@maintainer-pro/ai-bridge 0.1.24 → 0.1.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maintainer-pro/ai-bridge",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "description": "Local bridge daemon that pairs a machine to Maintainer Pro and configures multiple client sandboxes.",
   "keywords": [
     "maintainer-pro",

package/src/cors-cookies.mjs

@@ -0,0 +1,274 @@
+/**
+ * Cookie jar for Bypass CORS. The browser talks to /p/{token}/__cors
+ * (admin origin), so it never sends the remote API's cookies. The bridge
+ * stores Set-Cookie from those hosts and attaches them on the next hop.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const MAX_COOKIES_PER_SANDBOX = 80;
+const FILE_NAME = "cors-cookies.json";
+
+/** @type {Map<string, CookieRecord[]>} */
+const jars = new Map();
+
+/**
+ * @typedef {{
+ *   name: string,
+ *   value: string,
+ *   domain: string,
+ *   path: string,
+ *   expires: number | null,
+ *   secure: boolean,
+ *   hostOnly: boolean,
+ * }} CookieRecord
+ */
+
+function homeDir() {
+  const override = String(process.env.MAINTAINER_PRO_HOME || "").trim();
+  return override || path.join(os.homedir(), ".maintainer-pro");
+}
+
+function sanitizeId(id) {
+  return String(id || "")
+    .trim()
+    .replace(/[^\w.-]+/g, "_")
+    .slice(0, 80);
+}
+
+function jarPath(sandboxId) {
+  const id = sanitizeId(sandboxId);
+  if (!id) return "";
+  return path.join(homeDir(), "projects", id, FILE_NAME);
+}
+
+function cookieKey(cookie) {
+  return `${cookie.name}\0${cookie.domain}\0${cookie.path}`;
+}
+
+function isExpired(cookie, now = Date.now()) {
+  return cookie.expires != null && cookie.expires <= now;
+}
+
+function hostMatches(hostname, cookie) {
+  const host = String(hostname || "").toLowerCase();
+  const domain = String(cookie.domain || "").toLowerCase();
+  if (!host || !domain) return false;
+  if (cookie.hostOnly) return host === domain;
+  return host === domain || host.endsWith(`.${domain}`);
+}
+
+function pathMatches(pathname, cookiePath) {
+  const pathName = pathname || "/";
+  const prefix = cookiePath || "/";
+  if (prefix === "/") return true;
+  if (pathName === prefix) return true;
+  const dir = prefix.endsWith("/") ? prefix : `${prefix}/`;
+  return pathName.startsWith(dir);
+}
+
+function domainAllowedForHost(host, domain) {
+  const h = String(host || "").toLowerCase();
+  const d = String(domain || "").replace(/^\./, "").toLowerCase();
+  if (!h || !d) return false;
+  return h === d || h.endsWith(`.${d}`);
+}
+
+function loadJar(sandboxId) {
+  const id = sanitizeId(sandboxId);
+  if (!id) return [];
+  if (jars.has(id)) return jars.get(id) || [];
+  let list = [];
+  const file = jarPath(id);
+  try {
+    if (file && fs.existsSync(file)) {
+      const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+      if (Array.isArray(raw)) {
+        list = raw.filter((row) => row && typeof row.name === "string");
+      }
+    }
+  } catch {
+    list = [];
+  }
+  const now = Date.now();
+  list = list.filter((row) => !isExpired(row, now));
+  jars.set(id, list);
+  return list;
+}
+
+function saveJar(sandboxId, list) {
+  const id = sanitizeId(sandboxId);
+  if (!id) return;
+  const now = Date.now();
+  const next = list.filter((row) => !isExpired(row, now)).slice(-MAX_COOKIES_PER_SANDBOX);
+  jars.set(id, next);
+  const file = jarPath(id);
+  if (!file) return;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(next)}\n`, "utf8");
+  } catch {
+    /* ignore */
+  }
+}
+
+/**
+ * @param {string} raw
+ * @param {URL} requestUrl
+ * @returns {CookieRecord | null}
+ */
+export function parseSetCookie(raw, requestUrl) {
+  const parts = String(raw || "")
+    .split(";")
+    .map((part) => part.trim())
+    .filter(Boolean);
+  if (!parts.length) return null;
+  const nv = parts[0];
+  const eq = nv.indexOf("=");
+  if (eq <= 0) return null;
+  const name = nv.slice(0, eq).trim();
+  const value = nv.slice(eq + 1).trim();
+  if (!name) return null;
+
+  const host = String(requestUrl.hostname || "").toLowerCase();
+  /** @type {CookieRecord} */
+  const cookie = {
+    name,
+    value,
+    domain: host,
+    path: "/",
+    expires: null,
+    secure: false,
+    hostOnly: true,
+  };
+
+  for (let i = 1; i < parts.length; i++) {
+    const part = parts[i];
+    const ieq = part.indexOf("=");
+    const key = (ieq >= 0 ? part.slice(0, ieq) : part).trim().toLowerCase();
+    const val = ieq >= 0 ? part.slice(ieq + 1).trim() : "";
+    if (key === "domain" && val) {
+      const domain = val.replace(/^\./, "").toLowerCase();
+      if (domainAllowedForHost(host, domain)) {
+        cookie.domain = domain;
+        cookie.hostOnly = false;
+      }
+    } else if (key === "path" && val.startsWith("/")) {
+      cookie.path = val;
+    } else if (key === "max-age") {
+      const n = Number(val);
+      if (Number.isFinite(n)) cookie.expires = Date.now() + n * 1000;
+    } else if (key === "expires") {
+      const t = Date.parse(val);
+      if (Number.isFinite(t)) cookie.expires = t;
+    } else if (key === "secure") {
+      cookie.secure = true;
+    }
+  }
+  return cookie;
+}
+
+function headerValues(headers, name) {
+  if (!headers || typeof headers !== "object") return [];
+  const lower = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (String(key).toLowerCase() !== lower || value == null) continue;
+    return Array.isArray(value) ? value.map(String) : [String(value)];
+  }
+  return [];
+}
+
+/**
+ * @param {string} sandboxId
+ * @param {URL} requestUrl
+ * @param {Record<string, unknown>} headers
+ */
+export function storeCorsCookies(sandboxId, requestUrl, headers) {
+  if (!sandboxId || !requestUrl) return;
+  const lines = headerValues(headers, "set-cookie");
+  if (!lines.length) return;
+  const list = loadJar(sandboxId);
+  const byKey = new Map(list.map((row) => [cookieKey(row), row]));
+  for (const line of lines) {
+    const cookie = parseSetCookie(line, requestUrl);
+    if (!cookie) continue;
+    const key = cookieKey(cookie);
+    if (!cookie.value || isExpired(cookie)) {
+      byKey.delete(key);
+      continue;
+    }
+    byKey.set(key, cookie);
+  }
+  saveJar(sandboxId, [...byKey.values()]);
+}
+
+/**
+ * @param {string} sandboxId
+ * @param {URL} requestUrl
+ */
+export function cookieHeaderForUrl(sandboxId, requestUrl) {
+  if (!sandboxId || !requestUrl) return "";
+  const list = loadJar(sandboxId);
+  const now = Date.now();
+  const https = requestUrl.protocol === "https:";
+  const pathName = requestUrl.pathname || "/";
+  const matching = [];
+  const kept = [];
+  for (const cookie of list) {
+    if (isExpired(cookie, now)) continue;
+    kept.push(cookie);
+    if (cookie.secure && !https) continue;
+    if (!hostMatches(requestUrl.hostname, cookie)) continue;
+    if (!pathMatches(pathName, cookie.path)) continue;
+    matching.push(cookie);
+  }
+  if (kept.length !== list.length) saveJar(sandboxId, kept);
+  matching.sort((a, b) => String(b.path).length - String(a.path).length);
+  return matching.map((cookie) => `${cookie.name}=${cookie.value}`).join("; ");
+}
+
+/**
+ * Parse a Cookie request header into name → value.
+ * @param {string} raw
+ */
+export function parseCookieHeader(raw) {
+  /** @type {Map<string, string>} */
+  const out = new Map();
+  for (const part of String(raw || "").split(";")) {
+    const eq = part.indexOf("=");
+    if (eq <= 0) continue;
+    const name = part.slice(0, eq).trim();
+    const value = part.slice(eq + 1).trim();
+    if (name) out.set(name, value);
+  }
+  return out;
+}
+
+/**
+ * Merge browser cookies (Maintainer Pro share origin, e.g. mp_session)
+ * with jar cookies for the remote host. `mp_*` always come from the
+ * browser. Other names: jar wins, then any leftover browser cookies.
+ * @param {string} incoming
+ * @param {string} jar
+ */
+export function mergeCookieHeader(incoming, jar) {
+  const browser = parseCookieHeader(incoming);
+  const stored = parseCookieHeader(jar);
+  /** @type {Map<string, string>} */
+  const merged = new Map();
+  for (const [name, value] of browser) {
+    if (name.toLowerCase().startsWith("mp_")) merged.set(name, value);
+  }
+  for (const [name, value] of stored) {
+    if (name.toLowerCase().startsWith("mp_") && merged.has(name)) continue;
+    merged.set(name, value);
+  }
+  for (const [name, value] of browser) {
+    if (merged.has(name)) continue;
+    merged.set(name, value);
+  }
+  return [...merged.entries()]
+    .map(([name, value]) => `${name}=${value}`)
+    .join("; ");
+}

package/src/daemon.mjs

@@ -38,6 +38,11 @@ import {
   leftoverStateKeys,
   LEGACY_TUNNEL_FILE,
 } from "./discarded-tunnels.mjs";
+import {
+  cookieHeaderForUrl,
+  mergeCookieHeader,
+  storeCorsCookies,
+} from "./cors-cookies.mjs";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const requireFromHere = createRequire(import.meta.url);
@@ -2516,6 +2521,15 @@ function parseExternalProxyUrl(value) {
   return parsed;
 }
 
+function incomingCookieHeader(incoming) {
+  if (!incoming || typeof incoming !== "object") return "";
+  for (const [key, value] of Object.entries(incoming)) {
+    if (String(key).toLowerCase() !== "cookie") continue;
+    if (typeof value === "string" && value.trim()) return value;
+  }
+  return "";
+}
+
 function externalProxyHeaders(incoming, targetHost) {
   /** @type {Record<string, string>} */
   const headers = {};
@@ -2594,6 +2608,12 @@ function fetchExternalProxyUrl(entry, url, method, headers, body, redirectsLeft)
   const lib = parsed.protocol === "https:" ? https : http;
   /** @type {Record<string, string>} */
   const reqHeaders = { ...headers, host: parsed.host };
+  const cookie = mergeCookieHeader(
+    entry.incomingCookie || "",
+    cookieHeaderForUrl(entry.sandboxId, parsed)
+  );
+  if (cookie) reqHeaders.cookie = cookie;
+  else delete reqHeaders.cookie;
   const sendBody =
     body?.length && method !== "GET" && method !== "HEAD" ? body : null;
   if (sendBody) reqHeaders["content-length"] = String(sendBody.length);
@@ -2611,6 +2631,7 @@ function fetchExternalProxyUrl(entry, url, method, headers, body, redirectsLeft)
         headers: reqHeaders,
       },
       (res) => {
+        storeCorsCookies(entry.sandboxId, parsed, res.headers);
         const status = res.statusCode || 502;
         const loc = res.headers.location;
         if (
@@ -2699,6 +2720,8 @@ function handleExternalProxyHttpFromAdmin(msg) {
     req: null,
     external: true,
     id,
+    sandboxId: typeof msg.sandboxId === "string" ? msg.sandboxId : "",
+    incomingCookie: incomingCookieHeader(msg.headers),
     url: parsed.href,
     method,
     headers: externalProxyHeaders(msg.headers, parsed.host),