refactor(management): reuse shared fingerprint RoundTripper for api-call

Route ChatGPT/Anthropic hosts through helps.NewFingerprintRoundTripper
and IsChatGPTUpstreamURL so management APICall tracks the same host
gate and ClientHello evolution as Codex/Claude, instead of a private
chrome-only copy that can drift over time.

Author: HuiCheng

internal/api/handlers/management/api_tools.go

@@ -25,10 +25,12 @@ const defaultAPICallTimeout = 60 * time.Second
 // for chatgpt.com so Go's default "Go-http-client" UA is not sent.
 const chromeAPICallUserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
 
-// newChromeAPICallTransport builds the Chrome-impersonating transport for
-// chatgpt.com. Tests replace this to avoid live TLS handshakes.
-var newChromeAPICallTransport = func(proxyURL string) http.RoundTripper {
-	return helps.NewChromeRoundTripper(proxyURL)
+// newAPICallFingerprintTransport builds the shared Anthropic/ChatGPT
+// fingerprint RoundTripper. Host routing and ClientHello live in helps so they
+// evolve with Codex/Claude instead of a private management copy. Tests replace
+// this to avoid live TLS handshakes.
+var newAPICallFingerprintTransport = func(proxyURL string, fallback http.RoundTripper) http.RoundTripper {
+	return helps.NewFingerprintRoundTripper(proxyURL, fallback)
 }
 
 const (
@@ -92,10 +94,11 @@ type apiCallResponse struct {
 //  3. Global config proxy-url
 //  4. Direct connect (environment proxies are not used)
 //
-// ChatGPT (https://chatgpt.com) uses the same Chrome TLS/HTTP2 fingerprint as
-// Codex. Callers may send ChatGPT web headers (User-Agent, oai-language,
-// x-openai-target-path / x-openai-target-route); missing ones are filled only
-// for that host. Other hosts keep the standard transport.
+// ChatGPT (https://chatgpt.com) and Anthropic HTTPS origins reuse the shared
+// helps fingerprint RoundTripper (same routing as Codex/Claude). Callers may
+// send ChatGPT web headers (User-Agent, oai-language, x-openai-target-path /
+// x-openai-target-route); missing ones are filled only for ChatGPT. Other hosts
+// keep the standard transport.
 //
 // Response JSON (returned with HTTP 200 when the APICall itself succeeds):
 //   - status_code: Upstream HTTP status code.
@@ -500,10 +503,9 @@ func (h *Handler) authByIndex(authIndex string) *coreauth.Auth {
 }
 
 func (h *Handler) apiCallClientTransport(auth *coreauth.Auth, requestProxyURL string) http.RoundTripper {
-	return &apiCallRoundTripper{
-		chrome:   newChromeAPICallTransport(h.apiCallProxyURL(auth, requestProxyURL)),
-		fallback: h.apiCallTransport(auth, requestProxyURL),
-	}
+	proxyURL := h.apiCallProxyURL(auth, requestProxyURL)
+	fallback := h.apiCallTransport(auth, requestProxyURL)
+	return newAPICallFingerprintTransport(proxyURL, fallback)
 }
 
 func (h *Handler) apiCallProxyURL(auth *coreauth.Auth, requestProxyURL string) string {
@@ -551,30 +553,8 @@ func (h *Handler) apiCallTransport(auth *coreauth.Auth, requestProxyURL string)
 	return directAPICallTransport()
 }
 
-type apiCallRoundTripper struct {
-	chrome   http.RoundTripper
-	fallback http.RoundTripper
-}
-
-func (t *apiCallRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
-	if t == nil {
-		return nil, fmt.Errorf("api-call transport is nil")
-	}
-	if usesChromeAPICallTLS(req.URL) && t.chrome != nil {
-		return t.chrome.RoundTrip(req)
-	}
-	if t.fallback == nil {
-		return nil, fmt.Errorf("api-call fallback transport is nil")
-	}
-	return t.fallback.RoundTrip(req)
-}
-
-func usesChromeAPICallTLS(u *url.URL) bool {
-	return u != nil && u.Scheme == "https" && strings.EqualFold(u.Hostname(), "chatgpt.com")
-}
-
 func applyChatGPTAPICallHeaderDefaults(req *http.Request) {
-	if req == nil || !usesChromeAPICallTLS(req.URL) {
+	if req == nil || !helps.IsChatGPTUpstreamURL(req.URL) {
 		return
 	}
 	setHeaderDefault := func(key, value string) {

internal/api/handlers/management/api_tools_test.go

@@ -6,12 +6,12 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
-	"net/url"
 	"strings"
 	"testing"
 
 	"github.com/gin-gonic/gin"
 	"github.com/router-for-me/CLIProxyAPI/v7/internal/config"
+	"github.com/router-for-me/CLIProxyAPI/v7/internal/runtime/executor/helps"
 	coreauth "github.com/router-for-me/CLIProxyAPI/v7/sdk/cliproxy/auth"
 	sdkconfig "github.com/router-for-me/CLIProxyAPI/v7/sdk/config"
 )
@@ -22,17 +22,25 @@ func (f apiCallRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, erro
 	return f(req)
 }
 
-func stubChromeAPICallTransport(t *testing.T, proxy *string, trip apiCallRoundTripFunc) {
+func stubAPICallFingerprintTransport(t *testing.T, proxy *string, trip apiCallRoundTripFunc) {
 	t.Helper()
-	original := newChromeAPICallTransport
+	original := newAPICallFingerprintTransport
 	t.Cleanup(func() {
-		newChromeAPICallTransport = original
+		newAPICallFingerprintTransport = original
 	})
-	newChromeAPICallTransport = func(proxyURL string) http.RoundTripper {
+	newAPICallFingerprintTransport = func(proxyURL string, fallback http.RoundTripper) http.RoundTripper {
 		if proxy != nil {
 			*proxy = proxyURL
 		}
-		return trip
+		return apiCallRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+			if helps.IsChatGPTUpstreamURL(req.URL) {
+				return trip(req)
+			}
+			if fallback == nil {
+				return nil, io.EOF
+			}
+			return fallback.RoundTrip(req)
+		})
 	}
 }
 
@@ -338,35 +346,6 @@ func TestAuthByIndexDistinguishesSharedAPIKeysAcrossProviders(t *testing.T) {
 	}
 }
 
-func TestUsesChromeAPICallTLS(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name string
-		raw  string
-		want bool
-	}{
-		{name: "chatgpt backend-api", raw: "https://chatgpt.com/backend-api/subscriptions", want: true},
-		{name: "chatgpt mixed case host", raw: "https://ChatGPT.com/backend-api/codex/responses", want: true},
-		{name: "chatgpt http", raw: "http://chatgpt.com/backend-api/subscriptions", want: false},
-		{name: "lookalike host", raw: "https://chatgpt.com.example/backend-api/subscriptions", want: false},
-		{name: "other https", raw: "https://api.example.com/v1/ping", want: false},
-	}
-	for _, tc := range cases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-			parsed, errParse := url.Parse(tc.raw)
-			if errParse != nil {
-				t.Fatalf("parse url: %v", errParse)
-			}
-			if got := usesChromeAPICallTLS(parsed); got != tc.want {
-				t.Fatalf("usesChromeAPICallTLS(%q) = %v, want %v", tc.raw, got, tc.want)
-			}
-		})
-	}
-}
-
 func TestApplyChatGPTAPICallHeaderDefaults(t *testing.T) {
 	t.Parallel()
 
@@ -445,7 +424,7 @@ func TestApplyChatGPTAPICallHeaderDefaults(t *testing.T) {
 func TestAPICallChatGPTUsesChromeTransportAndPassesHeaders(t *testing.T) {
 	var gotProxy string
 	var gotReq *http.Request
-	stubChromeAPICallTransport(t, &gotProxy, apiCallRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+	stubAPICallFingerprintTransport(t, &gotProxy, apiCallRoundTripFunc(func(req *http.Request) (*http.Response, error) {
 		gotReq = req.Clone(req.Context())
 		return &http.Response{
 			StatusCode: http.StatusOK,
@@ -483,7 +462,7 @@ func TestAPICallChatGPTUsesChromeTransportAndPassesHeaders(t *testing.T) {
 		t.Fatalf("upstream body = %q, want subscription JSON", response.Body)
 	}
 	if gotProxy != "http://request-proxy.example.com:8080" {
-		t.Fatalf("chrome proxy = %q, want request proxy", gotProxy)
+		t.Fatalf("fingerprint proxy = %q, want request proxy", gotProxy)
 	}
 	if gotReq == nil {
 		t.Fatal("expected chrome transport to receive the upstream request")
@@ -501,7 +480,7 @@ func TestAPICallChatGPTUsesChromeTransportAndPassesHeaders(t *testing.T) {
 
 func TestAPICallNonChatGPTDoesNotUseChromeTransport(t *testing.T) {
 	chromeCalled := false
-	stubChromeAPICallTransport(t, nil, apiCallRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+	stubAPICallFingerprintTransport(t, nil, apiCallRoundTripFunc(func(req *http.Request) (*http.Response, error) {
 		chromeCalled = true
 		return &http.Response{
 			StatusCode: http.StatusTeapot,
@@ -551,14 +530,15 @@ func TestAPICallNonChatGPTDoesNotUseChromeTransport(t *testing.T) {
 	}
 }
 
-func TestAPICallClientTransportPassesResolvedProxyToChrome(t *testing.T) {
+func TestAPICallClientTransportPassesResolvedProxyToFingerprint(t *testing.T) {
 	var gotProxy string
-	original := newChromeAPICallTransport
+	original := newAPICallFingerprintTransport
 	t.Cleanup(func() {
-		newChromeAPICallTransport = original
+		newAPICallFingerprintTransport = original
 	})
-	newChromeAPICallTransport = func(proxyURL string) http.RoundTripper {
+	newAPICallFingerprintTransport = func(proxyURL string, fallback http.RoundTripper) http.RoundTripper {
 		gotProxy = proxyURL
+		_ = fallback
 		return apiCallRoundTripFunc(func(req *http.Request) (*http.Response, error) {
 			return &http.Response{StatusCode: http.StatusOK, Body: http.NoBody, Request: req}, nil
 		})
@@ -572,24 +552,24 @@ func TestAPICallClientTransportPassesResolvedProxyToChrome(t *testing.T) {
 	auth := &coreauth.Auth{ProxyURL: "http://credential-proxy.example.com:8080"}
 	_ = h.apiCallClientTransport(auth, " http://request-proxy.example.com:8080 ")
 	if gotProxy != "http://request-proxy.example.com:8080" {
-		t.Fatalf("chrome proxy = %q, want request proxy", gotProxy)
+		t.Fatalf("fingerprint proxy = %q, want request proxy", gotProxy)
 	}
 
 	gotProxy = ""
 	_ = h.apiCallClientTransport(auth, "")
 	if gotProxy != "http://credential-proxy.example.com:8080" {
-		t.Fatalf("chrome proxy = %q, want credential proxy", gotProxy)
+		t.Fatalf("fingerprint proxy = %q, want credential proxy", gotProxy)
 	}
 
 	gotProxy = ""
 	_ = h.apiCallClientTransport(&coreauth.Auth{ProxyURL: "bad-value"}, "")
 	if gotProxy != "http://global-proxy.example.com:8080" {
-		t.Fatalf("chrome proxy = %q, want global proxy", gotProxy)
+		t.Fatalf("fingerprint proxy = %q, want global proxy", gotProxy)
 	}
 
 	gotProxy = ""
 	_ = h.apiCallClientTransport(nil, "")
 	if gotProxy != "http://global-proxy.example.com:8080" {
-		t.Fatalf("chrome proxy = %q, want global proxy when auth is nil", gotProxy)
+		t.Fatalf("fingerprint proxy = %q, want global proxy when auth is nil", gotProxy)
 	}
 }

internal/runtime/executor/helps/chatgpt_upstream.go

@@ -0,0 +1,19 @@
+package helps
+
+import (
+	"net/url"
+	"strings"
+)
+
+// IsChatGPTUpstreamURL reports whether a resolved request targets ChatGPT's
+// first-party web origin. Chrome TLS/HTTP2 fingerprinting and ChatGPT web
+// header defaults must use this gate so management APICall and Codex cannot
+// drift onto lookalike hosts, custom ports, or userinfo URLs as the codebase
+// evolves.
+func IsChatGPTUpstreamURL(u *url.URL) bool {
+	if u == nil || u.User != nil || !strings.EqualFold(u.Scheme, "https") || !strings.EqualFold(u.Hostname(), "chatgpt.com") {
+		return false
+	}
+	port := u.Port()
+	return port == "" || port == "443"
+}

internal/runtime/executor/helps/chatgpt_upstream_test.go

@@ -0,0 +1,41 @@
+package helps
+
+import (
+	"net/url"
+	"testing"
+)
+
+func TestIsChatGPTUpstreamURL(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name string
+		raw  string
+		want bool
+	}{
+		{name: "backend-api", raw: "https://chatgpt.com/backend-api/subscriptions", want: true},
+		{name: "mixed case host", raw: "https://ChatGPT.com/backend-api/codex/responses", want: true},
+		{name: "explicit 443", raw: "https://chatgpt.com:443/backend-api/subscriptions", want: true},
+		{name: "http", raw: "http://chatgpt.com/backend-api/subscriptions", want: false},
+		{name: "custom port", raw: "https://chatgpt.com:8443/backend-api/subscriptions", want: false},
+		{name: "lookalike host", raw: "https://chatgpt.com.example/backend-api/subscriptions", want: false},
+		{name: "userinfo", raw: "https://user:pass@chatgpt.com/backend-api/subscriptions", want: false},
+		{name: "other https", raw: "https://api.example.com/v1/ping", want: false},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			parsed, errParse := url.Parse(tc.raw)
+			if errParse != nil {
+				t.Fatalf("parse url: %v", errParse)
+			}
+			if got := IsChatGPTUpstreamURL(parsed); got != tc.want {
+				t.Fatalf("IsChatGPTUpstreamURL(%q) = %v, want %v", tc.raw, got, tc.want)
+			}
+		})
+	}
+	if IsChatGPTUpstreamURL(nil) {
+		t.Fatal("IsChatGPTUpstreamURL(nil) = true")
+	}
+}

internal/runtime/executor/helps/utls_client.go

@@ -363,12 +363,27 @@ func (f *fallbackRoundTripper) RoundTrip(req *http.Request) (*http.Response, err
 	if IsAnthropicUpstreamURL(req.URL) {
 		return f.anthropic.RoundTrip(req)
 	}
-	if req.URL.Scheme == "https" && strings.EqualFold(req.URL.Hostname(), "chatgpt.com") {
+	if IsChatGPTUpstreamURL(req.URL) {
 		return f.chrome.RoundTrip(req)
 	}
 	return f.fallback.RoundTrip(req)
 }
 
+// NewFingerprintRoundTripper routes Anthropic and ChatGPT HTTPS origins through
+// the same provider TLS fingerprints Codex/Claude already use, and sends every
+// other request through fallback. Management APICall must use this helper (not a
+// private copy) so host routing and ClientHello selection keep evolving in one place.
+func NewFingerprintRoundTripper(proxyURL string, fallback http.RoundTripper) http.RoundTripper {
+	if fallback == nil {
+		fallback = http.DefaultTransport
+	}
+	return &fallbackRoundTripper{
+		anthropic: cachedClaudeCodeRoundTripper(proxyURL),
+		chrome:    newUtlsRoundTripper(proxyURL),
+		fallback:  fallback,
+	}
+}
+
 // NewUtlsHTTPClient creates an HTTP client using provider-specific TLS
 // fingerprints for protected hosts. It uses Claude Code's Node/OpenSSL profile
 // for Anthropic and a Chrome profile for ChatGPT, with a standard-transport
@@ -387,25 +402,26 @@ func NewUtlsHTTPClient(ctx context.Context, cfg *config.Config, auth *cliproxyau
 		ctxRoundTripper, _ = ctx.Value("cliproxy.roundtripper").(http.RoundTripper)
 	}
 
-	var chromeRT http.RoundTripper = newUtlsRoundTripper(proxyURL)
-	var anthropicRT http.RoundTripper = cachedClaudeCodeRoundTripper(proxyURL)
 	var standardTransport http.RoundTripper = http.DefaultTransport
 	if proxyURL != "" {
 		if transport := buildProxyTransport(proxyURL); transport != nil {
 			standardTransport = transport
 		}
 	} else if ctxRoundTripper != nil {
-		chromeRT = ctxRoundTripper
-		anthropicRT = ctxRoundTripper
 		standardTransport = ctxRoundTripper
 	}
 
+	var transport http.RoundTripper
+	if ctxRoundTripper != nil && proxyURL == "" {
+		// Preserve the historical override: when a context round tripper is
+		// injected and no auth/config proxy is set, all hosts share it.
+		transport = ctxRoundTripper
+	} else {
+		transport = NewFingerprintRoundTripper(proxyURL, standardTransport)
+	}
+
 	client := &http.Client{
-		Transport: &fallbackRoundTripper{
-			anthropic: anthropicRT,
-			chrome:    chromeRT,
-			fallback:  standardTransport,
-		},
+		Transport: transport,
 	}
 	if timeout > 0 {
 		client.Timeout = timeout