Method _handleRequest

src/proxy/server/http.js:187–254

(req, res)

  }

  async _handleRequest(req, res) {
    const authHeader = req.headers['authorization'] || '';
    const provided = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : '';
    const provBuf = Buffer.from(provided, 'utf8');
    // Primary token plus any grace tokens from settings.json::proxy.previous_tokens.
    // The grace list is the recovery path for the rare case where settings.json was
    // wiped externally (logout, manual rm) while long-lived CC sessions still hold
    // the pre-wipe token in their fork-time env. Operator writes the lost token into
    // previous_tokens; once those sessions close, the operator can clear the array.
    // Reading directly from settings.json (instead of an env shim) keeps the
    // single source of truth on disk — no python bridge in the daemon hook.
    // Defense in depth: even though start() filters non-strings before persisting,
    // settings.json can be hand-edited between requests, so re-validate every read.
    // A non-string slipping into Buffer.from below would throw ERR_INVALID_ARG_TYPE
    // and unhandled-reject through the auth path.
    const previous = readSettings().proxy?.previous_tokens;
    const extras = Array.isArray(previous)
      ? previous
        .map((t) => (typeof t === 'string' ? t.trim() : ''))
        .filter((t) => isValidReusableProxyToken(t))
      : [];
    const candidates = [this.token, ...extras]
      .filter((t) => isValidReusableProxyToken(t))
      .map((t) => t.trim());
    let valid = false;
    for (const cand of candidates) {
      const expBuf = Buffer.from(cand, 'utf8');
      if (provBuf.length === expBuf.length && crypto.timingSafeEqual(provBuf, expBuf)) {
        valid = true;
        break;
      }
    }
    if (!valid) {
      return sendJson(res, 401, { error: 'Unauthorized' });
    }

    const url = new URL(req.url, `http://127.0.0.1:${this.actualPort}`);
    const routeKey = `${req.method} ${url.pathname}`;

    const paramMatch = this._matchRoute(req.method, url.pathname);

    if (!paramMatch) {
      return sendJson(res, 404, { error: 'Not found', path: url.pathname });
    }

    const { handler, params } = paramMatch;

    try {
      const body = (req.method === 'POST' || req.method === 'PUT') ? await parseBody(req) : {};
      const query = Object.fromEntries(url.searchParams);
      const headers = req.headers;
      const result = await handler({ body, query, params, headers });
      if (result && result.stream) {
        await this._streamResponse(res, result);
      } else {
        sendJson(res, result.status || 200, result.body || result, result.headers);
      }
    } catch (err) {