Repository navigation
fix(claude): scope CLAUDE_CC_ENTRYPOINT to OAuth call sites only - #9
Open
TechNickAI wants to merge 2 commits into
Open
TechNickAI wants to merge 2 commits into
TechNickAI wants to merge 2 commits into
Conversation
Two defects introduced when CLAUDE_CLI_USER_AGENT was made dynamic in #7: 1. CLAUDE_CLI_USER_AGENT was computed via claudeCliUserAgent() at module load, snapshotting CLAUDE_CC_ENTRYPOINT into the static registry constant used by getClaudeCliHeaders(). API-key connections (not OAuth) would then carry the sdk-cli User-Agent even though CLAUDE_CC_ENTRYPOINT is documented as OAuth-only. Fix: hardcode the static constant to always use "cli"; dynamic entrypoint stays in the OAuth call sites only. 2. mergeUpstreamExtraHeaders runs after the OAuth ccHeaders block sets User-Agent via claudeCliUserAgent(). Operator-configured upstream extra headers can include a custom User-Agent that overrides it, desynchronising cc_entrypoint from the actual wire value. Fix: reassert claudeCliUserAgent(CLAUDE_CODE_VERSION) after the merge for native Claude OAuth requests (provider=claude + hasClaudeOAuthToken). Tests: two new regression guards in claude-entrypoint.test.ts — one asserting CLAUDE_CLI_USER_AGENT is always "cli" regardless of env, one documenting the mergeUpstreamExtraHeaders override mechanism and the reassertion fix.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aa25dca27c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to PR #7 addressing two defects identified by bot review (comments 3707863231, 3707900072):
Static registry UA leaked OAuth billing identity:
CLAUDE_CLI_USER_AGENTwas computed viaclaudeCliUserAgent()at module load, snapshottingCLAUDE_CC_ENTRYPOINTinto a constant used bygetClaudeCliHeaders()for all API-key connections. WithCLAUDE_CC_ENTRYPOINT=sdk-cli, non-OAuth credential surfaces would sendclaude-cli/X.Y.Z (external, sdk-cli)— incorrect since the env var is documented as OAuth-only. Fix: hardcode the static constant to always use"cli"; dynamic entrypoint stays in OAuth call sites only.Preserve explicit OAuth User-Agent overrides: The native Claude OAuth path uses
claudeCliUserAgent(CLAUDE_CODE_VERSION)as its default.mergeUpstreamExtraHeadersremains the documented last-writer-wins operator override, so custom User-Agent settings are preserved instead of being silently replaced.Changes
open-sse/config/anthropicHeaders.ts:CLAUDE_CLI_USER_AGENThardcoded tocli(wasclaudeCliUserAgent(CLAUDE_CLI_VERSION))open-sse/executors/base.ts: preserve explicit User-Agent overrides after the native Claude OAuth default is settests/unit/claude-entrypoint.test.ts: Two regression guards addedTest plan
node --import tsx/esm --test tests/unit/claude-entrypoint.test.ts— 7/7 tests passCLAUDE_CLI_USER_AGENTis stable whenCLAUDE_CC_ENTRYPOINT=sdk-cliUser-Agentin extra headers preserve the explicit operator override