witbitz-code 1.7.2__tar.gz → 1.7.3__tar.gz

{witbitz_code-1.7.2/src/witbitz_code.egg-info → witbitz_code-1.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.7.2
+Version: 1.7.3
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.7.2 → witbitz_code-1.7.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "witbitz-code"
-version = "1.7.2"
+version = "1.7.3"
 description = "Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay."
 readme = "README.md"
 requires-python = ">=3.10"

{witbitz_code-1.7.2 → witbitz_code-1.7.3}/src/witbitz_code/__init__.py

@@ -4,4 +4,4 @@ The Python implementation of tools/witbitz-code.mjs (docs/opencode-relay.md phas
 vectors and cross-implementation tests.
 """
 
-__version__ = "1.7.2"
+__version__ = "1.7.3"

{witbitz_code-1.7.2 → witbitz_code-1.7.3}/src/witbitz_code/confidential.py

@@ -627,7 +627,11 @@ class ConfidentialProxy:
             hold = attempt["n"] > 1 or (ends is not None and self._now() / 1000 >= ends - HOLD_BEFORE_LAPSE_SEC)
             n = self._nonce()
             raw = dumps(stamp_floor(body)).encode("utf-8")
-            headers = {**_forward_headers(req.headers), "content-type": "application/json", "x-inference-receipt": n}
+            # the forwarded headers WITHOUT their own content-type / x-inference-receipt, whatever their case: OpenCode sends
+            # "Content-Type", and two of them made TrustedRouter refuse every confidential call (2026-10-17: a small one 400
+            # "could not read request"; a large one closed mid-upload — an empty httpx ReadError, "could not reach TrustedRouter ()")
+            fwd = {k: v for k, v in _forward_headers(req.headers).items() if k.lower() not in ("content-type", "x-inference-receipt")}
+            headers = {**fwd, "content-type": "application/json", "x-inference-receipt": n}
             tell("waiting", bytes=len(raw))
             async with self.client.stream("POST", target, headers=headers, content=raw) as up:
                 if not up.is_success:

{witbitz_code-1.7.2 → witbitz_code-1.7.3/src/witbitz_code.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: witbitz-code
-Version: 1.7.2
+Version: 1.7.3
 Summary: Reach OpenCode on this computer from the Witbitz Spaces Code section, through an end-to-end sealed relay.
 Author: Witbitz
 License-Expression: MIT

{witbitz_code-1.7.2 → witbitz_code-1.7.3}/tests/test_confidential.py

@@ -110,7 +110,7 @@ class FakeNet:
     def handler(self, req: httpx.Request):
         if "googleapis.com/service_accounts" in str(req.url):
             return httpx.Response(200, json=self.meta["googleJwks"])
-        self.calls.append({"url": str(req.url), "headers": dict(req.headers), "body": req.content.decode("utf-8")})
+        self.calls.append({"url": str(req.url), "headers": dict(req.headers), "raw": list(req.headers.raw), "body": req.content.decode("utf-8")})
         if self.status != 200:
             return httpx.Response(self.status, json={"error": {"message": "upstream said no"}})
         data = self.stream.encode("utf-8")
@@ -176,6 +176,20 @@ def test_a_confidential_answer_streams_through_and_the_receipt_verifies_on_the_r
     with_proxy(t)
 
 
+@needs_fixture
+def test_one_content_type_goes_upstream_whatever_case_opencode_sends_it():
+    # 2026-10-17: OpenCode sends "Content-Type"; the proxy forwarded it and added its own "content-type", and TrustedRouter
+    # refused every confidential call with two (a small one 400 "could not read request", a large one closed mid-upload —
+    # an empty httpx ReadError the owner saw as "could not reach TrustedRouter ()").
+    async def t(post, net, _p):
+        r = await post(SAY_OK, {"Content-Type": "application/json", "X-Inference-Receipt": "from-the-caller"})
+        assert r.status_code == 200
+        names = [k.decode().lower() for k, _v in net.calls[0]["raw"]]
+        assert names.count("content-type") == 1, names
+        assert names.count("x-inference-receipt") == 1 and net.calls[0]["headers"]["x-inference-receipt"] != "from-the-caller"
+    with_proxy(t)
+
+
 @needs_fixture
 def test_a_receipt_that_does_not_match_ends_the_step_with_an_error_and_no_tool_runs():
     meta, stream, _ = fixture()