claude-scionos 4.1.10 → 4.2.0

package/README.fr.md

@@ -137,7 +137,7 @@ Cas courants :
 - `Claude Code CLI not found` : installer `@anthropic-ai/claude-code`
 - `Git Bash is required on Windows` : installer Git for Windows
 - `ANTHROPIC_AUTH_TOKEN ... is required when using --no-prompt` : définir la variable d'environnement ou stocker le token au préalable
-- `Secure token file was created but no encrypted content was written` : mettre à jour vers `4.1.10` ou plus récent, puis relancer `claude-scionos auth login`
+- `Secure token file was created but no encrypted content was written` : mettre à jour vers `4.2.0` ou plus récent, puis relancer `claude-scionos auth login`
 - `Stored token` est indiqué comme absent sous Windows alors qu'un login a déjà été fait : relancer `claude-scionos auth login`, car le fichier DPAPI local peut être vide ou corrompu
 - `secret-tool not found` : installer un client Secret Service sous Linux ou utiliser la variable d'environnement
 

package/README.md

@@ -137,7 +137,7 @@ Common cases:
 - `Claude Code CLI not found`: install `@anthropic-ai/claude-code`
 - `Git Bash is required on Windows`: install Git for Windows
 - `ANTHROPIC_AUTH_TOKEN ... is required when using --no-prompt`: set the environment variable or store the token first
-- `Secure token file was created but no encrypted content was written`: update to `4.1.10` or later, then re-run `claude-scionos auth login`
+- `Secure token file was created but no encrypted content was written`: update to `4.2.0` or later, then re-run `claude-scionos auth login`
 - `Stored token` is missing on Windows even though you already logged in: re-run `claude-scionos auth login` because the local DPAPI token file may be empty or corrupted
 - `secret-tool not found`: install a Secret Service client on Linux or rely on the environment variable
 

package/index.js

@@ -4,23 +4,23 @@ import { styleText } from 'node:util';
 import fs from 'node:fs';
 import path from 'node:path';
 const chalk = {
-    hex: (color) => {
-        if (color === '#3b82f6') return (t) => styleText('blueBright', t);
-        if (color === '#a855f7') return (t) => styleText('magentaBright', t);
-        if (color === '#D97757') return (t) => styleText('redBright', t);
-        return (t) => t;
-    },
-    white: (t) => styleText('white', t),
-    gray: (t) => styleText('gray', t),
-    yellow: (t) => styleText('yellow', t),
-    red: (t) => styleText('red', t),
-    cyan: (t) => styleText('cyan', t),
-    redBright: (t) => styleText('redBright', t),
-    blueBright: (t) => styleText('blueBright', t),
-    green: (t) => styleText('green', t),
-    magenta: (t) => styleText('magenta', t),
-    bold: (t) => styleText('bold', t)
-};
+    hex: (color) => {
+        if (color === '#3b82f6') return (t) => styleText('blueBright', t);
+        if (color === '#a855f7') return (t) => styleText('magentaBright', t);
+        if (color === '#D97757') return (t) => styleText('redBright', t);
+        return (t) => t;
+    },
+    white: (t) => styleText('white', t),
+    gray: (t) => styleText('gray', t),
+    yellow: (t) => styleText('yellow', t),
+    red: (t) => styleText('red', t),
+    cyan: (t) => styleText('cyan', t),
+    redBright: (t) => styleText('redBright', t),
+    blueBright: (t) => styleText('blueBright', t),
+    green: (t) => styleText('green', t),
+    magenta: (t) => styleText('magenta', t),
+    bold: (t) => styleText('bold', t)
+};
 import { password, confirm, select, Separator } from '@inquirer/prompts';
 import { spawn, spawnSync } from 'node:child_process';
 import process from 'node:process';
@@ -43,11 +43,13 @@ import {
     getStrategyChoices,
     hasVerifiedModelIds,
     listStrategies,
+    resolveServiceBaseUrl,
     storeToken,
-    validateToken
+    validateToken,
+    validateTokenFormat
 } from './src/routerlab.js';
-import { buildProxyRequestOptions, normalizeProxyHeaders, startProxyServer } from './src/proxy.js';
-
+import { startProxyServer } from './src/proxy.js';
+
 const require = createRequire(import.meta.url);
 const pkg = require('./package.json');
 
@@ -292,7 +294,7 @@ function formatTokenSource(source) {
     if (source === 'manual') return 'manual input';
     return 'not available';
 }
-
+
 function installClaudeCode() {
     return spawnSync('npm', ['install', '-g', '@anthropic-ai/claude-code'], {
         stdio: 'inherit',
@@ -301,26 +303,27 @@ function installClaudeCode() {
 }
 
 async function promptAndValidateToken(promptMessage, serviceConfig) {
-    while (true) {
-        if (serviceConfig.tokenHelpUrl) {
-            console.log(chalk.blueBright(`To retrieve your token, visit: ${serviceConfig.tokenHelpUrl}`));
-        } else if (serviceConfig.tokenHelpMessage) {
-            console.log(chalk.blueBright(serviceConfig.tokenHelpMessage));
-        }
+    const serviceBaseUrl = resolveServiceBaseUrl(serviceConfig.value);
 
+    while (true) {
         const token = await password({
             message: promptMessage,
             mask: '*'
         });
 
-        console.log(chalk.gray("Validating token..."));
-        const validation = await validateToken(token, { baseUrl: serviceConfig.baseUrl });
+        const formatValidation = validateTokenFormat(token);
+        if (!formatValidation.valid) {
+            console.log(chalk.red(`✗ ${formatValidation.message}\n`));
+            continue;
+        }
+
+        const validation = await validateToken(token, { baseUrl: serviceBaseUrl, serviceValue: serviceConfig.value });
         if (canProceedWithValidation(validation)) {
-            console.log(chalk.green("✓ Token validated."));
+            console.log(chalk.green(`✓ ${serviceConfig.tokenPromptLabel} token validated.`));
             return { token, validation };
         }
 
-        console.log(chalk.red(`❌ Token validation failed: ${validation.message || validation.status || validation.reason}. Try again.`));
+        console.log(chalk.red(`✗ Token invalid: ${validation.message || validation.status || validation.reason}\n`));
     }
 }
 
@@ -347,9 +350,27 @@ async function maybeStoreToken(token, serviceConfig, replaceExisting = false) {
 
 async function resolveLaunchToken(noPrompt, serviceConfig) {
     const candidate = getAvailableTokenCandidate(serviceConfig.value);
+    const serviceBaseUrl = resolveServiceBaseUrl(serviceConfig.value);
 
     if (candidate.token) {
-        const validation = await validateToken(candidate.token, { baseUrl: serviceConfig.baseUrl });
+        const formatValidation = validateTokenFormat(candidate.token);
+        if (!formatValidation.valid) {
+            const sourceLabel = formatTokenSource(candidate.source);
+            if (noPrompt) {
+                throw new Error(`${sourceLabel} token is invalid: ${formatValidation.message}`);
+            }
+
+            console.log(chalk.yellow(`⚠ The ${sourceLabel} token is invalid: ${formatValidation.message} Please enter a new token.`));
+            const prompted = await promptAndValidateToken(`Please enter your ${serviceConfig.tokenPromptLabel} token:`, serviceConfig);
+            await maybeStoreToken(prompted.token, serviceConfig, candidate.source === 'secure-store');
+            return {
+                token: prompted.token,
+                source: 'manual',
+                validation: prompted.validation
+            };
+        }
+
+        const validation = await validateToken(candidate.token, { baseUrl: serviceBaseUrl, serviceValue: serviceConfig.value });
         if (canProceedWithValidation(validation)) {
             return {
                 token: candidate.token,
@@ -398,7 +419,7 @@ async function resolveStrategyChoice(parsed, modelIds, serviceConfig) {
         if (hasVerifiedModelIds(modelIds)) {
             const availability = assessStrategy(selected, modelIds, serviceConfig.value);
             if (availability.level === 'partial') {
-                console.log(chalk.yellow(`⚠ Strategy "${selected}" is only partially available on ${serviceConfig.availabilityLabel}.`));
+                console.log(chalk.yellow(`WARN Strategy "${selected}" is only partially available on ${serviceConfig.availabilityLabel}.`));
             }
         }
 
@@ -421,12 +442,12 @@ async function resolveStrategyChoice(parsed, modelIds, serviceConfig) {
     const strategyChoices = getStrategyChoices(modelIds, serviceConfig.value).map((choice) => {
         const launchReadiness = assessStrategyLaunch(choice.value, modelIds, serviceConfig.value);
         const disabled = hasVerifiedModelIds(modelIds) && !launchReadiness.ready ? launchReadiness.note : false;
-
         return {
             ...choice,
             disabled,
             name: `${getStrategyIndicator(choice.value, modelIds, serviceConfig.value)} ${getStrategyMenuLabel(choice.value)}`,
-            short: getStrategyMenuLabel(choice.value)
+            short: getStrategyMenuLabel(choice.value),
+            description: launchReadiness.note
         };
     });
 
@@ -451,12 +472,7 @@ function showStrategies(modelIds = null, serviceConfig) {
     const strategies = listStrategies(modelIds, serviceConfig.value);
     showSection('Strategies', strategies.map((strategy) => {
         const indicator = getStrategyIndicator(strategy.value, modelIds, serviceConfig.value);
-        const state = !hasVerifiedModelIds(modelIds)
-            ? chalk.gray('Unknown')
-            : assessStrategyLaunch(strategy.value, modelIds, serviceConfig.value).ready
-                ? chalk.green('Ready')
-                : chalk.red('Blocked');
-        return `${indicator} ${chalk.white(strategy.name)}  ${state}  ${chalk.gray(`(${strategy.value})`)}\n    ${strategy.description} ${strategy.availability.note}`.trimEnd();
+        return `${indicator} ${chalk.white(getStrategyMenuLabel(strategy.value))} ${chalk.gray(`(${strategy.value})`)}\n    ${strategy.description}`;
     }));
 }
 
@@ -478,7 +494,7 @@ async function runAuthCommand(action, serviceConfig) {
 
     if (action === 'logout') {
         const removed = deleteStoredToken(serviceConfig.value);
-        console.log(removed ? chalk.green('✓ Stored token removed.') : chalk.yellow('⚠ No stored token was found.'));
+        console.log(removed ? chalk.green('OK Stored token removed.') : chalk.yellow('WARN No stored token was found.'));
         return;
     }
 
@@ -489,21 +505,24 @@ async function runAuthCommand(action, serviceConfig) {
 
         const prompted = await promptAndValidateToken(`Enter the ${serviceConfig.tokenPromptLabel} token to save securely:`, serviceConfig);
         storeToken(prompted.token, serviceConfig.value);
-        console.log(chalk.green(`✓ Token saved securely in ${storage.backend}.`));
+        console.log(chalk.green(`OK Token saved securely in ${storage.backend}.`));
         return;
     }
 
     if (action === 'test') {
         const candidate = getAvailableTokenCandidate(serviceConfig.value);
         if (!candidate.token) {
-            console.log(chalk.yellow('⚠ No environment token or stored token is available.'));
+            console.log(chalk.yellow('WARN No environment token or stored token is available.'));
             return;
         }
 
-        const validation = await validateToken(candidate.token, { baseUrl: serviceConfig.baseUrl });
+        const validation = await validateToken(candidate.token, {
+            baseUrl: resolveServiceBaseUrl(serviceConfig.value),
+            serviceValue: serviceConfig.value
+        });
         console.log(canProceedWithValidation(validation)
-            ? chalk.green(`✓ ${formatTokenSource(candidate.source)} token is valid.`)
-            : chalk.red(`❌ ${formatTokenSource(candidate.source)} token is invalid: ${validation.message || validation.status || validation.reason}`));
+            ? chalk.green(`OK ${formatTokenSource(candidate.source)} token is valid for ${serviceConfig.label}.`)
+            : chalk.red(`FAIL ${formatTokenSource(candidate.source)} token is invalid for ${serviceConfig.label}: ${validation.message || validation.status || validation.reason}`));
 
         if (canProceedWithValidation(validation)) {
             showStrategies(validation.models, serviceConfig);
@@ -538,16 +557,19 @@ async function runDoctor(serviceConfig) {
     console.log('');
 
     const candidate = getAvailableTokenCandidate(serviceConfig.value);
+    let validation = null;
+
     if (!candidate.token) {
         showStatus(`${serviceConfig.tokenPromptLabel} auth`, 'warn', 'Skipped: no environment or stored token available');
-        console.log('');
-        return;
+    } else {
+        validation = await validateToken(candidate.token, {
+            baseUrl: resolveServiceBaseUrl(serviceConfig.value),
+            serviceValue: serviceConfig.value
+        });
+        showStatus(`${serviceConfig.tokenPromptLabel} auth`, canProceedWithValidation(validation) ? 'ok' : 'error', canProceedWithValidation(validation)
+            ? `validated via ${formatTokenSource(candidate.source)} token`
+            : validation.message || validation.status || validation.reason);
     }
-
-    const validation = await validateToken(candidate.token, { baseUrl: serviceConfig.baseUrl });
-    showStatus(`${serviceConfig.tokenPromptLabel} auth`, canProceedWithValidation(validation) ? 'ok' : 'error', canProceedWithValidation(validation)
-        ? `validated via ${formatTokenSource(candidate.source)} token`
-        : validation.message || validation.status || validation.reason);
     console.log('');
 
     if (canProceedWithValidation(validation)) {
@@ -560,18 +582,14 @@ async function runListStrategies(serviceConfig) {
     const candidate = getAvailableTokenCandidate(serviceConfig.value);
     if (!candidate.token) {
         showStrategies(null, serviceConfig);
-        console.log(chalk.gray(`Tip: save a token with \`claude-scionos auth login${serviceConfig.value === DEFAULT_SERVICE ? '' : ` --service ${serviceConfig.value}`}\` to verify availability live.`));
         return;
     }
 
-    const validation = await validateToken(candidate.token, { baseUrl: serviceConfig.baseUrl });
-    if (canProceedWithValidation(validation)) {
-        showStrategies(validation.models, serviceConfig);
-        return;
-    }
-
-    console.log(chalk.yellow(`⚠ Unable to verify strategy availability with the ${formatTokenSource(candidate.source)} token.`));
-    showStrategies(null, serviceConfig);
+    const validation = await validateToken(candidate.token, {
+        baseUrl: resolveServiceBaseUrl(serviceConfig.value),
+        serviceValue: serviceConfig.value
+    });
+    showStrategies(canProceedWithValidation(validation) ? validation.models : null, serviceConfig);
 }
 
 async function ensureClaudeInstallation(osInfo, interactive) {
@@ -611,7 +629,7 @@ async function ensureClaudeInstallation(osInfo, interactive) {
 
     return claudeStatus;
 }
-
+
 async function main() {
     const parsed = parseWrapperArgs(process.argv.slice(2));
 
@@ -667,7 +685,7 @@ async function main() {
     }
 
     const modelChoice = await resolveStrategyChoice(parsed, validation.models, serviceConfig);
-    let finalBaseUrl = serviceConfig.baseUrl;
+    let finalBaseUrl = resolveServiceBaseUrl(serviceConfig.value);
     let proxyServer = null;
 
     if (modelChoice !== 'default') {
@@ -676,7 +694,7 @@ async function main() {
         }
 
         const proxyInfo = await startProxyServer(modelChoice, token, {
-            baseUrl: serviceConfig.baseUrl,
+            baseUrl: resolveServiceBaseUrl(serviceConfig.value),
             debug: isDebug,
             onDebug: (message) => console.log(chalk.yellow(message)),
             onError: (message) => console.error(chalk.red(message))
@@ -689,10 +707,10 @@ async function main() {
     const env = {
         ...process.env,
         ANTHROPIC_BASE_URL: finalBaseUrl,
-        ANTHROPIC_AUTH_TOKEN: token,
-        ANTHROPIC_API_KEY: "" // Force empty
-    };
-
+        ANTHROPIC_AUTH_TOKEN: token,
+        ANTHROPIC_API_KEY: "" // Force empty
+    };
+
     if (interactive) {
         showSection('Launch Summary', [
             `${chalk.white('Service:')} ${serviceConfig.label}`,
@@ -721,31 +739,31 @@ async function main() {
         cleanup();
         process.exit(code ?? 0);
     });
-
-    child.on('error', (err) => {
-        cleanup();
-        console.error(chalk.red(`\n❌ Error launching Claude CLI:`));
-        if (err.code === 'ENOENT') {
-            console.error(chalk.yellow(`   Executable not found. Try 'npm install -g @anthropic-ai/claude-code'`));
-        } else if (err.code === 'EACCES') {
-            console.error(chalk.yellow(`   Permission denied.`));
-        } else {
-            console.error(chalk.yellow(`   ${err.message}`));
-        }
-        process.exit(1);
-    });
+
+    child.on('error', (err) => {
+        cleanup();
+        console.error(chalk.red(`\n❌ Error launching Claude CLI:`));
+        if (err.code === 'ENOENT') {
+            console.error(chalk.yellow(`   Executable not found. Try 'npm install -g @anthropic-ai/claude-code'`));
+        } else if (err.code === 'EACCES') {
+            console.error(chalk.yellow(`   Permission denied.`));
+        } else {
+            console.error(chalk.yellow(`   ${err.message}`));
+        }
+        process.exit(1);
+    });
 
     process.on('SIGINT', () => {
         // Claude handles SIGINT; we keep the wrapper alive for cleanup on child exit.
     });
-
-    process.on('SIGTERM', () => {
-        if (child) child.kill('SIGTERM');
-        cleanup();
-        process.exit(0);
-    });
-}
-
+
+    process.on('SIGTERM', () => {
+        if (child) child.kill('SIGTERM');
+        cleanup();
+        process.exit(0);
+    });
+}
+
 const isEntrypoint = normalizeEntrypointPath(process.argv[1]) === normalizeEntrypointPath(fileURLToPath(import.meta.url));
 
 if (isEntrypoint) {
@@ -754,14 +772,12 @@ if (isEntrypoint) {
         process.exit(1);
     });
 }
-
+
 export {
-    buildProxyRequestOptions,
     canProceedWithValidation,
     installClaudeCode,
     main,
     normalizeEntrypointPath,
-    normalizeProxyHeaders,
-    startProxyServer,
+    resolveLaunchToken,
     validateToken
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-scionos",
-    "version": "4.1.10",
+    "version": "4.2.0",
     "description": "RouterLab launcher, strategy proxy and secure token wrapper for Claude Code CLI",
     "type": "module",
     "main": "index.js",

package/src/proxy.js

@@ -14,6 +14,8 @@ const HOP_BY_HOP_HEADERS = new Set([
   'transfer-encoding',
   'upgrade',
 ]);
+const PROXY_AUTH_HEADER = 'x-scionos-proxy-secret';
+const MESSAGES_PATH = '/v1/messages';
 
 function normalizeProxyHeaders(headers) {
   const normalizedHeaders = {};
@@ -32,6 +34,7 @@ function normalizeProxyHeaders(headers) {
 function buildProxyRequestOptions(url, method, upstreamHeaders, validToken, bodyLength, timeout) {
   const headers = normalizeProxyHeaders(upstreamHeaders);
   delete headers.authorization;
+  delete headers[PROXY_AUTH_HEADER];
   headers['x-api-key'] = validToken;
   headers['anthropic-version'] ??= DEFAULT_ANTHROPIC_VERSION;
 
@@ -74,6 +77,22 @@ function writeJsonError(res, statusCode, payload) {
   res.end(JSON.stringify(payload));
 }
 
+function getRequestPath(req) {
+  return new URL(req.url, 'http://127.0.0.1').pathname;
+}
+
+function isAuthorizedProxyRequest(req, proxySecret) {
+  if (!proxySecret) {
+    return true;
+  }
+
+  return req.headers[PROXY_AUTH_HEADER] === proxySecret;
+}
+
+function isAllowedProxyRoute(req) {
+  return req.method === 'POST' && getRequestPath(req) === MESSAGES_PATH;
+}
+
 async function handleMessageRequest(req, res, options) {
   const {baseUrl, debug, onDebug, onError, targetModel, validToken} = options;
   const chunks = [];
@@ -123,7 +142,7 @@ async function handleMessageRequest(req, res, options) {
         validToken,
       });
     } catch (error) {
-      onError(`[Proxy Error] POST /messages: ${error.message}`);
+      onError(`[Proxy Error] POST ${MESSAGES_PATH}: ${error.message}`);
       writeJsonError(res, 500, {
         error: {
           message: 'Scionos Proxy Error',
@@ -162,9 +181,9 @@ async function forwardRequest(req, res, options) {
       onError(`[Proxy Error] Code: ${error.code}`);
     }
 
-    writeJsonError(res, req.method === 'POST' && req.url.includes('/messages') ? 500 : 502, {
+    writeJsonError(res, req.method === 'POST' && getRequestPath(req) === MESSAGES_PATH ? 500 : 502, {
       error: {
-        message: req.method === 'POST' && req.url.includes('/messages')
+        message: req.method === 'POST' && getRequestPath(req) === MESSAGES_PATH
           ? 'Proxy Error'
           : 'Scionos Proxy Error: Failed to connect to upstream',
         details: error.message,
@@ -201,47 +220,28 @@ function startProxyServer(targetModel, validToken, options = {}) {
     debug = false,
     onDebug = () => {},
     onError = () => {},
+    proxySecret = null,
   } = options;
 
   return new Promise((resolve, reject) => {
     const server = http.createServer((req, res) => {
-      if (req.method === 'OPTIONS') {
-        res.writeHead(200, {
-          'Access-Control-Allow-Origin': '*',
-          'Access-Control-Allow-Methods': 'POST, GET, OPTIONS',
-          'Access-Control-Allow-Headers': '*',
-        });
-        res.end();
+      if (!isAuthorizedProxyRequest(req, proxySecret)) {
+        writeJsonError(res, 403, {error: {message: 'Forbidden'}});
         return;
       }
 
-      if (req.method === 'POST' && req.url.includes('/messages')) {
-        handleMessageRequest(req, res, {
-          baseUrl,
-          debug,
-          onDebug,
-          onError,
-          targetModel,
-          validToken,
-        });
+      if (!isAllowedProxyRoute(req)) {
+        writeJsonError(res, 404, {error: {message: 'Not Found'}});
         return;
       }
 
-      forwardRequest(req, res, {
+      handleMessageRequest(req, res, {
         baseUrl,
         debug,
         onDebug,
         onError,
-        timeout: 60000,
+        targetModel,
         validToken,
-      }).catch((error) => {
-        onError(`[Proxy Error] ${req.method} ${req.url}: ${error.message}`);
-        writeJsonError(res, 502, {
-          error: {
-            message: 'Scionos Proxy Error: Failed to connect to upstream',
-            details: error.message,
-          },
-        });
       });
     });
 
@@ -257,6 +257,8 @@ function startProxyServer(targetModel, validToken, options = {}) {
 export {
   buildProxyRequestOptions,
   normalizeProxyHeaders,
+  PROXY_AUTH_HEADER,
   resolveMappedModel,
   startProxyServer,
 };
+

package/src/routerlab.js

@@ -102,7 +102,8 @@ const STRATEGIES = [
 
 async function fetchModels(apiKey, options = {}) {
   const {
-    baseUrl = BASE_URL,
+    serviceValue = DEFAULT_SERVICE,
+    baseUrl = resolveServiceBaseUrl(serviceValue),
     anthropicVersion = DEFAULT_ANTHROPIC_VERSION,
     timeoutMs = 30000,
   } = options;
@@ -190,6 +191,24 @@ function getServiceConfig(serviceValue = DEFAULT_SERVICE) {
   return SERVICES[normalizeServiceValue(serviceValue)] ?? null;
 }
 
+function resolveServiceBaseUrl(serviceValue = DEFAULT_SERVICE, env = process.env) {
+  return env.ANTHROPIC_BASE_URL?.trim() || getServiceConfig(serviceValue)?.baseUrl || BASE_URL;
+}
+
+function validateTokenFormat(apiKey) {
+  const token = apiKey?.trim() ?? '';
+
+  if (!token) {
+    return {valid: false, reason: 'missing', message: 'Token is required.'};
+  }
+
+  if (token.length < 20) {
+    return {valid: false, reason: 'too_short', message: 'Token seems invalid (too short).'};
+  }
+
+  return {valid: true};
+}
+
 function getServiceLabel(serviceValue = DEFAULT_SERVICE) {
   return getServiceConfig(serviceValue)?.availabilityLabel ?? 'RouterLab';
 }
@@ -652,6 +671,8 @@ export {
   getStrategyChoices,
   hasVerifiedModelIds,
   listStrategies,
+  resolveServiceBaseUrl,
   storeToken,
   validateToken,
+  validateTokenFormat,
 };