anypick 1.0.0

package/dist/providers/grok-proxy/server.js

@@ -0,0 +1,595 @@
+import { assertLoopbackHost } from "../../utils/network.js";
+import { GROK_MODELS } from "../../catalog/providers.js";
+import { sanitizeInferenceToolSchemas } from "../protocol/json-schema.js";
+import { anthropicToOpenAI, openAIToAnthropic } from "../protocol/anthropic-convert.js";
+import { pipeOpenAIStreamToAnthropic } from "../protocol/anthropic-stream.js";
+import { estimateAnthropicInputTokens } from "../protocol/token-estimate.js";
+import { HOP_BY_HOP, normalizeLocalApiUrl, readBody, requireProxyAuth } from "../proxy-shared.js";
+import { CooldownRegistry, classifyUpstreamFailure } from "../upstream-policy.js";
+import { ensureAccessToken } from "./auth.js";
+import { createServer } from "node:http";
+//#region src/providers/grok-proxy/server.ts
+/**
+* Dual-protocol reverse proxy for Grok CLI OIDC sessions.
+*
+* Compatibility (same base URL for both clients):
+*   • OpenAI   — Codex / OpenAI SDK  →  /v1/chat/completions, /v1/responses, /v1/models
+*   • Anthropic — Claude Code         →  /v1/messages
+*
+* Upstream cli-chat-proxy.grok.com already speaks both shapes; we inject the
+* CLI OIDC Bearer and forward. Model IDs and /v1/models are deliberately
+* passed through without a local catalog, so newly released models work
+* without a AnyPick update. Optional translate mode
+* (GROK_PROXY_TRANSLATE_ANTHROPIC=1) rewrites Anthropic → chat/completions
+* for OpenAI-only upstreams.
+*
+* Clients point BASE_URL here with any dummy API key / auth token.
+*/
+var DEFAULT_UPSTREAM = "https://cli-chat-proxy.grok.com";
+var DEFAULT_CLIENT_VERSION = "0.2.101";
+var COMPAT_LABEL = "OpenAI + Anthropic API";
+function createGrokProxyServer(opts) {
+	assertLoopbackHost(opts.host);
+	const upstream = (opts.upstream ?? DEFAULT_UPSTREAM).replace(/\/$/, "");
+	const clientVersion = opts.clientVersion ?? DEFAULT_CLIENT_VERSION;
+	const translateAnthropic = opts.translateAnthropic ?? process.env.GROK_PROXY_TRANSLATE_ANTHROPIC === "1";
+	const proxyToken = opts.token ?? process.env.ANYPICK_PROXY_TOKEN ?? "";
+	const log = opts.log ?? (opts.quiet ? () => {} : (line) => process.stderr.write(`${line}\n`));
+	let cached;
+	const cooldowns = new CooldownRegistry();
+	const server = createServer((req, res) => {
+		handle(req, res);
+	});
+	async function handle(req, res) {
+		const url = normalizeLocalApiUrl(req.url ?? "/");
+		const path = url.split("?")[0] ?? "/";
+		const method = req.method ?? "GET";
+		if (!checkCors(req, res)) return;
+		if (method === "OPTIONS") {
+			res.writeHead(204);
+			res.end();
+			return;
+		}
+		if ((method === "GET" || method === "HEAD") && (path === "/" || path === "/health")) {
+			json(res, 200, {
+				ok: true,
+				service: "anypick-grok-proxy",
+				compatibility: COMPAT_LABEL,
+				instanceId: process.env.ANYPICK_INSTANCE_ID ?? null,
+				clients: {
+					codex: "OPENAI_BASE_URL → /v1/chat/completions",
+					claude: "ANTHROPIC_BASE_URL → /v1/messages"
+				},
+				endpoints: {
+					openai: [
+						"/v1/chat/completions",
+						"/v1/responses",
+						"/v1/models"
+					],
+					anthropic: ["/v1/messages", "/v1/messages/count_tokens"]
+				},
+				translateAnthropic,
+				upstream
+			});
+			return;
+		}
+		if (!path.startsWith("/v1/") && path !== "/v1") {
+			json(res, 404, { error: {
+				message: `Not found: ${path}. Codex/OpenAI: /v1/chat/completions · Claude: /v1/messages · models: /v1/models`,
+				type: "not_found_error"
+			} });
+			return;
+		}
+		if (!requireProxyAuth(req, res, proxyToken)) return;
+		if (method === "POST" && path === "/v1/messages/count_tokens") {
+			await handleCountTokens(req, res);
+			return;
+		}
+		if (translateAnthropic && method === "POST" && path === "/v1/messages") {
+			await handleAnthropicTranslated(req, res);
+			return;
+		}
+		if ((method === "GET" || method === "HEAD") && path === "/v1/models") {
+			await handleListModels(req, res, url, method);
+			return;
+		}
+		log(`${method} ${path}`);
+		await proxyPassThrough(req, res, url, method);
+	}
+	async function handleCountTokens(req, res) {
+		try {
+			let body;
+			try {
+				body = JSON.parse((await readBody(req)).toString("utf8") || "{}");
+			} catch {
+				json(res, 400, {
+					type: "error",
+					error: {
+						type: "invalid_request_error",
+						message: "Invalid JSON body"
+					}
+				});
+				return;
+			}
+			const inputTokens = estimateAnthropicInputTokens(body);
+			const model = typeof body.model === "string" && body.model.trim() ? body.model.trim() : "?";
+			log(`POST /v1/messages/count_tokens → ${inputTokens} (local · ${model})`);
+			json(res, 200, { input_tokens: inputTokens });
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			log(`  ✗ count_tokens ${message}`);
+			if (!res.headersSent) json(res, 502, {
+				type: "error",
+				error: {
+					type: "proxy_error",
+					message
+				}
+			});
+		}
+	}
+	/**
+	* Prefer the live upstream catalog. If it is missing or empty, fall back to
+	* the static GROK_MODELS map so Proxy Hub can still publish routes.
+	*/
+	async function handleListModels(req, res, url, method) {
+		try {
+			const { token, session } = await ensureAccessToken(opts.authPath, cached);
+			cached = session;
+			const target = `${upstream}${url}`;
+			let upstreamRes = await fetchGrok(target, {
+				method,
+				headers: buildUpstreamHeaders(req, token, clientVersion),
+				signal: AbortSignal.timeout(12e3),
+				redirect: "manual"
+			}, `${method}:${url}`);
+			if (upstreamRes.status === 401 && cached?.refreshToken) {
+				log("  → 401 on /v1/models, refreshing OIDC token…");
+				const refreshed = await ensureAccessToken(opts.authPath);
+				cached = refreshed.session;
+				upstreamRes = await fetchGrok(target, {
+					method,
+					headers: buildUpstreamHeaders(req, refreshed.token, clientVersion),
+					signal: AbortSignal.timeout(12e3),
+					redirect: "manual"
+				}, `${method}:${url}`);
+			}
+			if (upstreamRes.ok) {
+				const models = modelIdsFromCatalogBody(await upstreamRes.text());
+				if (models.length > 0) {
+					log(`  list models ← ${models.length} (upstream)`);
+					json(res, 200, {
+						object: "list",
+						data: models.map((id) => ({
+							id,
+							object: "model",
+							owned_by: "xai"
+						}))
+					});
+					return;
+				}
+				log("  list models ← empty upstream; using static GROK_MODELS");
+			} else log(`  list models ← ${upstreamRes.status}; using static GROK_MODELS`);
+		} catch (err) {
+			log(`  list models ✗ ${err instanceof Error ? err.message : String(err)}; using static GROK_MODELS`);
+		}
+		const models = staticGrokModelIds();
+		log(`  list models ← ${models.length} (fallback)`);
+		json(res, 200, {
+			object: "list",
+			data: models.map((id) => ({
+				id,
+				object: "model",
+				owned_by: "xai"
+			}))
+		});
+	}
+	/**
+	* Native pass-through (default): inject OIDC Bearer, forward with only the
+	* tool-schema hygiene needed for strict xAI validation.
+	*/
+	async function proxyPassThrough(req, res, url, method) {
+		try {
+			const { token, session } = await ensureAccessToken(opts.authPath, cached);
+			cached = session;
+			const target = `${upstream}${url}`;
+			const rawBody = method === "GET" || method === "HEAD" || method === "OPTIONS" ? void 0 : await readBody(req);
+			const body = rawBody ? sanitizePassThroughBody(pathOf(url), rawBody) : void 0;
+			const headers = buildUpstreamHeaders(req, token, clientVersion, body?.byteLength);
+			if (body) headers["content-length"] = String(body.byteLength);
+			const upstreamRes = await fetchGrok(target, {
+				method,
+				headers,
+				body: body && body.length > 0 ? new Uint8Array(body) : void 0,
+				signal: AbortSignal.timeout(6e5),
+				redirect: "manual"
+			}, `${method}:${url}`);
+			if (upstreamRes.status === 401 && cached?.refreshToken) {
+				log("  → 401, refreshing OIDC token…");
+				const refreshed = await ensureAccessToken(opts.authPath);
+				cached = refreshed.session;
+				const retryHeaders = buildUpstreamHeaders(req, refreshed.token, clientVersion, body?.byteLength);
+				if (body) retryHeaders["content-length"] = String(body.byteLength);
+				await pipeResponse(await fetchGrok(target, {
+					method,
+					headers: retryHeaders,
+					body: body && body.length > 0 ? new Uint8Array(body) : void 0,
+					signal: AbortSignal.timeout(6e5),
+					redirect: "manual"
+				}, `${method}:${url}`), res, log);
+				return;
+			}
+			await pipeResponse(upstreamRes, res, log);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			log(`  ✗ ${msg}`);
+			if (!res.headersSent) json(res, 502, { error: {
+				message: msg,
+				type: "proxy_error"
+			} });
+			else res.end();
+		}
+	}
+	/**
+	* Translate Anthropic Messages → OpenAI chat/completions (optional mode).
+	*/
+	async function handleAnthropicTranslated(req, res) {
+		log("POST /v1/messages (translate → chat/completions)");
+		try {
+			const raw = await readBody(req);
+			let body;
+			try {
+				body = JSON.parse(raw.toString("utf8") || "{}");
+			} catch {
+				json(res, 400, {
+					type: "error",
+					error: {
+						type: "invalid_request_error",
+						message: "Invalid JSON body"
+					}
+				});
+				return;
+			}
+			if (!body.model) {
+				json(res, 400, {
+					type: "error",
+					error: {
+						type: "invalid_request_error",
+						message: "model is required"
+					}
+				});
+				return;
+			}
+			if (body.max_tokens == null) body.max_tokens = 4096;
+			const openaiBody = anthropicToOpenAI(body);
+			const stream = Boolean(body.stream);
+			openaiBody.stream = stream;
+			const payload = Buffer.from(JSON.stringify(openaiBody), "utf8");
+			const { token, session } = await ensureAccessToken(opts.authPath, cached);
+			cached = session;
+			const target = `${upstream}/v1/chat/completions`;
+			let upstreamRes = await fetchUpstream(target, token, payload);
+			if (upstreamRes.status === 401 && cached?.refreshToken) {
+				log("  → 401, refreshing OIDC token…");
+				const refreshed = await ensureAccessToken(opts.authPath);
+				cached = refreshed.session;
+				upstreamRes = await fetchUpstream(target, refreshed.token, payload);
+			}
+			log(`  ← ${upstreamRes.status} (via chat/completions)`);
+			if (stream) {
+				if (!upstreamRes.ok) {
+					const errText = await upstreamRes.text();
+					let message = errText;
+					try {
+						message = JSON.parse(errText).error?.message ?? errText;
+					} catch {}
+					res.writeHead(upstreamRes.status, { "content-type": "application/json; charset=utf-8" });
+					res.end(JSON.stringify({
+						type: "error",
+						error: {
+							type: "api_error",
+							message
+						}
+					}));
+					return;
+				}
+				res.writeHead(200, {
+					"content-type": "text/event-stream; charset=utf-8",
+					"cache-control": "no-cache",
+					connection: "keep-alive",
+					"x-accel-buffering": "no"
+				});
+				await pipeOpenAIStreamToAnthropic(upstreamRes, (chunk) => {
+					res.write(chunk);
+				}, body.model);
+				res.end();
+				return;
+			}
+			const text = await upstreamRes.text();
+			let parsed;
+			try {
+				parsed = JSON.parse(text);
+			} catch {
+				json(res, 502, {
+					type: "error",
+					error: {
+						type: "api_error",
+						message: `Upstream returned non-JSON: ${text.slice(0, 200)}`
+					}
+				});
+				return;
+			}
+			const converted = openAIToAnthropic(parsed, body.model);
+			if ("type" in converted && converted.type === "error") {
+				json(res, upstreamRes.status >= 400 ? upstreamRes.status : 502, converted);
+				return;
+			}
+			json(res, upstreamRes.ok ? 200 : upstreamRes.status, converted);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			log(`  ✗ anthropic ${msg}`);
+			if (!res.headersSent) json(res, 502, {
+				type: "error",
+				error: {
+					type: "proxy_error",
+					message: msg
+				}
+			});
+			else res.end();
+		}
+	}
+	async function fetchUpstream(target, token, payload) {
+		return fetchGrok(target, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${token}`,
+				"content-type": "application/json",
+				accept: "application/json",
+				"x-grok-client-version": clientVersion,
+				"x-grok-client-identifier": "anypick-grok-proxy",
+				"user-agent": `anypick-grok-proxy/${clientVersion}`
+			},
+			body: new Uint8Array(payload),
+			signal: AbortSignal.timeout(6e5),
+			redirect: "manual"
+		}, `POST:${target}`);
+	}
+	async function fetchGrok(target, init, route) {
+		const isInference = init.method === "POST";
+		const key = `grok:${route}`;
+		if (isInference) {
+			const remaining = cooldowns.remainingMs(key);
+			if (remaining > 0) return new Response(JSON.stringify({ error: {
+				type: "rate_limit_error",
+				message: "Grok route is cooling down."
+			} }), {
+				status: 429,
+				headers: {
+					"content-type": "application/json",
+					"retry-after": String(Math.ceil(remaining / 1e3))
+				}
+			});
+		}
+		const response = await fetch(target, init);
+		if (!isInference || response.status !== 429) return response;
+		const body = await response.arrayBuffer();
+		const failure = classifyUpstreamFailure(response.status, response.headers, new TextDecoder().decode(body));
+		if (failure.retryAfterMs) cooldowns.set(key, failure.retryAfterMs);
+		return new Response(body, {
+			status: response.status,
+			headers: response.headers
+		});
+	}
+	return server;
+}
+function buildUpstreamHeaders(req, token, clientVersion, contentLength) {
+	const headers = {
+		authorization: `Bearer ${token}`,
+		"x-grok-client-version": clientVersion,
+		"x-grok-client-identifier": "anypick-grok-proxy",
+		"user-agent": `anypick-grok-proxy/${clientVersion}`,
+		accept: req.headers.accept ?? "application/json"
+	};
+	if (req.headers["content-type"]) headers["content-type"] = String(req.headers["content-type"]);
+	else if (contentLength && contentLength > 0) headers["content-type"] = "application/json";
+	if (req.headers["anthropic-version"]) headers["anthropic-version"] = String(req.headers["anthropic-version"]);
+	if (req.headers["anthropic-beta"]) headers["anthropic-beta"] = String(req.headers["anthropic-beta"]);
+	for (const [k, v] of Object.entries(req.headers)) {
+		if (!v || HOP_BY_HOP.has(k.toLowerCase())) continue;
+		if (k.toLowerCase() === "authorization") continue;
+		if (k.toLowerCase().startsWith("x-grok-")) continue;
+		if (k.toLowerCase() === "x-api-key") continue;
+		if (k.toLowerCase() === "anthropic-version") continue;
+		if (k.toLowerCase() === "anthropic-beta") continue;
+		if (Array.isArray(v)) headers[k] = v.join(", ");
+		else headers[k] = v;
+	}
+	return headers;
+}
+async function pipeResponse(upstreamRes, res, log) {
+	if (upstreamRes.status >= 400) {
+		const errText = await upstreamRes.text();
+		const snippet = errText.replaceAll(/[\r\n\t]+/gu, " ").slice(0, 400);
+		log(`  ← ${upstreamRes.status} ${snippet}`);
+		const outHeaders = {};
+		upstreamRes.headers.forEach((value, key) => {
+			if (HOP_BY_HOP.has(key.toLowerCase()) || key.toLowerCase() === "content-encoding") return;
+			if (key.toLowerCase() === "content-length") return;
+			outHeaders[key] = value;
+		});
+		const payload = Buffer.from(errText, "utf8");
+		outHeaders["content-length"] = String(payload.byteLength);
+		res.writeHead(upstreamRes.status, outHeaders);
+		res.end(payload);
+		return;
+	}
+	log(`  ← ${upstreamRes.status}`);
+	const outHeaders = {};
+	upstreamRes.headers.forEach((value, key) => {
+		if (HOP_BY_HOP.has(key.toLowerCase())) return;
+		if (key.toLowerCase() === "content-encoding") return;
+		outHeaders[key] = value;
+	});
+	res.writeHead(upstreamRes.status, outHeaders);
+	if (!upstreamRes.body) {
+		res.end();
+		return;
+	}
+	let bytes = 0;
+	let clientGone = false;
+	const onClose = () => {
+		clientGone = true;
+		upstreamRes.body?.cancel().catch(() => {});
+	};
+	res.once("close", onClose);
+	const reader = upstreamRes.body.getReader();
+	try {
+		while (!clientGone && !res.writableEnded && !res.destroyed) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value?.byteLength) continue;
+			bytes += value.byteLength;
+			if (!res.write(Buffer.from(value))) {
+				if (!await waitForDrain(res)) {
+					clientGone = true;
+					reader.cancel().catch(() => {});
+					break;
+				}
+			}
+		}
+		if (clientGone) log(`  ✗ client disconnected after ${bytes} bytes`);
+	} catch (err) {
+		if (!clientGone && !isBenignStreamError(err)) log(`  ✗ stream interrupted after ${bytes} bytes: ${err instanceof Error ? err.message : String(err)}`);
+	} finally {
+		res.removeListener("close", onClose);
+		try {
+			reader.releaseLock();
+		} catch {}
+		if (!res.writableEnded) res.end();
+	}
+}
+function waitForDrain(res) {
+	if (res.writableEnded || res.destroyed || res.socket?.destroyed) return Promise.resolve(false);
+	if (!res.writableNeedDrain) return Promise.resolve(true);
+	return new Promise((resolve) => {
+		const done = (ok) => {
+			res.removeListener("drain", onDrain);
+			res.removeListener("close", onFail);
+			res.removeListener("error", onFail);
+			resolve(ok);
+		};
+		const onDrain = () => done(true);
+		const onFail = () => done(false);
+		res.once("drain", onDrain);
+		res.once("close", onFail);
+		res.once("error", onFail);
+	});
+}
+function isBenignStreamError(err) {
+	if (!err || typeof err !== "object") return false;
+	const value = err;
+	if (value.name === "AbortError" || value.code === "ABORT_ERR") return true;
+	if (value.code === "ERR_STREAM_PREMATURE_CLOSE") return true;
+	return typeof value.message === "string" && /aborted|premature close|ECONNRESET|EPIPE|socket hang up/i.test(value.message);
+}
+function checkCors(req, res) {
+	const origin = req.headers.origin;
+	if (origin) try {
+		const parsed = new URL(origin);
+		if (!((parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]") && (parsed.protocol === "http:" || parsed.protocol === "https:"))) {
+			json(res, 403, { error: {
+				type: "forbidden_origin",
+				message: "Only loopback browser origins are allowed."
+			} });
+			return false;
+		}
+		res.setHeader("access-control-allow-origin", origin);
+		res.setHeader("vary", "Origin");
+	} catch {
+		json(res, 403, { error: {
+			type: "forbidden_origin",
+			message: "Invalid browser origin."
+		} });
+		return false;
+	}
+	res.setHeader("access-control-allow-methods", "GET,POST,OPTIONS,HEAD");
+	res.setHeader("access-control-allow-headers", [
+		"authorization",
+		"content-type",
+		"x-api-key",
+		"openai-beta",
+		"openai-organization",
+		"anthropic-version",
+		"anthropic-beta"
+	].join(","));
+	return true;
+}
+/** Canonical ids from the static map (unique, stable order). */
+function staticGrokModelIds() {
+	return [...new Set(Object.values(GROK_MODELS).filter((id) => id.trim().length > 0))];
+}
+/** Accept OpenAI `{ data:[{id}] }`, `{ models:[] }`, or a bare string array. */
+function modelIdsFromCatalogBody(text) {
+	let value;
+	try {
+		value = JSON.parse(text);
+	} catch {
+		return [];
+	}
+	if (Array.isArray(value)) return value.map((entry) => typeof entry === "string" ? entry : entry && typeof entry === "object" ? entry.id : void 0).filter((id) => typeof id === "string" && id.trim().length > 0);
+	if (!value || typeof value !== "object") return [];
+	const record = value;
+	const list = Array.isArray(record.data) ? record.data : Array.isArray(record.models) ? record.models : null;
+	if (!list) return [];
+	return list.map((entry) => typeof entry === "string" ? entry : entry && typeof entry === "object" ? entry.id : void 0).filter((id) => typeof id === "string" && id.trim().length > 0);
+}
+function json(res, status, body) {
+	const raw = JSON.stringify(body);
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"content-length": Buffer.byteLength(raw)
+	});
+	res.end(raw);
+}
+function pathOf(url) {
+	return url.split("?")[0] ?? url;
+}
+/**
+* Claude Code (and some MCP tool packs) put `"required": null` on tool
+* input_schema. xAI schema validation rejects that; strip null keywords
+* before the body leaves the loopback proxy.
+*/
+function sanitizePassThroughBody(path, body) {
+	if (body.length === 0) return body;
+	let parsed;
+	try {
+		parsed = JSON.parse(body.toString("utf8"));
+	} catch {
+		return body;
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return body;
+	const { body: next, changed } = sanitizeInferenceToolSchemas(path, parsed);
+	return changed ? Buffer.from(JSON.stringify(next), "utf8") : body;
+}
+function listenGrokProxy(opts) {
+	const server = createGrokProxyServer(opts);
+	return new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(opts.port, opts.host, () => {
+			const addr = server.address();
+			if (!addr || typeof addr === "string") {
+				reject(/* @__PURE__ */ new Error("Failed to bind Grok proxy"));
+				return;
+			}
+			const endpoint = `http://${opts.host}:${addr.port}`;
+			resolve({
+				server,
+				endpoint,
+				port: addr.port
+			});
+		});
+	});
+}
+//#endregion
+export { createGrokProxyServer, listenGrokProxy, modelIdsFromCatalogBody, staticGrokModelIds };
+
+//# sourceMappingURL=server.js.map