solrouter 0.3.4 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solrouter",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "Local privacy router for coding tools: pseudonymises every request before it leaves your machine, and sends work a frontier model would refuse to an uncensored open-weight model you control.",
   "type": "module",
   "bin": {

package/src/providers.js

@@ -25,9 +25,18 @@ const DROP = new Set([
 function authHeaders(leg, clientHeaders = {}) {
   const h = { "content-type": "application/json" };
 
-  // 1. explicit key
+  // ALWAYS forward the client's non-auth headers first — especially every
+  // `anthropic-beta` flag. Claude Code enables body fields like `context_management`
+  // and 1M context via those headers; dropping them makes Anthropic reject the body
+  // ("Extra inputs are not permitted"). We overwrite only the auth header below.
+  for (const k of Object.keys(clientHeaders)) {
+    if (DROP.has(k) || k === "authorization" || k === "x-api-key") continue;
+    h[k] = clientHeaders[k];
+  }
+
+  // 1. explicit key — set auth, keep the forwarded beta headers
   if (leg.apiKey) {
-    if (leg.dialect === "anthropic") { h["x-api-key"] = leg.apiKey; h["anthropic-version"] = "2023-06-01"; }
+    if (leg.dialect === "anthropic") { h["x-api-key"] = leg.apiKey; h["anthropic-version"] ||= "2023-06-01"; }
     else h["authorization"] = `Bearer ${leg.apiKey}`;
     return h;
   }
@@ -39,15 +48,10 @@ function authHeaders(leg, clientHeaders = {}) {
     return h;
   }
 
-  // 2. pass-through (default): forward every client header verbatim
+  // 2. pass-through (default): forward the client's own auth too
   let forwarded = false;
-  for (const k of Object.keys(clientHeaders)) {
-    if (DROP.has(k)) continue;
-    h[k] = clientHeaders[k];
-    if (k === "authorization" || k === "x-api-key") forwarded = true;
-  }
+  for (const k of ["authorization", "x-api-key"]) if (clientHeaders[k]) { h[k] = clientHeaders[k]; forwarded = true; }
   if (!forwarded) {
-    // nothing to forward — fall back to the account token if we have one
     const auth = loadAuth();
     if (auth.access_token) h["authorization"] = `Bearer ${auth.access_token}`;
   }