solrouter 0.4.3 → 0.4.5

package/bin/proxy.js

@@ -18,6 +18,23 @@ const [, , cmdRaw, ...rest] = process.argv;
 const cmd = cmdRaw || "run";
 const flag = name => { const i = rest.indexOf(name); return i >= 0 ? (rest[i + 1] ?? true) : undefined; };
 
+// Find a genuinely free port starting from `start`. Prevents the footgun where a
+// STALE proxy already on the port gets silently reused, so old code keeps running
+// after a version bump.
+async function freePort(start) {
+  const net = await import("node:net");
+  for (let p = start; p < start + 25; p++) {
+    const ok = await new Promise(res => {
+      const s = net.createServer();
+      s.once("error", () => res(false));
+      s.once("listening", () => s.close(() => res(true)));
+      s.listen(p, "127.0.0.1");
+    });
+    if (ok) return p;
+  }
+  return start;
+}
+
 // Start the proxy in-process, then launch the chosen tool through it (Claude Code),
 // or — for GUI tools — keep the proxy up and print how to point the tool at it.
 async function startProxyAndLaunch(cfg, tool, launch, passThru = []) {
@@ -112,11 +129,23 @@ async function main() {
       const { banner } = await import("../src/banner.js");
       console.log(banner({ menu: false }));
       const { spawn } = await import("node:child_process");
+      // ALWAYS start our own proxy on a free port — never reuse a stale one.
+      cfg.port = await freePort(cfg.port);
       startServer(cfg); // non-blocking listener in this process
       // Pass everything after `code`/`claude` (minus our own --port/--mode) to Claude Code.
       const passThru = rest.filter((a, i) =>
         !["--port", "--mode"].includes(a) && !["--port", "--mode"].includes(rest[i - 1]));
       const tool = process.env.SOLROUTER_TOOL || "claude";
+      // CRITICAL: Claude Code only routes to a custom ANTHROPIC_BASE_URL when an API
+      // key is present — otherwise a Max/Pro subscription silently bypasses the base
+      // URL and talks to Anthropic directly (so the proxy never sees the traffic).
+      // Force API-key mode by giving the child a key. The proxy's frontier leg uses
+      // its own configured key regardless, so this only needs to be non-empty.
+      const childKey = cfg.frontier.apiKey || process.env.ANTHROPIC_API_KEY || "sk-ant-solrouter-proxy";
+      if (!cfg.frontier.apiKey && !process.env.ANTHROPIC_API_KEY) {
+        console.warn("Warning: no Anthropic API key configured — Claude Code on a subscription may bypass the proxy.");
+        console.warn("Run `solrouter setup` and paste an API key so requests route through the proxy.\n");
+      }
       console.log(`\nLaunching ${tool} through the proxy (ANTHROPIC_BASE_URL=http://127.0.0.1:${cfg.port})…\n`);
       const child = spawn(tool, passThru, {
         stdio: "inherit",
@@ -124,6 +153,8 @@ async function main() {
           ...process.env,
           ANTHROPIC_BASE_URL: `http://127.0.0.1:${cfg.port}`,
           OPENAI_BASE_URL: `http://127.0.0.1:${cfg.port}/v1`,
+          ANTHROPIC_API_KEY: childKey,           // forces Claude Code to use the base URL
+          CLAUDE_CODE_USE_BEDROCK: "",
         },
       });
       child.on("error", e => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solrouter",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Local privacy router for coding tools: pseudonymises every request before it leaves your machine, and sends work a frontier model would refuse to an uncensored open-weight model you control.",
   "type": "module",
   "bin": {

package/src/server.js

@@ -15,6 +15,12 @@ import { dialect, rewriteText } from "./wire.js";
 import { isRefusal } from "./route.js";
 import { writeReceipt } from "./receipt.js";
 import { HOME_DIR } from "./config.js";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+let VERSION = "?";
+try { VERSION = JSON.parse(readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8")).version; } catch {}
+export { VERSION };
 
 // Ground-truth log of every streaming routing decision, so a real Claude Code run
 // can be diagnosed from actual traffic instead of guesses. Never contains raw PII
@@ -64,7 +70,7 @@ export function startServer(cfg) {
   const server = createServer(async (req, res) => {
     const send = (code, obj) => { res.writeHead(code, { "content-type": "application/json" }); res.end(JSON.stringify(obj)); };
 
-    if (req.method === "GET" && req.url === "/health") return send(200, { ok: true, proxy: "solrouter", mode: cfg.mode });
+    if (req.method === "GET" && req.url === "/health") return send(200, { ok: true, proxy: "solrouter", version: VERSION, mode: cfg.mode });
 
     // Transparent passthrough for other Anthropic endpoints the client probes —
     // notably /v1/messages/count_tokens, which Claude Code calls before every
@@ -184,7 +190,7 @@ export function startServer(cfg) {
     }
   });
   server.listen(cfg.port, "127.0.0.1", () => {
-    console.log(`SolRouter proxy on http://127.0.0.1:${cfg.port}`);
+    console.log(`SolRouter proxy v${VERSION} on http://127.0.0.1:${cfg.port}`);
     console.log(`  mode=${cfg.mode}  frontier=${cfg.frontier.model || "(client's model)"} [${cfg.frontier.auth || "passthrough"}]  private=${cfg.private.model}`);
     console.log(`  point your tool's base URL here:`);
     console.log(`    OpenAI-style:    http://127.0.0.1:${cfg.port}/v1`);