return required ? `anon: required mode: model requests are refused until the transform proxy is routed (${MODE_ENV}=required)` : "anon: model requests are refused until /anon on succeeds; /anon off sends them directly";
 	}
 	function persist(ctx, value) {
 		try {
@@ -188,20 +262,23 @@ function createAnonController(deps) {
 			ctx.ui.notify(`anon: could not save ${statePath}: ${errorMessage(err)}`, "warning");
 		}
 	}
+	function stateLabel() {
+		return enabled ? "on" : wanted ? "error" : "off";
+	}
 	function showStatus(ctx) {
-		ctx.ui.setStatus(STATUS_KEY, enabled ? "anon on" : "anon off");
+		ctx.ui.setStatus(STATUS_KEY, `anon ${stateLabel()}`);
 	}
 	function statusText(ctx) {
 		const registry = ctx.modelRegistry;
 		const state = stateOf(registry);
 		const apis = providerApis(registry);
-		const lines = [`anon ${enabled ? "on" : "off"}${required ? " (required)" : ""}`];
+		const lines = [`anon ${stateLabel()}${required ? " (required)" : ""}`];
 		if (endpoint !== void 0) {
 			lines.push(`proxy: ${endpoint.url} (${endpoint.source})`);
 			lines.push(`pipeline: ${endpoint.pipeline ?? "the proxy default"}`);
 		}
 		if (sessionId !== void 0) lines.push(`session: ${sessionId}`);
-		const routed = [...state.routed].sort();
+		const routed = [...state.routed.keys()].sort();
 		const refused = routed.flatMap((provider) => {
 			const reason = refusalReason(apis.get(provider), state.originals.get(provider));
 			return reason === void 0 ? [] : [`${provider} (${reason})`];
@@ -212,26 +289,52 @@ function createAnonController(deps) {
 		if (preRouted.length > 0) lines.push(`routed by their own config (${preRouted.length}): ${preRouted.sort().join(", ")}`);
 		return lines.join("\n");
 	}
+	/**
+	* Session entry: rotate the proxy session for a new root, then (re-)apply routing when wanted.
+	* Rotation only switches the session header: the proxy keeps the old session's state in memory
+	* until it exits, and no request carries that id again.
+	*/
+	async function start(ctx, session, root) {
+		enterSession(ctx, root);
+		if (!wanted && readEnabled(statePath)) wanted = true;
+		if (wanted) {
+			const failure = await activate(ctx, session);
+			if (failure !== void 0) {
+				ctx.ui.notify(`anon: ${failure}`, "error");
+				ctx.ui.notify(refusalHint(), "error");
+			}
+		}
+		showStatus(ctx);
+	}
 	return {
 		required,
 		statePath,
 		async command(args, ctx, session) {
 			switch (args.trim().toLowerCase()) {
-				case "on":
-					if (await turnOn(ctx, session)) {
+				case "on": {
+					const before = wanted;
+					wanted = true;
+					const failure = await activate(ctx, session);
+					if (failure === void 0) {
 						persist(ctx, true);
 						const count = stateOf(ctx.modelRegistry).routed.size;
 						ctx.ui.notify(`anon on: ${count} provider(s) routed through ${endpoint?.url}`, "info");
+						break;
 					}
+					wanted = before || required;
+					ctx.ui.notify(`anon: ${failure}`, "error");
+					if (wanted) ctx.ui.notify(refusalHint(), "error");
 					break;
+				}
 				case "off": {
 					if (required) {
 						ctx.ui.notify(`anon: off refused: this session requires the transform proxy (${MODE_ENV}=required)`, "warning");
 						break;
 					}
 					const lost = unroute(ctx);
+					wanted = false;
 					enabled = false;
-					await rebind(ctx, session);
+					if (!await rebind(ctx, session)) ctx.ui.notify(`anon: could not rebind the active model ${ctx.model?.provider}/${ctx.model?.id}; select it again`, "warning");
 					persist(ctx, false);
 					ctx.ui.notify("anon off: original provider base URLs restored", "info");
 					if (lost.length > 0) ctx.ui.notify(`anon: ${lost.join(", ")} lost their runtime registration (registered by another extension); restart omp to restore them`, "warning");
@@ -250,20 +353,33 @@ function createAnonController(deps) {
 			const items = VERBS.filter((item) => item.value.startsWith(needle));
 			return items.length > 0 ? items : null;
 		},
-		async sessionStart(ctx, session) {
-			currentSessionId(ctx);
-			if (enabled && endpoint !== void 0) {
-				route(ctx, endpoint);
-				await rebind(ctx, session);
-			} else if (required || readEnabled(statePath)) {
-				if (!await turnOn(ctx, session) && required) ctx.ui.notify("anon: required mode, but no provider is routed through the transform proxy", "error");
-			}
-			showStatus(ctx);
+		sessionStart(ctx, session) {
+			return start(ctx, session, ctx.hasUI === true || ctx.mode !== void 0 && ctx.mode !== "print");
+		},
+		sessionSwitch(ctx, session) {
+			return start(ctx, session, true);
 		},
 		async reapply(ctx, session) {
-			if (!enabled || endpoint === void 0) return;
-			route(ctx, endpoint);
-			await rebind(ctx, session);
+			if (!wanted) return;
+			const was = enabled;
+			const failure = await activate(ctx, session);
+			if (failure !== void 0 && was) {
+				ctx.ui.notify(`anon: ${failure}`, "error");
+				ctx.ui.notify(refusalHint(), "error");
+			}
+			if (enabled !== was) showStatus(ctx);
+		},
+		providerRequest(ctx) {
+			if (!wanted) return void 0;
+			let reason;
+			try {
+				reason = bypassReason(ctx, ctx.model);
+			} catch (err) {
+				reason = errorMessage(err);
+			}
+			if (reason === void 0) return void 0;
+			ctx.ui.notify(`anon: model request refused: ${reason}`, "error");
+			return {};
 		}
 	};
 }
@@ -282,6 +398,101 @@ function readEnabled(path) {
 		return false;
 	}
 }
+function spawnNode(command, args, options) {
+	return spawn(command, [...args], {
+		cwd: options.cwd,
+		env: options.env,
+		stdio: [...options.stdio]
+	});
+}
+/** The stderr lines a startup failure quotes. */
+const STDERR_TAIL = 10;
+/**
+* Resolves with the URL of the child's `listening <url>` line. A child that exits first, fails
+* to spawn or stays silent past `timeoutMs` (it is then killed) rejects, quoting its last stderr
+* lines with the token redacted. omp exiting kills the child; once listening, the child and its
+* pipes no longer hold omp's event loop, and stdin stays open so the child sees omp go away.
+*/
+function waitForListening(child, how) {
+	const killOnExit = () => {
+		child.kill("SIGTERM");
+	};
+	process.on("exit", killOnExit);
+	const forgetExitHook = () => {
+		process.off("exit", killOnExit);
+	};
+	child.on("exit", forgetExitHook);
+	for (const stream of [
+		child.stdin,
+		child.stdout,
+		child.stderr
+	]) stream?.on("error", () => {});
+	const listening = Promise.withResolvers();
+	const label = `the transform proxy child process (${how.node}, pid ${child.pid})`;
+	const tail = [];
+	let stderrPartial = "";
+	let stdout = "";
+	let settled = false;
+	function stderrTail() {
+		const lines = [...tail, stderrPartial].filter((line) => line.trim() !== "").slice(-10);
+		return lines.length === 0 ? "(none)" : lines.map((line) => line.split(how.token).join("[token]")).join("\n");
+	}
+	function fail(message) {
+		if (settled) return;
+		settled = true;
+		clearTimeout(timer);
+		listening.reject(new Error(message));
+	}
+	const timer = setTimeout(() => {
+		fail(`${label} did not print "listening" within ${duration(how.timeoutMs)} and was killed; last stderr lines:\n${stderrTail()}`);
+		child.kill("SIGKILL");
+	}, how.timeoutMs);
+	child.stderr?.on("data", (chunk) => {
+		if (settled) return;
+		const lines = (stderrPartial + String(chunk)).split("\n");
+		stderrPartial = lines.pop() ?? "";
+		tail.push(...lines.map((line) => line.replace(/\r$/, "")));
+		tail.splice(0, Math.max(0, tail.length - STDERR_TAIL));
+	});
+	child.stdout?.on("data", (chunk) => {
+		if (settled) return;
+		const lines = (stdout + String(chunk)).split("\n");
+		stdout = lines.pop() ?? "";
+		for (const line of lines) {
+			const match = /^listening (\S+)$/.exec(line.trim());
+			if (match === null) continue;
+			settled = true;
+			clearTimeout(timer);
+			stdout = "";
+			child.unref();
+			for (const stream of [
+				child.stdin,
+				child.stdout,
+				child.stderr
+			]) stream?.unref?.();
+			listening.resolve(match[1]);
+			return;
+		}
+	});
+	child.on("exit", (code, signal) => {
+		if (settled) return;
+		const report = () => fail(`${label} exited with ${code === null ? `signal ${signal}` : `code ${code}`} before it was listening; last stderr lines:\n${stderrTail()}`);
+		const stderr = child.stderr;
+		if (stderr === null || stderr.readableEnded || stderr.destroyed) report();
+		else {
+			stderr.once("end", report);
+			stderr.once("close", report);
+		}
+	});
+	child.on("error", (err) => {
+		forgetExitHook();
+		fail(`could not start the transform proxy with "${how.node}": ${err.message}; it runs under Node >= 22: put node on PATH or set ${NODE_ENV}`);
+	});
+	return listening.promise;
+}
+function duration(ms) {
+	return ms % 1e3 === 0 ? `${ms / 1e3} s` : `${ms} ms`;
+}
 /** Every provider of the registry with the wire APIs of its models. */
 function providerApis(registry) {
 	const out = /* @__PURE__ */ new Map();
@@ -311,8 +522,24 @@ function refusalReason(apis, original) {
 	const unserved = [...apis ?? []].filter((api) => !Object.hasOwn(SERVED_APIS, api));
 	return unserved.length === 0 ? void 0 : unserved.join(", ");
 }
+function readSessionId(ctx) {
+	try {
+		const id = ctx.sessionManager.getSessionId();
+		return typeof id === "string" && id !== "" ? id : void 0;
+	} catch {
+		return;
+	}
+}
+/** The origin of an http(s) URL; `undefined` for anything else, which never matches the proxy. */
+function originOf(url) {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return;
+	}
+}
 // src/omp/index.ts
-/** omp re-imports the extension per session; the controller (proxy, recorded originals) is process-wide. */
+/** omp re-imports the extension per session; the controller (proxy child, recorded originals) is process-wide. */
 const CONTROLLER_KEY = Symbol.for("@skaile/transform-proxy/omp");
 /** Registers the `/anon` command and the event handlers on one session's extension API. */
 function registerAnonExtension(pi, controller) {
@@ -322,8 +549,10 @@ function registerAnonExtension(pi, controller) {
 		handler: (args, ctx) => guarded(ctx, () => controller.command(args, ctx, pi))
 	});
 	on(pi, "session_start", (ctx) => controller.sessionStart(ctx, pi));
+	on(pi, "session_switch", (ctx) => controller.sessionSwitch(ctx, pi));
 	on(pi, "before_agent_start", (ctx) => controller.reapply(ctx, pi));
 	on(pi, "turn_start", (ctx) => controller.reapply(ctx, pi));
+	pi.on("before_provider_request", (_event, ctx) => controller.providerRequest(ctx));
 }
 function anonExtension(pi) {
 	const scope = globalThis;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaile/transform-proxy",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "type": "module",
   "description": "Same-protocol passthrough proxy that runs model requests and replies through a chain of text transforms (Anthropic Messages, OpenAI chat, OpenAI responses)",
   "license": "MIT",