@openhoo/hoopilot 2.1.4 → 2.1.5

package/README.md

@@ -66,7 +66,7 @@ $env:OPENAI_BASE_URL = "http://127.0.0.1:4141/v1"
 $env:OPENAI_API_KEY = "hoopilot"
 ```
 
-To require clients to authenticate — recommended whenever you expose the proxy beyond localhost — set `HOOPILOT_API_KEY` to a strong, unique secret and send that value as the client key:
+To require clients to authenticate — recommended whenever you expose the proxy beyond localhost — set `HOOPILOT_API_KEY` to a strong, unique secret of at least 24 characters and send that value as the client key:
 
 ```sh
 export HOOPILOT_API_KEY=$(openssl rand -hex 24)
@@ -161,7 +161,7 @@ Tags follow the release version, for example `ghcr.io/openhoo/hoopilot:1.3`, `:1
 
 #### Exposing the proxy beyond loopback
 
-The image binds `0.0.0.0` and cannot tell whether the published port is loopback-only, so it fails closed: drop the `-e HOOPILOT_ALLOW_UNAUTHENTICATED=1` opt-in (or map the port to a non-loopback interface) and it refuses to start without a strong, unique `HOOPILOT_API_KEY` (well-known demo keys are rejected). Clients then send that key as `Authorization: Bearer <key>` or `x-api-key: <key>`:
+The image binds `0.0.0.0` and cannot tell whether the published port is loopback-only, so it fails closed: drop the `-e HOOPILOT_ALLOW_UNAUTHENTICATED=1` opt-in (or map the port to a non-loopback interface) and it refuses to start without a strong, unique `HOOPILOT_API_KEY` of at least 24 characters. Short, repeated, and well-known demo keys are rejected. Clients then send that key as `Authorization: Bearer <key>` or `x-api-key: <key>`:
 
 ```sh
 export HOOPILOT_API_KEY=$(openssl rand -hex 24)
@@ -201,7 +201,7 @@ Start the server:
 hoopilot --port 4141
 ```
 
-By default Hoopilot listens on `127.0.0.1:4141`. If `HOOPILOT_API_KEY` is unset, local requests are accepted without client authentication. Binding to a non-loopback host requires either a strong, unique `HOOPILOT_API_KEY` or the explicit `--allow-unauthenticated` / `HOOPILOT_ALLOW_UNAUTHENTICATED=1` opt-in. Well-known demo keys are always rejected on a non-loopback host, even with the unauthenticated opt-in.
+By default Hoopilot listens on `127.0.0.1:4141`. If `HOOPILOT_API_KEY` is unset, local requests are accepted without client authentication. Binding to a non-loopback host requires either a strong, unique `HOOPILOT_API_KEY` of at least 24 characters or the explicit `--allow-unauthenticated` / `HOOPILOT_ALLOW_UNAUTHENTICATED=1` opt-in. Short, repeated, and well-known demo keys are always rejected on a non-loopback host, even with the unauthenticated opt-in.
 
 When an API key is configured, clients may send it as either `Authorization: Bearer <key>` or `x-api-key: <key>`.
 
@@ -366,7 +366,7 @@ Server and local-client settings:
 | --- | --- |
 | `HOST` / `--host` | Host to listen on. Default: `127.0.0.1` for local runs; Docker sets `0.0.0.0`. |
 | `PORT` / `--port` | Port to listen on. Default: `4141`. |
-| `HOOPILOT_API_KEY` / `--api-key` | Require clients to send `Authorization: Bearer <key>` or `x-api-key: <key>`. Must be a strong, unique secret on non-loopback binds; well-known demo keys are rejected. |
+| `HOOPILOT_API_KEY` / `--api-key` | Require clients to send `Authorization: Bearer <key>` or `x-api-key: <key>`. Must be a strong, unique secret of at least 24 characters on non-loopback binds; short, repeated, and well-known demo keys are rejected. |
 | `--api-key-file` | Read the local API key from a file instead of argv. |
 | `HOOPILOT_ALLOWED_ORIGINS` | Comma-separated browser origins allowed to make cross-origin requests. Loopback origins are always allowed; every other origin is blocked. |
 | `HOOPILOT_ALLOW_UNAUTHENTICATED` / `--allow-unauthenticated` | Allow non-loopback binds without a local API key. |

package/dist/cli.js

@@ -3288,17 +3288,15 @@ function observeResponseUsage(response, fallbackModel, onUsage, signal, onOutcom
   if (!body) {
     return response;
   }
-  const [clientBranch, observerBranch] = body.tee();
   const isSse = response.headers.get("content-type")?.includes("text/event-stream") ?? false;
-  void consumeUsage(observerBranch, isSse, fallbackModel, onUsage, signal, onOutcome).catch(
-    () => {
+  return new Response(
+    streamWithUsageObservation(body, isSse, fallbackModel, onUsage, signal, onOutcome),
+    {
+      headers: response.headers,
+      status: response.status,
+      statusText: response.statusText
     }
   );
-  return new Response(clientBranch, {
-    headers: response.headers,
-    status: response.status,
-    statusText: response.statusText
-  });
 }
 function recordResponseTextUsage(text, isSse, fallbackModel, onUsage, onOutcome) {
   const accumulator = createUsageAccumulator(fallbackModel, onUsage, onOutcome);
@@ -3314,13 +3312,16 @@ function recordResponseTextUsage(text, isSse, fallbackModel, onUsage, onOutcome)
   }
   accumulator.finish();
 }
-async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOutcome) {
+function streamWithUsageObservation(stream, isSse, fallbackModel, onUsage, signal, onOutcome) {
   const reader = stream.getReader();
+  let aborted = signal?.aborted ?? false;
+  let released = false;
   const onAbort = () => {
+    aborted = true;
     reader.cancel().catch(() => {
     });
   };
-  if (signal?.aborted) {
+  if (aborted) {
     reader.cancel().catch(() => {
     });
   } else {
@@ -3328,7 +3329,7 @@ async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOut
   }
   const decoder = new TextDecoder();
   const guardedOutcome = onOutcome ? (extracted) => {
-    if (!signal?.aborted) {
+    if (!aborted) {
       onOutcome(extracted);
     }
   } : void 0;
@@ -3336,33 +3337,40 @@ async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOut
   let buffer = "";
   let bufferedBytes = 0;
   let overflowed = false;
-  try {
-    while (true) {
-      const result = await reader.read();
-      if (result.done) {
-        break;
+  const release = () => {
+    if (released) {
+      return;
+    }
+    released = true;
+    signal?.removeEventListener("abort", onAbort);
+    reader.releaseLock();
+  };
+  const observeChunk = (chunkBytes) => {
+    const chunk = decoder.decode(chunkBytes, { stream: true });
+    if (isSse) {
+      buffer += chunk;
+      const lines = buffer.split(/\r?\n/);
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        considerSseLine(line, accumulator.consider);
       }
-      const chunk = decoder.decode(result.value, { stream: true });
-      if (isSse) {
-        buffer += chunk;
-        const lines = buffer.split(/\r?\n/);
-        buffer = lines.pop() ?? "";
-        for (const line of lines) {
-          considerSseLine(line, accumulator.consider);
-        }
-        if (buffer.length > USAGE_BUFFER_LIMIT_BYTES) {
-          buffer = "";
-        }
-      } else if (!overflowed) {
-        bufferedBytes += result.value.byteLength;
-        if (bufferedBytes > USAGE_BUFFER_LIMIT_BYTES) {
-          overflowed = true;
-          buffer = "";
-        } else {
-          buffer += chunk;
-        }
+      if (buffer.length > USAGE_BUFFER_LIMIT_BYTES) {
+        buffer = "";
       }
+      return;
     }
+    if (overflowed) {
+      return;
+    }
+    bufferedBytes += chunkBytes.byteLength;
+    if (bufferedBytes > USAGE_BUFFER_LIMIT_BYTES) {
+      overflowed = true;
+      buffer = "";
+      return;
+    }
+    buffer += chunk;
+  };
+  const finishObservation = () => {
     const finalBuffer = buffer + decoder.decode();
     if (isSse) {
       if (finalBuffer) {
@@ -3374,11 +3382,41 @@ async function consumeUsage(stream, isSse, fallbackModel, onUsage, signal, onOut
         accumulator.consider(parsed);
       }
     }
-  } finally {
-    signal?.removeEventListener("abort", onAbort);
-    reader.releaseLock();
-  }
-  accumulator.finish();
+    if (!aborted) {
+      safeFinishAccumulator(accumulator);
+    }
+  };
+  return new ReadableStream({
+    async pull(controller) {
+      const result = await reader.read().catch((error) => {
+        release();
+        controller.error(error);
+        return void 0;
+      });
+      if (!result) {
+        return;
+      }
+      if (result.done) {
+        finishObservation();
+        controller.close();
+        release();
+        return;
+      }
+      try {
+        observeChunk(result.value);
+      } catch {
+      }
+      controller.enqueue(result.value);
+    },
+    async cancel(reason) {
+      aborted = true;
+      try {
+        await reader.cancel(reason);
+      } finally {
+        release();
+      }
+    }
+  });
 }
 function createUsageAccumulator(fallbackModel, onUsage, onOutcome) {
   let model = fallbackModel;
@@ -3403,6 +3441,12 @@ function createUsageAccumulator(fallbackModel, onUsage, onOutcome) {
     }
   };
 }
+function safeFinishAccumulator(accumulator) {
+  try {
+    accumulator.finish();
+  } catch {
+  }
+}
 function considerSseLine(line, consider) {
   const trimmed = line.trim();
   if (!trimmed.startsWith("data:")) {
@@ -3521,7 +3565,18 @@ async function getVersion() {
 var DEFAULT_HOST = "127.0.0.1";
 var DEFAULT_PORT = 4141;
 var FORBIDDEN_BROWSER_ORIGIN_MESSAGE = "Cross-origin browser requests are blocked unless the Origin is loopback or listed in HOOPILOT_ALLOWED_ORIGINS.";
-var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set(["local-key"]);
+var MIN_NON_LOOPBACK_API_KEY_LENGTH = 24;
+var WELL_KNOWN_DEMO_API_KEYS = /* @__PURE__ */ new Set([
+  "changeme",
+  "demo",
+  "example",
+  "hoopilot",
+  "local-key",
+  "password",
+  "password123",
+  "secret",
+  "test"
+]);
 var INVALID_JSON_MESSAGE = "Request body must be valid JSON.";
 var JSON_OBJECT_MESSAGE = "Request body must be a JSON object.";
 var MAX_REQUEST_BODY_BYTES = 16 * 1024 * 1024;
@@ -3799,10 +3854,9 @@ function startHoopilotServer(options = {}) {
         "Refusing to listen on a non-loopback host without HOOPILOT_API_KEY. Set an API key or pass --allow-unauthenticated."
       );
     }
-    if (apiKey && isWellKnownDemoApiKey(apiKey)) {
-      throw new Error(
-        "Refusing to listen on a non-loopback host with a well-known demo HOOPILOT_API_KEY. Set a strong, unique API key."
-      );
+    const rejection = apiKey ? apiKeyRejectionReason(apiKey) : void 0;
+    if (rejection) {
+      throw new Error(`Refusing to listen on a non-loopback host: ${rejection}`);
     }
   }
   const server = Bun.serve({
@@ -4100,12 +4154,16 @@ async function readRequestText(request) {
   const reader = body.getReader();
   const decoder = new TextDecoder();
   let bytes = 0;
-  let text = "";
+  const chunks = [];
   try {
     while (true) {
       const { done, value } = await reader.read();
       if (done) {
-        return `${text}${decoder.decode()}`;
+        const tail = decoder.decode();
+        if (tail) {
+          chunks.push(tail);
+        }
+        return chunks.join("");
       }
       bytes += value.byteLength;
       if (bytes > MAX_REQUEST_BODY_BYTES) {
@@ -4113,7 +4171,7 @@ async function readRequestText(request) {
         });
         throw new RequestBodyTooLargeError();
       }
-      text += decoder.decode(value, { stream: true });
+      chunks.push(decoder.decode(value, { stream: true }));
     }
   } finally {
     reader.releaseLock();
@@ -4210,8 +4268,18 @@ function resolveCorsAllowOrigin(origin, allowedOrigins) {
   }
   return isAllowedOrigin(origin, allowedOrigins) ? origin : void 0;
 }
-function isWellKnownDemoApiKey(apiKey) {
-  return WELL_KNOWN_DEMO_API_KEYS.has(apiKey.trim().toLowerCase());
+function apiKeyRejectionReason(apiKey) {
+  const normalized = apiKey.trim();
+  if (WELL_KNOWN_DEMO_API_KEYS.has(normalized.toLowerCase())) {
+    return "HOOPILOT_API_KEY is a well-known demo value. Set a strong, unique API key.";
+  }
+  if (normalized.length < MIN_NON_LOOPBACK_API_KEY_LENGTH) {
+    return `HOOPILOT_API_KEY must be at least ${MIN_NON_LOOPBACK_API_KEY_LENGTH} characters when listening on a non-loopback host.`;
+  }
+  if (/^(.)\1+$/.test(normalized)) {
+    return "HOOPILOT_API_KEY must not be a repeated single character. Set a strong, unique API key.";
+  }
+  return void 0;
 }
 function isUpstreamAuthStatus(status) {
   return status === 401 || status === 403;
@@ -4591,8 +4659,14 @@ function versionFromTag(tag) {
   return tag.trim().replace(/^v/, "");
 }
 function assetSuffixFor(platform, arch, isMusl) {
-  const os = platform === "win32" ? "windows" : platform === "darwin" ? "darwin" : "linux";
-  const cpu = arch === "arm64" || arch === "aarch64" ? "arm64" : "x64";
+  const os = platform === "linux" ? "linux" : platform === "win32" ? "windows" : platform === "darwin" ? "darwin" : void 0;
+  if (!os) {
+    throw new Error(`Unsupported platform for standalone updates: ${platform}.`);
+  }
+  const cpu = arch === "x64" || arch === "amd64" ? "x64" : arch === "arm64" || arch === "aarch64" ? "arm64" : void 0;
+  if (!cpu) {
+    throw new Error(`Unsupported architecture for standalone updates: ${arch}.`);
+  }
   const libc = os === "linux" && isMusl ? "-musl" : "";
   return `${os}-${cpu}${libc}`;
 }
@@ -5481,6 +5555,7 @@ Options:
   -p, --port <port>                 Port to listen on. Default: 4141
       --host <host>                 Host to listen on. Default: 127.0.0.1
       --api-key <key>               Require clients to send Authorization: Bearer <key> or x-api-key: <key>
+                                    Non-loopback binds require at least 24 characters.
       --api-key-file <path>         Read the local API key from a file instead of argv
       --auth-file <path>            OAuth credential store path
       --copilot-api-base-url <url>  Copilot API base URL override