llm-switcher 1.1.3 → 1.1.4

package/README.md

@@ -191,7 +191,11 @@ flowchart LR
 
 ---
 
-## Changes in 1.1.3
+## Changes in 1.1.4
+
+- **Contract lab privacy.** A sample that the gateway sends to intact carries no client content. Prompts, answers, tool arguments and results, files and user ids are masked on this machine before the upload. The fields that intact needs for analysis stay.
+
+### Changes in 1.1.3
 
 - **Dashboard.** Opened without its access token, the page no longer waits on "Checking status...". It says that it is locked and names `switch ui`, which opens it with the token.
 - **Dashboard.** The Codex model names (session, review, subagent) are on the **Models** tab, next to the other model settings. The **Blindfold** tab holds only the interceptor settings.
@@ -552,6 +556,8 @@ re-opened from a shell where the shim is on `PATH`.
 
 The contract lab finds fields that the converter loses. It is off by default.
 
+Before it sends a sample, the gateway masks the content of the client: prompts, answers, system text, thinking, tool arguments and results, files, images and user ids become `x` of the same length. Keys, types, roles, model names, tool names and schemas, numbers and event names stay, so intact can analyse the shape.
+
 - Set `contractLab: {url, apiKey, enabled}` in `config.json`. If `enabled` is `true`, the gateway sends a sample of complete exchanges to intact.
 - `switch contract-probe [--model m]` sends six test requests per model and format through the gateway.
 - `switch contract-check` gets the open findings from intact and writes one test file for each lost field.

package/README.vi.md

@@ -191,7 +191,11 @@ flowchart LR
 
 ---
 
-## Thay đổi trong bản 1.1.3
+## Thay đổi trong bản 1.1.4
+
+- **Bảo mật contract lab.** Mẫu mà gateway gửi lên intact không chứa nội dung của client. Prompt, câu trả lời, tham số và kết quả của tool, file và user id bị che ngay trên máy trước khi gửi. Các field mà intact cần để phân tích được giữ nguyên.
+
+### Thay đổi trong bản 1.1.3
 
 - **Dashboard.** Khi mở mà thiếu access token, trang không còn đứng ở "Checking status...". Trang báo đang bị khoá và chỉ lệnh `switch ui`, lệnh này mở trang kèm token.
 - **Dashboard.** Tên model của Codex (session, review, subagent) nằm ở tab **Models**, cạnh các cấu hình model khác. Tab **Blindfold** chỉ còn cấu hình interceptor.
@@ -552,6 +556,8 @@ trong `PATH`.
 
 Contract lab tìm các field mà converter làm mất. Mặc định tính năng này tắt.
 
+Trước khi gửi mẫu, gateway che nội dung của client: prompt, câu trả lời, system text, thinking, tham số và kết quả của tool, file, ảnh và user id đều thành chuỗi `x` cùng độ dài. Tên key, type, role, tên model, tên và schema của tool, số và tên event được giữ nguyên, để intact phân tích được hình dạng.
+
 - Đặt `contractLab: {url, apiKey, enabled}` trong `config.json`. Nếu `enabled` là `true`, gateway gửi một phần các lượt trao đổi hoàn chỉnh lên intact.
 - `switch contract-probe [--model m]` gửi sáu request thử cho mỗi model và mỗi format qua gateway.
 - `switch contract-check` lấy các finding còn mở từ intact và ghi một file test cho mỗi field bị mất.

package/contract.mjs

@@ -61,6 +61,69 @@ export function switcherVersion() {
 }
 
 /** Copies what the gateway writes to the client. Past the cap the side is dropped, not cut. */
+// ---------------- masking of client content ----------------
+// A half leaves this machine. The client's own content (prompts, answers, tool arguments and results,
+// files, user ids) is replaced by "x" of the same byte length; everything intact needs to analyse the
+// shape (keys, types, roles, models, tool names, numbers, flags, event names) stays as sent.
+const TEXT_KEYS = new Set(['text', 'content', 'thinking', 'system', 'instructions', 'delta', 'reasoning_content',
+  'refusal', 'output', 'input', 'data', 'url', 'file_data', 'encrypted_content', 'user', 'user_id', 'prompt',
+  'summary', 'output_text', 'partial_json', 'arguments', 'args']);
+const SSE_EVENT_RE = /^[A-Za-z0-9_.:-]{1,64}$/;
+
+const maskString = (s) => 'x'.repeat(Buffer.byteLength(s));
+
+// Inside a payload (tool arguments, tool input, a function response) every value belongs to the client.
+function maskPayload(v) {
+  if (typeof v === 'string') return maskString(v);
+  if (Array.isArray(v)) return v.map(maskPayload);
+  if (v && typeof v === 'object') return Object.fromEntries(Object.entries(v).map(([k, c]) => [k, maskPayload(c)]));
+  return v;
+}
+
+// A string that holds JSON (tool arguments) keeps its keys, so intact still sees the nested shape.
+function maskJsonString(s) {
+  const t = s.trim();
+  if ((t.startsWith('{') && t.endsWith('}')) || (t.startsWith('[') && t.endsWith(']'))) {
+    try { return JSON.stringify(maskPayload(JSON.parse(t))); } catch {}
+  }
+  return maskString(s);
+}
+
+function maskValue(v, parentKey = '') {
+  if (Array.isArray(v)) return v.map((c) => maskValue(c, parentKey));
+  if (!v || typeof v !== 'object') return v;
+  const out = {};
+  for (const [k, c] of Object.entries(v)) {
+    const payload = k === 'args' || k === 'arguments' || (k === 'input' && c && typeof c === 'object' && !Array.isArray(c))
+      || (k === 'response' && parentKey === 'functionResponse');
+    if (payload) out[k] = typeof c === 'string' ? maskJsonString(c) : maskPayload(c);
+    else if (typeof c === 'string' && TEXT_KEYS.has(k)) out[k] = (k === 'partial_json') ? maskJsonString(c) : maskString(c);
+    else out[k] = maskValue(c, k);
+  }
+  return out;
+}
+
+/** Masks the client's content in a request or response body: JSON, SSE, or anything else (masked whole). */
+export function maskHalf(text) {
+  if (!text) return '';
+  try { return JSON.stringify(maskValue(JSON.parse(text))); } catch {}
+  const lines = text.split('\n');
+  if (!lines.some((l) => l.startsWith('data:'))) return maskString(text);
+  return lines.map((line) => {
+    if (line === '' || line === '\r' || line.startsWith(':')) return line;
+    if (line.startsWith('event:')) {
+      const name = line.slice(6).trim();
+      return SSE_EVENT_RE.test(name) ? line : `event: ${maskString(name)}`;
+    }
+    if (line.startsWith('data:')) {
+      const data = line.slice(5).trim();
+      if (data === '[DONE]') return line;
+      try { return `data: ${JSON.stringify(maskValue(JSON.parse(data)))}`; } catch { return `data: ${maskString(data)}`; }
+    }
+    return maskString(line);
+  }).join('\n');
+}
+
 export function createHalfTap(limit = MAX_HALF_BYTES) {
   const chunks = [];
   let size = 0;
@@ -206,8 +269,8 @@ export function createContractLab(options = {}) {
 
   async function send(s, { traceId, half }) {
     const body = JSON.stringify({
-      toolRequest: half.toolRequest || '',
-      toolResponse: half.toolResponse || '',
+      toolRequest: maskHalf(half.toolRequest || ''),
+      toolResponse: maskHalf(half.toolResponse || ''),
       ...(half.toolVersion ? { toolVersion: half.toolVersion } : {}),
       switcherVersion: version(),
       converter: { inFormat: half.inFormat, outFormat: half.outFormat }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-switcher",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code, Codex, OpenAI and Gemini clients",
   "keywords": [
     "llm",

package/tests/contract-lab.test.mjs

@@ -398,8 +398,13 @@ test('the half of a sampled request reaches intact with the exchange and the ver
   assert.deepEqual(last.body.converter, { inFormat: 'anthropic', outFormat: 'anthropic' });
   assert.equal(last.body.toolVersion, '1.2.3');
   assert.match(last.body.switcherVersion, SWITCHER_VERSION_RE);
-  assert.equal(JSON.parse(last.body.toolRequest).messages[0].content, 'hello');
-  assert.equal(JSON.parse(last.body.toolResponse).content[0].text, 'direct ok');
+  // The client's content never leaves the machine: it arrives masked, same length; the shape stays.
+  const sentReq = JSON.parse(last.body.toolRequest);
+  assert.equal(sentReq.messages[0].content, 'x'.repeat('hello'.length));
+  assert.equal(sentReq.messages[0].role, 'user');
+  assert.equal(sentReq.model, 'claude-opus-4-6');
+  assert.equal(JSON.parse(last.body.toolResponse).content[0].text, 'x'.repeat('direct ok'.length));
+  assert.ok(!last.body.toolRequest.includes('hello') && !last.body.toolResponse.includes('direct ok'), 'no raw content in the half');
 });
 
 test('with intact at a closed port the tool answer is byte-identical to the answer with the lab off', async () => {
@@ -552,9 +557,9 @@ test('a sampled Codex WS turn is tagged and its half reaches intact', async () =
   assert.match(body.switcherVersion, SWITCHER_VERSION_RE);
   const asked = JSON.parse(body.toolRequest);
   assert.equal(asked.type, 'response.create');
-  assert.equal(asked.input, 'hello over ws');
+  assert.equal(asked.input, 'x'.repeat('hello over ws'.length), 'the WS request is masked');
   assert.ok(body.toolResponse.includes('event: response.completed'), 'the half holds the events the turn wrote');
-  assert.ok(body.toolResponse.includes('ws ok'), 'the answer text is in the half');
+  assert.ok(!body.toolResponse.includes('ws ok'), 'the answer text is masked in the half');
 });
 
 test('a Codex WS client can never choose the trace id, and a down intact leaves the turn unchanged', async () => {

package/tests/contract-mask.test.mjs

@@ -0,0 +1,99 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { maskHalf } from '../contract.mjs';
+
+const SECRET = 'SECRET-PII-marker';
+const KEEP = 'keep-model-name';
+const bytes = (s) => Buffer.byteLength(s);
+
+// Every body puts SECRET in each place a client writes its own content, and KEEP in fields that
+// analysis needs. After masking, SECRET must be gone and KEEP must stay.
+const bodies = {
+  anthropic: {
+    model: KEEP, max_tokens: 64, system: [{ type: 'text', text: `sys ${SECRET}` }],
+    metadata: { user_id: `u ${SECRET}` },
+    tools: [{ name: 'get_weather', description: 'Current weather', input_schema: { type: 'object', properties: { city: { type: 'string' } } } }],
+    messages: [
+      { role: 'user', content: `hi ${SECRET}` },
+      { role: 'assistant', content: [{ type: 'thinking', thinking: `t ${SECRET}`, signature: 'sig' },
+        { type: 'tool_use', id: 'toolu_1', name: 'get_weather', input: { city: `c ${SECRET}` } }] },
+      { role: 'user', content: [{ type: 'tool_result', tool_use_id: 'toolu_1', content: [{ type: 'text', text: `r ${SECRET}` }] },
+        { type: 'image', source: { type: 'base64', media_type: 'image/png', data: `img ${SECRET}` } }] }
+    ]
+  },
+  openaiChat: {
+    model: KEEP, user: `u ${SECRET}`, temperature: 0.2,
+    messages: [
+      { role: 'system', content: `s ${SECRET}` },
+      { role: 'user', content: [{ type: 'text', text: `q ${SECRET}` }, { type: 'image_url', image_url: { url: `data:${SECRET}` } }] },
+      { role: 'assistant', content: null, tool_calls: [{ id: 'call_1', type: 'function', function: { name: 'get_weather', arguments: JSON.stringify({ city: `c ${SECRET}` }) } }] },
+      { role: 'tool', tool_call_id: 'call_1', content: `o ${SECRET}` }
+    ]
+  },
+  responses: {
+    model: KEEP, instructions: `i ${SECRET}`,
+    input: [
+      { type: 'message', role: 'user', content: [{ type: 'input_text', text: `q ${SECRET}` }] },
+      { type: 'function_call', call_id: 'c1', name: 'get_weather', arguments: JSON.stringify({ city: `c ${SECRET}` }) },
+      { type: 'function_call_output', call_id: 'c1', output: `o ${SECRET}` },
+      { type: 'reasoning', summary: [{ type: 'summary_text', text: `r ${SECRET}` }], encrypted_content: `e ${SECRET}` }
+    ]
+  },
+  gemini: {
+    systemInstruction: { parts: [{ text: `s ${SECRET}` }] },
+    contents: [
+      { role: 'user', parts: [{ text: `q ${SECRET}` }] },
+      { role: 'model', parts: [{ functionCall: { name: 'get_weather', args: { city: `c ${SECRET}` } } }] },
+      { role: 'user', parts: [{ functionResponse: { name: 'get_weather', response: { temp: `t ${SECRET}` } } }] }
+    ]
+  }
+};
+
+for (const [name, body] of Object.entries(bodies)) {
+  test(`${name}: client content is masked, analysis fields stay`, () => {
+    const raw = JSON.stringify(body);
+    const out = maskHalf(raw);
+    assert.ok(!out.includes(SECRET), `${name} leaks content: ${out}`);
+    const parsed = JSON.parse(out);
+    if (body.model) assert.equal(parsed.model, KEEP);
+    assert.ok(out.includes('get_weather'), 'tool names stay');
+    if (raw.includes('"type":')) assert.ok(out.includes('"type":'), 'types stay');
+  });
+}
+
+test('masking keeps the byte length of every masked string', () => {
+  const out = JSON.parse(maskHalf(JSON.stringify({ model: 'm', messages: [{ role: 'user', content: 'héllo wörld' }] })));
+  assert.equal(bytes(out.messages[0].content), bytes('héllo wörld'));
+  assert.match(out.messages[0].content, /^x+$/);
+});
+
+test('a JSON string argument keeps its keys and masks its values', () => {
+  const out = JSON.parse(maskHalf(JSON.stringify(bodies.openaiChat)));
+  const args = JSON.parse(out.messages[2].tool_calls[0].function.arguments);
+  assert.deepEqual(Object.keys(args), ['city']);
+  assert.match(args.city, /^x+$/);
+});
+
+test('an SSE stream masks every data line and keeps event names', () => {
+  const sse = [
+    'event: message_start', `data: ${JSON.stringify({ type: 'message_start', message: { model: KEEP, role: 'assistant', content: [] } })}`, '',
+    'event: content_block_delta', `data: ${JSON.stringify({ type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text: `a ${SECRET}` } })}`, '',
+    `data: ${JSON.stringify({ choices: [{ index: 0, delta: { content: `b ${SECRET}` } }] })}`, '',
+    `data: ${JSON.stringify({ type: 'response.output_text.delta', delta: `c ${SECRET}` })}`, '',
+    'data: [DONE]', ''
+  ].join('\n');
+  const out = maskHalf(sse);
+  assert.ok(!out.includes(SECRET), out);
+  assert.ok(out.includes('event: content_block_delta'));
+  assert.ok(out.includes('"text_delta"') && out.includes(KEEP));
+  assert.ok(out.includes('data: [DONE]'));
+});
+
+test('text that is not JSON, or a cut body, is masked whole', () => {
+  const cut = JSON.stringify(bodies.anthropic).slice(0, 120);
+  for (const t of [`plain ${SECRET}`, cut]) {
+    const out = maskHalf(t);
+    assert.ok(!out.includes('SECRET'), out);
+    assert.equal(bytes(out), bytes(t));
+  }
+});