llm-switcher 1.1.2 → 1.1.4

package/README.md

@@ -191,7 +191,16 @@ flowchart LR
 
 ---
 
-## Changes in 1.1.2
+## Changes in 1.1.4
+
+- **Contract lab privacy.** A sample that the gateway sends to intact carries no client content. Prompts, answers, tool arguments and results, files and user ids are masked on this machine before the upload. The fields that intact needs for analysis stay.
+
+### Changes in 1.1.3
+
+- **Dashboard.** Opened without its access token, the page no longer waits on "Checking status...". It says that it is locked and names `switch ui`, which opens it with the token.
+- **Dashboard.** The Codex model names (session, review, subagent) are on the **Models** tab, next to the other model settings. The **Blindfold** tab holds only the interceptor settings.
+
+### Changes in 1.1.2
 
 - **npm package.** Install with `npm install -g llm-switcher` and run `switch`. An npm install keeps its data in `~/.llm-switcher`, so an upgrade does not erase your configuration. A git checkout keeps its data next to the code, as before.
 - **Contract lab.** The gateway can send a small sample of complete exchanges to an [intact](https://github.com/louisphamdev/intact) server, which finds fields that the converter loses. It is off by default. See "Contract lab" below.
@@ -547,6 +556,8 @@ re-opened from a shell where the shim is on `PATH`.
 
 The contract lab finds fields that the converter loses. It is off by default.
 
+Before it sends a sample, the gateway masks the content of the client: prompts, answers, system text, thinking, tool arguments and results, files, images and user ids become `x` of the same length. Keys, types, roles, model names, tool names and schemas, numbers and event names stay, so intact can analyse the shape.
+
 - Set `contractLab: {url, apiKey, enabled}` in `config.json`. If `enabled` is `true`, the gateway sends a sample of complete exchanges to intact.
 - `switch contract-probe [--model m]` sends six test requests per model and format through the gateway.
 - `switch contract-check` gets the open findings from intact and writes one test file for each lost field.

package/README.vi.md

@@ -191,7 +191,16 @@ flowchart LR
 
 ---
 
-## Thay đổi trong bản 1.1.2
+## Thay đổi trong bản 1.1.4
+
+- **Bảo mật contract lab.** Mẫu mà gateway gửi lên intact không chứa nội dung của client. Prompt, câu trả lời, tham số và kết quả của tool, file và user id bị che ngay trên máy trước khi gửi. Các field mà intact cần để phân tích được giữ nguyên.
+
+### Thay đổi trong bản 1.1.3
+
+- **Dashboard.** Khi mở mà thiếu access token, trang không còn đứng ở "Checking status...". Trang báo đang bị khoá và chỉ lệnh `switch ui`, lệnh này mở trang kèm token.
+- **Dashboard.** Tên model của Codex (session, review, subagent) nằm ở tab **Models**, cạnh các cấu hình model khác. Tab **Blindfold** chỉ còn cấu hình interceptor.
+
+### Thay đổi trong bản 1.1.2
 
 - **Gói npm.** Cài bằng `npm install -g llm-switcher` rồi chạy `switch`. Bản cài bằng npm lưu dữ liệu trong `~/.llm-switcher`, nên nâng cấp không xoá cấu hình. Bản git checkout vẫn lưu dữ liệu cạnh mã nguồn như trước.
 - **Contract lab.** Gateway có thể gửi một phần nhỏ các lượt trao đổi hoàn chỉnh lên server [intact](https://github.com/louisphamdev/intact) để tìm field mà converter làm mất. Mặc định tính năng này tắt. Xem mục "Contract lab" bên dưới.
@@ -547,6 +556,8 @@ trong `PATH`.
 
 Contract lab tìm các field mà converter làm mất. Mặc định tính năng này tắt.
 
+Trước khi gửi mẫu, gateway che nội dung của client: prompt, câu trả lời, system text, thinking, tham số và kết quả của tool, file, ảnh và user id đều thành chuỗi `x` cùng độ dài. Tên key, type, role, tên model, tên và schema của tool, số và tên event được giữ nguyên, để intact phân tích được hình dạng.
+
 - Đặt `contractLab: {url, apiKey, enabled}` trong `config.json`. Nếu `enabled` là `true`, gateway gửi một phần các lượt trao đổi hoàn chỉnh lên intact.
 - `switch contract-probe [--model m]` gửi sáu request thử cho mỗi model và mỗi format qua gateway.
 - `switch contract-check` lấy các finding còn mở từ intact và ghi một file test cho mỗi field bị mất.

package/contract.mjs

@@ -61,6 +61,69 @@ export function switcherVersion() {
 }
 
 /** Copies what the gateway writes to the client. Past the cap the side is dropped, not cut. */
+// ---------------- masking of client content ----------------
+// A half leaves this machine. The client's own content (prompts, answers, tool arguments and results,
+// files, user ids) is replaced by "x" of the same byte length; everything intact needs to analyse the
+// shape (keys, types, roles, models, tool names, numbers, flags, event names) stays as sent.
+const TEXT_KEYS = new Set(['text', 'content', 'thinking', 'system', 'instructions', 'delta', 'reasoning_content',
+  'refusal', 'output', 'input', 'data', 'url', 'file_data', 'encrypted_content', 'user', 'user_id', 'prompt',
+  'summary', 'output_text', 'partial_json', 'arguments', 'args']);
+const SSE_EVENT_RE = /^[A-Za-z0-9_.:-]{1,64}$/;
+
+const maskString = (s) => 'x'.repeat(Buffer.byteLength(s));
+
+// Inside a payload (tool arguments, tool input, a function response) every value belongs to the client.
+function maskPayload(v) {
+  if (typeof v === 'string') return maskString(v);
+  if (Array.isArray(v)) return v.map(maskPayload);
+  if (v && typeof v === 'object') return Object.fromEntries(Object.entries(v).map(([k, c]) => [k, maskPayload(c)]));
+  return v;
+}
+
+// A string that holds JSON (tool arguments) keeps its keys, so intact still sees the nested shape.
+function maskJsonString(s) {
+  const t = s.trim();
+  if ((t.startsWith('{') && t.endsWith('}')) || (t.startsWith('[') && t.endsWith(']'))) {
+    try { return JSON.stringify(maskPayload(JSON.parse(t))); } catch {}
+  }
+  return maskString(s);
+}
+
+function maskValue(v, parentKey = '') {
+  if (Array.isArray(v)) return v.map((c) => maskValue(c, parentKey));
+  if (!v || typeof v !== 'object') return v;
+  const out = {};
+  for (const [k, c] of Object.entries(v)) {
+    const payload = k === 'args' || k === 'arguments' || (k === 'input' && c && typeof c === 'object' && !Array.isArray(c))
+      || (k === 'response' && parentKey === 'functionResponse');
+    if (payload) out[k] = typeof c === 'string' ? maskJsonString(c) : maskPayload(c);
+    else if (typeof c === 'string' && TEXT_KEYS.has(k)) out[k] = (k === 'partial_json') ? maskJsonString(c) : maskString(c);
+    else out[k] = maskValue(c, k);
+  }
+  return out;
+}
+
+/** Masks the client's content in a request or response body: JSON, SSE, or anything else (masked whole). */
+export function maskHalf(text) {
+  if (!text) return '';
+  try { return JSON.stringify(maskValue(JSON.parse(text))); } catch {}
+  const lines = text.split('\n');
+  if (!lines.some((l) => l.startsWith('data:'))) return maskString(text);
+  return lines.map((line) => {
+    if (line === '' || line === '\r' || line.startsWith(':')) return line;
+    if (line.startsWith('event:')) {
+      const name = line.slice(6).trim();
+      return SSE_EVENT_RE.test(name) ? line : `event: ${maskString(name)}`;
+    }
+    if (line.startsWith('data:')) {
+      const data = line.slice(5).trim();
+      if (data === '[DONE]') return line;
+      try { return `data: ${JSON.stringify(maskValue(JSON.parse(data)))}`; } catch { return `data: ${maskString(data)}`; }
+    }
+    return maskString(line);
+  }).join('\n');
+}
+
 export function createHalfTap(limit = MAX_HALF_BYTES) {
   const chunks = [];
   let size = 0;
@@ -206,8 +269,8 @@ export function createContractLab(options = {}) {
 
   async function send(s, { traceId, half }) {
     const body = JSON.stringify({
-      toolRequest: half.toolRequest || '',
-      toolResponse: half.toolResponse || '',
+      toolRequest: maskHalf(half.toolRequest || ''),
+      toolResponse: maskHalf(half.toolResponse || ''),
       ...(half.toolVersion ? { toolVersion: half.toolVersion } : {}),
       switcherVersion: version(),
       converter: { inFormat: half.inFormat, outFormat: half.outFormat }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-switcher",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code, Codex, OpenAI and Gemini clients",
   "keywords": [
     "llm",

package/tests/contract-lab.test.mjs

@@ -398,8 +398,13 @@ test('the half of a sampled request reaches intact with the exchange and the ver
   assert.deepEqual(last.body.converter, { inFormat: 'anthropic', outFormat: 'anthropic' });
   assert.equal(last.body.toolVersion, '1.2.3');
   assert.match(last.body.switcherVersion, SWITCHER_VERSION_RE);
-  assert.equal(JSON.parse(last.body.toolRequest).messages[0].content, 'hello');
-  assert.equal(JSON.parse(last.body.toolResponse).content[0].text, 'direct ok');
+  // The client's content never leaves the machine: it arrives masked, same length; the shape stays.
+  const sentReq = JSON.parse(last.body.toolRequest);
+  assert.equal(sentReq.messages[0].content, 'x'.repeat('hello'.length));
+  assert.equal(sentReq.messages[0].role, 'user');
+  assert.equal(sentReq.model, 'claude-opus-4-6');
+  assert.equal(JSON.parse(last.body.toolResponse).content[0].text, 'x'.repeat('direct ok'.length));
+  assert.ok(!last.body.toolRequest.includes('hello') && !last.body.toolResponse.includes('direct ok'), 'no raw content in the half');
 });
 
 test('with intact at a closed port the tool answer is byte-identical to the answer with the lab off', async () => {
@@ -552,9 +557,9 @@ test('a sampled Codex WS turn is tagged and its half reaches intact', async () =
   assert.match(body.switcherVersion, SWITCHER_VERSION_RE);
   const asked = JSON.parse(body.toolRequest);
   assert.equal(asked.type, 'response.create');
-  assert.equal(asked.input, 'hello over ws');
+  assert.equal(asked.input, 'x'.repeat('hello over ws'.length), 'the WS request is masked');
   assert.ok(body.toolResponse.includes('event: response.completed'), 'the half holds the events the turn wrote');
-  assert.ok(body.toolResponse.includes('ws ok'), 'the answer text is in the half');
+  assert.ok(!body.toolResponse.includes('ws ok'), 'the answer text is masked in the half');
 });
 
 test('a Codex WS client can never choose the trace id, and a down intact leaves the turn unchanged', async () => {

package/tests/contract-mask.test.mjs

@@ -0,0 +1,99 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { maskHalf } from '../contract.mjs';
+
+const SECRET = 'SECRET-PII-marker';
+const KEEP = 'keep-model-name';
+const bytes = (s) => Buffer.byteLength(s);
+
+// Every body puts SECRET in each place a client writes its own content, and KEEP in fields that
+// analysis needs. After masking, SECRET must be gone and KEEP must stay.
+const bodies = {
+  anthropic: {
+    model: KEEP, max_tokens: 64, system: [{ type: 'text', text: `sys ${SECRET}` }],
+    metadata: { user_id: `u ${SECRET}` },
+    tools: [{ name: 'get_weather', description: 'Current weather', input_schema: { type: 'object', properties: { city: { type: 'string' } } } }],
+    messages: [
+      { role: 'user', content: `hi ${SECRET}` },
+      { role: 'assistant', content: [{ type: 'thinking', thinking: `t ${SECRET}`, signature: 'sig' },
+        { type: 'tool_use', id: 'toolu_1', name: 'get_weather', input: { city: `c ${SECRET}` } }] },
+      { role: 'user', content: [{ type: 'tool_result', tool_use_id: 'toolu_1', content: [{ type: 'text', text: `r ${SECRET}` }] },
+        { type: 'image', source: { type: 'base64', media_type: 'image/png', data: `img ${SECRET}` } }] }
+    ]
+  },
+  openaiChat: {
+    model: KEEP, user: `u ${SECRET}`, temperature: 0.2,
+    messages: [
+      { role: 'system', content: `s ${SECRET}` },
+      { role: 'user', content: [{ type: 'text', text: `q ${SECRET}` }, { type: 'image_url', image_url: { url: `data:${SECRET}` } }] },
+      { role: 'assistant', content: null, tool_calls: [{ id: 'call_1', type: 'function', function: { name: 'get_weather', arguments: JSON.stringify({ city: `c ${SECRET}` }) } }] },
+      { role: 'tool', tool_call_id: 'call_1', content: `o ${SECRET}` }
+    ]
+  },
+  responses: {
+    model: KEEP, instructions: `i ${SECRET}`,
+    input: [
+      { type: 'message', role: 'user', content: [{ type: 'input_text', text: `q ${SECRET}` }] },
+      { type: 'function_call', call_id: 'c1', name: 'get_weather', arguments: JSON.stringify({ city: `c ${SECRET}` }) },
+      { type: 'function_call_output', call_id: 'c1', output: `o ${SECRET}` },
+      { type: 'reasoning', summary: [{ type: 'summary_text', text: `r ${SECRET}` }], encrypted_content: `e ${SECRET}` }
+    ]
+  },
+  gemini: {
+    systemInstruction: { parts: [{ text: `s ${SECRET}` }] },
+    contents: [
+      { role: 'user', parts: [{ text: `q ${SECRET}` }] },
+      { role: 'model', parts: [{ functionCall: { name: 'get_weather', args: { city: `c ${SECRET}` } } }] },
+      { role: 'user', parts: [{ functionResponse: { name: 'get_weather', response: { temp: `t ${SECRET}` } } }] }
+    ]
+  }
+};
+
+for (const [name, body] of Object.entries(bodies)) {
+  test(`${name}: client content is masked, analysis fields stay`, () => {
+    const raw = JSON.stringify(body);
+    const out = maskHalf(raw);
+    assert.ok(!out.includes(SECRET), `${name} leaks content: ${out}`);
+    const parsed = JSON.parse(out);
+    if (body.model) assert.equal(parsed.model, KEEP);
+    assert.ok(out.includes('get_weather'), 'tool names stay');
+    if (raw.includes('"type":')) assert.ok(out.includes('"type":'), 'types stay');
+  });
+}
+
+test('masking keeps the byte length of every masked string', () => {
+  const out = JSON.parse(maskHalf(JSON.stringify({ model: 'm', messages: [{ role: 'user', content: 'héllo wörld' }] })));
+  assert.equal(bytes(out.messages[0].content), bytes('héllo wörld'));
+  assert.match(out.messages[0].content, /^x+$/);
+});
+
+test('a JSON string argument keeps its keys and masks its values', () => {
+  const out = JSON.parse(maskHalf(JSON.stringify(bodies.openaiChat)));
+  const args = JSON.parse(out.messages[2].tool_calls[0].function.arguments);
+  assert.deepEqual(Object.keys(args), ['city']);
+  assert.match(args.city, /^x+$/);
+});
+
+test('an SSE stream masks every data line and keeps event names', () => {
+  const sse = [
+    'event: message_start', `data: ${JSON.stringify({ type: 'message_start', message: { model: KEEP, role: 'assistant', content: [] } })}`, '',
+    'event: content_block_delta', `data: ${JSON.stringify({ type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text: `a ${SECRET}` } })}`, '',
+    `data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: `b ${SECRET}` } }] })}`, '',
+    `data: ${JSON.stringify({ type: 'response.output_text.delta', delta: `c ${SECRET}` })}`, '',
+    'data: [DONE]', ''
+  ].join('\n');
+  const out = maskHalf(sse);
+  assert.ok(!out.includes(SECRET), out);
+  assert.ok(out.includes('event: content_block_delta'));
+  assert.ok(out.includes('"text_delta"') && out.includes(KEEP));
+  assert.ok(out.includes('data: [DONE]'));
+});
+
+test('text that is not JSON, or a cut body, is masked whole', () => {
+  const cut = JSON.stringify(bodies.anthropic).slice(0, 120);
+  for (const t of [`plain ${SECRET}`, cut]) {
+    const out = maskHalf(t);
+    assert.ok(!out.includes('SECRET'), out);
+    assert.equal(bytes(out), bytes(t));
+  }
+});

package/ui.html

@@ -940,7 +940,7 @@
         <button id="tab-button-general" type="button" class="tab-btn active" role="tab" aria-selected="true" aria-controls="tab-general" tabindex="0" onclick="switchTab('tab-general')">General</button>
         <button id="tab-button-routing" type="button" class="tab-btn" role="tab" aria-selected="false" aria-controls="tab-routing" tabindex="-1" onclick="switchTab('tab-routing')">Routing</button>
         <button id="tab-button-models" type="button" class="tab-btn" role="tab" aria-selected="false" aria-controls="tab-models" tabindex="-1" onclick="switchTab('tab-models')">Models</button>
-        <button id="tab-button-codex" type="button" class="tab-btn" role="tab" aria-selected="false" aria-controls="tab-codex" tabindex="-1" onclick="switchTab('tab-codex')" hidden>Codex</button>
+        <button id="tab-button-codex" type="button" class="tab-btn" role="tab" aria-selected="false" aria-controls="tab-codex" tabindex="-1" onclick="switchTab('tab-codex')" hidden>Blindfold</button>
         <button id="tab-button-inspector" type="button" class="tab-btn" role="tab" aria-selected="false" aria-controls="tab-inspector" tabindex="-1" onclick="switchTab('tab-inspector'); loadInspectorLogs();">Request log</button>
       </div>
 
@@ -1037,23 +1037,10 @@
             <!-- Dynamically populated via renderModelSlots -->
           </div>
 
-          <!-- Model Explorer Box -->
-          <div class="form-group full" id="model-browser" style="display: none; margin-top: 14px;">
-            <div class="model-browser">
-              <div class="model-browser-header">
-                <span id="model-count-label" style="font-size: 11px; font-weight: 600; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.04em;">Available Upstream Models</span>
-                <label class="sr-only" for="model-filter">Filter upstream models</label>
-                <input type="search" id="model-filter" placeholder="Filter models" style="padding: 5px 9px; font-size: 11px; width: 200px;" oninput="filterModels()">
-              </div>
-              <div id="model-items" class="model-list-scroll"></div>
-            </div>
-          </div>
-        </div>
-
-        <!-- Tab 4: Live Inspector -->
-        <!-- Tab 4: Codex — only the names this CLI is allowed to observe -->
-        <div id="tab-codex" class="tab-pane" role="tabpanel" aria-labelledby="tab-button-codex" hidden>
-          <div class="warning-callout">
+          <!-- Codex model config lives with the other model config; only the interceptor stays on its own tab. -->
+          <div id="codex-names" style="margin-top: 16px;" hidden>
+            <span style="font-size: 12px; font-weight: 600; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.04em;">Names Codex sees</span>
+            <div class="warning-callout">
             <span class="badge badge-convert">NOTE</span>
             <div>
               <strong>Codex sees only these names.</strong> The slot aliases <code>main</code>, <code>review</code> and
@@ -1076,7 +1063,24 @@
               <input type="text" id="p-public-subagent" list="model-options" placeholder="e.g. gpt-5.6-luna">
             </div>
           </div>
+          </div>
 
+          <!-- Model Explorer Box -->
+          <div class="form-group full" id="model-browser" style="display: none; margin-top: 14px;">
+            <div class="model-browser">
+              <div class="model-browser-header">
+                <span id="model-count-label" style="font-size: 11px; font-weight: 600; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.04em;">Available Upstream Models</span>
+                <label class="sr-only" for="model-filter">Filter upstream models</label>
+                <input type="search" id="model-filter" placeholder="Filter models" style="padding: 5px 9px; font-size: 11px; width: 200px;" oninput="filterModels()">
+              </div>
+              <div id="model-items" class="model-list-scroll"></div>
+            </div>
+          </div>
+        </div>
+
+        <!-- Tab 4: Live Inspector -->
+        <!-- Tab 4: Codex — only the names this CLI is allowed to observe -->
+        <div id="tab-codex" class="tab-pane" role="tabpanel" aria-labelledby="tab-button-codex" hidden>
           <div class="form-grid" style="border-top: 1px solid var(--border); padding-top: 12px; margin-top: 12px;">
             <div class="form-group full">
               <label style="display: flex; align-items: center; gap: 6px; cursor: pointer; text-transform: none;">
@@ -1382,6 +1386,8 @@
       const applies = servesCodex(format);
       const btn = document.getElementById('tab-button-codex');
       if (btn) btn.hidden = !applies;
+      const names = document.getElementById('codex-names');
+      if (names) names.hidden = !applies;
       if (!applies && document.getElementById('tab-codex')?.classList.contains('active')) {
         switchTab('tab-general');
       }
@@ -1468,6 +1474,11 @@
       try {
         const res = await api('/api/status');
         const data = await res.json();
+        if (res.status === 401) {
+          document.getElementById('status-title').textContent = 'Dashboard locked';
+          document.getElementById('status-sub').textContent = 'Run `switch ui` in a terminal. It opens this page with its access token.';
+          return;
+        }
         if (!res.ok) {
           showToast(data.error || `Gateway error HTTP ${res.status}`, true);
           return;