solrouter 0.3.3 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solrouter",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Local privacy router for coding tools: pseudonymises every request before it leaves your machine, and sends work a frontier model would refuse to an uncensored open-weight model you control.",
   "type": "module",
   "bin": {

package/src/providers.js

@@ -25,9 +25,18 @@ const DROP = new Set([
 function authHeaders(leg, clientHeaders = {}) {
   const h = { "content-type": "application/json" };
 
-  // 1. explicit key
+  // ALWAYS forward the client's non-auth headers first — especially every
+  // `anthropic-beta` flag. Claude Code enables body fields like `context_management`
+  // and 1M context via those headers; dropping them makes Anthropic reject the body
+  // ("Extra inputs are not permitted"). We overwrite only the auth header below.
+  for (const k of Object.keys(clientHeaders)) {
+    if (DROP.has(k) || k === "authorization" || k === "x-api-key") continue;
+    h[k] = clientHeaders[k];
+  }
+
+  // 1. explicit key — set auth, keep the forwarded beta headers
   if (leg.apiKey) {
-    if (leg.dialect === "anthropic") { h["x-api-key"] = leg.apiKey; h["anthropic-version"] = "2023-06-01"; }
+    if (leg.dialect === "anthropic") { h["x-api-key"] = leg.apiKey; h["anthropic-version"] ||= "2023-06-01"; }
     else h["authorization"] = `Bearer ${leg.apiKey}`;
     return h;
   }
@@ -39,15 +48,10 @@ function authHeaders(leg, clientHeaders = {}) {
     return h;
   }
 
-  // 2. pass-through (default): forward every client header verbatim
+  // 2. pass-through (default): forward the client's own auth too
   let forwarded = false;
-  for (const k of Object.keys(clientHeaders)) {
-    if (DROP.has(k)) continue;
-    h[k] = clientHeaders[k];
-    if (k === "authorization" || k === "x-api-key") forwarded = true;
-  }
+  for (const k of ["authorization", "x-api-key"]) if (clientHeaders[k]) { h[k] = clientHeaders[k]; forwarded = true; }
   if (!forwarded) {
-    // nothing to forward — fall back to the account token if we have one
     const auth = loadAuth();
     if (auth.access_token) h["authorization"] = `Bearer ${auth.access_token}`;
   }
@@ -107,6 +111,20 @@ export async function callSolrouterAgent(leg, prompt) {
   return { ok: res.ok && json?.success !== false, status: res.status, reply: json?.reply ?? "", raw: json };
 }
 
+/**
+ * Transparent passthrough to the frontier for endpoints we don't transform —
+ * e.g. Claude Code's /v1/messages/count_tokens preflight. Returns the raw body so
+ * the response is relayed verbatim.
+ */
+export async function forward(leg, { method = "POST", path, body, clientHeaders }) {
+  const base = leg.baseUrl.replace(/\/$/, "");
+  const init = { method, headers: authHeaders(leg, clientHeaders) };
+  if (body !== undefined) init.body = JSON.stringify(withModel(body, leg));
+  const res = await fetch(base + path, init);
+  const text = await res.text();
+  return { ok: res.ok, status: res.status, text, contentType: res.headers.get("content-type") };
+}
+
 /** Streaming call. Returns { ok, status, stream } (raw SSE ReadableStream). */
 export async function streamLeg(leg, body, clientHeaders) {
   const res = await fetch(endpoint(leg), {

package/src/server.js

@@ -7,7 +7,9 @@
 // localhost only — nothing here should be reachable off the machine.
 
 import { createServer } from "node:http";
-import { handle, handleStream } from "./index.js";
+import { handle, handleStream, createMasker } from "./index.js";
+import { forward } from "./providers.js";
+import { dialect, rewriteText } from "./wire.js";
 import { writeReceipt } from "./receipt.js";
 
 function readBody(req) {
@@ -26,6 +28,27 @@ export function startServer(cfg) {
     const send = (code, obj) => { res.writeHead(code, { "content-type": "application/json" }); res.end(JSON.stringify(obj)); };
 
     if (req.method === "GET" && req.url === "/health") return send(200, { ok: true, proxy: "solrouter", mode: cfg.mode });
+
+    // Transparent passthrough for other Anthropic endpoints the client probes —
+    // notably /v1/messages/count_tokens, which Claude Code calls before every
+    // request and treats a 404 on as "model unavailable". Forward to the frontier.
+    if (/^\/v1\//.test(req.url) && !/^\/(v1\/chat\/completions|v1\/messages)$/.test(req.url)) {
+      let body;
+      if (req.method === "POST") {
+        try { body = await readBody(req); } catch { return send(400, { error: "invalid JSON body" }); }
+        if (body && cfg.masking?.enabled !== false) {
+          const m = createMasker(cfg.masking);
+          body = rewriteText(body, dialect(body, req.url), s => m.mask(s).text);
+        }
+      }
+      try {
+        const r = await forward(cfg.frontier, { method: req.method, path: req.url, body, clientHeaders: lower(req.headers) });
+        res.writeHead(r.status, { "content-type": r.contentType || "application/json" });
+        res.end(r.text);
+      } catch (e) { send(502, { error: "proxy error", detail: String(e?.message || e) }); }
+      return;
+    }
+
     if (req.method !== "POST" || !/^\/(v1\/chat\/completions|v1\/messages)$/.test(req.url)) {
       return send(404, { error: "not found" });
     }