[NomenAK]

Summary

#2165 stripped metadata unconditionally on Anthropic-shape bodies routed to CPA's /v1/messages (alongside client_info, prompt_cache_key, safety_identifier, etc.). That removed a useful signal that some BYOK clients (notably Capy) provide : a stable per-user metadata.user_id like user_3DGta5gzamzAUr57ZYZEtmc6lHX.

Stripping it means CPA's outbound cloak (which generates a fresh random UUID per call via uuid.New()) has no way to make Anthropic see the same account_uuid / session_uuid across calls from the same end user. No prompt-cache reuse, no per-user session continuity.

This PR preserves a bare {user_id: <string>} metadata shape only. Anything else under metadata (which Capy's SDK sometimes adds — session_id, client_info, etc.) is still stripped because Anthropic rejects it.

Related Issues

• Closes #
• Follow-up to fix(cliproxyapi): Anthropic-shape body routing and gate compatibility #2165 (Capy extras strip on Anthropic-shape bodies)

Motivation

CPA source : router-for-me/CLIProxyAPI, file internal/runtime/executor/helps/cloak_utils.go. The generateFakeUserID function builds a Claude Code-shaped identifier user_<64hex>_account_<uuidv4>_session_<uuidv4> where both UUIDs are produced by uuid.New() per call — no caching, no tie-back to the inbound BYOK request, no propagation of the OAuth account UUID captured during the auth handshake (which CPA's internal/auth/claude/anthropic_auth.go parses but doesn't persist into ClaudeTokenData).

Net effect from Anthropic's perspective : every call from the same Capy user looks like a different identity. The Anthropic prompt cache, which is keyed on account + prefix, never hits across calls in the same conversation.

A small CPA-side patch can derive a deterministic CC-shaped triplet from any seed string :

func DeterministicFakeUserID(seed string) string {
    h := sha256.Sum256([]byte("cpa-cloak-v1|" + seed))
    return "user_" + hex.EncodeToString(h[:]) +
           "_account_" + uuid.NewSHA1(uuid.NameSpaceOID, []byte("a|"+seed)).String() +
           "_session_" + uuid.NewSHA1(uuid.NameSpaceOID, []byte("s|"+seed)).String()
}

…and use it whenever the inbound metadata.user_id is non-empty but doesn't match CPA's strict CC regex. That patch is in flight on the CPA side ; this PR is the OmniRoute-side prerequisite so the seed actually arrives.

Today, with stock CPA, this PR is a no-op (CPA still overwrites the inbound user_id). Once the CPA patch ships, the same Capy user_3DGta5gz… gets a stable Anthropic identity, restoring prompt cache hits and (possibly) clearing the ^mcp_[^_] recognition gate without any other rewrite.

Changes

open-sse/executors/cliproxyapi.ts :

• Replace delete transformed.metadata (unconditional) with a conditional check :
  • Keep metadata if it's exactly { user_id: <string> } (one key, string value).
  • Strip it in every other case (no user_id, non-string user_id, extra fields alongside user_id).
• Strip order for other Capy extras (client_info, prompt_cache_key, safety_identifier) is unchanged.

Validation

• npm run test:unit — tests/unit/cliproxyapi-executor.test.ts — 39/39 pass (3 new tests : preserve bare shape, strip when extras present, strip when user_id missing or non-string)
• Existing test "strips metadata" rewritten to assert the new conditional behavior.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates the CliproxyapiExecutor to conditionally preserve the metadata field when it contains only a user_id string, enabling prompt-cache reuse. Previously, this field was always removed. Corresponding unit tests have been added to verify the preservation of valid metadata and the removal of invalid or extra fields. Feedback was provided to improve the robustness of the metadata check by explicitly handling non-object types and arrays to prevent potential API errors.

[gemini-code-assist]

The current implementation only strips metadata if it is an object that doesn't match the {user_id: string} shape. However, if metadata is a non-object (e.g., a string, number, or null), it will be preserved because the if (md && typeof md === "object") condition will be skipped. Since the previous behavior was to unconditionally delete metadata for Anthropic-shaped requests, this change could lead to 400 errors from Anthropic if a client sends a non-object metadata field.

It is safer to ensure metadata is deleted unless it matches the exact allowed shape, and to explicitly exclude arrays which also have a typeof value of "object".

Suggested change

	const md = transformed.metadata;
	if (md && typeof md === "object") {
	const mdRec = md as Record<string, unknown>;
	const isBareUserId = typeof mdRec.user_id === "string" && Object.keys(mdRec).length === 1;
	if (!isBareUserId) {
	delete transformed.metadata;
	}
	// bare {user_id: <string>} shape : keep as-is.
	}
	const md = transformed.metadata;
	const mdRec = md as Record<string, unknown>;
	const isBareUserId =
	md &&
	typeof md === "object" &&
	!Array.isArray(md) &&
	typeof mdRec.user_id === "string" &&
	Object.keys(mdRec).length === 1;
	if (!isBareUserId) {
	delete transformed.metadata;
	}

[NomenAK]

Closing after 2026-05-12 empirical bisect.

This PR preserved a bare {user_id: <string>} shape on metadata (and stripped anything else under metadata) so a CPA-side patch could use the inbound user_id as a deterministic seed for the cloaked user_id (account_uuid + session_uuid stable per Capy user → Anthropic prompt cache hits across calls).

Bisect against live Anthropic via CPA cloak confirmed that the entire metadata strip is unnecessary: Anthropic accepts metadata with arbitrary extra keys without flagging the extras-billing gate. The CPA-side deterministic user_id derivation now lives in router-for-me/CLIProxyAPI#3356 and works from the raw inbound user_id regardless of how cluttered the surrounding metadata object is.

Result: the conditional metadata strip is over-engineering with no upstream value. Fork-side: NomenAK/OmniRoute@cleanup/remove-over-engineered-strips drops it in commit 4e9e534.