@openhoo/hoopilot 0.9.3 → 1.0.0

package/dist/cli.js

@@ -6,7 +6,7 @@ import {
   main,
   trimTrailingSlash,
   truncatedResponseText
-} from "./chunk-7GSQVYYT.js";
+} from "./chunk-JU6F5L34.js";
 
 // src/cli.ts
 import { spawn } from "child_process";
@@ -2107,7 +2107,8 @@ async function getVersion() {
 // src/server.ts
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 4141;
-var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Browser-origin requests require HOOPILOT_API_KEY unless the Origin is loopback.";
+var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Cross-origin browser requests are blocked unless the Origin is loopback or listed in HOOPILOT_ALLOWED_ORIGINS.";
+var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set(["local-key"]);
 var INVALID_JSON_MESSAGE = "Request body must be valid JSON.";
 var JSON_OBJECT_MESSAGE = "Request body must be a JSON object.";
 var MAX_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
@@ -2123,6 +2124,7 @@ var RequestBodyTooLargeError = class extends Error {
 function createHoopilotHandler(options = {}) {
   const client = new CopilotClient(options);
   const apiKey = options.apiKey ?? envValue(options.env?.HOOPILOT_API_KEY);
+  const allowedOrigins = parseAllowedOrigins(options.env);
   const logger = serverLogger(options);
   const metrics = options.metrics ?? new MetricsRegistry();
   const readUsage = createUsageReader(client, metrics);
@@ -2142,7 +2144,10 @@ function createHoopilotHandler(options = {}) {
       route
     });
     metrics.startRequest();
+    const origin = request.headers.get("origin")?.trim() || void 0;
+    const corsOrigin = resolveCorsAllowOrigin(origin, allowedOrigins);
     const finish = (response) => finishResponse(response, {
+      corsOrigin,
       logger: requestLogger,
       method: request.method,
       metrics,
@@ -2152,11 +2157,11 @@ function createHoopilotHandler(options = {}) {
       closeConnection: bufferProxyBodies,
       trackStreamingBody: !bufferProxyBodies
     });
-    const browserOrigin = forbiddenBrowserOrigin(request, apiKey);
+    const browserOrigin = forbiddenBrowserOrigin(origin, request, allowedOrigins);
     if (browserOrigin) {
       requestLogger.warn(
         { event: "http.request.forbidden_origin", origin: browserOrigin },
-        "blocked unauthenticated browser-origin request"
+        "blocked cross-origin browser request"
       );
       return finish(jsonError(403, "forbidden_origin", FORBIDDEN_BROWSER_ORIGIN_MESSAGE));
     }
@@ -2282,10 +2287,17 @@ function startHoopilotServer(options = {}) {
   const port = normalizeServerPort(options.port ?? envValue(options.env?.PORT) ?? DEFAULT_PORT);
   const apiKey = options.apiKey ?? envValue(options.env?.HOOPILOT_API_KEY);
   const allowUnauthenticated = options.allowUnauthenticated ?? envValue(options.env?.HOOPILOT_ALLOW_UNAUTHENTICATED) === "1";
-  if (!isLoopbackHost(host) && !apiKey && !allowUnauthenticated) {
-    throw new Error(
-      "Refusing to listen on a non-loopback host without HOOPILOT_API_KEY. Set an API key or pass --allow-unauthenticated."
-    );
+  if (!isLoopbackHost(host)) {
+    if (!apiKey && !allowUnauthenticated) {
+      throw new Error(
+        "Refusing to listen on a non-loopback host without HOOPILOT_API_KEY. Set an API key or pass --allow-unauthenticated."
+      );
+    }
+    if (apiKey && isWellKnownDemoApiKey(apiKey)) {
+      throw new Error(
+        "Refusing to listen on a non-loopback host with a well-known demo HOOPILOT_API_KEY. Set a strong, unique API key."
+      );
+    }
   }
   const server = Bun.serve({
     fetch: createHoopilotHandler({
@@ -2598,7 +2610,6 @@ function corsHeaders() {
   return {
     "access-control-allow-headers": "anthropic-beta, anthropic-dangerous-direct-browser-access, anthropic-version, authorization, content-type, x-api-key, x-request-id",
     "access-control-allow-methods": "GET, POST, OPTIONS",
-    "access-control-allow-origin": "*",
     "access-control-expose-headers": "x-request-id"
   };
 }
@@ -2610,17 +2621,34 @@ function isAuthorized(request, apiKey) {
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1];
   return bearer === apiKey || request.headers.get("x-api-key") === apiKey;
 }
-function forbiddenBrowserOrigin(request, apiKey) {
-  if (apiKey) {
-    return void 0;
-  }
-  const origin = request.headers.get("origin")?.trim();
+function forbiddenBrowserOrigin(origin, request, allowedOrigins) {
   if (origin) {
-    return isLoopbackOrigin(origin) ? void 0 : origin;
+    return isAllowedOrigin(origin, allowedOrigins) ? void 0 : origin;
   }
   const fetchSite = request.headers.get("sec-fetch-site")?.toLowerCase();
   return fetchSite === "cross-site" ? "cross-site" : void 0;
 }
+function parseAllowedOrigins(env) {
+  const raw = envValue(env?.HOOPILOT_ALLOWED_ORIGINS);
+  if (!raw) {
+    return /* @__PURE__ */ new Set();
+  }
+  return new Set(
+    raw.split(",").map((value) => value.trim().toLowerCase()).filter((value) => value.length > 0)
+  );
+}
+function isAllowedOrigin(origin, allowedOrigins) {
+  return isLoopbackOrigin(origin) || allowedOrigins.has(origin.toLowerCase());
+}
+function resolveCorsAllowOrigin(origin, allowedOrigins) {
+  if (!origin) {
+    return "*";
+  }
+  return isAllowedOrigin(origin, allowedOrigins) ? origin : void 0;
+}
+function isWellKnownDemoApiKey(apiKey) {
+  return WELL_KNOWN_DEMO_API_KEYS.has(apiKey.trim().toLowerCase());
+}
 function isUpstreamAuthStatus(status) {
   return status === 401 || status === 403;
 }
@@ -2680,7 +2708,12 @@ function shouldBufferProxyBodies(mode) {
   return process.platform === "win32" && IS_STANDALONE_BINARY;
 }
 function finishResponse(response, options) {
-  const withRequestId = responseWithRequestId(response, options.requestId, options.closeConnection);
+  const withRequestId = responseWithRequestId(
+    response,
+    options.requestId,
+    options.closeConnection,
+    options.corsOrigin
+  );
   const stream = isStreamingResponse(withRequestId);
   const status = withRequestId.status;
   const complete = () => {
@@ -2698,9 +2731,17 @@ function finishResponse(response, options) {
   complete();
   return withRequestId;
 }
-function responseWithRequestId(response, requestId, closeConnection) {
+function responseWithRequestId(response, requestId, closeConnection, corsOrigin) {
   const headers = new Headers(response.headers);
   headers.set("x-request-id", requestId);
+  if (corsOrigin) {
+    headers.set("access-control-allow-origin", corsOrigin);
+    if (corsOrigin !== "*") {
+      headers.append("vary", "Origin");
+    }
+  } else {
+    headers.delete("access-control-allow-origin");
+  }
   if (closeConnection) {
     headers.set("connection", "close");
   }
@@ -3473,7 +3514,7 @@ async function main2(argv = Bun.argv.slice(2)) {
     if (await printMetaOption(args2)) {
       return;
     }
-    args2.logger = commandLogger(args2, "login");
+    args2.logger = commandLogger(args2, "login", args2.printToken ? process.stderr : void 0);
     await runLogin(args2);
     return;
   }
@@ -3556,6 +3597,10 @@ function parseArgs(argv) {
       args.noUpdateCheck = true;
       continue;
     }
+    if (arg === "--print-key" || arg === "--print-token") {
+      args.printToken = true;
+      continue;
+    }
     if (!arg.startsWith("-")) {
       throw new Error(`Unknown argument: ${arg}.`);
     }
@@ -3629,14 +3674,16 @@ function readApiKeyFile(path) {
 }
 async function runLogin(options = {}) {
   const logger = options.logger?.child({ component: "auth" }) ?? noopLogger;
+  const status = loginStatusLogger(Boolean(options.printToken));
   logger.debug({ event: "auth.login.started" }, "starting github copilot browser login");
-  console.log("Starting GitHub Copilot browser login...");
-  const login = await githubCopilotDeviceLogin({
+  status.info("Starting GitHub Copilot browser login...");
+  const deviceLogin = options.deviceLogin ?? githubCopilotDeviceLogin;
+  const login = await deviceLogin({
     env: options.env,
-    logger: console,
+    logger: status,
     openBrowser: openBrowserBestEffort
   });
-  console.log("Checking GitHub Copilot access...");
+  status.info("Checking GitHub Copilot access...");
   const access = await verifyCopilotOAuthToken(login.token, options);
   logger.debug(
     { apiBaseUrl: access.apiBaseUrl, event: "auth.login.verified" },
@@ -3653,8 +3700,11 @@ async function runLogin(options = {}) {
     path
   );
   logger.debug({ authStorePath: path, event: "auth.login.stored" }, "copilot credential stored");
-  console.log(`Copilot OAuth credential stored at ${path}`);
-  console.log("Copilot authentication ready.");
+  status.info(`Copilot OAuth credential stored at ${path}`);
+  status.info("Copilot authentication ready.");
+  if (options.printToken) {
+    console.log(login.token);
+  }
 }
 async function runModels(options = {}) {
   const logger = options.logger?.child({ component: "models" }) ?? noopLogger;
@@ -3823,13 +3873,28 @@ function modelIdsFromResponse(body) {
 function withRuntimeEnv(args) {
   return { ...args, env: process.env };
 }
-function commandLogger(args, command) {
+function commandLogger(args, command, stream) {
   return createHoopilotLogger({
     env: args.env,
     format: args.logFormat,
-    level: args.logLevel
+    level: args.logLevel,
+    stream
   }).child({ command, component: "cli" });
 }
+function loginStatusLogger(writeSecretsToStdout) {
+  if (writeSecretsToStdout) {
+    return {
+      error: (message) => console.error(message),
+      info: (message) => console.error(message),
+      warn: (message) => console.error(message)
+    };
+  }
+  return {
+    error: (message) => console.error(message),
+    info: (message) => console.log(message),
+    warn: (message) => console.warn(message)
+  };
+}
 function helpText(version) {
   return `hoopilot ${version}
 
@@ -3863,6 +3928,7 @@ Options:
       --api-key-file <path>         Read the local API key from a file instead of argv
       --auth-file <path>            OAuth credential store path
       --copilot-api-base-url <url>  Copilot API base URL override
+      --print-key                   Login: print the received OAuth token to stdout
       --log-level <level>           trace, debug, info, warn, error, fatal, or silent
       --log-format <format>         json or pretty. Default: pretty
       --stream-mode <mode>          auto, live, or buffer. Auto buffers Windows standalone streams.
@@ -3895,6 +3961,7 @@ export {
   main2 as main,
   openBrowserBestEffort,
   parseArgs,
+  runLogin,
   runModels,
   runUsage,
   verifyCopilotOAuthToken