ashlr-plugin 1.36.4 → 1.37.1

package/servers/_companions.ts

@@ -0,0 +1,258 @@
+/**
+ * Ashlr companion detection for `ashlr doctor`: asks each installed companion
+ * for `--ashlr-handshake --json` (docs/ashlr-handshake.md) and reports name,
+ * version, capabilities and readiness. Same rules as `stack doctor --ecosystem`:
+ * a short timeout per probe, an environment with no secrets, and a missing or
+ * too-old companion is reported, never a failure.
+ */
+
+import { spawn } from "child_process";
+
+export interface Companion {
+	name: string;
+	command: string;
+	repo: string;
+}
+
+export const COMPANIONS: Companion[] = [
+	{ name: "phantom", command: "phm", repo: "ashlrai/phantom" },
+	{
+		name: "phantom-secrets",
+		command: "phantom",
+		repo: "ashlrai/phantom-secrets",
+	},
+	{ name: "locus", command: "locus", repo: "ashlrai/locus" },
+	{ name: "lexicon", command: "lexicon", repo: "ashlrai/lexicon" },
+	{ name: "ashlr-md", command: "mdopener-mcp", repo: "ashlrai/ashlr-md" },
+	{ name: "ashlr-stack", command: "stack", repo: "ashlrai/ashlr-stack" },
+];
+
+export const COMPANION_TIMEOUT_MS = 2000;
+
+export type CompanionRun =
+	| { kind: "ran"; code: number | null; stdout: string }
+	| { kind: "missing" }
+	| { kind: "timeout" };
+
+export type CompanionRunner = (
+	command: string,
+	timeoutMs: number,
+) => Promise<CompanionRun>;
+
+export interface CompanionResult {
+	name: string;
+	command: string;
+	/**
+	 * ready: answered v1 with health ok; degraded: answered, health not ok;
+	 * outdated: ran but printed no JSON (too old for the handshake);
+	 * unknown: timed out, or printed JSON that is not a v1 handshake;
+	 * missing: not installed.
+	 */
+	state: "ready" | "degraded" | "outdated" | "unknown" | "missing";
+	version: string | null;
+	capabilities: string[];
+	/** The handshake's health.status as reported, or null when there was no v1 answer. */
+	health: string | null;
+	fix: string | null;
+	/** Capability-gated commands to run next (same rules as `stack doctor --ecosystem`). */
+	next_steps: string[];
+}
+
+/** Handshake capability a companion advertises when `<command> doctor --fix` exists. */
+export const DOCTOR_FIX_CAPABILITY = "doctor-fix";
+/** Kept for callers of #218. */
+export const LOCUS_DOCTOR_FIX_CAPABILITY = DOCTOR_FIX_CAPABILITY;
+
+/**
+ * Companions whose `doctor --fix` is a safe dry run by default (writes
+ * nothing; `--apply` makes the repairs). Keyed by companion name, valued by
+ * the command the user runs.
+ */
+export const DOCTOR_FIX_COMMANDS: Record<string, string> = {
+	locus: "locus",
+	lexicon: "lexicon",
+	"ashlr-md": "mdopener-mcp",
+};
+
+export const doctorFixStep = (command: string): string =>
+	`${command} doctor --fix   # preview safe repairs (writes nothing); add --apply to make them`;
+
+export const LOCUS_DOCTOR_FIX_STEP = doctorFixStep("locus");
+export const LEXICON_DOCTOR_FIX_STEP = doctorFixStep("lexicon");
+export const MDOPENER_DOCTOR_FIX_STEP = doctorFixStep("mdopener-mcp");
+
+/**
+ * Next steps for one companion. Keyed on what the companion itself
+ * advertises, never on its version: `<command> doctor --fix` only when the
+ * companion is one of DOCTOR_FIX_COMMANDS, answered, its health is not ok,
+ * and it lists `doctor-fix`.
+ */
+export function companionNextSteps(
+	r: Pick<CompanionResult, "name" | "state" | "health" | "capabilities">,
+): string[] {
+	const command = new Map(Object.entries(DOCTOR_FIX_COMMANDS)).get(r.name);
+	if (
+		command !== undefined &&
+		r.state === "degraded" &&
+		r.health !== null &&
+		r.health !== "ok" &&
+		r.capabilities.includes(DOCTOR_FIX_CAPABILITY)
+	)
+		return [doctorFixStep(command)];
+	return [];
+}
+
+/** PATH, HOME and locale only: no token in this process reaches a companion. */
+export function companionEnv(
+	env: Record<string, string | undefined> = process.env,
+): Record<string, string> {
+	const out: Record<string, string> = {};
+	for (const k of [
+		"PATH",
+		"HOME",
+		"USER",
+		"LANG",
+		"LC_ALL",
+		"TMPDIR",
+		"SYSTEMROOT",
+		"PATHEXT",
+	]) {
+		const v = env[k];
+		if (v !== undefined) out[k] = v;
+	}
+	out.NO_COLOR = "1";
+	return out;
+}
+
+export const defaultCompanionRunner: CompanionRunner = (command, timeoutMs) =>
+	new Promise((resolve) => {
+		let stdout = "";
+		let done = false;
+		const finish = (r: CompanionRun) => {
+			if (!done) {
+				done = true;
+				resolve(r);
+			}
+		};
+		let child: ReturnType<typeof spawn>;
+		try {
+			child = spawn(command, ["--ashlr-handshake", "--json"], {
+				env: companionEnv(),
+				stdio: ["ignore", "pipe", "ignore"],
+			});
+		} catch {
+			finish({ kind: "missing" });
+			return;
+		}
+		const timer = setTimeout(() => {
+			child.kill("SIGKILL");
+			finish({ kind: "timeout" });
+		}, timeoutMs);
+		child.stdout?.on("data", (d) => {
+			if (stdout.length < 64_000) stdout += String(d);
+		});
+		child.on("error", (err: NodeJS.ErrnoException) => {
+			clearTimeout(timer);
+			finish(
+				err.code === "ENOENT"
+					? { kind: "missing" }
+					: { kind: "ran", code: 1, stdout: "" },
+			);
+		});
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			finish({ kind: "ran", code, stdout });
+		});
+	});
+
+export function parseCompanion(
+	c: Companion,
+	run: CompanionRun,
+): CompanionResult {
+	const base = {
+		name: c.name,
+		command: c.command,
+		version: null,
+		capabilities: [] as string[],
+		health: null,
+		next_steps: [] as string[],
+	};
+	const docs = `https://github.com/${c.repo}#readme`;
+	if (run.kind === "missing")
+		return {
+			...base,
+			state: "missing",
+			fix: `optional: install ${c.name} (\`${c.command}\`), see ${docs}`,
+		};
+	if (run.kind === "timeout")
+		return {
+			...base,
+			state: "unknown",
+			fix: `\`${c.command} --ashlr-handshake --json\` did not answer in time`,
+		};
+	const text = run.stdout.trim();
+	let v: unknown;
+	let parsed = true;
+	try {
+		v = JSON.parse(text);
+	} catch {
+		parsed = false;
+	}
+	// Not JSON at all: an older build that does not know the flag.
+	if (!parsed && !text.startsWith("{"))
+		return {
+			...base,
+			state: "outdated",
+			fix: `upgrade ${c.name}: \`${c.command}\` does not answer --ashlr-handshake (see ${docs})`,
+		};
+	if (!parsed || v === null || typeof v !== "object")
+		return {
+			...base,
+			state: "unknown",
+			fix: `\`${c.command} --ashlr-handshake --json\` printed output doctor cannot read`,
+		};
+	const h = v as Record<string, unknown> & { health?: { status?: unknown } };
+	if (h.kind !== "ashlr.handshake" || h.schema_version !== 1)
+		return {
+			...base,
+			state: "unknown",
+			fix: `\`${c.command} --ashlr-handshake --json\` printed output doctor cannot read`,
+		};
+	const health =
+		typeof h.health?.status === "string" ? h.health.status : "unknown";
+	const result: CompanionResult = {
+		...base,
+		state: health === "ok" ? "ready" : "degraded",
+		version: typeof h.version === "string" ? h.version : null,
+		capabilities: Array.isArray(h.capabilities)
+			? h.capabilities.filter((x): x is string => typeof x === "string")
+			: [],
+		health,
+		fix:
+			health === "ok"
+				? null
+				: `run \`${c.command} --ashlr-handshake --json\` to see which check is not ok`,
+	};
+	result.next_steps = companionNextSteps(result);
+	if (result.next_steps.length)
+		result.fix = `run \`${DOCTOR_FIX_COMMANDS[c.name]} doctor --fix\` to preview safe repairs (writes nothing); add --apply to make them`;
+	return result;
+}
+
+/** Probes every companion in parallel. Never throws. */
+export async function detectCompanions(
+	runner: CompanionRunner = defaultCompanionRunner,
+	companions: Companion[] = COMPANIONS,
+	timeoutMs = COMPANION_TIMEOUT_MS,
+): Promise<CompanionResult[]> {
+	return Promise.all(
+		companions.map(async (c) =>
+			parseCompanion(
+				c,
+				await runner(c.command, timeoutMs).catch(
+					(): CompanionRun => ({ kind: "missing" }),
+				),
+			),
+		),
+	);
+}

package/servers/_cwd-clamp.ts

@@ -277,6 +277,31 @@ function allowedRoots(): string[] {
   return roots;
 }
 
+/**
+ * Move the MCP router into the folder its host launched it in.
+ *
+ * The launchers (scripts/mcp-entrypoint.ts, bootstrap.mjs, ashlr-mcp.ts) chdir
+ * to PLUGIN_ROOT so dependency resolution never trusts the caller's cwd, and
+ * record the original folder in ASHLR_LAUNCH_CWD first. Hosts start MCP
+ * servers in the user's project, so adopting it makes every tool default
+ * (`process.cwd()`, relative paths, the clamp's primary root) mean the project
+ * instead of the plugin install dir. Ignored when the recorded folder is the
+ * plugin install dir itself or no longer exists. Returns the adopted folder.
+ */
+export function adoptLaunchCwd(): string | null {
+  const launchCwd = process.env["ASHLR_LAUNCH_CWD"];
+  if (!launchCwd) return null;
+  try {
+    const abs = canonical(resolve(launchCwd));
+    if (cwdLooksLikePluginRoot(abs) || !statSync(abs).isDirectory()) return null;
+    if (abs === canonical(process.cwd())) return abs;
+    process.chdir(abs);
+    return abs;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Pick the user's primary project root from the allow-list.
  *
@@ -317,7 +342,9 @@ export function clampToCwd(
   toolName: string,
 ): ClampResult {
   const roots = allowedRoots();
-  const rootAbs = canonical(resolve(userPath ?? "."));
+  // Relative paths (and an omitted path) mean the user's project, not the
+  // plugin install dir the router process runs from.
+  const rootAbs = canonical(resolve(primaryProjectRoot(), userPath ?? "."));
 
   for (const root of roots) {
     const rel = relative(root, rootAbs);
@@ -340,3 +367,13 @@ export function clampToCwd(
     message: `${toolName}: refused path outside working directory: ${absInput}${jailDiag}\n(cwd is ${primary}${extra})`,
   };
 }
+
+const REFUSAL = /^ashlr__\w+: refused path outside working directory: /;
+
+/**
+ * True when `text` is a clampToCwd refusal. Many handlers return the refusal
+ * as plain text; the dispatcher uses this to mark those results `isError`.
+ */
+export function isPathRefusal(text: unknown): boolean {
+  return typeof text === "string" && REFUSAL.test(text);
+}

package/servers/_edit-match.ts

@@ -134,7 +134,10 @@ export function findFuzzyMatch(
   // -------------------------------------------------------------------------
   // Tier 2: block Levenshtein over line windows
   // -------------------------------------------------------------------------
-  const searchLines = search.split("\n");
+  // A trailing newline in `search` ends its last line; it is not an extra
+  // empty line to compare against the next line of content.
+  const searchEndsWithNewline = search.endsWith("\n");
+  const searchLines = (searchEndsWithNewline ? search.slice(0, -1) : search).split("\n");
   const contentLines = content.split("\n");
   const windowSize = searchLines.length;
 
@@ -170,10 +173,17 @@ export function findFuzzyMatch(
   // Map best window back to byte offsets.
   const start = lineToOffset(content, best.lineIdx);
   const endLineIdx = best.lineIdx + windowSize;
-  const end =
+  // The window covers whole lines, but the line terminator after its last line
+  // belongs to the window only when `search` itself ends with a newline.
+  // Otherwise the replacement would swallow it and join the next line.
+  let end =
     endLineIdx >= contentLines.length
       ? content.length
       : lineToOffset(content, endLineIdx);
+  if (!searchEndsWithNewline && endLineIdx < contentLines.length) {
+    end -= 1; // the "\n"
+    if (end > start && content[end - 1] === "\r") end -= 1;
+  }
 
   return { start, end, score: Math.round(best.score * 100) / 100 };
 }

package/servers/_embedding-model.ts

@@ -18,15 +18,30 @@
  *   Set ASHLR_EMBED_URL=http://localhost:11434/api/embeddings to call an
  *   Ollama/LM Studio endpoint. Falls back to BM25 on any failure.
  *
+ * OpenAI-compatible embedding (opt-in, off by default):
+ *   Set ASHLR_EMBED_FORMAT=openai and ASHLR_EMBED_URL to an OpenAI-compatible
+ *   base such as a LiteLLM proxy (http://127.0.0.1:4000/v1); the plugin POSTs
+ *   { model, input } to <base>/embeddings. Optional ASHLR_EMBED_KEY is sent
+ *   as a Bearer token; a Phantom `phm_` placeholder is sent unchanged for the
+ *   proxy to swap, a `phm:` reference is never resolved (no call is made).
+ *   The call follows the gateway rules (https, or http only to 127.0.0.1 /
+ *   [::1]; no credentials in the URL; redirects refused; strict mode adds the
+ *   allowlist). The key and the embedded text are never logged.
+ *   See docs/embeddings-gateway.md.
+ *
  * Env vars:
  *   ASHLR_EMBED_URL          — HTTP POST endpoint that returns { embedding: number[] }
+ *                              (with ASHLR_EMBED_FORMAT=openai: the OpenAI-compatible base URL)
  *   ASHLR_EMBED_MODEL        — model name to pass in the request body (default: nomic-embed-text)
+ *   ASHLR_EMBED_FORMAT       : "ollama" (default) or "openai"
+ *   ASHLR_EMBED_KEY          : optional key, used only with ASHLR_EMBED_FORMAT=openai
  *   ASHLR_CONTEXT_DB_DISABLE — if "1", embed() still works (used outside the cache path)
  */
 
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+import { safeKeyedFetch } from "./_gateway-target.ts";
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -259,9 +274,71 @@ export function bm25Embed(text: string): Float32Array {
  * Call a remote embedding endpoint.
  * Returns null on any failure so the caller can fall back to BM25.
  */
+type Env = Record<string, string | undefined>;
+
+export type EmbedFormat = "ollama" | "openai";
+
+/** "openai" only when ASHLR_EMBED_FORMAT is exactly that (case-insensitive); anything else keeps the Ollama shape. */
+export function embedFormat(env: Env = process.env): EmbedFormat {
+  return (env.ASHLR_EMBED_FORMAT ?? "").trim().toLowerCase() === "openai" ? "openai" : "ollama";
+}
+
+/** OpenAI-compatible embeddings URL: `<base>/embeddings`, unless the URL already ends in /embeddings. */
+export function openaiEmbeddingsUrl(base: string): string {
+  const trimmed = base.trim().replace(/\/+$/, "");
+  return /\/embeddings$/i.test(trimmed) ? trimmed : `${trimmed}/embeddings`;
+}
+
+/**
+ * Opt-in OpenAI-compatible embedding (LiteLLM and similar). Returns null on
+ * any failure or refusal so the caller falls back to BM25. Writes nothing to
+ * stdout or stderr: neither the key nor the text is ever logged.
+ */
+export async function openaiRemoteEmbed(
+  text: string,
+  env: Env = process.env,
+  fetchImpl: typeof fetch = fetch,
+): Promise<Float32Array | null> {
+  const base = (env.ASHLR_EMBED_URL ?? "").trim();
+  if (!base) return null;
+  const key = (env.ASHLR_EMBED_KEY ?? "").trim();
+  // A `phm:` vault reference is never resolved here; without a real key or a
+  // `phm_` session placeholder there is nothing safe to send.
+  if (key.startsWith("phm:")) return null;
+  const headers: Record<string, string> = { "Content-Type": "application/json" };
+  if (key) headers["Authorization"] = `Bearer ${key}`;
+  const model = env.ASHLR_EMBED_MODEL ?? "nomic-embed-text";
+  try {
+    const res = await safeKeyedFetch(
+      openaiEmbeddingsUrl(base),
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ model, input: text }),
+        signal: AbortSignal.timeout(5_000),
+      },
+      env,
+      fetchImpl,
+    );
+    if (!res.ok) {
+      try { await res.body?.cancel(); } catch { /* nothing to drain */ }
+      return null;
+    }
+    const json = (await res.json()) as { data?: Array<{ embedding?: unknown }> };
+    const emb = json.data?.[0]?.embedding;
+    if (!Array.isArray(emb) || emb.length === 0 || !emb.every((x) => typeof x === "number" && Number.isFinite(x))) {
+      return null;
+    }
+    return normalizeInPlace(new Float32Array(emb as number[]));
+  } catch {
+    return null;
+  }
+}
+
 async function remoteEmbed(text: string): Promise<Float32Array | null> {
   const url = process.env.ASHLR_EMBED_URL;
   if (!url) return null;
+  if (embedFormat() === "openai") return openaiRemoteEmbed(text);
 
   const model = process.env.ASHLR_EMBED_MODEL ?? "nomic-embed-text";
 

package/servers/_gateway-target.ts

@@ -0,0 +1,179 @@
+/**
+ * Opt-in strict targets for model calls that carry a key.
+ *
+ * Off by default: with ASHLR_GATEWAY_STRICT unset, keyedFetch() is plain
+ * fetch() and nothing changes. With ASHLR_GATEWAY_STRICT=1, a request that
+ * carries a key (Authorization or x-api-key) is sent only when its target is:
+ *
+ *   - a loopback IP literal, 127.0.0.1 or [::1] (http or https, any port), or
+ *   - https to an exact host:port listed in ASHLR_GATEWAY_HOSTS
+ *     (comma-separated, for example "litellm.internal:4000,gw.example.com:443"), or
+ *   - https to one of the plugin's built-in provider hosts on 443
+ *     (api.anthropic.com, api.openai.com, api.ashlr.ai).
+ *
+ * `localhost` by name is not loopback here, credentials in the URL are
+ * refused, and redirects are never followed (a 3xx is a refusal), because
+ * fetch forwards a custom header such as x-api-key to the redirect target.
+ * Refusal messages name scheme, host and port only, never the key, path or
+ * query.
+ */
+
+type Env = Record<string, string | undefined>;
+
+export const GATEWAY_STRICT_ENV = "ASHLR_GATEWAY_STRICT";
+export const GATEWAY_HOSTS_ENV = "ASHLR_GATEWAY_HOSTS";
+
+export const BUILTIN_PROVIDER_HOSTS: readonly string[] = [
+  "api.anthropic.com:443",
+  "api.openai.com:443",
+  "api.ashlr.ai:443",
+];
+
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "[::1]"]);
+
+export class GatewayRefusal extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "GatewayRefusal";
+  }
+}
+
+/** True when ASHLR_GATEWAY_STRICT is 1, true, yes or on (any case). */
+export function gatewayStrict(env: Env = process.env): boolean {
+  const v = (env[GATEWAY_STRICT_ENV] ?? "").trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes" || v === "on";
+}
+
+/**
+ * Parse ASHLR_GATEWAY_HOSTS. Each entry must be an exact host:port. Returns
+ * the invalid entries separately so a typo refuses every listed target
+ * instead of silently allowing less (or more) than intended.
+ */
+export function parseGatewayHosts(env: Env = process.env): { hosts: Set<string>; invalid: string[] } {
+  const hosts = new Set<string>();
+  const invalid: string[] = [];
+  for (const raw of (env[GATEWAY_HOSTS_ENV] ?? "").split(",")) {
+    const entry = raw.trim().toLowerCase();
+    if (!entry) continue;
+    const m = /^(\[[0-9a-f:.]+\]|[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*):(\d{1,5})$/.exec(entry);
+    const port = m ? Number(m[5]) : 0;
+    if (!m || port < 1 || port > 65535) {
+      invalid.push(raw.trim().slice(0, 80));
+      continue;
+    }
+    hosts.add(`${m[1]}:${port}`);
+  }
+  return { hosts, invalid };
+}
+
+/** scheme://host:port of a URL, nothing else; "(invalid URL)" when it does not parse. */
+export function safeTargetLabel(url: string): string {
+  try {
+    const u = new URL(url);
+    const port = u.port || (u.protocol === "https:" ? "443" : u.protocol === "http:" ? "80" : "");
+    return `${u.protocol}//${u.hostname}${port ? `:${port}` : ""}`;
+  } catch {
+    return "(invalid URL)";
+  }
+}
+
+export type TargetCheck = { ok: true } | { ok: false; reason: string };
+
+/** Decide whether a keyed request may go to `url` under the strict rules. */
+export function checkKeyedTarget(url: string, env: Env = process.env): TargetCheck {
+  let u: URL;
+  try {
+    u = new URL(url);
+  } catch {
+    return { ok: false, reason: "target is not a valid URL" };
+  }
+  const label = safeTargetLabel(url);
+  if (u.username || u.password) return { ok: false, reason: `${label}: credentials in the URL are refused` };
+  if (u.protocol !== "http:" && u.protocol !== "https:") {
+    return { ok: false, reason: `${label}: only http and https are allowed` };
+  }
+  const host = u.hostname.toLowerCase();
+  if (LOOPBACK_HOSTS.has(host)) return { ok: true };
+  if (u.protocol === "http:") {
+    return { ok: false, reason: `${label}: plain http is allowed only for 127.0.0.1 and [::1]` };
+  }
+  const hostPort = `${host}:${u.port || "443"}`;
+  if (BUILTIN_PROVIDER_HOSTS.includes(hostPort)) return { ok: true };
+  const { hosts, invalid } = parseGatewayHosts(env);
+  if (invalid.length > 0) {
+    return { ok: false, reason: `${GATEWAY_HOSTS_ENV} has entries that are not host:port (${invalid.join(", ")}); fix them first` };
+  }
+  if (hosts.has(hostPort)) return { ok: true };
+  return { ok: false, reason: `${label}: ${hostPort} is not listed in ${GATEWAY_HOSTS_ENV}` };
+}
+
+/**
+ * fetch() for a request that carries a key. Unchanged when strict mode is
+ * off. In strict mode it refuses a target that fails checkKeyedTarget() and
+ * any redirect, throwing GatewayRefusal before or instead of following it.
+ */
+export async function keyedFetch(
+  url: string,
+  init: RequestInit = {},
+  env: Env = process.env,
+  fetchImpl: typeof fetch = fetch,
+): Promise<Response> {
+  if (!gatewayStrict(env)) return fetchImpl(url, init);
+  const check = checkKeyedTarget(url, env);
+  if (!check.ok) throw new GatewayRefusal(`[ashlr] gateway strict mode refused ${check.reason}`);
+  const res = await fetchImpl(url, { ...init, redirect: "manual" });
+  if ((res.status >= 300 && res.status < 400) || res.type === "opaqueredirect") {
+    try { await res.body?.cancel(); } catch { /* nothing to drain */ }
+    throw new GatewayRefusal(`[ashlr] gateway strict mode refused a redirect from ${safeTargetLabel(url)}`);
+  }
+  return res;
+}
+
+/**
+ * Default-path rules for a keyed model call, applied whether or not strict
+ * mode is on: https to any host, or plain http only to 127.0.0.1 or [::1]
+ * (`localhost` by name does not count), and no credentials in the URL.
+ */
+export function checkBaseTarget(url: string): TargetCheck {
+  let u: URL;
+  try {
+    u = new URL(url);
+  } catch {
+    return { ok: false, reason: "target is not a valid URL" };
+  }
+  const label = safeTargetLabel(url);
+  if (u.username || u.password) return { ok: false, reason: `${label}: credentials in the URL are refused` };
+  if (u.protocol === "https:") return { ok: true };
+  if (u.protocol === "http:") {
+    return LOOPBACK_HOSTS.has(u.hostname.toLowerCase())
+      ? { ok: true }
+      : { ok: false, reason: `${label}: plain http is allowed only for 127.0.0.1 and [::1]` };
+  }
+  return { ok: false, reason: `${label}: only http and https are allowed` };
+}
+
+/**
+ * fetch() for a keyed call on the default path. Always applies
+ * checkBaseTarget() and never follows a redirect (a 3xx is a refusal, since
+ * fetch forwards custom key headers to the redirect target). With
+ * ASHLR_GATEWAY_STRICT on, the strict host rules apply on top.
+ */
+export async function safeKeyedFetch(
+  url: string,
+  init: RequestInit = {},
+  env: Env = process.env,
+  fetchImpl: typeof fetch = fetch,
+): Promise<Response> {
+  const base = checkBaseTarget(url);
+  if (!base.ok) throw new GatewayRefusal(`[ashlr] refused model endpoint ${base.reason}`);
+  if (gatewayStrict(env)) {
+    const strictCheck = checkKeyedTarget(url, env);
+    if (!strictCheck.ok) throw new GatewayRefusal(`[ashlr] gateway strict mode refused ${strictCheck.reason}`);
+  }
+  const res = await fetchImpl(url, { ...init, redirect: "manual" });
+  if ((res.status >= 300 && res.status < 400) || res.type === "opaqueredirect") {
+    try { await res.body?.cancel(); } catch { /* nothing to drain */ }
+    throw new GatewayRefusal(`[ashlr] refused a redirect from model endpoint ${safeTargetLabel(url)}`);
+  }
+  return res;
+}

package/servers/_llm-providers/anthropic.ts

@@ -11,10 +11,12 @@
 import { readFile } from "fs/promises";
 import { homedir } from "os";
 import { join } from "path";
+import { DEFAULT_ANTHROPIC_BASE_URL, anthropicBaseUrl } from "../_base-urls.ts";
 import type { LlmProvider, LlmSummarizeResult } from "./types.ts";
+import { safeKeyedFetch } from "../_gateway-target.ts";
+import { redactedBody } from "../_redact-keys.ts";
 
 const MODEL = "claude-haiku-4-5-20251001";
-const API_BASE = "https://api.anthropic.com";
 const ANTHROPIC_VERSION = "2023-06-01";
 
 function home(): string {
@@ -49,6 +51,10 @@ async function readClaudeCredentials(): Promise<string | null> {
 async function resolveApiKey(): Promise<string | null> {
   const env = process.env.ANTHROPIC_API_KEY;
   if (env && env.trim().length > 0) return env.trim();
+  // The Claude Code OAuth token is an Anthropic credential, not the user's
+  // gateway key: never hand it to a custom ANTHROPIC_BASE_URL (LiteLLM or
+  // any other proxy). Only the default Anthropic host may receive it.
+  if (anthropicBaseUrl() !== DEFAULT_ANTHROPIC_BASE_URL) return null;
   return readClaudeCredentials();
 }
 
@@ -81,7 +87,7 @@ export const anthropicProvider: LlmProvider = {
 
     let res: Response;
     try {
-      res = await fetch(`${API_BASE}/v1/messages`, {
+      res = await safeKeyedFetch(`${anthropicBaseUrl()}/v1/messages`, {
         method: "POST",
         signal: ctl.signal,
         headers: {
@@ -101,8 +107,8 @@ export const anthropicProvider: LlmProvider = {
     }
 
     if (!res.ok) {
-      const body = await res.text().catch(() => "");
-      throw new Error(`Anthropic API error ${res.status}: ${body.slice(0, 200)}`);
+      const body = await redactedBody(res, [apiKey]);
+      throw new Error(`Anthropic API error ${res.status}: ${body}`);
     }
 
     const latencyMs = Date.now() - t0;