Resolves conflicts: take HEAD (security audit) for mcp.rs imports,
register_server_blocking error handling, and maybe_execute_tools loop.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Proxy batch handlers now use BatchEngine for job lifecycle, file storage,
and webhook delivery instead of direct SQLite calls. Old batch/db.rs
stripped to Anthropic-specific mapping only. Cancel endpoint at
POST /v1/batches/{id}/cancel. BatchEngine initialized in main.rs startup
with second SQLite connection. Cancel integration test added.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
CSRF tokens are now one-time use. Tests updated to:
- Pre-insert TEST_CSRF_TOKEN in test_admin_router() for unit tests
- Call reinsert_csrf() before each additional mutation in multi-step tests
- Add fetch_csrf() helper for real-server tests
- update create_key_via_admin() to fetch a fresh token per call
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Replace batch/mod.rs types with re-exports from anyllm_batch_engine
- Strip batch/db.rs to Anthropic->OpenAI ID mapping only (batch_file/batch_job owned by engine)
- Rewrite batch/routes.rs to use BatchEngine for upload, create, get, list, cancel
- Remove batch_file/batch_job table creation from admin/db.rs init_db
- Add batch_engine parameter to app_multi_with_shared (5th arg, Option<Arc<BatchEngine>>)
- Initialize BatchEngine in main.rs with its own SQLite connection (admin-enabled path)
- Update batch_api.rs tests to use make_test_batch_engine() helper
- Fix anthropic_batch.rs to call init_anthropic_batch_map_table instead of removed init_batch_tables
- Add cancel_queued_batch integration test
Emits tracing::warn! when execute_bash is configured with policy: allow
so operators see an explicit reminder that this permits arbitrary OS
command execution. The dangerous-builtin-tools compile-time feature flag
remains the primary gate; this is an additional runtime visibility measure.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GET /admin/csrf-token now stores the generated token in
SharedState::issued_csrf_tokens (DashMap). validate_csrf middleware
verifies the X-CSRF-Token header was server-issued and removes it on
first use, preventing replay of previously issued tokens across multiple
mutating requests. validate_csrf switched to from_fn_with_state to
receive SharedState. Adds test: post_with_unissued_csrf_returns_403.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces reqwest::Client::new() in McpServerManager::new() and
discover_tools() with build_http_client(ssrf_protection: true), which
attaches SsrfSafeDnsResolver. This prevents DNS rebinding: a domain that
passes the registration-time check but later resolves to a private/metadata
IP (e.g. 169.254.169.254) is blocked at connection time by the resolver.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Applies is_safe_model_name to all three AddModelRequest fields before use,
preventing log injection via newlines or control characters in audit log
detail entries. Consistent with existing validation in put_config.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
MCP tool names use mcp_{server}_{tool}; underscores in server names make
parse_mcp_tool_name ambiguous. is_valid_mcp_server_name rejects names
containing underscores (allows alphanumerics + hyphens only).
register_server_blocking now returns Result<(), String> so callers handle
invalid names explicitly. Callers in main.rs and admin routes updated.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds allowed_dirs config field to BuiltinToolConfig. ReadFileTool now
rejects reads outside the configured base directories after canonicalize(),
blocking both path traversal and symlink attacks. Logs a warning when
allowed_dirs is empty. Threads config through register_all so constructors
receive per-tool settings.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add anyllm_batch_engine dependency to proxy Cargo.toml
- Add batch_engine field to AppState (Option<Arc<BatchEngine<...>>>)
- Add POST /v1/batches/{batch_id}/cancel route and handler
- cancel_batch handler uses BatchEngine when available, falls back to not_implemented
McpServerManager now holds a shared reqwest::Client (built once in new()).
call_tool uses self.client instead of creating a new client per call.
discover_tools_impl extracted as a free fn; both the instance method
(discover_tools_with_client) and the static fallback delegate to it.
SSRF protection added at both registration points:
- admin add_mcp_server endpoint: validate_base_url() before calling discover
- main.rs startup: skip and log any MCP server URL that fails SSRF check
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
partition_tool_calls now returns three buckets (auto_execute, pass_through,
denied). Denied tools generate ToolResult entries with is_error:true and a
"denied by policy" message, which are fed back to the LLM in a follow-up
turn so it can see the rejection. Updated all callers (maybe_execute_tools,
streaming handler in chat_completions.rs) and added unit + integration tests.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
ToolEngineState and McpServerManager were hardcoded to None. Now:
- SimpleParsed carries a ToolStartupConfig with the three tool sections
- LoadResult exposes that config to main.rs
- main.rs constructs ToolEngineState (registry, policy, loop config) when
any tool section is present; MCP servers are discovered async at startup
with a warning on failure (no panic)
- tool_engine and mcp_manager on SharedState are populated from the same
Arc so both proxy handlers and admin API share the same instance
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Accumulates tool call fragments during the chat_completions streaming
loop, then after the initial stream completes, checks for auto-executable
tools via the ToolEngine. If found, executes tools in parallel, builds a
follow-up request with tool results, and streams the follow-up response
through the same SSE channel. Defers [DONE] until after any tool
execution follow-up completes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When tool_engine is configured, the non-streaming /v1/messages handler
now checks for tool_use blocks in the response, executes registered
tools, and makes a follow-up backend call with the results.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When tool_engine is configured, the non-streaming /v1/chat/completions
handler now checks for tool_use blocks in the response, executes registered
tools, and makes a follow-up backend call with the results.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds extract_tool_calls, tool_results_to_user_message, and
response_to_assistant_message to execution.rs for use by non-streaming
handlers. Includes two tests for extract_tool_calls.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add ToolEngineState struct (registry, policy, loop_config, mcp_manager)
and tool_engine field to AppState. Update app_multi_with_shared signature
to accept the new parameter; all callers pass None until config-driven
wiring is implemented in a future task.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Implements the Tool trait on McpToolAdapter, delegating execute() to
McpServerManager::call_tool(). Adds register_mcp_tools() to bulk-register
all discovered MCP tools into a ToolRegistry.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds SimpleConfig::build_tool_config() that converts builtin_tools and
mcp_servers entries into a ToolExecutionPolicy (with exact-match and
glob rules) and converts tool_execution into a LoopConfig with sensible
defaults. Two tests cover both paths.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds three new optional top-level fields to SimpleConfig for upcoming
tool execution support: ToolExecutionConfig (loop limits/timeouts),
BuiltinToolConfig (per-tool enable/policy/timeout), and McpServerConfig
(name/url/policy). Two unit tests verify both present and absent cases.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Implements ToolCall/ToolResult types, LoopConfig, partition_tool_calls(),
execute_tool_calls() (parallel via JoinSet with per-tool timeout), and
is_duplicate(). Adds list_names() to ToolRegistry. All 6 unit tests pass.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Merge adds expose_degradation_warnings alongside stream_timeout_secs in
AppState. Also fixes pre-existing borrow error in admin/routes.rs (until
moved into closure then used in json response).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Captures stream_timeout_secs from AppState before the tokio::spawn and
wraps the byte-stream loop in tokio::time::timeout, mirroring the same
guard already present in streaming.rs. A stalled backend on
/v1/chat/completions no longer holds the connection indefinitely.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Wrap all four inject_degradation_header calls in chat_completions.rs with
state.expose_degradation_warnings guard, matching the pattern already applied
in routes.rs. Update existing degradation test to use expose_degradation_warnings:
true; add suppressed-when-disabled test for the false case.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Wraps the read_sse_frames I/O loop in tokio::time::timeout so a stalled
backend that trickles bytes cannot hold a connection open indefinitely.
Defaults to 900s; set to 0 to disable.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Thread Config/MultiConfig::expose_degradation_warnings into AppState and
wrap all four inject_degradation_header calls in routes.rs behind the flag.
Header is now only emitted when the flag is true.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Anthropic and Bedrock (bytes::Bytes) and Gemini (String) ApiError variants
now return the upstream body instead of None, so callers get the real error
message rather than a generic internal error. Return type changed from
Option<(&str, u16)> to Option<(String, u16)>; two call sites updated with &.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add the field to MultiConfig and TomlConfig, propagate it through
wrap_config (legacy env path), from_toml_str (TOML path), and
MultiConfig::load (LiteLLM YAML path). PROXY_CONFIG presence
auto-enables warnings on all config paths, matching Config::from_env.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds `expose_degradation_warnings: bool` to `Config`. Defaults to false
(simple mode). Set ANYLLM_DEGRADATION_WARNINGS=true/1 to opt in, or it
enables automatically when PROXY_CONFIG is set (advanced/config-file mode).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add crc32fast dependency and enforce prelude + message CRC validation
in eventstream::decode_frame; corrupted frames now return Err instead
of forwarding garbage JSON. Update build_frame test helper to emit real
CRCs, add three new CRC-specific tests, and update the bedrock passthrough
streaming loop to log and skip frames that fail validation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
