@openape/proxy 0.4.3 → 0.4.5

package/dist/index.cjs

@@ -1,15 +1,130 @@
 #!/usr/bin/env node
 "use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 
 // src/index.ts
+var import_node_fs3 = require("fs");
 var import_node_http = require("http");
+var import_node_os = require("os");
+var import_node_path2 = require("path");
 var import_node_util = require("util");
 
-// src/config.ts
+// src/ca-store.ts
 var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_node_forge = __toESM(require("node-forge"), 1);
+function loadOrCreateCa(opts) {
+  if ((0, import_node_fs.existsSync)(opts.certPath) && (0, import_node_fs.existsSync)(opts.keyPath)) {
+    return {
+      certPem: (0, import_node_fs.readFileSync)(opts.certPath, "utf-8"),
+      keyPem: (0, import_node_fs.readFileSync)(opts.keyPath, "utf-8"),
+      created: false
+    };
+  }
+  const keys = import_node_forge.default.pki.rsa.generateKeyPair({ bits: 2048 });
+  const cert = import_node_forge.default.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = String(Date.now());
+  cert.validity.notBefore = /* @__PURE__ */ new Date();
+  cert.validity.notAfter = new Date(Date.now() + 10 * 365 * 864e5);
+  const attrs = [
+    // @types/node-forge types valueTagClass as asn1.Class, but node-forge's
+    // x509.js reads it as an asn1.Type at runtime (see comment above). Cast to
+    // satisfy the too-narrow typing without changing runtime behaviour.
+    { name: "commonName", value: opts.subjectCN, valueTagClass: import_node_forge.default.asn1.Type.UTF8 }
+  ];
+  cert.setSubject(attrs);
+  cert.setIssuer(attrs);
+  cert.setExtensions([
+    { name: "basicConstraints", cA: true },
+    { name: "keyUsage", keyCertSign: true, cRLSign: true },
+    { name: "subjectKeyIdentifier" }
+  ]);
+  cert.sign(keys.privateKey, import_node_forge.default.md.sha256.create());
+  const certPem = import_node_forge.default.pki.certificateToPem(cert);
+  const keyPem = import_node_forge.default.pki.privateKeyToPem(keys.privateKey);
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(opts.certPath), { recursive: true, mode: 448 });
+  (0, import_node_fs.writeFileSync)(opts.certPath, certPem, { mode: 384 });
+  (0, import_node_fs.writeFileSync)(opts.keyPath, keyPem, { mode: 384 });
+  return { certPem, keyPem, created: true };
+}
+function mintLeafCert(ca, hostname) {
+  const caCert = import_node_forge.default.pki.certificateFromPem(ca.certPem);
+  const caKey = import_node_forge.default.pki.privateKeyFromPem(ca.keyPem);
+  const keys = import_node_forge.default.pki.rsa.generateKeyPair({ bits: 2048 });
+  const cert = import_node_forge.default.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = `${Date.now()}${Math.floor(Math.random() * 1e6)}`;
+  cert.validity.notBefore = /* @__PURE__ */ new Date();
+  const expiresAt = Date.now() + 24 * 36e5;
+  cert.validity.notAfter = new Date(expiresAt);
+  cert.setSubject([
+    // See note in createCaCert: valueTagClass is an asn1.Type at runtime;
+    // cast around the too-narrow @types/node-forge annotation.
+    { name: "commonName", value: hostname, valueTagClass: import_node_forge.default.asn1.Type.UTF8 }
+  ]);
+  cert.setIssuer(caCert.subject.attributes);
+  cert.setExtensions([
+    { name: "basicConstraints", cA: false },
+    { name: "keyUsage", digitalSignature: true, keyEncipherment: true },
+    { name: "extKeyUsage", serverAuth: true },
+    { name: "subjectAltName", altNames: [{ type: 2, value: hostname }] }
+  ]);
+  cert.sign(caKey, import_node_forge.default.md.sha256.create());
+  return {
+    certPem: import_node_forge.default.pki.certificateToPem(cert),
+    keyPem: import_node_forge.default.pki.privateKeyToPem(keys.privateKey),
+    expiresAt
+  };
+}
+function createLeafCertCache(ca, opts) {
+  const cache = /* @__PURE__ */ new Map();
+  return {
+    get(hostname) {
+      const existing = cache.get(hostname);
+      if (existing && existing.expiresAt > Date.now()) {
+        cache.delete(hostname);
+        cache.set(hostname, existing);
+        return existing;
+      }
+      const fresh = mintLeafCert(ca, hostname);
+      cache.set(hostname, fresh);
+      while (cache.size > opts.capacity) {
+        const oldestKey = cache.keys().next().value;
+        if (oldestKey === void 0) break;
+        cache.delete(oldestKey);
+      }
+      return fresh;
+    }
+  };
+}
+
+// src/config.ts
+var import_node_fs2 = require("fs");
 var import_smol_toml = require("smol-toml");
 function loadMultiAgentConfig(path, overrides) {
-  const raw = (0, import_node_fs.readFileSync)(path, "utf-8");
+  const raw = (0, import_node_fs2.readFileSync)(path, "utf-8");
   let parsed;
   if (path.endsWith(".json")) {
     parsed = JSON.parse(raw);
@@ -68,26 +183,26 @@ function matchesRule(rule, domain, method, path) {
   }
   return true;
 }
-function evaluateRules(config2, domain, method, path) {
-  for (const rule of config2.deny) {
+function evaluateRules(config, domain, method, path) {
+  for (const rule of config.deny) {
     if (matchesRule(rule, domain, method, path)) {
       return { type: "deny", note: rule.note };
     }
   }
-  for (const rule of config2.allow) {
+  for (const rule of config.allow) {
     if (matchesRule(rule, domain, method, path)) {
       return { type: "allow" };
     }
   }
-  for (const rule of config2.grant_required) {
+  for (const rule of config.grant_required) {
     if (matchesRule(rule, domain, method, path)) {
       return { type: "grant_required", rule };
     }
   }
-  if (config2.proxy.default_action === "block") {
+  if (config.proxy.default_action === "block") {
     return { type: "deny", note: "No matching rule (default: block)" };
   }
-  if (config2.proxy.default_action === "allow") {
+  if (config.proxy.default_action === "allow") {
     return { type: "allow" };
   }
   return {
@@ -277,14 +392,14 @@ function isPrivateIP(ip) {
   if ((0, import_node_net.isIP)(ip) === 6) return isPrivateIPv6(ip);
   return false;
 }
-async function checkEgress(hostname2) {
-  if ((0, import_node_net.isIP)(hostname2)) {
-    return isPrivateIP(hostname2) ? { kind: "private" } : { kind: "ok" };
+async function checkEgress(hostname) {
+  if ((0, import_node_net.isIP)(hostname)) {
+    return isPrivateIP(hostname) ? { kind: "private" } : { kind: "ok" };
   }
-  if (hostname2 === "localhost") return { kind: "private" };
+  if (hostname === "localhost") return { kind: "private" };
   let settled;
   try {
-    settled = await Promise.allSettled([(0, import_promises.resolve4)(hostname2), (0, import_promises.resolve6)(hostname2)]);
+    settled = await Promise.allSettled([(0, import_promises.resolve4)(hostname), (0, import_promises.resolve6)(hostname)]);
   } catch {
     return { kind: "unresolvable", reason: "dns-error" };
   }
@@ -300,17 +415,100 @@ async function checkEgress(hostname2) {
 
 // src/connect.ts
 var import_node_net2 = require("net");
-async function handleConnect(config2, grantsClients, req, clientSocket, _head) {
+
+// src/mitm-connect.ts
+var import_node_tls = require("tls");
+function handleMitmConnect(opts) {
+  const leaf = opts.leafCache.get(opts.host);
+  const ctx = (0, import_node_tls.createSecureContext)({ cert: leaf.certPem, key: leaf.keyPem });
+  const tls = new import_node_tls.TLSSocket(opts.clientSocket, { isServer: true, secureContext: ctx });
+  opts.clientSocket.resume();
+  let buffer = Buffer.alloc(0);
+  let dispatched = false;
+  const onData = (chunk) => {
+    if (dispatched) return;
+    buffer = Buffer.concat([buffer, chunk]);
+    const headerEnd = buffer.indexOf("\r\n\r\n");
+    if (headerEnd < 0) return;
+    const headerBlock = buffer.subarray(0, headerEnd).toString("utf-8");
+    const lines = headerBlock.split("\r\n");
+    const requestLine = lines[0] ?? "";
+    const [method, path] = requestLine.split(" ");
+    const headers = /* @__PURE__ */ new Map();
+    for (const line of lines.slice(1)) {
+      const i = line.indexOf(":");
+      if (i > 0) headers.set(line.slice(0, i).trim().toLowerCase(), line.slice(i + 1).trim());
+    }
+    const decision = opts.onRequest({
+      method: method ?? "",
+      host: opts.host,
+      path: path ?? "/",
+      headers,
+      // inject decisions use only target+headers; raw body bytes still flow through to upstream below
+      body: null
+    });
+    if (decision.type === "short-circuit") {
+      dispatched = true;
+      const body = Buffer.from(decision.body, "utf-8");
+      tls.write(`HTTP/1.1 ${decision.status} OK\r
+Content-Length: ${body.length}\r
+\r
+`);
+      tls.write(body);
+      tls.end();
+      return;
+    }
+    dispatched = true;
+    tls.pause();
+    const upstream = (0, import_node_tls.connect)({
+      host: opts.host,
+      port: opts.port,
+      servername: opts.host,
+      rejectUnauthorized: opts.upstreamRejectUnauthorized ?? true
+    });
+    upstream.once("secureConnect", () => {
+      const mutated = decision.mutatedHeaders;
+      const newHeaderLines = [];
+      for (const line of lines.slice(1)) {
+        const i = line.indexOf(":");
+        if (i <= 0) continue;
+        const lower = line.slice(0, i).trim().toLowerCase();
+        if (mutated.has(lower)) continue;
+        newHeaderLines.push(line);
+      }
+      for (const [name, value] of mutated.entries()) {
+        newHeaderLines.push(`${capitalizeHeader(name)}: ${value}`);
+      }
+      const fullRequest = [requestLine, ...newHeaderLines, "", ""].join("\r\n");
+      upstream.write(fullRequest);
+      const remainder = buffer.subarray(headerEnd + 4);
+      if (remainder.length > 0) upstream.write(remainder);
+      upstream.pipe(tls);
+      tls.removeListener("data", onData);
+      tls.pipe(upstream);
+      tls.resume();
+    });
+    upstream.on("error", () => tls.end());
+  };
+  tls.on("data", onData);
+  tls.on("error", () => opts.clientSocket.destroy());
+}
+function capitalizeHeader(name) {
+  return name.split("-").map((p) => (p[0]?.toUpperCase() ?? "") + p.slice(1)).join("-");
+}
+
+// src/connect.ts
+async function handleConnect(config, grantsClients, req, clientSocket, head, deps) {
   const target = req.url ?? "";
   const [host, portStr] = target.split(":");
-  const port2 = Number.parseInt(portStr || "443");
-  if (!host || !port2) {
+  const port = Number.parseInt(portStr || "443");
+  if (!host || !port) {
     clientSocket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
     clientSocket.destroy();
     return;
   }
   const idpHosts = new Set(
-    config2.agents.map((a) => {
+    config.agents.map((a) => {
       try {
         return new URL(a.idp_url).hostname.toLowerCase();
       } catch {
@@ -328,46 +526,51 @@ async function handleConnect(config2, grantsClients, req, clientSocket, _head) {
       path: target,
       rule: "idp-system-bypass"
     });
-    tunnel(host, port2, clientSocket);
+    tunnel(host, port, clientSocket);
     return;
   }
-  const mandatoryAuth = config2.proxy.mandatory_auth ?? false;
+  const mandatoryAuth = config.proxy.mandatory_auth ?? false;
+  const daemonMode = deps?.daemonMode ?? false;
   let agentEmail;
-  try {
-    const authHeader = req.headers["proxy-authorization"];
-    let identity = null;
-    for (const agentConf2 of config2.agents) {
-      identity = await verifyAgentAuth(
-        authHeader ?? null,
-        agentConf2.idp_url,
-        mandatoryAuth && config2.agents.length === 1
-      );
-      if (identity) break;
-    }
-    if (mandatoryAuth && !identity) {
-      throw new AuthError("JWT required");
-    }
-    agentEmail = identity?.email;
-    if (agentEmail) {
-      const known = config2.agents.find((a) => a.email === agentEmail);
-      if (!known) {
-        clientSocket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+  if (daemonMode) {
+    agentEmail = config.agents[0]?.email;
+  } else {
+    try {
+      const authHeader = req.headers["proxy-authorization"];
+      let identity = null;
+      for (const agentConf2 of config.agents) {
+        identity = await verifyAgentAuth(
+          authHeader ?? null,
+          agentConf2.idp_url,
+          mandatoryAuth && config.agents.length === 1
+        );
+        if (identity) break;
+      }
+      if (mandatoryAuth && !identity) {
+        throw new AuthError("JWT required");
+      }
+      agentEmail = identity?.email;
+      if (agentEmail) {
+        const known = config.agents.find((a) => a.email === agentEmail);
+        if (!known) {
+          clientSocket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+          clientSocket.destroy();
+          return;
+        }
+      } else if (config.agents.length > 1) {
+        throw new AuthError("JWT required for multi-agent proxy");
+      }
+    } catch (err) {
+      if (err instanceof AuthError) {
+        clientSocket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
         clientSocket.destroy();
         return;
       }
-    } else if (config2.agents.length > 1) {
-      throw new AuthError("JWT required for multi-agent proxy");
-    }
-  } catch (err) {
-    if (err instanceof AuthError) {
-      clientSocket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
-      clientSocket.destroy();
-      return;
+      throw err;
     }
-    throw err;
   }
   const egress = await checkEgress(host);
-  const auditAgent = agentEmail ?? config2.agents[0]?.email ?? "unknown";
+  const auditAgent = agentEmail ?? config.agents[0]?.email ?? "unknown";
   if (egress.kind === "private") {
     writeAudit({
       ts: (/* @__PURE__ */ new Date()).toISOString(),
@@ -402,7 +605,7 @@ DNS lookup failed for ${host} (${egress.reason}).\r
     clientSocket.destroy();
     return;
   }
-  const agentConf = agentEmail ? config2.agents.find((a) => a.email === agentEmail) : config2.agents[0];
+  const agentConf = agentEmail ? config.agents.find((a) => a.email === agentEmail) : config.agents[0];
   if (!agentConf) {
     clientSocket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
     clientSocket.destroy();
@@ -411,10 +614,10 @@ DNS lookup failed for ${host} (${egress.reason}).\r
   const effectiveEmail = agentEmail ?? agentConf.email;
   const rulesConfig = {
     proxy: {
-      listen: config2.proxy.listen,
+      listen: config.proxy.listen,
       idp_url: agentConf.idp_url,
       agent_email: agentConf.email,
-      default_action: config2.proxy.default_action
+      default_action: config.proxy.default_action
     },
     allow: agentConf.allow ?? [],
     deny: agentConf.deny ?? [],
@@ -455,7 +658,7 @@ Blocked:${note}\r
         audience: "ape-proxy",
         grantType: action.rule.grant_type,
         permissions: action.rule.permissions,
-        reason: `CONNECT ${host}:${port2}`,
+        reason: `CONNECT ${host}:${port}`,
         duration: action.rule.duration
       });
       const decided = await grantsClient.waitForApproval(grant.id);
@@ -484,10 +687,40 @@ Grant request failed: ${msg}\r
   } else {
     writeAudit({ ...baseAudit, action: "allow", rule: "allow-list" });
   }
-  tunnel(host, port2, clientSocket);
+  if (deps?.secretsStore && deps?.leafCache) {
+    clientSocket.pause();
+    clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+    if (head.length > 0) {
+      clientSocket.unshift(head);
+    }
+    const store = deps.secretsStore;
+    handleMitmConnect({
+      clientSocket,
+      host,
+      port,
+      leafCache: deps.leafCache,
+      upstreamRejectUnauthorized: deps.upstreamRejectUnauthorized,
+      onRequest: (mreq) => {
+        const portSuffix = port === 443 ? "" : `:${port}`;
+        const targetUrl = new URL(`https://${mreq.host}${portSuffix}${mreq.path}`);
+        const match = store.findFor(targetUrl);
+        if (!match) return { type: "forward", mutatedHeaders: /* @__PURE__ */ new Map() };
+        const rendered = match.template.replace(/\$\{value\}/g, match.value);
+        console.error(
+          `[openape-proxy] injected secret '${match.name}' into ${match.header} for ${mreq.method} ${targetUrl.href}`
+        );
+        return {
+          type: "forward",
+          mutatedHeaders: /* @__PURE__ */ new Map([[match.header.toLowerCase(), rendered]])
+        };
+      }
+    });
+    return;
+  }
+  tunnel(host, port, clientSocket);
 }
-function tunnel(host, port2, clientSocket) {
-  const targetSocket = (0, import_node_net2.connect)(port2, host, () => {
+function tunnel(host, port, clientSocket) {
+  const targetSocket = (0, import_node_net2.connect)(port, host, () => {
     clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
     targetSocket.pipe(clientSocket);
     clientSocket.pipe(targetSocket);
@@ -513,30 +746,33 @@ async function computeRequestHash(method, targetUrl, body) {
   }
   return hash.digest("hex");
 }
-function buildGrantsClients(config2) {
+function buildGrantsClients(config) {
   const grantsClients = /* @__PURE__ */ new Map();
-  for (const agent of config2.agents) {
+  for (const agent of config.agents) {
     grantsClients.set(agent.email, new GrantsClient(agent.idp_url));
   }
   return grantsClients;
 }
-function createMultiAgentProxy(config2, grantsClients = buildGrantsClients(config2)) {
-  for (const agent of config2.agents) {
+function createMultiAgentProxy(config, grantsClients = buildGrantsClients(config), deps = {}) {
+  for (const agent of config.agents) {
     if (!grantsClients.has(agent.email)) {
       grantsClients.set(agent.email, new GrantsClient(agent.idp_url));
     }
   }
-  const mandatoryAuth = config2.proxy.mandatory_auth ?? false;
+  const mandatoryAuth = config.proxy.mandatory_auth ?? false;
+  const secretsStore = deps.secretsStore;
+  const daemonMode = deps.daemonMode ?? false;
+  const fetchImpl = deps.fetchImpl ?? ((input, init) => globalThis.fetch(input, init));
   return {
-    port: Number.parseInt(config2.proxy.listen.split(":")[1] || "9090"),
-    hostname: config2.proxy.listen.split(":")[0] || "127.0.0.1",
+    port: Number.parseInt(config.proxy.listen.split(":")[1] || "9090"),
+    hostname: config.proxy.listen.split(":")[0] || "127.0.0.1",
     async fetch(req) {
       const url = new URL(req.url);
       const startTime = Date.now();
       if (url.pathname === "/healthz") {
         return Response.json({
           status: "ok",
-          agents: config2.agents.map((a) => a.email)
+          agents: config.agents.map((a) => a.email)
         });
       }
       const targetUrl = url.pathname.slice(1) + url.search;
@@ -564,33 +800,37 @@ function createMultiAgentProxy(config2, grantsClients = buildGrantsClients(confi
       }
       const bodyBuffer = req.body ? await req.arrayBuffer() : null;
       let agentIdentity = null;
-      try {
-        for (const agentConf2 of config2.agents) {
-          agentIdentity = await verifyAgentAuth(
-            req.headers.get("proxy-authorization"),
-            agentConf2.idp_url,
-            mandatoryAuth && config2.agents.length === 1
-          );
-          if (agentIdentity) break;
-        }
-        if (mandatoryAuth && !agentIdentity) {
-          throw new AuthError("JWT required");
-        }
-      } catch (err) {
-        if (err instanceof AuthError) {
-          return new Response(`Unauthorized: ${err.message}`, { status: 401 });
+      if (daemonMode) {
+        agentIdentity = { email: config.agents[0].email, act: "agent" };
+      } else {
+        try {
+          for (const agentConf2 of config.agents) {
+            agentIdentity = await verifyAgentAuth(
+              req.headers.get("proxy-authorization"),
+              agentConf2.idp_url,
+              mandatoryAuth && config.agents.length === 1
+            );
+            if (agentIdentity) break;
+          }
+          if (mandatoryAuth && !agentIdentity) {
+            throw new AuthError("JWT required");
+          }
+        } catch (err) {
+          if (err instanceof AuthError) {
+            return new Response(`Unauthorized: ${err.message}`, { status: 401 });
+          }
+          throw err;
         }
-        throw err;
       }
       const agentEmail = agentIdentity?.email;
       let agentConf;
       if (agentEmail) {
-        agentConf = config2.agents.find((a) => a.email === agentEmail);
+        agentConf = config.agents.find((a) => a.email === agentEmail);
         if (!agentConf) {
           return new Response(`Forbidden: unknown agent ${agentEmail}`, { status: 403 });
         }
-      } else if (config2.agents.length === 1) {
-        agentConf = config2.agents[0];
+      } else if (config.agents.length === 1) {
+        agentConf = config.agents[0];
       } else {
         return new Response("Unauthorized: JWT required for multi-agent proxy", { status: 401 });
       }
@@ -598,10 +838,10 @@ function createMultiAgentProxy(config2, grantsClients = buildGrantsClients(confi
       const grantsClient = grantsClients.get(agentConf.email);
       const rulesConfig = {
         proxy: {
-          listen: config2.proxy.listen,
+          listen: config.proxy.listen,
           idp_url: agentConf.idp_url,
           agent_email: agentConf.email,
-          default_action: config2.proxy.default_action
+          default_action: config.proxy.default_action
         },
         allow: agentConf.allow ?? [],
         deny: agentConf.deny ?? [],
@@ -621,7 +861,7 @@ function createMultiAgentProxy(config2, grantsClients = buildGrantsClients(confi
       }
       if (action.type === "allow") {
         writeAudit({ ...baseAudit, action: "allow", rule: "allow-list", grant_id: null });
-        return forwardRequest(req, targetUrl, bodyBuffer);
+        return forwardRequest(req, targetUrl, targetParsed, bodyBuffer, secretsStore, fetchImpl);
       }
       const rule = action.rule;
       const permissions = rule.permissions ?? [`${method.toLowerCase()}:${domain}`];
@@ -640,13 +880,13 @@ function createMultiAgentProxy(config2, grantsClients = buildGrantsClients(confi
           grant_id: existing.id,
           request_hash: requestHash
         });
-        return forwardRequest(req, targetUrl, bodyBuffer);
+        return forwardRequest(req, targetUrl, targetParsed, bodyBuffer, secretsStore, fetchImpl);
       }
-      if (config2.proxy.default_action === "block") {
+      if (config.proxy.default_action === "block") {
         writeAudit({ ...baseAudit, action: "deny", rule: "no-grant (block mode)", grant_id: null });
         return new Response("No grant \u2014 blocked", { status: 403 });
       }
-      if (config2.proxy.default_action === "request-async") {
+      if (config.proxy.default_action === "request-async") {
         const grant = await grantsClient.requestGrant({
           requester: effectiveEmail,
           targetHost: domain,
@@ -695,7 +935,7 @@ function createMultiAgentProxy(config2, grantsClients = buildGrantsClients(confi
             request_hash: requestHash,
             waited_ms: waitedMs
           });
-          return forwardRequest(req, targetUrl, bodyBuffer);
+          return forwardRequest(req, targetUrl, targetParsed, bodyBuffer, secretsStore, fetchImpl);
         }
         writeAudit({
           ...baseAudit,
@@ -718,9 +958,12 @@ function createMultiAgentProxy(config2, grantsClients = buildGrantsClients(confi
     }
   };
 }
-function createNodeHandler(config2) {
-  const grantsClients = buildGrantsClients(config2);
-  const proxy = createMultiAgentProxy(config2, grantsClients);
+function createNodeHandler(config, deps = {}) {
+  const grantsClients = buildGrantsClients(config);
+  const proxy = createMultiAgentProxy(config, grantsClients, {
+    secretsStore: deps.secretsStore,
+    daemonMode: deps.daemonMode
+  });
   return {
     handleRequest(req, res) {
       const reqUrl = req.url || "/";
@@ -768,24 +1011,39 @@ function createNodeHandler(config2) {
       });
     },
     handleConnect(req, socket, head) {
-      handleConnect(config2, grantsClients, req, socket, head);
+      handleConnect(config, grantsClients, req, socket, head, {
+        secretsStore: deps.secretsStore,
+        leafCache: deps.leafCache,
+        daemonMode: deps.daemonMode
+      });
     }
   };
 }
-async function forwardRequest(originalReq, targetUrl, cachedBody) {
+async function forwardRequest(originalReq, targetUrl, targetParsed, cachedBody, secretsStore, fetchImpl) {
   const headers = new Headers(originalReq.headers);
   headers.delete("proxy-authorization");
   headers.delete("proxy-connection");
   headers.delete("host");
+  if (secretsStore) {
+    const match = secretsStore.findFor(targetParsed);
+    if (match) {
+      const rendered = match.template.replace(/\$\{value\}/g, match.value);
+      headers.set(match.header, rendered);
+      console.error(
+        `[openape-proxy] injected secret '${match.name}' into ${match.header} for ${originalReq.method} ${targetUrl}`
+      );
+    }
+  }
   const body = cachedBody && cachedBody.byteLength > 0 ? cachedBody : null;
   try {
-    const res = await fetch(targetUrl, {
+    const upstreamReq = new Request(targetUrl, {
       method: originalReq.method,
       headers,
       body,
       duplex: "half",
       redirect: "manual"
     });
+    const res = await fetchImpl(upstreamReq);
     const responseHeaders = new Headers(res.headers);
     responseHeaders.delete("transfer-encoding");
     responseHeaders.delete("connection");
@@ -800,56 +1058,220 @@ async function forwardRequest(originalReq, targetUrl, cachedBody) {
   }
 }
 
+// src/secrets-store.ts
+var import_smol_toml2 = require("smol-toml");
+
+// src/secrets-match.ts
+function compileGlob(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`);
+}
+function literalPrefixLen(glob) {
+  const i = glob.indexOf("*");
+  return i < 0 ? glob.length : i;
+}
+function targetString(url) {
+  const port = url.port ? `:${url.port}` : "";
+  const path = url.pathname === "/" ? "" : url.pathname;
+  return `${url.hostname}${port}${path}`;
+}
+function matchSecret(target, entries) {
+  const targetStr = targetString(target);
+  let best = null;
+  for (let i = 0; i < entries.length; i++) {
+    const entry = entries[i];
+    const re = compileGlob(entry.target);
+    if (!re.test(targetStr) && !re.test(`${targetStr}/`)) continue;
+    const prefix = literalPrefixLen(entry.target);
+    if (!best || prefix > best.prefix) {
+      best = { entry, prefix, idx: i };
+    }
+  }
+  return best?.entry ?? null;
+}
+
+// src/secrets-store.ts
+var MAX_BLOB_BYTES = 4 * 1024;
+var SUPPORTED_VERSION = "1";
+function parseSecretsBlob(toml) {
+  if (Buffer.byteLength(toml, "utf-8") > MAX_BLOB_BYTES) {
+    throw new Error(`Secrets blob too large (max ${MAX_BLOB_BYTES} bytes / 4 KiB)`);
+  }
+  const parsed = (0, import_smol_toml2.parse)(toml);
+  const version = parsed.version;
+  if (version !== SUPPORTED_VERSION) {
+    throw new Error(`Unsupported or missing version (expected "${SUPPORTED_VERSION}", got ${JSON.stringify(version)})`);
+  }
+  const secretsBlock = parsed.secrets;
+  const entries = [];
+  if (secretsBlock) {
+    for (const [name, raw] of Object.entries(secretsBlock)) {
+      const required = ["target", "header", "template", "value"];
+      for (const field of required) {
+        if (!raw[field] || typeof raw[field] !== "string") {
+          throw new Error(`Secret '${name}' is missing required field '${field}'`);
+        }
+      }
+      entries.push({
+        name,
+        target: raw.target,
+        header: raw.header,
+        template: raw.template,
+        value: raw.value
+      });
+    }
+  }
+  const literalPrefix = (glob) => {
+    const i = glob.indexOf("*");
+    return i < 0 ? glob : glob.slice(0, i);
+  };
+  const seen = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const key = `${literalPrefix(e.target)}|${e.target}`;
+    if (seen.has(key)) {
+      throw new Error(`Duplicate target with identical specificity: '${e.target}' (entries '${seen.get(key)}' and '${e.name}')`);
+    }
+    seen.set(key, e.name);
+  }
+  return {
+    entries,
+    findFor: (target) => matchSecret(target, entries)
+  };
+}
+
 // src/index.ts
+function loadIdentity() {
+  const path = (0, import_node_path2.join)((0, import_node_os.homedir)(), ".config", "apes", "auth.json");
+  if (!(0, import_node_fs3.existsSync)(path)) {
+    console.error(`[openape-proxy] missing ${path} \u2014 run \`apes login\` first`);
+    process.exit(2);
+  }
+  const raw = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf-8"));
+  const bearer = raw.access_token ?? raw.bearer;
+  if (!raw.email || !raw.idp || !bearer) {
+    console.error(`[openape-proxy] malformed ${path} \u2014 re-run \`apes login\``);
+    process.exit(2);
+  }
+  return { email: raw.email, idpUrl: raw.idp, bearer };
+}
 var { values } = (0, import_node_util.parseArgs)({
   options: {
     config: { type: "string", short: "c", default: "config.toml" },
     "dry-run": { type: "boolean", default: false },
-    "mandatory-auth": { type: "boolean", default: false }
+    "mandatory-auth": { type: "boolean", default: false },
+    global: { type: "boolean", default: false },
+    port: { type: "string" }
   }
 });
-var configPath = values.config;
-console.log(`[openape-proxy] Loading config from ${configPath}`);
-var config = loadMultiAgentConfig(configPath, {
-  mandatoryAuth: values["mandatory-auth"] || void 0
-});
-if (values["dry-run"]) {
-  console.log("[openape-proxy] DRY RUN mode \u2014 logging only, not blocking");
-  console.log("[openape-proxy] Config loaded:");
-  console.log(`  Listen: ${config.proxy.listen}`);
-  console.log(`  Default action: ${config.proxy.default_action}`);
-  console.log(`  Mandatory auth: ${config.proxy.mandatory_auth ?? false}`);
-  console.log(`  Agents: ${config.agents.length}`);
-  for (const agent of config.agents) {
-    const allowCount = agent.allow?.length ?? 0;
-    const denyCount = agent.deny?.length ?? 0;
-    const grantCount = agent.grant_required?.length ?? 0;
-    console.log(`    ${agent.email} (${agent.idp_url}) \u2014 ${allowCount} allow, ${denyCount} deny, ${grantCount} grant`);
+if (values.global) {
+  if (process.versions.bun) {
+    console.error(
+      "[openape-proxy] --global mode requires Node (Bun is not supported).\n  Bun's node:tls compat layer does not handle TLSSocket-on-existing-socket\n  for the CONNECT-MITM pipeline. Re-run with `node` directly, or use the\n  built `openape-proxy` binary (its shebang invokes Node)."
+    );
+    process.exit(2);
+  }
+  const stdinBuf = [];
+  let total = 0;
+  let aborted = false;
+  process.stdin.on("data", (chunk) => {
+    if (aborted) return;
+    total += chunk.length;
+    if (total > 8 * 1024) {
+      console.error("[openape-proxy] stdin > 8 KiB, refusing");
+      aborted = true;
+      process.exit(2);
+    }
+    stdinBuf.push(chunk);
+  });
+  process.stdin.on("end", () => {
+    if (aborted) return;
+    const blob = Buffer.concat(stdinBuf).toString("utf-8");
+    if (!blob.trim()) {
+      console.error("[openape-proxy] --global requires secrets TOML on stdin");
+      process.exit(2);
+    }
+    let store;
+    try {
+      store = parseSecretsBlob(blob);
+    } catch (err) {
+      console.error(`[openape-proxy] secrets parse error: ${err.message}`);
+      process.exit(2);
+    }
+    const identity = loadIdentity();
+    const port = Number.parseInt(values.port ?? "18789");
+    const ca = loadOrCreateCa({
+      certPath: (0, import_node_path2.join)((0, import_node_os.homedir)(), ".openape", "proxy", "ca.crt"),
+      keyPath: (0, import_node_path2.join)((0, import_node_os.homedir)(), ".openape", "proxy", "ca.key"),
+      subjectCN: `OpenApe Proxy CA (${identity.email})`
+    });
+    if (ca.created) {
+      console.log(`[openape-proxy] generated new CA at ~/.openape/proxy/ca.crt`);
+    }
+    const leafCache = createLeafCertCache(ca, { capacity: 256 });
+    const config = {
+      proxy: { listen: `127.0.0.1:${port}`, default_action: "allow" },
+      agents: [{ email: identity.email, idp_url: identity.idpUrl }]
+    };
+    const handler = createNodeHandler(config, { secretsStore: store, leafCache, daemonMode: true });
+    const server = (0, import_node_http.createServer)(handler.handleRequest);
+    server.on("connect", handler.handleConnect);
+    server.listen(port, "127.0.0.1", () => {
+      const addr = server.address();
+      const actualPort = typeof addr === "object" && addr ? addr.port : port;
+      console.log(`[openape-proxy] identity: ${identity.email} (${identity.idpUrl})`);
+      const names = store.entries.map((e) => e.name).join(", ");
+      console.log(`[openape-proxy] secrets: ${names}`);
+      console.log(`[openape-proxy] export OPENAPE_PROXY=127.0.0.1:${actualPort}`);
+      console.log(`[openape-proxy] listening on 127.0.0.1:${actualPort}`);
+    });
+    process.on("SIGINT", () => server.close(() => process.exit(0)));
+    process.on("SIGTERM", () => server.close(() => process.exit(0)));
+  });
+  process.stdin.resume();
+} else {
+  const configPath = values.config;
+  console.log(`[openape-proxy] Loading config from ${configPath}`);
+  const config = loadMultiAgentConfig(configPath, {
+    mandatoryAuth: values["mandatory-auth"] || void 0
+  });
+  if (values["dry-run"]) {
+    console.log("[openape-proxy] DRY RUN mode \u2014 logging only, not blocking");
+    console.log("[openape-proxy] Config loaded:");
+    console.log(`  Listen: ${config.proxy.listen}`);
+    console.log(`  Default action: ${config.proxy.default_action}`);
+    console.log(`  Mandatory auth: ${config.proxy.mandatory_auth ?? false}`);
+    console.log(`  Agents: ${config.agents.length}`);
+    for (const agent of config.agents) {
+      const allowCount = agent.allow?.length ?? 0;
+      const denyCount = agent.deny?.length ?? 0;
+      const grantCount = agent.grant_required?.length ?? 0;
+      console.log(`    ${agent.email} (${agent.idp_url}) \u2014 ${allowCount} allow, ${denyCount} deny, ${grantCount} grant`);
+    }
+    process.exit(0);
   }
-  process.exit(0);
+  const handler = createNodeHandler(config);
+  const port = Number.parseInt(config.proxy.listen.split(":")[1] || "9090");
+  const hostname = config.proxy.listen.split(":")[0] || "127.0.0.1";
+  const server = (0, import_node_http.createServer)(handler.handleRequest);
+  server.on("connect", handler.handleConnect);
+  server.listen(port, hostname, () => {
+    const addr = server.address();
+    const actualPort = typeof addr === "object" && addr ? addr.port : port;
+    console.log(`[openape-proxy] Listening on http://${hostname}:${actualPort}`);
+    console.log(`[openape-proxy] CONNECT tunneling enabled`);
+    console.log(`[openape-proxy] Mandatory auth: ${config.proxy.mandatory_auth ?? false}`);
+    console.log(`[openape-proxy] Agents: ${config.agents.map((a) => a.email).join(", ")}`);
+    console.log(`[openape-proxy] Default action: ${config.proxy.default_action}`);
+  });
+  process.on("SIGINT", () => {
+    console.log("\n[openape-proxy] Shutting down...");
+    server.close();
+    process.exit(0);
+  });
+  process.on("SIGTERM", () => {
+    console.log("[openape-proxy] Shutting down...");
+    server.close();
+    process.exit(0);
+  });
 }
-var handler = createNodeHandler(config);
-var port = Number.parseInt(config.proxy.listen.split(":")[1] || "9090");
-var hostname = config.proxy.listen.split(":")[0] || "127.0.0.1";
-var server = (0, import_node_http.createServer)(handler.handleRequest);
-server.on("connect", handler.handleConnect);
-server.listen(port, hostname, () => {
-  const addr = server.address();
-  const actualPort = typeof addr === "object" && addr ? addr.port : port;
-  console.log(`[openape-proxy] Listening on http://${hostname}:${actualPort}`);
-  console.log(`[openape-proxy] CONNECT tunneling enabled`);
-  console.log(`[openape-proxy] Mandatory auth: ${config.proxy.mandatory_auth ?? false}`);
-  console.log(`[openape-proxy] Agents: ${config.agents.map((a) => a.email).join(", ")}`);
-  console.log(`[openape-proxy] Default action: ${config.proxy.default_action}`);
-});
-process.on("SIGINT", () => {
-  console.log("\n[openape-proxy] Shutting down...");
-  server.close();
-  process.exit(0);
-});
-process.on("SIGTERM", () => {
-  console.log("[openape-proxy] Shutting down...");
-  server.close();
-  process.exit(0);
-});
 //# sourceMappingURL=index.cjs.map