feat: Linux AutoClaw 2.0.3 support, dynamic model catalogs, and request serialization

.gitignore

@@ -6,3 +6,4 @@ proxy_requests_anthropic.json
 proxy_requests_test.json
 proxy_requests*.jsonl
 proxy_requests*.lock
+.venv/

README.md

@@ -14,7 +14,7 @@
   <img src="https://github.com/eequaled/GLM_proxy/actions/workflows/ci.yml/badge.svg" alt="CI">
 </p>
 
-<p align="center"><sub>v2.6.0. One CLI, two API formats, zero dependencies.</sub></p>
+<p align="center"><sub>v3.0.0. One CLI, two API formats, zero dependencies.</sub></p>
 
 ---
 
@@ -33,13 +33,15 @@ glmproxy --anthropic --port 3001 --key mykey
 
 Then point any OpenAI-compatible tool at `http://127.0.0.1:18791/v1`, or any Anthropic-compatible tool at `http://127.0.0.1:18792`. Default key is `mewmew` (see [Integrations](#integrations) below for exact per-tool setup).
 
-**You need:** [AutoClaw](https://autoclaw.z.ai) installed, running, and logged in (Windows/macOS), plus Node.js 18+. The proxy reads auth straight from AutoClaw's local token file, so there's no manual token setup and no API keys to copy.
+**You need:** [AutoClaw](https://autoclaw.z.ai) installed, running, and logged in:
+- **Windows / macOS**: AutoClaw 1.x or 2.x desktop app running. Auth is automatically read from AutoClaw's local runtime state.
+- **Linux**: AutoClaw 2.0.3 AppImage running. The proxy automatically discovers and syncs account tokens from the system Secret Service / GNOME Keyring vault with zero manual setup. For Linux TLS compatibility matching AutoClaw's Electron fingerprint, ensure `curl_cffi` is installed (`pip install curl_cffi`). Node.js 18+ required on all platforms.
 
 ---
 
 ## Integrations
 
-### Claude Code CLI
+### Claude Code CLI & Anthropic API
 
 Add to `~/.claude/settings.json`:
 
@@ -52,8 +54,18 @@ Add to `~/.claude/settings.json`:
 }
 ```
 
+#### Supported Modes & Known Caveats:
+- **Claude Agent SDK & Direct API**: Fully supported. Direct `/v1/messages` calls, streaming SSE deltas, thinking blocks, and tool use execute cleanly without restrictions.
+- **Claude Code CLI (Print Mode)**: Works reliably for CLI tasks using the `-p` / non-interactive flag across Opus, Sonnet, and Haiku models:
+  ```bash
+  claude -p "Explain the codebase architecture"
+  ```
+- **Interactive Mode Notice**: Running interactive `claude` sessions injects Claude Code's internal auto-mode security classifier prompt (a ~285 KB / 71,000+ token evaluation prompt with multi-tier session hooks) which triggers an upstream `HTTP 406 Not Acceptable` filter from AutoClaw. For interactive agentic sessions, use the OpenAI-compatible endpoint (`http://localhost:18791/v1`) with Cursor, OpenCode, or Continue, or run Claude Code in print mode (`-p`).
+
 ### OpenCode
 
+Add to your OpenCode configuration (or select auto-discovered models from `/v1/models`):
+
 ```json
 {
   "provider": {
@@ -66,15 +78,15 @@ Add to `~/.claude/settings.json`:
       },
       "models": {
         "zai_auto": { "name": "AutoClaw Auto" },
+        "zai_auto-fast": { "name": "AutoClaw Auto-Fast" },
         "zaicoding_glm-5.3": { "name": "AutoClaw GLM-5.3" },
-        "zai_glm-5-turbo": { "name": "AutoClaw GLM-5 Turbo" },
-        "tdpsk_deepseek-v4-flash-202605": { "name": "AutoClaw Deepseek-V4-Flash" },
-        "tdpsk_deepseek-v4-pro-202606": { "name": "AutoClaw DeepSeek-V4-Pro" }
+        "zai_glm-5.3-flash": { "name": "AutoClaw GLM-5.3 Flash" }
       }
     }
   }
 }
 ```
+*(On Windows, `zai_glm-5-turbo`, `tdpsk_deepseek-v4-flash-202605`, and `tdpsk_deepseek-v4-pro-202606` are also available in the catalog).*
 
 ### Cursor / Continue / anything OpenAI-compatible
 
@@ -160,24 +172,50 @@ AutoClaw handles authentication automatically. The cloud is the only route: if i
 
 ## Current available models in autoclaw
 
+The proxy dynamically serves the correct model catalog for your platform and AutoClaw version.
+
+### Windows (AutoClaw 1.x / 2.x)
+
 | ID | Name | Context | Max Output | Notes |
 |----|------|---------|------------|-------|
 | `zai_auto` | Auto | 1M | 131K | Routes to AutoClaw's optimal model (GLM-5.3-Flash today) |
 | `zaicoding_glm-5.3` | GLM-5.3 | 1M | 131K | Latest GLM coding model |
 | `zai_glm-5-turbo` | GLM-5-Turbo | 200K | 131K | Zhipu AI GLM-5 Turbo |
-| `zai_glm-5.3-flash` | GLM-5.3-Flash ("OX-alpha") | 1M | 131K | Now a regular catalog model, served straight through the cloud path |
-| `tdpsk_deepseek-v4-flash-202605` | Deepseek-V4-Flash | 1M | 393K | Fast DeepSeek model |
-| `tdpsk_deepseek-v4-pro-202606` | DeepSeek-V4-Pro | 1M | 393K | Deep reasoning model |
+| `zai_glm-5.3-flash` | GLM-5.3-Flash ("OX-alpha") | 1M | 131K | Fast high-throughput GLM model |
+| `tdpsk_deepseek-v4-flash-202605` | Deepseek-V4-Flash | 1M | 393K | Fast DeepSeek model (Windows upstream catalog) |
+| `tdpsk_deepseek-v4-pro-202606` | DeepSeek-V4-Pro | 1M | 393K | Deep reasoning model (Windows upstream catalog) |
 
-> GLM 5.3 flash new in the proxy!!!!! ox alpha the goat
+### Linux (AutoClaw 2.0.3)
 
-The catalog is re-read from AutoClaw's `openclaw.runtime.json` on every `/v1/models` call, with a built-in fallback if that file isn't readable. Run `glmproxy --doctor` to inspect the current catalog after an AutoClaw update. Claude model names sent to the Anthropic proxy are mapped automatically:
+On Linux, AutoClaw 2.0.3 natively exposes **4 models** in its upstream runtime catalog (DeepSeek models and GLM-5-Turbo are not present in Linux 2.x upstream):
 
-| Claude model | Routes to |
-|---|---|
-| `claude-opus-*` | First available GLM-5.3 / GLM-5 model |
-| `claude-sonnet-*` | `zai_auto` (or next available GLM-5 model) |
-| `claude-haiku-*` | `zai_glm-5-turbo` (or DeepSeek / Auto fallback) |
+| ID | Name | Context | Max Output | Notes |
+|----|------|---------|------------|-------|
+| `zai_auto` | Auto | 1M | 131K | Routes to AutoClaw's default model |
+| `zai_auto-fast` | Auto-Fast | 1M | 131K | Lightweight fast auto-routing |
+| `zaicoding_glm-5.3` | GLM-5.3 | 1M | 131K | Latest GLM coding model |
+| `zai_glm-5.3-flash` | GLM-5.3-Flash | 1M | 131K | Fast high-throughput GLM model |
+
+> **Platform Model Differences**: AutoClaw 2.0.3 AppImage on Linux natively provisions the 4 core ZAI models above in its runtime catalog. DeepSeek models (`tdpsk_*`) and `zai_glm-5-turbo` are served exclusively on Windows AutoClaw installations. The proxy dynamically inspects your environment and serves the correct model set at runtime.
+
+The catalog is re-read dynamically from AutoClaw's runtime snapshot on every `/v1/models` call, degrading to the platform-appropriate fallback catalog if the snapshot is unreadable. Run `glmproxy --doctor` to inspect the current catalog after an AutoClaw update. Claude model names sent to the Anthropic proxy are mapped automatically:
+
+| Claude model | Routes to (Linux) | Routes to (Windows) |
+|---|---|---|
+| `claude-opus-*` | `zaicoding_glm-5.3` | `zaicoding_glm-5.3` |
+| `claude-sonnet-*` | `zaicoding_glm-5.3` / `zai_auto` | `zaicoding_glm-5.3` / `zai_auto` |
+| `claude-haiku-*` | `zai_glm-5.3-flash` | `zai_glm-5.3-flash` / `zai_glm-5-turbo` |
+
+---
+
+## Subagent & Concurrency Support (In-Flight Queue)
+
+Upstream AutoClaw strictly limits accounts to **1 active generation at a time**. In environments that spawn autonomous subagents, background tools, or parallel turns (e.g. Claude Code subagents, Cursor Agent parallel tool calls, OpenCode multi-tasking), simultaneous requests previously caused upstream `HTTP 406 (upstream_failure)` errors.
+
+GLM Proxy includes a built-in serialized FIFO in-flight queue (`InFlightQueue`):
+- Concurrent requests automatically wait in-process until the active stream finishes.
+- Once the stream completes, queued requests immediately dispatch to upstream.
+- Prevents 406 concurrency collisions while ensuring zero dropped requests or failed turns.
 
 ---
 
@@ -541,8 +579,9 @@ TRUSTED_PROXIES=127.0.0.1 glmproxy --host 0.0.0.0
 - Upstream 400 `"invalid request"` gets one retry after a 2s delay (a known upstream hiccup). Quota/plan errors are never retried
 - The cloud upstream requires AutoClaw's app system-prompt banner in every request. The proxy injects it automatically and never duplicates it. In practice it doesn't change much since your harness's own system prompt overrides it anyway
 - Max output is clamped to each model's real upstream cap (131K for every GLM model, 393K for DeepSeek). AutoClaw's runtime catalog overstates GLM-5.3's cap (307K), and asking the cloud for more than a model's real cap makes it **silently run a DeepSeek model instead and bill DeepSeek credits** — the proxy clamps so your `zai_glm-5.3` stays GLM-5.3
-- Images pass through natively: pasted/attached images (`image_url` data URLs, Anthropic `image` blocks) reach vision-capable models (e.g. `zai_glm-5.3-flash`) as real image parts — the model sees them directly, no OCR bridge. Text-only models reject them upstream and the request falls back to the desktop agent, mirroring AutoClaw's own gating
-- The token file is watched for changes, so AutoClaw can rotate auth mid-session without a restart
+- Images pass through natively: pasted/attached images (`image_url` data URLs, Anthropic `image` blocks) reach vision-capable models (e.g. `zai_glm-5.3-flash`) as real image parts — the model sees them directly, no OCR bridge.
+- The token file is watched for changes, so AutoClaw can rotate auth mid-session without a restart. On Linux, AutoClaw 2.0.3 vault tokens from the Secret Service / GNOME Keyring are automatically decrypted and synced with MD5 auth signatures. Master keys remain strictly in-memory and are never stored in plaintext on disk. Headless or custom environments can configure `AUTOCLAW_CONFIG_DIR` and `GLMP_KEYRING_PASSWORD`.
+- Upstream limits accounts to 1 concurrent generation: parallel requests from subagents or concurrent sessions are queued in-process in FIFO order, eliminating upstream 406 collisions. Client disconnects automatically abort in-flight upstream streams before releasing the queue slot.
 - AutoClaw's client identity (app version, platform, channel) loads dynamically from its runtime file, same as the model catalog, so an AutoClaw app update is picked up without editing or restarting the proxy
 - The fallback model catalog lives in `lib/fallback-models.json` (override with `FALLBACK_MODELS_PATH`). The built-in list is only a last resort when AutoClaw's runtime file is unreadable
 - A capacity throttle is retried in-process (two attempts, about 4 s then 6 s) so a transient "high demand" wall does not stop your harness. A ban or a quota wall is never retried

anthropic.js

@@ -33,6 +33,7 @@ import {
   getPacingGovernor, classifyGovernorError,
   startConfigHeartbeat, startShapeWatch,
 } from "./lib/core.js";
+import { globalInFlightQueue } from "./lib/queue.js";
 
 // Config (per-format log filenames come from `format`)
 const config = loadConfig({ format: "anthropic" });
@@ -132,22 +133,25 @@ function resolveModel(anthropicModel) {
 
 // Convert an Anthropic Messages request body to OpenAI chat/completions format.
 function anthropicToOpenAI(body, modelId) {
+  const sanitize = (s) => typeof s === "string" ? s.replace(/Claude Agent SDK/g, "Agent SDK") : s;
   const messages = [];
 
   // System prompt
   if (body.system) {
     const text = typeof body.system === "string"
       ? body.system
-      : body.system.filter((b) => b.type === "text").map((b) => b.text).join("\n");
-    if (text) messages.push({ role: "system", content: text });
+      : (Array.isArray(body.system)
+          ? body.system.map((b) => typeof b === "string" ? b : (b.type === "text" ? b.text : (b.text || ""))).filter(Boolean).join("\n")
+          : "");
+    if (text) messages.push({ role: "system", content: sanitize(text) });
   }
 
   // Convert messages
   for (const msg of body.messages || []) {
     const content = msg.content;
 
     if (typeof content === "string") {
-      messages.push({ role: msg.role, content });
+      messages.push({ role: msg.role, content: sanitize(content) });
       continue;
     }
 
@@ -174,7 +178,7 @@ function anthropicToOpenAI(body, modelId) {
     for (const block of content) {
       if (block.type === "tool_result")      toolResults.push(block);
       else if (block.type === "tool_use")    toolUses.push(block);
-      else if (block.type === "text")        textParts.push(block.text);
+      else if (block.type === "text")        textParts.push(sanitize(block.text));
       else if (block.type === "image")       { const p = toOpenAIImage(block); if (p) imageParts.push(p); }
       else if (block.type === "thinking")    { /* skip */ }
     }
@@ -545,6 +549,19 @@ async function handleMessages(req, res) {
 
   const lastMsgForLog = () => lastMessagePreview(openAIBody.messages);
 
+  let cloudEvidence = null;
+  let releaseLock = null;
+  let released = false;
+  const releaseOnce = () => {
+    if (!released) {
+      released = true;
+      if (typeof releaseLock === "function") {
+        releaseLock();
+        releaseLock = null;
+      }
+    }
+  };
+
   try {
     const cachedFailure = permanentFailures.get(modelId);
     if (cachedFailure) {
@@ -564,6 +581,9 @@ async function handleMessages(req, res) {
       return sendClassifiedErrorAnthropic(res, cls);
     }
 
+    // Upstream limits accounts to 1 concurrent active generation; serialize in-flight requests
+    releaseLock = await globalInFlightQueue.acquire();
+
     // Cloud call with one retry on the flaky 400 "invalid request" hiccup;
     // every >=400 body is buffered + logged (R1). Shared with openai.js.
     const { res: upstreamRes, errBody: upstreamErrBody } = await callUpstreamWithInvalidRequestRetry(
@@ -586,13 +606,14 @@ async function handleMessages(req, res) {
 
     // Failure path only — a 2xx falls through to the success renderer below.
     if (statusCode >= 400) {
+      releaseOnce();
       // Classify the verdict the client will see. The classified status is
       // what goes on the wire: a raw 403 meaning "free-tier capacity throttle"
       // (810002) becomes 429 upstream_busy, so a harness backs off instead of
       // retrying into a wall.
       const cls = classifyUpstreamError(statusCode, upstreamErrBody, modelId);
       if (cls.permanent) permanentFailures.mark(modelId, cls);
-      log.error(`Upstream error ${statusCode}:`, cls.message);
+      log.error(`Upstream error ${statusCode}:`, cls.message, upstreamErrBody ? `Body: ${upstreamErrBody.slice(0, 500)}` : "(empty body)");
       cloudEvidence = { status: statusCode, code: cls.code };
 
       record(cls.status, {
@@ -607,6 +628,13 @@ async function handleMessages(req, res) {
     // Success paths
     record(statusCode, { lastMessage: lastMsgForLog(), messageCount: openAIBody.messages?.length || 0 });
 
+    res.on("close", () => {
+      if (!res.writableFinished && upstreamRes && !upstreamRes.destroyed) {
+        try { upstreamRes.destroy(); } catch (_) {}
+      }
+      releaseOnce();
+    });
+
     if (stream) {
       res.writeHead(200, SSE_HEADERS);
 
@@ -643,9 +671,14 @@ async function handleMessages(req, res) {
         }
         for (const e of openAIChunkToAnthropicEvents("data: [DONE]", state)) res.write(e);
         res.end();
+        releaseOnce();
       });
 
-      upstreamRes.on("error", (err) => { log.error("Stream error:", err); res.end(); });
+      upstreamRes.on("error", (err) => {
+        log.error("Stream error:", err);
+        try { res.end(); } catch (_) {}
+        releaseOnce();
+      });
       return;
     }
 
@@ -659,9 +692,21 @@ async function handleMessages(req, res) {
       } catch (err) {
         if (!res.headersSent) sendErrorAnthropic(res, `Failed to parse upstream response: ${err.message}`, "api_error", 502, "upstream_parse_failed");
         else { try { res.end(); } catch (_) {} }
+      } finally {
+        releaseOnce();
+      }
+    });
+    upstreamRes.on("error", (err) => {
+      log.error("Non-stream upstream error:", err);
+      if (!res.headersSent) {
+        sendErrorAnthropic(res, `Upstream stream failed: ${err.message}`, "api_error", 502, "upstream_failed");
+      } else {
+        try { res.end(); } catch (_) {}
       }
+      releaseOnce();
     });
   } catch (err) {
+    releaseOnce();
     const cls = classifyTransportError(err);
     log.error(`messages model=${body.model} transport failure:`, cls.message);
     if (res.headersSent) { try { res.end(); } catch (_) {} return; }