@mnemom/mnemom 0.17.2-next.2 → 0.17.2-next.4

package/dist/rc-proxy.mjs

@@ -13,9 +13,10 @@
 //
 // WHAT IT DOES
 //   * Listens on 127.0.0.1 (ephemeral port) as an HTTP CONNECT proxy.
-//   * Terminates TLS for api.anthropic.com ONLY, with an ephemeral CA + leaf minted at
-//     startup into a private 0700 tmpdir (CA key deleted right after signing, dir removed on
-//     exit). Every other host is tunnelled byte-for-byte (telemetry, Datadog, MCP servers…).
+//   * Terminates TLS for api.anthropic.com ONLY, with an ephemeral CA (397 days, key held in
+//     memory only) minted at startup into a private 0700 tmpdir (removed on exit), and a 7-day
+//     leaf re-minted every 24 h and hot-swapped (see below). Every other host is tunnelled
+//     byte-for-byte (telemetry, Datadog, MCP servers…).
 //   * Inside api.anthropic.com, only `POST /v1/messages[?…]` is rewritten to the Mnemom
 //     gateway door: the real Anthropic key rides as `x-api-key` (API-key billing), plus
 //     `x-mnemom-agent`, `x-mnemom-conversation-id`, and optionally `x-mnemom-api-key`,
@@ -79,6 +80,7 @@ import net from "node:net";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import crypto from "node:crypto";
 import { execFileSync } from "node:child_process";
 
 const MITM_HOST = "api.anthropic.com";
@@ -140,14 +142,27 @@ try {
 }
 if (!secrets.anthropic) die("the Anthropic key (stdin line 1) is empty");
 
-// --- ephemeral CA + leaf for api.anthropic.com ------------------------------------------
-// Private 0700 dir under the OS tmpdir; the CA key is deleted as soon as the leaf is signed
-// (only the leaf key is needed to serve sessions) and the whole dir goes on exit. Works with
-// macOS's system LibreSSL (3.3+) and OpenSSL 1.1.1+ (`-addext`).
+// --- ephemeral CA + rotating leaf for api.anthropic.com ---------------------------------
+// Private 0700 dir under the OS tmpdir, removed on exit. Claude Code reads NODE_EXTRA_CA_CERTS
+// once at process start, so the CA it trusts can never change mid-session: the CA is valid for
+// CA_DAYS and its private key lives in memory only (read into a Buffer, then deleted from disk).
+// The leaf is short-lived and re-minted from that key every LEAF_ROTATE_MS — and on demand when
+// it has under LEAF_MIN_LEFT_MS left — then hot-swapped with setSecureContext, so a running
+// session picks it up on its next TLS handshake. (A 2-day CA + leaf with the CA key deleted at
+// startup broke every session older than 48 h with "SSL certificate has expired".) openssl only
+// takes the CA key from a file, so each signing writes it 0600 into caDir and deletes it right
+// after. Works with macOS's system LibreSSL (3.3+) and OpenSSL 1.1.1+ (`-addext`).
+// MNEMOM_RC_LEAF_ROTATE_MS / MNEMOM_RC_LEAF_DAYS exist for tests only.
+const CA_DAYS = 397;
+const LEAF_DAYS = Number(env.MNEMOM_RC_LEAF_DAYS || 7);
+const LEAF_ROTATE_MS = Number(env.MNEMOM_RC_LEAF_ROTATE_MS || 24 * 60 * 60 * 1000);
+const LEAF_MIN_LEFT_MS = 24 * 60 * 60 * 1000;
 const caDir = fs.mkdtempSync(path.join(os.tmpdir(), "mnemom-code-rc-ca-"));
 fs.chmodSync(caDir, 0o700);
 const p = (f) => path.join(caDir, f);
+let rotateTimer = null;
 const cleanup = () => {
+  clearInterval(rotateTimer); // a no-op while still null
   try {
     fs.rmSync(caDir, { recursive: true, force: true });
   } catch {
@@ -156,8 +171,12 @@ const cleanup = () => {
 };
 process.on("exit", cleanup);
 for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) process.on(sig, () => process.exit(0));
+const ossl = (...a) => execFileSync("openssl", a, { stdio: ["ignore", "ignore", "pipe"] });
+// openssl's own stderr when it has any, else the error itself (spawn / fs failures).
+const osslErr = (e) => (e.stderr && e.stderr.length ? e.stderr.toString().trim() : e.message);
+
+let caKey; // Buffer — never on disk outside mintLeaf()'s signing call
 try {
-  const ossl = (...a) => execFileSync("openssl", a, { stdio: ["ignore", "ignore", "pipe"] });
   ossl(
     "req",
     "-x509",
@@ -171,7 +190,7 @@ try {
     "-out",
     p("ca.pem"),
     "-days",
-    "2",
+    String(CA_DAYS),
     "-subj",
     "/CN=mnemom agent local CA (ephemeral)",
     "-addext",
@@ -179,6 +198,19 @@ try {
     "-addext",
     "keyUsage=critical,keyCertSign,cRLSign",
   );
+  caKey = fs.readFileSync(p("ca.key"));
+  fs.rmSync(p("ca.key"));
+  fs.writeFileSync(
+    p("leaf.ext"),
+    `subjectAltName=DNS:${MITM_HOST}\nbasicConstraints=CA:FALSE\nkeyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\n`,
+  );
+} catch (e) {
+  fs.rmSync(p("ca.key"), { force: true });
+  die(`could not mint the ephemeral CA with openssl: ${osslErr(e)}`);
+}
+
+// Mint a fresh leaf key + cert signed by the in-memory CA key. Returns { key, cert, notAfter }.
+function mintLeaf() {
   ossl(
     "req",
     "-newkey",
@@ -193,32 +225,41 @@ try {
     "-subj",
     `/CN=${MITM_HOST}`,
   );
-  fs.writeFileSync(
-    p("leaf.ext"),
-    `subjectAltName=DNS:${MITM_HOST}\nbasicConstraints=CA:FALSE\nkeyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\n`,
-  );
-  ossl(
-    "x509",
-    "-req",
-    "-in",
-    p("leaf.csr"),
-    "-CA",
-    p("ca.pem"),
-    "-CAkey",
-    p("ca.key"),
-    "-CAcreateserial",
-    "-out",
-    p("leaf.pem"),
-    "-days",
-    "2",
-    "-extfile",
-    p("leaf.ext"),
-  );
-  fs.rmSync(p("ca.key"));
+  try {
+    fs.writeFileSync(p("ca.key"), caKey, { mode: 0o600, flag: "wx" });
+    ossl(
+      "x509",
+      "-req",
+      "-in",
+      p("leaf.csr"),
+      "-CA",
+      p("ca.pem"),
+      "-CAkey",
+      p("ca.key"),
+      "-CAcreateserial",
+      "-out",
+      p("leaf.pem"),
+      "-days",
+      String(LEAF_DAYS),
+      "-extfile",
+      p("leaf.ext"),
+    );
+  } finally {
+    fs.rmSync(p("ca.key"), { force: true });
+  }
+  const cert = fs.readFileSync(p("leaf.pem"));
+  return {
+    key: fs.readFileSync(p("leaf.key")),
+    cert,
+    notAfter: Date.parse(new crypto.X509Certificate(cert).validTo),
+  };
+}
+
+let leaf;
+try {
+  leaf = mintLeaf();
 } catch (e) {
-  die(
-    `could not mint the ephemeral CA with openssl: ${e.stderr ? e.stderr.toString() : e.message}`,
-  );
+  die(`could not mint the ephemeral CA with openssl: ${osslErr(e)}`);
 }
 
 // --- request handling ---------------------------------------------------------------------
@@ -299,6 +340,23 @@ const THREAD_400 = Buffer.from(
   }),
 );
 let localSeq = 0;
+
+// The Claude Code session ids seen on the /v1/messages leg (`x-claude-code-session-id`, not a
+// secret): each NEW one is logged once as `cc-session=<id>`, so the server shape (many sessions in
+// one proxy) gets a local conversation ↔ CC session record. Bounded; the id is clipped to a
+// uuid-ish charset so a hostile header cannot forge log lines.
+const CC_SESSION_SEEN_MAX = 256;
+const ccSessionsSeen = new Set();
+function noteCcSession(raw) {
+  const id = String(raw ?? "")
+    .replace(/[^A-Za-z0-9._:-]/g, "")
+    .slice(0, 64);
+  if (!id || ccSessionsSeen.has(id)) return;
+  if (ccSessionsSeen.size >= CC_SESSION_SEEN_MAX) ccSessionsSeen.clear();
+  ccSessionsSeen.add(id);
+  log(`cc-session=${id} conversation=${CONV}`);
+}
+
 function rejectThread(res, tag, thread) {
   res.writeHead(400, {
     "content-type": "application/json",
@@ -344,6 +402,7 @@ function handle(req, res, viaPlain) {
       path: GATEWAY.pathname.replace(/\/$/, "") + urlPath,
       agent: gatewayAgent,
     };
+    noteCcSession(headers["x-claude-code-session-id"]);
     delete headers.authorization; // the OAuth bearer stays local
     headers["x-api-key"] = secrets.anthropic;
     headers["x-mnemom-agent"] = AGENT;
@@ -398,10 +457,12 @@ function handle(req, res, viaPlain) {
       }
       ur.pipe(res);
       const goalRev = ur.headers["x-mnemom-goal-revision"];
+      const goalThread = ur.headers["x-mnemom-goal-thread"];
       const steer = ur.headers["x-mnemom-goal-steer"];
       const ident = toGateway
         ? ` agent=${ur.headers["x-mnemom-agent"] || "-"} verdict=${ur.headers["x-mnemom-goal-verdict"] || "-"}` +
           (goalRev ? ` goal-rev=${goalRev}` : "") +
+          (goalThread ? ` goal-thread=${goalThread}` : "") +
           (steer ? ` steer=${steer}` : "")
         : "";
       ur.on("end", () => {
@@ -459,18 +520,33 @@ function handle(req, res, viaPlain) {
   }
 }
 
-const tlsServer = https.createServer(
-  { key: fs.readFileSync(p("leaf.key")), cert: fs.readFileSync(p("leaf.pem")) },
-  (req, res) => handle(req, res, false),
+const tlsServer = https.createServer({ key: leaf.key, cert: leaf.cert }, (req, res) =>
+  handle(req, res, false),
 );
 tlsServer.on("tlsClientError", (e) => log(`tls client error: ${e.code || e.message}`));
 
+// Re-mint the leaf and hot-swap it; established TLS connections keep the old one, every new
+// handshake gets the new one. A failed re-mint keeps serving the current leaf.
+function rotateLeaf(why) {
+  try {
+    leaf = mintLeaf();
+    tlsServer.setSecureContext({ key: leaf.key, cert: leaf.cert });
+    log(`leaf rotated (${why}) notAfter=${new Date(leaf.notAfter).toISOString()}`);
+  } catch (e) {
+    log(`leaf rotation FAILED (${why}), keeping the current leaf: ${osslErr(e)}`);
+  }
+}
+rotateTimer = setInterval(() => rotateLeaf("interval"), LEAF_ROTATE_MS);
+rotateTimer.unref();
+
 const proxy = http.createServer((req, res) => handle(req, res, true));
 proxy.on("connect", (req, sock, head) => {
   const [host, portStr] = req.url.split(":");
   const port = Number(portStr || 443);
   sock.on("error", () => {});
   if (host === MITM_HOST && port === 443) {
+    // A timer can run late (laptop sleep): never hand out a leaf that is about to expire.
+    if (leaf.notAfter - Date.now() < LEAF_MIN_LEFT_MS) rotateLeaf("expiring");
     sock.write("HTTP/1.1 200 Connection Established\r\n\r\n");
     if (head && head.length) sock.unshift(head);
     tlsServer.emit("connection", sock);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.2-next.2",
+  "version": "0.17.2-next.4",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {