Repository navigation
proxy: an allow decision can observe the response body - #799
Open
thomaslwang wants to merge 1 commit into
Open
thomaslwang wants to merge 1 commit into
thomaslwang wants to merge 1 commit into
Conversation
onResponse reports a response's status and headers, and a request's body is already readable through filterRequest. The response body had no such hook, so a consumer could not see what came back: for an agent's model traffic, that is where the tool calls are. onResponseChunk gets a copy of each chunk as the upstream sent it, and onResponseEnd is called once and says whether the whole body arrived. Both are observers, like onResponse: they cannot change or hold the response, and their failures are logged and ignored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
filterRequestcan read a request's body andonResponsereports a response's status and headers, but nothing exposes the response body. A consumer watching an agent's model traffic therefore cannot see the tool calls, which only appear in the reply. A client that resends its conversation shows them in its next request, but Claude Code 2.1 was measured sending only the newtool_result.This adds two observers to an allow decision:
onResponseChunk(chunk)gets a copy of each body chunk as the upstream sent it. A compressed body stays compressed.onResponseEnd(complete)is called once.completeis false when the upstream or client went away part-way, or when the proxy replaced an unrelayable response with its 502.Scope. They observe only, like
onResponse: they cannot change or hold the response, and a throw or rejection is logged and ignored. They cover the plain HTTP, parent proxy, MITM socket and TLS-terminated paths. With neither set, no listener is attached. The proxy buffers nothing for them, so what a consumer keeps is its own to bound.Not included. Holding or rewriting a response before the client sees it. That is a different security surface and I'd rather discuss it separately if there is interest.
Testing.
test/sandbox/request-rewriting.test.ts, on the plain and TLS-terminated paths where both apply.mainwithout this change. I compared the counts, not the names of the failures.tsc, eslint and prettier are clean.tlsTerminate: the reply body showed thetool_usethat the next request did not contain.The parent proxy and MITM socket paths have the same one-line change but no dedicated new test.
🤖 Generated with Claude Code