llm-switcher 1.2.8 → 1.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-switcher",
-  "version": "1.2.8",
+  "version": "1.2.9",
   "description": "Zero-dependency multi-protocol edge gateway & provider switcher for Claude Code and Codex, with OpenAI-compatible, Anthropic and Vertex upstreams",
   "keywords": [
     "llm",

package/proxy.mjs

@@ -500,7 +500,54 @@ function previewOf(ir) {
 // ----------------------------------------------------
 const HOP_BY_HOP = new Set(['content-length', 'content-encoding', 'transfer-encoding', 'connection', 'keep-alive']);
 
-async function forwardAnthropicDirect(res, payload, bodyBuffer, url, headers, mappedModel, signal, profile) {
+// Bifrost: intact names, per model, the User-Agent prefix of the provider's own client (bifrost_ua).
+// When the caller is that client, the request crosses as it is: only the key changes.
+const bifrostUACache = new Map();
+async function bifrostUAFor(profile, model) {
+  const base = String(profile.baseURL || '').replace(/\/+$/, '');
+  if (!base || !model) return '';
+  const key = `${base}\n${model}`;
+  const hit = bifrostUACache.get(key);
+  if (hit && hit.until > Date.now()) return hit.ua;
+  let ua = '';
+  let ttl = 10 * 60 * 1000;
+  try {
+    const r = await fetch(`${base}/models/${model.split('/').map(encodeURIComponent).join('/')}`, {
+      headers: { authorization: `Bearer ${profile.apiKey || ''}` }, signal: AbortSignal.timeout(3000)
+    });
+    if (r.ok) ua = String((await r.json())?.bifrost_ua || '');
+  } catch {
+    ttl = 30 * 1000; // an unreachable list must not pin the decision for long
+  }
+  bifrostUACache.set(key, { ua, until: Date.now() + ttl });
+  return ua;
+}
+
+async function crossesBifrost(req, profile, model) {
+  const clientUA = String(req.headers['user-agent'] || '');
+  if (!clientUA) return false;
+  const ua = await bifrostUAFor(profile, model);
+  return Boolean(ua) && clientUA.startsWith(ua);
+}
+
+// Every client header except its own credentials, the switcher's control headers and hop-by-hop.
+function bifrostHeaders(req, profile) {
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) {
+    const lk = k.toLowerCase();
+    if (BLOCKED_PASSTHROUGH.has(lk) || HOP_BY_HOP.has(lk) || lk === 'host' || lk === 'authorization' || lk === 'accept-encoding') continue;
+    headers[lk] = v;
+  }
+  headers['x-api-key'] = profile.apiKey || '';
+  return headers;
+}
+
+function withClientQuery(url, req) {
+  const q = String(req.url || '').indexOf('?');
+  return q < 0 ? url : url + (url.includes('?') ? '&' : '?') + req.url.slice(q + 1);
+}
+
+async function forwardAnthropicDirect(res, payload, bodyBuffer, url, headers, mappedModel, signal, profile, bifrost = false) {
   debugLog('Direct forward to native Anthropic endpoint:', url);
 
   // Only re-serialize when a fix is actually needed; otherwise forward the client's original bytes.
@@ -510,13 +557,13 @@ async function forwardAnthropicDirect(res, payload, bodyBuffer, url, headers, ma
     json = { ...json, model: mappedModel };
     modified = true;
   }
-  const healed = healAnthropicPayload(json);
+  const healed = bifrost ? { changed: false, notes: [] } : healAnthropicPayload(json);
   if (healed.changed) {
     json = healed.payload;
     modified = true;
     debugLog('Healer (direct):', healed.notes.join('; '));
   }
-  if (profile?.thinkingMode === 'off' && json.thinking) {
+  if (!bifrost && profile?.thinkingMode === 'off' && json.thinking) {
     json = { ...json };
     delete json.thinking;
     modified = true;
@@ -752,6 +799,25 @@ async function handleConvert(clientFormat, req, res, bodyBuffer, opts = {}) {
   let answered = false; // set only after a complete 2xx answer; the half upload depends on it
 
   try {
+    // Bifrost: the provider's own client reaching its own account through intact. Bytes and headers
+    // go as sent, only the key changes: no healer, no thinkingMode, no conversion.
+    if (clientFormat === 'anthropic' && await crossesBifrost(req, profile, mappedModel)) {
+      const { url } = upstreamEndpoint(profile, 'anthropic', mappedModel, ir.stream, req);
+      const headers = bifrostHeaders(req, profile);
+      if (traceId) headers['x-intact-trace'] = traceId;
+      try {
+        const r = await forwardAnthropicDirect(res, payload, bodyBuffer, withClientQuery(url, req), headers, mappedModel, ac.signal, profile, true);
+        answered = !r.error && r.status >= 200 && r.status < 300;
+        log({ outFormat: 'anthropic', status: r.status, tokens: r.tokens, responsePreview: '(bifrost)', error: r.error || undefined });
+      } catch (err) {
+        if (ac.signal.aborted) return log({ status: 499, error: 'client disconnected' });
+        console.error(`[${profileKey}] Bifrost forward error:`, err.message);
+        sendClientError(res, clientFormat, 502, `Bifrost forward error: ${err.message}`);
+        log({ status: 502, error: err.message });
+      }
+      return;
+    }
+
     // Fast path: anthropic in/out goes straight through, preserving original bytes (including thinking signatures).
     // Note: this branch skips the Healer Engine because it bypasses the IR.
     if (clientFormat === 'anthropic' && outFormat === 'anthropic') {
@@ -889,11 +955,14 @@ async function handleCountTokens(req, res, buf) {
   const { profile } = getActiveProfile('anthropic', req);
   if (profile) {
     const mappedModel = mapModel(payload.model || '', profile, 'anthropic');
-    if (resolveOutFormat(profile, mappedModel) === 'anthropic') {
-      const { url, headers } = upstreamEndpoint(profile, 'anthropic', mappedModel, false, req);
-      const countUrl = profile.endpoints?.countTokens || url.replace(/\/messages$/, '/messages/count_tokens');
+    const bifrost = await crossesBifrost(req, profile, mappedModel);
+    if (bifrost || resolveOutFormat(profile, mappedModel) === 'anthropic') {
+      const ep = upstreamEndpoint(profile, 'anthropic', mappedModel, false, req);
+      const headers = bifrost ? bifrostHeaders(req, profile) : ep.headers;
+      let countUrl = profile.endpoints?.countTokens || ep.url.replace(/\/messages$/, '/messages/count_tokens');
+      if (bifrost) countUrl = withClientQuery(countUrl, req);
       try {
-        const body = healAnthropicPayload({ ...payload, model: mappedModel }).payload;
+        const body = bifrost ? { ...payload, model: mappedModel } : healAnthropicPayload({ ...payload, model: mappedModel }).payload;
         const r = await fetch(countUrl, { method: 'POST', headers, body: JSON.stringify(body), signal: AbortSignal.timeout(15000) });
         if (r.ok) {
           const j = await r.json();

package/skills/llm-switcher/SKILL.md

@@ -1,93 +1,93 @@
----
-name: llm-switcher
-description: Mandatory guidance for AI coding agents and token compression tools (Headroom, RTK, Ponytail, Repomix). Enforces routing all LLM traffic through the local LLM Switcher edge gateway (http://127.0.0.1:3456) instead of directly calling provider endpoints.
----
-
-# LLM Switcher Edge Gateway Skill
-
-This skill governs how AI coding agents (Claude Code, Codex, Cursor, Windsurf, Opencode) and prompt optimization/compression tools (Headroom, RTK, Ponytail, Repomix) must interact with LLM providers on this workstation.
-
-## 1. The Core Directive
-
-> **ALL OUTBOUND LLM REQUESTS MUST ROUTE THROUGH LLM SWITCHER (`http://127.0.0.1:3456`).**
-> 
-> Never configure any tool, script, sub-agent, or token compression proxy to call external provider endpoints directly (such as `https://api.anthropic.com`, `https://api.openai.com`, or `https://generativelanguage.googleapis.com`).
->
-> If a token compression tool (Headroom, RTK, Ponytail) is used, it MUST be positioned as an **inner processing layer**, and its **upstream destination MUST be configured to point to LLM Switcher** at `http://127.0.0.1:3456`.
-
-```
-[Client CLI / Agent]
-         │
-         ▼
-[Token Compressor: RTK / Headroom / Ponytail]  <-- Inner Layer
-         │
-         ▼ (MANDATORY: Upstream MUST point to http://127.0.0.1:3456)
-[LLM Switcher Edge Gateway (:3456)]            <-- Outermost Gatekeeper
-         │
-         ▼ (Heals schemas, maps 1M context, extracts thinking, converts protocol)
-[Internet / intact (Recommended) / 9Router / Upstream LLM]
-```
-
-## 2. Why This is Mandatory
-
-Direct outbound calls from token compressors will break the developer environment for several reasons:
-
-1. **Schema Breakage & The Healer Engine:**
-   Token optimizers frequently prune conversation history to save tokens. In doing so, they often delete an `assistant` turn containing a `tool_use`, while leaving the subsequent `user` turn containing a `tool_result`.
-   - Anthropic and OpenAI APIs strictly reject this with `HTTP 400 (orphaned tool_use_id)`.
-   - **LLM Switcher** intercepts these malformed requests and runs its **Healer Engine**, automatically converting orphaned results into safe context text blocks and merging consecutive same-role turns so upstream providers accept the payload cleanly.
-2. **Thinking / Reasoning Protection:**
-   Many token compressors naively strip `thinking` parameters or reasoning budgets to reduce token count.
-   - When routed through LLM Switcher, the gateway detects reasoning models (such as `ag/claude-opus-4-6-thinking` or `ag/gemini-3.8-flash`) and **automatically restores thinking parameters**, ensuring the model retains its full reasoning capabilities.
-3. **Official Context Windows & Dynamic Model Discovery:**
-   Context windows follow the model you select without mutating permanent settings. The gateway auto-discovers official models from Anthropic and OpenAI, refreshing mappings on tool version upgrades (`switch models`).
-4. **Server Gateway Synergy (intact / 9Router):**
-   LLM Switcher pairs directly with server-side gateways like **intact** (strongly recommended for credential proxying, account pooling, and contract lab self-healing) or 9Router, handling retries and quotas far better than any local tool.
-
-## 3. Configuring Token Compression Tools
-
-When setting up or assisting the user with token compression tools, apply these exact configurations:
-
-### A. Headroom (Prompt Compression Proxy)
-When configuring Headroom's upstream endpoint:
-- In Headroom config (`headroom.yaml` or environment variables):
-  ```bash
-  ANTHROPIC_BASE_URL="http://127.0.0.1:3456"
-  OPENAI_BASE_URL="http://127.0.0.1:3456/v1"
-  ```
-- Point your CLI to Headroom's listening port (e.g. `http://127.0.0.1:8787`). Headroom compresses the prompt and forwards it to LLM Switcher on port `3456`.
-
-### B. RTK (Rust Token Killer / Repomix)
-- In RTK configuration or execution flags:
-  ```bash
-  # Ensure RTK's target upstream proxy is LLM Switcher
-  export UPSTREAM_URL="http://127.0.0.1:3456"
-  ```
-
-### C. Ponytail / Custom Proxies
-- Always set the proxy's upstream host to:
-  `http://127.0.0.1:3456` (or `http://127.0.0.1:3456/v1` for OpenAI-compatible tools).
-
-### D. Sub-Agents & Spawned Terminal Commands
-When an agent spawns sub-processes that call LLM CLIs:
-- **Never advise sourcing `env.sh` or `env.cmd`.** Those files carry no proxy variables any
-  more, so sourcing one changes nothing — and a stale variable an older version once wrote
-  would still point the tool at a port where nothing listens.
-- Run `switch claude <profile>` or `switch codex <profile>` instead. The shims in
-  `~/.llm-switcher/bin` inject the proxy variables into the tool process itself and clear
-  anything stale first.
-- `claude` and `codex` on `PATH` already are those shims: invoke them normally, and never
-  wrap them in another script.
-
-## 4. Operational Rules for AI Agents
-
-1. **NEVER edit `~/.claude/settings.json` directly.**
-   LLM Switcher uses zero-mutation launcher flags (`active.flag`). Writing custom base URLs or auth tokens into `settings.json` triggers warning banners in Claude Code and risks breaking the user's official subscription. Use `switch` CLI commands instead.
-2. **Check Gateway Health Before Complex Operations:**
-   Run `switch status` or call the `switcher_audit` MCP tool to confirm:
-   - LLM Switcher is active on port `3456`.
-   - The active profile matches the intended CLI target (Claude Code, Codex, or OpenAI).
-3. **Verify Routing When Errors Occur:**
-   If a tool fails with `HTTP 400`, `HTTP 502`, or connection errors:
-   - Run `switch doctor` to audit port collisions and environment variables.
-   - Inspect recent request logs via `http://127.0.0.1:3456/ui` (Tab 4: Live Inspector) to see if an intermediary tool mangled the payload.
+---
+name: llm-switcher
+description: Mandatory guidance for AI coding agents and token compression tools (Headroom, RTK, Ponytail, Repomix). Enforces routing all LLM traffic through the local LLM Switcher edge gateway (http://127.0.0.1:3456) instead of directly calling provider endpoints.
+---
+
+# LLM Switcher Edge Gateway Skill
+
+This skill governs how AI coding agents (Claude Code, Codex, Cursor, Windsurf, Opencode) and prompt optimization/compression tools (Headroom, RTK, Ponytail, Repomix) must interact with LLM providers on this workstation.
+
+## 1. The Core Directive
+
+> **ALL OUTBOUND LLM REQUESTS MUST ROUTE THROUGH LLM SWITCHER (`http://127.0.0.1:3456`).**
+> 
+> Never configure any tool, script, sub-agent, or token compression proxy to call external provider endpoints directly (such as `https://api.anthropic.com`, `https://api.openai.com`, or `https://generativelanguage.googleapis.com`).
+>
+> If a token compression tool (Headroom, RTK, Ponytail) is used, it MUST be positioned as an **inner processing layer**, and its **upstream destination MUST be configured to point to LLM Switcher** at `http://127.0.0.1:3456`.
+
+```
+[Client CLI / Agent]
+         │
+         ▼
+[Token Compressor: RTK / Headroom / Ponytail]  <-- Inner Layer
+         │
+         ▼ (MANDATORY: Upstream MUST point to http://127.0.0.1:3456)
+[LLM Switcher Edge Gateway (:3456)]            <-- Outermost Gatekeeper
+         │
+         ▼ (Heals schemas, maps 1M context, extracts thinking, converts protocol)
+[Internet / intact (Recommended) / 9Router / Upstream LLM]
+```
+
+## 2. Why This is Mandatory
+
+Direct outbound calls from token compressors will break the developer environment for several reasons:
+
+1. **Schema Breakage & The Healer Engine:**
+   Token optimizers frequently prune conversation history to save tokens. In doing so, they often delete an `assistant` turn containing a `tool_use`, while leaving the subsequent `user` turn containing a `tool_result`.
+   - Anthropic and OpenAI APIs strictly reject this with `HTTP 400 (orphaned tool_use_id)`.
+   - **LLM Switcher** intercepts these malformed requests and runs its **Healer Engine**, automatically converting orphaned results into safe context text blocks and merging consecutive same-role turns so upstream providers accept the payload cleanly.
+2. **Thinking / Reasoning Protection:**
+   Many token compressors naively strip `thinking` parameters or reasoning budgets to reduce token count.
+   - When routed through LLM Switcher, the gateway detects reasoning models (such as `ag/claude-opus-4-6-thinking` or `ag/gemini-3.8-flash`) and **automatically restores thinking parameters**, ensuring the model retains its full reasoning capabilities.
+3. **Official Context Windows & Dynamic Model Discovery:**
+   Context windows follow the model you select without mutating permanent settings. The gateway auto-discovers official models from Anthropic and OpenAI, refreshing mappings on tool version upgrades (`switch models`).
+4. **Server Gateway Synergy (intact / 9Router):**
+   LLM Switcher pairs directly with server-side gateways like **intact** (strongly recommended for credential proxying, account pooling, and contract lab self-healing) or 9Router, handling retries and quotas far better than any local tool.
+
+## 3. Configuring Token Compression Tools
+
+When setting up or assisting the user with token compression tools, apply these exact configurations:
+
+### A. Headroom (Prompt Compression Proxy)
+When configuring Headroom's upstream endpoint:
+- In Headroom config (`headroom.yaml` or environment variables):
+  ```bash
+  ANTHROPIC_BASE_URL="http://127.0.0.1:3456"
+  OPENAI_BASE_URL="http://127.0.0.1:3456/v1"
+  ```
+- Point your CLI to Headroom's listening port (e.g. `http://127.0.0.1:8787`). Headroom compresses the prompt and forwards it to LLM Switcher on port `3456`.
+
+### B. RTK (Rust Token Killer / Repomix)
+- In RTK configuration or execution flags:
+  ```bash
+  # Ensure RTK's target upstream proxy is LLM Switcher
+  export UPSTREAM_URL="http://127.0.0.1:3456"
+  ```
+
+### C. Ponytail / Custom Proxies
+- Always set the proxy's upstream host to:
+  `http://127.0.0.1:3456` (or `http://127.0.0.1:3456/v1` for OpenAI-compatible tools).
+
+### D. Sub-Agents & Spawned Terminal Commands
+When an agent spawns sub-processes that call LLM CLIs:
+- **Never advise sourcing `env.sh` or `env.cmd`.** Those files carry no proxy variables any
+  more, so sourcing one changes nothing — and a stale variable an older version once wrote
+  would still point the tool at a port where nothing listens.
+- Run `switch claude <profile>` or `switch codex <profile>` instead. The shims in
+  `~/.llm-switcher/bin` inject the proxy variables into the tool process itself and clear
+  anything stale first.
+- `claude` and `codex` on `PATH` already are those shims: invoke them normally, and never
+  wrap them in another script.
+
+## 4. Operational Rules for AI Agents
+
+1. **NEVER edit `~/.claude/settings.json` directly.**
+   LLM Switcher uses zero-mutation launcher flags (`active.flag`). Writing custom base URLs or auth tokens into `settings.json` triggers warning banners in Claude Code and risks breaking the user's official subscription. Use `switch` CLI commands instead.
+2. **Check Gateway Health Before Complex Operations:**
+   Run `switch status` or call the `switcher_audit` MCP tool to confirm:
+   - LLM Switcher is active on port `3456`.
+   - The active profile matches the intended CLI target (Claude Code, Codex, or OpenAI).
+3. **Verify Routing When Errors Occur:**
+   If a tool fails with `HTTP 400`, `HTTP 502`, or connection errors:
+   - Run `switch doctor` to audit port collisions and environment variables.
+   - Inspect recent request logs via `http://127.0.0.1:3456/ui` (Tab 4: Live Inspector) to see if an intermediary tool mangled the payload.

package/switch.cmd

@@ -1,2 +1,2 @@
-@echo off
-node "%~dp0switch.mjs" %*
+@echo off
+node "%~dp0switch.mjs" %*

package/tests/contract-lab.test.mjs

@@ -260,6 +260,11 @@ function startUpstream() {
     let body = '';
     req.on('data', c => { body += c; });
     req.on('end', () => {
+      // The Bifrost lookup reads one model entry; it is not a probe request.
+      if (req.method === 'GET' && req.url.includes('/models/')) {
+        res.writeHead(404, { 'Content-Type': 'application/json' });
+        return res.end('{}');
+      }
       const json = body ? JSON.parse(body) : {};
       received.push({ url: req.url, headers: req.headers, body: json });
       if (JSON.stringify(json.messages || '').includes('ERR_400')) {

package/tests/gateway.e2e.test.mjs

@@ -68,9 +68,23 @@ function startUpstream() {
     req.on('data', c => { body += c; });
     req.on('end', () => {
       const json = body ? JSON.parse(body) : {};
-      received.push({ url: req.url, headers: req.headers, body: json });
+      received.push({ url: req.url, headers: req.headers, body: json, raw: body });
       const lastUser = JSON.stringify(json.messages?.at(-1) ?? json.contents?.at(-1) ?? '');
 
+      // A stand-in intact: claude/* is a Claude Code account, the rest is not.
+      if (req.method === 'GET' && req.url.startsWith('/intact/v1/models/')) {
+        const id = decodeURIComponent(req.url.slice('/intact/v1/models/'.length));
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        return res.end(JSON.stringify({ id, owned_by: id.split('/')[0], ...(id.startsWith('claude/') ? { bifrost_ua: 'claude-cli/' } : {}) }));
+      }
+      if (req.url.startsWith('/intact/v1/messages')) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        return res.end(JSON.stringify({ id: 'msg_n', type: 'message', role: 'assistant', model: json.model, content: [{ type: 'text', text: 'bifrost ok' }], stop_reason: 'end_turn', usage: { input_tokens: 3, output_tokens: 2 } }));
+      }
+      if (req.url.startsWith('/intact/v1/chat/completions')) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        return res.end(JSON.stringify({ id: 'c1', object: 'chat.completion', model: json.model, choices: [{ index: 0, message: { role: 'assistant', content: 'converted ok' }, finish_reason: 'stop' }], usage: { prompt_tokens: 1, completion_tokens: 1 } }));
+      }
       if (req.url.startsWith('/chat/v1/chat/completions')) {
         if (lastUser.includes('RATE_LIMIT')) {
           res.writeHead(429, { 'Content-Type': 'application/json', 'retry-after': '7' });
@@ -202,6 +216,7 @@ before(async () => {
       pub: { name: 'Mock Public', mode: 'convert', inFormat: 'responses', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-pub', publicModels: ['gpt-5.6-sol', 'gpt-5.2'], defaultModels: { main: 'ag/mock-flash' }, model1M: { main: true } },
       roles: { name: 'Mock Public Roles', mode: 'convert', inFormat: 'responses', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-roles', publicModels: ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna'], defaultModels: { main: 'ag/mock-flash', review: 'ag/mock-review', subagent: 'ag/mock-low' } },
       native: { name: 'Mock Strict OpenAI', mode: 'convert', inFormat: 'auto', outFormat: 'openai-chat', thinkingMode: 'native', baseURL: `${base}/chat/v1`, apiKey: 'sk-secret-native', defaultModels: models },
+      intactcc: { name: 'Mock intact', mode: 'convert', tool: 'claude', outFormat: 'openai-chat', thinkingMode: 'off', baseURL: `${base}/intact/v1`, apiKey: 'sk-intact-user', defaultModels: { opus: 'claude/claude-opus-5', sonnet: 'gem/flash', haiku: 'claude/claude-haiku-4-5', fable: 'gem/flash' } },
       ant: { name: 'Mock Anthropic', mode: 'direct', inFormat: 'auto', outFormat: 'anthropic', baseURL: `${base}/ant`, apiKey: 'sk-secret-ant', defaultModels: models }
     }
   };
@@ -577,6 +592,40 @@ test('Direct Anthropic passthrough strips hop-by-hop headers and blocks client c
   assert.equal(up.body.model, 'up-opus');
 });
 
+test('Bifrost: Claude Code to a Claude Code account on intact changes only the key', async () => {
+  // Orphaned tool_result and a thinking block: the healer and thinkingMode=off would both change these.
+  const body = { model: 'claude-opus-4-6', max_tokens: 10, thinking: { type: 'adaptive' }, metadata: { user_id: 'u1' },
+    messages: [{ role: 'user', content: [{ type: 'tool_result', tool_use_id: 'gone', content: 'x' }] }] };
+  const res = await post('/v1/messages?beta=true', body, {
+    'x-llm-profile': 'intactcc', 'user-agent': 'claude-cli/2.1.300 (external, cli)', 'x-api-key': 'client-own-key',
+    authorization: 'Bearer client-oauth', 'anthropic-beta': 'oauth-2025-04-20,new-beta', 'anthropic-dangerous-direct-browser-access': 'true', 'x-app': 'cli'
+  });
+  assert.equal(res.status, 200);
+  assert.equal((await res.json()).content[0].text, 'bifrost ok');
+  const up = received.at(-1);
+  assert.equal(up.url, '/intact/v1/messages?beta=true');
+  assert.equal(up.headers['x-api-key'], 'sk-intact-user');
+  assert.equal(up.headers.authorization, undefined);
+  assert.equal(up.headers['user-agent'], 'claude-cli/2.1.300 (external, cli)');
+  assert.equal(up.headers['anthropic-beta'], 'oauth-2025-04-20,new-beta');
+  assert.equal(up.headers['anthropic-dangerous-direct-browser-access'], 'true');
+  assert.equal(up.headers['x-app'], 'cli');
+  assert.equal(up.raw, JSON.stringify({ ...body, model: 'claude/claude-opus-5' }));
+});
+
+test('Bifrost stays off for a model that is not a Claude Code account', async () => {
+  const res = await post('/v1/messages', { model: 'claude-sonnet-5', max_tokens: 10, messages: [{ role: 'user', content: 'hi' }] },
+    { 'x-llm-profile': 'intactcc', 'user-agent': 'claude-cli/2.1.300 (external, cli)' });
+  assert.equal(res.status, 200);
+  assert.equal(received.at(-1).url, '/intact/v1/chat/completions');
+});
+
+test('Bifrost stays off for a client that is not Claude Code', async () => {
+  await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 10, messages: [{ role: 'user', content: 'hi' }] },
+    { 'x-llm-profile': 'intactcc', 'user-agent': 'some-sdk/1.0' });
+  assert.equal(received.at(-1).url, '/intact/v1/chat/completions');
+});
+
 test('Healer: orphaned tool_result and missing tool_result produce a valid chat history', async () => {
   await post('/v1/messages', {
     model: 'claude-opus-4-6', max_tokens: 50, messages: [

package/tests/helpers.mjs

@@ -1,24 +1,24 @@
-import assert from 'node:assert/strict';
-
-// Validate an Anthropic event sequence: indexes increase in start order, deltas only target an open block.
-export function assertValidAnthropicEvents(events) {
-  const open = new Set();
-  const seen = new Set();
-  let expectedNext = 0;
-  for (const { event, data } of events) {
-    if (event === 'content_block_start') {
-      assert.equal(data.index, expectedNext, `block index must be sequential (got ${data.index}, want ${expectedNext})`);
-      assert.ok(!seen.has(data.index), `index ${data.index} reused`);
-      seen.add(data.index);
-      open.add(data.index);
-      expectedNext++;
-    } else if (event === 'content_block_delta') {
-      assert.ok(open.has(data.index), `delta for block ${data.index} which is not open`);
-    } else if (event === 'content_block_stop') {
-      assert.ok(open.has(data.index), `stop for block ${data.index} which is not open`);
-      open.delete(data.index);
-    } else if (event === 'message_stop') {
-      assert.equal(open.size, 0, 'all blocks must be closed before message_stop');
-    }
-  }
-}
+import assert from 'node:assert/strict';
+
+// Validate an Anthropic event sequence: indexes increase in start order, deltas only target an open block.
+export function assertValidAnthropicEvents(events) {
+  const open = new Set();
+  const seen = new Set();
+  let expectedNext = 0;
+  for (const { event, data } of events) {
+    if (event === 'content_block_start') {
+      assert.equal(data.index, expectedNext, `block index must be sequential (got ${data.index}, want ${expectedNext})`);
+      assert.ok(!seen.has(data.index), `index ${data.index} reused`);
+      seen.add(data.index);
+      open.add(data.index);
+      expectedNext++;
+    } else if (event === 'content_block_delta') {
+      assert.ok(open.has(data.index), `delta for block ${data.index} which is not open`);
+    } else if (event === 'content_block_stop') {
+      assert.ok(open.has(data.index), `stop for block ${data.index} which is not open`);
+      open.delete(data.index);
+    } else if (event === 'message_stop') {
+      assert.equal(open.size, 0, 'all blocks must be closed before message_stop');
+    }
+  }
+}