fix(ai): accept larger Anthropic message requests

src/backend/server.test.ts

@@ -560,6 +560,34 @@ describe('PuterServer request parsing', () => {
 
     const host = () => `puter.localhost:${port}`;
 
+    it.each([
+        '/puterai/anthropic/v1/messages',
+        '/puterai/anthropic/v1/messages/count_tokens',
+    ])('accepts JSON above 50 MiB on %s before applying auth gates', async (path) => {
+        const payload = JSON.stringify({ text: 'x'.repeat(51 * 1024 * 1024) });
+        for (const contentType of ['application/json', 'text/plain;actually=json']) {
+            const res = await rawRequest(port, path, {
+                host: `api.puter.localhost:${port}`,
+                'content-type': contentType,
+            }, 'POST', payload);
+            expect(res.status).toBe(401);
+        }
+    });
+
+    it.each([
+        '/puterai/anthropic/v1/messages',
+        '/puterai/anthropic/v1/messages/count_tokens',
+        '/raw-probe',
+    ])('rejects bodies above the JSON limit on %s', async (path) => {
+        const limitMiB = path === '/raw-probe' ? 50 : 128;
+        const payload = JSON.stringify({ text: 'x'.repeat(limitMiB * 1024 * 1024) });
+        const res = await rawRequest(port, path, {
+            host: `api.puter.localhost:${port}`,
+            'content-type': 'application/json',
+        }, 'POST', payload);
+        expect(res.status).toBe(413);
+    });
+
     it('parses the user agent the first time a handler reads it', async () => {
         const agent =
             'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36';

src/backend/server.ts

@@ -524,6 +524,20 @@ export class PuterServer {
             // body-parser hands over a fresh buffer and never writes to it.
             (req as { rawBody?: Buffer }).rawBody = buf;
         };
+        // Claude's Messages and Token Counting APIs accept larger JSON bodies.
+        this.#app.post(
+            [
+                '/puterai/anthropic/v1/messages',
+                '/puterai/anthropic/v1/messages/count_tokens',
+            ],
+            express.json({ limit: '128mb', verify: captureRawBody }),
+            express.json({
+                limit: '128mb',
+                type: (req) =>
+                    req.headers['content-type'] === 'text/plain;actually=json',
+                verify: captureRawBody,
+            }),
+        );
         this.#app.use(express.json({ limit: '50mb', verify: captureRawBody }));
         this.#app.use(
             express.json({

src/docs/src/rate-limits-and-quotas.md

@@ -93,6 +93,8 @@ The OpenAI- and Anthropic-compatible endpoints (`/puterai/openai/v1/*`, `/putera
 
 `/puterai/anthropic/v1/messages/count_tokens` has its own budget of 120 requests per minute per user, with no concurrency limit, and is not charged.
 
+POST requests to `/puterai/anthropic/v1/messages` and `/puterai/anthropic/v1/messages/count_tokens` accept JSON bodies up to 128 MiB (134,217,728 bytes), including `text/plain;actually=json` bodies. Larger bodies return HTTP 413. The default JSON body limit for other routes is 50 MiB.
+
 Claude's server-executed tools are clamped so a request can't reserve an unbounded amount of credit:
 
 | Tool | Limit |