@bman654/clodex 2.18.8 → 2.18.9

package/dist/cli.js

@@ -346,7 +346,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.18.8",
+  version: "2.18.9",
   publishConfig: {
     access: "public"
   },
@@ -19906,7 +19906,7 @@ var CA_KEY_FILE = "clodex-ca-key.pem";
 var SERVER_CERT_FILE = "api.anthropic.com.pem";
 var SERVER_KEY_FILE = "api.anthropic.com-key.pem";
 var CERT_VERSION_FILE = "version";
-var CERT_VERSION = "1\n";
+var CERT_VERSION = "2\n";
 function serialNumber() {
   const bytes = randomBytes2(16);
   bytes[0] &= 127;
@@ -19931,6 +19931,31 @@ function writePublic(path, value) {
   writeFileSync7(path, value, { encoding: "utf8", mode: 420 });
   chmodSync5(path, 420);
 }
+function generateServerCertificate(paths, caCert, caKey) {
+  const caKeyId = caCert.getExtension("subjectKeyIdentifier")?.subjectKeyIdentifier;
+  const serverKeys = forge.pki.rsa.generateKeyPair(2048);
+  const serverCert = forge.pki.createCertificate();
+  serverCert.publicKey = serverKeys.publicKey;
+  serverCert.serialNumber = serialNumber();
+  serverCert.validity.notBefore = new Date(Date.now() - 24 * 60 * 60 * 1e3);
+  serverCert.validity.notAfter = new Date(Date.now() + 825 * 24 * 60 * 60 * 1e3);
+  serverCert.setSubject([{ name: "commonName", value: "api.anthropic.com" }]);
+  serverCert.setIssuer(caCert.subject.attributes);
+  serverCert.setExtensions([
+    { name: "basicConstraints", cA: false, critical: true },
+    { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
+    { name: "extKeyUsage", serverAuth: true },
+    { name: "subjectAltName", altNames: [{ type: 2, value: "api.anthropic.com" }] },
+    { name: "subjectKeyIdentifier" },
+    {
+      name: "authorityKeyIdentifier",
+      keyIdentifier: caKeyId ? forge.util.hexToBytes(caKeyId) : caCert.generateSubjectKeyIdentifier().getBytes()
+    }
+  ]);
+  serverCert.sign(caKey, forge.md.sha256.create());
+  writePrivate(paths.serverKey, forge.pki.privateKeyToPem(serverKeys.privateKey));
+  writePublic(paths.serverCert, forge.pki.certificateToPem(serverCert));
+}
 function generateCertificates(paths) {
   mkdirSync7(paths.dir, { recursive: true, mode: 448 });
   chmodSync5(paths.dir, 448);
@@ -19949,35 +19974,37 @@ function generateCertificates(paths) {
     { name: "subjectKeyIdentifier" }
   ]);
   caCert.sign(caKeys.privateKey, forge.md.sha256.create());
-  const serverKeys = forge.pki.rsa.generateKeyPair(2048);
-  const serverCert = forge.pki.createCertificate();
-  serverCert.publicKey = serverKeys.publicKey;
-  serverCert.serialNumber = serialNumber();
-  serverCert.validity.notBefore = new Date(Date.now() - 24 * 60 * 60 * 1e3);
-  serverCert.validity.notAfter = new Date(Date.now() + 825 * 24 * 60 * 60 * 1e3);
-  serverCert.setSubject([{ name: "commonName", value: "api.anthropic.com" }]);
-  serverCert.setIssuer(caCert.subject.attributes);
-  serverCert.setExtensions([
-    { name: "basicConstraints", cA: false, critical: true },
-    { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
-    { name: "extKeyUsage", serverAuth: true },
-    { name: "subjectAltName", altNames: [{ type: 2, value: "api.anthropic.com" }] },
-    { name: "subjectKeyIdentifier" }
-  ]);
-  serverCert.sign(caKeys.privateKey, forge.md.sha256.create());
   writePrivate(paths.caKey, forge.pki.privateKeyToPem(caKeys.privateKey));
   writePublic(paths.caCert, forge.pki.certificateToPem(caCert));
-  writePrivate(paths.serverKey, forge.pki.privateKeyToPem(serverKeys.privateKey));
-  writePublic(paths.serverCert, forge.pki.certificateToPem(serverCert));
+  generateServerCertificate(paths, caCert, caKeys.privateKey);
   writePublic(paths.version, CERT_VERSION);
 }
+var RENEWAL_BUFFER_MS = 7 * 24 * 60 * 60 * 1e3;
+function staysValid(cert, now) {
+  return cert.validity.notBefore.getTime() <= now && cert.validity.notAfter.getTime() > now + RENEWAL_BUFFER_MS;
+}
+function keyMatchesCertificate(cert, key) {
+  return cert.publicKey.n.compareTo(key.n) === 0;
+}
+function loadCurrentCa(paths) {
+  try {
+    const caCert = forge.pki.certificateFromPem(readFileSync12(paths.caCert, "utf8"));
+    const caKey = forge.pki.privateKeyFromPem(readFileSync12(paths.caKey, "utf8"));
+    if (!staysValid(caCert, Date.now())) return null;
+    if (!caCert.verify(caCert)) return null;
+    if (!keyMatchesCertificate(caCert, caKey)) return null;
+    return { caCert, caKey };
+  } catch {
+    return null;
+  }
+}
 function storedCertificatesAreCurrent(paths) {
   try {
     const ca = forge.pki.certificateFromPem(readFileSync12(paths.caCert, "utf8"));
     const server = forge.pki.certificateFromPem(readFileSync12(paths.serverCert, "utf8"));
+    const serverKey = forge.pki.privateKeyFromPem(readFileSync12(paths.serverKey, "utf8"));
     const now = Date.now();
-    const renewalBuffer = 7 * 24 * 60 * 60 * 1e3;
-    return ca.validity.notBefore.getTime() <= now && ca.validity.notAfter.getTime() > now + renewalBuffer && server.validity.notBefore.getTime() <= now && server.validity.notAfter.getTime() > now + renewalBuffer && ca.verify(ca) && ca.verify(server);
+    return staysValid(ca, now) && staysValid(server, now) && ca.verify(ca) && ca.verify(server) && keyMatchesCertificate(server, serverKey);
   } catch {
     return false;
   }
@@ -19986,7 +20013,15 @@ function ensureHttpProxyCertificates() {
   const paths = certPaths();
   const required = [paths.caCert, paths.caKey, paths.serverCert, paths.serverKey, paths.version];
   const current = required.every(existsSync6) && readFileSync12(paths.version, "utf8") === CERT_VERSION && storedCertificatesAreCurrent(paths);
-  if (!current) generateCertificates(paths);
+  if (!current) {
+    const ca = loadCurrentCa(paths);
+    if (ca) {
+      generateServerCertificate(paths, ca.caCert, ca.caKey);
+      writePublic(paths.version, CERT_VERSION);
+    } else {
+      generateCertificates(paths);
+    }
+  }
   return {
     caCertPath: paths.caCert,
     caCert: readFileSync12(paths.caCert, "utf8"),