fix(anthropic): wire buildGuardedModelFetch into the Cloudflare createClient branch (#98003)

wangmiao0668000666 · web-flow · commit f84bcdb4d79c · 2026-07-03T13:17:28.000+03:00
* fix(anthropic): guard Cloudflare Anthropic fetches

Wire the Cloudflare AI Gateway Anthropic SDK client through buildGuardedModelFetch so this path gets the same SSRF and transport policy as sibling providers.

Keep the behavior proof focused on the regression: a Cloudflare Anthropic request pointed at a link-local address must fail before the SDK reaches global fetch.

* fix(anthropic): add loopback proof test to cloudflare fetch wiring

* test(anthropic-cloudflare): trim proof to SSRF-block only, remove synthetic loopback server
diff --git a/src/llm/providers/anthropic-cloudflare.fetch-proof.test.ts b/src/llm/providers/anthropic-cloudflare.fetch-proof.test.ts
@@ -0,0 +1,61 @@
+// Anthropic Cloudflare AI Gateway constructor guard-specific proof: the SSRF
+// guard blocks a private-IP request before the SDK's default global fetch is
+// ever reached. This proves `buildGuardedModelFetch` is actively wired into
+// the Cloudflare branch, not just present in constructor options.
+//
+// Unlike anthropic.test.ts (which mocks the Anthropic SDK to verify
+// constructor options), this test stubs `globalThis.fetch` to COUNT calls.
+// Behavior only `buildGuardedModelFetch` can produce.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { Context, Model } from "../types.js";
+
+const CLOUDFLARE_ANTHROPIC_MODEL = {
+  id: "claude-sonnet-4-6",
+  name: "Claude Sonnet 4.6",
+  api: "anthropic-messages",
+  provider: "cloudflare-ai-gateway",
+  baseUrl: "https://gateway.ai.cloudflare.com/v1/account/gateway/anthropic/v1/messages",
+  reasoning: true,
+  input: ["text"],
+  cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+  contextWindow: 200_000,
+  maxTokens: 4096,
+} satisfies Model<"anthropic-messages">;
+
+const context = {
+  messages: [{ role: "user", content: "hi", timestamp: 1 }],
+} satisfies Context;
+
+describe("Anthropic Cloudflare guard-specific SSRF blocking proof", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("blocks a private-IP request before globalThis.fetch is called (guard-specific behavior)", async () => {
+    let globalFetchCalled = 0;
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => {
+        globalFetchCalled++;
+        return new Response(null, { status: 500 });
+      }),
+    );
+
+    // Override the model baseUrl to a private link-local IP that the guard blocks.
+    const blockedModel = {
+      ...CLOUDFLARE_ANTHROPIC_MODEL,
+      baseUrl: "http://169.254.169.254/v1",
+    } satisfies Model<"anthropic-messages">;
+
+    const { streamAnthropic } = await import("./anthropic.js");
+    const stream = streamAnthropic(blockedModel, context, { apiKey: "sk-ant-test" });
+    const result = await stream.result();
+
+    expect(result.stopReason).toBe("error");
+    expect(result.errorMessage).toBeTruthy();
+
+    // Guard-specific: SSRF blocked the private-IP request before
+    // globalThis.fetch was ever called.
+    expect(globalFetchCalled).toBe(0);
+  });
+});
diff --git a/src/llm/providers/anthropic.test.ts b/src/llm/providers/anthropic.test.ts
@@ -75,12 +75,14 @@ describe("Anthropic provider", () => {
       apiKey?: string | null;
       authToken?: string | null;
       defaultHeaders?: Record<string, string | null>;
+      fetch?: unknown;
     };
 
     expect(config.apiKey).toBe("sk-ant-provider");
     expect(config.authToken).toBeNull();
     expect(config.defaultHeaders?.["x-api-key"]).toBeUndefined();
     expect(config.defaultHeaders?.["cf-aig-authorization"]).toBe("Bearer gateway-token");
+    expect(typeof config.fetch).toBe("function");
   });
 
   it("uses bearer auth for Microsoft Foundry Anthropic requests", async () => {
diff --git a/src/llm/providers/anthropic.ts b/src/llm/providers/anthropic.ts
@@ -15,6 +15,7 @@ import {
   type AnthropicProjectedToolChoice,
   type AnthropicToolProjection,
 } from "../../agents/anthropic-tool-projection.js";
+import { buildGuardedModelFetch } from "../../agents/provider-transport-fetch.js";
 import {
   splitSystemPromptCacheBoundary,
   stripSystemPromptCacheBoundary,
@@ -947,6 +948,7 @@ function createClient(
         model.headers,
         optionsHeaders,
       ),
+      fetch: buildGuardedModelFetch(model),
     });
 
     return { client, isOAuthToken: false };
