@peakflo/agent-harness 0.0.0-stage → 0.2.2-rc.1

package/dist/github-command-guards.js

@@ -0,0 +1,330 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MERGE_REFUSAL = void 0;
+exports.installGhGuard = installGhGuard;
+exports.acquireGhGuardPath = acquireGhGuardPath;
+exports.installPushGuard = installPushGuard;
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+exports.MERGE_REFUSAL = 'GitHub merge refused: agents may open pull requests but must not merge them.';
+let guardPathState;
+let guardPathQueue = Promise.resolve();
+/**
+ * Install friendly command-line refusals before backend processes start.
+ * These launchers are UX only. The TLS proxy is the security boundary and
+ * applies the same policy even when an agent calls the real binary directly.
+ */
+async function installGhGuard(root) {
+    const bin = (0, node_path_1.join)(root, '.github-bin');
+    await (0, promises_1.mkdir)(bin, { recursive: true, mode: 0o700 });
+    let executable = null;
+    let gitExecutable = null;
+    for (const directory of (process.env.PATH ?? '').split(node_path_1.delimiter)) {
+        if (!directory || directory === bin)
+            continue;
+        const candidate = (0, node_path_1.join)(directory, 'gh');
+        try {
+            await (0, promises_1.access)(candidate, node_fs_1.constants.X_OK);
+            executable = candidate;
+            break;
+        }
+        catch {
+            /* Try next PATH entry. */
+        }
+    }
+    for (const directory of (process.env.PATH ?? '').split(node_path_1.delimiter)) {
+        if (!directory || directory === bin)
+            continue;
+        const candidate = (0, node_path_1.join)(directory, 'git');
+        try {
+            await (0, promises_1.access)(candidate, node_fs_1.constants.X_OK);
+            gitExecutable = candidate;
+            break;
+        }
+        catch {
+            /* Next entry. */
+        }
+    }
+    await (0, promises_1.writeFile)((0, node_path_1.join)(bin, 'git'), `#!${process.execPath}
+const { spawnSync } = require('node:child_process');
+const { readFileSync } = require('node:fs');
+const { resolve, join } = require('node:path');
+const executable = ${JSON.stringify(gitExecutable)};
+if (!executable) { console.error('git is not installed'); process.exit(127); }
+const args = process.argv.slice(2);
+const gitEnv = { ...process.env };
+for (const key of Object.keys(gitEnv)) {
+  if (key.startsWith('GIT_')) delete gitEnv[key];
+  if (key.startsWith('GH_') && !['GH_TOKEN', 'GH_CONFIG_DIR'].includes(key)) delete gitEnv[key];
+}
+gitEnv.GIT_TERMINAL_PROMPT = '0';
+// The wrapper deliberately removes caller-controlled GIT_* overrides, but
+// Git's libcurl requires GIT_SSL_CAINFO to trust the harness TLS proxy. Pin it
+// to the harness-owned bundle instead of accepting the caller's value.
+gitEnv.GIT_SSL_CAINFO = ${JSON.stringify((0, node_path_1.join)(root, '.github-proxy-ca.pem'))};
+for (const key of ['GIT_AUTHOR_NAME', 'GIT_AUTHOR_EMAIL', 'GIT_AUTHOR_DATE', 'GIT_COMMITTER_NAME', 'GIT_COMMITTER_EMAIL', 'GIT_COMMITTER_DATE']) {
+  if (process.env[key]) gitEnv[key] = process.env[key];
+}
+let command = 0;
+let cwd = process.cwd();
+let refusedGlobalOption = null;
+const valueOptions = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--super-prefix', '--config-env', '--list-cmds', '--attr-source']);
+const flagOptions = new Set(['-p', '-P', '--bare', '--no-pager', '--paginate', '--exec-path', '--html-path', '--man-path', '--info-path', '--version', '--help', '--literal-pathspecs', '--glob-pathspecs', '--noglob-pathspecs', '--icase-pathspecs', '--no-optional-locks', '--no-replace-objects', '--no-lazy-fetch', '--no-advice']);
+const redirectingOptions = new Set(['--git-dir', '--work-tree', '--namespace', '--super-prefix', '--config-env', '--bare', '--exec-path']);
+while (command < args.length) {
+  const arg = args[command];
+  if (valueOptions.has(arg) && args[command + 1]) {
+    if (arg === '-C') cwd = resolve(cwd, args[command + 1]);
+    if (redirectingOptions.has(arg)) refusedGlobalOption = arg;
+    if (arg === '-c') refusedGlobalOption = arg + ' ' + args[command + 1].split('=', 1)[0];
+    command += 2;
+    continue;
+  }
+  if (/^-c.+/.test(arg)) {
+    refusedGlobalOption = '-c ' + arg.slice(2).split('=', 1)[0];
+    command += 1;
+    continue;
+  }
+  if (/^-C.+/.test(arg)) {
+    cwd = resolve(cwd, arg.slice(2));
+    command += 1;
+    continue;
+  }
+  const assignedOption = arg.match(/^(--(?:git-dir|work-tree|namespace|super-prefix|config-env|exec-path|list-cmds|attr-source))=/)?.[1];
+  if (flagOptions.has(arg) || assignedOption) {
+    if (redirectingOptions.has(arg) || (assignedOption && redirectingOptions.has(assignedOption))) refusedGlobalOption = assignedOption ?? arg;
+    command += 1;
+    continue;
+  }
+  break;
+}
+if (refusedGlobalOption && args[command] !== 'push') {
+  console.error('Git command refused: global option ' + refusedGlobalOption + ' can redirect repository policy or command execution.');
+  process.exit(1);
+}
+if (args[command] === 'config') {
+  const configArgs = args.slice(command + 1);
+  const readActions = new Set(['--get', '--get-all', '--get-regexp', '--get-urlmatch', '--list', '-l', '--get-color', '--get-colorbool']);
+  const writeActions = new Set(['--add', '--replace-all', '--unset', '--unset-all', '--rename-section', '--remove-section', '-e', '--edit']);
+  const positional = configArgs.filter(arg => !arg.startsWith('-'));
+  const mutates = configArgs.some(arg => writeActions.has(arg)) || (!configArgs.some(arg => readActions.has(arg)) && positional.length > 1);
+  if (mutates) {
+    console.error('Git config refused: agents may read Git configuration but may not change it.');
+    process.exit(1);
+  }
+}
+if (args[command] === 'push') {
+  const refuse = () => { console.error('Git push refused: use an explicit agent/<session-id> destination; default and other branches are forbidden.'); process.exit(1); };
+  if (refusedGlobalOption) {
+    console.error('Git push refused: global option ' + refusedGlobalOption + ' can redirect the repository, hooks, refs, or push URL.');
+    process.exit(1);
+  }
+  let policy;
+  const hooks = spawnSync(executable, ['-C', cwd, 'config', '--get', 'core.hooksPath'], { encoding: 'utf8', env: gitEnv });
+  try { policy = JSON.parse(readFileSync(join(hooks.stdout.trim(), 'push-policy.json'), 'utf8')); } catch { refuse(); }
+  const positional = [];
+  for (const arg of args.slice(command + 1)) {
+    if (['-u', '--set-upstream', '-f', '--force', '--force-with-lease', '--dry-run', '-n', '--porcelain', '-v', '--verbose'].includes(arg)) continue;
+    if (arg.startsWith('-')) refuse();
+    positional.push(arg);
+  }
+  if (positional.length < 2) refuse();
+  if (positional[0] !== 'origin') refuse();
+  const remote = spawnSync(executable, ['-C', cwd, 'remote', 'get-url', '--push', positional[0]], { encoding: 'utf8', env: gitEnv });
+  if (remote.status !== 0 || remote.stdout.trim() !== policy.remoteUrl) refuse();
+  for (const ref of positional.slice(1)) {
+    const destination = ref.replace(/^\\+/, '').split(':').pop().replace(/^refs\\/heads\\//, '');
+    if (destination === policy.defaultBranch || destination !== policy.branch) refuse();
+  }
+}
+const result = spawnSync(executable, args, { stdio: 'inherit', env: gitEnv });
+process.exit(result.status ?? 1);
+`, { mode: 0o700 });
+    await (0, promises_1.writeFile)((0, node_path_1.join)(bin, 'gh'), `#!${process.execPath}
+const { spawnSync } = require('node:child_process');
+const { readFileSync } = require('node:fs');
+const { resolve } = require('node:path');
+const args = process.argv.slice(2);
+const cleanEnv = { ...process.env };
+for (const key of Object.keys(cleanEnv)) {
+  if (key.startsWith('GIT_')) delete cleanEnv[key];
+  if (key.startsWith('GH_') && !['GH_TOKEN', 'GH_CONFIG_DIR'].includes(key)) delete cleanEnv[key];
+}
+cleanEnv.GIT_TERMINAL_PROMPT = '0';
+// Inspect all args, including endpoint=... and flags before the subcommand.
+const decodedArgs = args.map(arg => {
+  try { return decodeURIComponent(arg); } catch { return arg; }
+});
+const ghGlobalValueOptions = new Set(['-R', '--repo', '--hostname']);
+const ghGlobalFlagOptions = new Set(['--help', '--version', '--prompt', '--no-pager']);
+let command = 0;
+while (command < decodedArgs.length) {
+  const arg = decodedArgs[command];
+  if (ghGlobalValueOptions.has(arg) && decodedArgs[command + 1]) {
+    command += 2;
+    continue;
+  }
+  if (/^-R.+/.test(arg) || /^--(?:repo|hostname)=/.test(arg) || ghGlobalFlagOptions.has(arg)) {
+    command += 1;
+    continue;
+  }
+  break;
+}
+const commandName = decodedArgs[command];
+const api = commandName === 'api' ? command : -1;
+const apiValueOptions = new Set(['-X', '--method', '-H', '--header', '-F', '--field', '-f', '--raw-field', '--input', '--hostname', '--cache']);
+let endpoint = null;
+let inputBuffer = null;
+const body = [...decodedArgs];
+if (api >= 0) {
+  for (let index = api + 1; index < decodedArgs.length; index += 1) {
+    const arg = decodedArgs[index];
+    if (apiValueOptions.has(arg)) {
+      const value = decodedArgs[index + 1];
+      if (arg === '--input' && value) {
+        try {
+          inputBuffer = value === '-' ? readFileSync(0) : readFileSync(resolve(value));
+          body.push(inputBuffer.toString('utf8'));
+        } catch { /* Let gh report an unreadable input after policy checks. */ }
+      }
+      index += 1;
+      continue;
+    }
+    const assigned = arg.match(/^(?:-X|--method|-H|--header|-F|--field|-f|--raw-field|--input|--hostname|--cache)=(.*)$/)?.[1];
+    if (assigned !== undefined) {
+      if (/^--input=/.test(arg)) {
+        try {
+          inputBuffer = assigned === '-' ? readFileSync(0) : readFileSync(resolve(assigned));
+          body.push(inputBuffer.toString('utf8'));
+        } catch { /* Let gh report an unreadable input after policy checks. */ }
+      }
+      continue;
+    }
+    if (arg.startsWith('-')) continue;
+    if (endpoint === null) endpoint = arg;
+  }
+}
+const normaliseEndpoint = value => {
+  if (!value) return '';
+  try {
+    const parsed = new URL(value, 'https://api.github.com');
+    return parsed.pathname.replace(/\\/+$/, '') || '/';
+  } catch {
+    return value.split(/[?#]/, 1)[0].replace(/\\/+$/, '');
+  }
+};
+const mergeOperation = api >= 0 && body.some(value => /\\b(?:mergePullRequest|enablePullRequestAutoMerge)\\b/i.test(value));
+const mergePath = api >= 0 && /^\\/repos\\/[^/]+\\/[^/]+\\/(?:pulls\\/[^/]+\\/merge|merges)$/i.test(normaliseEndpoint(endpoint));
+const containsPrMerge = value => /(?:^|\\s)pr(?:\\s+--?\\S+(?:\\s+\\S+)?)*\\s+merge(?:\\s|$)/i.test(value);
+let prCommand = command + 1;
+if (commandName === 'pr') {
+  while (prCommand < decodedArgs.length) {
+    const arg = decodedArgs[prCommand];
+    if (ghGlobalValueOptions.has(arg) && decodedArgs[prCommand + 1]) {
+      prCommand += 2;
+      continue;
+    }
+    if (/^-R.+/.test(arg) || /^--(?:repo|hostname)=/.test(arg) || ghGlobalFlagOptions.has(arg)) {
+      prCommand += 1;
+      continue;
+    }
+    break;
+  }
+}
+const mergeCommand = commandName === 'pr' && decodedArgs[prCommand] === 'merge';
+const commandTail = decodedArgs.slice(command + 1);
+const administrativeCommand =
+  (commandName === 'repo' && commandTail.includes('delete')) ||
+  (commandName === 'secret' && commandTail.includes('set')) ||
+  (commandName === 'workflow' && commandTail.includes('run'));
+const dangerousAliasText = value => /\\b(?:mergePullRequest|enablePullRequestAutoMerge)\\b|\\/merges?(?:[\\s/?#]|$)/i.test(value) || containsPrMerge(value);
+const executable = ${JSON.stringify(executable)};
+let dangerousAlias = commandName === 'alias' && decodedArgs.slice(command).some(dangerousAliasText);
+if (!dangerousAlias && executable && commandName) {
+  const alias = spawnSync(executable, ['alias', 'get', commandName], { encoding: 'utf8', env: cleanEnv });
+  dangerousAlias = alias.status === 0 && dangerousAliasText(alias.stdout);
+}
+if (mergeOperation || mergePath || mergeCommand || dangerousAlias) {
+  console.error(${JSON.stringify(exports.MERGE_REFUSAL)});
+  process.exit(1);
+}
+if (administrativeCommand) {
+  console.error('GitHub request refused: this administrative operation is not permitted.');
+  process.exit(1);
+}
+if (!executable) { console.error('gh is not installed; use the workspace GitHub API link to open a PR.'); process.exit(127); }
+const result = inputBuffer
+  ? spawnSync(executable, args, { input: inputBuffer, stdio: ['pipe', 'inherit', 'inherit'], env: cleanEnv })
+  : spawnSync(executable, args, { stdio: 'inherit', env: cleanEnv });
+process.exit(result.status ?? 1);
+`, { mode: 0o700 });
+    return bin;
+}
+/**
+ * Lease one session-neutral guard directory for the whole process. Generated
+ * launchers read policy from the target worktree, so sharing the launcher is
+ * safe; stacking per-Harness directories in global PATH is not.
+ */
+async function acquireGhGuardPath(root) {
+    let unlock;
+    const previous = guardPathQueue;
+    guardPathQueue = new Promise((resolve) => {
+        unlock = resolve;
+    });
+    await previous;
+    try {
+        if (!guardPathState) {
+            const bin = await installGhGuard(root);
+            const path = (process.env.PATH ?? '')
+                .split(node_path_1.delimiter)
+                .filter((entry) => entry && entry !== bin);
+            process.env.PATH = [bin, ...path].join(node_path_1.delimiter);
+            guardPathState = { bin, references: 0 };
+        }
+        const state = guardPathState;
+        state.references += 1;
+        let released = false;
+        return {
+            bin: state.bin,
+            release() {
+                if (released)
+                    return;
+                released = true;
+                state.references -= 1;
+                if (state.references === 0 && guardPathState === state) {
+                    process.env.PATH = (process.env.PATH ?? '')
+                        .split(node_path_1.delimiter)
+                        .filter((entry) => entry && entry !== state.bin)
+                        .join(node_path_1.delimiter);
+                    guardPathState = undefined;
+                }
+            }
+        };
+    }
+    finally {
+        unlock();
+    }
+}
+/** Git supplies resolved destination refs, covering force, wildcard and implicit pushes. */
+async function installPushGuard(directory, sessionId, defaultBranch, remoteUrl) {
+    await (0, promises_1.mkdir)(directory, { recursive: true, mode: 0o700 });
+    await (0, promises_1.writeFile)((0, node_path_1.join)(directory, 'push-policy.json'), JSON.stringify({ branch: `agent/${sessionId}`, defaultBranch, remoteUrl }), { mode: 0o600 });
+    await (0, promises_1.writeFile)((0, node_path_1.join)(directory, 'pre-push'), `#!${process.execPath}
+const { readFileSync } = require('node:fs');
+const allowed = ${JSON.stringify(`refs/heads/agent/${sessionId}`)};
+const defaultRef = ${JSON.stringify(`refs/heads/${defaultBranch}`)};
+const allowedRemote = ${JSON.stringify(remoteUrl)};
+if (process.argv[2] !== 'origin' || process.argv[3] !== allowedRemote) {
+  console.error('Git push refused: remote ' + process.argv[2] + ' is not this worktree origin.');
+  process.exit(1);
+}
+for (const line of readFileSync(0, 'utf8').trim().split('\\n').filter(Boolean)) {
+  const remoteRef = line.split(/\\s+/)[2];
+  if (remoteRef === defaultRef || remoteRef !== allowed) {
+    console.error('Git push refused: destination ' + remoteRef + '; this session may push only ' + allowed + '.');
+    process.exit(1);
+  }
+}
+`, { mode: 0o700 });
+}

package/dist/github-proxy-certificates.d.ts

@@ -0,0 +1,25 @@
+import 'reflect-metadata';
+export interface GitHubProxyCertificateOptions {
+    /** Override only for deterministic tests. Production preserves process.env. */
+    environment?: NodeJS.ProcessEnv;
+}
+export interface GitHubProxyCertificates {
+    caCertificate: Buffer;
+    caCertificatePath: string;
+    leaf(hostname: string): Promise<{
+        certificate: Buffer;
+        privateKey: Buffer;
+    }>;
+}
+/**
+ * Create one short-lived CA for this harness process. WebCrypto creates and
+ * signs every key in process. Private key material exists only in memory. Only
+ * the public CA certificate is written, as the command-line trust anchor.
+ *
+ * SSL_CERT_FILE and CURL_CA_BUNDLE replace (rather than extend) the caller's
+ * normal trust store. The file therefore also carries Node's public roots. If
+ * it contained only our proxy CA, direct HTTPS calls such as the model gateway
+ * would fail with `unable to verify the first certificate` even though their
+ * public certificate chains are valid.
+ */
+export declare function createGitHubProxyCertificates(stateRoot: string, options?: GitHubProxyCertificateOptions): Promise<GitHubProxyCertificates>;

package/dist/github-proxy-certificates.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createGitHubProxyCertificates = createGitHubProxyCertificates;
+require("reflect-metadata");
+const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const node_tls_1 = require("node:tls");
+const x509_1 = require("@peculiar/x509");
+const CA_CERTIFICATE_FILE = '.github-proxy-ca.pem';
+const CERTIFICATE_LIFETIME_MS = 2 * 24 * 60 * 60 * 1000;
+const SIGNING_ALGORITHM = {
+    name: 'RSASSA-PKCS1-v1_5',
+    hash: 'SHA-256',
+    publicExponent: new Uint8Array([1, 0, 1]),
+    modulusLength: 2048
+};
+const AMBIENT_CA_ENVIRONMENT_KEYS = [
+    'SSL_CERT_FILE',
+    'CURL_CA_BUNDLE',
+    'NODE_EXTRA_CA_CERTS'
+];
+async function ambientCaCertificates(environment, outputPath) {
+    const paths = new Set();
+    for (const key of AMBIENT_CA_ENVIRONMENT_KEYS) {
+        const value = environment[key]?.trim();
+        if (!value)
+            continue;
+        const path = (0, node_path_1.resolve)(value);
+        // A reused process must never append yesterday's generated bundle to the
+        // new one and make the file grow on every proxy restart.
+        if (path !== outputPath)
+            paths.add(path);
+    }
+    const certificates = [];
+    for (const path of paths) {
+        try {
+            const contents = await (0, promises_1.readFile)(path);
+            if (contents.length > 0) {
+                certificates.push(contents.at(-1) === 0x0a
+                    ? contents
+                    : Buffer.concat([contents, Buffer.from('\n')]));
+            }
+        }
+        catch (error) {
+            const code = error.code;
+            // Node itself warns and ignores absent extra-CA files. Preserve that
+            // compatibility while refusing to silently discard a CA file that
+            // exists but cannot be read.
+            if (code === 'ENOENT' || code === 'ENOTDIR')
+                continue;
+            throw error;
+        }
+    }
+    return certificates;
+}
+function validity() {
+    const now = Date.now();
+    return {
+        // Permit a small clock difference between the harness and the client.
+        notBefore: new Date(now - 60_000),
+        notAfter: new Date(now + CERTIFICATE_LIFETIME_MS)
+    };
+}
+function serialNumber() {
+    return (0, node_crypto_1.randomBytes)(16).toString('hex');
+}
+async function privateKeyPem(key) {
+    const pkcs8 = await node_crypto_1.webcrypto.subtle.exportKey('pkcs8', key);
+    return Buffer.from(x509_1.PemConverter.encode(pkcs8, x509_1.PemConverter.PrivateKeyTag));
+}
+/**
+ * Create one short-lived CA for this harness process. WebCrypto creates and
+ * signs every key in process. Private key material exists only in memory. Only
+ * the public CA certificate is written, as the command-line trust anchor.
+ *
+ * SSL_CERT_FILE and CURL_CA_BUNDLE replace (rather than extend) the caller's
+ * normal trust store. The file therefore also carries Node's public roots. If
+ * it contained only our proxy CA, direct HTTPS calls such as the model gateway
+ * would fail with `unable to verify the first certificate` even though their
+ * public certificate chains are valid.
+ */
+async function createGitHubProxyCertificates(stateRoot, options = {}) {
+    x509_1.cryptoProvider.set(node_crypto_1.webcrypto);
+    const root = (0, node_path_1.resolve)(stateRoot);
+    await (0, promises_1.mkdir)(root, { recursive: true, mode: 0o700 });
+    const caKeys = (await node_crypto_1.webcrypto.subtle.generateKey(SIGNING_ALGORITHM, false, [
+        'sign',
+        'verify'
+    ]));
+    const ca = await x509_1.X509CertificateGenerator.createSelfSigned({
+        serialNumber: serialNumber(),
+        name: 'CN=Peakflo GitHub Sandbox Proxy CA',
+        ...validity(),
+        signingAlgorithm: SIGNING_ALGORITHM,
+        keys: caKeys,
+        extensions: [
+            new x509_1.BasicConstraintsExtension(true, undefined, true),
+            new x509_1.KeyUsagesExtension(x509_1.KeyUsageFlags.keyCertSign | x509_1.KeyUsageFlags.cRLSign, true),
+            await x509_1.SubjectKeyIdentifierExtension.create(caKeys.publicKey)
+        ]
+    });
+    const caCertificate = Buffer.from(ca.toString('pem'));
+    const caCertificatePath = (0, node_path_1.join)(root, CA_CERTIFICATE_FILE);
+    const ambientRoots = await ambientCaCertificates(options.environment ?? process.env, caCertificatePath);
+    const publicRoots = `${node_tls_1.rootCertificates.join('\n')}\n`;
+    await (0, promises_1.writeFile)(caCertificatePath, Buffer.concat([...ambientRoots, Buffer.from(publicRoots), caCertificate]), { mode: 0o644 });
+    await (0, promises_1.chmod)(caCertificatePath, 0o644);
+    const leaves = new Map();
+    const makeLeaf = async (hostname) => {
+        const leafKeys = (await node_crypto_1.webcrypto.subtle.generateKey(SIGNING_ALGORITHM, true, ['sign', 'verify']));
+        const certificate = await x509_1.X509CertificateGenerator.create({
+            serialNumber: serialNumber(),
+            subject: `CN=${hostname}`,
+            issuer: ca.subject,
+            ...validity(),
+            signingAlgorithm: SIGNING_ALGORITHM,
+            publicKey: leafKeys.publicKey,
+            signingKey: caKeys.privateKey,
+            extensions: [
+                new x509_1.BasicConstraintsExtension(false, undefined, true),
+                new x509_1.KeyUsagesExtension(x509_1.KeyUsageFlags.digitalSignature | x509_1.KeyUsageFlags.keyEncipherment, true),
+                new x509_1.ExtendedKeyUsageExtension([x509_1.ExtendedKeyUsage.serverAuth]),
+                new x509_1.SubjectAlternativeNameExtension([{ type: 'dns', value: hostname }]),
+                await x509_1.SubjectKeyIdentifierExtension.create(leafKeys.publicKey)
+            ]
+        });
+        return {
+            certificate: Buffer.from(certificate.toString('pem')),
+            privateKey: await privateKeyPem(leafKeys.privateKey)
+        };
+    };
+    return {
+        caCertificate,
+        caCertificatePath,
+        leaf(hostname) {
+            let leaf = leaves.get(hostname);
+            if (!leaf) {
+                leaf = makeLeaf(hostname);
+                leaves.set(hostname, leaf);
+            }
+            return leaf;
+        }
+    };
+}

package/dist/github-proxy.d.ts

@@ -0,0 +1,37 @@
+import { type Server } from 'node:http';
+import { type RequestOptions as HttpsRequestOptions } from 'node:https';
+import { type Socket } from 'node:net';
+import type { GitHubProxyCertificates } from './github-proxy-certificates';
+import type { LeasedGitHubCredential } from './types';
+export interface GitHubProxySession {
+    sessionId: string;
+    sentinel: string;
+    credential: LeasedGitHubCredential;
+}
+export interface GitHubProxyOptions {
+    certificates: GitHubProxyCertificates;
+    findSession(sentinel: string): GitHubProxySession | undefined;
+    isDirectHostAllowed?(hostname: string): boolean;
+    logger?: Pick<Console, 'warn'>;
+    connectDirect?: (hostname: string, port: number) => Socket;
+    resolveUpstream?: (hostname: string) => Partial<HttpsRequestOptions>;
+}
+export interface ReceivePackCommand {
+    oldOid: string;
+    newOid: string;
+    ref: string;
+}
+export declare function parseReceivePackCommands(body: Buffer): ReceivePackCommand[];
+export declare function receivePackRefusal(body: Buffer, sessionId: string): string | null;
+export declare class GitHubTlsProxy {
+    private readonly listener;
+    private readonly options;
+    private readonly tunneled;
+    constructor(listener: Server, options: GitHubProxyOptions);
+    private refused;
+    private logRefusal;
+    private connect;
+    private connectDirect;
+    private handle;
+    private forward;
+}