@jheavenknows/bluerouter 5.4.18 → 5.4.20

package/app/.next-cli-build/server/chunks/3096.js

@@ -1,2 +1,2 @@
-"use strict";exports.id=3096,exports.ids=[3096],exports.modules={5565:(a,b,c)=>{let d=c(91645);function e(a){let b=String(a||"").trim().toLowerCase();b.startsWith("[")&&b.endsWith("]")&&(b=b.slice(1,-1));let c=b.indexOf("%");return c>=0&&(b=b.slice(0,c)),b.startsWith("::ffff:")&&4===d.isIP(b.slice(7))&&(b=b.slice(7)),b}function f(a){return Buffer.from(a.split(".").map(a=>Number(a)))}function g(a,b){return 4===b?f(a):function(a){let b=e(a),c=b.lastIndexOf(":");if(c>=0){let a=b.slice(c+1);if(4===d.isIP(a)){let d=f(a),e=(d[0]<<8|d[1]).toString(16),g=(d[2]<<8|d[3]).toString(16);b=`${b.slice(0,c)}:${e}:${g}`}}let g=b.split("::");if(g.length>2)throw Error("Invalid IPv6 address");let h=g[0]?g[0].split(":").filter(Boolean):[],i=2===g.length&&g[1]?g[1].split(":").filter(Boolean):[],j=8-h.length-i.length;if(1===g.length&&0!==j||j<0)throw Error("Invalid IPv6 address");let k=2===g.length?[...h,...Array(j).fill("0"),...i]:h;if(8!==k.length)throw Error("Invalid IPv6 address");let l=Buffer.alloc(16);return k.forEach((a,b)=>{let c=Number.parseInt(a||"0",16);if(!Number.isInteger(c)||c<0||c>65535)throw Error("Invalid IPv6 address");l[2*b]=c>>8&255,l[2*b+1]=255&c}),l}(a)}function h(a){let b=String(a||"").trim();if(!b)throw Error("Empty IP rule");let c=b.indexOf("/"),f=e(c>=0?b.slice(0,c):b),g=d.isIP(f);if(!g)throw Error(`Invalid client IP/CIDR: ${b}`);let h=4===g?32:128,i=c>=0?Number(b.slice(c+1)):h;if(!Number.isInteger(i)||i<0||i>h)throw Error(`Invalid CIDR prefix: ${b}`);return{text:c>=0?`${f}/${i}`:f,ip:f,family:g,prefix:i}}a.exports={normalizeIp:e,parseIpRule:h,normalizeAllowedClientIps:function(a){let b=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),c=[],d=new Set;for(let a of b){let b=String(a||"").trim();if(!b)continue;let e=h(b);d.has(e.text)||(d.add(e.text),c.push(e.text))}return c},clientIpMatches:function(a,b=[]){let c=e(a),f=d.isIP(c);if(!f)return!1;let i=g(c,f);for(let a of b||[]){let b;try{b=h(a)}catch{continue}if(b.family===f&&function(a,b,c){let d=Math.floor(c/8),e=c%8;for(let c=0;c<d;c+=1)if(a[c]!==b[c])return!1;if(!e)return!0;let f=255<<8-e&255;return(a[d]&f)==(b[d]&f)}(i,g(b.ip,b.family),b.prefix))return!0}return!1}}},7566:(a,b,c)=>{let d=c(55511),e=/^[a-z0-9][a-z0-9._-]{0,63}$/i,f=null;function g(){return f||(f=c(81370)),f}function h(a){return String(a||"").trim()}function i(a){let b=Array.isArray(a)?a:[],c=new Set,d=[];for(let a of b){if(!a||"object"!=typeof a)continue;let b=h(a.username),f=String(a.passwordHash||"");if(!e.test(b)||!f.startsWith("$2"))continue;let g=b.toLowerCase();c.has(g)||(c.add(g),d.push({username:b,passwordHash:f}))}return d}function j(a){if(Array.isArray(a))return null;let b=String(a||"").trim();if(!b||b.length>1024)return null;let c=b.indexOf(" ");if(c<0||"basic"!==b.slice(0,c).toLowerCase())return null;let d=b.slice(c+1).trim();if(!d||!/^[A-Za-z0-9+/]+={0,2}$/.test(d))return null;let e="";try{e=Buffer.from(d,"base64").toString("utf8")}catch{return null}let f=e.indexOf(":");return f<0?null:{username:e.slice(0,f),password:e.slice(f+1)}}a.exports={CACHE_TTL_MS:3e5,PASSWORD_MAX_BYTES:72,PASSWORD_MIN_BYTES:8,createProxyAuthLimiter:function({maxFailures:a=10,windowMs:b=6e4,cooldownMs:c=3e4,maxCooldownMs:d=3e5,maxEntries:e=1024}={}){let f=new Map;return{isLocked(a){let b=f.get(a);return!!b&&b.lockedUntil>Date.now()},recordFailure(g){let h=Date.now();!function(a){if(f.size<e)return;for(let[c,d]of f)if(d.lockedUntil<=a&&a-d.lastFailAt>b&&f.delete(c),f.size<e)return;let c=f.keys().next();c.done||f.delete(c.value)}(h);let i=f.get(g)||{failures:0,lastFailAt:0,lockedUntil:0,cooldownMs:c};h-i.lastFailAt>b&&(i.failures=0),i.failures+=1,i.lastFailAt=h;let j=!1;return i.failures>=a&&(i.lockedUntil=h+i.cooldownMs,i.cooldownMs=Math.min(2*i.cooldownMs,d),i.failures=0,j=!0),f.set(g,i),{lockedNow:j}},recordSuccess(a){f.delete(a)}}},createProxyAuthenticator:function(a){let b=new Map(i(a).map(a=>[a.username.toLowerCase(),a])),c=new Map,e=new Map;return{get accountCount(){return b.size},async authenticate(a){let f,h=j(a);if(!h)return{ok:!1,username:null,reason:a?"Unsupported proxy credentials":"Proxy authentication required"};let{username:i,password:k}=h,l=d.createHash("sha256").update(`${i}\0${k}`).digest("hex"),m=(f=c.get(l))?f.expiresAt<=Date.now()?(c.delete(l),null):f.username:null;if(m)return{ok:!0,username:m,reason:null};let n=b.get(i.trim().toLowerCase()),o=n?n.passwordHash:"$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy",p=e.get(l);p||(p=g().compare(k,o).catch(()=>!1),e.set(l,p),p.finally(()=>e.delete(l)));let q=await p;if(!n||!q)return{ok:!1,username:null,reason:"Invalid proxy credentials"};var r=n.username;if(c.size>=256){let a=c.keys().next();a.done||c.delete(a.value)}return c.set(l,{username:r,expiresAt:Date.now()+3e5}),{ok:!0,username:n.username,reason:null}}}},hashProxyPassword:async function a(a){let b=await g().genSalt(10);return g().hash(String(a),b)},isValidUsername:function(a){return e.test(h(a))},normalizeProxyUsers:i,parseBasicProxyAuthorization:j,redactProxyAuthUsers:function(a){return i(a).map(a=>({username:a.username,hasPassword:!0}))}}},43096:(a,b,c)=>{let d=c(29021),e=c(33873),{DATA_DIR:f}=c(82193),{normalizeAllowedClientIps:g}=c(5565),{normalizeAllowedToolsInput:h}=c(98586),{normalizeProxyUsers:i}=c(7566),{normalizeAccessGrants:j}=c(77407),k=e.join(f,"audit-gateway"),l=e.join(k,"config.json"),m=e.join(k,"audit.jsonl"),n=e.join(k,"logs"),o=Object.freeze({enabled:!1,bindHost:"127.0.0.1",port:3128,clientProxyHost:"",clientIpFilterEnabled:!1,allowedClientIps:[],clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],accessGrants:[],allowedHosts:["api.anthropic.com","*.anthropic.com","claude.ai","*.claude.ai","api.openai.com","*.openai.com","chatgpt.com","*.chatgpt.com"],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,retentionDays:7,verifyUpstreamTls:!0,connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,shutdownGraceMs:1500,allowPlainHttp:!1,allowedConnectPorts:[443]});function p(){return{...o,allowedClientIps:[...o.allowedClientIps],allowedClientTools:[...o.allowedClientTools],proxyAuthUsers:[...o.proxyAuthUsers],accessGrants:[],allowedHosts:[...o.allowedHosts],allowedConnectPorts:[...o.allowedConnectPorts]}}function q(){d.mkdirSync(k,{recursive:!0}),d.mkdirSync(n,{recursive:!0})}function r(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(a=>String(a||"").trim().toLowerCase()).filter(Boolean).filter(a=>!a.includes("://")&&/^[*a-z0-9._-]+$/.test(a)))]}function s(a,b,c,d,e){let f=null==a?b:Number(a);if(!Number.isInteger(f)||f<c||f>d)throw Error(`${e} must be between ${c} and ${d}`);return f}function t(a={}){let b={...o,...a},c=s(b.port,o.port,1,65535,"Proxy port"),d=Number(b.captureLimitBytes);if(!Number.isFinite(d)||d<0||d>0x1000000)throw Error("Capture limit must be between 0 and 16 MB");let e=s(b.retentionDays,o.retentionDays,1,365,"Retention days"),f=s(b.connectTimeoutMs,o.connectTimeoutMs,1e3,12e4,"Connect timeout"),k=s(b.tlsHandshakeTimeoutMs,o.tlsHandshakeTimeoutMs,1e3,12e4,"TLS handshake timeout"),l=s(b.responseHeaderTimeoutMs,o.responseHeaderTimeoutMs,1e3,3e5,"Response header timeout"),m=s(b.idleTimeoutMs,o.idleTimeoutMs,3e4,36e5,"Idle timeout"),n=s(b.shutdownGraceMs,o.shutdownGraceMs,0,3e4,"Shutdown grace period"),p=String(b.bindHost||"127.0.0.1").trim();if(!p||/\s/.test(p))throw Error("Invalid bind address");let q=String(b.clientProxyHost||"").trim();if(/\s/.test(q)||q.includes("://"))throw Error("Client proxy host must be a hostname or IP without protocol");let u=!0===b.clientIpFilterEnabled,v=g(b.allowedClientIps);if(u&&0===v.length)throw Error("Client IP filter requires at least one allowed IP or CIDR");let w=i(b.proxyAuthUsers);0;let x=j(b.accessGrants),y=!0===b.clientToolFilterEnabled,z=h(b.allowedClientTools);if(y&&0===z.length)throw Error("Client tool filter requires at least one allowed tool");return{enabled:!0===b.enabled,bindHost:p,port:c,clientProxyHost:q,clientIpFilterEnabled:u,allowedClientIps:v,clientToolFilterEnabled:y,allowedClientTools:z,proxyAuthEnabled:!1,proxyAuthUsers:w,accessGrants:x,allowedHosts:r(b.allowedHosts),passthroughUnknown:!1!==b.passthroughUnknown,captureBodies:!1!==b.captureBodies,captureLimitBytes:Math.round(d),retentionDays:e,verifyUpstreamTls:!0,connectTimeoutMs:f,tlsHandshakeTimeoutMs:k,responseHeaderTimeoutMs:l,idleTimeoutMs:m,shutdownGraceMs:n,allowPlainHttp:!1,allowedConnectPorts:[443]}}a.exports={PROXY_AUTH_FEATURE_ENABLED:!1,AUDIT_DIR:k,CONFIG_PATH:l,AUDIT_LOG_PATH:m,AUDIT_LOG_DIR:n,DEFAULT_CONFIG:o,ensureAuditDir:q,loadConfig:function(){if(q(),!d.existsSync(l))return p();try{return t(JSON.parse(d.readFileSync(l,"utf8")))}catch(a){return console.warn(`[audit-proxy] invalid config ignored: ${a.message||a}`),p()}},saveConfig:function(a){q();let b=t(a),c=`${l}.tmp`;return d.writeFileSync(c,`${JSON.stringify(b,null,2)}
-`,{mode:384}),d.renameSync(c,l),b},validateConfig:t,normalizeAllowedHosts:r,normalizeAllowedClientIps:g}},77407:(a,b,c)=>{let{normalizeAllowedClientIps:d,clientIpMatches:e,normalizeIp:f}=c(5565);function g(a){return String(a||"").trim().toLowerCase()}function h(a){let b=Array.isArray(a)?a:a&&"object"==typeof a?Object.entries(a).map(([a,b])=>({userId:a,ips:b})):[],c=new Map;for(let a of b){let b=g(a?.userId??a?.user??a?.id);if(!b)continue;let e=d(a?.ips??a?.allowedClientIps??[]);if(e.length>64)throw Error(`Grant for ${b} exceeds 64 IP entries`);let f=c.get(b);c.set(b,{userId:b,ips:f?d([...f.ips,...e]):e,note:String((a?.note??f?.note)||"").trim().slice(0,200)})}if(c.size>500)throw Error("At most 500 Audit Proxy access grants are supported");return[...c.values()].sort((a,b)=>a.userId.localeCompare(b.userId))}function i(a=[]){return d(a.flatMap(a=>a?.ips||[]))}a.exports={MAX_GRANTS:500,MAX_IPS_PER_GRANT:64,normalizeGrantUserId:g,normalizeAccessGrants:h,grantedIps:i,findAccessGrant:function(a=[],b=""){let c=g(b);return c&&a.find(a=>a.userId===c)||null},effectiveClientIpPolicy:function(a={}){let b=h(a.accessGrants),c=i(b);return c.length>0?{enabled:!0,allowedClientIps:c,source:"grants",grants:b}:{enabled:!0===a.clientIpFilterEnabled,allowedClientIps:d(a.allowedClientIps||[]),source:"manual",grants:b}},attachClientIpGate:function(a,b){let c=new Map;return a.prependListener("connection",a=>{let d=f(a?.remoteAddress||""),g=b()||{};if(g.enabled&&!e(d,g.allowedClientIps||[])){console.log(`[audit-proxy] denied client IP ${d||"unknown"} (${g.source||"manual"} allowlist)`);try{a.destroy()}catch{}return}c.set(a,d),a.once("close",()=>c.delete(a))}),{dropRevoked(){let a=b()||{};if(!a.enabled)return 0;let d=0;for(let[b,f]of[...c])if(!e(f,a.allowedClientIps||[])){console.log(`[audit-proxy] closing connection from revoked client IP ${f||"unknown"}`);try{b.destroy()}catch{}c.delete(b),d+=1}return d},connectionCount:()=>c.size}}}},82193:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(21820),g="bluerouter";function h(){return"win32"===process.platform?e.join(process.env.APPDATA||e.join(f.homedir(),"AppData","Roaming"),g):e.join(f.homedir(),`.${g}`)}let i=function(){let a=process.env.DATA_DIR;if(!a)return h();try{return d.mkdirSync(a,{recursive:!0}),a}catch(b){if(b?.code==="EACCES"||b?.code==="EPERM")return console.warn(`[DATA_DIR] '${a}' not writable → fallback ~/.${g}`),h();throw b}}(),j=e.join(i,"mitm");a.exports={DATA_DIR:i,MITM_DIR:j}},98586:a=>{let b=[{id:"claude-code",label:"Claude Code",patterns:["claude-cli","claude-code","anthropic"]},{id:"codex",label:"OpenAI Codex",patterns:["codex_cli","codex-cli","codex"]},{id:"gemini-cli",label:"Gemini CLI",patterns:["gemini-cli","google-genai"]},{id:"cursor",label:"Cursor",patterns:["cursor"]},{id:"curl",label:"curl / scripts",patterns:["curl","wget","httpie"]}];function c(a){return String(a||"").trim().toLowerCase()}function d(a,b=[]){let e=c(a);return!!e&&!!b.length&&b.some(a=>a&&e.includes(a))}a.exports={TOOL_PRESETS:b,normalizeAllowedTools:function(a){let d=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),e=[];for(let a of d){let d=c(a);if(!d)continue;let f=b.find(a=>a.id===d);f?e.push(...f.patterns):e.push(d)}return[...new Set(e)]},normalizeAllowedToolsInput:function(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(c).filter(Boolean))]},clientToolMatches:d,shouldRefuseClientTool:function(a,b=[]){return!!c(a)&&!d(a,b)},describeUserAgent:function(a){let b=String(a||"").trim();return b?b.length>120?`${b.slice(0,119)}…`:b:"no User-Agent"}}}};
+"use strict";exports.id=3096,exports.ids=[3096],exports.modules={5565:(a,b,c)=>{let d=c(91645);function e(a){let b=String(a||"").trim().toLowerCase();b.startsWith("[")&&b.endsWith("]")&&(b=b.slice(1,-1));let c=b.indexOf("%");return c>=0&&(b=b.slice(0,c)),b.startsWith("::ffff:")&&4===d.isIP(b.slice(7))&&(b=b.slice(7)),b}function f(a){return Buffer.from(a.split(".").map(a=>Number(a)))}function g(a,b){return 4===b?f(a):function(a){let b=e(a),c=b.lastIndexOf(":");if(c>=0){let a=b.slice(c+1);if(4===d.isIP(a)){let d=f(a),e=(d[0]<<8|d[1]).toString(16),g=(d[2]<<8|d[3]).toString(16);b=`${b.slice(0,c)}:${e}:${g}`}}let g=b.split("::");if(g.length>2)throw Error("Invalid IPv6 address");let h=g[0]?g[0].split(":").filter(Boolean):[],i=2===g.length&&g[1]?g[1].split(":").filter(Boolean):[],j=8-h.length-i.length;if(1===g.length&&0!==j||j<0)throw Error("Invalid IPv6 address");let k=2===g.length?[...h,...Array(j).fill("0"),...i]:h;if(8!==k.length)throw Error("Invalid IPv6 address");let l=Buffer.alloc(16);return k.forEach((a,b)=>{let c=Number.parseInt(a||"0",16);if(!Number.isInteger(c)||c<0||c>65535)throw Error("Invalid IPv6 address");l[2*b]=c>>8&255,l[2*b+1]=255&c}),l}(a)}function h(a){let b=String(a||"").trim();if(!b)throw Error("Empty IP rule");let c=b.indexOf("/"),f=e(c>=0?b.slice(0,c):b),g=d.isIP(f);if(!g)throw Error(`Invalid client IP/CIDR: ${b}`);let h=4===g?32:128,i=c>=0?Number(b.slice(c+1)):h;if(!Number.isInteger(i)||i<0||i>h)throw Error(`Invalid CIDR prefix: ${b}`);return{text:c>=0?`${f}/${i}`:f,ip:f,family:g,prefix:i}}a.exports={normalizeIp:e,parseIpRule:h,normalizeAllowedClientIps:function(a){let b=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),c=[],d=new Set;for(let a of b){let b=String(a||"").trim();if(!b)continue;let e=h(b);d.has(e.text)||(d.add(e.text),c.push(e.text))}return c},clientIpMatches:function(a,b=[]){let c=e(a),f=d.isIP(c);if(!f)return!1;let i=g(c,f);for(let a of b||[]){let b;try{b=h(a)}catch{continue}if(b.family===f&&function(a,b,c){let d=Math.floor(c/8),e=c%8;for(let c=0;c<d;c+=1)if(a[c]!==b[c])return!1;if(!e)return!0;let f=255<<8-e&255;return(a[d]&f)==(b[d]&f)}(i,g(b.ip,b.family),b.prefix))return!0}return!1}}},7566:(a,b,c)=>{let d=c(55511),e=/^[a-z0-9][a-z0-9._-]{0,63}$/i,f=null;function g(){return f||(f=c(81370)),f}function h(a){return String(a||"").trim()}function i(a){let b=Array.isArray(a)?a:[],c=new Set,d=[];for(let a of b){if(!a||"object"!=typeof a)continue;let b=h(a.username),f=String(a.passwordHash||"");if(!e.test(b)||!f.startsWith("$2"))continue;let g=b.toLowerCase();c.has(g)||(c.add(g),d.push({username:b,passwordHash:f}))}return d}function j(a){if(Array.isArray(a))return null;let b=String(a||"").trim();if(!b||b.length>1024)return null;let c=b.indexOf(" ");if(c<0||"basic"!==b.slice(0,c).toLowerCase())return null;let d=b.slice(c+1).trim();if(!d||!/^[A-Za-z0-9+/]+={0,2}$/.test(d))return null;let e="";try{e=Buffer.from(d,"base64").toString("utf8")}catch{return null}let f=e.indexOf(":");return f<0?null:{username:e.slice(0,f),password:e.slice(f+1)}}a.exports={CACHE_TTL_MS:3e5,PASSWORD_MAX_BYTES:72,PASSWORD_MIN_BYTES:8,createProxyAuthLimiter:function({maxFailures:a=10,windowMs:b=6e4,cooldownMs:c=3e4,maxCooldownMs:d=3e5,maxEntries:e=1024}={}){let f=new Map;return{isLocked(a){let b=f.get(a);return!!b&&b.lockedUntil>Date.now()},recordFailure(g){let h=Date.now();!function(a){if(f.size<e)return;for(let[c,d]of f)if(d.lockedUntil<=a&&a-d.lastFailAt>b&&f.delete(c),f.size<e)return;let c=f.keys().next();c.done||f.delete(c.value)}(h);let i=f.get(g)||{failures:0,lastFailAt:0,lockedUntil:0,cooldownMs:c};h-i.lastFailAt>b&&(i.failures=0),i.failures+=1,i.lastFailAt=h;let j=!1;return i.failures>=a&&(i.lockedUntil=h+i.cooldownMs,i.cooldownMs=Math.min(2*i.cooldownMs,d),i.failures=0,j=!0),f.set(g,i),{lockedNow:j}},recordSuccess(a){f.delete(a)}}},createProxyAuthenticator:function(a){let b=new Map(i(a).map(a=>[a.username.toLowerCase(),a])),c=new Map,e=new Map;return{get accountCount(){return b.size},async authenticate(a){let f,h=j(a);if(!h)return{ok:!1,username:null,reason:a?"Unsupported proxy credentials":"Proxy authentication required"};let{username:i,password:k}=h,l=d.createHash("sha256").update(`${i}\0${k}`).digest("hex"),m=(f=c.get(l))?f.expiresAt<=Date.now()?(c.delete(l),null):f.username:null;if(m)return{ok:!0,username:m,reason:null};let n=b.get(i.trim().toLowerCase()),o=n?n.passwordHash:"$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy",p=e.get(l);p||(p=g().compare(k,o).catch(()=>!1),e.set(l,p),p.finally(()=>e.delete(l)));let q=await p;if(!n||!q)return{ok:!1,username:null,reason:"Invalid proxy credentials"};var r=n.username;if(c.size>=256){let a=c.keys().next();a.done||c.delete(a.value)}return c.set(l,{username:r,expiresAt:Date.now()+3e5}),{ok:!0,username:n.username,reason:null}}}},hashProxyPassword:async function a(a){let b=await g().genSalt(10);return g().hash(String(a),b)},isValidUsername:function(a){return e.test(h(a))},normalizeProxyUsers:i,parseBasicProxyAuthorization:j,redactProxyAuthUsers:function(a){return i(a).map(a=>({username:a.username,hasPassword:!0}))}}},43096:(a,b,c)=>{let d=c(29021),e=c(33873),{DATA_DIR:f}=c(82193),{normalizeAllowedClientIps:g}=c(5565),{normalizeAllowedToolsInput:h}=c(98586),{normalizeProxyUsers:i}=c(7566),{normalizeAccessGrants:j}=c(77407),k=e.join(f,"audit-gateway"),l=e.join(k,"config.json"),m=e.join(k,"audit.jsonl"),n=e.join(k,"logs"),o=Object.freeze({enabled:!1,bindHost:"127.0.0.1",port:3128,clientProxyHost:"",clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],accessGrants:[],allowedHosts:["api.anthropic.com","*.anthropic.com","claude.ai","*.claude.ai","api.openai.com","*.openai.com","chatgpt.com","*.chatgpt.com"],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,retentionDays:7,verifyUpstreamTls:!0,connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,shutdownGraceMs:1500,allowPlainHttp:!1,allowedConnectPorts:[443]});function p(){return{...o,allowedClientTools:[...o.allowedClientTools],proxyAuthUsers:[...o.proxyAuthUsers],accessGrants:[],allowedHosts:[...o.allowedHosts],allowedConnectPorts:[...o.allowedConnectPorts]}}function q(){d.mkdirSync(k,{recursive:!0}),d.mkdirSync(n,{recursive:!0})}function r(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(a=>String(a||"").trim().toLowerCase()).filter(Boolean).filter(a=>!a.includes("://")&&/^[*a-z0-9._-]+$/.test(a)))]}function s(a,b,c,d,e){let f=null==a?b:Number(a);if(!Number.isInteger(f)||f<c||f>d)throw Error(`${e} must be between ${c} and ${d}`);return f}function t(a={}){let b={...o,...a},c=s(b.port,o.port,1,65535,"Proxy port"),d=Number(b.captureLimitBytes);if(!Number.isFinite(d)||d<0||d>0x1000000)throw Error("Capture limit must be between 0 and 16 MB");let e=s(b.retentionDays,o.retentionDays,1,365,"Retention days"),f=s(b.connectTimeoutMs,o.connectTimeoutMs,1e3,12e4,"Connect timeout"),g=s(b.tlsHandshakeTimeoutMs,o.tlsHandshakeTimeoutMs,1e3,12e4,"TLS handshake timeout"),k=s(b.responseHeaderTimeoutMs,o.responseHeaderTimeoutMs,1e3,3e5,"Response header timeout"),l=s(b.idleTimeoutMs,o.idleTimeoutMs,3e4,36e5,"Idle timeout"),m=s(b.shutdownGraceMs,o.shutdownGraceMs,0,3e4,"Shutdown grace period"),n=String(b.bindHost||"127.0.0.1").trim();if(!n||/\s/.test(n))throw Error("Invalid bind address");let p=String(b.clientProxyHost||"").trim();if(/\s/.test(p)||p.includes("://"))throw Error("Client proxy host must be a hostname or IP without protocol");let q=i(b.proxyAuthUsers);0;let u=j(b.accessGrants),v=!0===b.clientToolFilterEnabled,w=h(b.allowedClientTools);if(v&&0===w.length)throw Error("Client tool filter requires at least one allowed tool");return{enabled:!0===b.enabled,bindHost:n,port:c,clientProxyHost:p,clientToolFilterEnabled:v,allowedClientTools:w,proxyAuthEnabled:!1,proxyAuthUsers:q,accessGrants:u,allowedHosts:r(b.allowedHosts),passthroughUnknown:!1!==b.passthroughUnknown,captureBodies:!1!==b.captureBodies,captureLimitBytes:Math.round(d),retentionDays:e,verifyUpstreamTls:!0,connectTimeoutMs:f,tlsHandshakeTimeoutMs:g,responseHeaderTimeoutMs:k,idleTimeoutMs:l,shutdownGraceMs:m,allowPlainHttp:!1,allowedConnectPorts:[443]}}a.exports={PROXY_AUTH_FEATURE_ENABLED:!1,AUDIT_DIR:k,CONFIG_PATH:l,AUDIT_LOG_PATH:m,AUDIT_LOG_DIR:n,DEFAULT_CONFIG:o,ensureAuditDir:q,loadConfig:function(){if(q(),!d.existsSync(l))return p();try{return t(JSON.parse(d.readFileSync(l,"utf8")))}catch(a){return console.warn(`[audit-proxy] invalid config ignored: ${a.message||a}`),p()}},saveConfig:function(a){q();let b=t(a),c=`${l}.tmp`;return d.writeFileSync(c,`${JSON.stringify(b,null,2)}
+`,{mode:384}),d.renameSync(c,l),b},validateConfig:t,normalizeAllowedHosts:r,normalizeAllowedClientIps:g}},77407:(a,b,c)=>{let{normalizeAllowedClientIps:d,clientIpMatches:e,normalizeIp:f}=c(5565);function g(a){return String(a||"").trim().toLowerCase()}function h(a){let b=Array.isArray(a)?a:a&&"object"==typeof a?Object.entries(a).map(([a,b])=>({userId:a,ips:b})):[],c=new Map;for(let a of b){let b=g(a?.userId??a?.user??a?.id);if(!b)continue;let e=d(a?.ips??a?.allowedClientIps??[]);if(e.length>64)throw Error(`Grant for ${b} exceeds 64 IP entries`);let f=c.get(b);c.set(b,{userId:b,ips:f?d([...f.ips,...e]):e,note:String((a?.note??f?.note)||"").trim().slice(0,200)})}if(c.size>500)throw Error("At most 500 Audit Proxy access grants are supported");return[...c.values()].sort((a,b)=>a.userId.localeCompare(b.userId))}function i(a=[]){return d(a.flatMap(a=>a?.ips||[]))}a.exports={MAX_GRANTS:500,MAX_IPS_PER_GRANT:64,normalizeGrantUserId:g,normalizeAccessGrants:h,grantedIps:i,findAccessGrant:function(a=[],b=""){let c=g(b);return c&&a.find(a=>a.userId===c)||null},effectiveClientIpPolicy:function(a={}){let b=h(a.accessGrants);return{enabled:!0,allowedClientIps:i(b),source:"grants",grants:b}},attachClientIpGate:function(a,b){let c=new Map;return a.prependListener("connection",a=>{let d=f(a?.remoteAddress||""),g=b()||{};if(g.enabled&&!e(d,g.allowedClientIps||[])){console.log(`[audit-proxy] denied client IP ${d||"unknown"} (${g.source||"manual"} allowlist)`);try{a.destroy()}catch{}return}c.set(a,d),a.once("close",()=>c.delete(a))}),{dropRevoked(){let a=b()||{};if(!a.enabled)return 0;let d=0;for(let[b,f]of[...c])if(!e(f,a.allowedClientIps||[])){console.log(`[audit-proxy] closing connection from revoked client IP ${f||"unknown"}`);try{b.destroy()}catch{}c.delete(b),d+=1}return d},connectionCount:()=>c.size}}}},82193:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(21820),g="bluerouter";function h(){return"win32"===process.platform?e.join(process.env.APPDATA||e.join(f.homedir(),"AppData","Roaming"),g):e.join(f.homedir(),`.${g}`)}let i=function(){let a=process.env.DATA_DIR;if(!a)return h();try{return d.mkdirSync(a,{recursive:!0}),a}catch(b){if(b?.code==="EACCES"||b?.code==="EPERM")return console.warn(`[DATA_DIR] '${a}' not writable → fallback ~/.${g}`),h();throw b}}(),j=e.join(i,"mitm");a.exports={DATA_DIR:i,MITM_DIR:j}},98586:a=>{let b=[{id:"claude-code",label:"Claude Code",patterns:["claude-cli","claude-code","anthropic"]},{id:"codex",label:"OpenAI Codex",patterns:["codex_cli","codex-cli","codex"]},{id:"gemini-cli",label:"Gemini CLI",patterns:["gemini-cli","google-genai"]},{id:"cursor",label:"Cursor",patterns:["cursor"]},{id:"curl",label:"curl / scripts",patterns:["curl","wget","httpie"]}];function c(a){return String(a||"").trim().toLowerCase()}function d(a,b=[]){let e=c(a);return!!e&&!!b.length&&b.some(a=>a&&e.includes(a))}a.exports={TOOL_PRESETS:b,normalizeAllowedTools:function(a){let d=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),e=[];for(let a of d){let d=c(a);if(!d)continue;let f=b.find(a=>a.id===d);f?e.push(...f.patterns):e.push(d)}return[...new Set(e)]},normalizeAllowedToolsInput:function(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(c).filter(Boolean))]},clientToolMatches:d,shouldRefuseClientTool:function(a,b=[]){return!!c(a)&&!d(a,b)},describeUserAgent:function(a){let b=String(a||"").trim();return b?b.length>120?`${b.slice(0,119)}…`:b:"no User-Agent"}}}};