clauderipple 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.5.1 — 2026-09-28
+
+### Fixed
+
+- **Prompt caching on anthropic-compatible providers** (#36, #37, by @grapefruit0205).
+  Claude Code's billing header opens the system prompt and changes every turn, so a
+  vendor with a plain prefix cache cached nothing after it: DeepSeek via Alibaba Bailian
+  reported 0.3% over two days. The header is now dropped for these providers, as it
+  already was for the translated ones; measured 99% on the next turns.
+- **Switching a session from a translated model to Claude.** The translated providers
+  return reasoning as unsigned, sometimes empty `thinking` blocks, and Anthropic refused
+  every turn after the switch with "each thinking block must contain thinking". Unsigned
+  thinking is now dropped before a request reaches Anthropic.
+- **Windows install when the user name equals the computer name** (#38, reported by
+  @haemilchu). The scheduled task is registered as `DOMAIN\user`; the bare name did not
+  resolve and registration failed with 0x80070057 before `settings.json` was written.
+- **Windows reinstall no longer re-registers a correct task.** The check read two
+  battery settings under names the task object does not have, so it never matched and
+  every install registered again — what fails on machines that protect the task.
+  Checked in a Windows 11 VM.
+- **`clauderipple` in a new PowerShell window** (#38). The installer leaves no `.ps1`
+  shim, so PowerShell runs the `.cmd` under the default execution policy.
+
 ## 0.5.0 — 2026-09-24
 
 Linux, and four fixes from the first outside contributions.

package/dist/cli/src/schtasks.js

@@ -39,6 +39,25 @@ function run(script) {
         return { ok: false, out: `${err.stdout?.toString() ?? ""}${err.stderr?.toString() ?? ""}`.trim() };
     }
 }
+/**
+ * The account the task runs as, qualified with its domain. A bare name is looked up as a machine
+ * name too, so on a local account named after its computer (user X on host X) it resolves to
+ * nothing and Register-ScheduledTask fails with 0x80070057 (#38). `X\X` names the user.
+ */
+export function taskUser(username = os.userInfo().username, domain = process.env.USERDOMAIN) {
+    return domain ? `${domain}\\${username}` : username;
+}
+/**
+ * Windows stores the qualified name as given on the trigger but the bare one on the principal
+ * (reported in #38), and a task registered before that fix carries the bare name on both, so
+ * either spelling of the same account is a match.
+ */
+function sameAccount(stored, expected) {
+    if (stored === undefined)
+        return false;
+    const bare = expected.slice(expected.lastIndexOf("\\") + 1);
+    return [expected, bare].some((name) => name.toLowerCase() === stored.toLowerCase());
+}
 export function taskDefinitionMatches(value, expected) {
     if (!value || typeof value !== "object")
         return false;
@@ -46,12 +65,12 @@ export function taskDefinitionMatches(value, expected) {
     return (task.actionCount === 1 &&
         task.execute?.toLowerCase() === "powershell.exe" &&
         task.arguments === expected.arguments &&
-        task.userId?.toLowerCase() === expected.userId.toLowerCase() &&
+        sameAccount(task.userId, expected.userId) &&
         task.runLevel === 0 &&
         task.logonType === 3 &&
         task.triggerCount === 1 &&
         task.triggerType === "MSFT_TaskLogonTrigger" &&
-        task.triggerUserId?.toLowerCase() === expected.userId.toLowerCase() &&
+        sameAccount(task.triggerUserId, expected.userId) &&
         task.restartCount === 99 &&
         task.restartInterval === "PT1M" &&
         task.executionTimeLimit === "PT0S" &&
@@ -98,30 +117,38 @@ function writeLauncher(opts) {
     fs.writeFileSync(launcher, lines.join("\r\n") + "\r\n");
     return launcher;
 }
+/**
+ * The registered task in the shape taskDefinitionMatches reads, or null. The settings object has
+ * no AllowStartIfOnBatteries/DontStopIfGoingOnBatteries — the switches of the same names set
+ * DisallowStartIfOnBatteries/StopIfGoingOnBatteries to false — so reading the switch names gave
+ * null, and until #38 no existing task ever matched: every install re-registered.
+ */
+export function existingTaskDefinition() {
+    const existing = run([
+        `$t = Get-ScheduledTask -TaskName ${ps(taskName())} -ErrorAction SilentlyContinue`,
+        `if ($null -eq $t) { 'null'; exit 0 }`,
+        `$a = @($t.Actions); $p = $t.Principal; $tr = @($t.Triggers); $s = $t.Settings`,
+        `[pscustomobject]@{ actionCount = $a.Count; execute = $a[0].Execute; arguments = $a[0].Arguments; userId = $p.UserId; runLevel = [int]$p.RunLevel; logonType = [int]$p.LogonType; triggerCount = $tr.Count; triggerType = $tr[0].CimClass.CimClassName; triggerUserId = $tr[0].UserId; restartCount = $s.RestartCount; restartInterval = [string]$s.RestartInterval; executionTimeLimit = [string]$s.ExecutionTimeLimit; multipleInstances = [int]$s.MultipleInstances; allowStartIfOnBatteries = $s.DisallowStartIfOnBatteries -eq $false; dontStopIfGoingOnBatteries = $s.StopIfGoingOnBatteries -eq $false } | ConvertTo-Json -Compress`,
+    ].join("; "));
+    if (!existing.ok)
+        return null;
+    try {
+        return JSON.parse(existing.out);
+    }
+    catch {
+        // A malformed inspection result is not trusted; the caller falls through to registration.
+        return null;
+    }
+}
 export function installAgent(opts) {
     const launcher = writeLauncher({ program: opts.program, args: opts.args ?? [], home: opts.home, ...(opts.env ? { env: opts.env } : {}) });
-    const user = `${os.userInfo().username}`;
+    const user = taskUser();
     const actionArgs = `-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "${launcher}"`;
     // Updating the generated launcher does not require re-registering an otherwise correct task.
     // Some Windows installations protect an existing per-user task's security descriptor so that
     // even the same unelevated user gets E_ACCESSDENIED from Register-ScheduledTask -Force. Treat the
     // verified existing definition as success; never silently accept a same-named foreign task.
-    const existing = run([
-        `$t = Get-ScheduledTask -TaskName ${ps(taskName())} -ErrorAction SilentlyContinue`,
-        `if ($null -eq $t) { 'null'; exit 0 }`,
-        `$a = @($t.Actions); $p = $t.Principal; $tr = @($t.Triggers); $s = $t.Settings`,
-        `[pscustomobject]@{ actionCount = $a.Count; execute = $a[0].Execute; arguments = $a[0].Arguments; userId = $p.UserId; runLevel = [int]$p.RunLevel; logonType = [int]$p.LogonType; triggerCount = $tr.Count; triggerType = $tr[0].CimClass.CimClassName; triggerUserId = $tr[0].UserId; restartCount = $s.RestartCount; restartInterval = [string]$s.RestartInterval; executionTimeLimit = [string]$s.ExecutionTimeLimit; multipleInstances = [int]$s.MultipleInstances; allowStartIfOnBatteries = $s.AllowStartIfOnBatteries; dontStopIfGoingOnBatteries = $s.DontStopIfGoingOnBatteries } | ConvertTo-Json -Compress`,
-    ].join("; "));
-    let definition = null;
-    if (existing.ok) {
-        try {
-            definition = JSON.parse(existing.out);
-        }
-        catch {
-            // A malformed inspection result is not trusted; fall through to registration.
-        }
-    }
-    if (taskDefinitionMatches(definition, { arguments: actionArgs, userId: user }))
+    if (taskDefinitionMatches(existingTaskDefinition(), { arguments: actionArgs, userId: user }))
         return launcher;
     const script = [
         `$ErrorActionPreference = 'Stop'`,

package/dist/router/src/compat.js

@@ -66,6 +66,30 @@ function stripCacheControl(value) {
     }
     return { value: out, count };
 }
+// Claude Code's first system block is Anthropic billing telemetry
+// ("x-anthropic-billing-header: … cch=… cc_prompt_id=… cc_turn_origin=…"). The CLI adds those
+// per-turn fields only when it believes it is talking to api.anthropic.com — which, behind this
+// router's MITM proxy, it always does — and their values change on every turn. Left in, the block
+// sits at the head of the prefix and nothing after it is ever cached by a vendor that keeps a
+// plain stable-prefix cache. Measured 2026-09-25 on Bailian DeepSeek: all 399 requests of two days
+// reported cached=0 over 69.8M input tokens; two identical bodies cached 3,584 of ~3,700 tokens
+// with the block held constant and 0 on all three calls with its fields varied per request. The
+// translated providers drop it for the same reason (`systemText` in providers/chatgpt/translate.ts,
+// measured 2026-09-13), and it means nothing to a provider that is not Anthropic.
+const BILLING_BLOCK = /^x-anthropic-billing-header:/;
+function stripBillingHeader(system) {
+    if (typeof system === "string") {
+        const value = system.replace(/^x-anthropic-billing-header:[^\n]*\n*/, "");
+        return { value, removed: value === system ? 0 : 1 };
+    }
+    if (!Array.isArray(system))
+        return { value: system, removed: 0 };
+    const value = system.filter((block) => {
+        const source = record(block);
+        return !(source && typeof source.text === "string" && BILLING_BLOCK.test(source.text));
+    });
+    return { value, removed: system.length - value.length };
+}
 /**
  * Remove extensions Claude Code sends only to Anthropic. This deliberately retains content
  * verbatim except cache_control when the provider explicitly rejects prompt caching.
@@ -160,6 +184,17 @@ export function sanitizeForCompatible(json, caps) {
             changes.push("tool_choice");
         }
     }
+    if ("system" in out) {
+        const next = stripBillingHeader(out.system);
+        if (next.removed > 0) {
+            // An emptied array would be a system the provider has to reject; the field goes with the block.
+            if (Array.isArray(next.value) && next.value.length === 0)
+                delete out.system;
+            else
+                out.system = next.value;
+            changes.push(`billing_header×${next.removed}`);
+        }
+    }
     if (!caps.cacheControl) {
         let removed = 0;
         for (const key of ["system", "messages"]) {

package/dist/router/src/proxy.js

@@ -35,6 +35,7 @@ import { injectPickerModels, isBootstrapPath } from "./picker.js";
 import { ResponseUsageTap } from "./requestlog.js";
 import { credentialHeaderValues, redactErrorText, redactHeaders } from "./redact.js";
 import { ClaudeAccountAuthPool } from "./providers/anthropic-account-pool.js";
+import { dropForeignThinking } from "./thinking.js";
 const MAX_BODY = 64 * 1024 * 1024;
 const HOP_BY_HOP = new Set(["connection", "keep-alive", "proxy-connection", "transfer-encoding", "upgrade", "host", "content-length"]);
 // The caller's own Anthropic credentials. A routed request authenticates as the provider, so these
@@ -740,6 +741,7 @@ export class Proxy {
                     finish("401", out.length, "no usable Claude account");
                     return;
                 }
+                dropForeignThinking(json);
                 body = Buffer.from(JSON.stringify(json));
                 chosen = this.pool.pick(route.provider, credentials, conversationKey(json));
                 const using = chosen ?? credentials[0];
@@ -831,6 +833,9 @@ export class Proxy {
         else if (isApiHost) {
             target = { protocol: "https:", host: cfg.upstream, port: 443, agent: this.upstreamAgent, extraHeaders: {} };
             tag = `PASS ${typeof model === "string" ? model : "-"}`;
+            // Passthrough stays byte-exact unless another model's thinking would get the turn refused.
+            if (json && dropForeignThinking(json) > 0)
+                body = Buffer.from(JSON.stringify(json));
         }
         else {
             target = { protocol: "https:", host: reqHost, port: 443, agent: this.agentFor(`host:${reqHost}`, "https:"), extraHeaders: {} };

package/dist/router/src/thinking.js

@@ -0,0 +1,39 @@
+// Thinking blocks another model left in a conversation that is now going to Anthropic.
+//
+// The translated providers hand the CLI their reasoning as `thinking` blocks with no signature —
+// there is no Anthropic signature to give — and an empty `thinking` when the upstream sent a
+// reasoning item without a summary. The CLI keeps them in the transcript, so a session switched
+// from such a model to a Claude model replays them, and Anthropic refuses the whole request:
+// "messages.2.content.0.thinking: each thinking block must contain thinking" (measured 2026-09-28,
+// gpt-6-astra → claude-opus-5-5, every retry of the turn). A block Anthropic wrote always carries a
+// signature, so an unsigned one is foreign and goes; the translated providers drop thinking from
+// replayed history for the same reason (ARCHITECTURE §4, "Cache-safety decisions").
+function foreign(block) {
+    const b = block;
+    return !!b && typeof b === "object" && b.type === "thinking" && !(typeof b.signature === "string" && b.signature.length > 0);
+}
+/**
+ * Removes unsigned thinking blocks from assistant turns, in place, and returns how many went.
+ * A turn left with no content is removed with them: Anthropic refuses an empty assistant turn,
+ * and joins the two user turns that then meet.
+ */
+export function dropForeignThinking(json) {
+    const messages = json.messages;
+    if (!Array.isArray(messages))
+        return 0;
+    let removed = 0;
+    const kept = [];
+    for (const message of messages) {
+        if (message?.role !== "assistant" || !Array.isArray(message.content) || !message.content.some(foreign)) {
+            kept.push(message);
+            continue;
+        }
+        const content = message.content.filter((block) => !foreign(block));
+        removed += message.content.length - content.length;
+        if (content.length > 0)
+            kept.push({ ...message, content });
+    }
+    if (removed > 0)
+        json.messages = kept;
+    return removed;
+}

package/dist/router/src/version.js

@@ -5,4 +5,4 @@
 // from the manifests. Until 0.1.1 the router and the CLI each carried their own literal, and both
 // still said "0.1.0" in the 0.1.1 release: after an update nobody could tell which router was
 // running, and the tray app had nothing to compare (2026-09-15, reported from a Windows install).
-export const VERSION = "0.5.0";
+export const VERSION = "0.5.1";

package/docs/ARCHITECTURE.md

@@ -835,6 +835,7 @@ what we do not have yet — so that adding a provider does not start with readin
 | OpenCode Go's relay answered `403 {"message":"Error from provider (Console Go): Upstream request failed: …"}` during a few seconds of its own trouble. The 403 was classified as an auth failure, which both cooled the credential for 60s **and** removed it from the retry candidate list, so the router could not retry inside the turn and answered the user with what read as an authentication error. Five times in a day, each cleared by asking again (2026-09-21) | A 403 whose body reports an upstream failure is charged a **zero** cooldown. It is not a statement about the credential, and any wait at all moves the conversation off a key that did nothing and takes its prompt cache with it (§4). With no cooldown the credential stays retryable, so the turn is answered on the next attempt instead of becoming a user-visible failure. The body is the only way to tell this apart from a real 403 (policy, region, blocked model), so it is read for 403 and only 403. |
 | The same relay 403 kept reaching the user after that fix, because it was the wrong layer: DeepSeek runs on `openai-compatible`, whose adapter was **never** retried at all — the in-turn retry lives only in the anthropic-compatible wire path (`nextCredential`), and `credentialsOf` gives a translated provider exactly one credential and no fallback. So a relay hiccup had nowhere to go but the user (2026-09-21, root cause of the day's repeated "authentication failed") | Every translated adapter retries the `fetch` **before** any status or byte is written, so the turn is still replaceable (§4 "the first byte commits the turn"). `fetchWithRetry` retries only `transient` verdicts — connect failures, 5xx, and a 403 reporting a broken upstream — to the ceiling of 10 attempts the CLI itself uses, with a 250ms→2s backoff. A 401/429 is **not** retried: the adapter holds one credential, so asking the key that just refused the identical request again only delays the error. `classify` is reused for the judgement, with `kind === "transient"` narrowing a pool's answer to an adapter's. |
 | Workers on muse-spark-1.3 "stalled for minutes, then died": 84 of 1,815 turns (2026-09-18..22) waited a median 58s — five exactly 300s — and then the upstream closed the stream with **no** `response.completed`, no usage, no text. Both translated adapters finished such a stream as `end_turn` with whatever had arrived (the ChatGPT one by a comment saying so), so Claude Code received an empty, successful turn, did not retry, and the subagent ended with nothing. Same shape on `chatgpt` (gpt-6-astra, 12 turns, median 105s) and DeepSeek. A non-streaming failure was likewise answered 200 with the fragment | A turn is finished only when the vendor says so: `response.completed`/`response.incomplete` on Responses, a `finish_reason` or `[DONE]` on Chat. A stream that closes without one, or breaks mid-read, ends in an SSE `overloaded_error` — the one mid-stream error Claude Code retries on its own (CLI 2.1.278 matches `"type":"overloaded_error"` in the message; `api_error` is final). Non-streaming turns answer 529 with the same error, and the request record says the turn failed. The upstream stall itself is the vendor's; what must not happen here is turning it into an answer. |
+| A session switched from gpt-6-astra to claude-opus-5-5 failed every turn with `400 messages.2.content.0.thinking: each thinking block must contain thinking`: the translated adapters hand the CLI reasoning as `thinking` blocks with no signature (and no text when the reasoning item had no summary), the CLI keeps them, and passthrough replayed them to Anthropic (2026-09-28) | Before a request reaches Anthropic (`PASS` and the account-pool provider), assistant `thinking` blocks without a signature are dropped (`thinking.ts`) — Anthropic's own always carry one — and a turn left empty goes with them. Passthrough stays byte-exact when there is nothing to drop. |
 
 ## 6. Blocked paths (measured, do not retry)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clauderipple",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Use GPT (ChatGPT Plus/Pro), DeepSeek and 400+ other models in the Claude Desktop Code tab and Claude Code while staying signed in to your Claude subscription — no third-party gateway mode. Several ChatGPT accounts that take over when one runs out, in Codex too.",
   "license": "GPL-3.0-only",
   "workspaces": [