clawmoney 0.14.1 → 0.14.3

package/dist/relay/upstream/claude-api.js

@@ -53,8 +53,21 @@ const DEFAULT_USER_AGENT = `claude-cli/${DEFAULT_CLI_VERSION} (external, ${DEFAU
 // same file — both projects have the identical string. This value is part
 // of Anthropic's server-side check that the request came from a real CLI.
 const CLAUDE_FINGERPRINT_SALT = "59cf53e54c78";
+// Headers that real Claude Code emits on every /v1/messages call. The
+// Anthropic SDK would inject these automatically; since we bypass the SDK
+// and hand-roll the fetch call we have to include them verbatim.
+//
+// Note the deliberate omissions:
+//   - `anthropic-beta` is NOT static — it is per-request and derived from
+//     the model via pickClaudeBetasForModel(). Real Claude Code passes
+//     the list via the SDK's `betas: [...]` body param and the SDK then
+//     emits it as a comma-joined `anthropic-beta` header. We do the same
+//     thing by building the header inline in doCallClaudeApi so Haiku
+//     requests drop `claude-code-20250219` like the real CLI.
+//   - `accept` is overridden per-request to `text/event-stream` when we
+//     set stream:true (see doCallClaudeApi). Leaving it out of the static
+//     set so we can pick the right value at call time.
 const STATIC_CLAUDE_CODE_HEADERS = {
-    "accept": "application/json",
     "x-stainless-retry-count": "0",
     "x-stainless-timeout": "600",
     "x-stainless-lang": "js",
@@ -67,10 +80,6 @@ const STATIC_CLAUDE_CODE_HEADERS = {
     "anthropic-version": "2023-06-01",
     "x-app": "cli",
     "content-type": "application/json",
-    // Minimal beta set that Max-tier subscriptions always accept. Adding
-    // context-1m or context-management here will get rejected as "long
-    // context beta not available for this subscription" on non-Enterprise tiers.
-    "anthropic-beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14",
 };
 // System prompt captured from real Claude Code ≥ 2.1.x. The first marker line
 // matches claudeCodeSystemPrompts template #2 in sub2api's validator
@@ -88,6 +97,85 @@ const MODEL_ID_OVERRIDES = {
 function normalizeModel(model) {
     return MODEL_ID_OVERRIDES[model] ?? model;
 }
+// ── Per-model thinking + betas selection (mirrors real Claude Code) ──
+//
+// Real Claude Code ALWAYS sends a `thinking` body field for Claude 4+
+// models, and the shape depends on whether the model supports adaptive
+// thinking. Source: claude-code-best/src/utils/thinking.ts:
+//   - modelSupportsThinking() → any canonical name NOT matching "claude-3-"
+//   - modelSupportsAdaptiveThinking() → only canonical names containing
+//     "opus-4-6" or "sonnet-4-6"
+//
+// If we send requests to Anthropic without this field but with Claude 4+
+// models, the per-account traffic pattern is "zero thinking on every
+// message" which is a clear relay-farm fingerprint (real users on these
+// tiers get adaptive thinking automatically and have no way to turn it
+// off short of setting alwaysThinkingEnabled=false).
+function modelSupportsThinking(model) {
+    return !normalizeModel(model).includes("claude-3-");
+}
+function modelSupportsAdaptiveThinking(model) {
+    const m = normalizeModel(model);
+    return m.includes("opus-4-6") || m.includes("sonnet-4-6");
+}
+// Anthropic's /v1/messages rejects thinking.enabled.budget_tokens < 1024.
+const CLAUDE_MIN_THINKING_BUDGET = 1024;
+function pickClaudeThinkingConfig(model, maxTokens) {
+    if (!modelSupportsThinking(model)) {
+        return { config: undefined, adjustedMaxTokens: maxTokens };
+    }
+    if (modelSupportsAdaptiveThinking(model)) {
+        // Adaptive has no fixed budget — the API internally picks. Don't
+        // inflate max_tokens; keep caller's cap.
+        return { config: { type: "adaptive" }, adjustedMaxTokens: maxTokens };
+    }
+    // Budget thinking (4-5 / haiku-4-5): budget_tokens must be >= 1024 AND
+    // strictly less than max_tokens. If caller's max_tokens is too low to
+    // fit the 1024 floor + 1, bump max_tokens so we can send a valid
+    // thinking block. Real Claude Code uses `getMaxThinkingTokensForModel
+    // = getModelMaxOutputTokens(model).upperLimit - 1` which is usually
+    // many thousands, but for a relay we want to respect the caller's cap
+    // unless it would force an invalid request.
+    const requiredMax = CLAUDE_MIN_THINKING_BUDGET + 1;
+    const adjustedMaxTokens = Math.max(maxTokens, requiredMax);
+    const budget = Math.max(CLAUDE_MIN_THINKING_BUDGET, adjustedMaxTokens - 1);
+    return {
+        config: { type: "enabled", budget_tokens: budget },
+        adjustedMaxTokens,
+    };
+}
+/**
+ * Assemble the `betas` array that goes into the /v1/messages body. Real
+ * Claude Code constructs this dynamically per-request from
+ * getAllModelBetas() — the key branches are:
+ *   1. non-haiku → push `claude-code-20250219`
+ *   2. OAuth subscriber → push `oauth-2025-04-20`
+ *   3. model supports interleaved-source-processing (ISP, i.e. any 4+) →
+ *      push `interleaved-thinking-2025-05-14`
+ * Source: claude-code-best/src/utils/betas.ts:233-261 (getAllModelBetas).
+ *
+ * The Anthropic SDK later materializes this array into the
+ * `anthropic-beta` HTTP header as a comma-separated list. Sending it via
+ * the body instead of a static header is indistinguishable from the SDK
+ * wire format (we are literally doing the same thing the SDK does), but
+ * making it dynamic per-model avoids the Haiku mismatch where real CLI
+ * drops `claude-code-20250219` but our old static header always sent it.
+ */
+function pickClaudeBetasForModel(model) {
+    const m = normalizeModel(model);
+    const isHaiku = m.includes("haiku");
+    const betas = [];
+    if (!isHaiku)
+        betas.push("claude-code-20250219");
+    // OAuth subscriber — always true for us since we only serve relay from
+    // Max-tier OAuth tokens.
+    betas.push("oauth-2025-04-20");
+    // Interleaved thinking — all Claude 4+ models support it.
+    if (modelSupportsThinking(model)) {
+        betas.push("interleaved-thinking-2025-05-14");
+    }
+    return betas;
+}
 // ── Proxy (honor HTTPS_PROXY / http_proxy env vars) ──
 //
 // Node's native fetch does NOT read these env vars automatically, so if the
@@ -640,9 +728,15 @@ async function doCallClaudeApi(opts) {
     // message text so the cc_version.<FP3> suffix varies request-by-request,
     // matching what real Claude Code sends. See computeClaudeFingerprint().
     const attributionHeader = buildClaudeAttributionHeader(sanitizedPrompt, fingerprint.cc_version, fingerprint.cc_entrypoint);
+    // Per-request betas + thinking config, picked from the real CLI's
+    // per-model logic (see pickClaudeBetasForModel / pickClaudeThinkingConfig).
+    // These are two of the strongest fingerprint signals Anthropic could use
+    // to distinguish relay traffic from genuine CLI traffic.
+    const betasForRequest = pickClaudeBetasForModel(opts.model);
+    const { config: thinkingConfig, adjustedMaxTokens } = pickClaudeThinkingConfig(opts.model, maxTokens);
     const body = {
         model: normalizeModel(opts.model),
-        max_tokens: maxTokens,
+        max_tokens: adjustedMaxTokens,
         system: [
             {
                 type: "text",
@@ -672,8 +766,27 @@ async function doCallClaudeApi(opts) {
             },
         ],
         metadata: { user_id: buildMetadataUserID(fingerprint, sessionId) },
-        stream: false,
+        // Real Claude Code ALWAYS sends stream:true on its main path
+        // (claude-code-sourcemap/src/services/api/claude.ts:1824 —
+        // `{ ...params, stream: true }`). The non-stream call at line 864 is
+        // only the fallback path triggered when the stream fails mid-response.
+        // Sending stream:false on every request is a statistical signal that
+        // Anthropic could use to identify relay clients vs real CLI — the
+        // entire account's traffic would be the opposite polarity of what the
+        // CLI ever emits. Switch to streaming to match.
+        stream: true,
+        // NOTE: `betas` is a client-side SDK-only param — the Anthropic SDK
+        // strips it out of the body and emits it as the `anthropic-beta`
+        // HTTP header. Anthropic's API rejects requests that carry `betas`
+        // in the wire body with `betas: Extra inputs are not permitted`.
+        // The header is set on the fetch call below, so don't put it here.
     };
+    // `thinking` is always set on Claude 4+ models by real CLI. Omitting it
+    // would be an account-wide zero-thinking anomaly. Adaptive for 4-6
+    // models, enabled+budget for 4-5 / haiku.
+    if (thinkingConfig) {
+        body.thinking = thinkingConfig;
+    }
     const bodyJson = JSON.stringify(body);
     let transientAttempt = 0;
     let hasRefreshed = false;
@@ -683,6 +796,15 @@ async function doCallClaudeApi(opts) {
             method: "POST",
             headers: {
                 ...STATIC_CLAUDE_CODE_HEADERS,
+                // SSE streaming — Anthropic returns event-stream body when
+                // stream:true is set in the body. The SDK default sets an accept
+                // that includes text/event-stream; we match that exactly.
+                "accept": "application/json, text/event-stream",
+                // `anthropic-beta` is what the Anthropic SDK generates from the
+                // body's `betas` array. We could leave body.betas and drop this
+                // header, but some Anthropic deploys check header presence too,
+                // so we send both for safety. The values must match.
+                "anthropic-beta": betasForRequest.join(","),
                 "user-agent": fingerprint.user_agent,
                 "authorization": `Bearer ${creds.accessToken}`,
                 "x-claude-code-session-id": sessionId,
@@ -695,7 +817,10 @@ async function doCallClaudeApi(opts) {
         if (sessionWin)
             rateGuard?.setSessionWindow(sessionWin);
         if (resp.ok) {
-            const parsed = parseResponse(await resp.json(), opts.model);
+            // Stream parser — real Claude Code's main path uses stream:true; see
+            // body construction above. parseClaudeSseResponse aggregates text
+            // deltas + usage until message_stop, matching SDK semantics.
+            const parsed = await parseClaudeSseResponse(resp, opts.model);
             recordSpendFromUsage(parsed, opts.model);
             return parsed;
         }
@@ -756,22 +881,152 @@ function recordSpendFromUsage(parsed, model) {
     // subscription meter and what will actually burn the account.
     rateGuard.recordSpend(cost.apiCost);
 }
-function parseResponse(data, fallbackModel) {
-    const text = (data.content ?? [])
-        .filter((c) => c.type === "text" && typeof c.text === "string")
-        .map((c) => c.text)
-        .join("");
-    const usage = data.usage ?? {};
+/**
+ * Parse an Anthropic SSE `/v1/messages` stream response into a ParsedOutput.
+ *
+ * Wire format (Anthropic docs — beta.messages.create({stream: true})):
+ *
+ *   event: message_start
+ *   data: {"type":"message_start","message":{"id":"...","model":"...","usage":{"input_tokens":10,...}}}
+ *
+ *   event: content_block_start
+ *   data: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}
+ *
+ *   event: content_block_delta
+ *   data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"Hello"}}
+ *
+ *   ... more deltas ...
+ *
+ *   event: content_block_stop
+ *   data: {"type":"content_block_stop","index":0}
+ *
+ *   event: message_delta
+ *   data: {"type":"message_delta","delta":{"stop_reason":"end_turn"},"usage":{"output_tokens":42}}
+ *
+ *   event: message_stop
+ *   data: {"type":"message_stop"}
+ *
+ *   event: ping            (keepalive — ignore)
+ *
+ *   event: error           (upstream error — throw)
+ *   data: {"type":"error","error":{"type":"overloaded_error","message":"..."}}
+ */
+async function parseClaudeSseResponse(resp, fallbackModel) {
+    const reader = resp.body?.getReader();
+    if (!reader) {
+        throw new Error("Claude streamGenerateContent returned no body");
+    }
+    const decoder = new TextDecoder("utf-8");
+    let buffer = "";
+    let text = "";
+    let model = fallbackModel;
+    let inputTokens = 0;
+    let outputTokens = 0;
+    let cacheCreation = 0;
+    let cacheRead = 0;
+    let streamError;
+    const processChunk = (jsonStr) => {
+        const trimmed = jsonStr.trim();
+        if (!trimmed)
+            return;
+        let chunk;
+        try {
+            chunk = JSON.parse(trimmed);
+        }
+        catch {
+            return;
+        }
+        switch (chunk.type) {
+            case "message_start": {
+                if (chunk.message?.model)
+                    model = chunk.message.model;
+                const u = chunk.message?.usage;
+                if (u) {
+                    if (typeof u.input_tokens === "number")
+                        inputTokens = u.input_tokens;
+                    if (typeof u.output_tokens === "number")
+                        outputTokens = u.output_tokens;
+                    if (typeof u.cache_creation_input_tokens === "number") {
+                        cacheCreation = u.cache_creation_input_tokens;
+                    }
+                    if (typeof u.cache_read_input_tokens === "number") {
+                        cacheRead = u.cache_read_input_tokens;
+                    }
+                }
+                break;
+            }
+            case "content_block_delta": {
+                // We only accumulate text_delta. input_json_delta is for tool calls,
+                // which we don't surface from the relay path (the buyer gets the
+                // model's final text response, not in-flight tool plumbing).
+                if (chunk.delta?.type === "text_delta" && typeof chunk.delta.text === "string") {
+                    text += chunk.delta.text;
+                }
+                break;
+            }
+            case "message_delta": {
+                // message_delta carries the final output_tokens count and
+                // potentially an updated usage (e.g. cache hits applied late).
+                const u = chunk.usage;
+                if (u) {
+                    if (typeof u.output_tokens === "number")
+                        outputTokens = u.output_tokens;
+                    if (typeof u.input_tokens === "number")
+                        inputTokens = u.input_tokens;
+                    if (typeof u.cache_creation_input_tokens === "number") {
+                        cacheCreation = u.cache_creation_input_tokens;
+                    }
+                    if (typeof u.cache_read_input_tokens === "number") {
+                        cacheRead = u.cache_read_input_tokens;
+                    }
+                }
+                break;
+            }
+            case "error": {
+                streamError = chunk.error;
+                break;
+            }
+            // message_stop / content_block_start / content_block_stop / ping —
+            // structural, nothing to accumulate.
+            default:
+                break;
+        }
+    };
+    while (true) {
+        const { value, done } = await reader.read();
+        if (done)
+            break;
+        buffer += decoder.decode(value, { stream: true });
+        let newlineIdx;
+        while ((newlineIdx = buffer.indexOf("\n")) >= 0) {
+            const line = buffer.slice(0, newlineIdx).replace(/\r$/, "");
+            buffer = buffer.slice(newlineIdx + 1);
+            if (!line)
+                continue;
+            // SSE dispatches on `data: ...` lines. `event: ...` names are
+            // informational (the chunk JSON's `type` field is authoritative).
+            if (line.startsWith("data:")) {
+                processChunk(line.slice(5));
+            }
+        }
+    }
+    // Flush trailing line (rare — most servers end with a \n\n).
+    if (buffer.startsWith("data:")) {
+        processChunk(buffer.slice(5));
+    }
+    if (streamError) {
+        throw new Error(`Anthropic stream error: ${streamError.type ?? "unknown"} — ${streamError.message ?? ""}`);
+    }
     return {
         text,
         sessionId: "",
         usage: {
-            input_tokens: usage.input_tokens ?? 0,
-            output_tokens: usage.output_tokens ?? 0,
-            cache_creation_tokens: usage.cache_creation_input_tokens ?? 0,
-            cache_read_tokens: usage.cache_read_input_tokens ?? 0,
+            input_tokens: inputTokens,
+            output_tokens: outputTokens,
+            cache_creation_tokens: cacheCreation,
+            cache_read_tokens: cacheRead,
         },
-        model: data.model ?? fallbackModel,
+        model,
         costUsd: 0,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawmoney",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "description": "ClawMoney CLI -- Earn rewards with your AI agent",
   "type": "module",
   "bin": {