package executor import (	"bufio"	"bytes"	"context"	"fmt"	"io"	"net/http"	"strings" 	"github.com/router-for-me/CLIProxyAPI/v7/internal/runtime/executor/helps"	"github.com/router-for-me/CLIProxyAPI/v7/internal/thinking"	cliproxyauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth"	cliproxyexecutor "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/executor"	sdktranslator "github.com/router-for-me/CLIProxyAPI/v7/sdk/translator"	log "github.com/sirupsen/logrus"	"github.com/tidwall/gjson") func (e *ClaudeExecutor) ExecuteStream(ctx context.Context, auth *cliproxyauth.Auth, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (_ *cliproxyexecutor.StreamResult, err error) {	if opts.Alt == "responses/compact" {		return nil, statusErr{code: http.StatusNotImplemented, msg: "/responses/compact not supported"}	}	baseModel := thinking.ParseSuffix(req.Model).ModelName	upstreamModel := e.upstreamModel(baseModel) 	apiKey, baseURL := claudeCreds(auth)	if baseURL == "" {		baseURL = "https://api.anthropic.com"	} 	reporter := helps.NewExecutorUsageReporter(ctx, e, baseModel, auth)	defer reporter.TrackFailure(ctx, &err)	from := opts.SourceFormat	responseFormat := cliproxyexecutor.ResponseFormatOrSource(opts)	to := sdktranslator.FromString("claude")	originalPayloadSource := req.Payload	if len(opts.OriginalRequest) > 0 {		originalPayloadSource = opts.OriginalRequest	}	originalPayload := originalPayloadSource	originalTranslated := helps.TranslateRequestWithCodexMultiAgentV2(ctx, opts.Headers, e.cfg, from, to, baseModel, originalPayload, true)	body := helps.TranslateRequestWithCodexMultiAgentV2(ctx, opts.Headers, e.cfg, from, to, baseModel, req.Payload, true)	body = helps.SetStringIfDifferent(body, "model", upstreamModel) 	body, err = thinking.ApplyThinking(body, req.Model, from.String(), to.String(), e.Identifier())	if err != nil {		return nil, err	}	if rebuildMidSystemMessageEnabled(e.cfg, auth) {		body = rebuildMidSystemMessagesToTopLevel(body)	} 	// Apply cloaking (system prompt injection, fake user ID, sensitive word obfuscation)	// based on client type and configuration.	body, err = applyCloaking(ctx, e.cfg, auth, body, baseModel, apiKey)	if err != nil {		return nil, err	} 	requestedModel := helps.PayloadRequestedModel(opts, req.Model)	requestPath := helps.PayloadRequestPath(opts)	body = helps.ApplyPayloadConfigWithRequest(e.cfg, baseModel, to.String(), from.String(), "", body, originalTranslated, requestedModel, requestPath, opts.Headers)	body = ensureModelMaxTokens(body, baseModel) 	// Disable thinking if tool_choice forces tool use (Anthropic API constraint)	body = disableThinkingIfToolChoiceForced(body)	body = normalizeClaudeSamplingForUpstream(body)	// Claude OAuth (and this executor's redact-thinking beta) returns signature-only	// thinking blocks unless display is set to "summarized".	body = ensureClaudeThinkingDisplay(body) 	// Auto-inject cache_control if missing (optimization for ClawdBot/clients without caching support)	if countCacheControls(body) == 0 {		body = ensureCacheControl(body)	} 	// Enforce Anthropic's cache_control block limit (max 4 breakpoints per request).	body = enforceCacheControlLimit(body, 4) 	// Normalize TTL values to prevent ordering violations under prompt-caching-scope-2026-01-05.	body = normalizeCacheControlTTL(body) 	// Extract betas from body and convert to header	var extraBetas []string	extraBetas, body = extractAndRemoveBetas(body)	bodyForTranslation := body	bodyForUpstream := body	oauthToken := isClaudeOAuthToken(apiKey)	var oauthToolNamesReverseMap map[string]string	if oauthToken {		bodyForUpstream, oauthToolNamesReverseMap = prepareClaudeOAuthToolNamesForUpstream(bodyForUpstream, claudeToolPrefix, auth.ToolPrefixDisabled())	}	bodyForUpstream = sanitizeClaudeMessagesForClaudeUpstreamWithDebug(ctx, bodyForUpstream, baseModel)	// Enable cch signing by default for OAuth tokens (not just experimental flag).	if oauthToken || experimentalCCHSigningEnabled(e.cfg, auth) {		bodyForUpstream = signAnthropicMessagesBody(bodyForUpstream)	}	reporter.SetTranslatedReasoningEffort(bodyForUpstream, to.String()) 	url := fmt.Sprintf("%s/v1/messages?beta=true", baseURL)	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(bodyForUpstream))	if err != nil {		return nil, err	}	if errHeaders := applyClaudeHeaders(httpReq, auth, apiKey, true, extraBetas, e.cfg, opts.Headers); errHeaders != nil {		return nil, errHeaders	}	var authID, authLabel, authType, authValue string	if auth != nil {		authID = auth.ID		authLabel = auth.Label		authType, authValue = auth.AccountInfo()	}	helps.RecordAPIRequest(ctx, e.cfg, helps.UpstreamRequestLog{		URL:       url,		Method:    http.MethodPost,		Headers:   httpReq.Header.Clone(),		Body:      bodyForUpstream,		Provider:  e.upstreamRequestLogProvider(),		AuthID:    authID,		AuthLabel: authLabel,		AuthType:  authType,		AuthValue: authValue,	}) 	httpClient := helps.NewUtlsHTTPClient(ctx, e.cfg, auth, 0)	httpClient = reporter.TrackHTTPClient(httpClient)	httpResp, err := httpClient.Do(httpReq)	if err != nil {		helps.RecordAPIResponseError(ctx, e.cfg, err)		return nil, err	}	helps.RecordAPIResponseMetadata(ctx, e.cfg, httpResp.StatusCode, httpResp.Header.Clone())	if httpResp.StatusCode < 200 || httpResp.StatusCode >= 300 {		// Decompress error responses — pass the Content-Encoding value (may be empty)		// and let decodeResponseBody handle both header-declared and magic-byte-detected		// compression.  This keeps error-path behaviour consistent with the success path.		errBody, decErr := decodeResponseBody(httpResp.Body, httpResp.Header.Get("Content-Encoding"))		if decErr != nil {			helps.RecordAPIResponseError(ctx, e.cfg, decErr)			msg := fmt.Sprintf("failed to decode error response body: %v", decErr)			helps.LogWithRequestID(ctx).Warn(msg)			return nil, statusErr{code: httpResp.StatusCode, msg: msg}		}		b, readErr := io.ReadAll(errBody)		if readErr != nil {			helps.RecordAPIResponseError(ctx, e.cfg, readErr)			msg := fmt.Sprintf("failed to read error response body: %v", readErr)			helps.LogWithRequestID(ctx).Warn(msg)			b = []byte(msg)		}		helps.AppendAPIResponseChunk(ctx, e.cfg, b)		helps.LogWithRequestID(ctx).Debugf("request error, error status: %d, error message: %s", httpResp.StatusCode, helps.SummarizeErrorBody(httpResp.Header.Get("Content-Type"), b))		if errClose := errBody.Close(); errClose != nil {			log.Errorf("response body close error: %v", errClose)		}		err = statusErr{code: httpResp.StatusCode, msg: string(b)}		return nil, err	}	decodedBody, err := decodeResponseBody(httpResp.Body, httpResp.Header.Get("Content-Encoding"))	if err != nil {		helps.RecordAPIResponseError(ctx, e.cfg, err)		if errClose := httpResp.Body.Close(); errClose != nil {			log.Errorf("response body close error: %v", errClose)		}		return nil, err	}	out := make(chan cliproxyexecutor.StreamChunk)	go func() {		defer close(out)		defer func() {			if errClose := decodedBody.Close(); errClose != nil {				log.Errorf("response body close error: %v", errClose)			}		}() 		// If the response target is Claude, directly forward complete SSE events without translation.		if responseFormat == to {			scanner := bufio.NewScanner(decodedBody)			scanner.Buffer(nil, 52_428_800) // 50MB			var event bytes.Buffer			flushEvent := func() bool {				if event.Len() == 0 {					return true				}				cloned := bytes.Clone(event.Bytes())				event.Reset()				select {				case out <- cliproxyexecutor.StreamChunk{Payload: cloned}:					return true				case <-ctx.Done():					return false				}			}			for scanner.Scan() {				line := scanner.Bytes()				helps.AppendAPIResponseChunk(ctx, e.cfg, line)				if detail, ok := helps.ParseClaudeStreamUsage(line); ok {					reporter.Publish(ctx, detail)				}				line = restoreClaudeOAuthToolNamesFromStreamLine(line, claudeToolPrefix, auth.ToolPrefixDisabled(), oauthToolNamesReverseMap)				line = e.restoreResponseModel(line, req.Model)				event.Write(line)				event.WriteByte('\n')				if len(bytes.TrimSpace(line)) == 0 && !flushEvent() {					return				}			}			if !flushEvent() {				return			}			if errScan := scanner.Err(); errScan != nil {				helps.RecordAPIResponseError(ctx, e.cfg, errScan)				reporter.PublishFailure(ctx, errScan)				select {				case out <- cliproxyexecutor.StreamChunk{Err: errScan}:				case <-ctx.Done():				}			}			return		} 		// For other formats, use translation		scanner := bufio.NewScanner(decodedBody)		scanner.Buffer(nil, 52_428_800) // 50MB		var param any		for scanner.Scan() {			line := scanner.Bytes()			helps.AppendAPIResponseChunk(ctx, e.cfg, line)			if detail, ok := helps.ParseClaudeStreamUsage(line); ok {				reporter.Publish(ctx, detail)			}			line = restoreClaudeOAuthToolNamesFromStreamLine(line, claudeToolPrefix, auth.ToolPrefixDisabled(), oauthToolNamesReverseMap)			line = e.restoreResponseModel(line, req.Model)			chunks := sdktranslator.TranslateStream(				ctx,				to,				responseFormat,				req.Model,				opts.OriginalRequest,				bodyForTranslation,				bytes.Clone(line),				&param,			)			for i := range chunks {				select {				case out <- cliproxyexecutor.StreamChunk{Payload: chunks[i]}:				case <-ctx.Done():					return				}			}		}		if errScan := scanner.Err(); errScan != nil {			helps.RecordAPIResponseError(ctx, e.cfg, errScan)			reporter.PublishFailure(ctx, errScan)			select {			case out <- cliproxyexecutor.StreamChunk{Err: errScan}:			case <-ctx.Done():			}		}	}()	return &cliproxyexecutor.StreamResult{Headers: httpResp.Header.Clone(), Chunks: out}, nil} func validateClaudeStreamingResponse(data []byte) error {	scanner := bufio.NewScanner(bytes.NewReader(data))	scanner.Buffer(nil, 52_428_800) 	hasData := false	hasMessageStart := false	hasMessageDelta := false 	for scanner.Scan() {		line := bytes.TrimSpace(scanner.Bytes())		if len(line) == 0 || !bytes.HasPrefix(line, []byte("data:")) {			continue		}		payload := bytes.TrimSpace(line[len("data:"):])		if len(payload) == 0 || bytes.Equal(payload, []byte("[DONE]")) {			continue		}		hasData = true		if !gjson.ValidBytes(payload) {			return statusErr{code: http.StatusBadGateway, msg: "claude executor: upstream returned malformed stream data"}		} 		root := gjson.ParseBytes(payload)		switch root.Get("type").String() {		case "error":			message := strings.TrimSpace(root.Get("error.message").String())			if message == "" {				message = strings.TrimSpace(root.Get("error.type").String())			}			if message == "" {				message = "unknown upstream error"			}			return statusErr{code: http.StatusBadGateway, msg: "claude executor: upstream returned error event: " + message}		case "message_start":			message := root.Get("message")			if strings.TrimSpace(message.Get("id").String()) == "" || strings.TrimSpace(message.Get("model").String()) == "" {				return statusErr{code: http.StatusBadGateway, msg: "claude executor: upstream stream message_start is missing id or model"}			}			hasMessageStart = true		case "message_delta":			hasMessageDelta = true		}	}	if errScan := scanner.Err(); errScan != nil {		return errScan	}	if !hasData {		return statusErr{code: http.StatusBadGateway, msg: "claude executor: upstream returned empty stream response"}	}	if !hasMessageStart {		return statusErr{code: http.StatusBadGateway, msg: "claude executor: upstream stream response is missing message_start"}	}	if !hasMessageDelta {		return statusErr{code: http.StatusBadGateway, msg: "claude executor: upstream stream response ended before message completion"}	}	return nil}