[ranxianglei]

(ai: vllm-qwen/qwen3.8-27b)

Closes #5211

What this fixes

Field report (#5211, bili 0.1.208 / DSH desktop): the host's LOCAL private request POST http://127.0.0.1:<port>/api/dsh-im/delivery/messages appeared in bili.log forwarded to https://api.anthropic.com/api/dsh-im/delivery/messages — the caller's private payload left the machine to a third-party API.

Root cause (server-side). When a client's base URL points at the proxy port itself (origin-form request), resolveUpstream returns undefined and forwardUpstreamUrl splices the bare path onto opts.upstream — the configured upstream, default api.anthropic.com. That splice had NO shape check: any path (model endpoints, discovery, or an unrelated local/private API) was relayed verbatim to it (the #1284 verbatim-relay branch makes the non-conversation forwarding explicit). The in-process client over-claim (isModelApiUrl matches any trailing /messages) is a real but separate defect class — on the dsh lane the attribution gate keeps such calls direct-sent or loopback-bound, so it did not produce the reported egress. The egress producer is the server-side catch-all splice: any process pointed at the proxy port could ship its payload to the default upstream.

Fix

handle() now refuses origin-form requests whose path is neither model traffic nor a declared destination locally with 404 (error.type = unknown_upstream_path; the message tells the caller how to reach model traffic) before anything is forwarded:

• Admitted shapes (isModelTrafficOriginFormPath, root-anchored): /v1/messages /messages /chat/completions /llm_raw_chat /responses /responses/compact (version segment optional), /models /v1/models discovery, Google :generateContent/:streamGenerateContent/:countTokens model-in-path shapes, Vertex anthropic publishers/anthropic/models/<id>:rawPredict|streamRawPredict.
• Escape hatches unchanged: /bili/<full-url> zero-config tunnels, absolute-form forward-proxy requests, MITM sockets, providers.* declarations for the destination (incl. per-destination passthrough), x-bili-passthrough marks (「BUG」native-intercept 进程级 globalThis.fetch 补丁按 URL 形状接管所有模型流量，无关调用者（如 MemOS）被卷入宿主压缩流程 #1117), x-bili-hop chain skips (fix: stitched-stream usage double-count after compress re-request (adapter-anthropic >0 guard) #300), global passthrough mode.
• Observability mirroring the dsh使用插件dsh-commandcode-provider反代go套餐的话，不进billion-context压缩 #1290 surface: per-path rate-limited log (warn×3 → info → silent; query stripped from the key), a refusedForeignPaths field on GET /__bili/stats, and a REFUSED FOREIGN PATHS section in the /acp status report.

No new config keys (the issue's suggested relayUnknownUpstream toggle is not implemented — the refusal is safe-default boundary behavior, not a preference knob; anyone who genuinely needs the old behavior for one endpoint declares it under providers.*). No client-side blanket loopback passthrough either — that would break compression for local model servers (Ollama/vLLM/LM Studio on loopback/LAN are supported destinations).

Behavior changes (old → new)

Surface	Old	New	Why
Origin-form request to a path that is neither model-shaped nor declared (e.g. /api/dsh-im/delivery/messages, /v1/files, /v1/embeddings, prefixed bases like /x/v1/messages)	Spliced onto the configured upstream and forwarded verbatim (default: api.anthropic.com) — payload leaves the machine	Local 404 unknown_upstream_path; payload never forwarded	Security boundary: a compression proxy must not act as an open relay to its configured upstream (#5211)
Origin-form model-shaped paths, /models discovery, all /bili/ · absolute-form · MITM forms, passthrough marks/hops/mode	forwarded	byte-identical	pinned by the new suite's controls
tests/issue-393-registry-window.test.ts unknown-path control	asserted an "unrecognized path" warn after forwarding	asserts the 404 refusal + "refused foreign path" log	pins the new boundary

Verification

• New regression suite tests/issue5211-foreign-path-refusal.test.ts (42 tests): the exact issue repro (delivery body never reaches the mock upstream), foreign GETs, stats/admin surface, model-traffic controls with hop markers (anthropic / openai / discovery / vertex), and every escape hatch.
• Targeted suites green locally: issue5211, issue-393, provider-protocol, dump-observability, forward-absolute-url, issue4501-pathstyle-config, fix-1117-passthrough, issue1284-misrouted-messages (83 tests in the batch); npm run typecheck clean. Full-suite verdict: remote CI on this head.

[github-actions]

📦 Built Package Artifact

Branch: 2026-10-31_refuse-foreign-origin-form-paths (75d728b)

Latest build — install this exact version

npm install -g billion-context@0.0.7431-pr.5258.e3680ab

This exact version is immutable and reproducible. The rolling pr tag tracks the newest test build across all PRs.

Recent builds (commit → version)

commit	version	build
75d728b	billion-context@0.0.7431-pr.5258.e3680ab	build
d758fdd	billion-context@0.0.7310-pr.5258.6a5a150	build
d758d0f	billion-context@0.0.7275-pr.5258.7fe1963	build
71714a1	billion-context@0.0.7271-pr.5258.7317c0b	build
904a2a9	billion-context@0.0.7260-pr.5258.e35ad9b	build
6570505	billion-context@0.0.7236-pr.5258.0a0afaa	build
5a3b674	billion-context@0.0.7198-pr.5258.f4f4a73	build

Download artifact

1. Download the artifact from the Actions run
2. Extract the tarball and install:

tar xzf billion-context-pr5258.tgz
npm install -g package

---

Install instructions are refreshed on each push.