clauderipple 0.2.0

package/dist/router/src/index.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+// ClaudeRipple router entry point.
+//   CLAUDERIPPLE_HOME   config + certs + logs directory (default ~/.clauderipple)
+//   CLAUDERIPPLE_ECHO=1 also print log lines to stdout
+//
+// Exit codes: 0 clean, 2 bad config/certs, 75 upstream unreachable (supervisor should restart).
+import fs from "node:fs";
+import path from "node:path";
+import { codexEnabled, writeCodexCatalog } from "../../cli/src/codex.js";
+import { ingressModels } from "./ingress/models.js";
+import { ConfigStore, configPath, homeDir, terminateHosts } from "./config.js";
+import { CertStore } from "./certs.js";
+import { Logger } from "./log.js";
+import { UpstreamHealth, EXIT_UPSTREAM_UNREACHABLE } from "./health.js";
+import { Proxy } from "./proxy.js";
+import { startAdmin } from "./admin.js";
+import { RequestLog } from "./requestlog.js";
+import { OpenAiIngress } from "./ingress/server.js";
+import { ObservedClaudeCodeAuth } from "./providers/anthropic-observed.js";
+import { VERSION } from "./version.js";
+// Startup timing. Claude Desktop routes *all* its traffic through us in picker mode, so every
+// second before the socket is open is a second the app cannot reach anything (ERR_PROXY_-
+// CONNECTION_FAILED, observed 2026-09-14 after a reboot: 26s between exec and listening).
+// `timeOrigin` is process start, so `node` covers interpreter boot + module loading.
+const T_MODULE = Date.now();
+const T_EXEC = Math.round(performance.timeOrigin);
+const since = (t) => Date.now() - t;
+const home = homeDir();
+const logFile = process.env.CLAUDERIPPLE_NO_LOGFILE ? null : path.join(home, "logs", "router.log");
+let log = null;
+const store = new ConfigStore(undefined, (c, errors) => {
+    for (const e of errors)
+        (log ?? console).warn(`config: ${e}`);
+    log?.info(`config loaded: ${Object.keys(c.routes).length} routes, ${Object.keys(c.providers).length} providers, direct=${c.direct.map((d) => d.prefix).join(",") || "-"}`);
+    // Keep the Codex app's model list in step with the models we serve (only while `codex on` is in effect).
+    try {
+        if (codexEnabled())
+            writeCodexCatalog(ingressModels(c));
+    }
+    catch (e) {
+        log?.warn(`codex catalog: ${e.message}`);
+    }
+});
+const cfg0 = store.get();
+log = new Logger(logFile, cfg0.log.maxBytes, cfg0.log.keep, !!process.env.CLAUDERIPPLE_ECHO || !logFile);
+const T_CONFIG = Date.now();
+const certs = new CertStore(home);
+const requests = new RequestLog(path.join(home, "logs", "requests.jsonl"));
+try {
+    certs.register(cfg0.upstream, fs.readFileSync(path.join(home, "leaf.pem")), fs.readFileSync(path.join(home, "leaf.key")));
+}
+catch (e) {
+    log.error(`cannot load leaf.pem/leaf.key from ${home}: ${e.message}. Run the installer first.`);
+    process.exit(2);
+}
+// Picker mode: mint leaves for the app's own hosts so the first CONNECT is not slowed down.
+// Runs *after* listen(): minting generates an RSA key pair, and a client that has to wait a moment
+// for its first CONNECT is far better off than one whose connection is refused outright. Lazy
+// minting in the CONNECT path (proxy.ts) covers anything that arrives before this finishes.
+function premintLeaves() {
+    for (const h of terminateHosts(store.get())) {
+        if (certs.has(h))
+            continue;
+        try {
+            certs.contextFor(h);
+            log.info(`picker: certificate ready for ${h}`);
+        }
+        catch (e) {
+            log.error(`picker: cannot mint certificate for ${h}: ${e.message}`);
+        }
+    }
+}
+const health = new UpstreamHealth(() => store.get().health.maxConsecutiveUpstreamFailures, (n) => {
+    log.error(`${n} consecutive upstream connect failures; exiting ${EXIT_UPSTREAM_UNREACHABLE} for the supervisor to restart`);
+    setTimeout(() => process.exit(EXIT_UPSTREAM_UNREACHABLE), 100);
+});
+const observedClaudeCodeAuth = new ObservedClaudeCodeAuth(path.join(home, "claude-auth-observed.json"));
+const proxy = new Proxy({ config: () => store.get(), log, certs, health, home, requests, observedClaudeCodeAuth });
+const ingress = new OpenAiIngress({ config: () => store.get(), log, requests, home, observedClaudeCodeAuth });
+process.on("uncaughtException", (e) => log.error(`uncaught ${e.stack ?? e}`));
+process.on("unhandledRejection", (e) => log.error(`unhandled ${e?.stack ?? e}`));
+const DRAIN_MS = 90_000; // new model calls are refused during drain, so this is the longest single call we wait for; `clauderipple restart` waits 120s
+let draining = false;
+/**
+ * Stop accepting, let in-flight model calls finish, exit. Idempotent.
+ *
+ * Reachable two ways: a POSIX signal, and `POST /api/shutdown`. The second exists because Windows
+ * has no SIGTERM — `process.kill(pid, "SIGTERM")` terminates the target outright there, which
+ * would cut the drain — so a supervisor asks over the admin API instead and waits for the process
+ * to go. The same path serves both platforms rather than only being exercised on one.
+ */
+function beginDrain(reason) {
+    if (draining)
+        return;
+    draining = true;
+    log.info(`${reason}: draining, proxy=${proxy.stats.messagesInFlight} ingress=${ingress.stats.messagesInFlight} model calls`);
+    let lastReported = -1;
+    void Promise.all([
+        proxy.drain(DRAIN_MS, () => { }),
+        ingress.drain(DRAIN_MS, () => { }),
+    ])
+        .then(() => {
+        const left = proxy.stats.messagesInFlight + ingress.stats.messagesInFlight;
+        if (left !== lastReported)
+            log.info(`drain complete, exiting (model calls still open: ${left})`);
+        setTimeout(() => process.exit(0), 200).unref();
+    });
+}
+for (const sig of ["SIGINT", "SIGTERM"])
+    process.on(sig, () => beginDrain(sig));
+const statsEvery = 5 * 60 * 1000;
+setInterval(() => {
+    const s = proxy.stats;
+    const oi = ingress.stats;
+    log.info(`stats proxy=${s.started}/${s.completed}/${s.failed} inFlight=${s.inFlight} ingress=${oi.started}/${oi.completed}/${oi.failed} inFlight=${oi.inFlight} consecutiveUpstreamFailures=${health.consecutiveFailures}`);
+}, statsEvery).unref();
+proxy
+    .listen()
+    .then(async () => {
+    const c = store.get();
+    log.info(`clauderipple router listening on ${c.listen.host}:${c.listen.port} upstream=${c.upstream} home=${home}` +
+        ` (startup ${since(T_EXEC)}ms: node ${T_MODULE - T_EXEC}, config ${T_CONFIG - T_MODULE}, listen ${since(T_CONFIG)})`);
+    const ingressPort = await ingress.listen();
+    log.info(`clauderipple OpenAI ingress listening on 127.0.0.1:${ingressPort}`);
+    const admin = await startAdmin({
+        config: () => store.get(),
+        configFile: configPath(),
+        log: log,
+        stats: () => proxy.stats,
+        health: () => health.consecutiveFailures,
+        version: VERSION,
+        requests,
+        chatgpt: () => ({ quota: proxy.chatgptRateLimits, auth: proxy.chatgptAuthStatus() }),
+        picker: () => ({ enabled: !!store.get().picker?.enabled, hosts: terminateHosts(store.get()).slice(1), last: proxy.lastPickerInjection }),
+        observedClaudeCodeAuth,
+        shutdown: () => beginDrain("shutdown requested"),
+    });
+    log.info(`clauderipple admin GUI on http://127.0.0.1:${admin.port}/`);
+    setImmediate(premintLeaves);
+})
+    .catch((e) => {
+    log.error(`listen failed: ${e.message}`);
+    process.exit(2);
+});

package/dist/router/src/ingress/models.js

@@ -0,0 +1,29 @@
+// Models the OpenAI ingress can serve to Codex: Claude (native `anthropic` provider) and any
+// Anthropic-compatible provider's models, plus the routes that point at them. Shared by
+// `GET /v1/models` and by the Codex model catalog that puts these names in the Codex app picker.
+import { effortLevels } from "../admin.js";
+import { claudeSupportsEffort } from "./translate.js";
+export function ingressModels(cfg) {
+    const levels = effortLevels(cfg).providers;
+    const out = new Map();
+    const add = (id, provider, name, explicit) => {
+        if (out.has(id))
+            return;
+        const p = cfg.providers[provider];
+        if (!p || (p.type !== "anthropic" && p.type !== "anthropic-compatible"))
+            return;
+        let supported = explicit ?? levels[provider]?.models?.[id] ?? levels[provider]?.default ?? [];
+        if (p.type === "anthropic" && !claudeSupportsEffort(id))
+            supported = [];
+        out.set(id, { id, provider, ...(name ? { name } : {}), effortLevels: supported });
+    };
+    for (const [name, provider] of Object.entries(cfg.providers)) {
+        for (const model of provider.models ?? [])
+            add(model.id, name, model.name, model.effortLevels);
+    }
+    for (const [id, route] of Object.entries(cfg.routes)) {
+        const target = cfg.providers[route.provider]?.models?.find((m) => m.id === route.model);
+        add(id, route.provider, target?.name, target?.effortLevels);
+    }
+    return [...out.values()];
+}

package/dist/router/src/ingress/server.js

@@ -0,0 +1,400 @@
+// Local OpenAI-compatible ingress for Codex CLI and other OpenAI clients.
+// Binds loopback only. Client Authorization is accepted only as a local-presence check and is
+// intentionally never copied to the Anthropic-compatible upstream.
+import http from "node:http";
+import https from "node:https";
+import { resolve } from "../routing.js";
+import { PRESETS } from "../presets.js";
+import { resolveCompatibleCaps, sanitizeForCompatible } from "../compat.js";
+import { SseParser } from "../providers/chatgpt/sse.js";
+import { ingressModels } from "./models.js";
+import { requestId } from "../requestlog.js";
+import { credentialHeaderValues, redactErrorText } from "../redact.js";
+import { CLAUDE_CODE_IDENTITY, ClaudeCodeAuthStore, fromClaudeCodeToolName, nativeAnthropicHeaders, observedAnthropicHeaders, toClaudeCodeToolName } from "../providers/anthropic.js";
+import { ObservedClaudeCodeAuth } from "../providers/anthropic-observed.js";
+import { ResponsesEventMapper, chatToAnthropic, formatDataSse, formatSse, responsesEventsToChatChunks, responsesToAnthropic, responsesToChatCompletion, } from "./translate.js";
+const MAX_BODY = 64 * 1024 * 1024;
+const HOP_BY_HOP = new Set(["connection", "keep-alive", "proxy-connection", "transfer-encoding", "upgrade", "host", "content-length", "authorization"]);
+function openAiError(message, type = "invalid_request_error", code = null) {
+    return { error: { message, type, param: null, code } };
+}
+function sendJson(res, status, body) {
+    const text = JSON.stringify(body);
+    res.writeHead(status, { "content-type": "application/json; charset=utf-8", "content-length": String(Buffer.byteLength(text)) });
+    res.end(text);
+    return Buffer.byteLength(text);
+}
+function readBody(req) {
+    return new Promise((resolveP, reject) => {
+        const chunks = [];
+        let total = 0;
+        req.on("data", (chunk) => {
+            total += chunk.length;
+            if (total > MAX_BODY) {
+                req.destroy();
+                reject(new Error("request body too large"));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => resolveP(Buffer.concat(chunks)));
+        req.on("error", reject);
+    });
+}
+function contentType(headers) {
+    const value = headers.get("content-type");
+    return value ?? undefined;
+}
+function httpStatusError(status, body) {
+    let message = body.replace(/\s+/g, " ").slice(0, 500) || `Anthropic-compatible provider returned HTTP ${status}`;
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed.error?.message === "string")
+            message = parsed.error.message;
+        else if (typeof parsed.message === "string")
+            message = parsed.message;
+    }
+    catch {
+        // Preserve the compact text fallback.
+    }
+    const mapped = status === 401 || status === 403 ? 401 : status === 429 ? 429 : status >= 500 ? 502 : 400;
+    const type = mapped === 401 ? "authentication_error" : mapped === 429 ? "rate_limit_error" : mapped === 502 ? "api_error" : "invalid_request_error";
+    return { status: mapped, error: openAiError(message, type) };
+}
+function usage(mapper) {
+    return { input: mapper.usage.input_tokens - mapper.usage.input_tokens_details.cached_tokens, cached: mapper.usage.input_tokens_details.cached_tokens, output: mapper.usage.output_tokens };
+}
+function anthropicJsonEvents(value) {
+    const out = [{ type: "message_start", message: { usage: value.usage ?? {} } }];
+    const content = Array.isArray(value.content) ? value.content : [];
+    for (let index = 0; index < content.length; index++) {
+        const raw = content[index];
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            continue;
+        const block = raw;
+        out.push({ type: "content_block_start", index, content_block: block });
+        if (block.type === "text" && typeof block.text === "string")
+            out.push({ type: "content_block_delta", index, delta: { type: "text_delta", text: block.text } });
+        if (block.type === "tool_use")
+            out.push({ type: "content_block_delta", index, delta: { type: "input_json_delta", partial_json: JSON.stringify(block.input ?? {}) } });
+        out.push({ type: "content_block_stop", index });
+    }
+    out.push({ type: "message_delta", delta: { stop_reason: value.stop_reason ?? "end_turn" }, usage: value.usage ?? {} });
+    out.push({ type: "message_stop" });
+    return out;
+}
+export function openaiPort(cfg) {
+    return cfg.listen.openaiPort ?? cfg.listen.port + 2;
+}
+export class OpenAiIngress {
+    stats = { inFlight: 0, messagesInFlight: 0, started: 0, completed: 0, failed: 0 };
+    server;
+    agents = new Map();
+    sockets = new Set();
+    claudeCodeAuth;
+    deps;
+    draining = false;
+    constructor(deps) {
+        this.deps = deps;
+        this.claudeCodeAuth = new ClaudeCodeAuthStore(undefined, {
+            ...(deps.observedClaudeCodeAuth ? { observed: deps.observedClaudeCodeAuth } : {}),
+            ...(deps.home ? { home: deps.home } : {}),
+            log: (line) => deps.log.info(line),
+        });
+        this.server = http.createServer({ maxHeaderSize: 64 * 1024 }, (req, res) => void this.handle(req, res));
+        this.server.keepAliveTimeout = 65_000;
+        this.server.on("connection", (socket) => {
+            this.sockets.add(socket);
+            socket.once("close", () => this.sockets.delete(socket));
+        });
+        this.server.on("clientError", (_error, socket) => socket.end("HTTP/1.1 400 Bad Request\r\nconnection: close\r\n\r\n"));
+    }
+    listen() {
+        const cfg = this.deps.config();
+        const port = openaiPort(cfg);
+        return new Promise((resolveP, reject) => {
+            this.server.once("error", reject);
+            this.server.listen(port, "127.0.0.1", () => {
+                this.server.off("error", reject);
+                const address = this.server.address();
+                resolveP(address && typeof address === "object" ? address.port : port);
+            });
+        });
+    }
+    /** Stop new connections, reject new model work on keep-alive sockets, then close after model calls drain. */
+    async drain(maxMs, onProgress) {
+        this.draining = true;
+        this.server.close();
+        const start = Date.now();
+        while (this.stats.messagesInFlight > 0 && Date.now() - start < maxMs) {
+            onProgress?.(this.stats.messagesInFlight);
+            await new Promise((resolveP) => setTimeout(resolveP, 250));
+        }
+        for (const socket of this.sockets)
+            socket.destroy();
+    }
+    agentFor(key, protocol) {
+        const existing = this.agents.get(key);
+        if (existing)
+            return existing;
+        const agent = protocol === "https:" ? new https.Agent({ keepAlive: true, maxSockets: 64 }) : new http.Agent({ keepAlive: true, maxSockets: 64 });
+        this.agents.set(key, agent);
+        return agent;
+    }
+    async handle(req, res) {
+        const path = (req.url ?? "/").split("?")[0] ?? "/";
+        const method = req.method ?? "GET";
+        const isCall = method === "POST" && (path === "/v1/responses" || path === "/v1/chat/completions");
+        this.stats.started++;
+        this.stats.inFlight++;
+        if (isCall)
+            this.stats.messagesInFlight++;
+        const started = Date.now();
+        let record = { kind: "messages", source: "-", target: "-", provider: "-", stream: false };
+        let completed = false;
+        const finish = (status, bytes, extra = {}) => {
+            if (completed)
+                return;
+            completed = true;
+            this.stats.inFlight--;
+            if (isCall)
+                this.stats.messagesInFlight--;
+            if (status >= 200 && status < 400)
+                this.stats.completed++;
+            else
+                this.stats.failed++;
+            const ms = Date.now() - started;
+            const tagged = `${method} ${path} -> ${status} ${bytes}B ${(ms / 1000).toFixed(1)}s${extra.note ? ` ${extra.note}` : ""}`;
+            this.deps.log.info(`OPENAI ${tagged}`);
+            if (isCall) {
+                const entry = { ...record, id: requestId(), at: new Date(started).toISOString(), ms, status, ok: status >= 200 && status < 400 };
+                if (extra.usage)
+                    entry.usage = extra.usage;
+                if (extra.stopReason)
+                    entry.stopReason = extra.stopReason;
+                if (extra.note)
+                    entry.note = extra.note;
+                this.deps.requests.add(entry);
+            }
+        };
+        // Codex closes the socket the moment it reads `response.completed`, often before Anthropic's
+        // stream has ended on our side; that is a finished request, not an abort.
+        let terminal = null;
+        res.once("close", () => {
+            if (completed || res.writableEnded)
+                return;
+            if (terminal)
+                finish(terminal.status, terminal.bytes, { ...(terminal.usage ? { usage: terminal.usage } : {}), ...(terminal.stopReason ? { stopReason: terminal.stopReason } : {}), note: `${terminal.note ?? ""}; client closed after completion`.replace(/^; /, "") });
+            else
+                finish(499, 0, { note: "client closed" });
+        });
+        try {
+            if (path === "/v1/models" && method === "GET") {
+                const data = ingressModels(this.deps.config()).map((m) => ({ id: m.id, object: "model", created: 0, owned_by: m.provider }));
+                const bytes = sendJson(res, 200, { object: "list", data });
+                finish(200, bytes);
+                return;
+            }
+            if (!isCall) {
+                const bytes = sendJson(res, 404, openAiError("not found", "invalid_request_error"));
+                finish(404, bytes);
+                return;
+            }
+            if (this.draining) {
+                req.resume();
+                const bytes = sendJson(res, 503, openAiError("ClaudeRipple is restarting; retry", "server_error"));
+                finish(503, bytes, { note: "refused during drain" });
+                return;
+            }
+            // Loopback-only listener: a client may omit Authorization (the Codex desktop app has no shell
+            // env to carry a placeholder key). When present it must at least look like a bearer token.
+            const authorization = req.headers.authorization;
+            if (authorization !== undefined && (typeof authorization !== "string" || !/^Bearer\s+\S+$/i.test(authorization))) {
+                const bytes = sendJson(res, 401, openAiError("Malformed Authorization header; use Bearer <token> or omit it", "authentication_error"));
+                finish(401, bytes);
+                return;
+            }
+            let body;
+            try {
+                body = JSON.parse((await readBody(req)).toString("utf8"));
+            }
+            catch (error) {
+                const bytes = sendJson(res, 400, openAiError(`Invalid JSON request: ${error.message}`));
+                finish(400, bytes);
+                return;
+            }
+            if (!body || typeof body !== "object" || Array.isArray(body)) {
+                const bytes = sendJson(res, 400, openAiError("Request body must be a JSON object"));
+                finish(400, bytes);
+                return;
+            }
+            if (path === "/v1/responses" && body.previous_response_id != null) {
+                const bytes = sendJson(res, 400, openAiError("previous_response_id unsupported; ClaudeRipple OpenAI ingress is stateless", "invalid_request_error", "previous_response_id_unsupported"));
+                finish(400, bytes);
+                return;
+            }
+            const requested = typeof body.model === "string" ? body.model : "";
+            const cfg = this.deps.config();
+            // Unmapped models default to the native `anthropic` provider when one is configured, so a
+            // Codex user can name any Claude model directly (`-m claude-sonnet-5`) without a mapping.
+            const fallback = Object.entries(cfg.providers).find(([, p]) => p.type === "anthropic");
+            const route = resolve(requested, {}, cfg) ?? (fallback && requested ? { provider: fallback[0], model: requested, effort: undefined, tag: `${requested}->${requested}` } : null);
+            if (!route) {
+                const bytes = sendJson(res, 400, openAiError(`No ClaudeRipple route for model ${requested || "(missing)"}`, "invalid_request_error", "model_not_found"));
+                finish(400, bytes);
+                return;
+            }
+            const provider = cfg.providers[route.provider];
+            if (!provider) {
+                const bytes = sendJson(res, 500, openAiError(`Configured provider ${route.provider} is missing`, "server_error"));
+                finish(500, bytes);
+                return;
+            }
+            if (provider.type === "chatgpt" || provider.type === "openai-compatible") {
+                const bytes = sendJson(res, 400, openAiError(`${provider.type === "chatgpt" ? "ChatGPT" : "OpenAI-compatible"} provider is not available through OpenAI ingress`, "invalid_request_error", "unsupported_provider"));
+                finish(400, bytes, { note: `model ${requested} -> ${provider.type} provider unsupported` });
+                return;
+            }
+            const native = provider.type === "anthropic";
+            const prefix = native && provider.auth === "claude-code" ? CLAUDE_CODE_IDENTITY : undefined;
+            const anthropic = path === "/v1/responses" ? responsesToAnthropic(body, route.model, prefix) : chatToAnthropic(body, route.model, prefix);
+            const wire = native ? anthropic : sanitizeForCompatible(anthropic, resolveCompatibleCaps(provider.preset ? (() => { const preset = PRESETS.find((entry) => entry.id === provider.preset); return preset ? { effortLevels: preset.effortLevels, thinking: preset.thinking } : undefined; })() : undefined, provider.caps)).json;
+            if (native && provider.auth === "claude-code" && Array.isArray(wire.tools)) {
+                wire.tools = wire.tools.map((raw) => {
+                    const tool = raw;
+                    return typeof tool.name === "string" ? { ...tool, name: toClaudeCodeToolName(tool.name) } : tool;
+                });
+                const choice = wire.tool_choice;
+                if (choice?.type === "tool" && typeof choice.name === "string")
+                    wire.tool_choice = { ...choice, name: toClaudeCodeToolName(choice.name) };
+            }
+            const stream = body.stream === true;
+            wire.stream = stream;
+            record = { kind: "messages", source: requested, target: route.model, provider: route.provider, ...(route.effort ? { effort: route.effort } : {}), stream };
+            const kindNote = `openai-ingress ${path === "/v1/responses" ? "responses" : "chat"}`;
+            const outcome = await this.forward(res, provider, wire, route.model, path === "/v1/chat/completions", stream, (done) => { terminal = { ...done, note: kindNote }; });
+            finish(outcome.status, outcome.bytes, { ...(outcome.usage ? { usage: outcome.usage } : {}), ...(outcome.stopReason ? { stopReason: outcome.stopReason } : {}), note: `${kindNote}${outcome.note ? `; ${outcome.note}` : ""}` });
+        }
+        catch (error) {
+            if (completed)
+                return; // already recorded (e.g. client closed after the terminal event)
+            this.deps.log.warn(`OPENAI ingress error: ${error.message}`);
+            if (!res.headersSent) {
+                const bytes = sendJson(res, 502, openAiError(`Anthropic-compatible upstream unreachable: ${error.message}`, "api_error"));
+                finish(502, bytes);
+            }
+            else {
+                res.destroy();
+                finish(502, 0, { note: "response interrupted" });
+            }
+        }
+    }
+    async forward(res, provider, wire, model, chat, stream, onTerminal) {
+        const native = provider.type === "anthropic";
+        const upstream = new URL(native ? "https://api.anthropic.com" : provider.url);
+        const protocol = upstream.protocol === "https:" ? "https:" : "http:";
+        const body = Buffer.from(JSON.stringify(wire));
+        let authentication;
+        if (native && provider.auth === "claude-code") {
+            await this.claudeCodeAuth.refreshIfNeeded();
+            const auth = this.claudeCodeAuth.get();
+            if (auth instanceof Error)
+                return { status: 401, bytes: sendJson(res, 401, openAiError(auth.message, "authentication_error")), note: "Claude Code OAuth unavailable" };
+            authentication = auth.source === "observed" ? observedAnthropicHeaders(auth.observed) : nativeAnthropicHeaders(provider, auth.credentials);
+        }
+        else if (native) {
+            try {
+                authentication = nativeAnthropicHeaders(provider);
+            }
+            catch (error) {
+                return { status: 401, bytes: sendJson(res, 401, openAiError(error.message, "authentication_error")), note: "Anthropic API key unavailable" };
+            }
+        }
+        else
+            authentication = provider.headers ?? {};
+        const headers = { "content-type": "application/json", accept: stream ? "text/event-stream" : "application/json", "content-length": String(body.length), ...authentication };
+        const lib = protocol === "https:" ? https : http;
+        const response = await new Promise((resolveP, reject) => {
+            const request = lib.request({ protocol, hostname: upstream.hostname, port: Number(upstream.port) || (protocol === "https:" ? 443 : 80), method: "POST", path: `${upstream.pathname.replace(/\/+$/, "")}/v1/messages`, headers, agent: this.agentFor(native ? "https://api.anthropic.com" : provider.url, protocol), ...(protocol === "https:" ? { servername: upstream.hostname } : {}) }, resolveP);
+            request.once("error", reject);
+            res.once("close", () => request.destroy());
+            request.end(body);
+        });
+        if ((response.statusCode ?? 0) < 200 || (response.statusCode ?? 0) >= 300) {
+            const text = await new Promise((resolveP) => {
+                let output = "";
+                response.on("data", (chunk) => { output = (output + chunk.toString("utf8")).slice(0, 1024); });
+                response.on("end", () => resolveP(output));
+                response.on("error", () => resolveP(output));
+            });
+            const safeText = redactErrorText(text, credentialHeaderValues(Object.entries(headers)));
+            this.deps.log.warn(`OPENAI ingress upstream ${response.statusCode ?? 0} (${model}): ${safeText.slice(0, 400)}`);
+            const mapped = httpStatusError(response.statusCode ?? 502, safeText);
+            return { status: mapped.status, bytes: sendJson(res, mapped.status, mapped.error), note: `upstream ${response.statusCode ?? 0}` };
+        }
+        const mapper = new ResponsesEventMapper(model, native && provider.auth === "claude-code" ? fromClaudeCodeToolName : undefined);
+        let bytes = 0;
+        const writeResponses = (events) => {
+            for (const event of events)
+                bytes += Buffer.byteLength(formatSse(event)), res.write(formatSse(event));
+        };
+        const writeChat = (events) => {
+            for (const chunk of responsesEventsToChatChunks(events, mapper))
+                bytes += Buffer.byteLength(formatDataSse(chunk)), res.write(formatDataSse(chunk));
+        };
+        const write = chat ? writeChat : writeResponses;
+        if (stream) {
+            res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
+            if (!chat)
+                write(mapper.start());
+        }
+        if (/^text\/event-stream\b/i.test(contentType(new Headers(response.headers)) ?? "")) {
+            const parser = new SseParser();
+            const decoder = new TextDecoder();
+            await new Promise((resolveP, reject) => {
+                response.on("data", (chunk) => {
+                    for (const event of parser.feed(decoder.decode(chunk, { stream: true }))) {
+                        const mapped = mapper.feed(event);
+                        if (stream)
+                            write(mapped);
+                        if (stream && mapped.some((e) => e.type === "response.completed")) {
+                            if (chat) {
+                                bytes += Buffer.byteLength("data: [DONE]\n\n");
+                                res.write("data: [DONE]\n\n");
+                            }
+                            onTerminal?.({ status: 200, bytes, usage: usage(mapper), stopReason: mapper.output.some((item) => item.type === "function_call") ? "tool_use" : "end_turn" });
+                        }
+                    }
+                });
+                response.on("end", resolveP);
+                response.on("error", reject);
+            });
+        }
+        else {
+            const raw = await new Promise((resolveP, reject) => {
+                const chunks = [];
+                response.on("data", (chunk) => chunks.push(chunk));
+                response.on("end", () => resolveP(Buffer.concat(chunks)));
+                response.on("error", reject);
+            });
+            const parsed = JSON.parse(raw.toString("utf8"));
+            const mapped = anthropicJsonEvents(parsed).flatMap((event) => mapper.feed(event));
+            if (stream)
+                write(mapped);
+        }
+        const tail = mapper.finish();
+        if (stream) {
+            write(tail);
+            if (chat && tail.length) {
+                bytes += Buffer.byteLength("data: [DONE]\n\n");
+                res.write("data: [DONE]\n\n");
+            }
+            res.end();
+        }
+        else {
+            const result = chat ? responsesToChatCompletion(mapper) : mapper.response("completed");
+            bytes = sendJson(res, 200, result);
+        }
+        return { status: 200, bytes, usage: usage(mapper), stopReason: mapper.output.some((item) => item.type === "function_call") ? "tool_use" : "end_turn" };
+    }
+}