@byoky/bridge 0.3.0 → 0.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 byoky contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/host.js

@@ -3,18 +3,29 @@ import { createServer } from "http";
 var MAX_PENDING_REQUESTS = 100;
 var pendingRequests = /* @__PURE__ */ new Map();
 function handleProxyResponse(msg) {
-  if (msg.type === "proxy_http_response") {
-    const pending = pendingRequests.get(msg.requestId);
-    if (pending) {
-      pending.resolve(msg);
-      pendingRequests.delete(msg.requestId);
-    }
+  const pending = pendingRequests.get(msg.requestId);
+  if (!pending) return;
+  if (msg.type === "proxy_http_response_meta") {
+    const headers = { ...msg.headers };
+    delete headers["transfer-encoding"];
+    delete headers["content-encoding"];
+    delete headers["content-length"];
+    delete headers["set-cookie"];
+    delete headers["set-cookie2"];
+    pending.res.writeHead(msg.status, headers);
+  } else if (msg.type === "proxy_http_response_chunk") {
+    pending.res.write(msg.chunk);
+  } else if (msg.type === "proxy_http_response_done") {
+    pending.res.end();
+    clearTimeout(pending.timeout);
+    pendingRequests.delete(msg.requestId);
   } else if (msg.type === "proxy_http_error") {
-    const pending = pendingRequests.get(msg.requestId);
-    if (pending) {
-      pending.reject(new Error(msg.error));
-      pendingRequests.delete(msg.requestId);
+    if (!pending.res.headersSent) {
+      pending.res.writeHead(502, { "Content-Type": "application/json" });
     }
+    pending.res.end(JSON.stringify({ error: msg.error }));
+    clearTimeout(pending.timeout);
+    pendingRequests.delete(msg.requestId);
   }
 }
 function startProxyServer(config) {
@@ -37,6 +48,11 @@ function startProxyServer(config) {
       res.end(JSON.stringify({ status: "ok", providers }));
       return;
     }
+    if ((req.url?.length ?? 0) > MAX_URI_LENGTH) {
+      res.writeHead(414, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "URI too long" }));
+      return;
+    }
     const match = req.url?.match(/^\/([^/]+)(\/.*)?$/);
     if (!match) {
       res.writeHead(404, { "Content-Type": "application/json" });
@@ -50,6 +66,12 @@ function startProxyServer(config) {
       res.end(JSON.stringify({ error: `Provider "${providerId}" not available in this session` }));
       return;
     }
+    const declaredLength = parseInt(req.headers["content-length"] || "0", 10);
+    if (declaredLength > MAX_BODY_SIZE) {
+      res.writeHead(413, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Payload too large" }));
+      return;
+    }
     const body = await readBody(req);
     const providerUrls = {
       anthropic: "https://api.anthropic.com",
@@ -76,9 +98,17 @@ function startProxyServer(config) {
     }
     const realUrl = `${baseUrl}${path}`;
     const requestId = `proxy-${crypto.randomUUID()}`;
+    const STRIP_HEADERS = /* @__PURE__ */ new Set([
+      "host",
+      "connection",
+      "cookie",
+      "authorization",
+      "proxy-authorization",
+      "proxy-connection"
+    ]);
     const headers = {};
     for (const [key, value] of Object.entries(req.headers)) {
-      if (key === "host" || key === "connection") continue;
+      if (STRIP_HEADERS.has(key)) continue;
       if (typeof value === "string") headers[key] = value;
     }
     const proxyMsg = {
@@ -96,25 +126,17 @@ function startProxyServer(config) {
       res.end(JSON.stringify({ error: "Too many concurrent requests" }));
       return;
     }
-    try {
-      const response = await new Promise((resolve, reject) => {
-        pendingRequests.set(requestId, { resolve, reject });
-        setTimeout(() => {
-          if (pendingRequests.has(requestId)) {
-            pendingRequests.delete(requestId);
-            reject(new Error("Request timed out"));
-          }
-        }, 12e4);
-        sendToExtension(proxyMsg);
-      });
-      const responseHeaders = { ...response.headers };
-      delete responseHeaders["transfer-encoding"];
-      res.writeHead(response.status, responseHeaders);
-      res.end(response.body);
-    } catch (err) {
-      res.writeHead(502, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: err.message }));
-    }
+    const timeout = setTimeout(() => {
+      if (pendingRequests.has(requestId)) {
+        pendingRequests.delete(requestId);
+        if (!res.headersSent) {
+          res.writeHead(504, { "Content-Type": "application/json" });
+        }
+        res.end(JSON.stringify({ error: "Request timed out" }));
+      }
+    }, 12e4);
+    pendingRequests.set(requestId, { res, timeout });
+    sendToExtension(proxyMsg);
   });
   server.listen(port, "127.0.0.1", () => {
     process.stderr.write(`Byoky proxy listening on http://127.0.0.1:${port}
@@ -123,6 +145,7 @@ function startProxyServer(config) {
   return server;
 }
 var MAX_BODY_SIZE = 10 * 1024 * 1024;
+var MAX_URI_LENGTH = 8192;
 function readBody(req) {
   return new Promise((resolve, reject) => {
     let body = "";
@@ -206,12 +229,17 @@ async function handleMessage(msg) {
   if (!msg || typeof msg !== "object") return;
   const message = msg;
   if (message.type === "ping") {
-    writeMessage({ type: "pong", version: "0.2.0" });
+    writeMessage({ type: "pong", version: "0.3.0" });
     return;
   }
   if (message.type === "proxy") {
     const req = msg;
-    await handleSetupTokenProxy(req);
+    await handleStreamingFetch(req.requestId, req.url, req.method, req.headers, req.body, "bridge");
+    return;
+  }
+  if (message.type === "proxy_direct_fetch") {
+    const req = msg;
+    await handleStreamingFetch(req.requestId, req.url, req.method, req.headers, req.body, "proxy_http");
     return;
   }
   if (message.type === "start-proxy") {
@@ -219,36 +247,49 @@ async function handleMessage(msg) {
     handleStartProxy(req);
     return;
   }
-  if (message.type === "proxy_http_response" || message.type === "proxy_http_error") {
+  if (msg && typeof msg === "object" && "type" in msg && (msg.type === "proxy_http_response_meta" || msg.type === "proxy_http_response_chunk" || msg.type === "proxy_http_response_done" || msg.type === "proxy_http_error")) {
     handleProxyResponse(msg);
     return;
   }
 }
-async function handleSetupTokenProxy(req) {
+async function handleStreamingFetch(requestId, url, method, headers, body, mode) {
+  const send = (msg) => {
+    if (mode === "bridge") {
+      writeMessage(msg);
+    } else {
+      handleProxyResponse(msg);
+    }
+  };
+  const prefix = mode === "bridge" ? "proxy_response" : "proxy_http_response";
+  const errorType = mode === "bridge" ? "proxy_error" : "proxy_http_error";
+  const controller = new AbortController();
+  const fetchTimeout = setTimeout(() => controller.abort(), 12e4);
   try {
-    const res = await fetch(req.url, {
-      method: req.method,
-      headers: req.headers,
-      body: req.body || void 0
+    const res = await fetch(url, {
+      method,
+      headers,
+      body: body || void 0,
+      signal: controller.signal
     });
-    const body = await res.text();
-    const headers = {};
+    const resHeaders = {};
     res.headers.forEach((v, k) => {
-      headers[k] = v;
-    });
-    writeMessage({
-      type: "proxy_response",
-      requestId: req.requestId,
-      status: res.status,
-      headers,
-      body
+      resHeaders[k] = v;
     });
+    send({ type: `${prefix}_meta`, requestId, status: res.status, headers: resHeaders });
+    if (res.body) {
+      const reader = res.body.getReader();
+      const decoder = new TextDecoder();
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        send({ type: `${prefix}_chunk`, requestId, chunk: decoder.decode(value, { stream: true }) });
+      }
+    }
+    send({ type: `${prefix}_done`, requestId });
   } catch (e) {
-    writeMessage({
-      type: "proxy_error",
-      requestId: req.requestId,
-      error: e.message
-    });
+    send({ type: errorType, requestId, error: "Fetch request failed" });
+  } finally {
+    clearTimeout(fetchTimeout);
   }
 }
 function handleStartProxy(req) {
@@ -267,7 +308,7 @@ function handleStartProxy(req) {
     writeMessage({
       type: "proxy_error",
       requestId: "start-proxy",
-      error: e.message
+      error: "Failed to start proxy server"
     });
   }
 }

package/dist/installer.js

@@ -2,11 +2,11 @@
 import { writeFileSync, mkdirSync, unlinkSync, existsSync, chmodSync } from "fs";
 import { dirname, resolve } from "path";
 import { homedir, platform } from "os";
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 var HOST_NAME = "com.byoky.bridge";
 function getHostPath() {
   try {
-    return execSync("which byoky-bridge", { encoding: "utf-8" }).trim();
+    return execFileSync("/usr/bin/which", ["byoky-bridge"], { encoding: "utf-8", timeout: 5e3 }).trim();
   } catch {
     return resolve(dirname(new URL(import.meta.url).pathname), "../bin/byoky-bridge.js");
   }
@@ -14,16 +14,19 @@ function getHostPath() {
 function createNativeWrapper(hostPath, manifestDir) {
   const nodePath = process.execPath;
   const wrapperPath = resolve(manifestDir, "byoky-bridge-host");
-  const userPath = process.env.PATH || "";
-  const script = `#!/bin/bash
-export PATH="${userPath}"
-exec "${nodePath}" "${hostPath}" host "$@"
-`;
+  const nodeDir = dirname(nodePath);
+  const safePath = `${nodeDir}:/usr/local/bin:/usr/bin:/bin`;
+  const script = [
+    "#!/bin/bash",
+    `export PATH='${safePath}'`,
+    `exec '${nodePath.replace(/'/g, "'\\''")}' '${hostPath.replace(/'/g, "'\\''")}' host "$@"`,
+    ""
+  ].join("\n");
   writeFileSync(wrapperPath, script);
   chmodSync(wrapperPath, 493);
   return wrapperPath;
 }
-var DEFAULT_EXTENSION_ID = "ahhecmfcclkjdgjnmackoacldnmgmipl";
+var DEFAULT_EXTENSION_ID = process.env.BYOKY_EXTENSION_ID || "ahhecmfcclkjdgjnmackoacldnmgmipl";
 function buildManifest(hostPath, browserType, extensionId) {
   const base = {
     name: HOST_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byoky/bridge",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Native messaging bridge for Byoky — routes setup token requests through Claude Code CLI",
   "type": "module",
   "main": "dist/host.js",
@@ -11,10 +11,6 @@
     "dist",
     "bin"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch"
-  },
   "keywords": [
     "byoky",
     "claude",
@@ -31,5 +27,9 @@
     "@types/node": "25.5.0",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch"
   }
-}
+}