feat(gateway): native Anthropic passthrough for redacted requests

Policy-bound (redacting) requests now forward the redacted Anthropic Messages
body straight to api.anthropic.com — keeping claude as the model — instead of
translating to the OpenAI/Lyzr upstream. The caller's own x-api-key /
anthropic-version headers are forwarded verbatim (proxy holds no token), and the
response is deanonymized (streaming text_delta included).

Fixes the 403 from routing claude agents through the Lyzr upstream: PII
redaction now works WITHOUT changing the model backend or depending on the Lyzr
token. The OpenAI/Lyzr translation path remains for non-policy requests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: patel-lyzr

packages/llm-proxy-openai/src/proxy.ts

@@ -44,6 +44,14 @@ export interface RedactionConfig {
    * un-redacted (availability over privacy); `false` fails the request closed.
    */
   readonly failOpen?: boolean;
+  /**
+   * Native Anthropic backend for the redacting path. When set (default
+   * `https://api.anthropic.com`), a policy-scoped request (`/rai/<id>`) is
+   * redacted and then forwarded **as Anthropic Messages** to this base —
+   * keeping the model's own backend (claude) instead of translating to the
+   * OpenAI/Lyzr upstream. The caller's `x-api-key` is forwarded verbatim.
+   */
+  readonly anthropicBase?: string;
 }
 
 export interface ProxyOptions {
@@ -187,6 +195,11 @@ async function handleRequest(req: IncomingMessage, res: ServerResponse, ctx: Han
     if (Object.keys(redactionMap).length) {
       ctx.log(`🔒 redacted ${Object.keys(redactionMap).length} PII span(s) via policy ${ctx.policyId}`);
     }
+    // Native Anthropic backend: forward the redacted Anthropic body straight to
+    // api.anthropic.com (keeping claude as the model), rather than translating
+    // to the OpenAI/Lyzr upstream. The caller's own x-api-key is forwarded.
+    await forwardAnthropic(req, res, ctx, body, redactionMap);
+    return;
   }
 
   const wantStream = Boolean(body.stream);
@@ -384,6 +397,121 @@ function blockedAnthropicResponse(model: string, reason?: string): AnthropicResp
   };
 }
 
+// ── Native Anthropic passthrough (redact → forward to api.anthropic.com) ────
+
+/**
+ * Forward an (already redacted) Anthropic Messages request straight to the
+ * Anthropic API — no OpenAI/Lyzr translation, so the model stays claude. The
+ * caller's own `x-api-key` / `anthropic-version` headers are forwarded verbatim
+ * (the proxy holds no Anthropic token of its own). The response is deanonymized
+ * so the agent sees the original PII values restored.
+ */
+async function forwardAnthropic(
+  req: IncomingMessage,
+  res: ServerResponse,
+  ctx: HandlerCtx,
+  body: AnthropicRequest,
+  redactionMap: Record<string, string>,
+): Promise<void> {
+  const base = (ctx.redaction?.anthropicBase ?? "https://api.anthropic.com").replace(/\/+$/, "");
+  const url = `${base}/v1/messages`;
+  const wantStream = Boolean(body.stream);
+
+  const headers: Record<string, string> = {
+    "content-type": "application/json",
+    "accept": wantStream ? "text/event-stream" : "application/json",
+  };
+  for (const h of ["x-api-key", "authorization", "anthropic-version", "anthropic-beta"]) {
+    const v = req.headers[h];
+    if (typeof v === "string") headers[h] = v;
+  }
+  if (!headers["anthropic-version"]) headers["anthropic-version"] = "2023-06-01";
+
+  ctx.log(`→ anthropic passthrough model=${body.model} stream=${wantStream} msgs=${body.messages.length}`);
+
+  let up: Response;
+  try {
+    up = await fetch(url, { method: "POST", headers, body: JSON.stringify(body) });
+  } catch (e) {
+    ctx.log("anthropic fetch failed:", (e as Error).message);
+    res.writeHead(502, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: { type: "api_error", message: `anthropic unreachable: ${(e as Error).message}` } }));
+    return;
+  }
+
+  if (!up.ok) {
+    const text = await up.text();
+    ctx.log(`anthropic ${up.status}:`, text.slice(0, 200));
+    res.writeHead(up.status, { "content-type": "application/json" });
+    res.end(text || JSON.stringify({ error: { type: "api_error", message: `anthropic ${up.status}` } }));
+    return;
+  }
+
+  if (wantStream) {
+    res.writeHead(200, {
+      "content-type": "text/event-stream",
+      "cache-control": "no-cache",
+      "connection": "keep-alive",
+    });
+    await pipeAnthropicPassthrough(up, res, redactionMap);
+    return;
+  }
+
+  const j = (await up.json()) as AnthropicResponse;
+  deanonymizeAnthropicResponse(j, redactionMap);
+  res.writeHead(200, { "content-type": "application/json" });
+  res.end(JSON.stringify(j));
+}
+
+/** Stream Anthropic SSE through unchanged, deanonymizing `text_delta` events. */
+async function pipeAnthropicPassthrough(
+  up: Response,
+  out: ServerResponse,
+  map: Record<string, string>,
+): Promise<void> {
+  const body = up.body;
+  if (!body) { out.end(); return; }
+  const hasMap = Object.keys(map).length > 0;
+  const reader = body.getReader();
+  const decoder = new TextDecoder("utf-8");
+  let buf = "";
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buf += decoder.decode(value, { stream: true });
+    let idx: number;
+    while ((idx = buf.indexOf("\n\n")) !== -1) {
+      const frame = buf.slice(0, idx);
+      buf = buf.slice(idx + 2);
+      out.write(transformAnthropicFrame(frame, map, hasMap) + "\n\n");
+    }
+  }
+  if (buf) out.write(buf);
+  out.end();
+}
+
+/** Rewrite the `text_delta` text of a content_block_delta frame, deanonymized. */
+function transformAnthropicFrame(frame: string, map: Record<string, string>, hasMap: boolean): string {
+  if (!hasMap || !frame.includes("text_delta")) return frame;
+  return frame
+    .split("\n")
+    .map((line) => {
+      if (!line.startsWith("data: ")) return line;
+      try {
+        const d = JSON.parse(line.slice(6)) as {
+          type?: string;
+          delta?: { type?: string; text?: string };
+        };
+        if (d?.type === "content_block_delta" && d.delta?.type === "text_delta" && typeof d.delta.text === "string") {
+          d.delta.text = applyMapping(d.delta.text, map);
+          return "data: " + JSON.stringify(d);
+        }
+      } catch { /* not JSON — pass through */ }
+      return line;
+    })
+    .join("\n");
+}
+
 // ── REQUEST: Anthropic /v1/messages → OpenAI chat completions ─────────────
 
 interface AnthropicRequest {