@st-gr/sail-proxy 0.9.2 → 0.9.4

package/bundled/gateway/services/gateway/src/plugins/pseudonymization/replacementMap.d.ts

@@ -4,13 +4,37 @@
  * Maintains forward (original → placeholder) and reverse (placeholder → original)
  * mappings for the lifetime of a single request. Ensures idempotency: the same
  * original text always gets the same placeholder within a request.
+ *
+ * Pseudonymization placeholders are CONTENT-DERIVED (truncated SHA-256 of the
+ * original value), so the same value produces the same token in every request:
+ *   - tokens echoed by the model out of older conversation turns ("residue")
+ *     resolve correctly as long as the underlying value is present in the
+ *     current request (it re-mints the identical token);
+ *   - the response cache can safely replay a masked response cached from an
+ *     equivalent request — its tokens are reproducible from content alone;
+ *   - masked request bodies are byte-stable across requests, which also keeps
+ *     upstream prompt caching effective.
+ * Anonymization placeholders remain per-request counters: without a reverse
+ * map they are never unmasked, and a content-derived token would make the same
+ * entity linkable across requests, defeating anonymization.
  */
 export declare class ReplacementMap {
     readonly forward: Map<string, string>;
     readonly reverse: Map<string, string>;
     private counters;
+    private minCountersByPrefix;
     private method;
     constructor(method?: 'pseudonymization' | 'anonymization');
+    /**
+     * Ensure freshly minted placeholders for `prefix` start above `minCount`.
+     *
+     * Used when the incoming request already contains literal MASKED_*_n tokens
+     * ("residue" leaked into the conversation history by an earlier session).
+     * Without this, a fresh entity could mint the same number as a residue token,
+     * and unmasking the model's echo of that residue would substitute the WRONG
+     * person's name.
+     */
+    reserveMinCount(prefix: string, minCount: number): void;
     /**
      * Get or assign a placeholder for an entity
      */

package/bundled/gateway/services/gateway/src/plugins/pseudonymization/replacementMap.js

@@ -5,18 +5,66 @@
  * Maintains forward (original → placeholder) and reverse (placeholder → original)
  * mappings for the lifetime of a single request. Ensures idempotency: the same
  * original text always gets the same placeholder within a request.
+ *
+ * Pseudonymization placeholders are CONTENT-DERIVED (truncated SHA-256 of the
+ * original value), so the same value produces the same token in every request:
+ *   - tokens echoed by the model out of older conversation turns ("residue")
+ *     resolve correctly as long as the underlying value is present in the
+ *     current request (it re-mints the identical token);
+ *   - the response cache can safely replay a masked response cached from an
+ *     equivalent request — its tokens are reproducible from content alone;
+ *   - masked request bodies are byte-stable across requests, which also keeps
+ *     upstream prompt caching effective.
+ * Anonymization placeholders remain per-request counters: without a reverse
+ * map they are never unmasked, and a content-derived token would make the same
+ * entity linkable across requests, defeating anonymization.
  */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ReplacementMap = void 0;
+const crypto_1 = __importDefault(require("crypto"));
 const types_1 = require("./types");
+/** Digits of the content-derived placeholder id. Decimal (not hex) on purpose:
+ *  models copy short digit runs far more reliably than hex strings — a garbled
+ *  id is unrecoverable, so copy fidelity is part of the security design. */
+const HASH_ID_DIGITS = 8;
+/**
+ * Derive a decimal id from a SHA-256 digest. `level` widens the id (8, 10, 12 …
+ * digits) using more of the digest — used for deterministic collision probing:
+ * the same value always yields the same ladder of candidate ids.
+ */
+function idFromDigest(digest, level) {
+    const digits = HASH_ID_DIGITS + 2 * level;
+    const window = digest.slice(0, Math.min(12 + 4 * level, digest.length));
+    const num = BigInt(`0x${window}`) % (10n ** BigInt(digits));
+    return num.toString().padStart(digits, '0');
+}
 class ReplacementMap {
     forward = new Map();
     reverse = new Map();
     counters = new Map();
+    minCountersByPrefix = new Map();
     method;
     constructor(method = 'pseudonymization') {
         this.method = method;
     }
+    /**
+     * Ensure freshly minted placeholders for `prefix` start above `minCount`.
+     *
+     * Used when the incoming request already contains literal MASKED_*_n tokens
+     * ("residue" leaked into the conversation history by an earlier session).
+     * Without this, a fresh entity could mint the same number as a residue token,
+     * and unmasking the model's echo of that residue would substitute the WRONG
+     * person's name.
+     */
+    reserveMinCount(prefix, minCount) {
+        const current = this.minCountersByPrefix.get(prefix) || 0;
+        if (minCount > current) {
+            this.minCountersByPrefix.set(prefix, minCount);
+        }
+    }
     /**
      * Get or assign a placeholder for an entity
      */
@@ -26,14 +74,55 @@ class ReplacementMap {
             return this.forward.get(originalValue);
         }
         const prefix = customPrefix || types_1.DEFAULT_PREFIXES[entityType] || 'MASKED_UNKNOWN';
-        // Assign incrementing ID so the LLM can distinguish between entities
-        const count = (this.counters.get(entityType) || 0) + 1;
-        this.counters.set(entityType, count);
-        const placeholder = `${prefix}_${count}`;
+        // URL origins get a URL-SHAPED placeholder (e.g. `http://masked-url-12345678.invalid`)
+        // instead of a bare token: the model can then legitimately append paths and query
+        // parameters, and the composed URL still unmasks (the placeholder origin is replaced
+        // by the real origin wherever it appears). `.invalid` is an RFC 2606 reserved TLD,
+        // so an unresolved placeholder can never route traffic anywhere.
+        const isUrl = prefix === 'MASKED_URL';
+        const urlScheme = isUrl ? (originalValue.match(/^(?:https?|wss?|ftps?):\/\//)?.[0] ?? '') : '';
+        const render = (id) => isUrl ? `${urlScheme}masked-url-${id}.invalid` : `${prefix}_${id}`;
+        let placeholder;
+        if (this.method === 'pseudonymization') {
+            // Content-derived stable id: same value → same placeholder in every request.
+            const digest = crypto_1.default.createHash('sha256').update(originalValue, 'utf8').digest('hex');
+            let level = 0;
+            placeholder = render(idFromDigest(digest, level));
+            // In-request collision probing: two DIFFERENT values sharing an id widen it
+            // deterministically (each value always follows the same ladder of candidates,
+            // so the resolution itself is stable across requests).
+            while (this.reverse.has(placeholder) && this.reverse.get(placeholder) !== originalValue) {
+                level += 1;
+                if (12 + 4 * level > digest.length) {
+                    // Full-digest collision is not realistically reachable; guard anyway.
+                    placeholder = render(`${idFromDigest(digest, level)}${this.forward.size}`);
+                    break;
+                }
+                placeholder = render(idFromDigest(digest, level));
+            }
+        }
+        else {
+            // Anonymization: per-request incrementing id so the LLM can distinguish entities
+            // without the token being linkable across requests. Never collide with residue
+            // numbers already present in the request input.
+            const minForPrefix = this.minCountersByPrefix.get(prefix) || 0;
+            const count = Math.max(this.counters.get(entityType) || 0, minForPrefix) + 1;
+            this.counters.set(entityType, count);
+            placeholder = render(String(count));
+        }
         this.forward.set(originalValue, placeholder);
         if (this.method === 'pseudonymization') {
             // Only store reverse mapping for pseudonymization (enables unmasking)
             this.reverse.set(placeholder, originalValue);
+            // Scheme-less alias for URL placeholders: if the model reproduces the masked
+            // host without (or with a different) scheme, the bare form still unmasks to
+            // the bare origin, keeping whatever scheme the model chose.
+            if (isUrl && urlScheme) {
+                const bareKey = placeholder.slice(urlScheme.length);
+                if (!this.reverse.has(bareKey)) {
+                    this.reverse.set(bareKey, originalValue.slice(urlScheme.length));
+                }
+            }
         }
         return placeholder;
     }

package/bundled/gateway/services/gateway/src/plugins/pseudonymization/replacer.d.ts

@@ -6,6 +6,28 @@
  */
 import { EntityMatch, MaskingConfig } from './types';
 import { ReplacementMap } from './replacementMap';
+/**
+ * Minimum length of a detected value for it to be propagated (masked at ALL its
+ * exact occurrences across the request). Short values are masked only where a
+ * detector actually fired — propagating them risks carpet-masking common strings.
+ */
+export declare const MIN_PROPAGATION_LENGTH = 12;
+/**
+ * Propagate already-minted masks to EVERY exact occurrence of each detected value
+ * across the request's string nodes — including places no detector fired (e.g. a
+ * secret that was caught as `token=<secret>` in one node but rode through as
+ * `Authorization: Bearer <secret>` in another). This is the primary security fix:
+ * one value → one token → masked everywhere.
+ *
+ * Operates on parsed string nodes (system + messages subtree), so JSON-escaping in
+ * embedded tool_result strings is a non-issue. For values containing `"` or `\`, the
+ * JSON-escaped form is also searched (an identical secret embedded inside a
+ * JSON-in-string blob is escaped there). Mutates `body` in place; returns the number
+ * of occurrences replaced.
+ */
+export declare function propagateMaskedValues(body: any, map: ReplacementMap, opts?: {
+    minLength?: number;
+}): number;
 /**
  * Replace all detected entities in text with their placeholders
  * Returns the masked text

package/bundled/gateway/services/gateway/src/plugins/pseudonymization/replacer.js

@@ -6,10 +6,87 @@
  * Processes matches in reverse order of position to preserve character offsets.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_PROPAGATION_LENGTH = void 0;
+exports.propagateMaskedValues = propagateMaskedValues;
 exports.replaceEntities = replaceEntities;
 exports.maskJsonValue = maskJsonValue;
 const fabricatedData_1 = require("./fabricatedData");
 const detectors_1 = require("./detectors");
+/**
+ * Minimum length of a detected value for it to be propagated (masked at ALL its
+ * exact occurrences across the request). Short values are masked only where a
+ * detector actually fired — propagating them risks carpet-masking common strings.
+ */
+exports.MIN_PROPAGATION_LENGTH = 12;
+const REGEX_META = /[.*+?^${}()|[\]\\]/g;
+const WORD_CHAR = /[A-Za-z0-9_]/;
+/**
+ * Propagate already-minted masks to EVERY exact occurrence of each detected value
+ * across the request's string nodes — including places no detector fired (e.g. a
+ * secret that was caught as `token=<secret>` in one node but rode through as
+ * `Authorization: Bearer <secret>` in another). This is the primary security fix:
+ * one value → one token → masked everywhere.
+ *
+ * Operates on parsed string nodes (system + messages subtree), so JSON-escaping in
+ * embedded tool_result strings is a non-issue. For values containing `"` or `\`, the
+ * JSON-escaped form is also searched (an identical secret embedded inside a
+ * JSON-in-string blob is escaped there). Mutates `body` in place; returns the number
+ * of occurrences replaced.
+ */
+function propagateMaskedValues(body, map, opts = {}) {
+    const minLength = opts.minLength ?? exports.MIN_PROPAGATION_LENGTH;
+    // Build (needle → placeholder) pairs. Include the JSON-escaped form of any value
+    // containing escapable characters so it also matches inside JSON-in-string blobs.
+    const needles = [];
+    for (const [value, placeholder] of map.forward) {
+        if (typeof value !== 'string' || value.length < minLength)
+            continue;
+        needles.push({ text: value, placeholder });
+        const escaped = JSON.stringify(value).slice(1, -1);
+        if (escaped !== value && escaped.length >= minLength) {
+            needles.push({ text: escaped, placeholder });
+        }
+    }
+    if (needles.length === 0)
+        return 0;
+    // Longest needle first so a value that is a substring of another is not shadowed.
+    needles.sort((a, b) => b.text.length - a.text.length);
+    const byText = new Map(needles.map(n => [n.text, n.placeholder]));
+    const alternation = new RegExp(needles.map(n => n.text.replace(REGEX_META, '\\$&')).join('|'), 'g');
+    let replaced = 0;
+    const replaceInString = (s) => s.replace(alternation, (matchStr, offset, whole) => {
+        // Word-boundary guard: don't fire mid-identifier when the value's own edge is
+        // a word char and the adjacent text char is too (would corrupt an identifier).
+        const before = whole[offset - 1];
+        const after = whole[offset + matchStr.length];
+        if (WORD_CHAR.test(matchStr[0]) && before !== undefined && WORD_CHAR.test(before))
+            return matchStr;
+        if (WORD_CHAR.test(matchStr[matchStr.length - 1]) && after !== undefined && WORD_CHAR.test(after))
+            return matchStr;
+        replaced++;
+        return byText.get(matchStr) ?? matchStr;
+    });
+    const walk = (value) => {
+        if (typeof value === 'string')
+            return replaceInString(value);
+        if (Array.isArray(value)) {
+            for (let i = 0; i < value.length; i++)
+                value[i] = walk(value[i]);
+            return value;
+        }
+        if (value && typeof value === 'object') {
+            for (const k of Object.keys(value))
+                value[k] = walk(value[k]);
+            return value;
+        }
+        return value;
+    };
+    if (body?.system !== undefined)
+        body.system = walk(body.system);
+    if (Array.isArray(body?.messages))
+        walk(body.messages);
+    return replaced;
+}
 /**
  * Get the replacement strategy for an entity type from config
  */

package/bundled/gateway/services/gateway/src/plugins/pseudonymization/streamBuffer.js

@@ -39,8 +39,16 @@ class StreamUnmaskBuffer {
                 this.maxPrefixLength = p.length;
             }
         }
-        // Add some buffer for the digits after the prefix
-        this.maxPrefixLength += 5; // e.g., "_123" at most
+        // Add room for the id after the prefix: hash-stable ids are 8 digits
+        // (up to a few more under collision probing); legacy numeric ids are shorter.
+        this.maxPrefixLength += 16;
+        // Retention must also cover the longest exact key (URL-shaped placeholders like
+        // "https://masked-url-12345678.invalid" carry no MASKED_ prefix family).
+        for (const placeholder of map.reverse.keys()) {
+            if (placeholder.length > this.maxPrefixLength) {
+                this.maxPrefixLength = placeholder.length;
+            }
+        }
         // Build regex for complete placeholders
         const placeholders = Array.from(map.reverse.keys())
             .sort((a, b) => b.length - a.length);
@@ -57,13 +65,19 @@ class StreamUnmaskBuffer {
      */
     append(text) {
         this.buffer += text;
-        // Unmask any complete placeholders in buffer
-        this.placeholderRegex.lastIndex = 0;
-        this.buffer = this.buffer.replace(this.placeholderRegex, (match) => this.reverseMap.get(match) || match);
-        // Find safe flush point
+        // Find the safe flush point on the RAW buffer first, then unmask only the
+        // flushed slice. Replacing before choosing the flush point corrupted longer
+        // placeholders split at a digit boundary: with both MASKED_PERSON_11 and
+        // MASKED_PERSON_113 in the map, a chunk ending in '…MASKED_PERSON_11'
+        // followed by '3…' must NOT be eagerly replaced as _11 plus a stray '3'.
+        // couldBePartialPlaceholder retains a complete placeholder that is a strict
+        // prefix of a longer one, so the ambiguous tail stays buffered until the
+        // next chunk (or flush) disambiguates it.
         const safePoint = this.findSafeFlushPoint();
-        const flushed = this.buffer.slice(0, safePoint);
+        let flushed = this.buffer.slice(0, safePoint);
         this.buffer = this.buffer.slice(safePoint);
+        this.placeholderRegex.lastIndex = 0;
+        flushed = flushed.replace(this.placeholderRegex, (match) => this.reverseMap.get(match) || match);
         return flushed;
     }
     /**
@@ -81,7 +95,11 @@ class StreamUnmaskBuffer {
      * Any suffix that could be the beginning of a known placeholder must be retained.
      */
     findSafeFlushPoint() {
-        if (this.knownPrefixes.length === 0)
+        // No placeholders at all → nothing can ever match, flush everything.
+        // (knownPrefixes alone is not sufficient: URL-shaped placeholders like
+        // "https://masked-url-<id>.invalid" have no MASKED_*_ prefix family but
+        // still require suffix retention via the exact-key check below.)
+        if (this.knownPrefixes.length === 0 && this.reverseMap.size === 0)
             return this.buffer.length;
         const maxCheck = Math.min(this.buffer.length, this.maxPrefixLength);
         for (let len = maxCheck; len >= 1; len--) {

package/bundled/gateway/services/gateway/src/services/awsBedrockService.js

@@ -49,6 +49,9 @@ const logger_1 = require("@libs/logger");
 const logger = (0, logger_1.getDefaultLogger)();
 const rateLimitManager_1 = __importDefault(require("./rateLimitManager"));
 const usageTracker_1 = require("../utils/usageTracker");
+const betaFeatureFilter_1 = require("../utils/betaFeatureFilter");
+const betaFlagQuarantine = __importStar(require("./betaFlagQuarantine"));
+const upstreamErrorBody_1 = require("../utils/upstreamErrorBody");
 /**
  * Process AWS Bedrock requests with payload transformation and routing
  * @param options - Request processing options
@@ -92,39 +95,42 @@ async function processBedrockRequest(options) {
         if (processedRequestBody.anthropic_version === undefined && isInvokeSubpath) {
             processedRequestBody.anthropic_version = modelDetails.anthropic_version;
         }
-        // Add anthropic_beta from header if present (for beta features like extended thinking)
-        const anthropicBetaHeader = options.headers['anthropic-beta'];
-        if (anthropicBetaHeader && isInvokeSubpath) {
-            // Bedrock expects anthropic_beta as an array of strings
-            let betaFeatures = typeof anthropicBetaHeader === 'string'
-                ? anthropicBetaHeader.split(',').map(s => s.trim())
-                : Array.isArray(anthropicBetaHeader) ? anthropicBetaHeader : [];
-            // Filter out unsupported beta headers based on configuration
-            const excludedBetaHeaders = configService_1.default.getExcludedBetaHeaders();
-            if (excludedBetaHeaders.length > 0) {
-                const originalCount = betaFeatures.length;
-                betaFeatures = betaFeatures.filter(feature => !excludedBetaHeaders.includes(feature));
-                if (betaFeatures.length !== originalCount) {
-                    const filtered = originalCount - betaFeatures.length;
-                    logger.debug('AwsBedrockService', `Filtered ${filtered} unsupported beta feature(s): ${excludedBetaHeaders.filter(h => !betaFeatures.includes(h)).join(', ')}`);
-                }
+        // Assemble anthropic_beta for invoke subpaths from all sources, then filter
+        // through the configured allowlist (supported_beta_headers) and denylist
+        // (excluded_beta_headers) so no unsupported flag can reach SAP AI Core —
+        // including flags injected via inject_beta_features or supplied in the body.
+        if (isInvokeSubpath) {
+            const headerFeatures = (0, betaFeatureFilter_1.parseAnthropicBetaHeader)(options.headers['anthropic-beta']);
+            // Header takes precedence over a body-supplied anthropic_beta (legacy behavior);
+            // body flags are now filtered too instead of passing through untouched.
+            const bodyFeatures = headerFeatures.length === 0 && Array.isArray(processedRequestBody.anthropic_beta)
+                ? processedRequestBody.anthropic_beta.map(String)
+                : [];
+            const injectedFeatures = Array.isArray(modelDetails.inject_beta_features)
+                ? modelDetails.inject_beta_features.map(String)
+                : [];
+            const candidates = (0, betaFeatureFilter_1.mergeBetaFeatures)(headerFeatures, bodyFeatures, injectedFeatures);
+            const filterOptions = {
+                supported: configService_1.default.getSupportedBetaHeaders(),
+                // Config denylist plus flags quarantined at runtime after upstream
+                // "invalid beta flag" 400s for this model (see betaFlagQuarantine).
+                excluded: (0, betaFeatureFilter_1.mergeBetaFeatures)(configService_1.default.getExcludedBetaHeaders(), betaFlagQuarantine.getQuarantinedFlags(modelId))
+            };
+            const betaFeatures = (0, betaFeatureFilter_1.filterBetaFeatures)(candidates, filterOptions);
+            const dropped = candidates.filter(feature => !betaFeatures.includes(feature));
+            if (dropped.length > 0) {
+                logger.debug('AwsBedrockService', `Filtered ${dropped.length} unsupported beta feature(s): ${dropped.join(', ')}`);
+            }
+            if (injectedFeatures.length > 0) {
+                logger.debug('AwsBedrockService', `Injected model-specific beta features: ${injectedFeatures.join(', ')}`);
             }
             if (betaFeatures.length > 0) {
                 processedRequestBody.anthropic_beta = betaFeatures;
                 logger.debug('AwsBedrockService', `Adding anthropic_beta features: ${betaFeatures.join(', ')}`);
             }
-        }
-        // Inject model-specific beta features from configuration (e.g., context-1m for Opus/Sonnet 4.6)
-        if (isInvokeSubpath && modelDetails.inject_beta_features && Array.isArray(modelDetails.inject_beta_features)) {
-            if (!processedRequestBody.anthropic_beta) {
-                processedRequestBody.anthropic_beta = [];
-            }
-            for (const feature of modelDetails.inject_beta_features) {
-                if (!processedRequestBody.anthropic_beta.includes(feature)) {
-                    processedRequestBody.anthropic_beta.push(feature);
-                }
+            else {
+                delete processedRequestBody.anthropic_beta;
             }
-            logger.debug('AwsBedrockService', `Injected model-specific beta features: ${modelDetails.inject_beta_features.join(', ')}`);
         }
         if (isInvokeSubpath && isNativeSubpath) {
             // Check if model explicitly disables prompt caching - if so, filter out cache_control parameters
@@ -320,7 +326,20 @@ async function handleNativeSubpath(options) {
     catch (error) {
         logger.error('AwsBedrockService', `Error in native request: ${error.message}`);
         if (error.response) {
-            logger.error('AwsBedrockService', `SAP AI Core error response: ${error.response.status}`, error.response.data);
+            logger.error('AwsBedrockService', `SAP AI Core error response: ${error.response.status}`, undefined, { data: error.response.data });
+            if (debugRequestId) {
+                payloadLogger.savePayload(debugRequestId, '03_native_error_from_sap', {
+                    status: error.response.status,
+                    data: error.response.data
+                }, req, res);
+            }
+            const sentBetaFlags = Array.isArray(requestBody?.anthropic_beta)
+                ? requestBody.anthropic_beta.map(String)
+                : [];
+            if (sentBetaFlags.length > 0
+                && betaFlagQuarantine.isInvalidBetaFlagError(error.response.status, error.response.data)) {
+                betaFlagQuarantine.recordBetaFlagRejection(modelId, error.response.data, sentBetaFlags);
+            }
         }
         throw error;
     }
@@ -412,7 +431,21 @@ async function handleEmulatedSubpath(options) {
             isTimeout: error.isAxiosError && error.code === 'ECONNABORTED'
         });
         if (error.response) {
-            logger.error('AwsBedrockService', `SAP AI Core error response: ${error.response.status}`, error.response.data);
+            logger.error('AwsBedrockService', `SAP AI Core error response: ${error.response.status}`, undefined, { data: error.response.data });
+            if (debugRequestId) {
+                payloadLogger.savePayload(debugRequestId, '03_emulated_error_from_sap', {
+                    status: error.response.status,
+                    data: error.response.data
+                }, req, res);
+            }
+            // Converse payloads carry no anthropic_beta today — this hook is defense-in-depth should the transform ever forward beta flags.
+            const sentBetaFlags = Array.isArray(requestBody?.anthropic_beta)
+                ? requestBody.anthropic_beta.map(String)
+                : [];
+            if (sentBetaFlags.length > 0
+                && betaFlagQuarantine.isInvalidBetaFlagError(error.response.status, error.response.data)) {
+                betaFlagQuarantine.recordBetaFlagRejection(modelId, error.response.data, sentBetaFlags);
+            }
         }
         throw error;
     }
@@ -926,14 +959,32 @@ async function handleNativeStreamingRequest(options) {
             code: error.code,
             isTimeout: error.isAxiosError && error.code === 'ECONNABORTED'
         });
-        // Enhanced error logging for auth issues
-        if (error.response && error.response.status === 401) {
-            logger.error('AwsBedrockService', `Authentication failed (401) for request to: ${targetUrl}`);
-            logger.error('AwsBedrockService', 'Error details:', undefined, { data: error.response.data });
-            // Log auth details if DEBUG is enabled
-            if (process.env.DEBUG === 'true') {
-                logger.debug('AwsBedrockService', 'DEBUG - Auth token used:', { token: authToken });
-                logger.debug('AwsBedrockService', 'DEBUG - Response headers: ' + (0, logger_1.createHeadersPreview)(error.response.headers));
+        if (error.response) {
+            // responseType:'stream' delivers the error body as a Readable — drain it so
+            // SAP's actual error is loggable, persisted, and quarantine-matchable.
+            const upstreamErrorBody = await (0, upstreamErrorBody_1.readUpstreamErrorBody)(error.response);
+            logger.error('AwsBedrockService', `SAP AI Core error response: ${error.response.status}`, undefined, { data: upstreamErrorBody });
+            if (debugRequestId) {
+                payloadLogger.savePayload(debugRequestId, '03_native_streaming_error_from_sap', {
+                    status: error.response.status,
+                    data: upstreamErrorBody
+                }, req, res);
+            }
+            // Enhanced error logging for auth issues
+            if (error.response.status === 401) {
+                logger.error('AwsBedrockService', `Authentication failed (401) for request to: ${targetUrl}`);
+                // Log auth details if DEBUG is enabled
+                if (process.env.DEBUG === 'true') {
+                    logger.debug('AwsBedrockService', 'DEBUG - Auth token used:', { token: authToken });
+                    logger.debug('AwsBedrockService', 'DEBUG - Response headers: ' + (0, logger_1.createHeadersPreview)(error.response.headers));
+                }
+            }
+            const sentBetaFlags = Array.isArray(requestBody?.anthropic_beta)
+                ? requestBody.anthropic_beta.map(String)
+                : [];
+            if (sentBetaFlags.length > 0
+                && betaFlagQuarantine.isInvalidBetaFlagError(error.response.status, upstreamErrorBody)) {
+                betaFlagQuarantine.recordBetaFlagRejection(modelId, upstreamErrorBody, sentBetaFlags);
             }
         }
         if (!res.writableEnded) {
@@ -1300,18 +1351,39 @@ async function handleEmulatedStreamingRequest(options) {
             code: error.code,
             isTimeout: error.isAxiosError && error.code === 'ECONNABORTED'
         });
-        // Enhanced error logging for auth issues
-        if (error.response && error.response.status === 401) {
-            logger.error('AwsBedrockService', `Authentication failed (401) for request to: ${targetUrl}`);
-            logger.error('AwsBedrockService', 'Error details:', undefined, { data: error.response.data });
-            // Log auth details if DEBUG is enabled
-            if (process.env.DEBUG === 'true') {
-                logger.debug('AwsBedrockService', 'DEBUG - Auth token used:', { token: authToken });
-                logger.debug('AwsBedrockService', 'DEBUG - Response headers: ' + (0, logger_1.createHeadersPreview)(error.response.headers));
+        let upstreamErrorBody;
+        if (error.response) {
+            // responseType:'stream' delivers the error body as a Readable — drain it so
+            // SAP's actual error is loggable, persisted, and quarantine-matchable.
+            upstreamErrorBody = await (0, upstreamErrorBody_1.readUpstreamErrorBody)(error.response);
+            logger.error('AwsBedrockService', `SAP AI Core error response: ${error.response.status}`, undefined, { data: upstreamErrorBody });
+            if (debugRequestId) {
+                payloadLogger.savePayload(debugRequestId, '03_emulated_streaming_error_from_sap', {
+                    status: error.response.status,
+                    data: upstreamErrorBody
+                }, req, res);
+            }
+            // Enhanced error logging for auth issues
+            if (error.response.status === 401) {
+                logger.error('AwsBedrockService', `Authentication failed (401) for request to: ${targetUrl}`);
+                // Log auth details if DEBUG is enabled
+                if (process.env.DEBUG === 'true') {
+                    logger.debug('AwsBedrockService', 'DEBUG - Auth token used:', { token: authToken });
+                    logger.debug('AwsBedrockService', 'DEBUG - Response headers: ' + (0, logger_1.createHeadersPreview)(error.response.headers));
+                }
+            }
+            // Converse payloads carry no anthropic_beta today — this hook is defense-in-depth should the transform ever forward beta flags.
+            const sentBetaFlags = Array.isArray(requestBody?.anthropic_beta)
+                ? requestBody.anthropic_beta.map(String)
+                : [];
+            if (sentBetaFlags.length > 0
+                && betaFlagQuarantine.isInvalidBetaFlagError(error.response.status, upstreamErrorBody)) {
+                betaFlagQuarantine.recordBetaFlagRejection(modelId, upstreamErrorBody, sentBetaFlags);
             }
         }
         if (!res.writableEnded) {
-            const message = error.response?.data?.message || error.message || "Failed to establish stream";
+            const message = upstreamErrorBody?.error?.message || upstreamErrorBody?.message
+                || error.message || "Failed to establish stream";
             const status = error.response?.status || 500;
             const errToSend = new Error(message);
             errToSend.status = status;

package/bundled/gateway/services/gateway/src/services/betaFlagQuarantine.d.ts

@@ -0,0 +1,18 @@
+export declare function getQuarantinedFlags(modelId: string): string[];
+export declare function quarantineFlags(modelId: string, flags: string[]): void;
+export declare function clearQuarantine(): void;
+/**
+ * Whether an upstream error response is a beta-flag rejection.
+ */
+export declare function isInvalidBetaFlagError(status: number | undefined, errorData: any): boolean;
+/**
+ * Flags to quarantine: those explicitly named in the error body when present
+ * (first-party-style errors name them), else all flags that were sent
+ * (Bedrock's bare "invalid beta flag" names none).
+ */
+export declare function resolveRejectedFlags(errorData: any, sentFlags: string[]): string[];
+/**
+ * Record a beta-flag rejection so subsequent requests for this model omit
+ * the offending flags. Returns the quarantined flags.
+ */
+export declare function recordBetaFlagRejection(modelId: string, errorData: any, sentFlags: string[]): string[];