swayrouter 1.0.0

package/src/providers/registry/xai.js

@@ -0,0 +1,46 @@
+export default {
+  "id": "xai",
+  "priority": 280,
+  "alias": "xai",
+  "display": {
+    "name": "xAI (Grok)",
+    "icon": "auto_awesome",
+    "color": "#1DA1F2",
+    "textIcon": "XA",
+    "website": "https://x.ai",
+    "notice": {
+      "apiKeyUrl": "https://console.x.ai"
+    }
+  },
+  "category": "oauth",
+  "authModes": [
+    "oauth",
+    "apikey"
+  ],
+  "hasOAuth": true,
+  "transport": {
+    "baseUrl": "https://api.x.ai/v1/chat/completions",
+    "validateUrl": "https://api.x.ai/v1/models",
+    "responsesUrl": "https://api.x.ai/v1/responses",
+    "clientId": "b1a00492-073a-47ea-816f-4c329264a828",
+    "tokenUrl": "https://auth.x.ai/oauth2/token",
+    "refreshUrl": "https://auth.x.ai/oauth2/token"
+  },
+  "models": [
+    {
+      "id": "grok-4",
+      "name": "Grok 4"
+    },
+    {
+      "id": "grok-4-fast-reasoning",
+      "name": "Grok 4 Fast Reasoning"
+    },
+    {
+      "id": "grok-code-fast-1",
+      "name": "Grok Code Fast"
+    },
+    {
+      "id": "grok-3",
+      "name": "Grok 3"
+    }
+  ]};

package/src/providers/registry/xiaomi-mimo.js

@@ -0,0 +1,66 @@
+export default {
+  "id": "xiaomi-mimo",
+  "priority": 290,
+  "alias": "xiaomi-mimo",
+  "aliases": [
+    "mimo"
+  ],
+  "uiAlias": "mimo",
+  "display": {
+    "name": "Xiaomi MiMo",
+    "icon": "smart_toy",
+    "color": "#FF6900",
+    "textIcon": "XM",
+    "website": "https://xiaomimimo.com",
+    "notice": {
+      "apiKeyUrl": "https://platform.xiaomimimo.com/console/api-keys"
+    }
+  },
+  "category": "apikey",
+  "transport": {
+    "baseUrl": "https://api.xiaomimimo.com/v1/chat/completions",
+    "validateUrl": "https://api.xiaomimimo.com/v1/models"
+  },
+  "transports": [
+    {
+      "format": "openai",
+      "baseUrl": "https://api.xiaomimimo.com/v1/chat/completions",
+      "auth": {
+        "combined": true,
+        "header": "Authorization",
+        "scheme": "bearer"
+      }
+    },
+    {
+      "format": "claude",
+      "baseUrl": "https://api.xiaomimimo.com/anthropic/v1/messages",
+      "headers": {
+        "Anthropic-Version": "2023-06-01",
+        "Anthropic-Beta": "claude-code-20250219,interleaved-thinking-2025-05-14"
+      },
+      "auth": {
+        "combined": true,
+        "header": "x-api-key",
+        "scheme": "raw"
+      }
+    }
+  ],
+  "models": [
+    {
+      "id": "mimo-v2.5-pro",
+      "name": "MiMo V2.5 Pro"
+    },
+    {
+      "id": "mimo-v2.5",
+      "name": "MiMo V2.5"
+    },
+    {
+      "id": "mimo-v2-omni",
+      "name": "MiMo V2 Omni"
+    },
+    {
+      "id": "mimo-v2-flash",
+      "name": "MiMo V2 Flash"
+    }
+  ]
+};

package/src/providers/registry/xiaomi-tokenplan.js

@@ -0,0 +1,58 @@
+import { CLAUDE_API_HEADERS } from "../shared.js";
+
+export default {
+  id: "xiaomi-tokenplan",
+  priority: 300,
+  alias: "xiaomi-tokenplan",
+  aliases: [
+    "xmtp",
+  ],
+  uiAlias: "xmtp",
+  display: {
+    name: "Xiaomi MiMo (Token Plan)",
+    icon: "smart_toy",
+    color: "#FF6700",
+    textIcon: "XT",
+    website: "https://mimo.xiaomi.com",
+    notice: {
+      text: "Xiaomi MiMo Token Plan subscription (API key starts with tp-). Token Plan keys are cluster-specific — select the region matching your subscription.",
+      apiKeyUrl: "https://mimo.xiaomi.com",
+    },
+  },
+  category: "apikey",
+  hasProviderSpecificData: true,
+  regions: [
+    { id: "sgp", label: "Singapore (新加坡)" },
+    { id: "cn", label: "China (中国大陆)" },
+    { id: "ams", label: "Amsterdam (阿姆斯特丹)" },
+  ],
+  defaultRegion: "sgp",
+  transport: {
+    baseUrl: "https://token-plan-sgp.xiaomimimo.com/v1/chat/completions",
+    regions: {
+      sgp: "https://token-plan-sgp.xiaomimimo.com/v1",
+      cn: "https://token-plan-cn.xiaomimimo.com/v1",
+      ams: "https://token-plan-ams.xiaomimimo.com/v1",
+    },
+    defaultRegion: "sgp",
+  },
+
+  transports: [
+    {
+      format: "openai",
+      auth: { combined: true, header: "Authorization", scheme: "bearer" },
+    },
+    {
+      format: "claude",
+      headers: { ...CLAUDE_API_HEADERS },
+      auth: { combined: true, header: "x-api-key", scheme: "raw" },
+    },
+  ],
+  models: [
+    { id: "mimo-v2.5-pro", name: "MiMo V2.5 Pro" },
+    { id: "mimo-v2.5-pro-claude", name: "MiMo V2.5 Pro (Claude Native)", targetFormat: "claude", upstreamModelId: "mimo-v2.5-pro" },
+    { id: "mimo-v2.5", name: "MiMo V2.5" },
+    { id: "mimo-v2-pro", name: "MiMo V2 Pro" },
+    { id: "mimo-v2-omni", name: "MiMo V2 Omni" },
+  ],
+};

package/src/providers/registryEntry.js

@@ -0,0 +1,3 @@
+export function createRegistryEntry(definition) {
+  return definition && typeof definition === "object" ? { ...definition } : definition;
+}

package/src/providers/schema.js

@@ -0,0 +1,33 @@
+import { DEFAULT_RETRY_CONFIG, FETCH_CONNECT_TIMEOUT_MS } from "../config/runtimeConfig.js";
+
+export const PROVIDER_DEFAULTS = {
+  baseUrl: "",
+  format: "openai",
+  headers: {},
+  auth: { header: "Authorization", scheme: "bearer", source: ["accessToken", "apiKey"] },
+  forceStream: false,
+  urlSuffix: "",
+  quirks: {},
+  passthroughModels: false,
+  retry: DEFAULT_RETRY_CONFIG,
+  timeoutMs: FETCH_CONNECT_TIMEOUT_MS,
+  executor: "default"
+};
+
+export const ENDPOINT_DEFAULTS = {
+  openai: { chat: "/chat/completions", test: "/models", models: "/models" },
+  claude: { chat: "/messages", test: "/models", countTokens: "/messages/count_tokens" },
+  gemini: { chat: "/{model}:streamGenerateContent", models: "/models", test: "/models" }
+};
+
+export function resolveProvider(entry) {
+  const transport = (entry && entry.transport) || {};
+  return {
+    ...PROVIDER_DEFAULTS,
+    ...transport,
+    headers: { ...PROVIDER_DEFAULTS.headers, ...transport.headers },
+    auth: { ...PROVIDER_DEFAULTS.auth, ...transport.auth },
+    quirks: { ...PROVIDER_DEFAULTS.quirks, ...transport.quirks },
+    retry: { ...PROVIDER_DEFAULTS.retry, ...transport.retry }
+  };
+}

package/src/providers/shared.js

@@ -0,0 +1,114 @@
+import { platform, arch } from "os";
+
+export function mapStainlessOs() {
+  switch (platform()) {
+    case "darwin": return "MacOS";
+    case "win32": return "Windows";
+    case "linux": return "Linux";
+    case "freebsd": return "FreeBSD";
+    default: return `Other::${platform()}`;
+  }
+}
+
+export function mapStainlessArch() {
+  switch (arch()) {
+    case "x64": return "x64";
+    case "arm64": return "arm64";
+    case "ia32": return "x86";
+    default: return `other::${arch()}`;
+  }
+}
+
+export const ANTHROPIC_API_VERSION = "2023-06-01";
+
+export const CLAUDE_API_HEADERS = {
+  "Anthropic-Version": ANTHROPIC_API_VERSION,
+  "Anthropic-Beta": "claude-code-20250219,interleaved-thinking-2025-05-14"
+};
+
+export const CLAUDE_CLI_SPOOF_HEADERS = {
+  "Anthropic-Version": ANTHROPIC_API_VERSION,
+  "Anthropic-Beta": "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05,advanced-tool-use-2025-11-20,effort-2025-11-24,structured-outputs-2025-12-15,fast-mode-2026-02-01,redact-thinking-2026-02-12,token-efficient-tools-2026-03-28",
+  "Anthropic-Dangerous-Direct-Browser-Access": "true",
+  "User-Agent": "claude-cli/2.1.92 (external, sdk-cli)",
+  "X-App": "cli",
+  "X-Stainless-Helper-Method": "stream",
+  "X-Stainless-Retry-Count": "0",
+  "X-Stainless-Runtime-Version": "v24.14.0",
+  "X-Stainless-Package-Version": "0.80.0",
+  "X-Stainless-Runtime": "node",
+  "X-Stainless-Lang": "js",
+  "X-Stainless-Arch": mapStainlessArch(),
+  "X-Stainless-Os": mapStainlessOs(),
+  "X-Stainless-Timeout": "600"
+};
+
+const ANTHROPIC_BETA_BASE = [
+  "claude-code-20250219",
+  "oauth-2025-04-20", // gitleaks:allow -- public Anthropic feature flag
+  "interleaved-thinking-2025-05-14",
+  "context-management-2025-06-27",
+  "prompt-caching-scope-2026-01-05",
+  "structured-outputs-2025-12-15",
+  "fast-mode-2026-02-01",
+  "redact-thinking-2026-02-12",
+  "token-efficient-tools-2026-03-28",
+];
+const ANTHROPIC_BETA_HEAVY_AGENT = ["advanced-tool-use-2025-11-20", "effort-2025-11-24"];
+
+export function selectAnthropicBeta(model = "") {
+  const flags = [...ANTHROPIC_BETA_BASE];
+  if (/^claude-(opus|sonnet)/.test(model)) flags.push(...ANTHROPIC_BETA_HEAVY_AGENT);
+  return flags.join(",");
+}
+
+export const KIMI_CODING_BASE_URL = "https://api.kimi.com/coding/v1/messages";
+
+export const OPENAI_COMPAT_BASE = "https://api.openai.com/v1";
+export const ANTHROPIC_COMPAT_BASE = "https://api.anthropic.com/v1";
+
+// AgentRouter validates compatible clients by their client fingerprint. Keep
+// these headers scoped to the built-in provider instead of exposing them as a
+// user-configurable custom-provider option.
+export const AGENTROUTER_MODELS_URL = "https://agentrouter.org/v1/models";
+export const AGENTROUTER_OPENAI_HEADERS = {
+  "User-Agent": "codex_cli_rs/0.149.1",
+  originator: "codex_cli_rs",
+  version: "0.149.1",
+};
+export const AGENTROUTER_ANTHROPIC_HEADERS = {
+  "User-Agent": "claude-cli/1.0.0 (external, cli)",
+};
+export const AGENTROUTER_ANTHROPIC_AUTH = {
+  combined: true,
+  header: "Authorization",
+  scheme: "bearer",
+  additional: [{ header: "x-api-key", scheme: "raw" }],
+  anthropicVersion: true,
+};
+
+export const ANTIGRAVITY_IDE_VERSION = "2.1.1";
+export const ANTIGRAVITY_IDE_BASE_URL = "https://daily-cloudcode-pa.googleapis.com";
+export const ANTIGRAVITY_IDE_USER_AGENT = `antigravity/ide/${ANTIGRAVITY_IDE_VERSION} darwin/arm64`;
+
+function getOAuthClient(clientIdEnv, clientSecretEnv) {
+  return {
+    clientId: process.env[clientIdEnv]?.trim() || "",
+    clientSecret: process.env[clientSecretEnv]?.trim() || "",
+  };
+}
+
+export const ANTIGRAVITY_OAUTH_CLIENT = {
+  // Public application credentials distributed with the Antigravity desktop
+  // OAuth integration. Environment variables can override either value.
+  clientId:
+    process.env.ANTIGRAVITY_OAUTH_CLIENT_ID?.trim() ||
+    "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com",
+  clientSecret:
+    process.env.ANTIGRAVITY_OAUTH_CLIENT_SECRET?.trim() ||
+    "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", // gitleaks:allow -- public desktop OAuth application credential
+};
+
+export const GOOGLE_OAUTH_CLIENT = {
+  ...getOAuthClient("GOOGLE_OAUTH_CLIENT_ID", "GOOGLE_OAUTH_CLIENT_SECRET"),
+};

package/src/providers/thinkingLevels.js

@@ -0,0 +1,49 @@
+import { getCapabilitiesForModel } from "./capabilities.js";
+import { matchPattern } from "./pricing.js";
+import { resolveKiroEffortPath } from "../config/kiroConstants.js";
+
+const L = {
+  base: ["none", "low", "medium", "high"],
+  onOff: ["none", "thinking"],
+  openai: ["none", "minimal", "low", "medium", "high", "xhigh"],
+  levelMax: ["none", "low", "medium", "high", "max"],
+  budgetX: ["none", "low", "medium", "high", "xhigh", "max"],
+  gemini: ["minimal", "low", "medium", "high"],
+  hiMax: ["none", "low", "high", "max"],
+};
+
+const FORMAT_LEVELS = {
+  openai: L.openai,
+  "claude-adaptive": L.levelMax,
+  "claude-budget": L.budgetX,
+  "gemini-level": L.gemini,
+  "gemini-budget": L.base,
+  zai: L.onOff,
+  qwen: L.base,
+  kimi: L.levelMax,
+  deepseek: L.hiMax,
+  minimax: L.onOff,
+  hunyuan: L.base,
+  step: L.base,
+};
+
+const CODEX_GPT_5_6_LEVELS = ["none", "minimal", "low", "medium", "high", "xhigh", "max"];
+
+const PATTERN_THINKING = [
+  { provider: "codex", pattern: "*gpt-5.6-sol*", levels: [...CODEX_GPT_5_6_LEVELS, "ultra"] },
+  { provider: "codex", pattern: "*gpt-5.6-terra*", levels: [...CODEX_GPT_5_6_LEVELS, "ultra"] },
+  { provider: "codex", pattern: "*gpt-5.6-luna*", levels: CODEX_GPT_5_6_LEVELS },
+  { pattern: "*codex*", levels: ["low", "medium", "high", "xhigh"] },
+];
+
+export function getThinkingLevels(provider, model, capabilityOverride = null) {
+  if (provider === "kiro" && resolveKiroEffortPath(model) === null) return null;
+  const caps = getCapabilitiesForModel(provider, model, capabilityOverride);
+  if (!caps.reasoning) return null;
+  const hit = PATTERN_THINKING.find((entry) =>
+    (!entry.provider || entry.provider === provider) && matchPattern(entry.pattern, model)
+  );
+  let levels = hit?.levels || FORMAT_LEVELS[caps.thinkingFormat] || L.base;
+  if (caps.thinkingCanDisable === false) levels = levels.filter((l) => l !== "none");
+  return levels;
+}

package/src/routes/api/auth/login/route.js

@@ -0,0 +1,82 @@
+import { NextResponse } from "next/server";
+import { getSettings } from "@/lib/localDb";
+import bcrypt from "bcryptjs";
+import { cookies } from "next/headers";
+import { setDashboardAuthCookie } from "@/lib/auth/dashboardSession";
+import { checkLock, recordFail, recordSuccess, getClientIp } from "@/lib/auth/loginLimiter";
+import { isLocalRequest } from "@/dashboardGuard";
+import { env } from "@/lib/env";
+import { loadState } from "@/lib/tunnel/shared/state.js";
+import { isTunnelHost } from "@/lib/tunnel/cloudflare/publicUrl.js";
+
+const RESET_HINT = "Forgot password? Reset to default via Sway Router CLI → Settings → Reset Password to Default.";
+const NO_STORE_HEADERS = { "Cache-Control": "no-store" };
+
+function isTunnelRequest(request, settings) {
+  const host = (request.headers.get("host") || "").split(":")[0].toLowerCase();
+  return isTunnelHost(host, settings, loadState());
+}
+
+export async function POST(request) {
+  try {
+    const ip = getClientIp(request);
+    const lock = checkLock(ip);
+    if (lock.locked) {
+      return NextResponse.json(
+        { error: `Too many failed attempts. Try again in ${lock.retryAfter}s. ${RESET_HINT}`, retryAfter: lock.retryAfter, resetHint: RESET_HINT },
+        { status: 429, headers: { "Retry-After": String(lock.retryAfter) } }
+      );
+    }
+
+    const { password } = await request.json();
+    const settings = await getSettings();
+
+    if (isTunnelRequest(request, settings) && settings.tunnelDashboardAccess !== true) {
+      return NextResponse.json({ error: "Dashboard access via tunnel is disabled" }, { status: 403 });
+    }
+
+    const storedHash = settings.password;
+    const localRequest = isLocalRequest(request);
+
+    if (!storedHash && !localRequest) {
+      return NextResponse.json(
+        { error: "Initial setup must be completed from localhost before remote login is enabled." },
+        { status: 403, headers: NO_STORE_HEADERS },
+      );
+    }
+
+    let isValid = false;
+    if (storedHash) {
+      isValid = await bcrypt.compare(password, storedHash);
+    } else {
+      const initialPassword = env.initialPassword;
+      isValid = typeof password === "string" && password === initialPassword;
+    }
+
+    if (isValid) {
+      recordSuccess(ip);
+      const cookieStore = await cookies();
+
+      const mustChangePassword = !storedHash;
+      await setDashboardAuthCookie(cookieStore, request, { mustChangePassword });
+
+      return NextResponse.json({ success: true, mustChangePassword }, { headers: NO_STORE_HEADERS });
+    }
+
+    const { remainingBeforeLock } = recordFail(ip);
+    const postLock = checkLock(ip);
+    if (postLock.locked) {
+      return NextResponse.json(
+        { error: `Too many failed attempts. Try again in ${postLock.retryAfter}s. ${RESET_HINT}`, retryAfter: postLock.retryAfter, resetHint: RESET_HINT },
+        { status: 429, headers: { "Retry-After": String(postLock.retryAfter) } }
+      );
+    }
+    return NextResponse.json(
+      { error: `Invalid password. ${remainingBeforeLock} attempt(s) left before lockout.`, remainingBeforeLock },
+      { status: 401 }
+    );
+  } catch (error) {
+    console.error("[Auth][Login]", error);
+    return NextResponse.json({ error: "Login failed" }, { status: 500 });
+  }
+}

package/src/routes/api/auth/logout/route.js

@@ -0,0 +1,9 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { clearDashboardAuthCookie } from "@/lib/auth/dashboardSession";
+
+export async function POST() {
+  const cookieStore = await cookies();
+  clearDashboardAuthCookie(cookieStore);
+  return NextResponse.json({ success: true }, { headers: { "Cache-Control": "no-store" } });
+}

package/src/routes/api/auth/reset-password/route.js

@@ -0,0 +1,12 @@
+import { NextResponse } from "next/server";
+import { updateSettings } from "@/lib/localDb";
+
+export async function POST() {
+  try {
+    await updateSettings({ password: null });
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error("[Auth][ResetPassword]", error);
+    return NextResponse.json({ error: "Password reset failed" }, { status: 500 });
+  }
+}

package/src/routes/api/auth/status/route.js

@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import { getSettings } from "@/lib/localDb";
+import { getDashboardAuthSession } from "@/lib/auth/dashboardSession";
+
+export async function GET() {
+  try {
+    const settings = await getSettings();
+    const cookieStore = await cookies();
+    const session = await getDashboardAuthSession(cookieStore.get("auth_token")?.value);
+    const requireLogin = settings.requireLogin !== false;
+
+    const defaultPasswordActive = !settings.password;
+
+    return NextResponse.json({
+      requireLogin,
+      hasPassword: !!settings.password,
+      defaultPasswordActive,
+      displayName: "Password user",
+      loginMethod: "Password",
+      authenticated: !!session,
+    });
+  } catch {
+    return NextResponse.json({
+      requireLogin: true,
+      hasPassword: false,
+      defaultPasswordActive: false,
+      displayName: "Password user",
+      loginMethod: "Password",
+      authenticated: false,
+    });
+  }
+}

package/src/routes/api/auth/verify-password/route.js

@@ -0,0 +1,39 @@
+import { NextResponse } from "next/server";
+import { verifyDashboardPassword } from "@/lib/auth/dashboardSession";
+
+const NO_STORE_HEADERS = { "Cache-Control": "no-store" };
+
+export async function POST(request) {
+  try {
+    const body = await request.json();
+    const password = typeof body?.password === "string" ? body.password : "";
+
+    if (!password) {
+      return NextResponse.json(
+        { error: "Current password is required" },
+        { status: 400, headers: NO_STORE_HEADERS },
+      );
+    }
+
+    const verified = await verifyDashboardPassword(password);
+    if (!verified) {
+      return NextResponse.json(
+        {
+          error: {
+            message: "Invalid current password",
+            code: "invalid_current_password",
+          },
+        },
+        { status: 401, headers: NO_STORE_HEADERS },
+      );
+    }
+
+    return NextResponse.json({ verified: true }, { headers: NO_STORE_HEADERS });
+  } catch (error) {
+    console.error("[Auth][VerifyPassword]", error);
+    return NextResponse.json(
+      { error: "Unable to verify current password" },
+      { status: 500, headers: NO_STORE_HEADERS },
+    );
+  }
+}

package/src/routes/api/chat/tools/curl/route.js

@@ -0,0 +1,100 @@
+import dns from "node:dns/promises";
+import net from "node:net";
+import { NextResponse } from "@/next/server";
+import { fetchWithSsrfGuard, isUnsafeIp, SsrfGuardError } from "@/shared/utils/ssrfGuard.js";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const MAX_URL_LENGTH = 2_000;
+const MAX_BODY_LENGTH = 1_000_000;
+const CURL_TIMEOUT_MS = 8_000;
+
+class CurlInputError extends Error {}
+
+function isPrivateAddress(address) {
+  return net.isIP(address) > 0 && isUnsafeIp(address);
+}
+
+async function assertPublicUrl(value) {
+  if (typeof value !== "string" || !value.trim()) throw new CurlInputError("URL is required");
+  const raw = value.trim();
+  if (raw.length > MAX_URL_LENGTH) throw new CurlInputError(`URL must be ${MAX_URL_LENGTH} characters or fewer`);
+  let parsed;
+  try { parsed = new URL(raw); } catch { throw new CurlInputError("URL must be valid"); }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new CurlInputError("Only http:// and https:// URLs are allowed");
+  if (parsed.username || parsed.password) throw new CurlInputError("URLs with embedded credentials are not allowed");
+  if (isPrivateAddress(parsed.hostname)) throw new CurlInputError("Private and loopback targets are not allowed");
+  const hostname = parsed.hostname.toLowerCase().replace(/\.$/, "");
+  if (hostname === "localhost" || hostname === "metadata" || hostname === "metadata.google.internal" || hostname.endsWith(".internal") || hostname.endsWith(".local") || hostname.endsWith(".localhost") || hostname.endsWith(".lan")) {
+    throw new CurlInputError("Private and metadata hostnames are not allowed");
+  }
+  try {
+    const addresses = await dns.lookup(parsed.hostname, { all: true, verbatim: true });
+    if (!addresses.length || addresses.some(({ address }) => isPrivateAddress(address))) {
+      throw new CurlInputError("URL resolves to a private or loopback address");
+    }
+  } catch (error) {
+    if (error instanceof CurlInputError) throw error;
+    throw new CurlInputError("URL host could not be resolved safely");
+  }
+  return parsed;
+}
+
+async function readBoundedBody(response) {
+  if (!response.body) return { text: "", truncated: false };
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  const chunks = [];
+  let bytes = 0;
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    const chunk = value instanceof Uint8Array ? value : new Uint8Array(value);
+    const remaining = MAX_BODY_LENGTH - bytes;
+    if (chunk.byteLength > remaining) {
+      if (remaining > 0) chunks.push(decoder.decode(chunk.slice(0, remaining), { stream: false }));
+      try { await reader.cancel("body limit reached"); } catch {              }
+      return { text: chunks.join(""), truncated: true };
+    }
+    bytes += chunk.byteLength;
+    chunks.push(decoder.decode(chunk, { stream: true }));
+  }
+  chunks.push(decoder.decode());
+  return { text: chunks.join(""), truncated: false };
+}
+
+export async function POST(request) {
+  let timer;
+  try {
+    const body = await request.json().catch(() => ({}));
+    const method = String(body?.method || "GET").toUpperCase();
+    if (method !== "GET" && method !== "HEAD") throw new CurlInputError("Only GET and HEAD requests are allowed");
+    const url = await assertPublicUrl(body?.url);
+    const controller = new AbortController();
+    timer = setTimeout(() => controller.abort(), CURL_TIMEOUT_MS);
+    const response = await fetchWithSsrfGuard(url.toString(), {
+      method,
+      redirect: "manual",
+      cache: "no-store",
+      headers: { Accept: "application/json, text/plain, text/html, */*", "User-Agent": "SwayRouter Agent/1.0" },
+      signal: controller.signal,
+    }, { maxRedirects: 0 });
+    const bounded = method === "HEAD" ? { text: "", truncated: false } : await readBoundedBody(response);
+    return NextResponse.json({
+      ok: true,
+      method,
+      url: url.toString(),
+      status: response.status,
+      contentType: response.headers.get("content-type") || "",
+      body: bounded.text,
+      truncated: bounded.truncated,
+    });
+  } catch (error) {
+    const status = error instanceof CurlInputError || error instanceof SsrfGuardError ? 400 : 502;
+    const message = error?.name === "AbortError" ? "Request timed out" : (error instanceof Error ? error.message : "Curl tool failed");
+    return NextResponse.json({ ok: false, error: message }, { status });
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}