@@ -6975,6 +7206,378 @@ function loginAgreementRoutePath(
return `/legal/${id}`;
}
+type ClaudeOAuthSystemPromptPreset =
+ | "billing"
+ | "system"
+ | "expansion"
+ | "custom";
+
+interface ClaudeOAuthSystemPromptBlock {
+ id: string;
+ enabled: boolean;
+ expanded: boolean;
+ type: "text";
+ preset: ClaudeOAuthSystemPromptPreset;
+ text: string;
+ cacheControlEnabled: boolean;
+ cacheControlTTL: string;
+}
+
+interface ClaudeOAuthSystemPromptRawBlock {
+ enabled?: boolean;
+ type?: string;
+ text?: string;
+ cache_control?: unknown;
+}
+
+const defaultClaudeCodeSystemPrompt =
+ "You are Claude Code, Anthropic's official CLI for Claude.";
+
+const defaultClaudeCodeExpansionPrompt = `You are an interactive agent that helps users with software engineering tasks. Use the instructions below and the tools available to you to assist the user.
+
+IMPORTANT: Assist with authorized security testing, defensive security, CTF challenges, and educational contexts. Refuse requests for destructive techniques, DoS attacks, mass targeting, supply chain compromise, or detection evasion for malicious purposes. Dual-use security tools (C2 frameworks, credential testing, exploit development) require clear authorization context: pentesting engagements, CTF competitions, security research, or defensive use cases.
+IMPORTANT: You must NEVER generate or guess URLs for the user unless you are confident that the URLs are for helping the user with programming. You may use URLs provided by the user in their messages or local files.
+
+# Tone and style
+ - Only use emojis if the user explicitly requests it. Avoid using emojis in all communication unless asked.
+ - Your responses should be short and concise.
+ - When referencing specific functions or pieces of code include the pattern file_path:line_number to allow the user to easily navigate to the source code location.
+ - When referencing GitHub issues or pull requests, use the owner/repo#123 format (e.g. anthropics/claude-code#100) so they render as clickable links.
+ - Do not use a colon before tool calls. Your tool calls may not be shown directly in the output, so text like "Let me read the file:" followed by a read tool call should just be "Let me read the file." with a period.`;
+
+let claudeOAuthSystemPromptBlockID = 0;
+
+function nextClaudeOAuthSystemPromptBlockID(): string {
+ claudeOAuthSystemPromptBlockID += 1;
+ return `claude-oauth-system-prompt-block-${claudeOAuthSystemPromptBlockID}`;
+}
+
+function normalizeClaudeOAuthSystemPromptCacheTTL(value: unknown): string {
+ return typeof value === "string" && value.trim() ? value.trim() : "5m";
+}
+
+function detectClaudeOAuthSystemPromptPreset(
+ text: string,
+): ClaudeOAuthSystemPromptPreset {
+ const trimmed = text.trim();
+ if (trimmed === "{billing_header}") {
+ return "billing";
+ }
+ if (
+ trimmed === "{claude_code_system_prompt}" ||
+ trimmed === defaultClaudeCodeSystemPrompt
+ ) {
+ return "system";
+ }
+ if (
+ trimmed === "{claude_code_expansion_prompt}" ||
+ trimmed === defaultClaudeCodeExpansionPrompt
+ ) {
+ return "expansion";
+ }
+ return "custom";
+}
+
+function normalizeClaudeOAuthSystemPromptBlockText(
+ text: string,
+ expansionPrompt = "",
+): string {
+ const trimmed = text.trim();
+ if (trimmed === "{claude_code_system_prompt}") {
+ return defaultClaudeCodeSystemPrompt;
+ }
+ if (trimmed === "{claude_code_expansion_prompt}") {
+ return expansionPrompt.trim() || defaultClaudeCodeExpansionPrompt;
+ }
+ return text;
+}
+
+function createClaudeOAuthSystemPromptBlock(
+ overrides: Partial = {},
+): ClaudeOAuthSystemPromptBlock {
+ const text = overrides.text ?? "";
+ return {
+ id: nextClaudeOAuthSystemPromptBlockID(),
+ enabled: overrides.enabled ?? true,
+ expanded: overrides.expanded ?? true,
+ type: "text",
+ preset: overrides.preset ?? detectClaudeOAuthSystemPromptPreset(text),
+ text,
+ cacheControlEnabled: overrides.cacheControlEnabled ?? false,
+ cacheControlTTL: overrides.cacheControlTTL ?? "5m",
+ };
+}
+
+function createDefaultClaudeOAuthSystemPromptBlocks(
+ expansionPrompt = "",
+): ClaudeOAuthSystemPromptBlock[] {
+ const normalizedExpansionPrompt = expansionPrompt.trim();
+ const expansionText =
+ normalizedExpansionPrompt || defaultClaudeCodeExpansionPrompt;
+
+ return [
+ createClaudeOAuthSystemPromptBlock({
+ preset: "billing",
+ text: "{billing_header}",
+ }),
+ createClaudeOAuthSystemPromptBlock({
+ preset: "system",
+ text: defaultClaudeCodeSystemPrompt,
+ }),
+ createClaudeOAuthSystemPromptBlock({
+ preset:
+ expansionText === defaultClaudeCodeExpansionPrompt
+ ? "expansion"
+ : "custom",
+ text: expansionText,
+ cacheControlEnabled: true,
+ cacheControlTTL: "5m",
+ }),
+ ];
+}
+
+function parseClaudeOAuthSystemPromptCacheControl(cacheControl: unknown): {
+ enabled: boolean;
+ ttl: string;
+} {
+ if (cacheControl === true) {
+ return { enabled: true, ttl: "5m" };
+ }
+ if (
+ cacheControl &&
+ typeof cacheControl === "object" &&
+ !Array.isArray(cacheControl)
+ ) {
+ return {
+ enabled: true,
+ ttl: normalizeClaudeOAuthSystemPromptCacheTTL(
+ (cacheControl as Record).ttl,
+ ),
+ };
+ }
+ return { enabled: false, ttl: "5m" };
+}
+
+function parseClaudeOAuthSystemPromptBlocks(
+ raw: string,
+ expansionPrompt = "",
+): ClaudeOAuthSystemPromptBlock[] {
+ const trimmed = raw.trim();
+ if (!trimmed) {
+ return createDefaultClaudeOAuthSystemPromptBlocks(expansionPrompt);
+ }
+
+ try {
+ const parsed = JSON.parse(trimmed) as
+ | ClaudeOAuthSystemPromptRawBlock[]
+ | { blocks?: ClaudeOAuthSystemPromptRawBlock[] };
+ const rawBlocks = Array.isArray(parsed)
+ ? parsed
+ : Array.isArray(parsed.blocks)
+ ? parsed.blocks
+ : [];
+
+ if (rawBlocks.length === 0) {
+ return createDefaultClaudeOAuthSystemPromptBlocks(expansionPrompt);
+ }
+
+ return rawBlocks.map((block) => {
+ const cacheControl = parseClaudeOAuthSystemPromptCacheControl(
+ block.cache_control,
+ );
+ const text = normalizeClaudeOAuthSystemPromptBlockText(
+ typeof block.text === "string" ? block.text : "",
+ expansionPrompt,
+ );
+ return createClaudeOAuthSystemPromptBlock({
+ enabled: block.enabled !== false,
+ type: "text",
+ text,
+ preset: detectClaudeOAuthSystemPromptPreset(text),
+ cacheControlEnabled: cacheControl.enabled,
+ cacheControlTTL: cacheControl.ttl,
+ });
+ });
+ } catch (_error) {
+ return createDefaultClaudeOAuthSystemPromptBlocks(expansionPrompt);
+ }
+}
+
+function serializeClaudeOAuthSystemPromptBlocksToJSON(
+ blocks: ClaudeOAuthSystemPromptBlock[],
+): string {
+ const source =
+ blocks.length > 0
+ ? blocks
+ : [
+ createClaudeOAuthSystemPromptBlock({
+ enabled: false,
+ preset: "custom",
+ text: "",
+ }),
+ ];
+
+ const rawBlocks = source.map((block) => {
+ const raw: ClaudeOAuthSystemPromptRawBlock = {
+ enabled: block.enabled,
+ type: block.type || "text",
+ text: block.text,
+ };
+ if (block.cacheControlEnabled) {
+ raw.cache_control = {
+ type: "ephemeral",
+ ttl: normalizeClaudeOAuthSystemPromptCacheTTL(block.cacheControlTTL),
+ };
+ }
+ return raw;
+ });
+
+ return JSON.stringify(rawBlocks, null, 2);
+}
+
+const defaultClaudeOAuthSystemPromptBlocks =
+ serializeClaudeOAuthSystemPromptBlocksToJSON(
+ createDefaultClaudeOAuthSystemPromptBlocks(),
+ );
+
+const claudeOAuthSystemPromptBlocks = ref(
+ createDefaultClaudeOAuthSystemPromptBlocks(),
+);
+
+const claudeOAuthSystemPromptPresetOptions = computed(() => [
+ {
+ value: "billing",
+ label: t("admin.settings.gatewayForwarding.systemBlockPresetBilling"),
+ },
+ {
+ value: "system",
+ label: t("admin.settings.gatewayForwarding.systemBlockPresetIdentity"),
+ },
+ {
+ value: "expansion",
+ label: t("admin.settings.gatewayForwarding.systemBlockPresetExpansion"),
+ },
+ {
+ value: "custom",
+ label: t("admin.settings.gatewayForwarding.systemBlockPresetCustom"),
+ },
+]);
+
+const claudeOAuthSystemPromptBlockTypeOptions = computed(() => [
+ {
+ value: "text",
+ label: t("admin.settings.gatewayForwarding.systemBlockTypeText"),
+ },
+]);
+
+const claudeOAuthSystemPromptCacheTTLOptions = computed(() => [
+ { value: "5m", label: t("admin.settings.gatewayForwarding.cacheTTL5m") },
+ { value: "1h", label: t("admin.settings.gatewayForwarding.cacheTTL1h") },
+]);
+
+function getClaudeOAuthPresetLabel(
+ preset: ClaudeOAuthSystemPromptPreset,
+): string {
+ return (
+ claudeOAuthSystemPromptPresetOptions.value.find(
+ (option) => option.value === preset,
+ )?.label || t("admin.settings.gatewayForwarding.systemBlockPresetCustom")
+ );
+}
+
+function syncClaudeOAuthSystemPromptBlocksFormField(): void {
+ form.claude_oauth_system_prompt_blocks =
+ serializeClaudeOAuthSystemPromptBlocksToJSON(
+ claudeOAuthSystemPromptBlocks.value,
+ );
+}
+
+function addClaudeOAuthSystemPromptBlock(): void {
+ claudeOAuthSystemPromptBlocks.value.push(
+ createClaudeOAuthSystemPromptBlock({
+ expanded: true,
+ preset: "custom",
+ text: "",
+ }),
+ );
+ syncClaudeOAuthSystemPromptBlocksFormField();
+}
+
+function toggleClaudeOAuthSystemPromptBlock(index: number): void {
+ const block = claudeOAuthSystemPromptBlocks.value[index];
+ if (!block) {
+ return;
+ }
+ block.expanded = !block.expanded;
+}
+
+function removeClaudeOAuthSystemPromptBlock(index: number): void {
+ claudeOAuthSystemPromptBlocks.value.splice(index, 1);
+ syncClaudeOAuthSystemPromptBlocksFormField();
+}
+
+function moveClaudeOAuthSystemPromptBlock(
+ index: number,
+ direction: -1 | 1,
+): void {
+ const targetIndex = index + direction;
+ if (
+ targetIndex < 0 ||
+ targetIndex >= claudeOAuthSystemPromptBlocks.value.length
+ ) {
+ return;
+ }
+ const blocks = claudeOAuthSystemPromptBlocks.value;
+ const current = blocks[index];
+ blocks[index] = blocks[targetIndex];
+ blocks[targetIndex] = current;
+ syncClaudeOAuthSystemPromptBlocksFormField();
+}
+
+function applyClaudeOAuthSystemPromptPreset(
+ index: number,
+ value: string | number | boolean | null,
+): void {
+ const block = claudeOAuthSystemPromptBlocks.value[index];
+ if (!block) {
+ return;
+ }
+ const preset = String(value || "custom") as ClaudeOAuthSystemPromptPreset;
+ block.preset = preset;
+ block.type = "text";
+ if (preset === "billing") {
+ block.text = "{billing_header}";
+ block.cacheControlEnabled = false;
+ block.cacheControlTTL = "5m";
+ } else if (preset === "system") {
+ block.text = defaultClaudeCodeSystemPrompt;
+ block.cacheControlEnabled = false;
+ block.cacheControlTTL = "5m";
+ } else if (preset === "expansion") {
+ block.text =
+ form.claude_oauth_system_prompt.trim() ||
+ defaultClaudeCodeExpansionPrompt;
+ block.cacheControlEnabled = true;
+ block.cacheControlTTL = "5m";
+ }
+ syncClaudeOAuthSystemPromptBlocksFormField();
+}
+
+function markClaudeOAuthSystemPromptBlockCustom(
+ block: ClaudeOAuthSystemPromptBlock,
+): void {
+ block.preset = detectClaudeOAuthSystemPromptPreset(block.text);
+ syncClaudeOAuthSystemPromptBlocksFormField();
+}
+
+function resetClaudeOAuthSystemPromptBlocks(): void {
+ claudeOAuthSystemPromptBlocks.value = createDefaultClaudeOAuthSystemPromptBlocks(
+ form.claude_oauth_system_prompt,
+ );
+ syncClaudeOAuthSystemPromptBlocksFormField();
+}
+
+
interface DefaultSubscriptionGroupOption {
value: number;
label: string;
@@ -7200,6 +7803,9 @@ const form = reactive({
enable_fingerprint_unification: true,
enable_metadata_passthrough: false,
enable_cch_signing: false,
+ enable_claude_oauth_system_prompt_injection: true,
+ claude_oauth_system_prompt: "",
+ claude_oauth_system_prompt_blocks: defaultClaudeOAuthSystemPromptBlocks,
enable_anthropic_cache_ttl_1h_injection: false,
rewrite_message_cache_control: false,
antigravity_user_agent_version: "",
@@ -7823,6 +8429,15 @@ async function loadSettings() {
(form as Record)[key] = value;
}
}
+ if (!form.claude_oauth_system_prompt_blocks?.trim()) {
+ form.claude_oauth_system_prompt_blocks =
+ defaultClaudeOAuthSystemPromptBlocks;
+ }
+ claudeOAuthSystemPromptBlocks.value = parseClaudeOAuthSystemPromptBlocks(
+ form.claude_oauth_system_prompt_blocks,
+ form.claude_oauth_system_prompt,
+ );
+ syncClaudeOAuthSystemPromptBlocksFormField();
form.login_agreement_mode =
settings.login_agreement_mode === "checkbox" ? "checkbox" : "modal";
form.login_agreement_updated_at =
@@ -8152,6 +8767,12 @@ async function saveSettings() {
form.wechat_connect_mobile_enabled,
form.wechat_connect_mode,
);
+ const claudeOAuthSystemPromptBlocksJSON =
+ serializeClaudeOAuthSystemPromptBlocksToJSON(
+ claudeOAuthSystemPromptBlocks.value,
+ );
+ form.claude_oauth_system_prompt_blocks =
+ claudeOAuthSystemPromptBlocksJSON;
const payload: UpdateSettingsRequest = {
registration_enabled: form.registration_enabled,
@@ -8305,6 +8926,12 @@ async function saveSettings() {
enable_fingerprint_unification: form.enable_fingerprint_unification,
enable_metadata_passthrough: form.enable_metadata_passthrough,
enable_cch_signing: form.enable_cch_signing,
+ enable_claude_oauth_system_prompt_injection:
+ form.enable_claude_oauth_system_prompt_injection,
+ claude_oauth_system_prompt: form.claude_oauth_system_prompt?.trim()
+ ? form.claude_oauth_system_prompt
+ : "",
+ claude_oauth_system_prompt_blocks: claudeOAuthSystemPromptBlocksJSON,
enable_anthropic_cache_ttl_1h_injection:
form.enable_anthropic_cache_ttl_1h_injection,
rewrite_message_cache_control: form.rewrite_message_cache_control,
diff --git a/frontend/src/views/admin/__tests__/SettingsView.spec.ts b/frontend/src/views/admin/__tests__/SettingsView.spec.ts
index 69b4f5f291..4327eb1869 100644
--- a/frontend/src/views/admin/__tests__/SettingsView.spec.ts
+++ b/frontend/src/views/admin/__tests__/SettingsView.spec.ts
@@ -378,6 +378,9 @@ const baseSettingsResponse = {
enable_fingerprint_unification: true,
enable_metadata_passthrough: false,
enable_cch_signing: false,
+ enable_claude_oauth_system_prompt_injection: true,
+ claude_oauth_system_prompt: "",
+ claude_oauth_system_prompt_blocks: "",
enable_anthropic_cache_ttl_1h_injection: false,
rewrite_message_cache_control: false,
antigravity_user_agent_version: "",
@@ -642,6 +645,42 @@ describe("admin SettingsView payment visible method controls", () => {
);
});
+ it("submits Claude OAuth system prompt injection gateway settings", async () => {
+ const blocks = `[{"type":"text","text":"custom block","cache_control":true}]`;
+ getSettings.mockResolvedValueOnce({
+ ...baseSettingsResponse,
+ enable_claude_oauth_system_prompt_injection: false,
+ claude_oauth_system_prompt_blocks: blocks,
+ });
+
+ const wrapper = mountView();
+
+ await flushPromises();
+ await wrapper.find("form").trigger("submit.prevent");
+ await flushPromises();
+
+ expect(updateSettings).toHaveBeenCalledTimes(1);
+ expect(updateSettings).toHaveBeenCalledWith(
+ expect.objectContaining({
+ enable_claude_oauth_system_prompt_injection: false,
+ }),
+ );
+ const payload = updateSettings.mock.calls[0][0] as {
+ claude_oauth_system_prompt_blocks: string;
+ };
+ expect(JSON.parse(payload.claude_oauth_system_prompt_blocks)).toEqual([
+ {
+ enabled: true,
+ type: "text",
+ text: "custom block",
+ cache_control: {
+ type: "ephemeral",
+ ttl: "5m",
+ },
+ },
+ ]);
+ });
+
it("submits Antigravity user agent version gateway setting", async () => {
getSettings.mockResolvedValueOnce({
...baseSettingsResponse,