From c8d8d0a3e7ccb3e2e8f61d5d6e7c3300acb5ac0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=B8=96=E7=95=8C?= <i@sekai.icu>
Date: Fri, 13 Mar 2026 23:31:19 +0800
Subject: [PATCH] service/ccm: reject fast-mode external credentials

---
 service/ccm/service.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/service/ccm/service.go b/service/ccm/service.go
index 6f1500fb8..b41eb6da2 100644
--- a/service/ccm/service.go
+++ b/service/ccm/service.go
@@ -464,6 +464,11 @@ func (s *Service) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			"extended context (1m) requests cannot be proxied through external credentials")
 		return
 	}
+	if isFastModeRequest(anthropicBetaHeader) && selectedCredential.isExternal() {
+		writeJSONError(w, r, http.StatusBadRequest, "invalid_request_error",
+			"fast mode requests cannot be proxied through external credentials")
+		return
+	}
 
 	requestContext := selectedCredential.wrapRequestContext(r.Context())
 	defer func() {