@jiayunxie/aerial 0.1.10 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jiayunxie/aerial",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Local-only GitHub Copilot proxy for Codex CLI and Claude Code.",
   "type": "module",
   "private": false,

package/src/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { fileURLToPath } from "node:url";
 import { startDeviceFlow, pollDeviceFlow, readGitHubToken, gitHubTokenSource } from "./auth.js";
-import { ensureApiKey, loadConfig, saveConfig } from "./config.js";
+import { defaultConfig, ensureApiKey, loadConfig, saveConfig } from "./config.js";
 import { configPath } from "./paths.js";
 import { startServer } from "./server.js";
 import { setupClaude, setupCodex, setupStatus, restoreClient, restoreAllClients } from "./setup.js";
@@ -70,6 +70,20 @@ function requiredArgValue(args, name) {
   return value;
 }
 
+function parseConfigPort(value) {
+  const text = String(value).trim();
+  if (!/^\d+$/.test(text)) throw new Error("port must be an integer between 1 and 65535");
+  const port = Number(text);
+  if (port < 1 || port > 65535) throw new Error("port must be an integer between 1 and 65535");
+  return port;
+}
+
+function parseConfigHost(value) {
+  const host = String(value).trim().toLowerCase();
+  if (host === "127.0.0.1" || host === "localhost" || host === "::1") return host;
+  throw new Error("host must be a loopback address: 127.0.0.1, localhost, or ::1");
+}
+
 async function selectSetupOptions(target, route, args) {
   const explicitEffort = requiredArgValue(args, "--effort");
   if (explicitEffort !== undefined) assertValidEffort(explicitEffort);
@@ -524,6 +538,11 @@ async function main() {
   }
 
   if (command === "config") {
+    if (subcommand === "reset") {
+      saveConfig(defaultConfig());
+      console.log(`Reset Aerial config: ${configPath()}`);
+      return;
+    }
     const config = loadConfig();
     if (subcommand === "set") {
       const [key, value] = rest;
@@ -531,12 +550,22 @@ async function main() {
       if (!["host", "port", "defaultModel", "defaultEffort", "logLevel", "promptCacheRetention", "promptCacheKey"].includes(key)) throw new Error(`Unsupported config key: ${key}`);
       if (key === "promptCacheRetention" && !["in_memory", "24h", "off"].includes(value)) throw new Error("promptCacheRetention must be one of: in_memory, 24h, off");
       if (key === "promptCacheKey" && !value.trim()) throw new Error("promptCacheKey must be auto, off, or a non-empty string");
+      if (key === "host") {
+        config.host = parseConfigHost(value);
+        saveConfig(config);
+        return;
+      }
+      if (key === "port") {
+        config.port = parseConfigPort(value);
+        saveConfig(config);
+        return;
+      }
       if (key === "defaultEffort") {
         config.defaultEffort = assertValidEffort(value);
         saveConfig(config);
         return;
       }
-      config[key] = key === "port" ? Number(value) : value;
+      config[key] = value;
       saveConfig(config);
       return;
     }

package/src/config.js

@@ -19,8 +19,23 @@ export function defaultConfig() {
   };
 }
 
+function objectConfig(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
+export function readConfigFileStatus() {
+  const file = configPath();
+  if (!fs.existsSync(file)) return { file, exists: false, ok: true, value: undefined };
+  try {
+    return { file, exists: true, ok: true, value: readJsonIfExists(file) };
+  } catch (err) {
+    return { file, exists: true, ok: false, error: err.message };
+  }
+}
+
 export function loadConfig() {
-  const loaded = readJsonIfExists(configPath()) || {};
+  const status = readConfigFileStatus();
+  const loaded = status.ok ? objectConfig(status.value) : {};
   const envRetention = process.env.AERIAL_PROMPT_CACHE_RETENTION;
   const envCacheKey = process.env.AERIAL_PROMPT_CACHE_KEY;
   const defaults = defaultConfig();

package/src/doctor.js

@@ -1,14 +1,32 @@
 import { setupStatus } from "./setup.js";
 import { serviceStatus } from "./service.js";
 import { computeAppStatus } from "./app-status.js";
+import { readConfigFileStatus } from "./config.js";
 
 const REPAIRS = Object.freeze({
+  CONFIG_RESET: Object.freeze({ command: "aerial", args: ["config", "reset"] }),
   LOGIN: Object.freeze({ command: "aerial", args: ["login"] }),
   SETUP_CODEX: Object.freeze({ command: "aerial", args: ["setup", "codex"] }),
   SERVICE_INSTALL: Object.freeze({ command: "aerial", args: ["service", "install"] }),
   SERVICE_STATUS_JSON: Object.freeze({ command: "aerial", args: ["service", "status", "--json"] })
 });
 
+function buildConfigChecks(configFile) {
+  if (!configFile.ok) {
+    return [{
+      id: "config.file",
+      ok: false,
+      severity: "fail",
+      message: `Aerial config file is not valid JSON: ${configFile.error}. Reset it to defaults, then rerun setup if needed.`,
+      repair: REPAIRS.CONFIG_RESET
+    }];
+  }
+  if (!configFile.exists) {
+    return [{ id: "config.file", ok: true, severity: "info", message: "Aerial config file has not been created yet." }];
+  }
+  return [{ id: "config.file", ok: true, severity: "info", message: "Aerial config file is valid JSON." }];
+}
+
 function buildAuthChecks(setup) {
   const checks = [];
   const apiKey = setup.auth.api_key;
@@ -142,10 +160,12 @@ function summarize(ok, checks) {
 }
 
 export async function doctor({ run, healthFetch, setup, service } = {}) {
+  const configFile = readConfigFileStatus();
   const setupOut = setup ?? setupStatus();
   const serviceOut = service ?? await serviceStatus({ ...(run ? { run } : {}), ...(healthFetch ? { healthFetch } : {}) });
   const app = computeAppStatus(setupOut, serviceOut);
   const checks = [
+    ...buildConfigChecks(configFile),
     ...buildAuthChecks(setupOut),
     ...buildClientChecks(setupOut),
     ...buildServiceChecks(serviceOut)

package/src/log.js

@@ -4,17 +4,7 @@ import path from "node:path";
 const DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 const DEFAULT_ROTATE_KEEP = 3;
 const MAX_LINE_BYTES = 64 * 1024;
-const REDACT_KEYS = new Set([
-  "authorization",
-  "token",
-  "apiKey",
-  "api_key",
-  "githubToken",
-  "github_token",
-  "body",
-  "password",
-  "secret"
-]);
+const MAX_REDACT_DEPTH = 8;
 
 const state = {
   fd: undefined,
@@ -151,19 +141,53 @@ function writeBuffer(buf) {
   }
 }
 
-function redact(fields) {
+function sensitiveKey(key) {
+  const normalized = String(key).toLowerCase().replace(/[_-]/g, "");
+  return normalized === "authorization"
+    || normalized === "token"
+    || (normalized.endsWith("token") && !normalized.endsWith("tokens"))
+    || normalized.includes("apikey")
+    || normalized.includes("secret")
+    || normalized.includes("password")
+    || normalized === "body"
+    || normalized.endsWith("body");
+}
+
+function scrubString(value) {
+  return value
+    .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/g, "Bearer [redacted]")
+    .replace(/\bgithub_pat_[A-Za-z0-9_]+/g, "[redacted]")
+    .replace(/\bgh[opsru]_[A-Za-z0-9_]{20,}\b/g, "[redacted]")
+    .replace(/\baerial_[A-Za-z0-9_-]{16,}\b/g, "[redacted]")
+    .replace(/\bsk-[A-Za-z0-9_-]{20,}\b/g, "[redacted]")
+    .replace(/\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, "[redacted]");
+}
+
+function scrub(value, seen = new WeakSet(), depth = 0) {
+  if (typeof value === "string") return scrubString(value);
+  if (value === null || typeof value !== "object") return value;
+  if (Buffer.isBuffer(value)) return "[redacted buffer]";
+  if (depth >= MAX_REDACT_DEPTH) return "[redacted depth]";
+  if (seen.has(value)) return "[redacted circular]";
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const out = value.map((item) => scrub(item, seen, depth + 1));
+    seen.delete(value);
+    return out;
+  }
   const out = {};
-  for (const [k, v] of Object.entries(fields)) {
-    if (REDACT_KEYS.has(k)) continue;
-    out[k] = v;
+  for (const [k, v] of Object.entries(value)) {
+    if (sensitiveKey(k)) continue;
+    out[k] = scrub(v, seen, depth + 1);
   }
+  seen.delete(value);
   return out;
 }
 
 function lineFor(event, fields) {
-  const safe = redact(fields);
+  const safe = scrub(fields);
   const ts = new Date().toISOString();
-  const obj = { ts, event, ...safe };
+  const obj = { ts, event: scrubString(event), ...safe };
   const line = JSON.stringify(obj);
   const buf = Buffer.from(`${line}\n`, "utf8");
   if (buf.length <= MAX_LINE_BYTES) return buf;

package/src/server.js

@@ -5,6 +5,8 @@ import { proxyChatCompletions, proxyMessages, proxyModels, proxyResponses, local
 import { readGitHubToken } from "./auth.js";
 import { logEvent } from "./log.js";
 
+const MAX_BODY_BYTES = 32 * 1024 * 1024;
+
 function json(status, body) {
   return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
 }
@@ -53,9 +55,45 @@ function nodeRequestToFetch(req, body, signal) {
   return new Request(`http://${req.headers.host}${req.url}`, { method: req.method, headers: req.headers, body: body.length ? body : undefined, duplex: "half", signal });
 }
 
-async function readBody(req) {
+function nodeHeaderObject(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (Array.isArray(value)) out[key] = value.join(", ");
+    else if (value !== undefined) out[key] = String(value);
+  }
+  return out;
+}
+
+function publicRoute(req) {
+  const url = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
+  return (req.method === "GET" && url.pathname === "/health")
+    || (req.method === "GET" && url.pathname === "/")
+    || (req.method === "GET" && url.pathname === "/v1/models");
+}
+
+function bodyTooLarge(limit) {
+  const err = new Error(`Request body too large. Limit is ${limit} bytes.`);
+  err.statusCode = 413;
+  return err;
+}
+
+function declaredContentLength(req) {
+  const raw = Array.isArray(req.headers["content-length"]) ? req.headers["content-length"][0] : req.headers["content-length"];
+  if (raw === undefined) return undefined;
+  const n = Number(raw);
+  return Number.isFinite(n) ? n : undefined;
+}
+
+async function readBody(req, maxBytes = MAX_BODY_BYTES) {
+  const declared = declaredContentLength(req);
+  if (declared !== undefined && declared > maxBytes) throw bodyTooLarge(maxBytes);
   const chunks = [];
-  for await (const chunk of req) chunks.push(chunk);
+  let bytes = 0;
+  for await (const chunk of req) {
+    bytes += chunk.length;
+    if (bytes > maxBytes) throw bodyTooLarge(maxBytes);
+    chunks.push(chunk);
+  }
   return Buffer.concat(chunks);
 }
 
@@ -78,7 +116,7 @@ async function handle(fetchRequest, runtime = {}) {
     return modelsRouteOrUpstreamAuthFailed(fetchRequest);
   }
 
-  if (!validateLocalAuth(Object.fromEntries(fetchRequest.headers), config)) {
+  if (!runtime.localAuthValidated && !validateLocalAuth(Object.fromEntries(fetchRequest.headers), config)) {
     return json(401, { error: { type: "authentication_error", message: "Invalid or missing Aerial API key" } });
   }
 
@@ -118,9 +156,20 @@ export function createServer(runtime = {}) {
     res.on("close", () => controller.abort());
     try {
       logEvent("request_start", { method: req.method, path: req.url });
+      let localAuthValidated = false;
+      if (!publicRoute(req)) {
+        const config = loadConfig();
+        if (!validateLocalAuth(nodeHeaderObject(req.headers), config)) {
+          const fetchResponse = json(401, { error: { type: "authentication_error", message: "Invalid or missing Aerial API key" } });
+          await writeNodeResponse(res, fetchResponse, controller.signal);
+          logEvent("request_end", { method: req.method, path: req.url, status: fetchResponse.status, ms: Date.now() - started });
+          return;
+        }
+        localAuthValidated = true;
+      }
       const body = await readBody(req);
       const fetchRequest = nodeRequestToFetch(req, body, controller.signal);
-      const fetchResponse = await handle(fetchRequest, runtime);
+      const fetchResponse = await handle(fetchRequest, { ...runtime, localAuthValidated });
       await writeNodeResponse(res, fetchResponse, controller.signal);
       logEvent("request_end", { method: req.method, path: req.url, status: fetchResponse.status, ms: Date.now() - started });
     } catch (error) {
@@ -128,10 +177,11 @@ export function createServer(runtime = {}) {
         logEvent("request_aborted", { method: req.method, path: req.url, ms: Date.now() - started });
         return;
       }
-      logEvent("request_end", { method: req.method, path: req.url, status: 500, ms: Date.now() - started, error: error.message });
-      res.statusCode = error.message?.includes("Missing GitHub token") ? 503 : 500;
+      const status = error.statusCode || (error.message?.includes("Missing GitHub token") ? 503 : 500);
+      logEvent("request_end", { method: req.method, path: req.url, status, ms: Date.now() - started, error: error.message });
+      res.statusCode = status;
       res.setHeader("content-type", "application/json");
-      res.end(JSON.stringify({ error: { type: "aerial_error", message: error.message } }));
+      res.end(JSON.stringify({ error: { type: status === 413 ? "request_entity_too_large" : "aerial_error", message: error.message } }));
     }
   });
 

package/src/setup.js

@@ -36,10 +36,22 @@ function tomlValue(value) {
   return JSON.stringify(String(value));
 }
 
-function setTomlString(content, key, value) {
+function escapeRegExp(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function setTomlRootString(content, key, value) {
   const line = `${key} = ${tomlValue(value)}`;
-  const re = new RegExp(`^${key}\\s*=.*$`, "m");
-  return re.test(content) ? content.replace(re, line) : `${content.trimEnd()}\n${line}\n`;
+  const source = content.split(/\r?\n/);
+  const firstSection = source.findIndex((sourceLine) => /^\s*\[.*\]\s*(?:#.*)?$/.test(sourceLine));
+  const rootLines = firstSection === -1 ? source : source.slice(0, firstSection);
+  const restLines = firstSection === -1 ? [] : source.slice(firstSection);
+  const root = rootLines.join("\n");
+  const rest = restLines.join("\n");
+  const re = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=.*$`, "m");
+  const nextRoot = re.test(root) ? root.replace(re, line) : `${root.trimEnd()}${root.trimEnd() ? "\n" : ""}${line}`;
+  if (!rest) return `${nextRoot.trimEnd()}\n`;
+  return `${nextRoot.trimEnd()}\n${rest}`;
 }
 
 function upsertTomlSection(content, section, values) {
@@ -88,8 +100,8 @@ export function setupCodex({ model, effort, authCommand = DEFAULT_CODEX_AUTH } =
   ensureParent(file);
   const backup = backupIfExists(file);
   let content = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
-  content = setTomlString(content, "model_provider", "aerial");
-  content = setTomlString(content, "model", selectedModel);
+  content = setTomlRootString(content, "model_provider", "aerial");
+  content = setTomlRootString(content, "model", selectedModel);
   content = upsertTomlSection(content, "model_providers.aerial", {
     name: "Aerial",
     base_url: `http://${config.host}:${config.port}/v1`,
@@ -367,4 +379,3 @@ export function restoreAllClients(opts) {
   const ok = Object.values(results).every((r) => r.ok);
   return { ok, results };
 }
-