@skaile/transform-proxy 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.4.0
+
+- Library: `TransformProxy.inspect(sessionId, pipelineId?)` returns host-only transform state, `{ <transformId>: state }` for each stage of the session's pipeline instance (default `defaultPipeline`) that implements the new optional `Transform.inspect?()`. A host such as anon-ai reads forge-anon's mapping through it to show what was anonymized. It is in-process only (no HTTP route, never sent), returns `{}` for an unknown session, an unbuilt pipeline or a failed build, and never builds an instance or creates session state.
+
+## 0.3.1
+
+- Anthropic walker: the system text that Anthropic's Claude subscription (OAuth) check reads verbatim passes untransformed: the leading Claude Code identity sentence and the leading `x-anthropic-billing-header:` line. The rest of each block is still transformed. forge-anon read `Claude` as a name and the `cc_version` as IP addresses, so every request of a subscription session with anon on got 429 `rate_limit_error` "Error".
+
 ## 0.3.0
 
 - omp extension, **behaviour change**: `/anon on` and `/anon off` switch only the omp process they run in (its subagents and its `/new`, `/resume`, `/fork` sessions included) and no longer save the default. Before, every `/anon on|off` wrote `~/.omp/agent/skaile-transform-proxy.json`, so turning anon off in one window turned it off for every omp started later. `/anon on --global` and `/anon off --global` also save the default. A saved `on` is applied at session start only until the first successful `/anon on|off` in that process, so a plain `/anon off` stays off across `/new`. An existing saved `enabled: true` still turns anon on in new omp processes; run `/anon off --global` to clear it.

package/README.md

@@ -85,6 +85,8 @@ await proxy.dropSession('s1')
 await proxy.close()
 ```
 
+`await proxy.inspect('s1')` lets the host read what the session's transforms hold, e.g. forge-anon's mapping for highlights: `{ <transformId>: state }`, one entry per stage of the pipeline (`inspect('s1', 'anon')`; default `defaultPipeline`) whose `Transform` implements `inspect()`. It is in-process only: there is no HTTP route, and the result is never sent anywhere. An unknown session, a pipeline that has not been built for the session yet, or a failed build gives `{}`; `inspect` never builds an instance or creates session state.
+
 ## omp extension
 
 The package ships an [omp](https://omp.sh) extension (subpath `@skaile/transform-proxy/omp`, declared in the package manifest under `omp.extensions`):
@@ -128,10 +130,12 @@ A module default-exports a `TransformModule`:
 
 - `open(config, { baseDir, log })` runs once per proxy. It validates the config and builds shared state. Throwing rejects startup.
 - It returns a `TransformFactory`, which runs once per `(session, pipeline)`: `(ctx: { sessionId, facts, log }) => Transform`.
-- A `Transform` has `instruction?`, `outbound(text, leaf)`, `inbound(text)`, `inboundStream()` and `dispose?()`.
+- A `Transform` has `instruction?`, `outbound(text, leaf)`, `inbound(text)`, `inboundStream()`, `dispose?()` and `inspect?()` (host-only state, read through `proxy.inspect`; the walkers never call it).
 
 The Anthropic walker appends the pipeline `instruction` after the host's system prompt: a string `system` gets it after a blank line, a block array gets it as one more text block at the end, and an absent `system` becomes the instruction. The host's leading blocks stay first, because Claude Code gateways (TeamClaude) refuse Sonnet requests with 429 `rate_limit_error` when the system prompt does not start with the Claude Code blocks. The OpenAI walkers still put the instruction first: a leading `system` message in chat completions, a prefix of `instructions` in responses.
 
+Those leading blocks also pass untransformed: a system text that starts with the Claude Code identity sentence (`You are Claude Code, Anthropic's official CLI for Claude.`) keeps that sentence, and one that starts with `x-anthropic-billing-header:` keeps that first line; the rest of the text is transformed. Anthropic's Claude subscription (OAuth) check reads them verbatim and answers 429 `rate_limit_error` with the message `Error` when they differ, and a German NER reads `Claude` as a name and a `cc_version` as an IP address. The host writes these blocks; they carry no user data.
+
 `inboundStream().push(c1) + … + flush()` must equal `inbound(c1 + … + cn)` for every chunking.
 
 Connectors publish facts through `proxy.session(id).publisher(source)`. Facts are in-process only.

package/dist/cli.d.mts

@@ -1,4 +1,4 @@
-import { i as TransformProxy } from "./server-C_eKyCTV.mjs";
+import { i as TransformProxy } from "./server-CicvlQ7q.mjs";
 /** Environment variable that supplies the client token when `--token` is absent. */
 export declare const TOKEN_ENV = "SKAILE_TRANSFORM_PROXY_TOKEN";
 export interface CliEnvironment {

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { d as createTransformProxy, o as resolveProxyConfig, v as errorMessage } from "./config-PKHxejC8.mjs";
+import { d as createTransformProxy, o as resolveProxyConfig, v as errorMessage } from "./config-Ceb5AF_a.mjs";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";

package/dist/{config-PKHxejC8.mjs → config-Ceb5AF_a.mjs}

@@ -323,8 +323,8 @@ async function outbound$2(transform, text, leaf) {
 	return text === "" ? text : transform.outbound(text, leaf);
 }
 /** A string, or an array of blocks whose `text` blocks are rewritten; anything else is refused. */
-async function rewriteText(content, slot, leaf, transform) {
-	if (typeof content === "string") return outbound$2(transform, content, leaf);
+async function rewriteText(content, slot, rewrite) {
+	if (typeof content === "string") return rewrite(content);
 	if (!Array.isArray(content)) return malformed$2(slot);
 	const out = [];
 	for (const block of content) {
@@ -337,11 +337,30 @@ async function rewriteText(content, slot, leaf, transform) {
 		if (typeof block.text !== "string") return malformed$2(`${slot} text block`);
 		out.push({
 			...block,
-			text: await outbound$2(transform, block.text, leaf)
+			text: await rewrite(block.text)
 		});
 	}
 	return out;
 }
+/**
+* Host-written system text that Anthropic's Claude subscription (OAuth) check reads verbatim: the
+* billing header line and the Claude Code identity sentence. Rewritten ("CLI for <NAME_…>",
+* "cc_version=<CONTACT_IP_…>"), the request is answered 429 `rate_limit_error` "Error". Neither
+* carries user data.
+*/
+const BILLING_HEADER = "x-anthropic-billing-header:";
+const CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+/** The leading part of a system text that passes untransformed; `''` when there is none. */
+function gatePrefix(text) {
+	if (text.startsWith(CLAUDE_CODE_IDENTITY)) return CLAUDE_CODE_IDENTITY;
+	if (!text.startsWith(BILLING_HEADER)) return "";
+	const end = text.indexOf("\n");
+	return end === -1 ? text : text.slice(0, end);
+}
+async function rewriteSystemText(text, transform) {
+	const kept = gatePrefix(text);
+	return kept + await outbound$2(transform, text.slice(kept.length), { kind: "system" });
+}
 /** Every string leaf of a JSON value (tool-call input); keys stay as they are. */
 async function rewriteStrings$2(value, leaf, transform) {
 	if (typeof value === "string") return outbound$2(transform, value, leaf);
@@ -421,10 +440,10 @@ async function rewriteContent$2(content, role, toolNames, ctx) {
 				const toolName = typeof block.tool_use_id === "string" ? toolNames.get(block.tool_use_id) : void 0;
 				out.push({
 					...block,
-					content: await rewriteText(block.content, "tool_result content", {
+					content: await rewriteText(block.content, "tool_result content", (text) => outbound$2(ctx.transform, text, {
 						kind: "toolResult",
 						toolName
-					}, ctx.transform)
+					}))
 				});
 				break;
 			}
@@ -567,7 +586,7 @@ const anthropicWalker = {
 	async request(body, ctx) {
 		if (!isObj$2(body)) return malformed$2("request body");
 		const out = { ...body };
-		if (body.system !== void 0) out.system = await rewriteText(body.system, "system", { kind: "system" }, ctx.transform);
+		if (body.system !== void 0) out.system = await rewriteText(body.system, "system", (text) => rewriteSystemText(text, ctx.transform));
 		if (ctx.transform.instruction !== void 0) out.system = withInstruction(out.system, ctx.transform.instruction);
 		if (body.messages !== void 0) {
 			if (!Array.isArray(body.messages)) return malformed$2("messages");
@@ -1405,6 +1424,8 @@ async function createTransformProxy(options) {
 	const factories = await openTransforms(options.transforms, options.baseDir, log);
 	const pipelines = options.pipelines;
 	const sessions = /* @__PURE__ */ new Map();
+	/** Composed instance -> its stages with their transform ids, for `inspect`. */
+	const stagesOf = /* @__PURE__ */ new WeakMap();
 	function stateFor(id) {
 		const existing = sessions.get(id);
 		if (existing) return existing;
@@ -1437,7 +1458,12 @@ async function createTransformProxy(options) {
 			}
 			throw err;
 		}
-		return composeTransforms(stages, log);
+		const composed = composeTransforms(stages, log);
+		stagesOf.set(composed, ids.map((id, i) => ({
+			id,
+			transform: stages[i]
+		})));
+		return composed;
 	}
 	async function handle(req, res) {
 		const url = new URL(req.url ?? "/", "http://proxy.invalid");
@@ -1554,6 +1580,22 @@ async function createTransformProxy(options) {
 			sessions.delete(id);
 			await disposeInstances(state, log);
 		},
+		async inspect(sessionId, pipelineId) {
+			const state = sessions.get(sessionId);
+			const pipeline = pipelineId ?? options.defaultPipeline;
+			if (state === void 0 || pipeline === void 0) return {};
+			const pending = state.instances.get(pipeline);
+			if (pending === void 0) return {};
+			let instance;
+			try {
+				instance = await pending;
+			} catch {
+				return {};
+			}
+			const result = {};
+			for (const stage of stagesOf.get(instance) ?? []) if (typeof stage.transform.inspect === "function") result[stage.id] = stage.transform.inspect();
+			return result;
+		},
 		async close() {
 			const closed = Promise.withResolvers();
 			server.close((err) => err ? closed.reject(err) : closed.resolve());

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { _ as TransformModule, a as TransformProxyOptions, c as TransformSpec, d as SessionFactPublisher, f as SessionFacts, g as TransformFactory, h as Transform, i as TransformProxy, l as Logger, m as TextLeafKind, n as SESSION_HEADER, o as UPSTREAM_HEADER, p as TextLeaf, r as TOKEN_HEADER, s as createTransformProxy, t as PIPELINE_HEADER, u as SessionFact, v as TransformSessionContext } from "./server-C_eKyCTV.mjs";
+import { _ as TransformModule, a as TransformProxyOptions, c as TransformSpec, d as SessionFactPublisher, f as SessionFacts, g as TransformFactory, h as Transform, i as TransformProxy, l as Logger, m as TextLeafKind, n as SESSION_HEADER, o as UPSTREAM_HEADER, p as TextLeaf, r as TOKEN_HEADER, s as createTransformProxy, t as PIPELINE_HEADER, u as SessionFact, v as TransformSessionContext } from "./server-CicvlQ7q.mjs";
 /** One stage's streamed inbound transformer, as returned by `Transform.inboundStream()`. */
 interface InboundStream {
   push(chunk: string): string;

package/dist/index.mjs

@@ -1 +1 @@
-export { t as CONFIG_FILE_NAME, s as PIPELINE_HEADER, c as SESSION_HEADER, l as TOKEN_HEADER, u as UPSTREAM_HEADER, h as UnsupportedContentError, m as anthropicWalker, _ as composeTransforms, n as configCandidates, g as createSessionFacts, d as createTransformProxy, r as findProxyConfig, i as loadProxyConfig, p as openaiChatWalker, f as openaiResponsesWalker, a as parseProxyConfig, o as resolveProxyConfig, y as silentLogger } from "./config-PKHxejC8.mjs";
+export { t as CONFIG_FILE_NAME, s as PIPELINE_HEADER, c as SESSION_HEADER, l as TOKEN_HEADER, u as UPSTREAM_HEADER, h as UnsupportedContentError, m as anthropicWalker, _ as composeTransforms, n as configCandidates, g as createSessionFacts, d as createTransformProxy, r as findProxyConfig, i as loadProxyConfig, p as openaiChatWalker, f as openaiResponsesWalker, a as parseProxyConfig, o as resolveProxyConfig, y as silentLogger } from "./config-Ceb5AF_a.mjs";

package/dist/omp/index.mjs

@@ -1,4 +1,4 @@
-import { c as SESSION_HEADER, i as loadProxyConfig, l as TOKEN_HEADER, n as configCandidates, r as findProxyConfig, u as UPSTREAM_HEADER, v as errorMessage } from "../config-PKHxejC8.mjs";
+import { c as SESSION_HEADER, i as loadProxyConfig, l as TOKEN_HEADER, n as configCandidates, r as findProxyConfig, u as UPSTREAM_HEADER, v as errorMessage } from "../config-Ceb5AF_a.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";

package/dist/{server-C_eKyCTV.d.mts → server-CicvlQ7q.d.mts}

@@ -25,6 +25,8 @@ interface Transform {
   };
   /** Called once when the proxy drops the session. */
   dispose?(): void | Promise<void>;
+  /** Host-only state of this instance (e.g. the anon mapping), read through TransformProxy.inspect. Never called by the walkers, never sent anywhere. */
+  inspect?(): unknown;
 }
 interface SessionFact {
   readonly kind: string;
@@ -86,6 +88,12 @@ interface TransformProxy {
   };
   /** Disposes the session's transform instances and forgets its facts and caches. */
   dropSession(id: string): Promise<void>;
+  /**
+   * Host-only, in-process: each stage's `inspect()` result of the session's pipeline instance, keyed by transform id.
+   * `{}` when the session or pipeline is unknown, the instance is not built, or its build failed.
+   * Never builds an instance or creates session state; there is no HTTP route for it.
+   */
+  inspect(sessionId: string, pipelineId?: string): Promise<Record<string, unknown>>;
   close(): Promise<void>;
 }
 declare const UPSTREAM_HEADER = "x-skaile-transform-upstream";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaile/transform-proxy",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "type": "module",
   "description": "Same-protocol passthrough proxy that runs model requests and replies through a chain of text transforms (Anthropic Messages, OpenAI chat, OpenAI responses)",
   "license": "MIT",