Something went wrong. Try again.
sloproxy
Something went wrong. Try again.
64 kB · 1843 lines
Go
at main
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844package executor
import ( "bytes" "context" "crypto/sha256" "encoding/hex" "encoding/json" "fmt" "net/http" "strings" "time"
claudeauth "github.com/router-for-me/CLIProxyAPI/v7/internal/auth/claude" "github.com/router-for-me/CLIProxyAPI/v7/internal/config" "github.com/router-for-me/CLIProxyAPI/v7/internal/registry" "github.com/router-for-me/CLIProxyAPI/v7/internal/runtime/executor/helps" "github.com/router-for-me/CLIProxyAPI/v7/internal/util" cliproxyauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth" log "github.com/sirupsen/logrus" "github.com/tidwall/gjson" "github.com/tidwall/sjson"
"github.com/gin-gonic/gin")
func resolveIncomingClaudeHeaders(ctx context.Context, incoming http.Header) http.Header { resolved := make(http.Header) if ginCtx, ok := ctx.Value("gin").(*gin.Context); ok && ginCtx != nil && ginCtx.Request != nil { resolved = ginCtx.Request.Header.Clone() } for key, values := range incoming { resolved[key] = append([]string(nil), values...) } return resolved}
func detectIncomingClaudeCodeRequest(ctx context.Context, incoming http.Header, payload []byte, countTokens bool, cfg *config.Config) (http.Header, helps.ClaudeCodeRequestDetection) { resolved := resolveIncomingClaudeHeaders(ctx, incoming) return resolved, helps.DetectClaudeCodeRequest(resolved, payload, countTokens, cfg)}
// getWorkloadFromContext extracts workload identifier from the gin request headers.func getWorkloadFromContext(ctx context.Context) string { if ginCtx, ok := ctx.Value("gin").(*gin.Context); ok && ginCtx != nil && ginCtx.Request != nil { return strings.TrimSpace(ginCtx.GetHeader("X-CPA-Claude-Workload")) } return ""}
// getCloakConfigFromAuth extracts cloak configuration from the auth's attributes,// falling back to its stored metadata (the raw OAuth/token JSON). Returns// (cloakMode, strictMode, sensitiveWords, cacheUserID); an empty cloakMode means// the credential did not explicitly configure a mode.func getCloakConfigFromAuth(auth *cliproxyauth.Auth) (cloakMode string, strictMode bool, sensitiveWords []string, cacheUserID bool) { if auth == nil { return "", false, nil, false }
// lookupCloakAttr prefers the executor-facing Attributes, then falls back to the // raw metadata blob (e.g. the OAuth/token JSON) so file-based credentials can // carry cloak settings without a matching claude-api-key config entry. lookupCloakAttr := func(key string) string { if auth.Attributes != nil { if value := strings.TrimSpace(auth.Attributes[key]); value != "" { return value } } if value := claudeauth.ReadMetadataString(&auth.Metadata, key); value != "" { return strings.TrimSpace(value) } return "" }
// An empty cloakMode means this credential did not explicitly configure a mode, // allowing the caller to fall back to the global/default behavior. cloakMode = lookupCloakAttr("cloak_mode")
strictMode = strings.EqualFold(lookupCloakAttr("cloak_strict_mode"), "true")
if wordsStr := lookupCloakAttr("cloak_sensitive_words"); wordsStr != "" { sensitiveWords = strings.Split(wordsStr, ",") for i := range sensitiveWords { sensitiveWords[i] = strings.TrimSpace(sensitiveWords[i]) } }
cacheUserID = strings.EqualFold(lookupCloakAttr("cloak_cache_user_id"), "true")
return cloakMode, strictMode, sensitiveWords, cacheUserID}
// injectFakeUserID generates and injects a fake user ID into the request metadata.// When useCache is false, a new user ID is generated for every call.func injectFakeUserID(ctx context.Context, payload []byte, apiKey string, useCache bool) ([]byte, error) { generateID := func() (string, error) { if useCache { return helps.CachedUserIDRequired(ctx, apiKey) } sessionID, errSessionID := helps.CachedSessionIDRequired(ctx, apiKey) if errSessionID != nil { return "", errSessionID } return helps.GenerateFakeUserIDWithSessionID(sessionID), nil }
metadata := gjson.GetBytes(payload, "metadata") if !metadata.Exists() { userID, errUserID := generateID() if errUserID != nil { return nil, errUserID } payload, _ = sjson.SetBytes(payload, "metadata.user_id", userID) return payload, nil }
existingUserID := gjson.GetBytes(payload, "metadata.user_id").String() if existingUserID == "" || !helps.IsValidUserID(existingUserID) { userID, errUserID := generateID() if errUserID != nil { return nil, errUserID } payload, _ = sjson.SetBytes(payload, "metadata.user_id", userID) } return payload, nil}
// fingerprintSalt is the salt used by Claude Code to compute the 3-char build fingerprint.const fingerprintSalt = "59cf53e54c78"
// computeFingerprint computes the 3-char build fingerprint that Claude Code embeds in cc_version.// Algorithm: SHA256(salt + messageText[4] + messageText[7] + messageText[20] + version)[:3]func computeFingerprint(messageText, version string) string { indices := [3]int{4, 7, 20} runes := []rune(messageText) var sb strings.Builder for _, idx := range indices { if idx < len(runes) { sb.WriteRune(runes[idx]) } else { sb.WriteRune('0') } } input := fingerprintSalt + sb.String() + version h := sha256.Sum256([]byte(input)) return hex.EncodeToString(h[:])[:3]}
// generateBillingHeader creates the x-anthropic-billing-header text block that// Claude Code prepends to its system prompt. cch is present only on signed paths.func generateBillingHeader(cchSigning bool, version, messageText, entrypoint, workload string, isSubagent bool, prevReq, promptID string) string { if entrypoint == "" { entrypoint = "cli" } buildHash := computeFingerprint(messageText, version) var b strings.Builder b.WriteString("x-anthropic-billing-header: cc_version=") b.WriteString(version) b.WriteByte('.') b.WriteString(buildHash) b.WriteString("; cc_entrypoint=") b.WriteString(entrypoint) b.WriteByte(';')
if cchSigning { b.WriteString(" cch=00000;") } if workload != "" { b.WriteString(" cc_workload=") b.WriteString(workload) b.WriteByte(';') } if isSubagent { b.WriteString(" cc_is_subagent=true;") } if cchSigning { if prevReq != "" { b.WriteString(" cc_prev_req=") b.WriteString(prevReq) b.WriteByte(';') } if promptID != "" { b.WriteString(" cc_prompt_id=") b.WriteString(promptID) b.WriteByte(';') } } return b.String()}
func claudeBillingFingerprintMessageText(payload []byte) string { messageText := "" gjson.GetBytes(payload, "messages").ForEach(func(_, message gjson.Result) bool { if message.Get("role").String() != "user" { return true } content := message.Get("content") candidate := "" if content.Type == gjson.String { candidate = content.String() } else if content.IsArray() { content.ForEach(func(_, part gjson.Result) bool { if part.Get("type").String() == "text" { candidate = part.Get("text").String() } return true }) } if candidate != "" { messageText = candidate } return true }) return messageText}
func claudeCCHFallbackBillingHeader(ctx context.Context, cfg *config.Config, payload []byte, entrypoint string) string { isProbeOrHelper := helps.IsClaudeProbeOrHelperRequest(payload) prevReq, promptID := helps.ExtractClaudeBillingTags(payload) if !isProbeOrHelper { continuityCtx := helps.ClaudeContinuityContextFromContext(ctx) if prevReq == "" && continuityCtx != nil { prevReq = continuityCtx.PreviousRequestID } if promptID == "" && continuityCtx != nil { promptID = continuityCtx.PromptID } } incomingHeaders := resolveIncomingClaudeHeaders(ctx, helps.IncomingHeadersFromContext(ctx)) isSubagent := helps.IsClaudeSubagentRequest(incomingHeaders, payload) return generateBillingHeader( true, helps.DefaultClaudeVersion(cfg), claudeBillingFingerprintMessageText(payload), entrypoint, getWorkloadFromContext(ctx), isSubagent, prevReq, promptID, )}
const claudeCodeCLIIdentity = "You are Claude Code, Anthropic's official CLI for Claude."
const claudeCodeFableReportingOutcomes = `# Reporting outcomes
Report what actually happened, not what you intended. When you say something is done, sent, saved, fixed, or verified, that claim must rest on a result you observed in this session — tool output, the file as it now reads, the page as it now loads — not on what the step should have produced. If you did not check, say you did not check. If any step failed, was skipped, or came back different from what you expected, say so in the first sentence of your report, before anything else, even when the rest of the work succeeded. Never quietly work around a failure in a way that makes it look resolved; a problem the user can see is recoverable, one your summary hides is not. When you stop before the task is complete, your first line says so plainly and names what is left. Do not describe partial work as done, and do not let a summary read as more certain than the evidence behind it.`
func checkSystemInstructionsWithMode(payload []byte, strictMode bool) []byte { return checkSystemInstructionsWithSigningMode(payload, strictMode, false, "2.1.258", "cli", "")}
// checkSystemInstructionsWithSigningMode adds CLI attribution while keeping// caller instructions top-level. Cloaking must not manufacture conversation turns.func checkSystemInstructionsWithSigningMode(payload []byte, strictMode bool, cchSigning bool, version, entrypoint, workload string) []byte { return checkSystemInstructionsWithSigningModeAt(payload, strictMode, cchSigning, version, entrypoint, workload, time.Now(), false, "", "")}
// isClaudeFable51Model reports whether the model is specifically Fable 5.1 / Mythos 5.1,// matching native Claude Code 2.1.258 family/major/minor checks (AFo = {major:5, minor:1}).func isClaudeFable51Model(model string) bool { m := strings.ToLower(strings.TrimSpace(model)) for _, target := range []string{"fable-5-1", "fable-5.1", "mythos-5-1", "mythos-5.1"} { idx := strings.Index(m, target) if idx != -1 { nextIdx := idx + len(target) if nextIdx >= len(m) || m[nextIdx] < '0' || m[nextIdx] > '9' { return true } } } return false}
func checkSystemInstructionsWithSigningModeAt( payload []byte, strictMode bool, cchSigning bool, version, entrypoint, workload string, now time.Time, isSubagent bool, prevReq, promptID string,) []byte { system := gjson.GetBytes(payload, "system") messageText := claudeBillingFingerprintMessageText(payload)
billingText := generateBillingHeader(cchSigning, version, messageText, entrypoint, workload, isSubagent, prevReq, promptID) billingBlock := buildTextBlock(billingText, nil) agentBlock := buildTextBlock(claudeCodeCLIIdentity, &claudeCodeCacheControl)
systemBlocks := []string{billingBlock, agentBlock} model := strings.ToLower(strings.TrimSpace(gjson.GetBytes(payload, "model").String())) if isClaudeFable51Model(model) && !helps.IsClaudeProbeOrHelperRequest(payload) { systemBlocks = append(systemBlocks, buildTextBlock(claudeCodeFableReportingOutcomes, nil)) } payload, _ = sjson.SetRawBytes(payload, "system", []byte("["+strings.Join(systemBlocks, ",")+"]")) if strictMode { return injectClaudeCodeCurrentDate(payload, now) }
forwardedSystemBlocks := collectForwardedClaudeSystemPromptBlocks(system) if len(forwardedSystemBlocks) > 0 { last := len(forwardedSystemBlocks) - 1 if !gjson.Get(forwardedSystemBlocks[last], "cache_control").Exists() { forwardedSystemBlocks[last] = withEphemeralCacheControl(forwardedSystemBlocks[last]) } systemBlocks = append(systemBlocks, forwardedSystemBlocks...) payload, _ = sjson.SetRawBytes(payload, "system", []byte("["+strings.Join(systemBlocks, ",")+"]")) } return injectClaudeCodeCurrentDate(payload, now)}
// prepareClaudeSystemPromptForCountTokens preserves caller instructions in the// same top-level slot as Messages without adding CLI identity or conversation turns.func prepareClaudeSystemPromptForCountTokens(payload []byte, strictMode bool) []byte { system := gjson.GetBytes(payload, "system") if !system.Exists() { return payload } var blocks []string if !strictMode { blocks = collectForwardedClaudeSystemPromptBlocks(system) } if len(blocks) == 0 { updated, _ := sjson.DeleteBytes(payload, "system") return updated } updated, _ := sjson.SetRawBytes(payload, "system", []byte("["+strings.Join(blocks, ",")+"]")) return updated}
// claudeLegacySystemReminderModels lists the official Anthropic model IDs and// aliases that reject a mid-conversation role=system message. Entries mirror the// "claude" provider in internal/registry/models/models.json plus Anthropic's own// bare and "-latest" aliases. Other providers' synthetic IDs do not belong here.var claudeLegacySystemReminderModels = map[string]struct{}{ "claude-3-5-haiku-20241022": {}, "claude-3-5-haiku-latest": {}, "claude-3-7-sonnet-20250219": {}, "claude-3-7-sonnet-latest": {}, "claude-haiku-4-5": {}, "claude-haiku-4-5-20251001": {}, "claude-opus-4": {}, "claude-opus-4-20250514": {}, "claude-opus-4-1": {}, "claude-opus-4-1-20250805": {}, "claude-opus-4-5": {}, "claude-opus-4-5-20251101": {}, "claude-opus-4-6": {}, "claude-opus-4-7": {}, "claude-sonnet-4": {}, "claude-sonnet-4-20250514": {}, "claude-sonnet-4-5": {}, "claude-sonnet-4-5-20250929": {}, "claude-sonnet-4-6": {},}
func claudeUsesLegacySystemReminder(payload []byte) bool { model := strings.ToLower(strings.TrimSpace(gjson.GetBytes(payload, "model").String())) if slash := strings.LastIndexByte(model, '/'); slash >= 0 { model = model[slash+1:] } _, legacy := claudeLegacySystemReminderModels[model] return legacy}
// claudeCallerSystemBlockError reports a caller system block that Claude cannot// carry in any system slot. It is request-scoped: no other credential or upstream// model can accept the same body, so the request must not be retried.type claudeCallerSystemBlockError struct { statusErr}
func (claudeCallerSystemBlockError) IsRequestScoped() bool { return true}
func newClaudeCallerSystemBlockError(index int, blockType string) error { if blockType == "" { blockType = "unknown" } return claudeCallerSystemBlockError{statusErr{ code: http.StatusBadRequest, msg: fmt.Sprintf("invalid_request_error: system.%d.type: Input should be 'text'. "+ "System instructions support text only, but this block has type %q. "+ "Move non-text content into a user message.", index, blockType), }}}
// claudeMidSystemMessageModelError reports a mid-conversation// {"role":"system"} turn addressed to a first-party model that cannot carry// it. It is request-scoped for the same reason as claudeCallerSystemBlockError:// the body is incompatible with the model rather than evidence of unhealthy// credentials, so no credential should be cooled or retried.type claudeMidSystemMessageModelError struct { statusErr}
func (claudeMidSystemMessageModelError) IsRequestScoped() bool { return true}
// Both caller input and payload overrides may introduce a system turn, so the// error describes the final model's requirement without assuming its origin.func newClaudeMidSystemMessageModelError(model string) error { if model == "" { model = "unknown" } return claudeMidSystemMessageModelError{statusErr{ code: http.StatusBadRequest, msg: fmt.Sprintf("invalid_request_error: role 'system' is not supported on this model. "+ "Model %q predates mid-conversation system turns, so system instructions must "+ "stay in the top-level system field for it.", model), }}}
// validateClaudeMidSystemMessageModel rejects a request that pairs a legacy// model with a caller's mid-conversation {"role":"system"} turn.//// Anthropic answers that pairing with a guaranteed rejection, verified on both// /v1/messages and /v1/messages/count_tokens://// 400 role 'system' is not supported on this model//// The native client never produces it either: it gates the turn on the model,// which is also why claudeCodeCLIBetas withholds// mid-conversation-system-2026-04-07 for these IDs. In 314 captured native// requests the turn appears only on claude-opus-5 and claude-sonnet-5, and on// none of the 43 requests addressed to a model in// claudeLegacySystemReminderModels.//// Three conditions keep the check inside the evidence that produced it://// - firstPartyAnthropic, because the rejection was measured against// api.anthropic.com. A third-party gateway may map these model IDs onto// something that accepts the turn, and answering locally would also stop// failover to another credential or base URL.// - confirmedClaudeCode, because a client that still matches the native// fingerprint owns its wire. It gates the turn itself, so its body is// forwarded untouched and any upstream error reaches it unchanged.// - the pairing itself, so unknown and future model IDs stay optimistic in// the same way checkSystemInstructions treats them.//// Operators who prefer the turn folded into the system slot can still set// rebuild_mid_system_message, which runs before this check.//// The error is request-scoped: the body/model pairing is invalid independently// of first-party credential health, so no credential should be cooled or// retried.func validateClaudeMidSystemMessageModel(payload []byte, confirmedClaudeCode, firstPartyAnthropic bool) error { if confirmedClaudeCode || !firstPartyAnthropic { return nil } if !claudeUsesLegacySystemReminder(payload) || !claudePayloadHasMidSystemMessage(payload) { return nil } return newClaudeMidSystemMessageModelError(gjson.GetBytes(payload, "model").String())}
// validateClaudeCallerSystemBlocks rejects caller system content that cannot keep// its operator authority. Verified against api.anthropic.com on 2026-08-03: the// top-level system field answers "system.<i>.type: Input should be 'text'" for// image, document and unknown block types, and a role=system message answers// "role 'system' supports text, tool_addition, and tool_removal blocks only".// Cloaking keeps caller blocks top-level, so a non-text block has no destination.// Failing here keeps the caller's instructions from being silently dropped, and// costs no upstream attempt.func validateClaudeCallerSystemBlocks(system gjson.Result) error { if !system.IsArray() { // A string system prompt is text by definition. return nil } var blockErr error index := 0 system.ForEach(func(_, part gjson.Result) bool { if strings.TrimSpace(part.Get("type").String()) != "text" { blockErr = newClaudeCallerSystemBlockError(index, strings.TrimSpace(part.Get("type").String())) return false } index++ return true }) return blockErr}
func collectForwardedClaudeSystemPromptBlocks(system gjson.Result) []string { var blocks []string appendBlock := func(text, raw string) { if strings.TrimSpace(text) == "" || util.IsClaudeCodeAttributionSystemText(text) || text == claudeCodeCLIIdentity { return } blocks = append(blocks, raw) } if system.IsArray() { system.ForEach(func(_, part gjson.Result) bool { if part.Get("type").String() == "text" { appendBlock(part.Get("text").String(), part.Raw) } return true }) } else if system.Type == gjson.String { appendBlock(system.String(), buildTextBlock(system.String(), nil)) } return blocks}
// buildTextBlock constructs a JSON text block with JSON.stringify-compatible// HTML characters. encoding/json's default \u003c escaping would change the// exact currentDate bytes and therefore the final CCH.func buildTextBlock(text string, cacheControl *claudeCacheControl) string { block := `{"type":"text","text":` + marshalJSONStringWithoutHTMLEscape(text) if cacheControl != nil && cacheControl.Type != "" { block += `,"cache_control":{"type":` + marshalJSONStringWithoutHTMLEscape(cacheControl.Type) if cacheControl.TTL != "" { block += `,"ttl":` + marshalJSONStringWithoutHTMLEscape(cacheControl.TTL) } block += "}" } return block + "}"}
func marshalJSONStringWithoutHTMLEscape(value string) string { var encoded bytes.Buffer encoder := json.NewEncoder(&encoded) encoder.SetEscapeHTML(false) _ = encoder.Encode(value) return strings.TrimSuffix(encoded.String(), "\n")}
type claudeCodeFableState struct { injectedFallbacks bool injectedDisplay bool injectedReporting bool}
func hasFableReportingBlock(body []byte) bool { system := gjson.GetBytes(body, "system") if !system.IsArray() { str := strings.ReplaceAll(system.String(), "\u200B", "") return str == claudeCodeFableReportingOutcomes || strings.Contains(str, claudeCodeFableReportingOutcomes) } for _, blk := range system.Array() { text := strings.ReplaceAll(blk.Get("text").String(), "\u200B", "") if text == claudeCodeFableReportingOutcomes { return true } } return false}
func captureClaudeCodeFableState(before, after []byte, cloaked bool) claudeCodeFableState { if !cloaked || len(before) == 0 || len(after) == 0 { return claudeCodeFableState{} } return claudeCodeFableState{ injectedFallbacks: !gjson.GetBytes(before, "fallbacks").Exists() && gjson.GetBytes(after, "fallbacks").Exists(), injectedDisplay: !gjson.GetBytes(before, "thinking.display").Exists() && gjson.GetBytes(after, "thinking.display").Exists(), injectedReporting: !hasFableReportingBlock(before) && hasFableReportingBlock(after), }}
// reconcileClaudeCodeFableModelAfterPayload reconciles model-specific additions// (Opus fallback, thinking.display=updates, and # Reporting outcomes system block)// if payload rules rewrite the request model between Fable 5.1 and non-Fable models.func reconcileClaudeCodeFableModelAfterPayload( body []byte, fableState claudeCodeFableState, payloadTouchedFallbacks bool, payloadTouchedDisplay bool, cloaked bool, isProbeOrHelper bool,) []byte { if !cloaked || len(body) == 0 { return body }
// Probes and helpers must never carry Fable additions (Opus fallback, display=updates, reporting block) if isProbeOrHelper { if fableState.injectedFallbacks && !payloadTouchedFallbacks { body, _ = sjson.DeleteBytes(body, "fallbacks") } if fableState.injectedDisplay && !payloadTouchedDisplay { body, _ = sjson.DeleteBytes(body, "thinking.display") } if fableState.injectedReporting { system := gjson.GetBytes(body, "system") if system.IsArray() { blocks := make([]string, 0, len(system.Array())) removed := false for _, blk := range system.Array() { if strings.ReplaceAll(blk.Get("text").String(), "\u200B", "") == claudeCodeFableReportingOutcomes { removed = true continue } blocks = append(blocks, blk.Raw) } if removed { body, _ = sjson.SetRawBytes(body, "system", []byte("["+strings.Join(blocks, ",")+"]")) } } else if strings.ReplaceAll(system.String(), "\u200B", "") == claudeCodeFableReportingOutcomes { body, _ = sjson.DeleteBytes(body, "system") } } return body } currentModel := strings.ToLower(strings.TrimSpace(gjson.GetBytes(body, "model").String()))
if isClaudeFable51Model(currentModel) { // Non-Fable rewritten to Fable 5.1 (or original Fable 5.1): attach Fable additions // unless matching payload rules explicitly configured or filtered them. if !gjson.GetBytes(body, "fallbacks").Exists() && !payloadTouchedFallbacks { body, _ = sjson.SetRawBytes(body, "fallbacks", []byte(`[{"model":"claude-opus-5"}]`)) } if gjson.GetBytes(body, "thinking").Exists() { thinkingType := gjson.GetBytes(body, "thinking.type").String() if thinkingType == "adaptive" && !gjson.GetBytes(body, "thinking.display").Exists() && !payloadTouchedDisplay { body, _ = sjson.SetBytes(body, "thinking.display", "updates") } else if thinkingType != "adaptive" && fableState.injectedDisplay && !payloadTouchedDisplay { body, _ = sjson.DeleteBytes(body, "thinking.display") } } else if fableState.injectedDisplay && !payloadTouchedDisplay { body, _ = sjson.DeleteBytes(body, "thinking.display") } if !hasFableReportingBlock(body) { system := gjson.GetBytes(body, "system") if system.IsArray() { blocks := make([]string, 0, len(system.Array())+1) for _, blk := range system.Array() { blocks = append(blocks, blk.Raw) } blocks = append(blocks, buildTextBlock(claudeCodeFableReportingOutcomes, nil)) body, _ = sjson.SetRawBytes(body, "system", []byte("["+strings.Join(blocks, ",")+"]")) } else if system.Type == gjson.String { str := system.String() blocks := []string{ buildTextBlock(str, nil), buildTextBlock(claudeCodeFableReportingOutcomes, nil), } body, _ = sjson.SetRawBytes(body, "system", []byte("["+strings.Join(blocks, ",")+"]")) } else if !system.Exists() { blocks := []string{ buildTextBlock(claudeCodeFableReportingOutcomes, nil), } body, _ = sjson.SetRawBytes(body, "system", []byte("["+strings.Join(blocks, ",")+"]")) } } return body }
// Target model is Non-Fable 5.1: // Only delete fallbacks if CPA automatically injected it and matching payload rules did NOT explicitly configure/modify it if fableState.injectedFallbacks && !payloadTouchedFallbacks { body, _ = sjson.DeleteBytes(body, "fallbacks") } if fableState.injectedDisplay && !payloadTouchedDisplay { body, _ = sjson.DeleteBytes(body, "thinking.display") }
// Remove Reporting outcomes if CPA automatically injected it if fableState.injectedReporting { system := gjson.GetBytes(body, "system") if system.IsArray() { blocks := make([]string, 0, len(system.Array())) removed := false for _, blk := range system.Array() { if strings.ReplaceAll(blk.Get("text").String(), "\u200B", "") == claudeCodeFableReportingOutcomes { removed = true continue } blocks = append(blocks, blk.Raw) } if removed { body, _ = sjson.SetRawBytes(body, "system", []byte("["+strings.Join(blocks, ",")+"]")) } } else if strings.ReplaceAll(system.String(), "\u200B", "") == claudeCodeFableReportingOutcomes { body, _ = sjson.DeleteBytes(body, "system") } } return body}
// claudeCodeLocalDate reproduces Claude Code 2.1.220's wcs() helper:// new Date(), local calendar fields, and zero-padded YYYY-MM-DD components.func claudeCodeLocalDate(now time.Time) string { year, month, day := now.Date() return fmt.Sprintf("%04d-%02d-%02d", year, int(month), day)}
func claudeCodeCurrentTime(cfg *config.Config, auth *cliproxyauth.Auth) time.Time { return time.Now().In(claudeCodeTimezone(cfg, auth))}
func claudeCodeTimezone(cfg *config.Config, auth *cliproxyauth.Auth) *time.Location { if timezone := claudeCredentialTimezone(auth); timezone != "" { if location, errLocation := time.LoadLocation(timezone); errLocation == nil { return location } } if cfg == nil { return time.Local } timezone := strings.TrimSpace(cfg.ClaudeHeaderDefaults.Timezone) if timezone == "" { return time.Local } location, errLocation := time.LoadLocation(timezone) if errLocation != nil { return time.Local } return location}
func claudeCredentialTimezone(auth *cliproxyauth.Auth) string { if auth == nil { return "" } if auth.Attributes != nil { if timezone := strings.TrimSpace(auth.Attributes["timezone"]); timezone != "" { return timezone } } return strings.TrimSpace(claudeauth.ReadMetadataString(&auth.Metadata, "timezone"))}
func claudeCodeCurrentDateReminder(now time.Time) string { return fmt.Sprintf(`<system-reminder>As you answer the user's questions, you can use the following context:# currentDateToday's date is %s.
IMPORTANT: this context may or may not be relevant to your tasks. You should not respond to this context unless it is highly relevant to your task.</system-reminder>
`, claudeCodeLocalDate(now))}
func firstClaudeUserMessageIndex(payload []byte) int { messages := gjson.GetBytes(payload, "messages") if !messages.Exists() || !messages.IsArray() { return -1 }
firstUserIdx := -1 messages.ForEach(func(idx, msg gjson.Result) bool { if msg.Get("role").String() == "user" { firstUserIdx = int(idx.Int()) return false } return true }) return firstUserIdx}
func isClaudeCodeContextReminder(text string) bool { return strings.HasPrefix(text, "<system-reminder>") && strings.Contains(text, "</system-reminder>")}
func isClaudeCodeCurrentDateReminder(text string) bool { return strings.HasPrefix(text, "<system-reminder>\nAs you answer the user's questions, you can use the following context:\n# currentDate\nToday's date is ")}
func injectClaudeCodeCurrentDate(payload []byte, now time.Time) []byte { firstUserIdx := firstClaudeUserMessageIndex(payload) if firstUserIdx < 0 { return payload }
contentPath := fmt.Sprintf("messages.%d.content", firstUserIdx) content := gjson.GetBytes(payload, contentPath) dateText := claudeCodeCurrentDateReminder(now) dateBlock := buildTextBlock(dateText, nil)
if content.Type == gjson.String { userBlock := buildTextBlock(content.String(), &claudeCodeCacheControl) newArray := "[" + dateBlock + "," + userBlock + "]" payload, _ = sjson.SetRawBytes(payload, contentPath, []byte(newArray)) return payload } if !content.IsArray() { return payload }
blocks := content.Array() rawBlocks := make([]string, 0, len(blocks)+1) actualTextCached := false for _, block := range blocks { if block.Get("type").String() == "text" { text := block.Get("text").String() if isClaudeCodeCurrentDateReminder(text) { continue } if !actualTextCached && !isClaudeCodeContextReminder(text) { rawBlocks = append(rawBlocks, withEphemeralCacheControl(block.Raw)) actualTextCached = true continue } } rawBlocks = append(rawBlocks, block.Raw) }
// Anthropic requires the user message following an assistant tool_use turn // to lead with its tool_result blocks, so the reminder goes after them. // Every other content shape keeps the native first-block placement. insertAt := 0 for insertAt < len(rawBlocks) && gjson.Parse(rawBlocks[insertAt]).Get("type").String() == "tool_result" { insertAt++ } rawBlocks = append(rawBlocks, "") copy(rawBlocks[insertAt+1:], rawBlocks[insertAt:]) rawBlocks[insertAt] = dateBlock payload, _ = sjson.SetRawBytes(payload, contentPath, []byte("["+strings.Join(rawBlocks, ",")+"]")) return payload}
// claudeCodeContextManagement is the context_management object Claude Code// 2.1.220 sends on every Messages request, captured 2026-08-01 from an isolated// profile talking to api.anthropic.com. keep:"all" retains every thinking block,// so replicating the client's exact value cannot produce upstream behaviour the// real client does not already get.const claudeCodeContextManagement = `{"edits":[{"type":"clear_thinking_20251015","keep":"all"}]}`
// claudeThinkingAcceptsClearThinking reports whether the payload's thinking// value allows the clear_thinking_20251015 strategy. Anthropic rejects the// request outright otherwise://// `clear_thinking_20251015` strategy requires `thinking` to be enabled or adaptive//// An absent thinking field is therefore just as ineligible as an explicit// {"type":"disabled"}, which is why this checks for the accepted values rather// than excluding the disabled one.func claudeThinkingAcceptsClearThinking(payload []byte) bool { switch gjson.GetBytes(payload, "thinking.type").String() { case "enabled", "adaptive": return true default: return false }}
// injectClaudeCodeContextManagement supplies context_management when the caller// omitted it. CPA already claims context-management-2025-06-27 in Anthropic-Beta,// so a missing body field is an observable inconsistency with the real client. A// caller that sent its own object keeps it untouched.func injectClaudeCodeContextManagement(payload []byte) ([]byte, bool) { if gjson.GetBytes(payload, "context_management").Exists() { return payload, false } if !claudeThinkingAcceptsClearThinking(payload) { return payload, false } updated, err := sjson.SetRawBytes(payload, "context_management", []byte(claudeCodeContextManagement)) if err != nil { return payload, false } return updated, true}
type claudeCodeContextManagementState struct { eligible bool callerOwned bool automaticallyInjected bool payloadRuleTouched bool}
// reconcileClaudeCodeContextManagement resolves automatic ownership after all// payload rules and forced tool-choice processing have completed.func reconcileClaudeCodeContextManagement(payload []byte, state claudeCodeContextManagementState) []byte { contextManagement := gjson.GetBytes(payload, "context_management")
// Any thinking value the strategy does not accept must drop an object CPA // injected itself. disableThinkingIfToolChoiceForced deletes the whole // thinking field after injection, so this also covers a request that was // still eligible when injectClaudeCodeContextManagement ran. if !claudeThinkingAcceptsClearThinking(payload) { if state.callerOwned || !state.automaticallyInjected || state.payloadRuleTouched { return payload } if contextManagement.Raw != claudeCodeContextManagement { return payload } updated, err := sjson.DeleteBytes(payload, "context_management") if err != nil { return payload } return updated }
if !state.eligible || state.callerOwned || state.payloadRuleTouched || contextManagement.Exists() { return payload } updated, err := sjson.SetRawBytes(payload, "context_management", []byte(claudeCodeContextManagement)) if err != nil { return payload } return updated}
// withEphemeralCacheControl stamps the native Claude Code default cache marker// {"type":"ephemeral"} onto a content block. A 1h ttl is not part of the default// shape; upgradeClaudeCacheControlTTL adds it for the credentials native uses it// on, after all placement decisions are final.func withEphemeralCacheControl(rawBlock string) string { updated, err := sjson.SetRawBytes([]byte(rawBlock), "cache_control", []byte(`{"type":"ephemeral"}`)) if err != nil { return rawBlock } return string(updated)}
type claudeWirePolicy struct { OAuth bool // real OAuth token runtime identity ProfileClaudeCodeCLI bool // request fingerprint looks like Claude Code CLI ConfirmedClaudeCode bool Cloak bool}
type claudeCloakSettings struct { strictMode bool sensitiveWords []string cacheUserID bool}
func resolveClaudeWirePolicy(cfg *config.Config, auth *cliproxyauth.Auth, apiKey string, confirmedClaudeCode bool) (claudeWirePolicy, claudeCloakSettings) { cloakCfg := resolveClaudeKeyCloakConfig(cfg, auth) attrMode, attrStrict, attrWords, attrCache := getCloakConfigFromAuth(auth)
cloakMode := "auto" if cfg != nil && cfg.DisableClaudeCloakMode { cloakMode = "never" } settings := claudeCloakSettings{ strictMode: attrStrict, sensitiveWords: attrWords, cacheUserID: attrCache, } if attrMode != "" { cloakMode = attrMode } if cloakCfg != nil { if mode := strings.TrimSpace(cloakCfg.Mode); mode != "" { cloakMode = mode } if cloakCfg.StrictMode { settings.strictMode = true } if len(cloakCfg.SensitiveWords) > 0 { settings.sensitiveWords = cloakCfg.SensitiveWords } if cloakCfg.CacheUserID != nil { settings.cacheUserID = *cloakCfg.CacheUserID } }
fp := resolveClaudeFingerprintPolicy(cfg, auth, apiKey) cloakConfigured := cloakCfg != nil || attrMode != "" || attrStrict || len(attrWords) > 0 || attrCache policy := claudeWirePolicy{ OAuth: fp.AuthIsOAuthToken, ProfileClaudeCodeCLI: fp.ProfileClaudeCodeCLI, ConfirmedClaudeCode: confirmedClaudeCode, Cloak: (fp.ProfileClaudeCodeCLI || cloakConfigured) && !confirmedClaudeCode, } if confirmedClaudeCode { // Native Claude Code is always a passthrough client. An operator-level // "always" mode may cloak unknown callers, but must not overwrite a // strongly confirmed CLI, sdk-cli, or claude-vscode fingerprint. policy.Cloak = false return policy, settings } switch strings.ToLower(strings.TrimSpace(cloakMode)) { case "always": policy.Cloak = true case "never": policy.Cloak = false default: // Auto applies the CLI cloak only to real Claude OAuth credentials, // explicit fingerprint-profile opt-ins, or credentials with explicit cloak // settings. Other API keys and delegated providers keep the caller shape. } return policy, settings}
// applyCloaking applies the shared Messages/count_tokens wire policy. The// returned boolean reports whether cloaking ran.func applyCloaking( ctx context.Context, cfg *config.Config, auth *cliproxyauth.Auth, payload []byte, apiKey string, confirmedClaudeCode bool, cchSigning bool,) ([]byte, bool, error) { return applyCloakingInternal(ctx, cfg, auth, payload, apiKey, confirmedClaudeCode, cchSigning, true)}
func applyCloakingInternal( ctx context.Context, cfg *config.Config, auth *cliproxyauth.Auth, payload []byte, apiKey string, confirmedClaudeCode bool, cchSigning bool, obfuscateSensitiveWords bool,) ([]byte, bool, error) { policy, settings := resolveClaudeWirePolicy(cfg, auth, apiKey, confirmedClaudeCode) if !policy.Cloak { return payload, false, nil } // Strict mode drops caller system prompts entirely, so nothing needs a // destination and an unusable block cannot lose information. if !settings.strictMode { if errSystem := validateClaudeCallerSystemBlocks(gjson.GetBytes(payload, "system")); errSystem != nil { return nil, false, errSystem } }
billingVersion := helps.DefaultClaudeVersion(cfg) workload := getWorkloadFromContext(ctx)
isProbeOrHelper := helps.IsClaudeProbeOrHelperRequest(payload) isSubagent := false prevReq := "" promptID := "" if !isProbeOrHelper { incomingHeaders := resolveIncomingClaudeHeaders(ctx, helps.IncomingHeadersFromContext(ctx)) isSubagent = helps.IsClaudeSubagentRequest(incomingHeaders, payload) existingPrevReq, existingPromptID := helps.ExtractClaudeBillingTags(payload)
sessionID := helps.ClaudeSessionIDFromContext(ctx) if sessionID == "" && auth != nil { sessionID = helps.ClaudeAgentSessionUUIDForRequest(incomingHeaders, payload, payload, confirmedClaudeCode) }
if sessionID != "" && auth != nil { credIdentity := claudeDiagnosticsCredentialIdentity(auth) isNewTurn := helps.IsClaudeNewPromptTurn(payload) continuityKey, seq, prevMsgID, storedPrevReq, storedPromptID := helps.BeginClaudeContinuity(credIdentity, sessionID, isNewTurn, existingPromptID)
if existingPromptID != "" { promptID = existingPromptID } else { promptID = storedPromptID } if storedPrevReq != "" { prevReq = storedPrevReq } else { prevReq = existingPrevReq }
if continuityCtx := helps.ClaudeContinuityContextFromContext(ctx); continuityCtx != nil { continuityCtx.Key = continuityKey continuityCtx.Sequence = seq continuityCtx.PreviousMessageID = prevMsgID continuityCtx.PreviousRequestID = prevReq continuityCtx.PromptID = promptID continuityCtx.Initialized = true } } }
payload = checkSystemInstructionsWithSigningModeAt( payload, settings.strictMode, cchSigning, billingVersion, "cli", workload, claudeCodeCurrentTime(cfg, auth), isSubagent, prevReq, promptID, )
// In native Claude Code 2.1.258, claude-fable-5-1 requests carry: // "fallbacks": [{"model": "claude-opus-5"}] model := strings.ToLower(strings.TrimSpace(gjson.GetBytes(payload, "model").String())) if isClaudeFable51Model(model) && !isProbeOrHelper { if !gjson.GetBytes(payload, "fallbacks").Exists() { payload, _ = sjson.SetRawBytes(payload, "fallbacks", []byte(`[{"model":"claude-opus-5"}]`)) } if gjson.GetBytes(payload, "thinking").Exists() { thinkingType := gjson.GetBytes(payload, "thinking.type").String() if thinkingType == "adaptive" && !gjson.GetBytes(payload, "thinking.display").Exists() { payload, _ = sjson.SetBytes(payload, "thinking.display", "updates") } } }
// Probes and subagents never use 1h cache in native Claude Code; ensure any // caller-supplied 1h ttl is stripped to match extended-cache-ttl beta suppression. if isSubagent || isProbeOrHelper { payload = stripClaudeCacheControlTTL(payload) }
// Claude-Code-CLI fingerprint identity (real OAuth or fingerprint-profile=claude-code-cli) // is applied later through the shared ApplyClaudeCredentialMetadata path. // Other non-OAuth cloaking keeps the legacy per-request fake user_id. if !policy.ProfileClaudeCodeCLI { var errFakeUserID error payload, errFakeUserID = injectFakeUserID(ctx, payload, apiKey, settings.cacheUserID) if errFakeUserID != nil { return nil, false, errFakeUserID } }
// Apply sensitive word obfuscation if obfuscateSensitiveWords && len(settings.sensitiveWords) > 0 { matcher := helps.BuildSensitiveWordMatcher(settings.sensitiveWords) payload = helps.ObfuscateSensitiveWords(payload, matcher) }
return payload, true, nil}
type claudeCacheControl struct { Type string `json:"type"` TTL string `json:"ttl,omitempty"`}
// claudeCodeCacheControl is the default Claude Code breakpoint shape.//// Recovered from the cache-control constructor in the installed 2.1.220,// 2.1.221 and 2.1.227 binaries, which is byte-identical in all three://// function ctor({scope, ttl} = {}) {// return {type: "ephemeral", ...ttl && {ttl}, ...scope === "global" && {scope}}// }//// ttl is spread in only when the caller passes one, so the default native wire// shape carries no ttl at all. upgradeClaudeCacheControlTTL applies the 1h pool// separately, for the credentials native selects it on. The struct field order// preserves the native {type, ttl} key order when sjson marshals a value.var claudeCodeCacheControl = claudeCacheControl{ Type: "ephemeral",}
// claudeCacheControlTTL1h is the only non-default ttl native ever selects.const claudeCacheControlTTL1h = "1h"
// ensureCacheControl injects default cache_control breakpoints for translated// entrypoints (Responses/Chat/Gemini) after cloaking. Placement follows the// native request builder recovered from the installed binaries:// 1. LAST system block when no system marker exists// 2. LAST cacheable message when that message has no marker//// Tools are normally not stamped: the native Messages builder never passes a// cacheControl to its tool-schema converter, and a system breakpoint already// covers the tools prefix. The one exception is a payload with tools but no// system at all, which native never produces (it always sends a system prompt).// Without the fallback such a request has its only breakpoint on the volatile// final message, so a stateless caller with large tool definitions rewrites the// whole prefix on every request and never reads it back.//// Each section injects independently so cloaking's first-user marker cannot// suppress system/latest-user breakpoints. Callers still run enforceCacheControlLimit.// See: https://docs.anthropic.com/en/docs/build-with-claude/prompt-cachingfunc ensureCacheControl(payload []byte) []byte { if !claudePayloadHasCacheableSystem(payload) { payload = injectToolsCacheControl(payload) } payload = injectSystemCacheControl(payload) payload = injectMessagesCacheControl(payload) return payload}
// claudePayloadHasCacheableSystem reports whether the payload has a system prompt// that injectSystemCacheControl can actually host a breakpoint on. An absent key, an// empty array and an empty string all leave the tools prefix uncovered.func claudePayloadHasCacheableSystem(payload []byte) bool { system := gjson.GetBytes(payload, "system") switch { case !system.Exists(): return false case system.IsArray(): return system.Get("#").Int() > 0 case system.Type == gjson.String: return strings.TrimSpace(system.String()) != "" default: return false }}
// upgradeClaudeCacheControlTTL mirrors the native ttl upgrade helper, which only// touches blocks that already carry a cache_control without a ttl://// function upgrade(block, ttl) {// if (!("cache_control" in block) || !block.cache_control || block.cache_control.ttl) return block// return {...block, cache_control: {...block.cache_control, ttl}}// }//// It never creates a breakpoint, so placement stays owned by ensureCacheControl.// Native gates the 1h selection on OAuth scopes, a non-overage account and an// allowlisted internal query source, and pushes extended-cache-ttl-2025-04-11// only when that selection produced a 1h body ttl. CPA has no query-source// equivalent, so the credential check is the reproducible half: OAuth is exactly// when claudeCodeCLIBetas emits extended-cache-ttl, which keeps body ttl and the// beta strictly paired the way native does. API-key credentials keep the plain// {"type":"ephemeral"} native default, which also avoids sending ttl to// Anthropic-compatible gateways that never advertised support for it.func upgradeClaudeCacheControlTTL(payload []byte, ttl string) []byte { if ttl == "" || len(payload) == 0 || !gjson.ValidBytes(payload) { return payload }
upgrade := func(path string, block gjson.Result) { cacheControl := block.Get("cache_control") if !cacheControl.IsObject() || cacheControl.Get("ttl").Exists() { return } blockType := cacheControl.Get("type") if blockType.Type != gjson.String { return } // Rebuild the object so the native {type, ttl, scope} key order survives // instead of appending ttl after a caller-supplied scope. upgraded := `{"type":` + marshalJSONStringWithoutHTMLEscape(blockType.String()) + `,"ttl":` + marshalJSONStringWithoutHTMLEscape(ttl) if scope := cacheControl.Get("scope"); scope.Exists() { upgraded += `,"scope":` + scope.Raw } upgraded += "}" updated, errSet := sjson.SetRawBytes(payload, path+".cache_control", []byte(upgraded)) if errSet != nil { return } payload = updated }
forEachClaudeCacheControlBlock(payload, upgrade) return payload}
// stripClaudeCacheControlTTL removes any ttl field from cache_control blocks in payload,// downgrading {"type":"ephemeral","ttl":"..."} to {"type":"ephemeral"}.// This ensures that when extended-cache-ttl-2025-04-11 is stripped (e.g. on probes,// subagents, or non-OAuth credentials), the body does not retain a ttl field that would// trigger Anthropic 400 errors or fingerprint mismatch.func stripClaudeCacheControlTTL(payload []byte) []byte { if len(payload) == 0 || !gjson.ValidBytes(payload) { return payload }
strip := func(path string, block gjson.Result) { cacheControl := block.Get("cache_control") if !cacheControl.IsObject() || !cacheControl.Get("ttl").Exists() { return } updated, errDel := sjson.DeleteBytes(payload, path+".cache_control.ttl") if errDel != nil { return } payload = updated }
forEachClaudeCacheControlBlock(payload, strip) return payload}
// forEachClaudeCacheControlBlock walks every block that can carry cache_control// in Anthropic's evaluation order: tools, then system, then messages.func forEachClaudeCacheControlBlock(payload []byte, visit func(path string, block gjson.Result)) { if tools := gjson.GetBytes(payload, "tools"); tools.IsArray() { tools.ForEach(func(idx, item gjson.Result) bool { visit(fmt.Sprintf("tools.%d", int(idx.Int())), item) return true }) } if system := gjson.GetBytes(payload, "system"); system.IsArray() { system.ForEach(func(idx, item gjson.Result) bool { visit(fmt.Sprintf("system.%d", int(idx.Int())), item) return true }) } if messages := gjson.GetBytes(payload, "messages"); messages.IsArray() { messages.ForEach(func(msgIdx, message gjson.Result) bool { content := message.Get("content") if !content.IsArray() { return true } content.ForEach(func(itemIdx, item gjson.Result) bool { visit(fmt.Sprintf("messages.%d.content.%d", int(msgIdx.Int()), int(itemIdx.Int())), item) return true }) return true }) }}
func shouldEnsureCacheControl(payload []byte, cloaked, confirmedClaudeCode bool) bool { return !confirmedClaudeCode && (cloaked || countCacheControls(payload) == 0)}
func countCacheControls(payload []byte) int { count := 0
// Check system system := gjson.GetBytes(payload, "system") if system.IsArray() { system.ForEach(func(_, item gjson.Result) bool { if item.Get("cache_control").Exists() { count++ } return true }) }
// Check tools tools := gjson.GetBytes(payload, "tools") if tools.IsArray() { tools.ForEach(func(_, item gjson.Result) bool { if item.Get("cache_control").Exists() { count++ } return true }) }
// Check messages messages := gjson.GetBytes(payload, "messages") if messages.IsArray() { messages.ForEach(func(_, msg gjson.Result) bool { content := msg.Get("content") if content.IsArray() { content.ForEach(func(_, item gjson.Result) bool { if item.Get("cache_control").Exists() { count++ } return true }) } return true }) }
return count}
// normalizeCacheControlTTL ensures cache_control TTL values don't violate the// prompt-caching-scope-2026-01-05 ordering constraint: a 1h-TTL block must not// appear after a 5m-TTL block anywhere in the evaluation order.//// Anthropic evaluates blocks in order: tools → system (index 0..N) → messages.// Within each section, blocks are evaluated in array order. A 5m (default) block// followed by a 1h block at ANY later position is an error — including within// the same section (e.g. system[1]=5m then system[3]=1h).//// Strategy: walk all cache_control blocks in evaluation order. Once a 5m block// is seen, strip ttl from ALL subsequent 1h blocks (downgrading them to 5m).func normalizeCacheControlTTL(payload []byte) []byte { if len(payload) == 0 || !gjson.ValidBytes(payload) { return payload }
original := payload seen5m := false modified := false
processBlock := func(path string, obj gjson.Result) { cc := obj.Get("cache_control") if !cc.Exists() { return } if !cc.IsObject() { seen5m = true return } ttl := cc.Get("ttl") if ttl.Type != gjson.String || ttl.String() != "1h" { seen5m = true return } if !seen5m { return } ttlPath := path + ".cache_control.ttl" updated, errDel := sjson.DeleteBytes(payload, ttlPath) if errDel != nil { return } payload = updated modified = true }
tools := gjson.GetBytes(payload, "tools") if tools.IsArray() { tools.ForEach(func(idx, item gjson.Result) bool { processBlock(fmt.Sprintf("tools.%d", int(idx.Int())), item) return true }) }
system := gjson.GetBytes(payload, "system") if system.IsArray() { system.ForEach(func(idx, item gjson.Result) bool { processBlock(fmt.Sprintf("system.%d", int(idx.Int())), item) return true }) }
messages := gjson.GetBytes(payload, "messages") if messages.IsArray() { messages.ForEach(func(msgIdx, msg gjson.Result) bool { content := msg.Get("content") if !content.IsArray() { return true } content.ForEach(func(itemIdx, item gjson.Result) bool { processBlock(fmt.Sprintf("messages.%d.content.%d", int(msgIdx.Int()), int(itemIdx.Int())), item) return true }) return true }) }
if !modified { return original } return payload}
// enforceCacheControlLimit removes excess cache_control blocks from a payload// so the total does not exceed the Anthropic API limit (currently 4).//// Anthropic evaluates cache breakpoints in order: tools → system → messages.// The most valuable breakpoints are:// 1. Last tool — caches ALL tool definitions// 2. Last system block — caches ALL system content// 3. Recent messages — cache conversation context//// Removal priority (strip lowest-value first)://// Phase 1: system blocks earliest-first, preserving the last one.// Phase 2: tool blocks earliest-first, preserving the last one.// Phase 3: message content blocks earliest-first.// Phase 4: remaining system blocks (last system).// Phase 5: remaining tool blocks (last tool).func enforceCacheControlLimit(payload []byte, maxBlocks int) []byte { if len(payload) == 0 || !gjson.ValidBytes(payload) { return payload }
total := countCacheControls(payload) if total <= maxBlocks { return payload }
excess := total - maxBlocks
system := gjson.GetBytes(payload, "system") if system.IsArray() { lastIdx := -1 system.ForEach(func(idx, item gjson.Result) bool { if item.Get("cache_control").Exists() { lastIdx = int(idx.Int()) } return true }) if lastIdx >= 0 { system.ForEach(func(idx, item gjson.Result) bool { if excess <= 0 { return false } i := int(idx.Int()) if i == lastIdx { return true } if !item.Get("cache_control").Exists() { return true } path := fmt.Sprintf("system.%d.cache_control", i) updated, errDel := sjson.DeleteBytes(payload, path) if errDel != nil { return true } payload = updated excess-- return true }) } } if excess <= 0 { return payload }
tools := gjson.GetBytes(payload, "tools") if tools.IsArray() { lastIdx := -1 tools.ForEach(func(idx, item gjson.Result) bool { if item.Get("cache_control").Exists() { lastIdx = int(idx.Int()) } return true }) if lastIdx >= 0 { tools.ForEach(func(idx, item gjson.Result) bool { if excess <= 0 { return false } i := int(idx.Int()) if i == lastIdx { return true } if !item.Get("cache_control").Exists() { return true } path := fmt.Sprintf("tools.%d.cache_control", i) updated, errDel := sjson.DeleteBytes(payload, path) if errDel != nil { return true } payload = updated excess-- return true }) } } if excess <= 0 { return payload }
messages := gjson.GetBytes(payload, "messages") if messages.IsArray() { messages.ForEach(func(msgIdx, msg gjson.Result) bool { if excess <= 0 { return false } content := msg.Get("content") if !content.IsArray() { return true } content.ForEach(func(itemIdx, item gjson.Result) bool { if excess <= 0 { return false } if !item.Get("cache_control").Exists() { return true } path := fmt.Sprintf("messages.%d.content.%d.cache_control", int(msgIdx.Int()), int(itemIdx.Int())) updated, errDel := sjson.DeleteBytes(payload, path) if errDel != nil { return true } payload = updated excess-- return true }) return true }) } if excess <= 0 { return payload }
system = gjson.GetBytes(payload, "system") if system.IsArray() { system.ForEach(func(idx, item gjson.Result) bool { if excess <= 0 { return false } if !item.Get("cache_control").Exists() { return true } path := fmt.Sprintf("system.%d.cache_control", int(idx.Int())) updated, errDel := sjson.DeleteBytes(payload, path) if errDel != nil { return true } payload = updated excess-- return true }) } if excess <= 0 { return payload }
tools = gjson.GetBytes(payload, "tools") if tools.IsArray() { tools.ForEach(func(idx, item gjson.Result) bool { if excess <= 0 { return false } if !item.Get("cache_control").Exists() { return true } path := fmt.Sprintf("tools.%d.cache_control", int(idx.Int())) updated, errDel := sjson.DeleteBytes(payload, path) if errDel != nil { return true } payload = updated excess-- return true }) }
return payload}
// injectMessagesCacheControl adds cache_control to the message the native rolling// breakpoint selector would pick. Recovered from the marker selector in the// installed 2.1.220/2.1.221/2.1.227 binaries://// eligible(msg): a non-assistant turn is always eligible; an assistant turn with// string content is eligible; an assistant turn with array content// is eligible only when its last block is not thinking-like.// last := walk back from the end, skipping internal system turns and// ineligible turns.// target := (final turn is a system turn with non-empty STRING content and// last >= 0) ? final turn : last//// The final-system special case is deliberately narrow: native requires string// content there and writes a brand new single text block for it rather than// stamping the last element of an existing array. Markers on other messages must// not suppress this rolling write.func injectMessagesCacheControl(payload []byte) []byte { messages := gjson.GetBytes(payload, "messages") if !messages.Exists() || !messages.IsArray() { return payload }
lastMessageIndex := int(messages.Get("#").Int()) - 1 lastEligibleIndex := -1 messages.ForEach(func(index gjson.Result, message gjson.Result) bool { if role := message.Get("role").String(); role != "user" && role != "assistant" { return true } if claudeMessageEligibleForRollingCache(message) { lastEligibleIndex = int(index.Int()) } return true })
if lastEligibleIndex >= 0 { finalMessage := messages.Get(fmt.Sprintf("%d", lastMessageIndex)) finalContent := finalMessage.Get("content") if finalMessage.Get("role").String() == "system" && finalContent.Type == gjson.String && strings.TrimSpace(finalContent.String()) != "" { return injectClaudeFinalSystemCacheControl(payload, lastMessageIndex, finalContent.String()) } } if lastEligibleIndex < 0 { return payload }
contentPath := fmt.Sprintf("messages.%d.content", lastEligibleIndex) content := gjson.GetBytes(payload, contentPath) if messageContentHasCacheControl(content) { return payload }
if content.IsArray() { contentCount := int(content.Get("#").Int()) if contentCount > 0 { cacheControlPath := fmt.Sprintf("messages.%d.content.%d.cache_control", lastEligibleIndex, contentCount-1) result, err := sjson.SetBytes(payload, cacheControlPath, claudeCodeCacheControl) if err != nil { log.Warnf("failed to inject cache_control into messages: %v", err) return payload } payload = result } } else if content.Type == gjson.String { newContent := "[" + buildTextBlock(content.String(), &claudeCodeCacheControl) + "]" result, err := sjson.SetRawBytes(payload, contentPath, []byte(newContent)) if err != nil { log.Warnf("failed to inject cache_control into message string content: %v", err) return payload } payload = result }
return payload}
// claudeMessageEligibleForRollingCache reports whether the native selector would// consider this user/assistant turn as a rolling breakpoint host. Native rejects// an assistant turn whose last content block is thinking-like, because a thinking// block cannot host the marker.func claudeMessageEligibleForRollingCache(message gjson.Result) bool { content := message.Get("content") if content.Type == gjson.String { return true } if !content.IsArray() || content.Get("#").Int() == 0 { return false } if message.Get("role").String() != "assistant" { return true } lastBlock := content.Get(fmt.Sprintf("%d", content.Get("#").Int()-1)) switch lastBlock.Get("type").String() { case "thinking", "redacted_thinking": return false default: return true }}
// injectClaudeFinalSystemCacheControl reproduces the native final-system special// case, which replaces the string content with a single marked text block.func injectClaudeFinalSystemCacheControl(payload []byte, messageIndex int, text string) []byte { contentPath := fmt.Sprintf("messages.%d.content", messageIndex) newContent := "[" + buildTextBlock(text, &claudeCodeCacheControl) + "]" result, err := sjson.SetRawBytes(payload, contentPath, []byte(newContent)) if err != nil { log.Warnf("failed to inject cache_control into trailing system message: %v", err) return payload } return result}
func messageContentHasCacheControl(content gjson.Result) bool { if content.IsArray() { found := false content.ForEach(func(_, item gjson.Result) bool { if item.Get("cache_control").Exists() { found = true return false } return true }) return found } return false}
// injectToolsCacheControl adds cache_control to the last non-deferred tool in the tools array.// Deferred tools cannot use prompt caching, so trailing deferred tools are skipped.// This only adds cache_control if NO tool in the array already has it.func injectToolsCacheControl(payload []byte) []byte { tools := gjson.GetBytes(payload, "tools") if !tools.Exists() || !tools.IsArray() { return payload }
// Check if ANY tool already has cache_control and find the last eligible tool. hasCacheControlInTools := false lastEligibleToolIndex := -1 tools.ForEach(func(index, tool gjson.Result) bool { if tool.Get("cache_control").Exists() { hasCacheControlInTools = true return false } if !tool.Get("defer_loading").Bool() { lastEligibleToolIndex = int(index.Int()) } return true }) if hasCacheControlInTools || lastEligibleToolIndex < 0 { return payload }
lastToolPath := fmt.Sprintf("tools.%d.cache_control", lastEligibleToolIndex) result, err := sjson.SetBytes(payload, lastToolPath, claudeCodeCacheControl) if err != nil { log.Warnf("failed to inject cache_control into tools array: %v", err) return payload }
return result}
// injectSystemCacheControl adds cache_control to the last element in the system prompt.// Converts string system prompts to array format if needed.// This only adds cache_control if NO system element already has it.func injectSystemCacheControl(payload []byte) []byte { system := gjson.GetBytes(payload, "system") if !system.Exists() { return payload }
if system.IsArray() { count := int(system.Get("#").Int()) if count == 0 { return payload }
// Check if ANY system element already has cache_control hasCacheControlInSystem := false system.ForEach(func(_, item gjson.Result) bool { if item.Get("cache_control").Exists() { hasCacheControlInSystem = true return false } return true }) if hasCacheControlInSystem { return payload }
// Add cache_control to the last system element lastSystemPath := fmt.Sprintf("system.%d.cache_control", count-1) result, err := sjson.SetBytes(payload, lastSystemPath, claudeCodeCacheControl) if err != nil { log.Warnf("failed to inject cache_control into system array: %v", err) return payload } payload = result } else if system.Type == gjson.String { // Empty/blank strings are not cacheable hosts. claudePayloadHasCacheableSystem // already treats them as missing so tools can cover the prefix; converting them // here would create a second, useless breakpoint on whitespace. if strings.TrimSpace(system.String()) == "" { return payload } // Convert string system prompt to an ordered native text block. newSystem := "[" + buildTextBlock(system.String(), &claudeCodeCacheControl) + "]" result, err := sjson.SetRawBytes(payload, "system", []byte(newSystem)) if err != nil { log.Warnf("failed to inject cache_control into system string: %v", err) return payload } payload = result }
return payload}
func ensureModelMaxTokens(body []byte, modelID string) []byte { if len(body) == 0 || !gjson.ValidBytes(body) { return body }
if maxTokens := gjson.GetBytes(body, "max_tokens"); maxTokens.Exists() { return body }
for _, provider := range registry.GetGlobalRegistry().GetModelProviders(strings.TrimSpace(modelID)) { if strings.EqualFold(provider, "claude") { maxTokens := defaultModelMaxTokens if info := registry.GetGlobalRegistry().GetModelInfo(strings.TrimSpace(modelID), "claude"); info != nil && info.MaxCompletionTokens > 0 { maxTokens = info.MaxCompletionTokens } body, _ = sjson.SetBytes(body, "max_tokens", maxTokens) return body } }
return body}