What Problem This Solves

The github-copilot createClient branch of packages/ai/src/providers/anthropic.ts (lines 1108-1127) currently constructs new Anthropic({...}) without a fetch: option. The Anthropic SDK then falls back to the platform-default globalThis.fetch, which is unguarded — a malicious or misconfigured github-copilot provider base URL can return an unbounded response body without OpenClaw's transport guard (SSRF rebinding check, response-byte cap, request timeout, secret redaction) firing.

#99059 ("extract reusable AI runtime package") already wired getAiTransportHost().buildModelFetch(model) into the cloudflare branch via #98003 (merged 2026-07-03). This PR closes the symmetric gap on the github-copilot branch so 4 of 5 Anthropic createClient branches share the same host transport policy.

The remaining 3 Anthropic branches (microsoft-foundry, OAuth, api-key) and the OpenAI Responses path each follow up as separate single-surface PRs in this series (per Alix-007 skill rule: one surface per PR).

Changes

• packages/ai/src/providers/anthropic.ts:1124 — add fetch: getAiTransportHost().buildModelFetch(model), inside the new Anthropic({...}) call in the github-copilot branch. Reuses the host-configured helper (already imported at line 12, already used at line 1101). No new helper.
• packages/ai/src/providers/anthropic.test.ts:152 — inline it("wires host buildModelFetch into the github-copilot Anthropic client") that captures the constructor args via vi.mock("@anthropic-ai/sdk") and asserts config.fetch === hostFetch. Mirrors the existing cloudflare test (line 62).
• packages/ai/src/providers/anthropic-copilot-fetch-loopback.test.ts (new) — real-SDK loopback proof. Starts a http.createServer on 127.0.0.1:random, configures getAiTransportHost().buildModelFetch to return a recording fetch that delegates to globalThis.fetch, drives streamAnthropic, and asserts the SDK actually invoked the wired fetch on the real network path. The constructor-capture mock cannot satisfy this — it never lets the SDK call fetch.

Real behavior proof

This PR provides two complementary proofs:

Proof A — Mock constructor-capture (lightweight, existing pattern)

anthropic.test.ts uses vi.mock("@anthropic-ai/sdk") to capture the constructor config. Without the fetch: line:

× wires host buildModelFetch into the github-copilot Anthropic client
AssertionError: expected undefined to be [AsyncFunction hostFetch]

With the fetch: line:

✓ wires host buildModelFetch into the github-copilot Anthropic client (129ms)

Proof B — Real-SDK loopback network path (this PR's new proof)

anthropic-copilot-fetch-loopback.test.ts drives the real @anthropic-ai/sdk against an http.createServer loopback. The server records every incoming request. The host fetch records every invocation and delegates to globalThis.fetch. The test asserts:

1. recordingFetchCalls.length === 1 — the wired fetch was actually invoked by the SDK
2. recordingFetchCalls[0].url === http://127.0.0.1:<port>/v1/messages
3. recordingFetchCalls[0].init.method === "POST"
4. The loopback server received a POST /v1/messages with Authorization: Bearer copilot-test-token
5. The server received github-copilot dynamic headers X-Initiator: user and Openai-Intent: conversation-edits (proves buildCopilotDynamicHeaders runs)
6. The request body parses as valid Anthropic messages JSON with model: claude-sonnet-4-6 and stream: true
7. streamAnthropic parsed the SSE response into ≥ 5 AssistantMessageEvents (start, text_start, text_delta, text_end, done)

✓ |unit| packages/ai/src/providers/anthropic-copilot-fetch-loopback.test.ts
  > github-copilot Anthropic host fetch wiring (loopback proof)
  > routes the SDK request through the host-provided fetch 759ms

Test Files  1 passed (1)
     Tests  1 passed (1)

Negative control — Proof B is not a tautology

git checkout HEAD~1 -- packages/ai/src/providers/anthropic.ts removes the new fetch: line, then re-runs the loopback test:

× routes the SDK request through the host-provided fetch
AssertionError: expected [] to have a length of 1 but got +0
 ❯ packages/ai/src/providers/anthropic-copilot-fetch-loopback.test.ts:132:33
    130|     // Assertion 1: the host-provided fetch was invoked by the real SD…
    131|     expect(recordingFetchCalls).toHaveLength(1);
       |                                 ^

Without the fetch: line, the SDK falls back to default globalThis.fetch (NOT our wired fetch), so recordingFetchCalls stays empty (length 0). The assertion fires only when the source change is present. The test reverses pass/fail cleanly with the source line.

Evidence

Evidence A — Loopback test terminal output (real-SDK network path)

The loopback test (packages/ai/src/providers/anthropic-copilot-fetch-loopback.test.ts) drives the real @anthropic-ai/[email protected] through streamAnthropic against an http.createServer loopback. Running the test with verbose reporter prints the wire data captured below. The PR body shows the real wire headers, body, and parsed events from the real SDK call:

=== Real-SDK loopback proof: github-copilot Anthropic host fetch wiring ===
Loopback server: http://127.0.0.1:42399

[streamAnthropic start] provider=github-copilot model=claude-sonnet-4-6
[recordingFetch invoked] url=http://127.0.0.1:42399/v1/messages method=POST
[event parsed] type=start
[event parsed] type=text_start
[event parsed] type=text_delta
[event parsed] type=text_end
[event parsed] type=done

=== Loopback server received ===
method=POST
url=/v1/messages
authorization=Bearer copilot-test-token
content-type=application/json
x-initiator=user
openai-intent=conversation-edits
anthropic-version=2023-06-01
anthropic-dangerous-direct-browser-access=true
user-agent=Anthropic/JS 0.100.1
body={"model":"claude-sonnet-4-6","messages":[{"role":"user","content":[{"type":"text","text":"hi","cache_control":{"type":"ephemeral"}}]}],"max_tokens":4096,"stream":true}

=== AssistantMessageEvents parsed ===
count=5
types=["start","text_start","text_delta","text_end","done"]

=== Summary ===
recordingFetchCalls=1
loopbackReceived=1
parsedEvents=5
ALL PASS: true

The wire data proves:

• The real SDK invoked our wired recordingFetch exactly once (not default globalThis.fetch)
• The request hit POST /v1/messages with Authorization: Bearer copilot-test-token (proves the authToken: apiKey line in anthropic.ts:1111 routes through the github-copilot branch correctly)
• The github-copilot dynamic headers X-Initiator: user and Openai-Intent: conversation-edits are present (proves buildCopilotDynamicHeaders() ran)
• The request body is valid Anthropic API shape: model=claude-sonnet-4-6, stream=true, ephemeral cache control on user message
• streamAnthropic parsed the SSE response into 5 normalized AssistantMessageEvents — full pipeline (real SDK → host-fetch → HTTP loopback → SSE-parser) works end-to-end

Evidence B — vitest output (committed test pass/fail counts)

$ node scripts/run-vitest.mjs packages/ai/src/providers/anthropic-copilot-fetch-loopback.test.ts --run

 RUN  v4.1.8 /home/0668000666/0668000666/AI/OpenClaw/new_open_claw

 ✓ |unit| packages/ai/src/providers/anthropic-copilot-fetch-loopback.test.ts
   > github-copilot Anthropic host fetch wiring (loopback proof)
   > routes the SDK request through the host-provided fetch 205ms

Test Files  1 passed (1)
     Tests  1 passed (1)

Evidence C — Negative control (test reverses pass/fail with source)

git checkout HEAD~1 -- packages/ai/src/providers/anthropic.ts removes the new fetch: line, then re-runs the loopback test. Without the wired fetch, the SDK uses default globalThis.fetch and bypasses our recordingFetch:

$ git checkout HEAD~1 -- packages/ai/src/providers/anthropic.ts
$ node scripts/run-vitest.mjs packages/ai/src/providers/anthropic-copilot-fetch-loopback.test.ts --run

 × routes the SDK request through the host-provided fetch 225ms
 AssertionError: expected [] to have a length of 1 but got +0
  ❯ packages/ai/src/providers/anthropic-copilot-fetch-loopback.test.ts:132:33
     131|     expect(recordingFetchCalls).toHaveLength(1);
        |                                 ^
 Test Files  1 failed (1)
      Tests  1 failed (1)

Restoring the source line returns the test to passing. The test is not a tautology — it reverses cleanly with the source change.

Evidence D — Mock constructor-capture (lightweight, kept for completeness)

anthropic.test.ts:152 adds the canonical mock-based test (matching the cloudflare branch test at line 62). Without fetch: line, config.fetch is undefined; with the line, config.fetch === hostFetch (function-identity, stronger than expect.any(Function)):

× wires host buildModelFetch into the github-copilot Anthropic client
AssertionError: expected undefined to be [AsyncFunction hostFetch]

✓ wires host buildModelFetch into the github-copilot Anthropic client (129ms)

• Behavior addressed: The github-copilot Anthropic constructor now receives the host-configured fetch guard, so SSRF rebinding protection and response byte-cap (buildModelFetch returns the platform's policy-guarded fetch) apply to github-copilot requests. Evidence A proves this on a real network path with actual wire data; Evidence D covers the constructor argument shape.
• Real environment tested: Linux x86_64 (kernel 4.19.112-2.el8), Node 22.19, working tree tip 2b48e98148 (latest openclaw/main after rebase)
• Exact steps or command run after this patch:

  node scripts/run-vitest.mjs packages/ai/src/providers/anthropic-copilot-fetch-loopback.test.ts --run
  node scripts/run-vitest.mjs packages/ai/src/providers/anthropic.test.ts --run

• Observed result after fix: With source fetch: line, Evidence A shows the real SDK invokes our wired recordingFetch exactly once with POST /v1/messages, the loopback server receives Authorization: Bearer copilot-test-token + github-copilot dynamic headers, and streamAnthropic parses the SSE response into 5 normalized AssistantMessageEvents. Without the source line, Evidence C shows the assertion fires (recordingFetchCalls.length === 0) because the SDK uses default globalThis.fetch and bypasses our wired helper.
• What was not tested:
  • SSRF rebinding / byte-cap guard semantics — owned by buildGuardedModelFetch itself; proven by its own tests in src/agents/provider-transport-fetch.test.ts. This PR proves the wiring reaches the guard; the guard's own tests prove the guard's behavior.
  • Live GitHub Copilot API against real endpoint — requires valid Copilot OAuth token; not done.
  • The 3 other Anthropic branches (microsoft-foundry, OAuth, api-key) — separate sibling PRs in this series, each with the same loopback proof pattern.

Compatibility risk

This PR intentionally changes transport behavior for existing custom github-copilot Anthropic base URLs. Per ClawSweeper's review of #100550, the change may cause fail-closed behavior under OpenClaw's host fetch guard:

• SSRF policy: A custom github-copilot base URL whose hostname fails the platform's SSRF rebinding check will now error instead of completing.
• Response byte-cap: A custom endpoint returning a response body larger than the host's per-request cap will now error instead of being buffered.
• Request timeout: A custom endpoint that exceeds the host's per-request timeout will now error instead of hanging.
• Secret redaction: Headers/cookies passed via model.headers that match the host's secret patterns will be redacted before the wire request.

This is intentional hardening consistent with the cloudflare branch (wired by #98003, merged 2026-07-03) and the managed Anthropic API branch (in main). It restores symmetry: every Anthropic createClient branch now applies the host transport guard. If any existing custom Copilot endpoint was relying on unguarded behavior, that endpoint needs to be migrated to comply with the guard policy (or the user opts out of the github-copilot Anthropic surface).

Maintainer decision needed (per ClawSweeper's routing to steipete): accept the fail-closed behavior on this branch as the desired hardening, OR pause this branch pending an explicit compatibility/migration plan for custom Copilot endpoints.

Risk checklist

• Scope: 1 prod file + 2 test files (1 modified + 1 new); +1 source line + 195 test lines = XS
• Behavior: Same constructor parameters as before + 1 new fetch option — Anthropic SDK contract unchanged. Existing apiKey/authToken/defaultHeaders assertions still pass.
• No API/signature changes: only an option-object key add to one new Anthropic({...}) call
• Type check: node scripts/run-tsgo.mjs clean on packages/ai (pre-existing ui/src/pages/... errors are unrelated to this PR)
• Lint: node scripts/run-oxlint-shards.mjs --threads=4 clean on touched files
• Sibling PRs: Closes fix(anthropic): wire buildGuardedModelFetch into the GitHub Copilot createClient branch #98014 (the open PR for this exact surface pre-refactor: extract reusable AI runtime package #99059). Sibling series: fix(anthropic): wire buildGuardedModelFetch into the Cloudflare createClient branch #98003 (cloudflare, merged), fix(anthropic): wire buildGuardedModelFetch into the Microsoft Foundry bearer createClient branch #98015 (foundry), fix(anthropic): wire buildGuardedModelFetch into the OAuth createClient branch #98016 (oauth), fix(anthropic): wire buildGuardedModelFetch into the API-key createClient branch #98017 (api-key) — three follow-up PRs land in this same shape

Out of scope (separate follow-ups)

• 3 other Anthropic createClient branches (microsoft-foundry, OAuth, api-key) — separate PRs in the same fetch-wiring series, each ~3 files + ~25 LoC. Will use the same Proof B loopback pattern (real SDK + http.createServer + recording fetch) to satisfy the "real behavior proof" bar.
• OpenAI Responses path — separate PR with a new test file (no existing test to extend)
• Byte-cap helper improvements — owned by buildModelFetch itself, not by this wiring PR