@kitman-sh/cli 0.10.54 → 0.10.56

package/dist/egress-proxy.ts

@@ -1,6 +1,6 @@
 // Runs alone inside the egress proxy container, so it imports nothing outside Node.
 import { once } from 'node:events'
-import { connect, createServer, type Server, type Socket } from 'node:net'
+import { connect, createServer, type LookupFunction, type Server, type Socket } from 'node:net'
 
 /** Whether the allowlist takes `host:port`: an entry `host` takes any port, `host:port` one, `*.domain` subdomains. */
 export const egressAllowed = (hosts: readonly string[], host: string, port: number) => {
@@ -39,7 +39,93 @@ const httpTarget = (absolute: string) => {
 
 const answer = (socket: Socket, status: string) => socket.end(`HTTP/1.1 ${status}\r\nContent-Length: 0\r\n\r\n`)
 
-const handle = (hosts: readonly string[]) => (client: Socket) => {
+/** Takes the next bytes a client sends: how many of them belong to the request body, and whether the body has ended. */
+type BodyFraming = (chunk: Buffer) => { readonly used: number; readonly done: boolean } | 'malformed'
+
+const countedBody = (length: number): BodyFraming => {
+  let remaining = length
+
+  return chunk => {
+    const used = Math.min(remaining, chunk.length)
+    remaining -= used
+
+    return { used, done: remaining === 0 }
+  }
+}
+
+const chunkedBody = (): BodyFraming => {
+  let state: 'size' | 'data' | 'trailer' | 'done' = 'size'
+  let line = ''
+  // The chunk's data and the CRLF after it.
+  let remaining = 0
+
+  return chunk => {
+    let index = 0
+
+    while (index < chunk.length && state !== 'done') {
+      if (state === 'data') {
+        const used = Math.min(remaining, chunk.length - index)
+        index += used
+        remaining -= used
+
+        if (remaining === 0) state = 'size'
+
+        continue
+      }
+
+      const byte = chunk[index++]
+
+      if (byte !== 0x0a) {
+        line += String.fromCharCode(byte ?? 0)
+
+        if (line.length > 4_096) return 'malformed'
+
+        continue
+      }
+
+      const content = line.trim()
+      line = ''
+
+      if (state === 'trailer') {
+        if (content === '') state = 'done'
+        continue
+      }
+
+      const hex = content.split(';')[0]?.trim() ?? ''
+
+      if (!/^[0-9a-f]+$/i.test(hex)) return 'malformed'
+
+      const size = Number.parseInt(hex, 16)
+
+      if (size === 0) state = 'trailer'
+      else {
+        remaining = size + 2
+        state = 'data'
+      }
+    }
+
+    return { used: index, done: state === 'done' }
+  }
+}
+
+const requestBody = (headers: readonly string[]): BodyFraming | 'malformed' => {
+  const value = (name: string) =>
+    headers.flatMap(line => (line.toLowerCase().startsWith(`${name}:`) ? [line.slice(name.length + 1).trim()] : []))
+
+  const transferEncoding = value('transfer-encoding').join(',').toLowerCase()
+
+  if (transferEncoding !== '') return /(^|,)\s*chunked\s*$/.test(transferEncoding) ? chunkedBody() : 'malformed'
+
+  const lengths = [...new Set(value('content-length'))]
+
+  if (lengths.length === 0) return countedBody(0)
+
+  const [length = ''] = lengths
+
+  return lengths.length === 1 && /^\d+$/.test(length) ? countedBody(Number(length)) : 'malformed'
+}
+
+const handle = (hosts: readonly string[], lookup: LookupFunction | undefined) => (client: Socket) => {
   let head = Buffer.alloc(0)
 
   const onData = (chunk: Buffer) => {
@@ -48,6 +134,8 @@ const handle = (hosts: readonly string[]) => (client: Socket) => {
 
     if (end === -1) return head.length > 16_384 ? answer(client, '431 Request Header Fields Too Large') : undefined
     client.off('data', onData)
+    // What a pipelining client sends next arrives while the proxy connects, and a flowing socket would drop it.
+    client.pause()
 
     const [requestLine = '', ...headers] = head.subarray(0, end).toString().split('\r\n')
     const [method = '', target = '', version = 'HTTP/1.1'] = requestLine.split(' ')
@@ -57,30 +145,57 @@ const handle = (hosts: readonly string[]) => (client: Socket) => {
 
     if (!egressAllowed(hosts, destination.host, destination.port)) return answer(client, '403 Forbidden')
 
-    const upstream = connect(destination.port, destination.host, () => {
-      if (!('path' in destination)) {
-        client.write('HTTP/1.1 200 Connection Established\r\n\r\n')
-        upstream.write(head.subarray(end + 4))
-      } else {
-        // One request per connection: a reused one could carry a request for another host to this one.
+    const framing = 'path' in destination ? requestBody(headers) : undefined
+
+    if (framing === 'malformed') return answer(client, '400 Bad Request')
+
+    const request = 'path' in destination && framing !== undefined ? { path: destination.path, framing } : undefined
+
+    const upstream = connect(
+      { port: destination.port, host: destination.host, ...(lookup === undefined ? undefined : { lookup }) },
+      () => {
+        if (request === undefined) {
+          client.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+          upstream.write(head.subarray(end + 4))
+          client.pipe(upstream)
+          upstream.pipe(client)
+          client.resume()
+
+          return
+        }
+
+        // One request per connection, and the client's connection ends with its response: a reused one could
+        // carry a request for another host to this one, and a pipelined one would mismatch the answers.
         const kept = headers.filter(line => !/^(proxy-)?connection:/i.test(line))
+        upstream.write([[method, request.path, version].join(' '), ...kept, 'Connection: close', '', ''].join('\r\n'))
 
-        upstream.write(
-          Buffer.concat([
-            Buffer.from(
-              [[method, destination.path, version].join(' '), ...kept, 'Connection: close', '', ''].join('\r\n')
-            ),
-            head.subarray(end + 4)
-          ])
-        )
-      }
+        let bodyDone = false
 
-      client.pipe(upstream)
-      upstream.pipe(client)
-    })
+        const forward = (chunk: Buffer) => {
+          if (bodyDone) return
+
+          const framed = request.framing(chunk)
+
+          if (framed === 'malformed') return client.destroy()
+
+          bodyDone = framed.done
+
+          if (upstream.write(chunk.subarray(0, framed.used))) return
+          client.pause()
+          upstream.once('drain', () => client.resume())
+        }
+
+        // Pipelined requests after the body are dropped; the client sends them again on a new connection.
+        client.on('data', forward)
+        upstream.pipe(client)
+        client.resume()
+        forward(head.subarray(end + 4))
+      }
+    )
 
     upstream.on('error', () => (client.writable ? answer(client, '502 Bad Gateway') : client.destroy()))
     client.on('error', () => upstream.destroy())
+    client.on('close', () => upstream.destroy())
   }
 
   client.on('data', onData)
@@ -92,8 +207,10 @@ export const startEgressProxy = (input: {
   readonly hosts: readonly string[]
   readonly port: number
   readonly hostname: string
+  /** How it resolves a host, if not as the system does. */
+  readonly lookup?: LookupFunction
 }): Promise<Server> => {
-  const server = createServer(handle(input.hosts)).listen(input.port, input.hostname)
+  const server = createServer(handle(input.hosts, input.lookup)).listen(input.port, input.hostname)
 
   return once(server, 'listening').then(() => server)
 }

package/dist/half-close-relay.ts

@@ -0,0 +1,125 @@
+// Runs alone inside a pipeline check's sandbox too, so it imports nothing outside Node.
+import { once } from 'node:events'
+import { connect, createServer, type Server, type Socket } from 'node:net'
+
+/**
+ * srt's proxy closes a connection once its client stops sending, and a Docker client attached to a job stops before
+ * the job prints anything. So the encoder inside the sandbox never stops sending: it sends what its client sends as
+ * frames, each a 4-byte big-endian length and that many bytes, and the client's end as a frame of length 0. The
+ * decoder outside the sandbox turns that frame back into the end of what it sends on.
+ */
+const frameHeader = 4
+
+const frame = (chunk: Buffer) => {
+  const header = Buffer.alloc(frameHeader)
+
+  header.writeUInt32BE(chunk.length)
+
+  return Buffer.concat([header, chunk])
+}
+
+const endOfInput = Buffer.alloc(frameHeader)
+
+/** Far more than the one socket chunk the encoder frames; a longer frame is not the encoder's. */
+export const maxFrame = 1024 * 1024
+
+/** Holds `from` until `to` has caught up, when a write to `to` was `accepted` only into its buffer. */
+const keepUp = (from: Socket, to: Socket, accepted: boolean) => {
+  if (accepted) return
+  from.pause()
+  to.once('drain', () => from.resume())
+}
+
+/** Ends each of `sockets` once another has closed, after what it holds is sent, and destroys them all if one fails. */
+const closeTogether = (...sockets: readonly Socket[]) =>
+  sockets.forEach(socket => {
+    socket.on('error', () => sockets.forEach(other => other.destroy()))
+    socket.on('close', () => sockets.forEach(other => other.end()))
+  })
+
+const listening = (server: Server, port: number) =>
+  once(server.listen(port, '127.0.0.1'), 'listening').then(() => server)
+
+/** Serves `port` outside the sandbox, sending each connection's frames on to `127.0.0.1:<targetPort>`. */
+export const startHalfCloseDecoder = (input: { readonly port: number; readonly targetPort: number }) =>
+  listening(
+    createServer({ allowHalfOpen: true }, client => {
+      const upstream = connect({ port: input.targetPort, host: '127.0.0.1', allowHalfOpen: true })
+      let pending: Buffer = Buffer.alloc(0)
+
+      client.on('data', (chunk: Buffer) => {
+        pending = Buffer.concat([pending, chunk])
+
+        if (pending.length >= frameHeader && pending.readUInt32BE(0) > maxFrame) return void client.destroy()
+
+        while (pending.length >= frameHeader && pending.length >= frameHeader + pending.readUInt32BE(0)) {
+          const length = pending.readUInt32BE(0)
+
+          if (length === 0) upstream.end()
+          else keepUp(client, upstream, upstream.write(pending.subarray(frameHeader, frameHeader + length)))
+          pending = pending.subarray(frameHeader + length)
+        }
+      })
+      client.on('end', () => upstream.end())
+      upstream.pipe(client)
+      closeTogether(client, upstream)
+    }),
+    input.port
+  )
+
+/** `host` as `net.connect` takes it: a URL writes an IPv6 address in brackets. */
+const unbracketed = (host: string) => host.replace(/^\[(.*)\]$/, '$1')
+
+/**
+ * Serves `port` inside the sandbox, sending each connection through `proxy` to the decoder on the Runner's
+ * `127.0.0.1:<targetPort>`, as frames.
+ */
+export const startHalfCloseEncoder = (input: {
+  readonly port: number
+  readonly proxy: string
+  readonly targetPort: number
+}) => {
+  const proxy = new URL(input.proxy)
+  const target = `127.0.0.1:${input.targetPort}`
+
+  const credential =
+    proxy.username === ''
+      ? ''
+      : `Proxy-Authorization: Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`).toString('base64')}\r\n`
+
+  return listening(
+    createServer({ allowHalfOpen: true }, client => {
+      client.pause()
+      const upstream = connect({ port: Number(proxy.port === '' ? 80 : proxy.port), host: unbracketed(proxy.hostname) })
+      let head = Buffer.alloc(0)
+
+      const onHead = (chunk: Buffer) => {
+        head = Buffer.concat([head, chunk])
+        const end = head.indexOf('\r\n\r\n')
+
+        if (end === -1) return
+        upstream.off('data', onHead)
+
+        if (!/^HTTP\/1\.[01] 200/.test(head.toString('latin1', 0, end))) return void upstream.destroy()
+        client.write(head.subarray(end + 4))
+        upstream.pipe(client)
+        client.on('data', (chunk: Buffer) => keepUp(client, upstream, upstream.write(frame(chunk))))
+        client.on('end', () => upstream.write(endOfInput))
+        client.resume()
+      }
+
+      upstream.on('data', onHead)
+      upstream.write(`CONNECT ${target} HTTP/1.1\r\nHost: ${target}\r\n${credential}\r\n`)
+      closeTogether(client, upstream)
+    }),
+    input.port
+  )
+}
+
+// `bun half-close-relay.ts <port> <proxy URL> <decoder port>`, inside srt.
+if (import.meta.main)
+  await startHalfCloseEncoder({
+    port: Number(Bun.argv[2]),
+    proxy: Bun.argv[3] ?? '',
+    targetPort: Number(Bun.argv[4])
+  })

package/dist/index.js

@@ -5,15 +5,15 @@
 var args = process.argv.slice(2);
 if (args[0] === "srt") {
   process.argv.splice(2, 1);
-  const { runSrtCli } = await import("./chunk-wczs5vrq.js");
+  const { runSrtCli } = await import("./chunk-st9mym1j.js");
   await runSrtCli();
 } else if (args[0] === "srt-step") {
-  const { runSrtStep } = await import("./chunk-19aqk325.js");
+  const { runSrtStep } = await import("./chunk-99ver3za.js");
   await runSrtStep(args.slice(1));
 } else if (args[0] === "opencode-read") {
-  const { runOpencodeReader } = await import("./chunk-rjfxnk05.js");
+  const { runOpencodeReader } = await import("./chunk-yfdktxzg.js");
   runOpencodeReader();
 } else {
-  const { runCli } = await import("./chunk-y48wz1sa.js");
+  const { runCli } = await import("./chunk-w9kg1784.js");
   runCli(args);
 }

package/dist/tcp-forwarder.ts

@@ -0,0 +1,29 @@
+// Runs alone inside a check Docker daemon's API forwarder container, so it imports nothing outside Node.
+import { once } from 'node:events'
+import { connect, createServer, type Server } from 'node:net'
+
+/** Forwards each connection to `port` on to `target:targetPort`, and only there. */
+export const startTcpForwarder = (input: {
+  readonly port: number
+  readonly target: string
+  readonly targetPort: number
+}): Promise<Server> => {
+  // A Docker client attached to a container stops sending long before the container's output ends.
+  const server = createServer({ allowHalfOpen: true }, client => {
+    const upstream = connect({ port: input.targetPort, host: input.target, allowHalfOpen: true })
+
+    client.pipe(upstream)
+    upstream.pipe(client)
+    client.on('error', () => upstream.destroy())
+    upstream.on('error', () => client.destroy())
+  }).listen(input.port, '0.0.0.0')
+
+  return once(server, 'listening').then(() => server)
+}
+
+if (import.meta.main)
+  await startTcpForwarder({
+    port: Number(Bun.argv[2]),
+    target: Bun.argv[3] ?? '',
+    targetPort: Number(Bun.argv[4])
+  })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitman-sh/cli",
-  "version": "0.10.54",
+  "version": "0.10.56",
   "type": "module",
   "license": "UNLICENSED",
   "bin": {