haechi 1.2.0 → 1.3.1

package/packages/privacy-profiles/index.mjs

@@ -12,7 +12,11 @@ const PROFILES = {
         email: "redact",
         card: "block",
         api_key: "block",
-        secret: "block"
+        secret: "block",
+        // A Japan My Number leak is as sensitive as a national ID and is a
+        // checksummed true-positive — block it in every profile so a non-JP
+        // deployment that happens to process JP data is still covered.
+        jp_mynumber: "block"
       }
     },
     transfer: {
@@ -31,7 +35,17 @@ const PROFILES = {
         card: "block",
         api_key: "block",
         secret: "block",
-        kr_rrn: "block"
+        kr_rrn: "block",
+        // EU national IDs — France NIR, Spain DNI/NIE, UK National Insurance
+        // Number, Italy codice fiscale, Germany tax ID, Netherlands BSN — are
+        // GDPR special-category-adjacent identifiers; block them.
+        fr_nir: "block",
+        es_dni: "block",
+        uk_nino: "block",
+        it_codice_fiscale: "block",
+        de_steuer_id: "block",
+        nl_bsn: "block",
+        jp_mynumber: "block"
       }
     },
     transfer: {
@@ -39,6 +53,37 @@ const PROFILES = {
       note: "Treat model/tool transfer as processor/subprocessor transfer and document SCC/TIA evidence outside Haechi."
     }
   },
+  "asia-pdpa": {
+    id: "asia-pdpa",
+    region: "ASIA",
+    regulations: ["Singapore PDPA", "India DPDP Act"],
+    policy: {
+      actions: {
+        // Asia national IDs — Singapore NRIC/FIN and India Aadhaar — are sensitive
+        // identifiers under the Singapore PDPA / India DPDP Act; block them. The
+        // other checksummed national IDs are also blocked so a mixed-region payload
+        // is covered, matching the cross-profile convention.
+        sg_nric: "block",
+        in_aadhaar: "block",
+        jp_mynumber: "block",
+        kr_rrn: "block",
+        fr_nir: "block",
+        es_dni: "block",
+        it_codice_fiscale: "block",
+        de_steuer_id: "block",
+        nl_bsn: "block",
+        phone: "mask",
+        email: "redact",
+        card: "block",
+        api_key: "block",
+        secret: "block"
+      }
+    },
+    transfer: {
+      requiresAssessment: true,
+      note: "Document the PDPA/DPDP handling basis, purpose limitation, and cross-border transfer notice before production use."
+    }
+  },
   "us-general": {
     id: "us-general",
     region: "US",
@@ -49,13 +94,37 @@ const PROFILES = {
         phone: "mask",
         card: "block",
         api_key: "block",
-        secret: "block"
+        secret: "block",
+        jp_mynumber: "block"
       }
     },
     transfer: {
       requiresAssessment: false,
       note: "Classify sector rules separately before using protected health, payment, or children's data."
     }
+  },
+  "jp-appi": {
+    id: "jp-appi",
+    region: "JP",
+    regulations: ["APPI"],
+    policy: {
+      actions: {
+        // My Number (個人番号) is a special-care personal-information identifier
+        // under the My Number Act; block it. The EU/KR IDs are also blocked so a
+        // mixed-region payload is covered, matching the cross-profile convention.
+        jp_mynumber: "block",
+        phone: "mask",
+        email: "redact",
+        card: "block",
+        api_key: "block",
+        secret: "block",
+        kr_rrn: "block"
+      }
+    },
+    transfer: {
+      requiresAssessment: true,
+      note: "Document the My Number Act handling basis, purpose limitation, and cross-border transfer notice before production use."
+    }
   }
 };
 

package/packages/protocol-adapters/index.mjs

@@ -8,6 +8,28 @@ const SSE_RESPONSES = { format: "sse", deltaPath: null };
 const SSE_LLAMA_LEGACY = { format: "sse", deltaPath: ["content"] };
 const NDJSON_OLLAMA_CHAT = { format: "ndjson", deltaPath: ["message", "content"] };
 const NDJSON_OLLAMA_GENERATE = { format: "ndjson", deltaPath: ["response"] };
+// Anthropic Messages API streams event-typed SSE frames; the incremental text
+// channel is `delta.text` inside a `content_block_delta` frame. Other frame
+// types (message_start, ping, etc.) don't carry deltaPath, so they get
+// within-frame protection but no cross-frame buffering. The stream-filter
+// preserves each frame's `event:` line on re-serialize. `flushOnType` lists the
+// frame types that END a delta sequence: before one of them the held cross-frame
+// buffer tail is flushed as a valid `content_block_delta`, so the residual lands
+// IN ORDER (before content_block_stop/message_stop) rather than after the stream
+// terminates. `ping` is intentionally absent — a match split across a keepalive
+// must still be caught by the sliding buffer. Legacy /v1/complete streams a
+// `completion` delta (no block framing, so no flushOnType needed).
+const SSE_ANTHROPIC_MESSAGES = {
+  format: "sse",
+  deltaPath: ["delta", "text"],
+  flushOnType: { path: ["type"], values: ["content_block_stop", "message_delta", "message_stop"] }
+};
+const SSE_ANTHROPIC_COMPLETE = { format: "sse", deltaPath: ["completion"] };
+// Google Gemini streams :streamGenerateContent as DATA-ONLY SSE (no `event:`
+// lines, like OpenAI). Each `data:` frame is a FULL GenerateContentResponse;
+// the incremental text channel is just deeper. Because frames are data-only,
+// the held cross-frame tail can flush at end-of-stream — no flushOnType needed.
+const SSE_GEMINI = { format: "sse", deltaPath: ["candidates", 0, "content", "parts", 0, "text"] };
 
 const ADAPTERS = {
   "openai-compatible": {
@@ -50,6 +72,47 @@ const ADAPTERS = {
       route("/api/embed", "embed"),
       route("/api/embeddings", "embeddings")
     ]
+  },
+  "anthropic": {
+    id: "anthropic",
+    protocol: "anthropic",
+    routes: [
+      // Anthropic Messages API. PII can sit in the top-level `system` string/blocks
+      // or any `messages[].content` string or content-block text/input — the core
+      // tree walk (collectStringEntries) covers every string leaf, so no custom
+      // extraction is needed. Streams via content_block_delta `delta.text`.
+      route("/v1/messages", "messages", { streaming: SSE_ANTHROPIC_MESSAGES }),
+      // count_tokens is a utility, but it carries prompt content, so protect it.
+      route("/v1/messages/count_tokens", "count-tokens", { protectRequest: true }),
+      // Legacy text completions: `prompt` is a top-level string; streams a `completion` delta.
+      route("/v1/complete", "complete", { streaming: SSE_ANTHROPIC_COMPLETE })
+    ]
+  },
+  "gemini": {
+    id: "gemini",
+    protocol: "gemini",
+    routes: [
+      // Google Gemini API. Endpoints are MODEL-IN-PATH with a `:method` suffix:
+      // POST /v1beta/models/{model}:generateContent (and /v1, and arbitrary
+      // model names like gemini-2.0-flash). The route key is therefore the
+      // `:method` SUFFIX, not a fixed path — declared via `methodSuffix`, which
+      // matchRoute checks only AFTER exact-path matches (so existing adapters
+      // are unaffected). PII can sit in systemInstruction.parts[].text and any
+      // contents[].parts[].text; the core tree walk (collectStringEntries)
+      // covers every string leaf, so no custom extraction is needed.
+      suffixRoute("generateContent", "generate-content"),
+      // Streaming variant: data-only SSE, full GenerateContentResponse per frame;
+      // delta text lives at candidates[0].content.parts[0].text. The :stream*
+      // endpoint ALWAYS streams (the intent is in the path, not a body flag), so
+      // mark it streamingDefault — there is no `stream:false` body field for
+      // Gemini, so isStreamingRequest always classifies it as streaming.
+      suffixRoute("streamGenerateContent", "stream-generate-content", { streamingDefault: true, streaming: SSE_GEMINI }),
+      // countTokens carries prompt content (contents/systemInstruction), so protect it.
+      suffixRoute("countTokens", "count-tokens", { protectRequest: true }),
+      // Embedding endpoints: request carries text to embed; protect it.
+      suffixRoute("embedContent", "embed", { protectRequest: true }),
+      suffixRoute("batchEmbedContents", "batch-embed", { protectRequest: true })
+    ]
   }
 };
 
@@ -121,10 +184,45 @@ function route(path, operation, options = {}) {
   };
 }
 
+// A SUFFIX route matches by a `:method` suffix instead of an exact pathname —
+// for model-in-path APIs (Gemini) where the path embeds an arbitrary model name
+// and a version prefix (e.g. /v1beta/models/gemini-2.0-flash:generateContent).
+// `path` stays null (there is no fixed path); `methodSuffix` carries the bare
+// method name and matchRoute matches when the pathname ends with `:${suffix}`.
+// matchRoute tries exact-path routes FIRST, so this never changes existing
+// exact-match behavior for openai/anthropic/ollama/llama-cpp.
+function suffixRoute(methodSuffix, operation, options = {}) {
+  return {
+    id: operation,
+    path: null,
+    methodSuffix,
+    operation,
+    protectRequest: options.protectRequest ?? true,
+    protectResponse: options.protectResponse ?? true,
+    streamingDefault: options.streamingDefault ?? false,
+    streaming: options.streaming ?? null
+  };
+}
+
 function pathFromRequestUrl(url) {
   return new URL(url, "http://haechi.local").pathname;
 }
 
 function matchRoute(routes, pathname) {
-  return routes.find((candidate) => candidate.path === pathname);
+  // 1) EXACT pathname match (unchanged) — the only matcher for openai/anthropic/
+  //    ollama/llama-cpp, so their classification is byte-for-byte identical.
+  const exact = routes.find((candidate) => candidate.path === pathname);
+  if (exact) {
+    return exact;
+  }
+  // 2) ADDITIVE: `:method`-SUFFIX match for model-in-path APIs (Gemini). A path
+  //    like /v1beta/models/gemini-2.0-flash:generateContent matches the route
+  //    whose methodSuffix the pathname ends with (`...:generateContent`). The
+  //    `:` guard prevents a bare substring (e.g. a model literally named
+  //    "generateContent") from matching without the method delimiter.
+  return routes.find(
+    (candidate) =>
+      typeof candidate.methodSuffix === "string" &&
+      pathname.endsWith(`:${candidate.methodSuffix}`)
+  );
 }

package/packages/proxy/index.mjs

@@ -4,6 +4,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { isUtf8 } from "node:buffer";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { once } from "node:events";
 import { inspectResponseStream } from "../stream-filter/index.mjs";
 
 export const DEFAULT_PROXY_PORT = 11016;
@@ -107,6 +108,19 @@ export function createHaechiProxy({ runtime, port = DEFAULT_PROXY_PORT, host = "
   const metrics = runtime.metrics ?? noopMetrics();
   const logger = createLogger(config.logging?.format ?? "text");
 
+  // P0-CR-001 — the upstream header forward policy, derived ONCE from config.
+  // gatewayConsumedAuthorization is true whenever the gateway authenticates the
+  // CLIENT (auth.provider !== "none"): the request's Authorization is then the
+  // gateway credential Haechi consumed and must NOT be forwarded to the model
+  // upstream. With auth.provider "none" the client's Authorization is the
+  // upstream provider key and IS forwarded. extraHeaders is the operator's
+  // additive target.forwardHeaders allowlist (validated lowercase in
+  // normalizeConfig); it can only widen, never override the always-drop set.
+  const forwardPolicy = {
+    gatewayConsumedAuthorization: (config.auth?.provider ?? "none") !== "none",
+    extraHeaders: new Set(config.target?.forwardHeaders ?? [])
+  };
+
   // WS4-B backpressure: a configurable global max-in-flight ceiling. 0 (default)
   // disables it, preserving 1.1 behavior. When > 0 and the live count is at the
   // ceiling, a NEW non-exempt request is rejected 503 + Retry-After BEFORE auth
@@ -237,7 +251,7 @@ export function createHaechiProxy({ runtime, port = DEFAULT_PROXY_PORT, host = "
 
       if (isStreamingRequest(json, routeContext)) {
         if (config.streaming.requestMode === "inspect") {
-          await handleInspectedStream({ runtime, request, response, routeContext, json, authContext, metrics });
+          await handleInspectedStream({ runtime, request, response, routeContext, json, authContext, metrics, forwardPolicy });
           return;
         }
 
@@ -259,11 +273,24 @@ export function createHaechiProxy({ runtime, port = DEFAULT_PROXY_PORT, host = "
             request,
             body,
             timeoutMs: config.limits.upstreamTimeoutMs,
-            metrics
+            metrics,
+            forwardPolicy
+          });
+          // P1-CR-003 — sanitize response headers (strip the upstream's
+          // content-encoding/content-length/transfer/hop-by-hop) on this path
+          // too: Node fetch() auto-decompressed the body, so the original
+          // compressed headers would now be wrong. P1-CR-004 — TRUE bounded
+          // streaming pass-through: pipe the upstream body to the client with a
+          // running byte cap instead of buffering the whole response.
+          response.writeHead(upstreamResponse.status, sanitizeResponseHeaders(upstreamResponse));
+          await pipeUpstreamBodyBounded({
+            upstreamResponse,
+            response,
+            maxBytes: streamingPassThroughMaxBytes(config),
+            logger,
+            metrics,
+            correlationId
           });
-          const { body: rawBody } = await readUpstreamBody(upstreamResponse);
-          response.writeHead(upstreamResponse.status, Object.fromEntries(upstreamResponse.headers.entries()));
-          response.end(rawBody);
           return;
         }
 
@@ -301,7 +328,8 @@ export function createHaechiProxy({ runtime, port = DEFAULT_PROXY_PORT, host = "
         request,
         body: JSON.stringify(result.payload),
         timeoutMs: config.limits.upstreamTimeoutMs,
-        metrics
+        metrics,
+        forwardPolicy
       });
 
       const forwarded = await maybeProtectResponse({
@@ -545,7 +573,13 @@ async function authorizeRequest({ runtime, request, routeContext, rateLimiter, m
 
   if (resolved.rate && resolved.rate.requestsPerMinute) {
     const key = identity?.id ?? "anonymous";
-    if (!rateLimiter.allow(key, resolved.rate.requestsPerMinute)) {
+    // allow() may return a boolean OR a Promise<boolean>: the built-in default is
+    // synchronous, but a shared-store (e.g. Redis-backed) limiter is inherently
+    // async. We await unconditionally — `await <boolean>` returns the boolean
+    // unchanged, so the sync default keeps working, while `!somePromise` (always
+    // false, because a Promise is truthy) can no longer let an async limiter
+    // silently fail open. See haechi-ratelimit-redis (shared-store satellite).
+    if (!(await rateLimiter.allow(key, resolved.rate.requestsPerMinute))) {
       await recordProxyDecision({
         runtime, routeContext, identity, profile: resolved.profile, correlationId,
         decision: "rate_limited",
@@ -627,7 +661,7 @@ async function recordAuthDenied({ runtime, routeContext, reason, correlationId =
   });
 }
 
-async function handleInspectedStream({ runtime, request, response, routeContext, json, authContext = {}, metrics = null }) {
+async function handleInspectedStream({ runtime, request, response, routeContext, json, authContext = {}, metrics = null, forwardPolicy = {} }) {
   const { haechi, config } = runtime;
   const requestMode = config.policy.mode ?? config.mode;
 
@@ -668,7 +702,8 @@ async function handleInspectedStream({ runtime, request, response, routeContext,
     request,
     body: JSON.stringify(requestResult.payload),
     timeoutMs: config.limits.upstreamTimeoutMs,
-    metrics
+    metrics,
+    forwardPolicy
   });
 
   const streamMode = config.streaming.responseMode ?? config.responseProtection.mode ?? config.policy.mode ?? config.mode;
@@ -681,7 +716,7 @@ async function handleInspectedStream({ runtime, request, response, routeContext,
     maxMatchBytes: config.streaming.maxMatchBytes
   });
 
-  response.writeHead(upstreamResponse.status, streamingResponseHeaders(upstreamResponse));
+  response.writeHead(upstreamResponse.status, sanitizeResponseHeaders(upstreamResponse));
 
   const { blocked, summary } = await inspectResponseStream({
     source: upstreamResponse.body ?? emptyAsyncIterable(),
@@ -702,13 +737,97 @@ async function handleInspectedStream({ runtime, request, response, routeContext,
   response.end();
 }
 
-function streamingResponseHeaders(upstreamResponse) {
+// P1-CR-003 — the SINGLE centralized response-header sanitizer used on EVERY
+// response path (pass-through, forwarded/unprotected, protected, streaming).
+// Node fetch() auto-decompresses gzip/br/deflate, so the upstream's original
+// content-encoding/content-length now describe the WIRE bytes Haechi no longer
+// emits — forwarding them makes a downstream client see "content-encoding: gzip"
+// on plain bytes and fail with "incorrect header check". transfer-encoding and
+// the hop-by-hop control headers (RFC 7230 §6.1) likewise describe the upstream
+// hop, not Haechi's connection to the client, so they are stripped too. A
+// correct content-length is re-set ONLY by a caller that emits a fully-buffered
+// body (transformedJsonHeaders / the buffered-body helper below); a streamed or
+// raw-piped body intentionally carries no content-length.
+const RESPONSE_HOP_BY_HOP_HEADERS = [
+  "content-encoding",
+  "content-length",
+  "transfer-encoding",
+  "connection",
+  "keep-alive",
+  "te",
+  "trailer",
+  "upgrade",
+  "proxy-authenticate"
+];
+
+function sanitizeResponseHeaders(upstreamResponse) {
   const headers = Object.fromEntries(upstreamResponse.headers.entries());
-  delete headers["content-length"];
-  delete headers["content-encoding"];
+  for (const name of RESPONSE_HOP_BY_HOP_HEADERS) {
+    delete headers[name];
+  }
   return headers;
 }
 
+// P1-CR-004 — the byte cap for the streaming pass-through path. Reuse
+// responseProtection.maxBytes (the existing hard response-size cap) so a single
+// dial governs all raw upstream-body reads; falls back to a 1 MiB default for a
+// hand-built config without responseProtection.
+function streamingPassThroughMaxBytes(config) {
+  const cap = config.responseProtection?.maxBytes;
+  return typeof cap === "number" && cap > 0 ? cap : 1048576;
+}
+
+// P1-CR-004 — TRUE bounded streaming pass-through. Pipe the upstream body to the
+// client response as it arrives (real streaming) while counting bytes; if the
+// running total exceeds maxBytes, abort: cancel the upstream reader and destroy
+// the client response so a long-lived or malicious stream cannot hold memory or
+// the connection open unbounded. Bytes already written cannot be retracted, so
+// this caps total memory/throughput, not the already-flushed prefix.
+async function pipeUpstreamBodyBounded({ upstreamResponse, response, maxBytes, logger = null, metrics = null, correlationId = null }) {
+  if (!upstreamResponse.body) {
+    response.end();
+    return;
+  }
+
+  const reader = upstreamResponse.body.getReader();
+  let received = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      received += value.byteLength;
+      if (maxBytes && received > maxBytes) {
+        // Over the cap: stop reading upstream and tear down the client write so
+        // the oversize stream is bounded (fail-closed on size).
+        void cancelReader(reader);
+        metrics?.increment("haechi_response_stream_truncated_total");
+        logger?.error("proxy_stream_pass_through_too_large", {
+          correlationId,
+          maxBytes
+        });
+        if (!response.writableEnded) {
+          response.destroy();
+        }
+        return;
+      }
+      // Respect downstream backpressure: stop pulling upstream until the client
+      // socket has drained.
+      const ok = response.write(Buffer.from(value));
+      if (!ok) {
+        await once(response, "drain");
+      }
+    }
+    response.end();
+  } catch (error) {
+    void cancelReader(reader);
+    if (!response.writableEnded) {
+      response.destroy();
+    }
+  }
+}
+
 function nodeResponseSink(response) {
   return {
     write(text) {
@@ -745,20 +864,42 @@ async function recordStreamDecision({ runtime, routeContext, blocked, summary, m
 }
 
 async function maybeProtectResponse({ upstreamResponse, routeContext, runtime, authContext = {}, issuedTokens = [], metrics = null }) {
-  const headers = Object.fromEntries(upstreamResponse.headers.entries());
+  // P1-CR-003 — content-encoding is read off the RAW upstream headers (before
+  // sanitation) for the compressed-response gate; the headers RETURNED to the
+  // client are always the sanitized set (no stale compression/length metadata).
+  const rawHeaders = Object.fromEntries(upstreamResponse.headers.entries());
+  const headers = sanitizeResponseHeaders(upstreamResponse);
 
   if (!runtime.config.responseProtection.enabled || !routeContext.protectResponse) {
-    const { body: rawBody } = await readUpstreamBody(upstreamResponse);
+    // P1-CR-004 — apply the same byte cap to this raw upstream-body read so an
+    // unprotected/forwarded response cannot be buffered unbounded. Fail closed
+    // (502) when the upstream body exceeds the cap.
+    const passThroughMax = streamingPassThroughMaxBytes(runtime.config);
+    const { body: rawBody, tooLarge } = await readUpstreamBody(upstreamResponse, { maxBytes: passThroughMax });
+    if (tooLarge) {
+      metrics?.increment("haechi_response_stream_truncated_total");
+      return {
+        decision: "response_unprotected_blocked",
+        status: 502,
+        headers: { "content-type": "application/json" },
+        body: Buffer.from(`${JSON.stringify({
+          error: "haechi_response_too_large",
+          reason: "response_body_too_large",
+          message: `Response body exceeds responseProtection.maxBytes (${passThroughMax})`
+        }, null, 2)}\n`)
+      };
+    }
     return {
       status: upstreamResponse.status,
-      headers,
+      // Re-set a correct content-length: this is a fully-buffered body.
+      headers: { ...headers, "content-length": String(rawBody.byteLength) },
       body: rawBody,
       decision: "forwarded"
     };
   }
 
   const responsePolicy = runtime.config.responseProtection;
-  const contentEncoding = headers["content-encoding"] ?? "";
+  const contentEncoding = rawHeaders["content-encoding"] ?? "";
   const bodyRead = await readUpstreamBody(upstreamResponse, { maxBytes: responsePolicy.maxBytes });
 
   if (bodyRead.tooLarge) {
@@ -910,12 +1051,12 @@ function restoreTokens(value, tokenValues) {
   return value;
 }
 
-async function forward({ upstream, request, body, timeoutMs = null, metrics = null }) {
+async function forward({ upstream, request, body, timeoutMs = null, metrics = null, forwardPolicy = {} }) {
   const target = buildUpstreamUrl({ upstream, requestUrl: request.url });
   try {
     return await fetch(target, {
       method: request.method,
-      headers: filteredHeaders(request.headers),
+      headers: filteredHeaders(request.headers, forwardPolicy),
       body: request.method === "GET" || request.method === "HEAD" ? undefined : body,
       signal: timeoutMs ? AbortSignal.timeout(timeoutMs) : undefined
     });
@@ -943,24 +1084,117 @@ function buildUpstreamUrl({ upstream, requestUrl }) {
   return new URL(`${parsed.pathname}${parsed.search}`, upstream.endsWith("/") ? upstream : `${upstream}/`);
 }
 
-function filteredHeaders(headers) {
+// P0-CR-001 — DEFAULT-DROP upstream header allowlist. The client's request
+// headers cross from the local gateway trust boundary into the MODEL PROVIDER
+// boundary, so the policy is: forward ONLY a known-safe set; everything else
+// (including ambient client credentials — Cookie, Proxy-Authorization, and the
+// client's gateway Authorization) is dropped. The conditional `authorization`
+// rule is handled in filteredHeaders against the forward policy. An operator can
+// additively widen the set with `target.forwardHeaders` for an unusual upstream.
+//
+// The forwarded set is exactly the headers the OpenAI-compatible / Anthropic /
+// Gemini adapters need: the provider key headers (x-api-key, x-goog-api-key,
+// openai-organization, openai-beta), provider version/feature pins
+// (anthropic-version, anthropic-beta), and benign request metadata (accept,
+// content-type — always rewritten to application/json, user-agent,
+// accept-language). content-type is set unconditionally below so it is NOT in
+// this set.
+const FORWARD_HEADER_ALLOWLIST = new Set([
+  "x-api-key",
+  "anthropic-version",
+  "anthropic-beta",
+  "x-goog-api-key",
+  "openai-organization",
+  "openai-beta",
+  "accept",
+  "user-agent",
+  "accept-language"
+]);
+
+// ALWAYS-DROP: ambient client credentials + hop-by-hop control headers. These
+// must NEVER reach the upstream regardless of the allowlist or the operator's
+// target.forwardHeaders extension (a fail-closed denylist that wins over both).
+//   - host / content-length: rewritten/recomputed by fetch for the new request.
+//   - cookie / set-cookie / proxy-authorization: ambient client credentials.
+//   - connection / keep-alive / te / trailer / transfer-encoding / upgrade:
+//     hop-by-hop headers (RFC 7230 §6.1) that must not be tunneled end-to-end.
+const FORWARD_HEADER_DENYLIST = new Set([
+  "host",
+  "content-length",
+  "cookie",
+  "set-cookie",
+  "proxy-authorization",
+  "connection",
+  "keep-alive",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+
+// `forwardPolicy` is built by createHaechiProxy from the runtime: it carries
+//   - gatewayConsumedAuthorization: true when auth.provider !== "none", i.e. the
+//     gateway authenticated the CLIENT with the request's Authorization. That
+//     header is the GATEWAY credential Haechi already consumed; forwarding it
+//     would leak a gateway secret into the model provider, so it is DROPPED.
+//     When false (auth.provider "none"), the client's Authorization is the
+//     UPSTREAM provider key (the OpenAI-compatible pass-through pattern), so it
+//     is FORWARDED.
+//   - extraHeaders: the operator's additive target.forwardHeaders allowlist
+//     (lowercase names) — never able to override the always-drop denylist.
+function filteredHeaders(headers, forwardPolicy = {}) {
+  const gatewayConsumedAuthorization = Boolean(forwardPolicy.gatewayConsumedAuthorization);
+  const extraHeaders = forwardPolicy.extraHeaders instanceof Set
+    ? forwardPolicy.extraHeaders
+    : new Set(Array.isArray(forwardPolicy.extraHeaders) ? forwardPolicy.extraHeaders : []);
+
   const next = new Headers();
   for (const [key, value] of Object.entries(headers)) {
-    if (!value || ["host", "content-length"].includes(key.toLowerCase())) {
+    if (!value) {
       continue;
     }
-    if (Array.isArray(value)) {
-      for (const item of value) {
-        next.append(key, item);
+    const name = key.toLowerCase();
+
+    // Always-drop wins over everything (credentials + hop-by-hop).
+    if (FORWARD_HEADER_DENYLIST.has(name)) {
+      continue;
+    }
+
+    // Conditional gateway-vs-upstream Authorization separation.
+    if (name === "authorization") {
+      if (gatewayConsumedAuthorization) {
+        // Gateway token Haechi already consumed — must not leak upstream.
+        continue;
       }
-    } else {
-      next.set(key, value);
+      // auth.provider "none": the client put the UPSTREAM provider key here.
+      appendHeader(next, key, value);
+      continue;
     }
+
+    // content-type is rewritten unconditionally below; skip the client's value.
+    if (name === "content-type") {
+      continue;
+    }
+
+    if (FORWARD_HEADER_ALLOWLIST.has(name) || extraHeaders.has(name)) {
+      appendHeader(next, key, value);
+    }
+    // Everything else is default-dropped (fail-closed).
   }
   next.set("content-type", "application/json");
   return next;
 }
 
+function appendHeader(target, key, value) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      target.append(key, item);
+    }
+  } else {
+    target.set(key, value);
+  }
+}
+
 function readBody(request, { maxBytes }) {
   return new Promise((resolve, reject) => {
     const chunks = [];
@@ -1036,9 +1270,13 @@ function isJson(contentType = "") {
 }
 
 function transformedJsonHeaders(headers) {
+  // P1-CR-003 — defensively strip the full hop-by-hop/compression set (the
+  // caller already passes the sanitized headers, but the transformed JSON body
+  // is freshly serialized, so any stale length/encoding metadata must not leak).
   const next = { ...headers, "content-type": "application/json" };
-  delete next["content-length"];
-  delete next["content-encoding"];
+  for (const name of RESPONSE_HOP_BY_HOP_HEADERS) {
+    delete next[name];
+  }
   return next;
 }
 
@@ -1071,10 +1309,13 @@ async function unprotectedResponseDecision({
   metrics?.increment("haechi_response_unprotected_total");
 
   if (allowed) {
+    // P1-CR-003 — `headers` is already the sanitized set (no stale
+    // compression/length metadata). Re-set a correct content-length for this
+    // fully-buffered body.
     return {
       decision,
       status: upstreamResponse.status,
-      headers,
+      headers: { ...headers, "content-length": String(rawBody.byteLength) },
       body: rawBody
     };
   }