clauderipple 0.9.0 → 0.9.2

package/dist/router/src/providers/grok/auth.js

@@ -0,0 +1,289 @@
+// Grok subscription sign-in, borrowed from the Grok CLI. Nothing here signs anyone in.
+//
+//   <grok home>/auth.json   written by `grok login` ($GROK_HOME, else ~/.grok). One entry per issuer,
+//                           keyed `https://auth.x.ai::<id>`; each has `key` (the session token, sent
+//                           as a bearer), `expires_at` (RFC 3339) and a `refresh_token`.
+//
+// Read-only, for the same reason as `borrow-codex`: the CLI refreshes its grant under a lock of its
+// own (`auth lock` in ~/.grok/logs), and if that refresh rotates the refresh token — not measured —
+// refreshing it from here would race the CLI and could sign it out. Measured 2026-10-08 on CLI 1.0.46: a session token lives six hours, and a running
+// CLI refreshes it about five minutes before expiry (`GROK_AUTH_EARLY_INVALIDATION_SECS`, default 300).
+// With no CLI running the file simply goes stale. So when the token is near its end the router asks
+// the CLI to do it: `grok models` with that same variable set to our own threshold makes the CLI see
+// the token as expiring, refresh it under its lock, and write the file — which we then read again.
+// `grok models` was measured to do exactly this (expiry moved six hours, file rewritten).
+import { execFile } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/** `x-grok-client-version` when the CLI cannot be asked. The proxy refuses a request without one (426). */
+export const GROK_CLIENT_VERSION_FALLBACK = "1.0.46";
+/** What the user can do about a missing or rejected session, appended to the errors they read. */
+export const GROK_AUTH_HINT = "sign in with `grok login`, or run `grok` once so the CLI refreshes its session";
+export function grokHome(env = process.env) {
+    return env.GROK_HOME ? env.GROK_HOME : path.join(os.homedir(), ".grok");
+}
+export function grokAuthPath(home) {
+    return path.join(home, "auth.json");
+}
+/**
+ * The session token in `file`: of the entries carrying one, the one that expires last. The entry key
+ * is the issuer plus an id, and the CLI's own README reads a different key than the one it writes
+ * (`https://accounts.x.ai/sign-in` vs `https://auth.x.ai::…`, 1.0.46), so no key is assumed.
+ */
+export function readGrokToken(file) {
+    let doc;
+    try {
+        doc = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!doc || typeof doc !== "object" || Array.isArray(doc))
+        return null;
+    let best = null;
+    for (const value of Object.values(doc)) {
+        if (!value || typeof value !== "object")
+            continue;
+        const entry = value;
+        // A key that cannot be a header value would only fail inside fetch, which quotes it in the error.
+        if (typeof entry.key !== "string" || !entry.key || /[\0\r\n]|[^\0-\xff]/.test(entry.key))
+            continue;
+        const expiresAt = typeof entry.expires_at === "string" ? Date.parse(entry.expires_at) || 0 : 0;
+        if (best && expiresAt <= best.expiresAt)
+            continue;
+        best = { key: entry.key, expiresAt, ...(typeof entry.email === "string" ? { email: entry.email } : {}) };
+    }
+    return best;
+}
+function executable(file) {
+    try {
+        fs.accessSync(file, fs.constants.X_OK);
+        return fs.statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The `grok` binary. The router runs under launchd with PATH=/usr/bin:/bin:/usr/sbin:/sbin (measured
+ * 2026-10-08), where the CLI never is, so the installer's own location comes before PATH.
+ */
+export function findGrokCli(home, explicit, env = process.env) {
+    if (explicit)
+        return executable(explicit) ? explicit : null;
+    const name = process.platform === "win32" ? "grok.exe" : "grok";
+    const candidates = [
+        path.join(home, "bin", name),
+        ...(env.PATH ?? "").split(path.delimiter).filter(Boolean).map((dir) => path.join(dir, name)),
+        path.join(env.HOME || os.homedir(), ".local", "bin", name),
+    ];
+    return candidates.find(executable) ?? null;
+}
+const runCli = (file, args, env, timeoutMs) => new Promise((resolve, reject) => {
+    execFile(file, args, { env, timeout: timeoutMs, windowsHide: true, maxBuffer: 1024 * 1024 }, (error, stdout) => {
+        if (error)
+            reject(error);
+        else
+            resolve(String(stdout));
+    });
+});
+export class GrokAuthError extends Error {
+}
+/**
+ * Bounded by the CLI's own: it waits up to 25s for its auth lock (`auth lock: attempting acquire
+ * (timeout=25000ms)`), so a refresh that cannot finish in 30s is not going to.
+ */
+const REFRESH_TIMEOUT_MS = 30_000;
+/**
+ * A rejected token is not ours to keep, so the refresh that follows one treats whatever is there as
+ * expiring. A day is past any session's six hours, and is the value measured to make the CLI refresh.
+ */
+const FORCE_REFRESH_SECS = 24 * 3600;
+/**
+ * A proxy that keeps refusing a freshly minted token is refusing the account, not the token, and
+ * forcing a refresh for every turn would only churn the grant. The CLI's README states the same rule
+ * for its own credential helpers: a token rejected within 30s of being fetched is not fetched again.
+ */
+const FORCED_REFRESH_GAP_MS = 60_000;
+/**
+ * A proactive refresh that ran and still left the token short (the CLI failed, or the IdP is down) is
+ * not run again for every turn in the minutes the token has left: each run can take 30s.
+ */
+const REFRESH_RETRY_GAP_MS = 60_000;
+export class GrokAuth {
+    file;
+    opts;
+    refreshAheadMs;
+    run;
+    now;
+    env;
+    cached;
+    refreshing;
+    lastForcedAt = -Infinity;
+    lastAttemptAt = -Infinity;
+    version;
+    constructor(opts) {
+        this.opts = opts;
+        this.file = grokAuthPath(opts.home);
+        this.refreshAheadMs = opts.refreshAheadMs ?? 10 * 60_000;
+        this.run = opts.run ?? runCli;
+        this.now = opts.now ?? Date.now;
+        this.env = opts.env ?? process.env;
+    }
+    /** The token on disk, read again only when the file changes. One stat per call. */
+    current() {
+        let st;
+        try {
+            st = fs.statSync(this.file);
+        }
+        catch {
+            this.cached = undefined;
+            return null;
+        }
+        if (this.cached && this.cached.mtimeMs === st.mtimeMs && this.cached.size === st.size)
+            return this.cached.token;
+        const token = readGrokToken(this.file);
+        this.cached = { mtimeMs: st.mtimeMs, size: st.size, token };
+        return token;
+    }
+    usable(token, marginMs) {
+        return token !== null && (token.expiresAt === 0 || token.expiresAt - this.now() > marginMs);
+    }
+    /**
+     * A token with at least `refreshAheadMs` to live, asking the CLI for a fresh one when the file's has
+     * less. A token that is merely close to its end is still used when the CLI cannot refresh it: it
+     * works until it expires, and refusing it early would fail a turn that could have run.
+     */
+    async token() {
+        const now = this.current();
+        if (this.usable(now, this.refreshAheadMs))
+            return now;
+        if (now === null && !fs.existsSync(this.file))
+            throw new GrokAuthError(`no Grok session at ${this.file}: ${GROK_AUTH_HINT}`);
+        // A refresh already running is joined. Otherwise one that failed less than a minute ago is not
+        // run again, whether or not the token has expired since: with the IdP down every turn would
+        // spawn the CLI for nothing. The file is still read again, in case the CLI fixed it on its own.
+        if (this.refreshing)
+            await this.refreshing;
+        else if (this.now() - this.lastAttemptAt >= REFRESH_RETRY_GAP_MS)
+            await this.refresh(Math.ceil(this.refreshAheadMs / 1000));
+        const after = this.current();
+        if (this.usable(after, 0))
+            return after;
+        throw new GrokAuthError(`the Grok session in ${this.file} has expired: ${GROK_AUTH_HINT}`);
+    }
+    /**
+     * After the proxy refused `key`: whether a different, live token is available now. The file is read
+     * first, since the CLI may already have rotated it; only when it still holds the refused token is
+     * the CLI asked to refresh, and that refresh is forced — the token was refused, however long it had.
+     */
+    async rejected(key) {
+        const replaced = () => {
+            const now = this.current();
+            return now !== null && now.key !== key && this.usable(now, 0);
+        };
+        if (replaced())
+            return true;
+        // Concurrent turns refused together share the refresh the first one started, rather than the
+        // second one finding the once-a-minute limit spent and failing.
+        if (this.refreshing) {
+            await this.refreshing;
+            if (replaced())
+                return true;
+        }
+        if (this.now() - this.lastForcedAt < FORCED_REFRESH_GAP_MS)
+            return false;
+        this.lastForcedAt = this.now();
+        await this.refresh(FORCE_REFRESH_SECS);
+        return replaced();
+    }
+    /** One refresh at a time: concurrent turns that all find the token stale share the CLI run. */
+    refresh(earlySecs) {
+        if (this.refreshing)
+            return this.refreshing;
+        this.lastAttemptAt = this.now();
+        const cli = findGrokCli(this.opts.home, this.opts.cli, this.env);
+        if (!cli) {
+            this.opts.log.warn(`grok: session needs a refresh but no grok CLI was found${this.opts.cli ? ` at ${this.opts.cli}` : ""}`);
+            return Promise.resolve();
+        }
+        const env = {
+            ...this.env,
+            GROK_AUTH_EARLY_INVALIDATION_SECS: String(earlySecs),
+            // The CLI reads its session from $GROK_HOME; a home given in the config has to reach it.
+            ...(this.opts.home !== grokHome(this.env) ? { GROK_HOME: this.opts.home } : {}),
+        };
+        const started = this.now();
+        this.refreshing = this.run(cli, ["models"], env, REFRESH_TIMEOUT_MS)
+            .then(() => this.opts.log.info(`grok: session refreshed through the CLI in ${this.now() - started}ms`))
+            .catch((error) => this.opts.log.warn(`grok: CLI session refresh failed: ${error.message.split("\n")[0]?.slice(0, 200)}`))
+            // The CLI rewrites the file with a token of the same length, possibly within the mtime's
+            // resolution, so the read after a refresh must not trust the stat-keyed cache.
+            .finally(() => { this.refreshing = undefined; this.cached = undefined; });
+        return this.refreshing;
+    }
+    /**
+     * `x-grok-client-version`: the installed CLI's own version, so the proxy sees the client the token
+     * was issued to. Read again when the binary changes: an update either replaces the file the symlink
+     * names or rewrites the binary in place, so the key is the resolved path with its mtime and size.
+     */
+    clientVersion(pinned = this.opts.clientVersion) {
+        if (pinned)
+            return Promise.resolve(pinned);
+        const cli = findGrokCli(this.opts.home, this.opts.cli, this.env);
+        let binary = "";
+        try {
+            if (cli) {
+                const real = fs.realpathSync(cli);
+                const st = fs.statSync(real);
+                binary = `${real}\0${st.mtimeMs}\0${st.size}`;
+            }
+        }
+        catch {
+            binary = cli ?? ""; /* keep the unresolved name */
+        }
+        if (this.version && this.version.binary === binary)
+            return this.version.value;
+        const value = !cli
+            ? Promise.resolve(GROK_CLIENT_VERSION_FALLBACK)
+            : this.run(cli, ["--version"], this.env, 10_000)
+                .then((out) => /\b(\d+\.\d+\.\d+)\b/.exec(out)?.[1] ?? GROK_CLIENT_VERSION_FALLBACK)
+                .catch((error) => {
+                this.opts.log.warn(`grok: \`grok --version\` failed (${error.message.split("\n")[0]?.slice(0, 120)}); sending ${GROK_CLIENT_VERSION_FALLBACK}`);
+                return GROK_CLIENT_VERSION_FALLBACK;
+            });
+        this.version = { binary, value };
+        return value;
+    }
+}
+const shared = new Map();
+/**
+ * The `GrokAuth` for one Grok home and binary, made once per process. The refresh is single-flight
+ * and backed off per instance, so the dashboard's probes and the turns that use the same session
+ * have to share one, or two of them spawn two CLI runs against the same lock. A pinned client version
+ * is not part of it: that is passed to `clientVersion()` by whoever sends the header.
+ */
+export function sharedGrokAuth(opts) {
+    const real = (file) => {
+        try {
+            return fs.realpathSync(file);
+        }
+        catch {
+            return file; /* not there yet: the resolved path names it */
+        }
+    };
+    const home = real(path.resolve(opts.home));
+    // The binary that would actually run, so a config that names the CLI the lookup would find anyway
+    // still shares the instance of one that leaves it out.
+    const cli = findGrokCli(home, opts.cli, opts.env);
+    const key = JSON.stringify([home, cli ? real(cli) : opts.cli ?? ""]);
+    let auth = shared.get(key);
+    if (!auth) {
+        // Built on the resolved home: one created through a symlink must not follow the link elsewhere
+        // later while still being found under the old target.
+        auth = new GrokAuth({ ...opts, home });
+        shared.set(key, auth);
+    }
+    return auth;
+}

package/dist/router/src/providers/grok/catalog.js

@@ -0,0 +1,52 @@
+// The models a Grok subscription offers, as the CLI chat proxy lists them (`GET /v1/models`).
+//
+// Measured 2026-10-08 (CLI 1.0.46, SuperGrok): four models, each with `context_window`,
+// `reasoning_efforts` (`[{id, value, label, description, default}]`, listed high to low) and
+// `api_backend: "responses"`. The listing is the truth about the ladder: grok-4.5 lists low..high,
+// the others low..xhigh. (Chat Completions accepted `xhigh` on grok-4.5 too, but a 200 means only
+// "not refused" — §4c — so the listing wins.) `max` and the string "none" are refused with 400
+// `invalid-argument` on every model; omitting the field is accepted and the model's default (`high`)
+// applies.
+export const GROK_DEFAULT_URL = "https://cli-chat-proxy.grok.com/v1";
+/** The ladder for a model the listing has not described. Ascending, as the picker expects. */
+export const GROK_EFFORT_LEVELS = ["low", "medium", "high", "xhigh"];
+const ORDER = ["minimal", "low", "medium", "high", "xhigh", "max"];
+/** What the listing said on 2026-10-08, for when it cannot be asked (no session yet, offline). */
+export const GROK_FALLBACK_MODELS = [
+    { id: "grok-4.7", name: "Grok 4.7", contextWindow: 256000, effortLevels: [...GROK_EFFORT_LEVELS] },
+    { id: "grok-4.7-build-fast", name: "Grok 4.7 Fast", contextWindow: 256000, effortLevels: [...GROK_EFFORT_LEVELS] },
+    { id: "grok-4.6", name: "Grok 4.6", contextWindow: 256000, effortLevels: [...GROK_EFFORT_LEVELS] },
+    { id: "grok-4.5", name: "Grok 4.5", contextWindow: 256000, effortLevels: ["low", "medium", "high"] },
+];
+/**
+ * Model entries from a `/v1/models` body. Only `id`, `name`, `contextWindow` and `effortLevels` are
+ * kept: a Grok model never carries `wire`, `url` or `authHeader`, because `providerFor` would turn it
+ * into an openai-compatible provider without the session headers.
+ */
+export function grokModelsFromListing(body) {
+    const data = body && typeof body === "object" && Array.isArray(body.data) ? body.data : [];
+    return data.flatMap((item) => {
+        if (!item || typeof item !== "object")
+            return [];
+        const m = item;
+        if (typeof m.id !== "string" || !m.id)
+            return [];
+        const listed = Array.isArray(m.reasoning_efforts)
+            ? m.reasoning_efforts.flatMap((effort) => {
+                const value = effort && typeof effort === "object" ? effort.value ?? effort.id : undefined;
+                return typeof value === "string" ? [value] : [];
+            })
+            : undefined;
+        const effortLevels = m.supports_reasoning_effort === false
+            ? []
+            : listed && listed.length > 0
+                ? [...new Set(listed)].sort((a, b) => (ORDER.indexOf(a) + 1 || 99) - (ORDER.indexOf(b) + 1 || 99))
+                : undefined;
+        return [{
+                id: m.id,
+                ...(typeof m.name === "string" && m.name ? { name: m.name } : {}),
+                ...(typeof m.context_window === "number" && m.context_window > 0 ? { contextWindow: m.context_window } : {}),
+                ...(effortLevels !== undefined ? { effortLevels } : {}),
+            }];
+    });
+}

package/dist/router/src/providers/grok/index.js

@@ -0,0 +1,94 @@
+// Grok on a SuperGrok / X Premium subscription: Anthropic Messages translated to OpenAI Chat
+// Completions and sent to the chat proxy the Grok CLI itself talks to, signed in with the CLI's own
+// session. The translation, streaming, retries and error mapping are the openai-compatible adapter's;
+// what this adds is the credential, which rotates under us, and the headers the proxy routes on.
+//
+// The proxy is documented for direct use in the CLI's README ("Using auth.json for API Access":
+// `Authorization: Bearer`, `X-XAI-Token-Auth: xai-grok-cli`, `x-grok-model-override`). Measured
+// 2026-10-08 that it also refuses a request without `x-grok-client-version` (426 "Your Grok CLI
+// version (none) is outdated"), which the README does not mention — see ARCHITECTURE §4e.
+import { OpenAiCompatibleAdapter } from "../openai/index.js";
+import { GROK_AUTH_HINT, GrokAuth, GrokAuthError, grokHome, sharedGrokAuth } from "./auth.js";
+import { GROK_DEFAULT_URL, GROK_EFFORT_LEVELS } from "./catalog.js";
+/**
+ * Facts only, returned by the probe in a `warning` field like the Antigravity one. Nothing published
+ * by xAI says either way whether a third-party client may use the CLI's session.
+ */
+export const GROK_WARNING = "This uses the Grok CLI's own sign-in and the chat proxy the CLI talks to. xAI's README for the CLI " +
+    "shows that proxy being called directly with this session, but the version header it also requires " +
+    "is undocumented, and the proxy is not a published API: a CLI release or a change on xAI's side can " +
+    "break this without warning. ClaudeRipple is not affiliated with xAI.";
+/** The headers the proxy authenticates and routes on. The model goes in a header, not just the body. */
+export function grokHeaders(token, model, clientVersion) {
+    return {
+        authorization: `Bearer ${token}`,
+        "x-xai-token-auth": "xai-grok-cli",
+        "x-grok-model-override": model,
+        "x-grok-client-version": clientVersion,
+    };
+}
+function bearer(headers) {
+    return (headers.authorization ?? "").replace(/^Bearer\s+/i, "");
+}
+export class GrokAdapter {
+    name;
+    auth;
+    inner;
+    constructor(name, cfg, log, auth) {
+        this.name = name;
+        // Shared with the dashboard's probe and with any other provider on the same session, and kept
+        // across a config change that rebuilds this adapter.
+        this.auth = auth ?? sharedGrokAuth({ home: cfg.home ?? grokHome(), ...(cfg.cli ? { cli: cfg.cli } : {}), log });
+        // Chat Completions rather than the `responses` backend the listing names: on Chat the reasoning
+        // arrives as text the mapper turns into thinking blocks, and a stable prefix was cached without a
+        // conversation header (measured 2026-10-08, §4e). Effort per model comes from the listing the
+        // probe saved; a model it has not described gets the common ladder.
+        const translated = {
+            type: "openai-compatible",
+            url: cfg.url ?? GROK_DEFAULT_URL,
+            wire: "chat",
+            caps: { reasoning: "effort", effortLevels: [...GROK_EFFORT_LEVELS] },
+            ...(cfg.models ? { models: cfg.models } : {}),
+            ...(cfg.identity === undefined ? {} : { identity: cfg.identity }),
+            ...(cfg.instructionsAppend ? { instructionsAppend: cfg.instructionsAppend } : {}),
+        };
+        this.inner = new OpenAiCompatibleAdapter(name, translated, log, {
+            label: "Grok",
+            logTag: "grok",
+            authHint: GROK_AUTH_HINT,
+            headers: async (model) => {
+                const token = this.auth.current();
+                return grokHeaders(token?.key ?? "", model, await this.auth.clientVersion(cfg.clientVersion));
+            },
+            unauthorized: async (_model, sent) => this.auth.rejected(bearer(sent)),
+        });
+    }
+    async handle(req, res, path, json, model, effort) {
+        // Counting tokens is answered locally and needs no session.
+        if (!path.startsWith("/v1/messages/count_tokens")) {
+            // The wait can be a 30s CLI refresh. A client that leaves meanwhile has cancelled the turn, and
+            // the inner adapter only starts listening for that once it is called, so it is watched from here.
+            let closed = res.destroyed;
+            const onClose = () => { closed = true; };
+            res.on("close", onClose);
+            try {
+                await this.auth.token();
+            }
+            catch (error) {
+                if (closed)
+                    return { status: 0, bytes: 0, note: "client closed" };
+                if (!(error instanceof GrokAuthError))
+                    throw error;
+                const body = JSON.stringify({ type: "error", error: { type: "authentication_error", message: `Grok: ${error.message}` } });
+                res.writeHead(401, { "content-type": "application/json", "content-length": String(Buffer.byteLength(body)) }).end(body);
+                return { status: 401, bytes: Buffer.byteLength(body), note: "no usable Grok session" };
+            }
+            finally {
+                res.off("close", onClose);
+            }
+            if (closed)
+                return { status: 0, bytes: 0, note: "client closed" };
+        }
+        return this.inner.handle(req, res, path, json, model, effort);
+    }
+}

package/dist/router/src/providers/openai/index.js

@@ -20,7 +20,8 @@ function failureStatus(failure) {
 function vendorMessage(text) {
     try {
         const json = JSON.parse(text);
-        const candidate = json.error?.message ?? json.message ?? json.detail;
+        // Most vendors nest the message; some (the Grok CLI proxy) send `{"error": "<message>"}`.
+        const candidate = typeof json.error === "string" ? json.error : json.error?.message ?? json.message ?? json.detail;
         if (typeof candidate === "string")
             return candidate.slice(0, 500);
     }
@@ -31,16 +32,24 @@ function vendorMessage(text) {
 export function looksLikeAuth(text) {
     return /\b(api[_ -]?key|token|credential|unauthori[sz]ed|authentication|invalid[_ -]?key|expired)\b/i.test(text);
 }
-export function mapHttpError(status, text) {
-    const message = `OpenAI-compatible provider: ${vendorMessage(text)}`;
+/**
+ * `label` names the provider in the message the user reads; `authHint`, when given, is appended to an
+ * authentication error to say what to do about it — a credential the user can fix in another tool is
+ * only fixable if the error names the tool.
+ */
+export function mapHttpError(status, text, label = "OpenAI-compatible provider", authHint, redact = (message) => message) {
+    // Cleaned after decoding: a credential escaped inside the JSON (`\u0074ok…`) only reads as itself
+    // once the string is parsed.
+    const message = `${label}: ${redact(vendorMessage(text))}`;
+    const authMessage = authHint ? `${message} — ${authHint}` : message;
     if (status === 401)
-        return anthropicError(401, "authentication_error", message);
+        return anthropicError(401, "authentication_error", authMessage);
     // A 403 is often not the credential at all: a data-sharing policy that needs opting into, a
     // region, a model the account may not use. Calling it an authentication error sends the user
     // back to check a key that was never the problem — which is most of an afternoon.
     if (status === 403) {
         return looksLikeAuth(text)
-            ? anthropicError(401, "authentication_error", message)
+            ? anthropicError(401, "authentication_error", authMessage)
             : anthropicError(403, "permission_error", message);
     }
     if (status === 429)
@@ -62,11 +71,15 @@ export class OpenAiCompatibleAdapter {
     name;
     cfg;
     log;
+    hooks;
+    tag;
     lastInputByKey = new Map();
-    constructor(name, cfg, log) {
+    constructor(name, cfg, log, hooks = {}) {
         this.name = name;
         this.cfg = cfg;
         this.log = log;
+        this.hooks = hooks;
+        this.tag = hooks.logTag ?? "openai";
     }
     rememberInput(key, usage) {
         const total = usage.input_tokens + usage.cache_read_input_tokens;
@@ -96,7 +109,7 @@ export class OpenAiCompatibleAdapter {
         // an empty answer with nothing logged anywhere.
         const serverTools = serverToolNames(json.tools);
         if (serverTools.size > 0)
-            this.log.warn(`openai ${this.name}: dropped server tools for ${model}: ${[...serverTools].join(", ")} (Anthropic runs these; this provider cannot)`);
+            this.log.warn(`${this.tag} ${this.name}: dropped server tools for ${model}: ${[...serverTools].join(", ")} (Anthropic runs these; this provider cannot)`);
         const upstreamRequest = toOpenAiRequest(json, {
             model,
             wire,
@@ -112,46 +125,85 @@ export class OpenAiCompatibleAdapter {
         const sessionHeader = this.cfg.sessionHeader
             ? { [this.cfg.sessionHeader]: conversationKey(json) }
             : {};
-        const upstreamHeaders = { "content-type": "application/json", accept: "text/event-stream", ...sessionHeader, ...(this.cfg.headers ?? {}) };
-        const upstreamSecrets = credentialHeaderValues(Object.entries(upstreamHeaders));
+        const label = this.hooks.label ?? "OpenAI-compatible provider";
+        const headersNow = async () => ({
+            "content-type": "application/json",
+            accept: "text/event-stream",
+            ...sessionHeader,
+            ...(this.cfg.headers ?? {}),
+            ...(this.hooks.headers ? await this.hooks.headers(model) : {}),
+        });
+        let upstreamHeaders = {};
+        // Every credential sent on any attempt: after a 401 retry the vendor's error may still echo the
+        // first one.
+        const upstreamSecrets = new Set();
+        const redact = (text) => redactErrorText(text, [...upstreamSecrets], 2000);
         // Same input floor behavior as the ChatGPT adapter: the CLI snapshots message_start before usage arrives.
         const key = JSON.stringify({ model, wire, system: json.system ?? "", user: json.messages.find((message) => message.role === "user")?.content ?? "" });
         const startInput = Math.max(estimateTokens(json), this.lastInputByKey.get(key) ?? 0);
         const controller = new AbortController();
         const onClose = () => controller.abort();
         res.on("close", onClose);
-        let upstream;
-        try {
+        const ask = async () => {
+            upstreamHeaders = await headersNow();
+            for (const secret of credentialHeaderValues(Object.entries(upstreamHeaders)))
+                upstreamSecrets.add(secret);
             // Nothing has been written to the client yet, so a failure another attempt could answer is
             // asked again here rather than handed to the user as an error they would have to retry by
             // hand. Once this returns, the response is written straight through (see `fetchWithRetry`).
-            upstream = await fetchWithRetry(endpoint(this.cfg.url, wire), {
+            return fetchWithRetry(endpoint(this.cfg.url, wire), {
                 method: "POST",
                 headers: upstreamHeaders,
                 body: requestBody,
                 signal: controller.signal,
-            }, { log: (line) => this.log.info(`openai ${this.name}: ${line}`) });
+            }, { log: (line) => this.log.info(`${this.tag} ${this.name}: ${redact(line)}`), ...(this.hooks.attempts ? { attempts: this.hooks.attempts } : {}) });
+        };
+        let upstream;
+        try {
+            upstream = await ask();
+            // A credential that rotates under us can be refused for being the one we read a moment before
+            // its owner replaced it. Still nothing written, so the turn can be asked once more.
+            if (upstream.status === 401 && this.hooks.unauthorized) {
+                const refusal = await upstream.text().catch(() => "");
+                if (await this.hooks.unauthorized(model, upstreamHeaders)) {
+                    this.log.info(`${this.tag} ${this.name}: 401 for ${model}; credential changed, asking again`);
+                    upstream = await ask();
+                }
+                else {
+                    upstream = new Response(refusal, { status: 401 });
+                }
+            }
         }
         catch (error) {
             res.off("close", onClose);
             if (controller.signal.aborted)
                 return { status: 0, bytes: 0, note: "client closed" };
-            const out = anthropicError(502, "api_error", `OpenAI-compatible provider unreachable: ${error.message}`);
+            // fetch names an invalid header value in full, credential included; the message also reaches the
+            // request log through whoever catches this.
+            error.message = redact(error.message);
+            const out = anthropicError(502, "api_error", `${label} unreachable: ${error.message}`);
             if (!res.headersSent)
                 res.writeHead(out.status, { "content-type": "application/json" }).end(out.body);
             throw error;
         }
         if (!upstream.ok || !upstream.body) {
             const text = await upstream.text().catch(() => "");
-            const safeText = redactErrorText(text, upstreamSecrets);
-            const out = mapHttpError(upstream.status, safeText);
-            this.log.warn(`openai ${this.name}: upstream ${upstream.status} for ${model}: ${safeText.slice(0, 400)}`);
+            // Re-serialised first, so an escaped credential in a JSON body is spelled out before it is matched.
+            let plain = text;
+            try {
+                plain = JSON.stringify(JSON.parse(text));
+            }
+            catch { /* not JSON: matched as it came */ }
+            const safeText = redactErrorText(plain, [...upstreamSecrets]);
+            const out = mapHttpError(upstream.status, text, label, this.hooks.authHint, redact);
+            this.log.warn(`${this.tag} ${this.name}: upstream ${upstream.status} for ${model}: ${safeText.slice(0, 400)}`);
             res.off("close", onClose);
             res.writeHead(out.status, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out.body)) }).end(out.body);
             return { status: out.status, bytes: Buffer.byteLength(out.body), note: `upstream ${upstream.status}`, exhaustion: providerExhaustion(upstream.status, text, retryAfterMs(Object.fromEntries(upstream.headers))) };
         }
         const wantStream = json.stream === true;
         const mapper = new OpenAiStreamMapper(model, startInput, toolNameRestoreMap(json));
+        mapper.redactError = redact;
         const parser = new SseParser();
         const reader = upstream.body.getReader();
         const decoder = new TextDecoder();
@@ -235,6 +287,8 @@ export class OpenAiCompatibleAdapter {
                 : `in=${usage.input_tokens} cached=${usage.cache_read_input_tokens} out=${usage.output_tokens} stop=${mapper.stopReason}`,
             usage: { input: usage.input_tokens, cached: usage.cache_read_input_tokens, output: usage.output_tokens },
             stopReason: mapper.stopReason,
+            ...(wantStream || !failure ? { messageId: mapper.messageId } : {}),
+            ...(mapper.servedTier !== undefined ? { servedTier: mapper.servedTier } : {}),
         };
     }
 }

package/dist/router/src/providers/openai/translate.js

@@ -283,6 +283,7 @@ export class OpenAiStreamMapper {
     responseItems = [];
     responseItemsById = new Map();
     messageId = `msg_${crypto.randomBytes(12).toString("hex")}`;
+    servedTier;
     content = [];
     usage = { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 };
     stopReason = "end_turn";
@@ -290,6 +291,8 @@ export class OpenAiStreamMapper {
     startInput;
     /** Mangled tool name → the name Claude Code knows, from `toolNameRestoreMap`. */
     toolNames;
+    /** Applied to every error message before it is stored or sent. */
+    redactError = (message) => message;
     constructor(model, startInput = 0, toolNames = new Map()) {
         this.model = model;
         this.startInput = startInput;
@@ -359,6 +362,8 @@ export class OpenAiStreamMapper {
     }
     feedChat(ev) {
         const out = [...this.start()];
+        if (typeof ev.service_tier === "string")
+            this.servedTier = ev.service_tier;
         const usage = ev.usage;
         if (usage)
             this.setUsage(usage);
@@ -513,6 +518,8 @@ export class OpenAiStreamMapper {
         }
         else if (type === "response.completed" || type === "response.incomplete") {
             const response = ev.response;
+            if (typeof response?.service_tier === "string")
+                this.servedTier = response.service_tier;
             this.setUsage(response?.usage);
             if (response?.incomplete_details?.reason === "max_output_tokens")
                 this.finishReason = "length";
@@ -543,10 +550,13 @@ export class OpenAiStreamMapper {
         this.stopReason = this.sawTool || this.finishReason === "tool_calls" ? "tool_use" : this.finishReason === "length" || this.finishReason === "max_output_tokens" ? "max_tokens" : "end_turn";
         return [...this.start(), ...this.closeBlock(), { event: "message_delta", data: { type: "message_delta", delta: { stop_reason: this.stopReason, stop_sequence: null }, usage: this.usage } }, { event: "message_stop", data: { type: "message_stop" } }];
     }
-    fail(message, code) {
+    fail(rawMessage, code) {
         if (this.finished)
             return [];
         this.finished = true;
+        // A vendor's error text can echo the credential it was sent; the client, the non-streamed body
+        // and the request log all take `failure.message`, so it is cleaned once, here.
+        const message = this.redactError(rawMessage);
         // `overloaded_error` is the one mid-stream error Claude Code retries on its own (CLI 2.1.278
         // matches `"type":"overloaded_error"` in the message); `api_error` ends the turn for good.
         const type = code === "rate_limit_exceeded" ? "rate_limit_error" : code === "server_is_overloaded" ? "overloaded_error" : "api_error";