solrouter 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solrouter",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Local privacy router for coding tools: pseudonymises every request before it leaves your machine, and sends work a frontier model would refuse to an uncensored open-weight model you control.",
   "type": "module",
   "bin": {

package/src/config.js

@@ -53,6 +53,7 @@ function readJson(path) {
 function deepMerge(a, b) {
   const out = { ...a };
   for (const k of Object.keys(b || {})) {
+    if (b[k] === undefined) continue; // never let an unset override clobber a default
     out[k] = b[k] && typeof b[k] === "object" && !Array.isArray(b[k])
       ? deepMerge(a[k] || {}, b[k]) : b[k];
   }

package/src/providers.js

@@ -13,8 +13,14 @@
 
 import { loadAuth } from "./config.js";
 
-// Client auth headers worth forwarding verbatim in pass-through mode.
-const FORWARD = ["authorization", "x-api-key", "anthropic-version", "anthropic-beta", "openai-organization"];
+// In pass-through mode we forward the client's headers VERBATIM (auth, every
+// anthropic-beta flag, oauth markers, user-agent), dropping only hop-by-hop headers
+// that must be recomputed for the new destination. An allowlist silently dropped
+// headers Claude Code needs (beta flags, oauth), which broke subscription auth.
+const DROP = new Set([
+  "host", "connection", "content-length", "transfer-encoding",
+  "accept-encoding", "keep-alive", "proxy-connection",
+]);
 
 function authHeaders(leg, clientHeaders = {}) {
   const h = { "content-type": "application/json" };
@@ -33,9 +39,13 @@ function authHeaders(leg, clientHeaders = {}) {
     return h;
   }
 
-  // 2. pass-through (default): forward the client's own credentials
+  // 2. pass-through (default): forward every client header verbatim
   let forwarded = false;
-  for (const k of FORWARD) if (clientHeaders[k]) { h[k] = clientHeaders[k]; forwarded = true; }
+  for (const k of Object.keys(clientHeaders)) {
+    if (DROP.has(k)) continue;
+    h[k] = clientHeaders[k];
+    if (k === "authorization" || k === "x-api-key") forwarded = true;
+  }
   if (!forwarded) {
     // nothing to forward — fall back to the account token if we have one
     const auth = loadAuth();