反蒸馏与输出保护

// services/api/claude.ts:301-313
// Anti-distillation: send fake_tools opt-in for 1P CLI only
if (
  feature('ANTI_DISTILLATION_CC')
    ? process.env.CLAUDE_CODE_ENTRYPOINT === 'cli' &&
      shouldIncludeFirstPartyOnlyBetas() &&
      getFeatureValue_CACHED_MAY_BE_STALE(
        'tengu_anti_distill_fake_tool_injection',
        false,
      )
    : false
) {
  result.anti_distillation = ['fake_tools']
}

// utils/betas.ts:279-298 — POC: server-side connector-text summarization
// When enabled, the API buffers assistant text between tool calls,
// summarizes it, and returns the summary with a cryptographic signature
// so the original text can be restored on subsequent turns.

// 启用条件：内部用户 + CONNECTOR_TEXT feature flag + GrowthBook flag
if (process.env.USER_TYPE === 'ant'
    && feature('CONNECTOR_TEXT')
    && (getFeatureValue_CACHED_MAY_BE_STALE('tengu_slate_prism', false)
        || isEnvTruthy(process.env.USE_CONNECTOR_TEXT_SUMMARIZATION))) {
  result.betas.push('summarize-connector-text-2026-03-13')
}

// services/api/claude.ts:2055-2134 — 流式处理 connector_text 块
// 累积文本和签名，在 stripSignatureBlocks 中按需清理

// utils/betas.ts:266-277
if (getFeatureValue_CACHED_MAY_BE_STALE('tengu_thinking_redaction', true)) {
  result.betas.push('redact-thinking-2026-02-12')
}

// constants/betas.ts:20 — beta header 定义
// 'redact-thinking-2026-02-12' → API 返回 redacted_thinking 块

// CLI 端处理：跳过 thinking summarizer，直接渲染为 stub
// 模型的推理链路在 transcript 中完全不可见

// utils/streamlinedTransform.ts — 蒸馏抵抗输出格式
export function createStreamlinedTransformer(): (
  message: StdoutMessage,
) => StdoutMessage | null {
  let cumulativeCounts = createEmptyToolCounts()

  return function transformToStreamlined(message: StdoutMessage) {
    switch (message.type) {
      case 'assistant': {
        const text = extractTextContent(content, '\n').trim()
        accumulateToolUses(message, cumulativeCounts)

        if (text.length > 0) {
          // 文本消息：输出文本，重置计数
          cumulativeCounts = createEmptyToolCounts()
          return { type: 'streamlined_text', text, ... }
        }
        // 纯工具消息：输出累计摘要
        // 例："Searched 3 patterns, read 5 files, wrote 2 files"
        return { type: 'streamlined_tool_use_summary', tool_summary, ... }
      }
      case 'result': return message    // 结果消息透传
      default:    return null          // 其他全部丢弃
    }
  }
}

// constants/system.ts:49-94 — Attribution Header
const header = [
  `cc_version=${VERSION}.${fingerprint}`,    // 版本 + 3字符指纹
  `cc_entrypoint=${entrypoint}`,              // cli | sdk | unknown
  `cch=00000`,                                // ← 占位符
  `cc_workload=${tag}`,                       // QoS 路由
].join('&')

// 当 NATIVE_CLIENT_ATTESTATION feature flag 启用时：
// Bun native HTTP 栈 (bun-anthropic/src/http/Attestation.zig)
// 在发送前将 cch=00000 替换为密码学哈希
// 关键：同长度替换，不改变 Content-Length

// utils/fingerprint.ts
export const FINGERPRINT_SALT = '59cf53e54c78'  // 硬编码盐值

export function computeFingerprint(
  messageText: string,
  version: string,
): string {
  // 提取索引 [4, 7, 20] 处的字符，越界用 "0"
  const indices = [4, 7, 20]
  const chars = indices.map(i => messageText[i] || '0').join('')

  const fingerprintInput = `${FINGERPRINT_SALT}${chars}${version}`

  // SHA256 哈希，取前 3 个 hex 字符
  const hash = createHash('sha256')
    .update(fingerprintInput).digest('hex')
  return hash.slice(0, 3)
}

// IMPORTANT: Do not change this method without careful coordination
// with 1P and 3P (Bedrock, Vertex, Azure) APIs.

// services/api/logging.ts:65-135
// 检测方式 1：响应头前缀匹配
'x-litellm-'    → LiteLLM
'helicone-'     → Helicone
'x-portkey-'    → Portkey
'cf-aig-'       → Cloudflare AI Gateway
'x-kong-'       → Kong
'x-bt-'         → Braintrust

// 检测方式 2：URL host 后缀匹配
'.cloud.databricks.com' → Databricks

// 检测结果写入分析事件
logEvent('tengu_api_success', { gateway_type })
logEvent('tengu_api_failure', { gateway_type })

// utils/undercover.ts
export function isUndercover(): boolean {
  if (process.env.USER_TYPE === 'ant') {
    if (isEnvTruthy(process.env.CLAUDE_CODE_UNDERCOVER)) return true
    // 自动模式：除非确认在内部仓库白名单中，否则默认激活
    return getRepoClassCached() !== 'internal'
  }
  return false  // 外部用户永远不激活
}

// 系统提示注入（undercover 时）：
// "You are operating UNDERCOVER in a PUBLIC repository.
//  NEVER include: internal codenames, version numbers,
//  project names, 'Claude Code', Co-Authored-By, or any
//  hint of what model you are."