@maintainer-pro/ai-bridge 0.1.23 → 0.1.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maintainer-pro/ai-bridge",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "Local bridge daemon that pairs a machine to Maintainer Pro and configures multiple client sandboxes.",
   "keywords": [
     "maintainer-pro",

package/src/daemon.mjs

@@ -2309,6 +2309,7 @@ function shareProxyContext(msg, ws, appId) {
     acceptEncoding,
     port: localPortForProxy(ws, appId),
     portUrls: { ...fromWs, ...fromMsg },
+    bypassCors: msg?.bypassCors === true,
   };
 }
 
@@ -2342,9 +2343,13 @@ function replyShareInterceptor(id, ctx, path) {
   let body = "";
   if (pathname === "/__mp/sw.js") {
     headers["service-worker-allowed"] = tokenRoot;
-    body = shareServiceWorkerScript(ctx.portUrls, tokenRoot);
+    body = shareServiceWorkerScript(ctx.portUrls, tokenRoot, ctx.bypassCors);
   } else {
-    body = shareShimScript(publicPathPrefix(ctx.publicBase), ctx.portUrls);
+    body = shareShimScript(
+      publicPathPrefix(ctx.publicBase),
+      ctx.portUrls,
+      ctx.bypassCors
+    );
   }
   replyProxyHttp(id, 200, headers, body);
   return true;
@@ -2476,6 +2481,234 @@ async function handleAiProxyHttpFromAdmin(msg, ws) {
   });
 }
 
+const EXTERNAL_PROXY_TIMEOUT_MS = 10 * 60 * 1000;
+const EXTERNAL_PROXY_MAX_REDIRECTS = 5;
+const EXTERNAL_PROXY_DROP_HEADERS = new Set([
+  "cookie",
+  "set-cookie",
+  "host",
+  "origin",
+  "referer",
+  "referrer",
+  "connection",
+  "keep-alive",
+  "transfer-encoding",
+  "upgrade",
+  "content-length",
+  "te",
+  "trailer",
+  "x-mp-target",
+  "x-forwarded-proto",
+  "x-forwarded-host",
+  "x-forwarded-for",
+]);
+
+function parseExternalProxyUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(String(value || ""));
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  const parts = parsed.pathname.split("/").filter(Boolean);
+  if (parts[0] === "p" && parts[2] === "__cors") return null;
+  return parsed;
+}
+
+function externalProxyHeaders(incoming, targetHost) {
+  /** @type {Record<string, string>} */
+  const headers = {};
+  if (incoming && typeof incoming === "object") {
+    for (const [key, value] of Object.entries(incoming)) {
+      const lower = String(key).toLowerCase();
+      if (EXTERNAL_PROXY_DROP_HEADERS.has(lower)) continue;
+      if (lower.startsWith("sec-fetch-")) continue;
+      if (typeof value === "string" && value) headers[key] = value;
+    }
+  }
+  headers.host = targetHost;
+  return headers;
+}
+
+function failExternalProxyHttp(id, error) {
+  proxyHttpReqs.delete(id);
+  bridgeSend({
+    type: "proxy.http.error",
+    id,
+    error: error instanceof Error ? error.message : String(error || "Upstream error"),
+  });
+}
+
+function streamExternalProxyHttp(id, res) {
+  const stream = randomBytes(8).toString("hex");
+  /** @type {Record<string, string>} */
+  const outHeaders = {};
+  for (const [key, value] of Object.entries(res.headers || {})) {
+    if (value == null) continue;
+    const lower = String(key).toLowerCase();
+    if (lower === "set-cookie" || lower === "cookie") continue;
+    outHeaders[key] = Array.isArray(value) ? value.join(", ") : String(value);
+  }
+  bridgeSend({
+    type: "proxy.http.start",
+    id,
+    stream,
+    status: res.statusCode || 502,
+    headers: outHeaders,
+  });
+  res.on("data", (chunk) => {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    for (let offset = 0; offset < buf.length; offset += PROXY_CHUNK_BYTES) {
+      const end = Math.min(offset + PROXY_CHUNK_BYTES, buf.length);
+      bridgeSend({
+        type: "proxy.http.chunk",
+        id,
+        stream,
+        data: Buffer.from(buf.subarray(offset, end)).toString("base64"),
+        eof: false,
+      });
+    }
+  });
+  res.on("end", () => {
+    proxyHttpReqs.delete(id);
+    bridgeSend({
+      type: "proxy.http.chunk",
+      id,
+      stream,
+      data: "",
+      eof: true,
+    });
+  });
+  res.on("error", (err) => {
+    failExternalProxyHttp(id, err);
+  });
+}
+
+function fetchExternalProxyUrl(entry, url, method, headers, body, redirectsLeft) {
+  const parsed = parseExternalProxyUrl(url);
+  if (!parsed) {
+    failExternalProxyHttp(entry.id, "Invalid external URL");
+    return;
+  }
+  const lib = parsed.protocol === "https:" ? https : http;
+  /** @type {Record<string, string>} */
+  const reqHeaders = { ...headers, host: parsed.host };
+  const sendBody =
+    body?.length && method !== "GET" && method !== "HEAD" ? body : null;
+  if (sendBody) reqHeaders["content-length"] = String(sendBody.length);
+  else delete reqHeaders["content-length"];
+
+  let req;
+  try {
+    req = lib.request(
+      {
+        protocol: parsed.protocol,
+        hostname: parsed.hostname,
+        port: parsed.port || undefined,
+        path: `${parsed.pathname}${parsed.search}`,
+        method,
+        headers: reqHeaders,
+      },
+      (res) => {
+        const status = res.statusCode || 502;
+        const loc = res.headers.location;
+        if (
+          loc &&
+          status >= 300 &&
+          status < 400 &&
+          redirectsLeft > 0
+        ) {
+          res.resume();
+          let next;
+          try {
+            next = new URL(loc, parsed).href;
+          } catch {
+            failExternalProxyHttp(entry.id, "Invalid redirect");
+            return;
+          }
+          const preserve = status === 307 || status === 308;
+          const nextMethod = preserve
+            ? method
+            : method === "HEAD"
+              ? "HEAD"
+              : "GET";
+          const nextBody =
+            preserve && nextMethod !== "GET" && nextMethod !== "HEAD"
+              ? body
+              : Buffer.alloc(0);
+          fetchExternalProxyUrl(
+            entry,
+            next,
+            nextMethod,
+            headers,
+            nextBody,
+            redirectsLeft - 1
+          );
+          return;
+        }
+        streamExternalProxyHttp(entry.id, res);
+      }
+    );
+  } catch (err) {
+    failExternalProxyHttp(entry.id, err);
+    return;
+  }
+  req.setTimeout(EXTERNAL_PROXY_TIMEOUT_MS, () => {
+    req.destroy(new Error("Upstream timeout"));
+  });
+  req.on("error", (err) => {
+    failExternalProxyHttp(entry.id, err);
+  });
+  entry.req = req;
+  if (sendBody) req.write(sendBody);
+  req.end();
+}
+
+function startExternalProxyHttp(entry) {
+  const body = Buffer.concat(entry.chunks || []);
+  fetchExternalProxyUrl(
+    entry,
+    entry.url,
+    entry.method,
+    entry.headers,
+    body,
+    EXTERNAL_PROXY_MAX_REDIRECTS
+  );
+}
+
+function handleExternalProxyHttpFromAdmin(msg) {
+  const id = typeof msg.id === "string" ? msg.id : "";
+  const parsed = parseExternalProxyUrl(msg.externalUrl);
+  if (!id) return;
+  if (!parsed) {
+    failExternalProxyHttp(id, "Invalid external URL");
+    return;
+  }
+  const existing = proxyHttpReqs.get(id);
+  if (existing) {
+    destroyProxyHttpReq(existing);
+    proxyHttpReqs.delete(id);
+  }
+  const method = String(msg.method || "GET").toUpperCase();
+  const initialBody =
+    typeof msg.body === "string" && msg.body
+      ? Buffer.from(msg.body, "base64")
+      : null;
+  const entry = {
+    req: null,
+    external: true,
+    id,
+    url: parsed.href,
+    method,
+    headers: externalProxyHeaders(msg.headers, parsed.host),
+    chunks: [],
+  };
+  proxyHttpReqs.set(id, entry);
+  if (initialBody?.length) entry.chunks.push(initialBody);
+  if (msg.bodyEof !== false) startExternalProxyHttp(entry);
+}
+
 function handleProxyHttpFromAdmin(msg) {
   const id = typeof msg.id === "string" ? msg.id : "";
   const sandboxId = typeof msg.sandboxId === "string" ? msg.sandboxId : "";
@@ -2490,6 +2723,10 @@ function handleProxyHttpFromAdmin(msg) {
     });
     return;
   }
+  if (typeof msg.externalUrl === "string" && msg.externalUrl.trim()) {
+    handleExternalProxyHttpFromAdmin(msg);
+    return;
+  }
   if (isAiServerAppId(appId, ws)) {
     void handleAiProxyHttpFromAdmin(msg, ws);
     return;
@@ -2702,11 +2939,16 @@ function handleProxyHttpBodyFromAdmin(msg) {
   const id = typeof msg.id === "string" ? msg.id : "";
   const entry = proxyHttpReqs.get(id);
   if (!entry) return;
-  const req = entry.req || entry;
   const chunk =
     typeof msg.data === "string" && msg.data
       ? Buffer.from(msg.data, "base64")
       : null;
+  if (entry.external) {
+    if (chunk?.length) entry.chunks.push(chunk);
+    if (msg.eof === true) startExternalProxyHttp(entry);
+    return;
+  }
+  const req = entry.req || entry;
   if (entry.rewrite) {
     if (chunk?.length) entry.chunks.push(chunk);
     if (msg.eof === true) {

package/src/share-rewrite.mjs

@@ -155,11 +155,33 @@ function isImmutableAssetPath(path) {
   return (
     /\/_next\/static\//.test(p) ||
     /\/__nextjs_font\//.test(p) ||
-    /\/node_modules\/\.vite\//.test(p) ||
     /\.[0-9a-f]{8,}\.(?:js|css|woff2?)$/i.test(p)
   );
 }
 
+function isViteDevSourcePath(path) {
+  const raw = String(path || "");
+  const p = raw.split("?")[0] || "";
+  if (/[?&]t=\d+/.test(raw)) return true;
+  if (/\/(?:@vite(?:\/|$)|@react-refresh|@fs\/|@id\/)/.test(p)) return true;
+  if (/\/node_modules\/\.vite\//.test(p)) return true;
+  if (/\/src\//.test(p)) return true;
+  if (
+    /\.(?:m?[jt]sx?|vue|svelte|css|scss|sass|less)$/i.test(p) &&
+    !/\/node_modules\//.test(p)
+  ) {
+    return true;
+  }
+  return false;
+}
+
+function isDocumentPath(path) {
+  const p = String(path || "").split("?")[0] || "";
+  if (!p || p === "/") return true;
+  if (/\.html?$/i.test(p)) return true;
+  return !/\.[A-Za-z0-9]+$/.test(p);
+}
+
 function isNoStorePath(path) {
   const p = String(path || "").split("?")[0] || "";
   return (
@@ -169,11 +191,9 @@ function isNoStorePath(path) {
     /\/_next\/webpack-hmr/i.test(p) ||
     /\/_next\/webpack\/hmr/i.test(p) ||
     /\/__nextjs_original-stack-frames/i.test(p) ||
-    /\/@vite(?:\/|$)/.test(p) ||
-    /\/@react-refresh/.test(p) ||
-    /\/@fs\//.test(p) ||
-    /\/@id\//.test(p) ||
-    /\/__mp\//.test(p)
+    /\/__mp\//.test(p) ||
+    isViteDevSourcePath(path) ||
+    isDocumentPath(path)
   );
 }
 
@@ -396,12 +416,12 @@ export function shareTokenRoot(publicBase) {
   return prefix.endsWith("/") ? prefix : `${prefix}/`;
 }
 
-export function shareShimScript(pathPrefix, portUrls) {
-  return `(${shareProxyShim.toString()})(${JSON.stringify(pathPrefix || "")},${JSON.stringify(portUrls || {})},${rewriteMappedLocalUrls.toString()});`;
+export function shareShimScript(pathPrefix, portUrls, bypassCors) {
+  return `(${shareProxyShim.toString()})(${JSON.stringify(pathPrefix || "")},${JSON.stringify(portUrls || {})},${rewriteMappedLocalUrls.toString()},${JSON.stringify(Boolean(bypassCors))});`;
 }
 
-export function shareServiceWorkerScript(portUrls, tokenRoot) {
-  return `(${shareServiceWorkerMain.toString()})(${JSON.stringify(portUrls || {})},${JSON.stringify(tokenRoot || "/")},${rewriteMappedLocalUrls.toString()});`;
+export function shareServiceWorkerScript(portUrls, tokenRoot, bypassCors) {
+  return `(${shareServiceWorkerMain.toString()})(${JSON.stringify(portUrls || {})},${JSON.stringify(tokenRoot || "/")},${rewriteMappedLocalUrls.toString()},${JSON.stringify(Boolean(bypassCors))});`;
 }
 
 function rewriteHeaderUrls(headers, publicBase, port, portUrls) {
@@ -596,7 +616,7 @@ function gzipIfRequested(payload, headers, acceptEncoding) {
 
 function rewriteCacheKey(publicBase, path) {
   if (!isImmutableAssetPath(path) && !isLongCacheScriptPath(path)) return null;
-  return `${publicBase || ""}\0${String(path || "").split("?")[0]}`;
+  return `${publicBase || ""}\0${String(path || "")}`;
 }
 
 function rememberRewrite(key, payload, status, headers, etag) {
@@ -1003,10 +1023,11 @@ function injectMaintainerProEmbed(html, aiPublicBase) {
 /**
  * Intercept every browser request and map listed app ports onto share URLs.
  */
-function shareProxyShim(p, portMap, rewriteMappedLocalUrls) {
+function shareProxyShim(p, portMap, rewriteMappedLocalUrls, bypassCors) {
   if (!p || window.__MP_SHARE_SHIM__) return;
   window.__MP_SHARE_SHIM__ = 1;
   window.__MP_PORT_MAP__ = portMap || {};
+  window.__MP_BYPASS_CORS__ = Boolean(bypassCors);
   function rewriteText(text) {
     if (typeof text !== "string" || !text || typeof rewriteMappedLocalUrls !== "function") {
       return text;
@@ -1108,6 +1129,38 @@ function shareProxyShim(p, portMap, rewriteMappedLocalUrls) {
     } catch (e) {}
     return v;
   }
+  function isCorsProxyPath(pathname) {
+    var parts = String(pathname || "").split("/").filter(Boolean);
+    return parts[0] === "p" && parts[2] === "__cors";
+  }
+  function shareToken() {
+    try {
+      var parts = location.pathname.split("/").filter(Boolean);
+      if (parts[0] === "p" && parts[1]) return parts[1];
+    } catch (e) {}
+    return "";
+  }
+  function corsProxy(v) {
+    if (!bypassCors || typeof v !== "string" || !v) return v;
+    if (!/^(https?:)\/\//i.test(v)) return v;
+    try {
+      var u = new URL(v);
+      if (u.protocol !== "http:" && u.protocol !== "https:") return v;
+      if (loopback(u.hostname)) return v;
+      if (u.origin === location.origin) return v;
+      if (isCorsProxyPath(u.pathname)) return v;
+      var token = shareToken();
+      if (!token) return v;
+      return (
+        location.origin +
+        "/p/" +
+        token +
+        "/__cors?__mp_url=" +
+        encodeURIComponent(u.href)
+      );
+    } catch (e) {}
+    return v;
+  }
   function addNet(v) {
     if (typeof v !== "string" || !v) return v;
     var mapped = mapLocal(v);
@@ -1115,7 +1168,10 @@ function shareProxyShim(p, portMap, rewriteMappedLocalUrls) {
     if (/^(https?:|wss?:)\/\//i.test(v)) {
       try {
         var abs = new URL(v);
-        if (!loopback(abs.hostname)) return v;
+        if (!loopback(abs.hostname)) {
+          if (/^wss?:/i.test(abs.protocol)) return v;
+          return corsProxy(v);
+        }
       } catch (e) {}
     }
     if (v.charAt(0) === "/" && v.charAt(1) !== "/") {
@@ -1299,17 +1355,27 @@ function shareProxyShim(p, portMap, rewriteMappedLocalUrls) {
   try {
     var tokenRoot = p.replace(/\/[^/]+$/, "/");
     if (navigator.serviceWorker && tokenRoot.indexOf("/p/") === 0) {
-      navigator.serviceWorker.register(p + "/__mp/sw.js", { scope: tokenRoot });
+      navigator.serviceWorker.register(p + "/__mp/sw.js", {
+        scope: tokenRoot,
+        updateViaCache: "none",
+      });
     }
   } catch (e) {}
 }
 
-function shareServiceWorkerMain(portMap, tokenRoot, rewriteMappedLocalUrls) {
+function shareServiceWorkerMain(portMap, tokenRoot, rewriteMappedLocalUrls, bypassCors) {
   self.addEventListener("install", function (event) {
     event.waitUntil(self.skipWaiting());
   });
   self.addEventListener("activate", function (event) {
-    event.waitUntil(self.clients.claim());
+    event.waitUntil(
+      self.clients.claim().then(function () {
+        if (!self.caches) return;
+        return self.caches.keys().then(function (keys) {
+          return Promise.all(keys.map(function (key) { return self.caches.delete(key); }));
+        });
+      })
+    );
   });
   function rewriteText(text) {
     if (typeof text !== "string" || !text) return text;
@@ -1352,12 +1418,49 @@ function shareServiceWorkerMain(portMap, tokenRoot, rewriteMappedLocalUrls) {
     }
     return "";
   }
+  function isCorsProxyPath(pathname) {
+    var parts = String(pathname || "").split("/").filter(Boolean);
+    return parts[0] === "p" && parts[2] === "__cors";
+  }
+  function shareToken() {
+    try {
+      var parts = String(self.registration && self.registration.scope || self.location.pathname)
+        .split("/")
+        .filter(Boolean);
+      if (parts[0] === "p" && parts[1]) return parts[1];
+    } catch (e) {}
+    return "";
+  }
+  function corsProxy(v) {
+    if (!bypassCors || typeof v !== "string" || !v) return v;
+    if (!/^(https?:)\/\//i.test(v)) return v;
+    try {
+      var u = new URL(v, self.location.href);
+      if (u.protocol !== "http:" && u.protocol !== "https:") return v;
+      if (loopback(u.hostname)) return v;
+      if (u.origin === self.location.origin) return v;
+      if (isCorsProxyPath(u.pathname)) return v;
+      var token = shareToken();
+      if (!token) return v;
+      return (
+        self.location.origin +
+        "/p/" +
+        token +
+        "/__cors?__mp_url=" +
+        encodeURIComponent(u.href)
+      );
+    } catch (e) {}
+    return v;
+  }
   function prefixWith(url, prefix) {
-    if (!prefix) return url;
+    if (!prefix) return corsProxy(url);
     try {
       if (/^(https?:|wss?:)\/\//i.test(url)) {
         var abs = new URL(url);
-        if (!loopback(abs.hostname)) return url;
+        if (!loopback(abs.hostname)) {
+          if (/^wss?:/i.test(abs.protocol)) return url;
+          return corsProxy(url);
+        }
       }
       var u = new URL(url, self.location.href);
       var path = u.pathname || "/";
@@ -1382,11 +1485,13 @@ function shareServiceWorkerMain(portMap, tokenRoot, rewriteMappedLocalUrls) {
   function mapUrl(v, prefix) {
     if (typeof v !== "string" || !v) return v;
     if (v.indexOf("/__mp/") !== -1) return v;
+    if (v.indexOf("/__cors") !== -1) return v;
     return prefixWith(rewriteText(v), prefix);
   }
   self.addEventListener("fetch", function (event) {
     var req = event.request;
     if (req.url.indexOf("/__mp/") !== -1) return;
+    if (req.url.indexOf("/__cors") !== -1) return;
     event.respondWith(
       (async function () {
         var client = null;
@@ -1417,6 +1522,7 @@ function shareServiceWorkerMain(portMap, tokenRoot, rewriteMappedLocalUrls) {
           credentials: req.credentials,
           redirect: req.redirect,
           referrer: req.referrer,
+          cache: "no-store",
         };
         if (req.mode && req.mode !== "navigate") init.mode = req.mode;
         if (body !== undefined) init.body = body;