internal/adapter/translator/anthropic/request.go (1)

39-52: Extract duplicated session ID derivation logic.

This session ID derivation logic (lines 41-47) is identical to the code in response.go (lines 72-78). See the comment on response.go for the suggested refactor to extract this into a shared helper method.

internal/adapter/inspector/simple_test.go (1)

14-140: Add test coverage for security and concurrency scenarios.

While the basic functionality is well-tested, consider adding tests for:

1. Path traversal protection: Test that session IDs like ../../../malicious are sanitised
2. Concurrent writes: Test that multiple goroutines writing to the same session file don't corrupt data or cause race conditions
3. Invalid session IDs: Test session IDs with special characters, empty strings, very long strings

Example test structure:

t.Run("PathTraversalPrevention", func(t *testing.T) {
	sessionID := "../../etc/passwd"
	err := inspector.LogRequest(sessionID, "model", []byte(`{}`))
	// Verify file is created in safe location, not traversed path
})

t.Run("ConcurrentWrites", func(t *testing.T) {
	sessionID := "concurrent-test"
	var wg sync.WaitGroup
	for i := 0; i < 10; i++ {
		wg.Add(1)
		go func(i int) {
			defer wg.Done()
			inspector.LogRequest(sessionID, "model", []byte(fmt.Sprintf(`{"id":%d}`, i)))
		}(i)
	}
	wg.Wait()
	// Verify all 10 entries exist and are valid JSON
})

internal/config/types.go (1)

182-187: Consider adding validation for InspectorConfig.

The InspectorConfig lacks validation. Consider adding a Validate() method to ensure:

• OutputDir is not empty when Enabled is true
• OutputDir doesn't contain path traversal sequences
• SessionHeader is a valid HTTP header name when provided

// Validate validates the inspector configuration
func (c *InspectorConfig) Validate() error {
	if !c.Enabled {
		return nil
	}
	
	if c.OutputDir == "" {
		return fmt.Errorf("output_dir must be specified when inspector is enabled")
	}
	
	// Check for path traversal attempts
	if strings.Contains(c.OutputDir, "..") {
		return fmt.Errorf("output_dir must not contain '..' sequences")
	}
	
	return nil
}

Then call it from AnthropicTranslatorConfig.Validate():

func (c *AnthropicTranslatorConfig) Validate() error {
	// existing validation...
	
	if err := c.Inspector.Validate(); err != nil {
		return fmt.Errorf("inspector config invalid: %w", err)
	}
	
	return nil
}

internal/adapter/inspector/simple.go (2)

86-94: Tighten file permissions for sensitive data.

The inspector logs may contain sensitive user data (as noted in config.yaml warnings). Consider using more restrictive permissions:

• Line 86: Directory permissions 0755 (world-readable) → 0700 (owner-only)
• Line 94: File permissions 0644 (world-readable) → 0600 (owner-only)

-	if err := os.MkdirAll(dirPath, 0755); err != nil {
+	if err := os.MkdirAll(dirPath, 0700); err != nil {

-	f, err := os.OpenFile(filePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
+	f, err := os.OpenFile(filePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)

---

28-28: Consider per-session mutexes for better concurrency.

The single global mutex (line 28) serialises all file writes, creating a bottleneck when multiple sessions are active concurrently. Consider using a sync.Map of per-session mutexes for better throughput.

This is optional since the PR is described as a quick debug port, but for production use:

type Simple struct {
	logger        logger.StyledLogger
	outputDir     string
	sessionHeader string
	sessionMutexes sync.Map // map[string]*sync.Mutex
	enabled       bool
}

func (s *Simple) getSessionMutex(sessionID string) *sync.Mutex {
	mu, _ := s.sessionMutexes.LoadOrStore(sessionID, &sync.Mutex{})
	return mu.(*sync.Mutex)
}

func (s *Simple) writeEntry(sessionID string, entry Entry) error {
	mu := s.getSessionMutex(sessionID)
	mu.Lock()
	defer mu.Unlock()
	// ... rest of implementation
}

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

internal/adapter/translator/anthropic/response.go (1)

70-84: Session ID derivation logic is duplicated.

The session ID derivation logic (lines 72-78) is duplicated in both response.go and request.go (lines 41-47). This has been previously identified in review comments.

Consider extracting this to a helper method on the Translator as suggested in the previous review:

// getSessionID extracts session ID from headers with fallback chain
func (t *Translator) getSessionID(r *http.Request) string {
	sessionID := r.Header.Get(t.inspector.GetSessionHeader())
	if sessionID == "" {
		sessionID = r.Header.Get("X-Request-ID")
		if sessionID == "" {
			sessionID = defaultSessionID
		}
	}
	return sessionID
}

Then use it in both files:

-	sessionID := original.Header.Get(t.inspector.GetSessionHeader())
-	if sessionID == "" {
-		sessionID = original.Header.Get("X-Request-ID")
-		if sessionID == "" {
-			sessionID = defaultSessionID
-		}
-	}
+	sessionID := t.getSessionID(original)

internal/adapter/translator/anthropic/streaming.go (1)

75-80: Consider increasing the scanner token limit for large tool arguments.

1 MiB per SSE line may still be tight for complex tool arguments. Suggest 8–16 MiB or switching to bufio.Reader with manual line splitting. This reduces risk of truncated chunks.

internal/adapter/inspector/simple_test.go (1)

103-123: Minor: avoid potential midnight rollover flake.

Tests derive “today” via time.Now() after writes. Extremely rare, but a date change at midnight could misalign directories. Optionally capture the date once before logging or inject a clock into the inspector for tests.

internal/adapter/inspector/simple.go (2)

94-101: Use filepath.Rel for robust containment check (avoid HasPrefix pitfalls).

HasPrefix on cleaned absolute paths can yield false positives for sibling directories (e.g. /var/log/abc vs /var/log/abcc). Use filepath.Rel to ensure the test path is inside the output directory.

-  // try and ensure the resolved path is within the output directory
-  // uses Clean to normalise paths and prevent ../ bypasses
-  if !strings.HasPrefix(filepath.Clean(absTestPath), filepath.Clean(absOutputDir)) {
-    return "", fmt.Errorf("session ID would escape output directory")
-  }
+  // Ensure absTestPath resides within absOutputDir
+  rel, err := filepath.Rel(absOutputDir, absTestPath)
+  if err != nil || strings.HasPrefix(rel, "..") || strings.HasPrefix(filepath.ToSlash(rel), "../") {
+    return "", fmt.Errorf("session ID would escape output directory")
+  }

---

168-173: Typo in comment (“owtner”).

s/owtner/owner/

-  // Use 0700 permissions - owtner only access (not world-readable)
+  // Use 0700 permissions - owner only access (not world-readable)

internal/config/types.go (1)

209-236: Confirm intent: deny-list blocks all of /var/, /usr/, etc.

validateOutputPath currently rejects any path under common system trees (including /var/log/...). That’s quite restrictive and may surprise operators who expect to point logs to /var/log/olla-inspector.

• If the goal is “don’t overwrite system dirs”, consider allowing subdirectories under those roots (e.g. /var/log/olla-inspector) while still rejecting the root directories themselves.
• Alternative: require a relative path (default ./inspector-logs) unless an explicit allow-list is configured.

Happy to propose a tuned rule set if you confirm desired behaviour.

Also applies to: 246-267

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

internal/adapter/translator/anthropic/translator.go (2)

47-54: Inspector initialisation is straightforward; consider lazy/no-op when disabled.

Current approach is fine. If you want to shave overhead in prod, you could construct a nil/no‑op inspector when cfg.Inspector.Enabled is false.

---

81-93: Header constant duplication.

You already import internal/core/constants elsewhere. Consider reusing a shared header constant (if one exists) instead of redefining "X-Request-ID" locally.

internal/adapter/translator/anthropic/request.go (2)

298-315: System prompt join semantics.

Joining multiple text blocks with no separator can smash words together. Consider joining with a single space (or preserving original separators) to avoid accidental concatenation.

- return strings.Join(textParts, "")
+ return strings.Join(textParts, " ")

---

39-46: Add redaction config to InspectorConfig for safer development logging.

Raw request bodies are logged directly without filtering in LogRequest(). Consider extending InspectorConfig with optional fields (e.g., Redact bool, UnsafeFullBody bool) to truncate/mask sensitive content by default, keeping full bodies behind an explicit flag. This prevents accidental exposure of tool arguments or message content if inspector is enabled outside development.

internal/adapter/translator/anthropic/token_count.go (6)

78-87: Remove duplicate text handling; delegate to the single counting source.

Use countContentBlockChars for all typed blocks to keep logic in one place and avoid drift.

-    if block.Type == contentTypeText {
-      totalChars += len(block.Text)
-    }
-    // for other block types, convert to typed block and count
-    if block.Type != "" && block.Type != contentTypeText {
-      totalChars += countContentBlockChars(&block)
-    }
+    if block.Type != "" {
+      totalChars += countContentBlockChars(&block)
+    }

---

130-139: Support string items within []interface{} for system blocks.

Robustly accept arrays that mix strings and blocks.

-  for _, block := range systemBlocks {
-    if normalised, nok := normaliseContentBlock(block); nok {
+  for _, block := range systemBlocks {
+    if s, isStr := block.(string); isStr {
+      if s != "" {
+        if err := fn(ContentBlock{Type: contentTypeText, Text: s}); err != nil {
+          return err
+        }
+      }
+      continue
+    }
+    if normalised, nok := normaliseContentBlock(block); nok {
       if err := fn(*normalised); err != nil {
         return err
       }
     }
   }

---

162-167: *Add []ContentBlock support for message content (parity with system/tool_result).

Covers pointer-shaped message content arrays.

   case []ContentBlock:
     // typed block arrays
     for i := range content {
       totalChars += countContentBlockChars(&content[i])
     }
+  case *[]ContentBlock:
+    if content != nil {
+      for i := range *content {
+        totalChars += countContentBlockChars(&(*content)[i])
+      }
+    }

---

172-213: normaliseContentBlock: accept plain strings as text blocks.

Improves resilience when untyped arrays contain strings.

 func normaliseContentBlock(block interface{}) (*ContentBlock, bool) {
-  // already a typed ContentBlock pointer, return as-is
+  // plain string -> text block
+  if s, ok := block.(string); ok {
+    return &ContentBlock{Type: contentTypeText, Text: s}, true
+  }
+  // already a typed ContentBlock pointer, return as-is
   if typedBlock, ok := block.(*ContentBlock); ok {
     return typedBlock, true
   }

Happy to add unit tests covering: string, []interface{} with mixed types, []ContentBlock, and pointer variants.

---

230-249: Count runes, not bytes, for text and tool_use name.

len(...) overcounts non‑ASCII text; utf8.RuneCountInString improves estimation with multilingual input.

 case contentTypeText:
-  // text blocks contribute their text length
-  return len(block.Text)
+  // text blocks contribute their rune length
+  return utf8.RuneCountInString(block.Text)

 case contentTypeToolUse:
-  // tool use blocks contribute name length plus serialised input
-  return len(block.Name) + countToolInput(block.Input)
+  // tool use blocks contribute name rune length plus serialised input
+  return utf8.RuneCountInString(block.Name) + countToolInput(block.Input)

Add import:

 import (
   "bytes"
   "context"
   "encoding/json"
   "fmt"
   "io"
   "net/http"
+  "unicode/utf8"

---

255-296: countToolResultContent: handle single map content and use rune counts for strings.

Covers map-shaped content and improves non‑ASCII accuracy.

 if contentStr, ok := content.(string); ok {
-  return len(contentStr)
+  return utf8.RuneCountInString(contentStr)
 }
 
+// single untyped block map
+if blockMap, ok := content.(map[string]interface{}); ok {
+  if normalised, ok := normaliseContentBlock(blockMap); ok {
+    return countContentBlockChars(normalised)
+  }
+}

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro