feat(sse): refresh Claude OAuth wire image to claude-cli/2.1.131 by Tentoxa · Pull Request #2011 · diegosouzapw/OmniRoute

Tentoxa · 2026-05-06T18:50:52Z

Summary

Refresh the native Claude OAuth wire image to match claude-cli/2.1.131, and
extend the cloak so it fires on any sk-ant-oat token regardless of upstream
client. This resolves the upstream 429s seen when routing Claude Max OAuth
credentials through non-CLI clients (ForgeCode, Cursor, Cline).

Highlights:

Per-OAuth-account cliUserID / accountUUID / sessionId generated and
persisted via mapTokens; preserved across token refresh.
postExchange calls /api/claude_cli/bootstrap to capture real account
metadata at provisioning time (best-effort — failure does not block OAuth).
Adaptive anthropic-beta selection per request shape (probe / structured
/ full-agent) replaces the previous static set.
Per-request behavior overrides via x-omniroute-effort and
x-omniroute-thinking headers; auto-mirror context_management whenever
thinking is set.
Migrate deprecated top-level output_format → output_config.format in
chatCore to fix the 400 some clients trigger.
Dashboard "Test Model" for OAuth Claude now routes through the executor
instead of duplicating cloak logic — single source of truth.

Related Issues

Closes #
Related to All Claude accounts returning 429 Upstream on every model. Accounts have full quota #1995

Validation

npm run lint
npm run test:unit
npm run test:coverage
Coverage is still >= 60% for statements, lines, functions, and branches
SonarQube PR analysis is green or any remaining issues are explicitly documented below

Tests Added Or Updated

No new test files. Existing Claude unit suites all pass (69 tests, 12 suites).

Coverage Notes

Touched files in open-sse/ and src/lib/ are covered by existing
claude-* suites. The new helper module open-sse/executors/claudeIdentity.ts
is exercised transitively by claude-code-parity and
anthropic-cache-fingerprint. Happy to add focused unit tests for
selectBetaFlags / parseUpstreamMetadataUserId / resolveCliUserID if
reviewers want them.

Reviewer Notes

Cloak gate widened: now fires on sk-ant-oat token detection in
addition to isClaudeCodeClient. API-key Claude (sk-ant-api) and all
other providers are unaffected.
Existing OAuth connections keep working but only get persistent
accountUUID / cliUserID after re-auth. Pre-existing accounts use a
background bootstrap fetch + in-memory cache as a stopgap.
New opt-in headers x-omniroute-effort and x-omniroute-thinking documented
inline in base.ts; default is pure passthrough.

- Per-OAuth-account identity (cliUserID, accountUUID, sessionId) generated with the same crypto.randomBytes(32) algorithm real CLI uses, persisted to providerSpecificData via mapTokens. Token refresh preserves the device id (the device is the machine, not the credential). - postExchange fetches /api/claude_cli/bootstrap to populate accountUUID, email, and organization metadata at OAuth provisioning. Best-effort: bootstrap failures do not block OAuth. - Adaptive anthropic-beta selection per request shape (probe / structured / full-agent) replaces the static set, matching what real CLI emits conditionally on body shape. - Cloak gate widened to cover OAuth tokens (sk-ant-oat) regardless of upstream client, so non-CLI clients (ForgeCode, Cursor, Cline) routing through OmniRoute on a Claude Max OAuth credential still emit CLI-shaped traffic on the user:sessions:claude_code scope. - Per-request behavior overrides via x-omniroute-effort and x-omniroute-thinking custom headers. Auto-mirror context_management whenever thinking is set but context_management isn't, matching the real-CLI invariant. - output_format -> output_config.format migration in chatCore for clients still emitting the deprecated top-level field (Anthropic now returns 400 on it). - Validation routes Claude OAuth probes through getExecutor("claude") instead of duplicating the cloak — single source of truth. - Header order in cliFingerprints matches real-CLI emission (Title-Case alphabetical, then lowercase alphabetical, then transport). - Tool cache_control kept on the translator path; cloak strips it for Claude OAuth requests (real CLI never sets cache_control on tools). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gemini-code-assist

Code Review

This pull request implements a comprehensive "cloak" for Claude OAuth traffic to ensure it mimics the official Anthropic CLI, addressing issues with rate limiting and prompt cache affinity. Key changes include the introduction of claudeIdentity.ts for session and device ID management, updating the pinned CLI version to 2.1.131, and refining header and body field ordering to match official fingerprints. Feedback focuses on ensuring fingerprinting is applied to all OAuth requests, managing memory for identity caches, adding timeouts to background fetch operations, and centralizing version constants for better maintainability.

gemini-code-assist · 2026-05-06T18:53:34Z

+        const shouldFingerprint =
+          isCliCompatEnabled(this.provider) ||
+          (this.provider === "claude" && isClaudeCodeClient);


The fingerprinting logic (which controls header and body field ordering) should be applied to all Claude OAuth requests to ensure they are indistinguishable from official CLI traffic. Currently, this is only triggered if isClaudeCodeClient is true, but the 'cloak' logic earlier in this method (lines 519-718) correctly applies to any hasClaudeOAuthToken. Missing this ordering on non-CLI clients using OAuth tokens increases the risk of 429 errors on the claude_code scope.

Suggested change

const shouldFingerprint =

isCliCompatEnabled(this.provider) ||

(this.provider === "claude" && isClaudeCodeClient);

const shouldFingerprint =

isCliCompatEnabled(this.provider) ||

(this.provider === "claude" && (isClaudeCodeClient || hasClaudeOAuthToken));

gemini-code-assist · 2026-05-06T18:53:34Z

+
+// ---------- Session ID (per OAuth account, process lifetime) -------------
+
+const sessionCache = new Map<string, string>();


The sessionCache, lazyCliUserIDCache, and accountUuidCache maps are unbounded and will grow indefinitely as new OAuth tokens or seeds are processed. In a long-running server environment, this constitutes a memory leak. Consider using an LRU cache or a Map with a maximum size limit to prune old entries.

gemini-code-assist · 2026-05-06T18:53:34Z

+    const res = await fetch("https://api.anthropic.com/api/claude_cli/bootstrap", {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json",
+        "User-Agent": `claude-cli/${CLAUDE_CODE_VERSION} (external, cli)`,
+        "anthropic-beta": "oauth-2025-04-20",
+      },


The fetch call to the bootstrap endpoint lacks a timeout. While this is a background operation, a hanging network request can indefinitely consume a socket and memory. It is recommended to use an AbortSignal with a reasonable timeout (e.g., 10 seconds).

gemini-code-assist · 2026-05-06T18:53:34Z

+    const res = await fetch("https://api.anthropic.com/api/claude_cli/bootstrap", {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json",
+        "User-Agent": "claude-cli/2.1.131 (external, cli)",
+        "anthropic-beta": "oauth-2025-04-20",
+      },


The fetch call to the bootstrap endpoint lacks a timeout. Network issues or slow upstream responses could cause this call to hang, potentially delaying the completion of the OAuth flow. Consider adding a timeout via AbortController.

gemini-code-assist · 2026-05-06T18:53:35Z

+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json",
+        "User-Agent": "claude-cli/2.1.131 (external, cli)",


The User-Agent string is hardcoded here. To ensure consistency across the codebase and simplify future version bumps, consider importing CLAUDE_CODE_VERSION from @omniroute/open-sse/executors/claudeIdentity.ts and using it in a template literal.

- Widen `shouldFingerprint` gate to also fire on `hasClaudeOAuthToken`, matching the cloak gate. Fixes ordering on non-CLI OAuth clients. - Bound identity caches (sessionCache, lazyCliUserIDCache, accountUuidCache) with FIFO eviction at 10k entries to prevent unbounded growth in long-running multi-tenant deployments. - Add 10s AbortController timeout to both bootstrap fetches (claudeIdentity background path and oauth/providers/claude provisioning path) so a hung upstream cannot leak sockets or stall OAuth completion. - Replace hardcoded "claude-cli/2.1.131" UA in oauth/providers/claude.ts with the CLAUDE_CODE_VERSION constant from claudeIdentity.ts so future version bumps are a single-line change.

Tentoxa · 2026-05-06T19:00:17Z

Addressed all issues found by Gemini in a07657b

diegosouzapw · 2026-05-07T11:49:10Z

Thank you @Tentoxa for your contribution! This has been reviewed and is now merged into release/v3.8.0 for the upcoming release. Amazing work!

Tentoxa requested a review from diegosouzapw as a code owner May 6, 2026 18:50

gemini-code-assist Bot reviewed May 6, 2026

View reviewed changes

diegosouzapw merged commit eb2579e into diegosouzapw:release/v3.8.0 May 7, 2026
2 checks passed

Tentoxa mentioned this pull request May 8, 2026

fix(sse): prevent Claude OAuth multi-account correlation via metadata.user_id #2053

Merged

5 tasks

diegosouzapw mentioned this pull request May 10, 2026

Release v3.8.0 #2111

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(sse): refresh Claude OAuth wire image to claude-cli/2.1.131#2011

feat(sse): refresh Claude OAuth wire image to claude-cli/2.1.131#2011
diegosouzapw merged 2 commits into
diegosouzapw:release/v3.8.0from
Tentoxa:feat/claude-oauth-cloak-refresh

Tentoxa commented May 6, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 6, 2026

Uh oh!

gemini-code-assist Bot May 6, 2026

Uh oh!

gemini-code-assist Bot May 6, 2026

Uh oh!

gemini-code-assist Bot May 6, 2026

Uh oh!

gemini-code-assist Bot May 6, 2026

Uh oh!

Tentoxa commented May 6, 2026

Uh oh!

diegosouzapw commented May 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		// ---------- Session ID (per OAuth account, process lifetime) -------------

		const sessionCache = new Map<string, string>();

Conversation

Tentoxa commented May 6, 2026

Summary

Related Issues

Validation

Tests Added Or Updated

Coverage Notes

Reviewer Notes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

Tentoxa commented May 6, 2026

Uh oh!

diegosouzapw commented May 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants