@maintainer-pro/ai-bridge 0.1.12 → 0.1.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maintainer-pro/ai-bridge",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "Local bridge daemon that pairs a machine to Maintainer Pro and configures multiple client sandboxes.",
   "keywords": [
     "maintainer-pro",
@@ -28,7 +28,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@maintainer-pro/ai-cli": "^0.1.7",
-    "@maintainer-pro/ai-server": "^0.1.6"
+    "@maintainer-pro/ai-cli": "^0.1.8",
+    "@maintainer-pro/ai-server": "^0.1.7"
   }
 }

package/src/daemon.mjs

@@ -18,6 +18,13 @@ import readline from "node:readline";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createLogger, ensureProjectDataDir } from "@maintainer-pro/ai-cli";
 import { findIife, startAiServer } from "@maintainer-pro/ai-server";
+import {
+  applyShareCacheHeaders,
+  lookupShareResponse,
+  prepareShareHttpRequest,
+  processShareHttpResponse,
+  shouldRewriteBody,
+} from "./share-rewrite.mjs";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_VERSION = readPackageVersion();
@@ -2306,6 +2313,50 @@ function replyProxyHttp(id, status, headers, body) {
   bridgeSend({ type: "proxy.http.chunk", id, stream, data: "", eof: true });
 }
 
+function shareProxyContext(msg, ws, appId) {
+  const apps = Array.isArray(ws?.hostApps) ? ws.hostApps : [];
+  const app = apps.find((row) => row.id === appId);
+  const slug =
+    (typeof msg.slug === "string" && msg.slug.trim()) ||
+    (isAiServerAppId(appId, ws) ? "ai" : proxySlugForApp(app));
+  const publicBase = String(
+    (typeof msg.publicBase === "string" && msg.publicBase) ||
+      proxyUrlForApp(
+        ws,
+        app || {
+          id: appId,
+          role: slug === "ai" ? "ai-server" : "ui",
+        }
+      ) ||
+      ""
+  ).replace(/\/$/, "");
+  const aiPublicBase = String(
+    (typeof msg.aiPublicBase === "string" && msg.aiPublicBase) ||
+      proxyUrlForApp(ws, { id: "ai-server", role: "ai-server" }) ||
+      ""
+  ).replace(/\/$/, "");
+  const acceptEncoding =
+    typeof msg.acceptEncoding === "string" ? msg.acceptEncoding : "";
+  return {
+    path: safeProxyPath(msg.path),
+    slug,
+    publicBase,
+    aiPublicBase,
+    acceptEncoding,
+    port: localPortForProxy(ws, appId),
+  };
+}
+
+function sendProcessedProxyHttp(id, ctx, status, headers, body) {
+  const processed = processShareHttpResponse({
+    ...ctx,
+    status,
+    headers,
+    body,
+  });
+  replyProxyHttp(id, processed.status, processed.headers, processed.body);
+}
+
 function bridgeEmbedConfigJs(ws) {
   const store = ws?.store && typeof ws.store === "object" ? ws.store : {};
   const aiApp = { id: "ai-server", role: "ai-server" };
@@ -2331,7 +2382,16 @@ async function handleAiProxyHttpFromAdmin(msg, ws) {
   const method = String(msg.method || "GET").toUpperCase();
   const reqPath = safeProxyPath(msg.path);
   const pathname = reqPath.split("?")[0] || "/";
-  const headers = proxyReqHeaders(msg.headers);
+  const ctx = shareProxyContext(msg, ws, "ai-server");
+  const prepared = prepareShareHttpRequest(
+    proxyReqHeaders(msg.headers),
+    ctx.publicBase,
+    ctx.acceptEncoding,
+    reqPath
+  );
+  ctx.acceptEncoding = prepared.acceptEncoding;
+  ctx.ifNoneMatch = prepared.ifNoneMatch;
+  const headers = prepared.headers;
   const body =
     typeof msg.body === "string" && msg.body
       ? Buffer.from(msg.body, "base64")
@@ -2340,20 +2400,21 @@ async function handleAiProxyHttpFromAdmin(msg, ws) {
   if (pathname === "/ai-ui.iife.js") {
     const file = findIife();
     if (!file || !fs.existsSync(file)) {
-      replyProxyHttp(
+      sendProcessedProxyHttp(
         id,
+        ctx,
         404,
         { "content-type": "text/plain; charset=utf-8" },
         "Not found"
       );
       return;
     }
-    replyProxyHttp(
+    sendProcessedProxyHttp(
       id,
+      ctx,
       200,
       {
         "content-type": "text/javascript; charset=utf-8",
-        "cache-control": "no-store",
       },
       fs.readFileSync(file)
     );
@@ -2363,8 +2424,9 @@ async function handleAiProxyHttpFromAdmin(msg, ws) {
   if (pathname === "/embed-config.js") {
     const cfg = bridgeCfg || loadConfig();
     await loadSandboxStoreEnv(ws, cfg);
-    replyProxyHttp(
+    sendProcessedProxyHttp(
       id,
+      ctx,
       200,
       {
         "content-type": "text/javascript; charset=utf-8",
@@ -2387,7 +2449,7 @@ async function handleAiProxyHttpFromAdmin(msg, ws) {
         headers,
         body,
       });
-      replyProxyHttp(id, result.status, result.headers, result.body);
+      sendProcessedProxyHttp(id, ctx, result.status, result.headers, result.body);
     } catch (err) {
       bridgeSend({
         type: "proxy.http.error",
@@ -2443,7 +2505,29 @@ function handleProxyHttpFromAdmin(msg) {
   }
   const method = String(msg.method || "GET").toUpperCase();
   const path = safeProxyPath(msg.path);
-  const headers = proxyReqHeaders(msg.headers);
+  const ctx = shareProxyContext(msg, ws, appId);
+  ctx.port = port;
+  const prepared = prepareShareHttpRequest(
+    proxyReqHeaders(msg.headers),
+    ctx.publicBase,
+    ctx.acceptEncoding,
+    path
+  );
+  ctx.acceptEncoding = prepared.acceptEncoding;
+  ctx.ifNoneMatch = prepared.ifNoneMatch;
+  if (method === "GET" || method === "HEAD") {
+    const cached = lookupShareResponse({
+      publicBase: ctx.publicBase,
+      path,
+      ifNoneMatch: ctx.ifNoneMatch,
+      acceptEncoding: ctx.acceptEncoding,
+    });
+    if (cached) {
+      replyProxyHttp(id, cached.status, cached.headers, cached.body);
+      return;
+    }
+  }
+  const headers = prepared.headers;
   headers.host = `127.0.0.1:${port}`;
   // Next.js dev 403s `/_next` when Origin/sec-fetch look cross-site.
   // This hop is server-to-server; drop those so chunks always load.
@@ -2479,11 +2563,31 @@ function handleProxyHttpFromAdmin(msg) {
           if (value == null) continue;
           outHeaders[key] = Array.isArray(value) ? value.join(", ") : String(value);
         }
+        const status = res.statusCode || 502;
+        applyShareCacheHeaders(outHeaders, path);
+        if (shouldRewriteBody(outHeaders)) {
+          /** @type {Buffer[]} */
+          const chunks = [];
+          res.on("data", (chunk) => {
+            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+          });
+          res.on("end", () => {
+            proxyHttpReqs.delete(id);
+            sendProcessedProxyHttp(
+              id,
+              ctx,
+              status,
+              outHeaders,
+              Buffer.concat(chunks)
+            );
+          });
+          return;
+        }
         bridgeSend({
           type: "proxy.http.start",
           id,
           stream,
-          status: res.statusCode || 502,
+          status,
           headers: outHeaders,
         });
         res.on("data", (chunk) => {
@@ -5096,6 +5200,12 @@ async function main() {
 
   if (args.pair || !cfg.token || !cfg.adminUrl) {
     cfg = await pairFlow(args);
+  } else if (typeof args.adminUrl === "string" && args.adminUrl.trim()) {
+    const next = args.adminUrl.replace(/\/$/, "");
+    if (cfg.adminUrl && cfg.adminUrl !== next) {
+      log(`admin URL ${cfg.adminUrl} → ${next}`);
+    }
+    cfg.adminUrl = next;
   }
 
   cfg.noAiServer = Boolean(args.noAiServer);
@@ -5265,6 +5375,7 @@ async function main() {
       senderType: msg.senderType === "client" ? "client" : undefined,
       senderName:
         typeof msg.senderName === "string" ? msg.senderName : undefined,
+      context: msg.context && typeof msg.context === "object" ? msg.context : undefined,
     };
     const embedded = embeddedChat.get(sandboxId);
     if (embedded?.runChat) {
@@ -5452,6 +5563,11 @@ async function main() {
       clearHeartbeatTimer();
       clearPingTimer();
       if (socket === ws) socket = null;
+      if (Number(code) === 1008) {
+        warn(
+          "Admin rejected this computer’s token. This admin is not the one in ~/.maintainer-pro/bridge.json. Generate a new pair code (Admin → Bridges → Add computer) and run the pair command."
+        );
+      }
       scheduleReconnect(code, reason);
     };
 

package/src/share-rewrite.mjs

@@ -0,0 +1,781 @@
+/**
+ * Share-URL processing lives on the bridge: path rewrite, widget injection,
+ * cache-control, and gzip. Maintainer Pro only forwards the result.
+ */
+import { gzipSync } from "node:zlib";
+import { createHash } from "node:crypto";
+
+const REWRITE_CACHE_MS = 10 * 60 * 1000;
+const REWRITE_CACHE_MAX = 128;
+
+/** @type {Map<string, { at: number, payload: Buffer, status: number, headers: Record<string, string>, etag: string }>} */
+const rewriteCache = new Map();
+
+/**
+ * @param {Record<string, string>} headers
+ * @returns {Record<string, string>}
+ */
+function lowerHeaders(headers) {
+  /** @type {Record<string, string>} */
+  const out = {};
+  for (const [key, value] of Object.entries(headers || {})) {
+    if (value == null) continue;
+    out[String(key).toLowerCase()] = String(value);
+  }
+  return out;
+}
+
+function headerGet(headers, name) {
+  const lower = String(name).toLowerCase();
+  for (const [key, value] of Object.entries(headers || {})) {
+    if (String(key).toLowerCase() === lower) return String(value);
+  }
+  return "";
+}
+
+function stripProxyPrefix(urlOrPath, pathPrefix) {
+  if (!pathPrefix || !urlOrPath) return urlOrPath;
+  try {
+    const u = new URL(urlOrPath, "http://mp.invalid");
+    let path = u.pathname;
+    if (path === pathPrefix) path = "/";
+    else if (path.startsWith(`${pathPrefix}/`)) {
+      path = path.slice(pathPrefix.length) || "/";
+    }
+    return `${path}${u.search}${u.hash}`;
+  } catch {
+    if (urlOrPath === pathPrefix) return "/";
+    if (urlOrPath.startsWith(`${pathPrefix}/`)) {
+      return urlOrPath.slice(pathPrefix.length) || "/";
+    }
+    return urlOrPath;
+  }
+}
+
+function proxyPathPrefix(publicBase) {
+  const trimmed = String(publicBase || "").replace(/\/$/, "");
+  if (!trimmed) return "";
+  try {
+    return new URL(trimmed).pathname.replace(/\/$/, "") || "";
+  } catch {
+    const start = trimmed.indexOf("://");
+    if (start < 0) return trimmed;
+    const pathStart = trimmed.indexOf("/", start + 3);
+    return pathStart >= 0 ? trimmed.slice(pathStart).replace(/\/$/, "") : "";
+  }
+}
+
+/**
+ * Force identity to the local app so HTML/JS can be rewritten, and strip the
+ * share prefix from Next's `next-url` header.
+ *
+ * @param {Record<string, string>} headers
+ * @param {string} [publicBase]
+ * @param {string} [acceptEncodingHint]
+ * @param {string} [path]
+ * @returns {{ headers: Record<string, string>, acceptEncoding: string, ifNoneMatch: string }}
+ */
+export function prepareShareHttpRequest(
+  headers,
+  publicBase,
+  acceptEncodingHint,
+  path
+) {
+  const out = { ...headers };
+  const acceptEncoding = String(
+    acceptEncodingHint || headerGet(out, "accept-encoding") || ""
+  );
+  const ifNoneMatch = headerGet(out, "if-none-match");
+  const pathPrefix = proxyPathPrefix(publicBase || "");
+  if (pathPrefix) {
+    for (const key of Object.keys(out)) {
+      if (key.toLowerCase() === "next-url") {
+        out[key] = stripProxyPrefix(out[key], pathPrefix);
+      }
+    }
+  }
+  for (const key of Object.keys(out)) {
+    if (key.toLowerCase() === "accept-encoding") delete out[key];
+  }
+  out["accept-encoding"] = "identity";
+  // Rewritten bodies get our ETag. Do not let Next 304 on its own validator
+  // or we would have no HTML/JS to rewrite.
+  if (willRewritePath(path)) {
+    for (const key of Object.keys(out)) {
+      const lower = key.toLowerCase();
+      if (lower === "if-none-match" || lower === "if-modified-since") {
+        delete out[key];
+      }
+    }
+  }
+  if (publicBase && !headerGet(out, "x-forwarded-prefix")) {
+    try {
+      const prefix = new URL(publicBase).pathname.replace(/\/$/, "") || "/";
+      out["x-forwarded-prefix"] = prefix;
+    } catch {
+      /* ignore */
+    }
+  }
+  return { headers: out, acceptEncoding, ifNoneMatch };
+}
+
+export function shouldRewriteBody(headers) {
+  const enc = headerGet(headers, "content-encoding").toLowerCase();
+  if (enc && enc !== "identity") return false;
+  const ct = headerGet(headers, "content-type").toLowerCase();
+  return /html|javascript|ecmascript|css|json|svg|xml|text\/plain|text\/x-component|text\/x-ref|\brsc\b/.test(
+    ct
+  );
+}
+
+function isImmutableAssetPath(path) {
+  const p = String(path || "").split("?")[0] || "";
+  return (
+    /\/_next\/static\//.test(p) ||
+    /\/__nextjs_font\//.test(p) ||
+    /\/node_modules\/\.vite\//.test(p) ||
+    /\.[0-9a-f]{8,}\.(?:js|css|woff2?)$/i.test(p)
+  );
+}
+
+function isNoStorePath(path) {
+  const p = String(path || "").split("?")[0] || "";
+  return (
+    /\/embed-config\.js$/i.test(p) ||
+    p === "/api" ||
+    p.startsWith("/api/") ||
+    /\/_next\/webpack-hmr/i.test(p) ||
+    /\/_next\/webpack\/hmr/i.test(p) ||
+    /\/__nextjs_original-stack-frames/i.test(p) ||
+    /\/@vite(?:\/|$)/.test(p) ||
+    /\/@react-refresh/.test(p) ||
+    /\/@fs\//.test(p) ||
+    /\/@id\//.test(p)
+  );
+}
+
+function isCacheableMediaPath(path) {
+  const p = String(path || "").split("?")[0] || "";
+  return /\.(?:png|jpe?g|gif|webp|avif|ico|woff2?|ttf|otf|mp4|webm|mp3|wav|wasm)$/i.test(
+    p
+  );
+}
+
+function isLongCacheScriptPath(path) {
+  const p = String(path || "").split("?")[0] || "";
+  return /\/ai-ui\.iife\.js$/i.test(p);
+}
+
+function willRewritePath(path) {
+  const p = String(path || "").split("?")[0]?.toLowerCase() || "";
+  if (!p || p === "/") return true;
+  if (isCacheableMediaPath(p)) return false;
+  if (/\.(?:woff2?|ttf|otf|png|jpe?g|gif|webp|avif|ico|mp4|webm|wasm)$/i.test(p)) {
+    return false;
+  }
+  return true;
+}
+
+function etagFor(payload) {
+  const hash = createHash("sha1").update(payload).digest("base64url").slice(0, 27);
+  return `"${hash}"`;
+}
+
+function etagMatches(ifNoneMatch, etag) {
+  if (!ifNoneMatch || !etag) return false;
+  const want = String(etag).trim();
+  return String(ifNoneMatch)
+    .split(",")
+    .some((part) => {
+      const token = part.trim();
+      return token === "*" || token === want || token === `W/${want}`;
+    });
+}
+
+function dropHopCacheNoise(headers) {
+  delete headers.pragma;
+  delete headers.expires;
+}
+
+/**
+ * Cache-Control for the share URL. Hashed Next/Vite assets can sit in the
+ * browser for a year; HTML/RSC revalidate with ETag; secrets and HMR do not
+ * cache.
+ *
+ * @param {Record<string, string>} headers
+ * @param {string} path
+ * @returns {"no-store" | "immutable" | "store" | "revalidate"}
+ */
+export function applyShareCacheHeaders(headers, path) {
+  dropHopCacheNoise(headers);
+  if (isNoStorePath(path)) {
+    headers["cache-control"] = "private, no-store";
+    return "no-store";
+  }
+  if (isImmutableAssetPath(path)) {
+    delete headers["set-cookie"];
+    headers["cache-control"] = "public, max-age=31536000, immutable";
+    return "immutable";
+  }
+  if (isCacheableMediaPath(path) || isLongCacheScriptPath(path)) {
+    delete headers["set-cookie"];
+    headers["cache-control"] = "public, max-age=86400";
+    return "store";
+  }
+  headers["cache-control"] = "no-cache";
+  return "revalidate";
+}
+
+function notModifiedResult(headers, etag) {
+  const out = {
+    "cache-control": headers["cache-control"] || "no-cache",
+    etag,
+  };
+  if (headers.vary) out.vary = headers.vary;
+  return { status: 304, headers: out, body: Buffer.alloc(0) };
+}
+
+function rewriteLocation(value, publicBase, port) {
+  if (!publicBase) return value;
+  const base = String(publicBase).replace(/\/$/, "");
+  const prefix = proxyPathPrefix(publicBase);
+  try {
+    const u = new URL(value, `http://127.0.0.1:${Number(port) || 0}`);
+    const host = String(u.hostname || "").toLowerCase();
+    const local =
+      host === "127.0.0.1" ||
+      host === "localhost" ||
+      host === "::1" ||
+      host === "0.0.0.0";
+    if (!local) return value;
+    let path = u.pathname || "/";
+    if (prefix && (path === prefix || path.startsWith(`${prefix}/`))) {
+      path = path.slice(prefix.length) || "/";
+    }
+    return `${base}${path}${u.search}${u.hash}`;
+  } catch {
+    /* keep */
+  }
+  return value;
+}
+
+function rewriteLinkHeader(value, publicBase) {
+  const prefix = proxyPathPrefix(publicBase);
+  if (!prefix || !value) return value;
+  return String(value).replace(/<(\/(?!\/)[^>\s]*)>/g, (full, path) =>
+    alreadyPrefixed(path, prefix) ? full : `<${prefix}${path}>`
+  );
+}
+
+function gzipIfRequested(payload, headers, acceptEncoding) {
+  if (payload.length < 1024) return payload;
+  if (!/\bgzip\b/i.test(acceptEncoding || "")) return payload;
+  const enc = headerGet(headers, "content-encoding");
+  if (enc && enc !== "identity") return payload;
+  try {
+    const gzipped = gzipSync(payload, { level: 6 });
+    if (gzipped.length >= payload.length) return payload;
+    for (const key of Object.keys(headers)) {
+      if (key.toLowerCase() === "content-encoding") delete headers[key];
+      if (key.toLowerCase() === "content-length") delete headers[key];
+    }
+    headers["content-encoding"] = "gzip";
+    const vary = headerGet(headers, "vary");
+    if (!/\baccept-encoding\b/i.test(vary)) {
+      for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === "vary") delete headers[key];
+      }
+      headers.vary = vary ? `${vary}, Accept-Encoding` : "Accept-Encoding";
+    }
+    return gzipped;
+  } catch {
+    return payload;
+  }
+}
+
+function rewriteCacheKey(publicBase, path) {
+  if (!isImmutableAssetPath(path) && !isLongCacheScriptPath(path)) return null;
+  return `${publicBase || ""}\0${String(path || "").split("?")[0]}`;
+}
+
+function rememberRewrite(key, payload, status, headers, etag) {
+  if (rewriteCache.size >= REWRITE_CACHE_MAX) {
+    const first = rewriteCache.keys().next().value;
+    if (first) rewriteCache.delete(first);
+  }
+  rewriteCache.set(key, {
+    at: Date.now(),
+    payload,
+    status,
+    headers: { ...headers },
+    etag,
+  });
+}
+
+/**
+ * Serve a previously rewritten immutable asset without hitting Next.
+ * Returns a 304 when the browser already has this ETag.
+ *
+ * @param {{ publicBase?: string, path?: string, ifNoneMatch?: string, acceptEncoding?: string }} opts
+ * @returns {{ status: number, headers: Record<string, string>, body: Buffer } | null}
+ */
+export function lookupShareResponse(opts) {
+  const path = String(opts?.path || "/");
+  const key = rewriteCacheKey(opts?.publicBase || "", path);
+  if (!key) return null;
+  const hit = rewriteCache.get(key);
+  if (!hit || Date.now() - hit.at >= REWRITE_CACHE_MS) return null;
+  return finishCachedShareResponse(hit, path, opts?.ifNoneMatch, opts?.acceptEncoding);
+}
+
+function finishCachedShareResponse(hit, path, ifNoneMatch, acceptEncoding) {
+  const outHeaders = { ...hit.headers };
+  applyShareCacheHeaders(outHeaders, path);
+  const etag = hit.etag || etagFor(hit.payload);
+  outHeaders.etag = etag;
+  if (etagMatches(ifNoneMatch, etag)) {
+    return notModifiedResult(outHeaders, etag);
+  }
+  const gzipped = gzipIfRequested(hit.payload, outHeaders, acceptEncoding || "");
+  outHeaders["content-length"] = String(gzipped.length);
+  return { status: hit.status, headers: outHeaders, body: gzipped };
+}
+
+function isNextDocument(body) {
+  return /\/_next\//.test(body) || /__NEXT_DATA__|self\.__next_f/.test(body);
+}
+
+function isViteDocument(body) {
+  return (
+    /\/@vite(?:\/client)?(?:["'?]|$)/.test(body) ||
+    /\/@react-refresh/.test(body) ||
+    /\/node_modules\/\.vite\//.test(body) ||
+    /\/node_modules\/\.pnpm\/vite@/.test(body)
+  );
+}
+
+function viteDevBases(body) {
+  const bases = [];
+  const re =
+    /\bconst base(?:\$\d+)?\s*=\s*["'](\/[^"']*)["']\s*\|\|\s*["']\/["']/g;
+  let match;
+  while ((match = re.exec(body))) {
+    const base = match[1];
+    if (!base || base === "/") continue;
+    bases.push(base.endsWith("/") ? base : `${base}/`);
+  }
+  return bases;
+}
+
+function viteAssetRoots(body) {
+  const roots = new Set([
+    "/@vite",
+    "/@react-refresh",
+    "/@fs",
+    "/@id",
+    "/node_modules/",
+    "/src/",
+    "/config.json",
+  ]);
+  const re =
+    /["'`](\/[^"'`]*?)(?=\/(?:@vite|@react-refresh|@fs|@id|node_modules\/|src\/))/g;
+  let match;
+  while ((match = re.exec(body))) {
+    const base = match[1];
+    if (!base || base === "/") continue;
+    roots.add(base.endsWith("/") ? base : `${base}/`);
+  }
+  for (const base of viteDevBases(body)) roots.add(base);
+  return [...roots];
+}
+
+function joinProxyAndViteBase(pathPrefix, viteBase) {
+  const prefix = pathPrefix.replace(/\/$/, "");
+  if (!viteBase || viteBase === "/") return `${prefix}/`;
+  const base = viteBase.startsWith("/") ? viteBase : `/${viteBase}`;
+  return `${prefix}${base.endsWith("/") ? base : `${base}/`}`;
+}
+
+function rewriteViteHmrClient(body, pathPrefix) {
+  if (!pathPrefix || !body.includes("vite-hmr")) return body;
+  const viteBase = viteDevBases(body)[0] || "/";
+  const prefixed = joinProxyAndViteBase(pathPrefix, viteBase);
+  const hostPath = JSON.stringify(prefixed).slice(1, -1);
+  let out = body;
+  out = out.replace(
+    /\bconst socketHost = `[\s\S]*?`;/,
+    `const socketHost = \`\${importMetaUrl.host}${hostPath}\`;`
+  );
+  out = out.replace(
+    /\bconst directSocketHost = (?:"[^"]*"|'[^']*');/,
+    `const directSocketHost = importMetaUrl.host + ${JSON.stringify(prefixed)};`
+  );
+  return out;
+}
+
+function prefixQuotedRoots(body, pathPrefix, roots) {
+  if (!pathPrefix) return body;
+  let out = body;
+  for (const root of roots) {
+    const escaped = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    out = out.replace(
+      new RegExp(`(["'\`])(${escaped})`, "g"),
+      `$1${pathPrefix}$2`
+    );
+  }
+  return out;
+}
+
+function alreadyPrefixed(path, pathPrefix) {
+  return path === pathPrefix || path.startsWith(`${pathPrefix}/`);
+}
+
+function rewriteNextFlightCanonical(body, pathPrefix) {
+  if (!pathPrefix || !body) return body;
+  const encoded = JSON.stringify(pathPrefix);
+  const escaped = pathPrefix.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
+  let out = body;
+  if (out.includes(`"c":["",""]`)) {
+    out = out.split(`"c":["",""]`).join(`"c":[${encoded}]`);
+  }
+  if (out.includes('\\"c\\":[\\"\\",\\"\\"]')) {
+    out = out
+      .split('\\"c\\":[\\"\\",\\"\\"]')
+      .join(`\\"c\\":[\\"${escaped}\\"]`);
+  }
+  out = out.replace(/("b":"[^"]+","p":)""/g, `$1${encoded}`);
+  out = out.replace(
+    /(\\?"b\\":\\?"[^"]+\\?",\\?"p\\":)\\?"\\?"/g,
+    `$1\\"${escaped}\\"`
+  );
+  if (out.includes(`"assetPrefix":""`)) {
+    out = out.split(`"assetPrefix":""`).join(`"assetPrefix":${encoded}`);
+  }
+  if (out.includes('\\"assetPrefix\\":\\"\\"')) {
+    out = out
+      .split('\\"assetPrefix\\":\\"\\"')
+      .join(`\\"assetPrefix\\":\\"${escaped}\\"`);
+  }
+  return out;
+}
+
+function rewriteNextTurbopackBasePath(body, pathPrefix) {
+  if (!pathPrefix) return body;
+  let out = rewriteNextFlightCanonical(body, pathPrefix);
+  if (out.includes("TURBOPACK compile-time value")) {
+    const next = JSON.stringify(pathPrefix);
+    out = out
+      .split(`("TURBOPACK compile-time value", "") || ''`)
+      .join(`("TURBOPACK compile-time value", ${next}) || ''`)
+      .split(`("TURBOPACK compile-time value", "") || ""`)
+      .join(`("TURBOPACK compile-time value", ${next}) || ""`);
+  }
+  const fromLocation =
+    "location ? (0, _createhreffromurl.createHrefFromUrl)(location) : initialCanonicalUrl";
+  if (out.includes(fromLocation)) {
+    out = out.split(fromLocation).join("initialCanonicalUrl");
+  }
+  const closeOnDomReady =
+    "if (document.readyState === 'loading') {\n    document.addEventListener('DOMContentLoaded', DOMContentLoaded, false);\n} else {\n    // Delayed in marco task to ensure it's executed later than hydration\n    setTimeout(DOMContentLoaded);\n}";
+  const closeOnLoad =
+    "if (document.readyState === 'complete') {\n    setTimeout(DOMContentLoaded);\n} else {\n    window.addEventListener('load', DOMContentLoaded, false);\n}";
+  if (out.includes(closeOnDomReady)) {
+    out = out.split(closeOnDomReady).join(closeOnLoad);
+  }
+  return out;
+}
+
+function contentMime(contentType) {
+  return contentType.toLowerCase().split(";")[0]?.trim() || "";
+}
+
+function prefixRootPaths(body, publicBase, contentType = "") {
+  const pathPrefix = proxyPathPrefix(publicBase);
+  if (!pathPrefix) return body;
+  const mime = contentMime(contentType);
+  const isCode =
+    /javascript|ecmascript|json|x-component|x-ref|\brsc\b/.test(mime) ||
+    mime === "text/plain";
+  const html =
+    !isCode &&
+    (mime === "text/html" ||
+      mime === "application/xhtml+xml" ||
+      (!mime && /<!doctype html|<html[\s>]/i.test(body)));
+  const css = mime === "text/css" || (!isCode && !html && /css/.test(mime));
+  const viteAndNext = ["/_next/", "/__nextjs_", ...viteAssetRoots(body)];
+  if (!html && !css) {
+    let code = rewriteViteHmrClient(body, pathPrefix);
+    code = prefixQuotedRoots(code, pathPrefix, viteAndNext);
+    code = code.replace(
+      /(?<![A-Za-z0-9])\/__nextjs_/g,
+      `${pathPrefix}/__nextjs_`
+    );
+    return rewriteNextTurbopackBasePath(code, pathPrefix);
+  }
+
+  let out = body;
+  if (
+    html &&
+    /<head[\s>]/i.test(out) &&
+    !/<base\s/i.test(out) &&
+    !isNextDocument(out)
+  ) {
+    out = out.replace(
+      /<head([^>]*)>/i,
+      `<head$1><base href="${pathPrefix}/">`
+    );
+  }
+  if (html) {
+    out = out.replace(
+      /(\s(?:src|href|action|poster)=["'])(\/(?!\/)[^"']*)/gi,
+      (full, start, path) =>
+        alreadyPrefixed(path, pathPrefix) ? full : `${start}${pathPrefix}${path}`
+    );
+    out = out.replace(/\s+crossorigin(?:\s*=\s*(["']).*?\1)?/gi, "");
+  }
+  if (isNextDocument(out)) {
+    out = rewriteNextFlightCanonical(out, pathPrefix);
+    out = prefixQuotedRoots(out, pathPrefix, ["/_next/", "/__nextjs_"]);
+    out = out.replace(
+      /(url\(\s*['"]?)(\/(?!\/)[^)"']*)/gi,
+      (full, start, path) => {
+        if (alreadyPrefixed(path, pathPrefix)) return full;
+        if (!path.startsWith("/_next/") && !path.startsWith("/__nextjs_")) {
+          return full;
+        }
+        return `${start}${pathPrefix}${path}`;
+      }
+    );
+  } else {
+    out = out.replace(
+      /(url\(\s*['"]?)(\/(?!\/)[^)"']*)/gi,
+      (full, start, path) =>
+        alreadyPrefixed(path, pathPrefix) ? full : `${start}${pathPrefix}${path}`
+    );
+    for (const root of viteAndNext) {
+      const escaped = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      out = out.replace(
+        new RegExp(`(?<![A-Za-z0-9])${escaped}`, "g"),
+        `${pathPrefix}${root}`
+      );
+    }
+  }
+  return out;
+}
+
+function httpToWsOrigin(httpUrl) {
+  const trimmed = httpUrl.replace(/\/$/, "");
+  if (trimmed.startsWith("https://")) {
+    return `wss://${trimmed.slice("https://".length)}`;
+  }
+  if (trimmed.startsWith("http://")) {
+    return `ws://${trimmed.slice("http://".length)}`;
+  }
+  return trimmed;
+}
+
+function isHtmlDocument(headers, body) {
+  const ct = headerGet(headers, "content-type").toLowerCase();
+  if (ct && !/html/.test(ct) && !/text\/plain/.test(ct)) return false;
+  return /<!doctype html|<html[\s>]|<body[\s>]|<\/body>|<\/html>/i.test(body);
+}
+
+function isScriptRequestPath(path) {
+  const p = String(path || "").split("?")[0]?.toLowerCase() || "";
+  return /\.(?:m?js|cjs)$/.test(p);
+}
+
+function rewriteLocalSidecarUrls(html, aiPublicBase, uiPublicBase) {
+  const ai = String(aiPublicBase || "").replace(/\/$/, "");
+  const ui = String(uiPublicBase || "").replace(/\/$/, "");
+  let out = html.split("__AI_SERVER_URL__").join(ai);
+  if (ui && ui !== ai) {
+    out = out
+      .split(`${ui}/embed-config.js`)
+      .join(`${ai}/embed-config.js`)
+      .split(`${ui}/ai-ui.iife.js`)
+      .join(`${ai}/ai-ui.iife.js`);
+  }
+  out = out.replace(
+    /https?:\/\/(?:localhost|127\.0\.0\.1):\d+(?=\/(?:embed-config\.js|ai-ui\.iife\.js|api\/(?:chat|ws)))/gi,
+    ai
+  );
+  return out;
+}
+
+function rewriteEmbedConfigJs(body, publicBase) {
+  if (!/^\s*window\.__MAINTAINER_PRO__\s*=/.test(body)) return body;
+  const base = String(publicBase || "").replace(/\/$/, "");
+  const start = body.indexOf("{");
+  const end = body.lastIndexOf("}");
+  if (start < 0 || end <= start) return body;
+  try {
+    const payload = JSON.parse(body.slice(start, end + 1));
+    payload.aiServerUrl = base;
+    payload.apiUrl = `${base}/api/chat`;
+    payload.aiServerWsUrl = `${httpToWsOrigin(base)}/api/ws`;
+    try {
+      payload.maintainerProUrl = new URL(base).origin;
+    } catch {
+      /* keep */
+    }
+    return `window.__MAINTAINER_PRO__=${JSON.stringify(payload)};`;
+  } catch {
+    return body;
+  }
+}
+
+function htmlAlreadyHasWidget(html) {
+  return (
+    html.includes("data-mp-proxy-embed") ||
+    html.includes("AiUi.init") ||
+    html.includes("ai-ui.iife.js")
+  );
+}
+
+function injectMaintainerProEmbed(html, aiPublicBase) {
+  if (htmlAlreadyHasWidget(html)) return html;
+  const ai = String(aiPublicBase || "").replace(/\/$/, "");
+  const loader = `<script data-mp-proxy-embed>(function(ai,ws){if(!ai||window.__MP_EMBED_LOADING)return;window.__MP_EMBED_LOADING=1;function load(src){return new Promise(function(resolve,reject){var s=document.createElement("script");s.src=src;s.onload=function(){resolve()};s.onerror=function(){reject(new Error(src))};(document.head||document.documentElement).appendChild(s)})}function boot(){var cfg=window.__MAINTAINER_PRO__||{};if(!window.AiUi||!window.AiUi.init)return false;window.AiUi.init({apiUrl:ai+"/api/chat",aiServerWsUrl:ws,title:"AI Assistant",maintainerProUrl:cfg.maintainerProUrl||undefined,maintainerProApiKey:cfg.maintainerProApiKey||undefined});return true}load(ai+"/embed-config.js").then(function(){return load(ai+"/ai-ui.iife.js")}).then(function(){if(boot())return;var n=0,t=setInterval(function(){n+=1;if(boot()||n>50)clearInterval(t)},100)}).catch(function(){})})(${JSON.stringify(ai)},${JSON.stringify(`${httpToWsOrigin(ai)}/api/ws`)})<\/script>`;
+  if (/<head[^>]*>/i.test(html)) {
+    return html.replace(/<head([^>]*)>/i, `<head$1>${loader}`);
+  }
+  if (/<\/html>/i.test(html)) {
+    return html.replace(/<\/html>/i, `</html>${loader}`);
+  }
+  if (/<\/body>/i.test(html)) {
+    return html.replace(/<\/body>/i, `${loader}</body>`);
+  }
+  return html + loader;
+}
+
+function injectNextProxyShim(html, publicBase) {
+  const prefix = proxyPathPrefix(publicBase);
+  if (
+    !prefix ||
+    html.includes("data-mp-proxy-next") ||
+    (!isNextDocument(html) && !isViteDocument(html))
+  ) {
+    return html;
+  }
+  const p = JSON.stringify(prefix);
+  const script = `<script data-mp-proxy-next>(function(p){if(!p)return;function add(v){if(typeof v!=="string"||!v)return v;function collapse(path){var d=p+p;while(path.indexOf(d)===0)path=p+path.slice(d.length);return path}if(v.charAt(0)==="/"&&v.charAt(1)!=="/"){if(v===p||v.indexOf(p+"/")===0)return collapse(v);var root=p.slice(0,p.lastIndexOf("/"));if(root&&(v===root||v.indexOf(root+"/")===0))return v;if(v==="/api/v1"||v.indexOf("/api/v1/")===0)return v;return collapse(p+v)}try{var u=new URL(v,location.href);var host=String(u.hostname||"").toLowerCase();if(host.charAt(0)==="["&&host.charAt(host.length-1)==="]")host=host.slice(1,-1);var local=host==="localhost"||host==="127.0.0.1"||host==="::1"||host==="0.0.0.0";if(!local){if(u.pathname===p){u.pathname="/";return u.toString()}if(u.pathname.indexOf(p+"/")===0){u.pathname=u.pathname.slice(p.length)||"/";return u.toString()}return v}var samePort=String(u.port||"")===String(location.port||"");if(samePort){u.pathname=add(u.pathname);return u.toString()}if(u.pathname===p||u.pathname.indexOf(p+"/")===0){u.protocol=location.protocol;u.host=location.host;return u.toString()}u.pathname=add(u.pathname||"/");u.protocol=location.protocol;u.host=location.host;return u.toString()}catch(e){}return v}function mapSel(sel){if(typeof sel!=="string")return sel;var pairs=[["src=\\"/_next/","src=\\""+p+"/_next/"],["href=\\"/_next/","href=\\""+p+"/_next/"]];for(var i=0;i<pairs.length;i++){if(sel.indexOf(pairs[i][0])!==-1)return sel.split(pairs[i][0]).join(pairs[i][1])}return sel}function patchQS(proto,name){var orig=proto[name];proto[name]=function(sel){var r=orig.call(this,sel);if(name==="querySelector"){if(r)return r}else if(r.length)return r;var s2=mapSel(sel);return s2===sel?r:orig.call(this,s2)}}patchQS(Document.prototype,"querySelector");patchQS(Document.prototype,"querySelectorAll");patchQS(Element.prototype,"querySelector");patchQS(Element.prototype,"querySelectorAll");var sa=Element.prototype.setAttribute;Element.prototype.setAttribute=function(n,v){if((n==="src"||n==="href")&&typeof v==="string")v=add(v);return sa.call(this,n,v)};function patchUrlProp(ctor,prop){try{var d=Object.getOwnPropertyDescriptor(ctor.prototype,prop);if(!d||!d.set)return;Object.defineProperty(ctor.prototype,prop,{configurable:true,enumerable:true,get:d.get,set:function(v){d.set.call(this,add(v))}})}catch(e){}}patchUrlProp(HTMLScriptElement,"src");patchUrlProp(HTMLLinkElement,"href");var f=window.fetch;window.fetch=function(input,init){if(typeof input==="string")input=add(input);else if(typeof Request!=="undefined"&&input instanceof Request)input=new Request(add(input.url),input);else if(typeof URL!=="undefined"&&input instanceof URL)input=new URL(add(input.href));return f.call(this,input,init)};var xo=XMLHttpRequest.prototype.open;XMLHttpRequest.prototype.open=function(m,u){if(typeof u==="string")arguments[1]=add(u);return xo.apply(this,arguments)};var ps=history.pushState.bind(history);history.pushState=function(s,t,u){if(typeof u==="string")u=add(u);return ps(s,t,u)};var rs=history.replaceState.bind(history);history.replaceState=function(s,t,u){if(typeof u==="string")u=add(u);return rs(s,t,u)};var WS=window.WebSocket;function WrappedWS(url,protocols){if(typeof url==="string")url=add(url);return protocols!==undefined?new WS(url,protocols):new WS(url)}WrappedWS.prototype=WS.prototype;WrappedWS.CONNECTING=WS.CONNECTING;WrappedWS.OPEN=WS.OPEN;WrappedWS.CLOSING=WS.CLOSING;WrappedWS.CLOSED=WS.CLOSED;window.WebSocket=WrappedWS;try{var la=location.assign.bind(location);location.assign=function(u){return la(add(String(u)))};var lr=location.replace.bind(location);location.replace=function(u){return lr(add(String(u)))}}catch(e){}try{var hd=Object.getOwnPropertyDescriptor(Location.prototype,"href");if(hd&&hd.set){Object.defineProperty(location,"href",{configurable:true,enumerable:true,get:function(){return hd.get.call(location)},set:function(v){hd.set.call(location,add(String(v)))}})}}catch(e){}})(${p})</script>`;
+  return html.replace(/<head([^>]*)>/i, `<head$1>${script}`);
+}
+
+/**
+ * Rewrite + gzip a local app response before it goes over the bridge WS.
+ *
+ * @param {{
+ *   path?: string,
+ *   slug?: string,
+ *   publicBase?: string,
+ *   aiPublicBase?: string,
+ *   status?: number,
+ *   headers?: Record<string, string>,
+ *   body?: Buffer | string,
+ *   acceptEncoding?: string,
+ *   ifNoneMatch?: string,
+ *   port?: number,
+ * }} opts
+ * @returns {{ status: number, headers: Record<string, string>, body: Buffer }}
+ */
+export function processShareHttpResponse(opts) {
+  const path = String(opts?.path || "/");
+  const slug = String(opts?.slug || "");
+  const publicBase = String(opts?.publicBase || "");
+  const aiPublicBase = String(opts?.aiPublicBase || "");
+  const acceptEncoding = String(opts?.acceptEncoding || "");
+  const ifNoneMatch = String(opts?.ifNoneMatch || "");
+  const port = Number(opts?.port) || 0;
+  let status =
+    typeof opts?.status === "number" && opts.status >= 100 ? opts.status : 200;
+  const headers = lowerHeaders(opts?.headers || {});
+  let payload = Buffer.isBuffer(opts?.body)
+    ? opts.body
+    : Buffer.from(opts?.body || "");
+
+  if (headers.location) {
+    headers.location = rewriteLocation(headers.location, publicBase, port);
+  }
+  if (headers.link) {
+    headers.link = rewriteLinkHeader(headers.link, publicBase);
+  }
+
+  const cachedKey = rewriteCacheKey(publicBase, path);
+  const hit =
+    cachedKey && Date.now() - (rewriteCache.get(cachedKey)?.at || 0) < REWRITE_CACHE_MS
+      ? rewriteCache.get(cachedKey)
+      : null;
+  if (hit) {
+    return finishCachedShareResponse(hit, path, ifNoneMatch, acceptEncoding);
+  }
+
+  if (isScriptRequestPath(path) && isHtmlDocument(headers, payload.toString("utf8"))) {
+    const notFound = {
+      "content-type": "text/plain; charset=utf-8",
+      "cache-control": "private, no-store",
+    };
+    return {
+      status: 404,
+      headers: notFound,
+      body: Buffer.from("Not found"),
+    };
+  }
+
+  let text = payload.toString("utf8");
+  let mutated = false;
+  if (publicBase && shouldRewriteBody(headers)) {
+    text = prefixRootPaths(text, publicBase, headers["content-type"] || "");
+    mutated = true;
+  }
+  if (aiPublicBase) {
+    const withShareUrls = rewriteLocalSidecarUrls(text, aiPublicBase, publicBase);
+    if (withShareUrls !== text) {
+      text = withShareUrls;
+      mutated = true;
+    }
+  }
+  if (aiPublicBase && /^\s*window\.__MAINTAINER_PRO__\s*=/.test(text)) {
+    const next = rewriteEmbedConfigJs(text, aiPublicBase);
+    if (next !== text) {
+      text = next;
+      mutated = true;
+    }
+  }
+  if (
+    publicBase &&
+    isHtmlDocument(headers, text) &&
+    (isNextDocument(text) || isViteDocument(text))
+  ) {
+    const next = injectNextProxyShim(text, publicBase);
+    if (next !== text) {
+      text = next;
+      mutated = true;
+    }
+  }
+  if (slug !== "ai" && aiPublicBase && isHtmlDocument(headers, text)) {
+    const next = injectMaintainerProEmbed(text, aiPublicBase);
+    if (next !== text) {
+      text = next;
+      mutated = true;
+    }
+  }
+
+  if (mutated) {
+    payload = Buffer.from(text, "utf8");
+    delete headers["content-encoding"];
+  }
+  delete headers.etag;
+  delete headers["last-modified"];
+  const mode = applyShareCacheHeaders(headers, path);
+  const etag = etagFor(payload);
+  if (mode !== "no-store") headers.etag = etag;
+  if (cachedKey) rememberRewrite(cachedKey, payload, status, headers, etag);
+  if (mode !== "no-store" && etagMatches(ifNoneMatch, etag)) {
+    return notModifiedResult(headers, etag);
+  }
+  payload = gzipIfRequested(payload, headers, acceptEncoding);
+  headers["content-length"] = String(payload.length);
+  return { status, headers, body: payload };
+}