@uvl000/claude-trace 3.0.13-workflowexp.1

package/dist/intercept/reverse-proxy.js

@@ -0,0 +1,807 @@
+"use strict";
+/**
+ * @file Local HTTP reverse proxy for intercepting LLM API traffic from native binaries.
+ *
+ * Used when the target coding agent (Claude Code V2+, OpenCode, Codex CLI) is a native
+ * binary that cannot be launched with Node's `--require` interceptor hook. The proxy
+ * listens on 127.0.0.1, rewrites upstream URLs based on tool-specific routing rules,
+ * forwards requests transparently, and logs request/response pairs to JSONL/JSON/HTML.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReverseProxyServer = void 0;
+exports.supportsZstd = supportsZstd;
+exports.normalizeAcceptEncoding = normalizeAcceptEncoding;
+exports.resolveOutboundProxy = resolveOutboundProxy;
+exports.decodeResponseBody = decodeResponseBody;
+const https = __importStar(require("https"));
+const http = __importStar(require("http"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const zlib = __importStar(require("zlib"));
+const child_process_1 = require("child_process");
+const http_proxy_agent_1 = require("http-proxy-agent");
+const https_proxy_agent_1 = require("https-proxy-agent");
+const cli_common_1 = require("../cli/cli-common");
+const header_redaction_1 = require("./header-redaction");
+const html_generator_1 = require("../report/html-generator");
+const shared_conversation_processor_1 = require("../report/shared-conversation-processor");
+const openai_adapter_1 = require("../adapt/openai-adapter");
+const api_format_1 = require("../adapt/api-format");
+const codex_routing_1 = require("../routing/codex-routing");
+const proxy_routing_1 = require("../routing/proxy-routing");
+/** Whether this Node runtime can decode zstd-compressed API responses. */
+function supportsZstd() {
+    return typeof zlib.zstdDecompressSync === "function";
+}
+/** Remove zstd from Accept-Encoding when the current Node cannot decode it. */
+function normalizeAcceptEncoding(value, zstdSupported = supportsZstd()) {
+    if (value === undefined || zstdSupported)
+        return Array.isArray(value) ? value.join(", ") : value;
+    const encodings = (Array.isArray(value) ? value.join(",") : value)
+        .split(",")
+        .map((item) => item.trim())
+        .filter((item) => item && item.split(";", 1)[0].toLowerCase() !== "zstd");
+    return encodings.length > 0 ? encodings.join(", ") : undefined;
+}
+function noProxyMatches(targetUrl, noProxy) {
+    const hostname = targetUrl.hostname.toLowerCase();
+    const port = targetUrl.port || (targetUrl.protocol === "https:" ? "443" : "80");
+    for (const rawEntry of noProxy.split(",")) {
+        let entry = rawEntry.trim().toLowerCase();
+        if (!entry)
+            continue;
+        if (entry === "*")
+            return true;
+        let entryPort = "";
+        const portIndex = entry.lastIndexOf(":");
+        if (portIndex > 0 && /^\d+$/.test(entry.slice(portIndex + 1))) {
+            entryPort = entry.slice(portIndex + 1);
+            entry = entry.slice(0, portIndex);
+        }
+        if (entryPort && entryPort !== port)
+            continue;
+        entry = entry.replace(/^\*\./, ".");
+        if (entry.startsWith(".")) {
+            if (hostname === entry.slice(1) || hostname.endsWith(entry))
+                return true;
+        }
+        else if (hostname === entry || hostname.endsWith(`.${entry}`)) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Resolve the process-level outbound proxy for one upstream URL, respecting NO_PROXY. */
+function resolveOutboundProxy(targetUrl, environment = process.env) {
+    const parsed = new URL(targetUrl);
+    const noProxy = environment.NO_PROXY || environment.no_proxy || "";
+    if (noProxyMatches(parsed, noProxy))
+        return undefined;
+    if (parsed.protocol === "https:") {
+        return (environment.HTTPS_PROXY ||
+            environment.https_proxy ||
+            environment.HTTP_PROXY ||
+            environment.http_proxy ||
+            environment.ALL_PROXY ||
+            environment.all_proxy);
+    }
+    return (environment.HTTP_PROXY ||
+        environment.http_proxy ||
+        environment.ALL_PROXY ||
+        environment.all_proxy);
+}
+function createOutboundAgent(targetUrl) {
+    const proxyUrl = resolveOutboundProxy(targetUrl);
+    if (!proxyUrl)
+        return undefined;
+    return new URL(targetUrl).protocol === "https:"
+        ? new https_proxy_agent_1.HttpsProxyAgent(proxyUrl)
+        : new http_proxy_agent_1.HttpProxyAgent(proxyUrl);
+}
+/** Decode a buffered upstream response for structured JSON/SSE logging. */
+function decodeResponseBody(buffer, contentEncoding) {
+    try {
+        if (contentEncoding === "zstd") {
+            const decompress = zlib.zstdDecompressSync;
+            if (decompress)
+                return decompress(buffer).toString("utf-8");
+        }
+        if (contentEncoding === "gzip")
+            return zlib.gunzipSync(buffer).toString("utf-8");
+        if (contentEncoding === "br")
+            return zlib.brotliDecompressSync(buffer).toString("utf-8");
+        if (contentEncoding === "deflate")
+            return zlib.inflateSync(buffer).toString("utf-8");
+    }
+    catch {
+        // Preserve the raw body below so validation can reject an unparseable exchange.
+    }
+    return buffer.toString("utf-8");
+}
+/**
+ * Parses a base URL string into host, port, protocol, and path prefix.
+ *
+ * @param targetBaseUrl - Full base URL (e.g. `https://api.anthropic.com/v1`).
+ * @returns Parsed target suitable for constructing upstream requests.
+ */
+function parseTargetBaseUrl(targetBaseUrl) {
+    const parsed = new URL(targetBaseUrl || "https://api.anthropic.com");
+    // Strip trailing slash from pathname so path concatenation stays predictable.
+    const pathPrefix = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/$/, "");
+    return {
+        protocol: parsed.protocol,
+        targetHost: parsed.hostname,
+        targetPort: parsed.port
+            ? parseInt(parsed.port, 10)
+            : parsed.protocol === "https:" ? 443 : 80,
+        pathPrefix,
+    };
+}
+/**
+ * URL path segments that identify LLM API endpoints worth logging.
+ * Matched via substring check so query strings and provider prefixes still match.
+ */
+const LLM_API_PATHS = [
+    "/v1/messages",
+    "/messages",
+    "/v1/chat/completions",
+    "/chat/completions",
+    "/v1/responses",
+    "/responses",
+    "/responses/compact",
+    "/backend-api/codex/responses",
+];
+/**
+ * Returns true when the request path targets a known LLM API endpoint.
+ *
+ * @param urlPath - Raw request URL path (may include query string).
+ */
+function isLlmApiPath(urlPath) {
+    if (!urlPath) {
+        return false;
+    }
+    return LLM_API_PATHS.some((segment) => urlPath.includes(segment));
+}
+/**
+ * Resolves upstream target for OpenCode provider-prefixed paths (`/p/{providerId}/...`).
+ *
+ * When the path does not match the `/p/` convention or the provider is unknown,
+ * falls back to the default target and preserves the original path.
+ *
+ * @param reqUrl - Incoming request URL from the client.
+ * @param routes - Provider-id → upstream base URL map.
+ * @param fallback - Default upstream when routing does not apply.
+ * @returns Parsed upstream target plus the full path used for logging and forwarding.
+ */
+function resolveRouteTarget(reqUrl, routes, fallback) {
+    if (!reqUrl || !routes || Object.keys(routes).length === 0) {
+        const upstreamDisplayPath = `${fallback.pathPrefix}${reqUrl || "/"}`;
+        return { ...fallback, upstreamDisplayPath };
+    }
+    // OpenCode encodes provider selection in the path: /p/{providerId}/remainder
+    const match = reqUrl.match(/^\/p\/([^/]+)(\/.*)?$/);
+    if (!match) {
+        const upstreamDisplayPath = `${fallback.pathPrefix}${reqUrl}`;
+        return { ...fallback, upstreamDisplayPath };
+    }
+    const providerId = decodeURIComponent(match[1]);
+    const remainder = match[2] || "/";
+    const upstreamBaseUrl = routes[providerId];
+    if (!upstreamBaseUrl) {
+        const upstreamDisplayPath = `${fallback.pathPrefix}${reqUrl}`;
+        return { ...fallback, upstreamDisplayPath };
+    }
+    const target = parseTargetBaseUrl(upstreamBaseUrl);
+    const upstreamDisplayPath = `${target.pathPrefix}${remainder}`;
+    return {
+        ...target,
+        upstreamDisplayPath,
+    };
+}
+/**
+ * Returns the request `Content-Encoding` header normalized to lowercase.
+ *
+ * @param headers - Incoming HTTP headers from the client request.
+ */
+function getRequestContentEncoding(headers) {
+    return (headers["content-encoding"] || "").toLowerCase();
+}
+/**
+ * Decompresses a request body buffer when Codex (or other clients) send compressed JSON.
+ *
+ * Supports zstd (Codex ChatGPT OAuth), gzip, br, and deflate. Returns the original
+ * buffer when encoding is absent or decompression is unavailable/fails.
+ *
+ * @param buffer - Raw request body bytes from the client.
+ * @param contentEncoding - Lowercase `Content-Encoding` header value.
+ */
+function decompressRequestBodyBuffer(buffer, contentEncoding) {
+    if (!buffer.length || !contentEncoding) {
+        return buffer;
+    }
+    try {
+        if (contentEncoding === "zstd") {
+            const zstdDecompressSync = zlib.zstdDecompressSync;
+            if (zstdDecompressSync) {
+                return zstdDecompressSync(buffer);
+            }
+            return buffer;
+        }
+        if (contentEncoding === "gzip") {
+            return zlib.gunzipSync(buffer);
+        }
+        if (contentEncoding === "br") {
+            return zlib.brotliDecompressSync(buffer);
+        }
+        if (contentEncoding === "deflate") {
+            return zlib.inflateSync(buffer);
+        }
+    }
+    catch {
+        return buffer;
+    }
+    return buffer;
+}
+/**
+ * Decodes a request body for JSON parsing and logs.
+ *
+ * @param headers - Incoming HTTP headers (for `Content-Encoding`).
+ * @param buffer - Raw request body bytes.
+ * @returns UTF-8 text after decompression, or empty string when buffer is empty.
+ */
+function decodeRequestBodyText(headers, buffer) {
+    if (!buffer.length) {
+        return "";
+    }
+    const decoded = decompressRequestBodyBuffer(buffer, getRequestContentEncoding(headers));
+    return decoded.toString("utf-8");
+}
+/**
+ * Parses a request body for structured logging.
+ *
+ * Binary or compressed bodies are decompressed when possible; otherwise a short
+ * metadata placeholder is stored instead of corrupted binary text.
+ *
+ * @param headers - Incoming HTTP headers.
+ * @param buffer - Raw request body bytes.
+ */
+function parseRequestBodyForLog(headers, buffer) {
+    if (!buffer.length) {
+        return null;
+    }
+    const encoding = getRequestContentEncoding(headers);
+    const decoded = decompressRequestBodyBuffer(buffer, encoding);
+    if (encoding === "zstd" && decoded === buffer && !zlib.zstdDecompressSync) {
+        return { _note: "zstd compressed request body", byteLength: buffer.length };
+    }
+    const text = decoded.toString("utf-8");
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        if (encoding && decoded !== buffer) {
+            return text;
+        }
+        if (encoding) {
+            return { _note: `${encoding} compressed request body`, byteLength: buffer.length };
+        }
+        return text;
+    }
+}
+/**
+ * Extracts the `model` field from a JSON request body.
+ *
+ * @param requestBody - Raw request body string.
+ * @returns Model identifier or `null` when absent or unparseable.
+ */
+function extractModelFromBody(requestBody) {
+    if (!requestBody) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(requestBody);
+        return typeof parsed.model === "string" ? parsed.model : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolves upstream target based on the `model` field in the request body.
+ *
+ * Used by OpenCode when `modelRoutes` is configured. Returns `null` when the
+ * model cannot be extracted or is not registered in the route table.
+ *
+ * @param reqUrl - Incoming request URL (path may be normalized for the provider).
+ * @param requestBody - Raw JSON request body.
+ * @param modelRoutes - Model name → route metadata map.
+ * @param fallback - Default upstream when model routing fails.
+ * @returns Routed target with optional {@link ModelRoute} metadata, or `null`.
+ */
+function resolveModelTarget(reqUrl, requestBody, modelRoutes, fallback) {
+    const model = extractModelFromBody(requestBody);
+    if (!model) {
+        return null;
+    }
+    const modelRoute = (0, proxy_routing_1.resolveModelRoute)(model, modelRoutes);
+    if (!modelRoute) {
+        (0, cli_common_1.traceDebug)(`opencode-trace: unknown model "${model}", cannot route request`);
+        return null;
+    }
+    const target = parseTargetBaseUrl(modelRoute.upstreamBaseUrl);
+    const [rawPath, query = ""] = (reqUrl || "/").split("?");
+    // Adjust path for provider-specific API conventions (e.g. /messages → /v1/messages).
+    const urlPath = (0, proxy_routing_1.normalizeUpstreamPath)(rawPath, modelRoute, target.pathPrefix);
+    const upstreamDisplayPath = `${target.pathPrefix}${urlPath}${query ? `?${query}` : ""}`;
+    (0, cli_common_1.traceDebug)(`opencode-trace: ${reqUrl || "/"} | model=${model} → provider=${modelRoute.providerId} (${modelRoute.apiFormat}) → ${modelRoute.upstreamBaseUrl}`);
+    return {
+        ...target,
+        upstreamDisplayPath,
+        modelRoute,
+    };
+}
+/**
+ * HTTP reverse proxy that intercepts, logs, and forwards LLM API traffic.
+ *
+ * Supports three routing modes:
+ * - **Default**: single `targetBaseUrl` (Claude Code V2+).
+ * - **OpenCode**: `modelRoutes` and/or `routes` for multi-provider routing.
+ * - **Codex**: `providerRoutes` for path-based upstream selection.
+ */
+class ReverseProxyServer {
+    /**
+     * Creates a new reverse proxy instance and initializes empty log files.
+     *
+     * @param config - Proxy and logging configuration.
+     */
+    constructor(config = {}) {
+        /** Active Node HTTP server, or `null` after {@link stop}. */
+        this.server = null;
+        /** In-memory aggregate of all logged request/response pairs. */
+        this.pairs = [];
+        /** Guards against duplicate cleanup when {@link stop} is called more than once. */
+        this.stopped = false;
+        const target = parseTargetBaseUrl(config.targetBaseUrl);
+        this.targetProtocol = target.protocol;
+        this.targetHost = target.targetHost;
+        this.targetPort = target.targetPort;
+        this.pathPrefix = target.pathPrefix;
+        this.useHttps = target.protocol === "https:";
+        this.tool = config.tool;
+        this.routes = config.routes;
+        this.modelRoutes = config.modelRoutes;
+        this.providerRoutes = config.providerRoutes;
+        this.config = {
+            port: config.port || 0,
+            logDirectory: config.logDirectory || ".claude-trace",
+            logBaseName: config.logBaseName || "",
+            includeAllRequests: config.includeAllRequests || false,
+            openBrowser: config.openBrowser || false,
+            logSensitiveHeaders: config.logSensitiveHeaders || false,
+        };
+        if (!fs.existsSync(this.config.logDirectory)) {
+            fs.mkdirSync(this.config.logDirectory, { recursive: true });
+        }
+        const fileBaseName = this.config.logBaseName ||
+            `log-${new Date().toISOString().replace(/[:.]/g, "-").replace("T", "-").slice(0, -5)}`;
+        this.logFile = path.join(this.config.logDirectory, `${fileBaseName}.jsonl`);
+        this.jsonFile = path.join(this.config.logDirectory, `${fileBaseName}.json`);
+        this.htmlFile = path.join(this.config.logDirectory, `${fileBaseName}.html`);
+        fs.writeFileSync(this.logFile, "");
+        fs.writeFileSync(this.jsonFile, "[]");
+        this.htmlGenerator = new html_generator_1.HTMLGenerator();
+    }
+    /**
+     * Converts Node HTTP headers to a flat string map, optionally redacting secrets.
+     *
+     * Sensitive keys (authorization, cookies, etc.) are truncated to show only
+     * prefix/suffix unless `logSensitiveHeaders` is enabled.
+     *
+     * @param headers - Raw Node `IncomingHttpHeaders` from request or response.
+     * @returns Flat string map safe for JSON serialization.
+     */
+    processHeaders(headers) {
+        return (0, header_redaction_1.processHeaders)(headers, this.config.logSensitiveHeaders);
+    }
+    /**
+     * Parses a Server-Sent Events (SSE) response body into structured events.
+     *
+     * Handles both Anthropic-style (`event:` + `data:`) and OpenAI-style
+     * (type embedded in JSON data) event formats.
+     *
+     * @param body - Decompressed SSE text from the upstream response.
+     * @returns Ordered list of parsed events with ISO timestamps.
+     */
+    parseSSEEvents(body) {
+        const events = [];
+        const lines = body.split("\n");
+        let currentEvent = "";
+        for (const line of lines) {
+            if (line.startsWith("event: ")) {
+                currentEvent = line.substring(7).trim();
+            }
+            else if (line.startsWith("data: ")) {
+                const data = line.substring(6).trim();
+                if (data === "[DONE]")
+                    break;
+                try {
+                    const parsed = JSON.parse(data);
+                    // Fall back to JSON `type` field when no explicit `event:` line was seen.
+                    const eventType = currentEvent ||
+                        (typeof parsed === "object" && parsed !== null && "type" in parsed
+                            ? String(parsed.type)
+                            : "unknown");
+                    events.push({
+                        event: eventType,
+                        data: parsed,
+                        timestamp: new Date().toISOString(),
+                    });
+                }
+                catch {
+                    // Skip unparseable SSE data lines rather than failing the whole response log.
+                }
+            }
+        }
+        return events;
+    }
+    /** Appends a request/response pair to JSONL and rewrites the aggregate JSON file. */
+    writePairToLog(pair) {
+        try {
+            const jsonLine = JSON.stringify(pair) + "\n";
+            fs.appendFileSync(this.logFile, jsonLine);
+            fs.writeFileSync(this.jsonFile, JSON.stringify(this.pairs, null, 2));
+        }
+        catch (err) {
+            (0, cli_common_1.traceRuntimeError)(`Failed to write log: ${err}`, this.config.logDirectory);
+        }
+    }
+    /** Regenerates the self-contained HTML report from all logged pairs. */
+    async generateHTML() {
+        try {
+            await this.htmlGenerator.generateHTML(this.pairs, this.htmlFile, {
+                timestamp: new Date().toISOString().replace("T", " ").slice(0, -5),
+                includeAllRequests: this.config.includeAllRequests,
+                tool: this.tool,
+            });
+        }
+        catch (err) {
+            (0, cli_common_1.traceRuntimeError)(`Failed to generate HTML: ${err}`, this.config.logDirectory);
+        }
+    }
+    /**
+     * Starts the proxy server on 127.0.0.1.
+     *
+     * @returns Resolved listen port and base URL (`http://127.0.0.1:{port}`).
+     */
+    async start() {
+        return new Promise((resolve, reject) => {
+            const httpServer = http.createServer((req, res) => {
+                this.handleRequest(req, res);
+            });
+            this.server = httpServer;
+            httpServer.on("error", (err) => {
+                reject(err);
+            });
+            // Bind to loopback only — the proxy must not be reachable from the network.
+            httpServer.listen(this.config.port, "127.0.0.1", () => {
+                const address = httpServer.address();
+                if (address && typeof address === "object") {
+                    const port = address.port;
+                    const url = `http://127.0.0.1:${port}`;
+                    console.error(`Logs will be written to:`);
+                    console.error(`  JSONL: ${path.resolve(this.logFile)}`);
+                    console.error(`  JSON:  ${path.resolve(this.jsonFile)}`);
+                    console.error(`  HTML:  ${path.resolve(this.htmlFile)}`);
+                    resolve({ port, url });
+                }
+                else {
+                    reject(new Error("Failed to get server address"));
+                }
+            });
+        });
+    }
+    /**
+     * Handles a single incoming HTTP request: route, forward, stream response, and log.
+     *
+     * Routing priority:
+     * 1. Model-based (OpenCode `modelRoutes`) — fails with 502 if model is unresolvable.
+     * 2. Provider-prefixed (`/p/{id}/...`) or default target.
+     * 3. Codex path-based (`providerRoutes`) overrides when `tool === "codex"`.
+     *
+     * @param req - Incoming client request from the coding agent.
+     * @param res - Response object streamed back to the client.
+     */
+    handleRequest(req, res) {
+        const requestTimestamp = Date.now();
+        const requestBodyChunks = [];
+        req.on("data", (chunk) => {
+            requestBodyChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        });
+        req.on("end", () => {
+            const requestBodyBuffer = Buffer.concat(requestBodyChunks);
+            const requestBodyText = decodeRequestBodyText(req.headers, requestBodyBuffer);
+            const fallback = {
+                protocol: this.targetProtocol,
+                targetHost: this.targetHost,
+                targetPort: this.targetPort,
+                pathPrefix: this.pathPrefix,
+            };
+            const modelTarget = this.modelRoutes && Object.keys(this.modelRoutes).length > 0
+                ? resolveModelTarget(req.url, requestBodyText, this.modelRoutes, fallback)
+                : null;
+            // OpenCode requires every request to resolve to a known model when modelRoutes is set.
+            if (this.modelRoutes && Object.keys(this.modelRoutes).length > 0 && !modelTarget) {
+                res.writeHead(502);
+                res.end("opencode-trace: could not resolve model from request body");
+                return;
+            }
+            let routeTarget = modelTarget ??
+                resolveRouteTarget(req.url, this.routes, fallback);
+            // Codex uses path-prefix routing instead of model-based routing.
+            if (this.tool === "codex" && this.providerRoutes?.length) {
+                routeTarget = (0, codex_routing_1.resolveCodexRouteTarget)(req.url, this.providerRoutes, fallback);
+            }
+            const upstreamPath = routeTarget.upstreamDisplayPath;
+            const upstreamUrl = `${routeTarget.protocol}//${routeTarget.targetHost}${upstreamPath}`;
+            const useHttps = routeTarget.protocol === "https:";
+            const upstreamHeaders = {
+                ...req.headers,
+                // Override Host so upstream TLS SNI and virtual-host routing match the target.
+                host: routeTarget.targetHost,
+            };
+            const acceptEncodingKey = Object.keys(upstreamHeaders).find((key) => key.toLowerCase() === "accept-encoding");
+            if (acceptEncodingKey) {
+                const normalized = normalizeAcceptEncoding(upstreamHeaders[acceptEncodingKey]);
+                if (normalized)
+                    upstreamHeaders[acceptEncodingKey] = normalized;
+                else
+                    delete upstreamHeaders[acceptEncodingKey];
+            }
+            const options = {
+                hostname: routeTarget.targetHost,
+                port: routeTarget.targetPort,
+                path: upstreamPath,
+                method: req.method,
+                headers: upstreamHeaders,
+                agent: createOutboundAgent(upstreamUrl),
+            };
+            const requestModule = useHttps ? https : http;
+            const proxyReq = requestModule.request(options, (proxyRes) => {
+                const responseTimestamp = Date.now();
+                const responseChunks = [];
+                // Stream response to client immediately while buffering for logging.
+                res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
+                proxyRes.on("data", (chunk) => {
+                    responseChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+                    res.write(chunk);
+                });
+                proxyRes.on("end", () => {
+                    void this.logResponse(req, proxyRes, requestTimestamp, responseTimestamp, requestBodyBuffer, responseChunks, upstreamUrl, modelTarget !== null, modelTarget?.modelRoute);
+                    res.end();
+                });
+            });
+            proxyReq.on("error", (err) => {
+                (0, cli_common_1.traceRuntimeError)(`Proxy request error: ${err.message} (upstream: ${upstreamUrl})`, this.config.logDirectory);
+                res.writeHead(502);
+                res.end(`Proxy error: ${err.message}`);
+            });
+            if (requestBodyBuffer.length > 0) {
+                proxyReq.write(requestBodyBuffer);
+            }
+            proxyReq.end();
+        });
+    }
+    /**
+     * Parses, normalizes, and persists a completed request/response exchange.
+     *
+     * Decompresses gzip/brotli/deflate bodies before parsing. Converts OpenAI and
+     * Anthropic streaming responses into structured message objects when possible.
+     *
+     * @param req - Original client request (used for URL and method).
+     * @param proxyRes - Upstream response headers and status.
+     * @param requestTimestamp - Client request start time in milliseconds.
+     * @param responseTimestamp - Upstream response completion time in milliseconds.
+     * @param requestBody - Buffered raw request body bytes.
+     * @param responseChunks - Buffered raw response body chunks.
+     * @param upstreamUrl - Fully resolved upstream URL for logging.
+     * @param modelRouted - Whether model-based routing was used (forces logging).
+     * @param modelRoute - Resolved model route metadata, if any.
+     */
+    async logResponse(req, proxyRes, requestTimestamp, responseTimestamp, requestBody, responseChunks, upstreamUrl, modelRouted = false, modelRoute) {
+        const shouldLog = this.config.includeAllRequests || isLlmApiPath(req.url) || modelRouted;
+        if (!shouldLog) {
+            (0, cli_common_1.traceDebug)(`opencode-trace: skipped logging for ${req.method} ${req.url}`);
+            return;
+        }
+        try {
+            const parsedRequestBody = parseRequestBodyForLog(req.headers, requestBody);
+            const rawBuffer = Buffer.concat(responseChunks);
+            const contentEncoding = (proxyRes.headers["content-encoding"] || "").toLowerCase();
+            const responseBody = decodeResponseBody(rawBuffer, contentEncoding);
+            const apiFormat = this.resolveResponseApiFormat(req.url, upstreamUrl, modelRoute);
+            const parsedResponseBody = this.parseResponseBody(proxyRes, responseBody, apiFormat, parsedRequestBody);
+            const pair = {
+                request: {
+                    timestamp: requestTimestamp / 1000,
+                    method: req.method || "GET",
+                    url: upstreamUrl,
+                    headers: this.processHeaders(req.headers),
+                    body: parsedRequestBody,
+                },
+                response: {
+                    timestamp: responseTimestamp / 1000,
+                    status_code: proxyRes.statusCode || 0,
+                    headers: this.processHeaders(proxyRes.headers),
+                    api_format: apiFormat !== "unknown" ? apiFormat : undefined,
+                    ...parsedResponseBody,
+                },
+                logged_at: new Date().toISOString(),
+            };
+            this.pairs.push(pair);
+            this.writePairToLog(pair);
+            await this.generateHTML();
+        }
+        catch (err) {
+            (0, cli_common_1.traceRuntimeError)(`opencode-trace: failed to log response: ${err}`, this.config.logDirectory);
+        }
+    }
+    /**
+     * Determines the API format for response parsing.
+     *
+     * Priority: explicit model route → request path heuristics → upstream URL heuristics.
+     *
+     * @param reqUrl - Client-facing request URL path.
+     * @param upstreamUrl - Resolved upstream URL after routing.
+     * @param modelRoute - Optional model route with explicit `apiFormat`.
+     * @returns Best-effort API format for {@link parseResponseBody}.
+     */
+    resolveResponseApiFormat(reqUrl, upstreamUrl, modelRoute) {
+        if (modelRoute?.apiFormat && modelRoute.apiFormat !== "unknown") {
+            return modelRoute.apiFormat;
+        }
+        const fromReq = (0, proxy_routing_1.inferApiFormatFromPath)(reqUrl);
+        if (fromReq !== "unknown") {
+            return fromReq;
+        }
+        return (0, api_format_1.inferApiFormatFromUrl)(upstreamUrl);
+    }
+    /**
+     * Parses a response body into structured log fields based on content type and API format.
+     *
+     * For SSE streams, attempts to reconstruct complete message objects from event
+     * sequences; falls back to raw body text when parsing fails.
+     *
+     * @param proxyRes - Upstream response (for `content-type` header).
+     * @param responseBody - Decompressed response text.
+     * @param apiFormat - Resolved format from {@link resolveResponseApiFormat}.
+     * @param requestBody - Parsed request body (used to extract model name).
+     * @returns Subset of {@link RawPair.response} fields (`body`, `body_raw`, `events`).
+     */
+    parseResponseBody(proxyRes, responseBody, apiFormat, requestBody) {
+        const contentType = proxyRes.headers["content-type"] || "";
+        const model = requestBody && typeof requestBody === "object" && "model" in requestBody
+            ? String(requestBody.model)
+            : "unknown";
+        try {
+            if (contentType.includes("application/json")) {
+                const parsed = JSON.parse(responseBody);
+                if (parsed && typeof parsed === "object" && "error" in parsed) {
+                    return { body: parsed };
+                }
+                if (apiFormat === "openai" || ("choices" in parsed)) {
+                    return { body: (0, openai_adapter_1.parseOpenAIChatCompletionBody)(parsed, model) };
+                }
+                if (apiFormat === "openai-responses" || ("output" in parsed)) {
+                    return { body: (0, openai_adapter_1.parseOpenAIResponsesBody)(parsed, model) };
+                }
+                return { body: parsed };
+            }
+            if (contentType.includes("text/event-stream")) {
+                const events = this.parseSSEEvents(responseBody);
+                if (apiFormat === "openai") {
+                    try {
+                        const completion = (0, openai_adapter_1.buildOpenAIChatCompletionFromSSE)(responseBody, model);
+                        return { body: (0, openai_adapter_1.parseOpenAIChatCompletionBody)(completion, model), events };
+                    }
+                    catch {
+                        return { body_raw: responseBody, events };
+                    }
+                }
+                if (apiFormat === "openai-responses") {
+                    try {
+                        const responsesBody = (0, openai_adapter_1.buildOpenAIResponsesFromSSE)(responseBody, model);
+                        return { body: (0, openai_adapter_1.parseOpenAIResponsesBody)(responsesBody, model), events };
+                    }
+                    catch {
+                        return { body_raw: responseBody, events };
+                    }
+                }
+                // Default SSE path: Anthropic Messages API streaming format.
+                const processor = new shared_conversation_processor_1.SharedConversationProcessor();
+                try {
+                    const message = processor.parseStreamingResponse(responseBody);
+                    return { body: message, events };
+                }
+                catch {
+                    return { body_raw: responseBody, events };
+                }
+            }
+            return { body_raw: responseBody };
+        }
+        catch {
+            return { body_raw: responseBody };
+        }
+    }
+    /**
+     * Stops the proxy server, prints summary stats, and optionally opens the HTML report.
+     */
+    stop() {
+        if (this.stopped) {
+            return;
+        }
+        this.stopped = true;
+        if (this.server) {
+            this.server.close();
+            this.server = null;
+        }
+        console.error(`Logged ${this.pairs.length} request/response pairs`);
+        if (this.config.openBrowser && fs.existsSync(this.htmlFile)) {
+            this.openHtmlInBrowser(this.htmlFile);
+        }
+    }
+    /** Returns the absolute path to the generated HTML report file. */
+    getHtmlFile() {
+        return this.htmlFile;
+    }
+    /** Opens an HTML file in the platform default browser (Windows/macOS/Linux). */
+    openHtmlInBrowser(htmlFile) {
+        try {
+            if (process.platform === "win32") {
+                (0, child_process_1.spawn)("cmd", ["/c", "start", "", htmlFile], { detached: true, stdio: "ignore" }).unref();
+            }
+            else {
+                const cmd = process.platform === "darwin" ? "open" : "xdg-open";
+                (0, child_process_1.spawn)(cmd, [htmlFile], { detached: true, stdio: "ignore" }).unref();
+            }
+            console.error(`Opening ${htmlFile} in browser`);
+        }
+        catch (err) {
+            console.error(`Failed to open browser: ${err}`);
+        }
+    }
+}
+exports.ReverseProxyServer = ReverseProxyServer;
+//# sourceMappingURL=reverse-proxy.js.map