Fix Anthropic-compatible auth headers - #24
Conversation
|
@0xSero this is like my 3rd github PR ever. And I did the very best vibing to codex xhigh i could to deliver you this. ultimately, its what worked for me and I'm vibing my way with multiple models in codex app. Maybe it doesnt merge and I'm sorry. but thank you for doing what you do 0x! |
@OnlyTerp please review if u can I appreciate your contribution. |
On it. Love this community I'll have this handled very shortly |
|
Merged! 🎉 Thank you @eafire15 — this is a genuinely correct fix. The real Anthropic Messages API authenticates with Nothing is lost for the providers that do want a bearer token — since What I did before merging:
For a 3rd-ever PR this is clean, well-tested, and well-reasoned. Exactly the kind of contribution we love to see — please keep them coming. 🙏 |
Bring in 5 upstream commits: - feat: Auto Router for per-task model selection (855e459) - test: Auto Router integration suite (17c4125) - feat: Cursor Composer subscription passthrough (27b6e5e) - feat: Windows quota launcher (f6a89f9) - fix: Anthropic auth uses x-api-key only (sybil-solutions#24) (14a05ba) Conflict resolutions ==================== codex_shim/cli.py — kept BOTH sides where they were complementary: * Conflict sybil-solutions#1 (picker needle): kept our regex-based MODEL_PICKER_NEEDLE (it handles both the old model-queries-*.js inlined form AND the new models-and-reasoning-efforts-*.js extracted form), AND kept upstream's new SYSTEM_CODEX_APP / USER_CODEX_APP Path constants (referenced by upstream's patched_codex_app_bundle() and resign helpers). Rationale: upstream's literal needle does not match recent Codex Desktop bundles; ours does. Upstream's Path constants are required by other upstream code we're adopting. * Conflict sybil-solutions#2 (exec_codex_app): layered fallback rather than a stitch. Order: patched bundle (upstream) -> codex CLI (upstream's original) -> macOS `open -a Codex` (our no-CLI fix) -> error. Each layer is independently meaningful; nothing is mashed together. codex_shim/server.py — accepted upstream entirely. The four conflicts (chat_completions routing, responses_compact ChatGPT branch, the _route method body and signature, _route return type) were all expressions of the same substitution: vision_router was replaced by the more general Auto Router (which subsumes vision routing via candidate.supports_images hard-zeroing on image tasks). Upstream's ShimServer rewrites _route from `(body) -> tuple[ShimModel, body]` back to `(body) -> ShimModel` and moves image-aware decisions into router.pick_candidate, so we keep nothing from our old signature. Independent of the substitution, we re-applied the diagnostic `[route] slug=... provider=... upstream_model=... url=` print in _post_openai_chat and _post_anthropic — those are operational logging, not vision-routing logic, and would otherwise be silently dropped. Deletions accepted as part of the substitution ============================================== codex_shim/vision_router.py, tests/test_vision_router.py, VISION_ROUTING.md, VISION_ROUTING_CN.md, IMPLEMENTATION_SUMMARY.md, IMPLEMENTATION_SUMMARY_CN.md. The Auto Router covers the image-routing use case via supports_images candidate metadata; strip_images_from_history is intentionally not ported because Auto Router decides per task and does not switch models mid-conversation. Verification ============ `pytest tests/ --ignore=tests/test_hostguard.py` → 120 passed, 1 failed. The one failure (test_join_url_handles_versioned_bases) reproduces on plain upstream/main and is unrelated to this merge; flagged for a separate fix.
Anthropic route headers now send only x-api-key (plus anthropic-version) and no longer also attach Authorization: Bearer <apiKey>. Some Anthropic-compatible gateways reject requests that carry both headers. Providers that genuinely require a bearer token can still supply one via extraHeaders. Co-authored-by: OnlyTerp <121772140+OnlyTerp@users.noreply.github.com>
3 participants
Summary
Some Anthropic-compatible providers expect authentication via
x-api-keyand reject requests when an additionalAuthorization: Bearer ...header is present.This updates Anthropic route headers to send only
x-api-keyby default. Custom headers can still be supplied throughextra_headers.Testing
/Users/chrisd/codex-shim/.venv/bin/python -m pytest tests/test_server.py::test_chat_routes_to_anthropic