@maintainer-pro/ai-bridge 0.1.23 → 0.1.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maintainer-pro/ai-bridge",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "Local bridge daemon that pairs a machine to Maintainer Pro and configures multiple client sandboxes.",
   "keywords": [
     "maintainer-pro",

package/src/cors-cookies.mjs

@@ -0,0 +1,274 @@
+/**
+ * Cookie jar for Bypass CORS. The browser talks to /p/{token}/__cors
+ * (admin origin), so it never sends the remote API's cookies. The bridge
+ * stores Set-Cookie from those hosts and attaches them on the next hop.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const MAX_COOKIES_PER_SANDBOX = 80;
+const FILE_NAME = "cors-cookies.json";
+
+/** @type {Map<string, CookieRecord[]>} */
+const jars = new Map();
+
+/**
+ * @typedef {{
+ *   name: string,
+ *   value: string,
+ *   domain: string,
+ *   path: string,
+ *   expires: number | null,
+ *   secure: boolean,
+ *   hostOnly: boolean,
+ * }} CookieRecord
+ */
+
+function homeDir() {
+  const override = String(process.env.MAINTAINER_PRO_HOME || "").trim();
+  return override || path.join(os.homedir(), ".maintainer-pro");
+}
+
+function sanitizeId(id) {
+  return String(id || "")
+    .trim()
+    .replace(/[^\w.-]+/g, "_")
+    .slice(0, 80);
+}
+
+function jarPath(sandboxId) {
+  const id = sanitizeId(sandboxId);
+  if (!id) return "";
+  return path.join(homeDir(), "projects", id, FILE_NAME);
+}
+
+function cookieKey(cookie) {
+  return `${cookie.name}\0${cookie.domain}\0${cookie.path}`;
+}
+
+function isExpired(cookie, now = Date.now()) {
+  return cookie.expires != null && cookie.expires <= now;
+}
+
+function hostMatches(hostname, cookie) {
+  const host = String(hostname || "").toLowerCase();
+  const domain = String(cookie.domain || "").toLowerCase();
+  if (!host || !domain) return false;
+  if (cookie.hostOnly) return host === domain;
+  return host === domain || host.endsWith(`.${domain}`);
+}
+
+function pathMatches(pathname, cookiePath) {
+  const pathName = pathname || "/";
+  const prefix = cookiePath || "/";
+  if (prefix === "/") return true;
+  if (pathName === prefix) return true;
+  const dir = prefix.endsWith("/") ? prefix : `${prefix}/`;
+  return pathName.startsWith(dir);
+}
+
+function domainAllowedForHost(host, domain) {
+  const h = String(host || "").toLowerCase();
+  const d = String(domain || "").replace(/^\./, "").toLowerCase();
+  if (!h || !d) return false;
+  return h === d || h.endsWith(`.${d}`);
+}
+
+function loadJar(sandboxId) {
+  const id = sanitizeId(sandboxId);
+  if (!id) return [];
+  if (jars.has(id)) return jars.get(id) || [];
+  let list = [];
+  const file = jarPath(id);
+  try {
+    if (file && fs.existsSync(file)) {
+      const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+      if (Array.isArray(raw)) {
+        list = raw.filter((row) => row && typeof row.name === "string");
+      }
+    }
+  } catch {
+    list = [];
+  }
+  const now = Date.now();
+  list = list.filter((row) => !isExpired(row, now));
+  jars.set(id, list);
+  return list;
+}
+
+function saveJar(sandboxId, list) {
+  const id = sanitizeId(sandboxId);
+  if (!id) return;
+  const now = Date.now();
+  const next = list.filter((row) => !isExpired(row, now)).slice(-MAX_COOKIES_PER_SANDBOX);
+  jars.set(id, next);
+  const file = jarPath(id);
+  if (!file) return;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(next)}\n`, "utf8");
+  } catch {
+    /* ignore */
+  }
+}
+
+/**
+ * @param {string} raw
+ * @param {URL} requestUrl
+ * @returns {CookieRecord | null}
+ */
+export function parseSetCookie(raw, requestUrl) {
+  const parts = String(raw || "")
+    .split(";")
+    .map((part) => part.trim())
+    .filter(Boolean);
+  if (!parts.length) return null;
+  const nv = parts[0];
+  const eq = nv.indexOf("=");
+  if (eq <= 0) return null;
+  const name = nv.slice(0, eq).trim();
+  const value = nv.slice(eq + 1).trim();
+  if (!name) return null;
+
+  const host = String(requestUrl.hostname || "").toLowerCase();
+  /** @type {CookieRecord} */
+  const cookie = {
+    name,
+    value,
+    domain: host,
+    path: "/",
+    expires: null,
+    secure: false,
+    hostOnly: true,
+  };
+
+  for (let i = 1; i < parts.length; i++) {
+    const part = parts[i];
+    const ieq = part.indexOf("=");
+    const key = (ieq >= 0 ? part.slice(0, ieq) : part).trim().toLowerCase();
+    const val = ieq >= 0 ? part.slice(ieq + 1).trim() : "";
+    if (key === "domain" && val) {
+      const domain = val.replace(/^\./, "").toLowerCase();
+      if (domainAllowedForHost(host, domain)) {
+        cookie.domain = domain;
+        cookie.hostOnly = false;
+      }
+    } else if (key === "path" && val.startsWith("/")) {
+      cookie.path = val;
+    } else if (key === "max-age") {
+      const n = Number(val);
+      if (Number.isFinite(n)) cookie.expires = Date.now() + n * 1000;
+    } else if (key === "expires") {
+      const t = Date.parse(val);
+      if (Number.isFinite(t)) cookie.expires = t;
+    } else if (key === "secure") {
+      cookie.secure = true;
+    }
+  }
+  return cookie;
+}
+
+function headerValues(headers, name) {
+  if (!headers || typeof headers !== "object") return [];
+  const lower = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (String(key).toLowerCase() !== lower || value == null) continue;
+    return Array.isArray(value) ? value.map(String) : [String(value)];
+  }
+  return [];
+}
+
+/**
+ * @param {string} sandboxId
+ * @param {URL} requestUrl
+ * @param {Record<string, unknown>} headers
+ */
+export function storeCorsCookies(sandboxId, requestUrl, headers) {
+  if (!sandboxId || !requestUrl) return;
+  const lines = headerValues(headers, "set-cookie");
+  if (!lines.length) return;
+  const list = loadJar(sandboxId);
+  const byKey = new Map(list.map((row) => [cookieKey(row), row]));
+  for (const line of lines) {
+    const cookie = parseSetCookie(line, requestUrl);
+    if (!cookie) continue;
+    const key = cookieKey(cookie);
+    if (!cookie.value || isExpired(cookie)) {
+      byKey.delete(key);
+      continue;
+    }
+    byKey.set(key, cookie);
+  }
+  saveJar(sandboxId, [...byKey.values()]);
+}
+
+/**
+ * @param {string} sandboxId
+ * @param {URL} requestUrl
+ */
+export function cookieHeaderForUrl(sandboxId, requestUrl) {
+  if (!sandboxId || !requestUrl) return "";
+  const list = loadJar(sandboxId);
+  const now = Date.now();
+  const https = requestUrl.protocol === "https:";
+  const pathName = requestUrl.pathname || "/";
+  const matching = [];
+  const kept = [];
+  for (const cookie of list) {
+    if (isExpired(cookie, now)) continue;
+    kept.push(cookie);
+    if (cookie.secure && !https) continue;
+    if (!hostMatches(requestUrl.hostname, cookie)) continue;
+    if (!pathMatches(pathName, cookie.path)) continue;
+    matching.push(cookie);
+  }
+  if (kept.length !== list.length) saveJar(sandboxId, kept);
+  matching.sort((a, b) => String(b.path).length - String(a.path).length);
+  return matching.map((cookie) => `${cookie.name}=${cookie.value}`).join("; ");
+}
+
+/**
+ * Parse a Cookie request header into name → value.
+ * @param {string} raw
+ */
+export function parseCookieHeader(raw) {
+  /** @type {Map<string, string>} */
+  const out = new Map();
+  for (const part of String(raw || "").split(";")) {
+    const eq = part.indexOf("=");
+    if (eq <= 0) continue;
+    const name = part.slice(0, eq).trim();
+    const value = part.slice(eq + 1).trim();
+    if (name) out.set(name, value);
+  }
+  return out;
+}
+
+/**
+ * Merge browser cookies (Maintainer Pro share origin, e.g. mp_session)
+ * with jar cookies for the remote host. `mp_*` always come from the
+ * browser. Other names: jar wins, then any leftover browser cookies.
+ * @param {string} incoming
+ * @param {string} jar
+ */
+export function mergeCookieHeader(incoming, jar) {
+  const browser = parseCookieHeader(incoming);
+  const stored = parseCookieHeader(jar);
+  /** @type {Map<string, string>} */
+  const merged = new Map();
+  for (const [name, value] of browser) {
+    if (name.toLowerCase().startsWith("mp_")) merged.set(name, value);
+  }
+  for (const [name, value] of stored) {
+    if (name.toLowerCase().startsWith("mp_") && merged.has(name)) continue;
+    merged.set(name, value);
+  }
+  for (const [name, value] of browser) {
+    if (merged.has(name)) continue;
+    merged.set(name, value);
+  }
+  return [...merged.entries()]
+    .map(([name, value]) => `${name}=${value}`)
+    .join("; ");
+}

package/src/daemon.mjs

@@ -38,6 +38,11 @@ import {
   leftoverStateKeys,
   LEGACY_TUNNEL_FILE,
 } from "./discarded-tunnels.mjs";
+import {
+  cookieHeaderForUrl,
+  mergeCookieHeader,
+  storeCorsCookies,
+} from "./cors-cookies.mjs";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const requireFromHere = createRequire(import.meta.url);
@@ -2309,6 +2314,7 @@ function shareProxyContext(msg, ws, appId) {
     acceptEncoding,
     port: localPortForProxy(ws, appId),
     portUrls: { ...fromWs, ...fromMsg },
+    bypassCors: msg?.bypassCors === true,
   };
 }
 
@@ -2342,9 +2348,13 @@ function replyShareInterceptor(id, ctx, path) {
   let body = "";
   if (pathname === "/__mp/sw.js") {
     headers["service-worker-allowed"] = tokenRoot;
-    body = shareServiceWorkerScript(ctx.portUrls, tokenRoot);
+    body = shareServiceWorkerScript(ctx.portUrls, tokenRoot, ctx.bypassCors);
   } else {
-    body = shareShimScript(publicPathPrefix(ctx.publicBase), ctx.portUrls);
+    body = shareShimScript(
+      publicPathPrefix(ctx.publicBase),
+      ctx.portUrls,
+      ctx.bypassCors
+    );
   }
   replyProxyHttp(id, 200, headers, body);
   return true;
@@ -2476,6 +2486,252 @@ async function handleAiProxyHttpFromAdmin(msg, ws) {
   });
 }
 
+const EXTERNAL_PROXY_TIMEOUT_MS = 10 * 60 * 1000;
+const EXTERNAL_PROXY_MAX_REDIRECTS = 5;
+const EXTERNAL_PROXY_DROP_HEADERS = new Set([
+  "cookie",
+  "set-cookie",
+  "host",
+  "origin",
+  "referer",
+  "referrer",
+  "connection",
+  "keep-alive",
+  "transfer-encoding",
+  "upgrade",
+  "content-length",
+  "te",
+  "trailer",
+  "x-mp-target",
+  "x-forwarded-proto",
+  "x-forwarded-host",
+  "x-forwarded-for",
+]);
+
+function parseExternalProxyUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(String(value || ""));
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  const parts = parsed.pathname.split("/").filter(Boolean);
+  if (parts[0] === "p" && parts[2] === "__cors") return null;
+  return parsed;
+}
+
+function incomingCookieHeader(incoming) {
+  if (!incoming || typeof incoming !== "object") return "";
+  for (const [key, value] of Object.entries(incoming)) {
+    if (String(key).toLowerCase() !== "cookie") continue;
+    if (typeof value === "string" && value.trim()) return value;
+  }
+  return "";
+}
+
+function externalProxyHeaders(incoming, targetHost) {
+  /** @type {Record<string, string>} */
+  const headers = {};
+  if (incoming && typeof incoming === "object") {
+    for (const [key, value] of Object.entries(incoming)) {
+      const lower = String(key).toLowerCase();
+      if (EXTERNAL_PROXY_DROP_HEADERS.has(lower)) continue;
+      if (lower.startsWith("sec-fetch-")) continue;
+      if (typeof value === "string" && value) headers[key] = value;
+    }
+  }
+  headers.host = targetHost;
+  return headers;
+}
+
+function failExternalProxyHttp(id, error) {
+  proxyHttpReqs.delete(id);
+  bridgeSend({
+    type: "proxy.http.error",
+    id,
+    error: error instanceof Error ? error.message : String(error || "Upstream error"),
+  });
+}
+
+function streamExternalProxyHttp(id, res) {
+  const stream = randomBytes(8).toString("hex");
+  /** @type {Record<string, string>} */
+  const outHeaders = {};
+  for (const [key, value] of Object.entries(res.headers || {})) {
+    if (value == null) continue;
+    const lower = String(key).toLowerCase();
+    if (lower === "set-cookie" || lower === "cookie") continue;
+    outHeaders[key] = Array.isArray(value) ? value.join(", ") : String(value);
+  }
+  bridgeSend({
+    type: "proxy.http.start",
+    id,
+    stream,
+    status: res.statusCode || 502,
+    headers: outHeaders,
+  });
+  res.on("data", (chunk) => {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    for (let offset = 0; offset < buf.length; offset += PROXY_CHUNK_BYTES) {
+      const end = Math.min(offset + PROXY_CHUNK_BYTES, buf.length);
+      bridgeSend({
+        type: "proxy.http.chunk",
+        id,
+        stream,
+        data: Buffer.from(buf.subarray(offset, end)).toString("base64"),
+        eof: false,
+      });
+    }
+  });
+  res.on("end", () => {
+    proxyHttpReqs.delete(id);
+    bridgeSend({
+      type: "proxy.http.chunk",
+      id,
+      stream,
+      data: "",
+      eof: true,
+    });
+  });
+  res.on("error", (err) => {
+    failExternalProxyHttp(id, err);
+  });
+}
+
+function fetchExternalProxyUrl(entry, url, method, headers, body, redirectsLeft) {
+  const parsed = parseExternalProxyUrl(url);
+  if (!parsed) {
+    failExternalProxyHttp(entry.id, "Invalid external URL");
+    return;
+  }
+  const lib = parsed.protocol === "https:" ? https : http;
+  /** @type {Record<string, string>} */
+  const reqHeaders = { ...headers, host: parsed.host };
+  const cookie = mergeCookieHeader(
+    entry.incomingCookie || "",
+    cookieHeaderForUrl(entry.sandboxId, parsed)
+  );
+  if (cookie) reqHeaders.cookie = cookie;
+  else delete reqHeaders.cookie;
+  const sendBody =
+    body?.length && method !== "GET" && method !== "HEAD" ? body : null;
+  if (sendBody) reqHeaders["content-length"] = String(sendBody.length);
+  else delete reqHeaders["content-length"];
+
+  let req;
+  try {
+    req = lib.request(
+      {
+        protocol: parsed.protocol,
+        hostname: parsed.hostname,
+        port: parsed.port || undefined,
+        path: `${parsed.pathname}${parsed.search}`,
+        method,
+        headers: reqHeaders,
+      },
+      (res) => {
+        storeCorsCookies(entry.sandboxId, parsed, res.headers);
+        const status = res.statusCode || 502;
+        const loc = res.headers.location;
+        if (
+          loc &&
+          status >= 300 &&
+          status < 400 &&
+          redirectsLeft > 0
+        ) {
+          res.resume();
+          let next;
+          try {
+            next = new URL(loc, parsed).href;
+          } catch {
+            failExternalProxyHttp(entry.id, "Invalid redirect");
+            return;
+          }
+          const preserve = status === 307 || status === 308;
+          const nextMethod = preserve
+            ? method
+            : method === "HEAD"
+              ? "HEAD"
+              : "GET";
+          const nextBody =
+            preserve && nextMethod !== "GET" && nextMethod !== "HEAD"
+              ? body
+              : Buffer.alloc(0);
+          fetchExternalProxyUrl(
+            entry,
+            next,
+            nextMethod,
+            headers,
+            nextBody,
+            redirectsLeft - 1
+          );
+          return;
+        }
+        streamExternalProxyHttp(entry.id, res);
+      }
+    );
+  } catch (err) {
+    failExternalProxyHttp(entry.id, err);
+    return;
+  }
+  req.setTimeout(EXTERNAL_PROXY_TIMEOUT_MS, () => {
+    req.destroy(new Error("Upstream timeout"));
+  });
+  req.on("error", (err) => {
+    failExternalProxyHttp(entry.id, err);
+  });
+  entry.req = req;
+  if (sendBody) req.write(sendBody);
+  req.end();
+}
+
+function startExternalProxyHttp(entry) {
+  const body = Buffer.concat(entry.chunks || []);
+  fetchExternalProxyUrl(
+    entry,
+    entry.url,
+    entry.method,
+    entry.headers,
+    body,
+    EXTERNAL_PROXY_MAX_REDIRECTS
+  );
+}
+
+function handleExternalProxyHttpFromAdmin(msg) {
+  const id = typeof msg.id === "string" ? msg.id : "";
+  const parsed = parseExternalProxyUrl(msg.externalUrl);
+  if (!id) return;
+  if (!parsed) {
+    failExternalProxyHttp(id, "Invalid external URL");
+    return;
+  }
+  const existing = proxyHttpReqs.get(id);
+  if (existing) {
+    destroyProxyHttpReq(existing);
+    proxyHttpReqs.delete(id);
+  }
+  const method = String(msg.method || "GET").toUpperCase();
+  const initialBody =
+    typeof msg.body === "string" && msg.body
+      ? Buffer.from(msg.body, "base64")
+      : null;
+  const entry = {
+    req: null,
+    external: true,
+    id,
+    sandboxId: typeof msg.sandboxId === "string" ? msg.sandboxId : "",
+    incomingCookie: incomingCookieHeader(msg.headers),
+    url: parsed.href,
+    method,
+    headers: externalProxyHeaders(msg.headers, parsed.host),
+    chunks: [],
+  };
+  proxyHttpReqs.set(id, entry);
+  if (initialBody?.length) entry.chunks.push(initialBody);
+  if (msg.bodyEof !== false) startExternalProxyHttp(entry);
+}
+
 function handleProxyHttpFromAdmin(msg) {
   const id = typeof msg.id === "string" ? msg.id : "";
   const sandboxId = typeof msg.sandboxId === "string" ? msg.sandboxId : "";
@@ -2490,6 +2746,10 @@ function handleProxyHttpFromAdmin(msg) {
     });
     return;
   }
+  if (typeof msg.externalUrl === "string" && msg.externalUrl.trim()) {
+    handleExternalProxyHttpFromAdmin(msg);
+    return;
+  }
   if (isAiServerAppId(appId, ws)) {
     void handleAiProxyHttpFromAdmin(msg, ws);
     return;
@@ -2702,11 +2962,16 @@ function handleProxyHttpBodyFromAdmin(msg) {
   const id = typeof msg.id === "string" ? msg.id : "";
   const entry = proxyHttpReqs.get(id);
   if (!entry) return;
-  const req = entry.req || entry;
   const chunk =
     typeof msg.data === "string" && msg.data
       ? Buffer.from(msg.data, "base64")
       : null;
+  if (entry.external) {
+    if (chunk?.length) entry.chunks.push(chunk);
+    if (msg.eof === true) startExternalProxyHttp(entry);
+    return;
+  }
+  const req = entry.req || entry;
   if (entry.rewrite) {
     if (chunk?.length) entry.chunks.push(chunk);
     if (msg.eof === true) {

package/src/share-rewrite.mjs

@@ -155,11 +155,33 @@ function isImmutableAssetPath(path) {
   return (
     /\/_next\/static\//.test(p) ||
     /\/__nextjs_font\//.test(p) ||
-    /\/node_modules\/\.vite\//.test(p) ||
     /\.[0-9a-f]{8,}\.(?:js|css|woff2?)$/i.test(p)
   );
 }
 
+function isViteDevSourcePath(path) {
+  const raw = String(path || "");
+  const p = raw.split("?")[0] || "";
+  if (/[?&]t=\d+/.test(raw)) return true;
+  if (/\/(?:@vite(?:\/|$)|@react-refresh|@fs\/|@id\/)/.test(p)) return true;
+  if (/\/node_modules\/\.vite\//.test(p)) return true;
+  if (/\/src\//.test(p)) return true;
+  if (
+    /\.(?:m?[jt]sx?|vue|svelte|css|scss|sass|less)$/i.test(p) &&
+    !/\/node_modules\//.test(p)
+  ) {
+    return true;
+  }
+  return false;
+}
+
+function isDocumentPath(path) {
+  const p = String(path || "").split("?")[0] || "";
+  if (!p || p === "/") return true;
+  if (/\.html?$/i.test(p)) return true;
+  return !/\.[A-Za-z0-9]+$/.test(p);
+}
+
 function isNoStorePath(path) {
   const p = String(path || "").split("?")[0] || "";
   return (
@@ -169,11 +191,9 @@ function isNoStorePath(path) {
     /\/_next\/webpack-hmr/i.test(p) ||
     /\/_next\/webpack\/hmr/i.test(p) ||
     /\/__nextjs_original-stack-frames/i.test(p) ||
-    /\/@vite(?:\/|$)/.test(p) ||
-    /\/@react-refresh/.test(p) ||
-    /\/@fs\//.test(p) ||
-    /\/@id\//.test(p) ||
-    /\/__mp\//.test(p)
+    /\/__mp\//.test(p) ||
+    isViteDevSourcePath(path) ||
+    isDocumentPath(path)
   );
 }
 
@@ -396,12 +416,12 @@ export function shareTokenRoot(publicBase) {
   return prefix.endsWith("/") ? prefix : `${prefix}/`;
 }
 
-export function shareShimScript(pathPrefix, portUrls) {
-  return `(${shareProxyShim.toString()})(${JSON.stringify(pathPrefix || "")},${JSON.stringify(portUrls || {})},${rewriteMappedLocalUrls.toString()});`;
+export function shareShimScript(pathPrefix, portUrls, bypassCors) {
+  return `(${shareProxyShim.toString()})(${JSON.stringify(pathPrefix || "")},${JSON.stringify(portUrls || {})},${rewriteMappedLocalUrls.toString()},${JSON.stringify(Boolean(bypassCors))});`;
 }
 
-export function shareServiceWorkerScript(portUrls, tokenRoot) {
-  return `(${shareServiceWorkerMain.toString()})(${JSON.stringify(portUrls || {})},${JSON.stringify(tokenRoot || "/")},${rewriteMappedLocalUrls.toString()});`;
+export function shareServiceWorkerScript(portUrls, tokenRoot, bypassCors) {
+  return `(${shareServiceWorkerMain.toString()})(${JSON.stringify(portUrls || {})},${JSON.stringify(tokenRoot || "/")},${rewriteMappedLocalUrls.toString()},${JSON.stringify(Boolean(bypassCors))});`;
 }
 
 function rewriteHeaderUrls(headers, publicBase, port, portUrls) {
@@ -596,7 +616,7 @@ function gzipIfRequested(payload, headers, acceptEncoding) {
 
 function rewriteCacheKey(publicBase, path) {
   if (!isImmutableAssetPath(path) && !isLongCacheScriptPath(path)) return null;
-  return `${publicBase || ""}\0${String(path || "").split("?")[0]}`;
+  return `${publicBase || ""}\0${String(path || "")}`;
 }
 
 function rememberRewrite(key, payload, status, headers, etag) {
@@ -1003,10 +1023,11 @@ function injectMaintainerProEmbed(html, aiPublicBase) {
 /**
  * Intercept every browser request and map listed app ports onto share URLs.
  */
-function shareProxyShim(p, portMap, rewriteMappedLocalUrls) {
+function shareProxyShim(p, portMap, rewriteMappedLocalUrls, bypassCors) {
   if (!p || window.__MP_SHARE_SHIM__) return;
   window.__MP_SHARE_SHIM__ = 1;
   window.__MP_PORT_MAP__ = portMap || {};
+  window.__MP_BYPASS_CORS__ = Boolean(bypassCors);
   function rewriteText(text) {
     if (typeof text !== "string" || !text || typeof rewriteMappedLocalUrls !== "function") {
       return text;
@@ -1108,6 +1129,38 @@ function shareProxyShim(p, portMap, rewriteMappedLocalUrls) {
     } catch (e) {}
     return v;
   }
+  function isCorsProxyPath(pathname) {
+    var parts = String(pathname || "").split("/").filter(Boolean);
+    return parts[0] === "p" && parts[2] === "__cors";
+  }
+  function shareToken() {
+    try {
+      var parts = location.pathname.split("/").filter(Boolean);
+      if (parts[0] === "p" && parts[1]) return parts[1];
+    } catch (e) {}
+    return "";
+  }
+  function corsProxy(v) {
+    if (!bypassCors || typeof v !== "string" || !v) return v;
+    if (!/^(https?:)\/\//i.test(v)) return v;
+    try {
+      var u = new URL(v);
+      if (u.protocol !== "http:" && u.protocol !== "https:") return v;
+      if (loopback(u.hostname)) return v;
+      if (u.origin === location.origin) return v;
+      if (isCorsProxyPath(u.pathname)) return v;
+      var token = shareToken();
+      if (!token) return v;
+      return (
+        location.origin +
+        "/p/" +
+        token +
+        "/__cors?__mp_url=" +
+        encodeURIComponent(u.href)
+      );
+    } catch (e) {}
+    return v;
+  }
   function addNet(v) {
     if (typeof v !== "string" || !v) return v;
     var mapped = mapLocal(v);
@@ -1115,7 +1168,10 @@ function shareProxyShim(p, portMap, rewriteMappedLocalUrls) {
     if (/^(https?:|wss?:)\/\//i.test(v)) {
       try {
         var abs = new URL(v);
-        if (!loopback(abs.hostname)) return v;
+        if (!loopback(abs.hostname)) {
+          if (/^wss?:/i.test(abs.protocol)) return v;
+          return corsProxy(v);
+        }
       } catch (e) {}
     }
     if (v.charAt(0) === "/" && v.charAt(1) !== "/") {
@@ -1299,17 +1355,27 @@ function shareProxyShim(p, portMap, rewriteMappedLocalUrls) {
   try {
     var tokenRoot = p.replace(/\/[^/]+$/, "/");
     if (navigator.serviceWorker && tokenRoot.indexOf("/p/") === 0) {
-      navigator.serviceWorker.register(p + "/__mp/sw.js", { scope: tokenRoot });
+      navigator.serviceWorker.register(p + "/__mp/sw.js", {
+        scope: tokenRoot,
+        updateViaCache: "none",
+      });
     }
   } catch (e) {}
 }
 
-function shareServiceWorkerMain(portMap, tokenRoot, rewriteMappedLocalUrls) {
+function shareServiceWorkerMain(portMap, tokenRoot, rewriteMappedLocalUrls, bypassCors) {
   self.addEventListener("install", function (event) {
     event.waitUntil(self.skipWaiting());
   });
   self.addEventListener("activate", function (event) {
-    event.waitUntil(self.clients.claim());
+    event.waitUntil(
+      self.clients.claim().then(function () {
+        if (!self.caches) return;
+        return self.caches.keys().then(function (keys) {
+          return Promise.all(keys.map(function (key) { return self.caches.delete(key); }));
+        });
+      })
+    );
   });
   function rewriteText(text) {
     if (typeof text !== "string" || !text) return text;
@@ -1352,12 +1418,49 @@ function shareServiceWorkerMain(portMap, tokenRoot, rewriteMappedLocalUrls) {
     }
     return "";
   }
+  function isCorsProxyPath(pathname) {
+    var parts = String(pathname || "").split("/").filter(Boolean);
+    return parts[0] === "p" && parts[2] === "__cors";
+  }
+  function shareToken() {
+    try {
+      var parts = String(self.registration && self.registration.scope || self.location.pathname)
+        .split("/")
+        .filter(Boolean);
+      if (parts[0] === "p" && parts[1]) return parts[1];
+    } catch (e) {}
+    return "";
+  }
+  function corsProxy(v) {
+    if (!bypassCors || typeof v !== "string" || !v) return v;
+    if (!/^(https?:)\/\//i.test(v)) return v;
+    try {
+      var u = new URL(v, self.location.href);
+      if (u.protocol !== "http:" && u.protocol !== "https:") return v;
+      if (loopback(u.hostname)) return v;
+      if (u.origin === self.location.origin) return v;
+      if (isCorsProxyPath(u.pathname)) return v;
+      var token = shareToken();
+      if (!token) return v;
+      return (
+        self.location.origin +
+        "/p/" +
+        token +
+        "/__cors?__mp_url=" +
+        encodeURIComponent(u.href)
+      );
+    } catch (e) {}
+    return v;
+  }
   function prefixWith(url, prefix) {
-    if (!prefix) return url;
+    if (!prefix) return corsProxy(url);
     try {
       if (/^(https?:|wss?:)\/\//i.test(url)) {
         var abs = new URL(url);
-        if (!loopback(abs.hostname)) return url;
+        if (!loopback(abs.hostname)) {
+          if (/^wss?:/i.test(abs.protocol)) return url;
+          return corsProxy(url);
+        }
       }
       var u = new URL(url, self.location.href);
       var path = u.pathname || "/";
@@ -1382,11 +1485,13 @@ function shareServiceWorkerMain(portMap, tokenRoot, rewriteMappedLocalUrls) {
   function mapUrl(v, prefix) {
     if (typeof v !== "string" || !v) return v;
     if (v.indexOf("/__mp/") !== -1) return v;
+    if (v.indexOf("/__cors") !== -1) return v;
     return prefixWith(rewriteText(v), prefix);
   }
   self.addEventListener("fetch", function (event) {
     var req = event.request;
     if (req.url.indexOf("/__mp/") !== -1) return;
+    if (req.url.indexOf("/__cors") !== -1) return;
     event.respondWith(
       (async function () {
         var client = null;
@@ -1417,6 +1522,7 @@ function shareServiceWorkerMain(portMap, tokenRoot, rewriteMappedLocalUrls) {
           credentials: req.credentials,
           redirect: req.redirect,
           referrer: req.referrer,
+          cache: "no-store",
         };
         if (req.mode && req.mode !== "navigate") init.mode = req.mode;
         if (body !== undefined) init.body = body;