@pellux/goodvibes-tui 0.18.11 → 0.18.13

package/src/runtime/network/inbound.ts

@@ -1,131 +0,0 @@
-import { existsSync } from 'node:fs';
-import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config/manager';
-import { getDefaultInboundCertPaths, inspectPrivateKeyPermissions, resolvePathFromGoodVibesRoot } from '@pellux/goodvibes-sdk/platform/runtime/network/shared';
-
-export type InboundTlsMode = 'off' | 'proxy' | 'direct';
-export type InboundServerSurface = 'controlPlane' | 'httpListener';
-
-export interface InboundTlsSnapshot {
-  readonly surface: InboundServerSurface;
-  readonly host: string;
-  readonly port: number;
-  readonly mode: InboundTlsMode;
-  readonly scheme: 'http' | 'https';
-  readonly trustProxy: boolean;
-  readonly certFile?: string;
-  readonly keyFile?: string;
-  readonly usingDefaultPaths: boolean;
-  readonly ready: boolean;
-  readonly errors: readonly string[];
-  readonly keyPermissions?: {
-    readonly available: boolean;
-    readonly safe?: boolean;
-    readonly mode?: string;
-  };
-}
-
-export interface ResolvedInboundTlsContext extends InboundTlsSnapshot {
-  readonly tls?: Bun.TLSOptions;
-}
-
-function readMode(configManager: ConfigManager, surface: InboundServerSurface): InboundTlsMode {
-  return surface === 'controlPlane'
-    ? configManager.get('controlPlane.tls.mode')
-    : configManager.get('httpListener.tls.mode');
-}
-
-function readTrustProxy(configManager: ConfigManager, surface: InboundServerSurface): boolean {
-  return surface === 'controlPlane'
-    ? Boolean(configManager.get('controlPlane.trustProxy'))
-    : Boolean(configManager.get('httpListener.trustProxy'));
-}
-
-function readHost(configManager: ConfigManager, surface: InboundServerSurface): string {
-  return String(surface === 'controlPlane'
-    ? configManager.get('controlPlane.host')
-    : configManager.get('httpListener.host'));
-}
-
-function readPort(configManager: ConfigManager, surface: InboundServerSurface): number {
-  return Number(surface === 'controlPlane'
-    ? configManager.get('controlPlane.port')
-    : configManager.get('httpListener.port'));
-}
-
-function readConfiguredCertPath(configManager: ConfigManager, surface: InboundServerSurface): string | null {
-  return resolvePathFromGoodVibesRoot(
-    surface === 'controlPlane'
-      ? configManager.get('controlPlane.tls.certFile')
-      : configManager.get('httpListener.tls.certFile'),
-    configManager,
-  );
-}
-
-function readConfiguredKeyPath(configManager: ConfigManager, surface: InboundServerSurface): string | null {
-  return resolvePathFromGoodVibesRoot(
-    surface === 'controlPlane'
-      ? configManager.get('controlPlane.tls.keyFile')
-      : configManager.get('httpListener.tls.keyFile'),
-    configManager,
-  );
-}
-
-export function inspectInboundTls(configManager: ConfigManager, surface: InboundServerSurface): InboundTlsSnapshot {
-  const mode = readMode(configManager, surface);
-  const trustProxy = readTrustProxy(configManager, surface);
-  const host = readHost(configManager, surface);
-  const port = readPort(configManager, surface);
-  if (mode !== 'direct') {
-    return {
-      surface,
-      host,
-      port,
-      mode,
-      scheme: mode === 'proxy' ? 'https' : 'http',
-      trustProxy,
-      usingDefaultPaths: false,
-      ready: true,
-      errors: [],
-    };
-  }
-
-  const defaults = getDefaultInboundCertPaths(configManager);
-  const certFile = readConfiguredCertPath(configManager, surface) ?? defaults.certFile;
-  const keyFile = readConfiguredKeyPath(configManager, surface) ?? defaults.keyFile;
-  const usingDefaultPaths = certFile === defaults.certFile && keyFile === defaults.keyFile;
-  const errors: string[] = [];
-  if (!existsSync(certFile)) errors.push(`Certificate file not found: ${certFile}`);
-  if (!existsSync(keyFile)) errors.push(`Private key file not found: ${keyFile}`);
-  const keyPermissions = inspectPrivateKeyPermissions(keyFile);
-  return {
-    surface,
-    host,
-    port,
-    mode,
-    scheme: 'https',
-    trustProxy,
-    certFile,
-    keyFile,
-    usingDefaultPaths,
-    ready: errors.length === 0,
-    errors,
-    keyPermissions,
-  };
-}
-
-export function resolveInboundTlsContext(configManager: ConfigManager, surface: InboundServerSurface): ResolvedInboundTlsContext {
-  const snapshot = inspectInboundTls(configManager, surface);
-  if (snapshot.mode !== 'direct') return snapshot;
-  if (!snapshot.ready || !snapshot.certFile || !snapshot.keyFile) {
-    throw new Error(
-      `${surface} direct TLS is enabled but certificate files are not ready: ${snapshot.errors.join('; ')}`,
-    );
-  }
-  return {
-    ...snapshot,
-    tls: {
-      cert: Bun.file(snapshot.certFile),
-      key: Bun.file(snapshot.keyFile),
-    },
-  };
-}

package/src/runtime/network/index.ts

@@ -1,30 +0,0 @@
-export type {
-  InboundServerSurface,
-  InboundTlsMode,
-  InboundTlsSnapshot,
-  ResolvedInboundTlsContext,
-} from '@pellux/goodvibes-sdk/platform/runtime/network/inbound';
-export {
-  inspectInboundTls,
-  resolveInboundTlsContext,
-} from '@pellux/goodvibes-sdk/platform/runtime/network/inbound';
-export type {
-  OutboundTlsSnapshot,
-  OutboundTrustMode,
-} from '@pellux/goodvibes-sdk/platform/runtime/network/outbound';
-export {
-  applyOutboundTlsToFetchInit,
-  createNetworkFetch,
-  GlobalNetworkTransportInstaller,
-  inspectOutboundTls,
-} from '@pellux/goodvibes-sdk/platform/runtime/network/outbound';
-export {
-  extractForwardedClientIp,
-  getDefaultCertDirectory,
-  getDefaultInboundCertPaths,
-  getGoodVibesRootDir,
-  inspectPrivateKeyPermissions,
-  isLocalHostname,
-  readPemEntriesFromDirectory,
-  resolvePathFromGoodVibesRoot,
-} from '@pellux/goodvibes-sdk/platform/runtime/network/shared';

package/src/runtime/network/outbound.ts

@@ -1,292 +0,0 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { getCACertificates } from 'node:tls';
-import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config/manager';
-import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
-import { isLocalHostname, readPemEntriesFromDirectory, resolvePathFromGoodVibesRoot } from '@pellux/goodvibes-sdk/platform/runtime/network/shared';
-import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
-
-export type OutboundTrustMode = 'bundled' | 'bundled+custom' | 'custom';
-
-type FetchTlsOptions = Bun.TLSOptions & {
-  checkServerIdentity?: NonNullable<import('node:tls').ConnectionOptions['checkServerIdentity']>;
-};
-
-type FetchInitWithTls = RequestInit & {
-  tls?: FetchTlsOptions;
-};
-
-export interface OutboundTlsSnapshot {
-  readonly mode: OutboundTrustMode;
-  readonly allowInsecureLocalhost: boolean;
-  readonly customCaFile?: string;
-  readonly customCaDir?: string;
-  readonly customCaEntryCount: number;
-  readonly effectiveCaStrategy: 'bun-default' | 'bundled+custom' | 'custom';
-  readonly errors: readonly string[];
-}
-
-interface ResolvedOutboundTlsContext {
-  readonly snapshot: OutboundTlsSnapshot;
-  readonly caEntries?: readonly string[];
-}
-
-const NETWORK_FETCH_WRAPPER = Symbol.for('goodvibes.network.fetch-wrapper');
-const NETWORK_FETCH_MANAGER = Symbol.for('goodvibes.network.fetch-manager');
-
-type WrappedNetworkFetch = typeof globalThis.fetch & {
-  [NETWORK_FETCH_WRAPPER]?: true;
-  [NETWORK_FETCH_MANAGER]?: GlobalNetworkTransportInstaller;
-};
-
-function readMode(configManager: ConfigManager): OutboundTrustMode {
-  return configManager.get('network.outboundTls.mode');
-}
-
-function readAllowInsecureLocalhost(configManager: ConfigManager): boolean {
-  return Boolean(configManager.get('network.outboundTls.allowInsecureLocalhost'));
-}
-
-function readCustomCaFile(configManager: ConfigManager): string | null {
-  return resolvePathFromGoodVibesRoot(configManager.get('network.outboundTls.customCaFile'), configManager);
-}
-
-function readCustomCaDir(configManager: ConfigManager): string | null {
-  return resolvePathFromGoodVibesRoot(configManager.get('network.outboundTls.customCaDir'), configManager);
-}
-
-function loadCustomCaEntries(configManager: ConfigManager): {
-  readonly entries: readonly string[];
-  readonly errors: readonly string[];
-  readonly customCaFile?: string;
-  readonly customCaDir?: string;
-} {
-  const errors: string[] = [];
-  const entries: string[] = [];
-  const customCaFile = readCustomCaFile(configManager);
-  const customCaDir = readCustomCaDir(configManager);
-
-  if (customCaFile) {
-    if (existsSync(customCaFile)) {
-      entries.push(readFileSync(customCaFile, 'utf-8'));
-    } else {
-      errors.push(`Custom CA file not found: ${customCaFile}`);
-    }
-  }
-
-  if (customCaDir) {
-    if (existsSync(customCaDir)) {
-      for (const path of readPemEntriesFromDirectory(customCaDir)) {
-        entries.push(readFileSync(path, 'utf-8'));
-      }
-    } else {
-      errors.push(`Custom CA directory not found: ${customCaDir}`);
-    }
-  }
-
-  return {
-    entries,
-    errors,
-    ...(customCaFile ? { customCaFile } : {}),
-    ...(customCaDir ? { customCaDir } : {}),
-  };
-}
-
-function getBundledCaEntries(): readonly string[] {
-  return getCACertificates('bundled');
-}
-
-export function inspectOutboundTls(configManager: ConfigManager): OutboundTlsSnapshot {
-  const mode = readMode(configManager);
-  const allowInsecureLocalhost = readAllowInsecureLocalhost(configManager);
-  const custom = loadCustomCaEntries(configManager);
-  return {
-    mode,
-    allowInsecureLocalhost,
-    ...(custom.customCaFile ? { customCaFile: custom.customCaFile } : {}),
-    ...(custom.customCaDir ? { customCaDir: custom.customCaDir } : {}),
-    customCaEntryCount: custom.entries.length,
-    effectiveCaStrategy: mode === 'bundled'
-      ? 'bun-default'
-      : mode === 'bundled+custom'
-        ? 'bundled+custom'
-        : 'custom',
-    errors: custom.errors,
-  };
-}
-
-function resolveOutboundTlsContext(configManager: ConfigManager): ResolvedOutboundTlsContext {
-  const snapshot = inspectOutboundTls(configManager);
-  const custom = loadCustomCaEntries(configManager);
-  const caEntries = snapshot.mode === 'bundled'
-    ? undefined
-    : snapshot.mode === 'bundled+custom'
-      ? [...getBundledCaEntries(), ...custom.entries]
-      : [...custom.entries];
-  return { snapshot, ...(caEntries ? { caEntries } : {}) };
-}
-
-function extractRequestUrl(input: RequestInfo | URL): URL | null {
-  try {
-    if (typeof input === 'string') return new URL(input);
-    if (input instanceof URL) return input;
-    if (typeof Request !== 'undefined' && input instanceof Request) return new URL(input.url);
-    return null;
-  } catch {
-    return null;
-  }
-}
-
-function extractRequestMethod(input: RequestInfo | URL, init?: RequestInit): string {
-  if (init?.method) return init.method.toUpperCase();
-  if (typeof Request !== 'undefined' && input instanceof Request) return input.method.toUpperCase();
-  return 'GET';
-}
-
-function extractHeaderValue(headers: HeadersInit | undefined, name: string): string | undefined {
-  if (!headers) return undefined;
-  if (headers instanceof Headers) return headers.get(name) ?? undefined;
-  if (Array.isArray(headers)) {
-    const loweredName = name.toLowerCase();
-    const match = headers.find(([key]) => key.toLowerCase() === loweredName);
-    return match?.[1];
-  }
-  for (const [key, value] of Object.entries(headers)) {
-    if (key.toLowerCase() !== name.toLowerCase()) continue;
-    if (Array.isArray(value)) return value.join(', ');
-    return value;
-  }
-  return undefined;
-}
-
-function shouldTraceProviderRequest(url: URL, method: string): boolean {
-  if (method !== 'POST') return false;
-  return (
-    url.pathname.endsWith('/chat/completions') ||
-    url.pathname.endsWith('/responses') ||
-    url.pathname.endsWith('/messages')
-  );
-}
-
-async function executeNetworkFetch(
-  fetchImpl: typeof globalThis.fetch,
-  input: RequestInfo | URL,
-  init: RequestInit | undefined,
-  configManager: ConfigManager,
-): Promise<Response> {
-  const nextInit = applyOutboundTlsToFetchInit(input, init, configManager);
-  const url = extractRequestUrl(input);
-  const method = extractRequestMethod(input, nextInit);
-  const shouldTrace = url ? shouldTraceProviderRequest(url, method) : false;
-
-  if (shouldTrace && url) {
-    logger.debug('Outbound provider request', {
-      method,
-      host: url.host,
-      path: url.pathname,
-      contentType: extractHeaderValue(nextInit.headers, 'content-type'),
-      contentLength: extractHeaderValue(nextInit.headers, 'content-length'),
-    });
-  }
-
-  try {
-    const response = await fetchImpl(input, nextInit);
-    if (shouldTrace && url) {
-      logger.debug('Outbound provider response', {
-        method,
-        host: url.host,
-        path: url.pathname,
-        status: response.status,
-        requestId: response.headers.get('x-request-id') ?? response.headers.get('request-id') ?? undefined,
-      });
-    }
-    return response;
-  } catch (error) {
-    if (shouldTrace && url) {
-      logger.error('Outbound provider request failed', {
-        method,
-        host: url.host,
-        path: url.pathname,
-        error: summarizeError(error),
-      });
-    }
-    throw error;
-  }
-}
-
-export function applyOutboundTlsToFetchInit(
-  input: RequestInfo | URL,
-  init: RequestInit | undefined,
-  configManager: ConfigManager,
-): FetchInitWithTls {
-  const url = extractRequestUrl(input);
-  const nextInit = { ...(init ?? {}) } as FetchInitWithTls;
-  if (!url || url.protocol !== 'https:') return nextInit;
-
-  const context = resolveOutboundTlsContext(configManager);
-  const existingTls = nextInit.tls ?? {};
-  const nextTls: FetchTlsOptions = { ...existingTls };
-
-  if (context.snapshot.mode === 'custom' && !nextTls.ca && (!context.caEntries || context.caEntries.length === 0)) {
-    throw new Error(
-      'network.outboundTls.mode is custom, but no custom CA entries were loaded. Configure network.outboundTls.customCaFile or network.outboundTls.customCaDir.',
-    );
-  }
-
-  if (!nextTls.ca && context.caEntries && context.caEntries.length > 0) {
-    nextTls.ca = [...context.caEntries];
-  }
-
-  if (
-    context.snapshot.allowInsecureLocalhost
-    && nextTls.rejectUnauthorized === undefined
-    && isLocalHostname(url.hostname)
-  ) {
-    nextTls.rejectUnauthorized = false;
-  }
-
-  return Object.keys(nextTls).length > 0
-    ? { ...nextInit, tls: nextTls }
-    : nextInit;
-}
-
-export function createNetworkFetch(
-  fetchImpl: typeof globalThis.fetch,
-  configManager: ConfigManager,
-): typeof globalThis.fetch {
-  const wrapped = (async (input: RequestInfo | URL, init?: RequestInit) =>
-    executeNetworkFetch(fetchImpl, input, init, configManager)) as typeof globalThis.fetch;
-  Object.assign(wrapped, fetchImpl);
-  return wrapped;
-}
-
-export class GlobalNetworkTransportInstaller {
-  private originalFetchRef: typeof globalThis.fetch | null = null;
-  private configManager: ConfigManager | null = null;
-
-  setConfigManager(configManager: ConfigManager): void {
-    this.configManager = configManager;
-  }
-
-  install(configManager: ConfigManager): void {
-    const currentFetch = globalThis.fetch as WrappedNetworkFetch;
-    if (currentFetch[NETWORK_FETCH_MANAGER]) {
-      currentFetch[NETWORK_FETCH_MANAGER]!.setConfigManager(configManager);
-      logger.debug('Updated global network transport', { ...inspectOutboundTls(configManager) });
-      return;
-    }
-
-    this.configManager = configManager;
-    this.originalFetchRef = globalThis.fetch.bind(globalThis);
-    const wrapped = (async (input: RequestInfo | URL, init?: RequestInit) => {
-      if (!this.originalFetchRef || !this.configManager) {
-        throw new Error('Global network transport is not initialized correctly.');
-      }
-      return executeNetworkFetch(this.originalFetchRef, input, init, this.configManager);
-    }) as WrappedNetworkFetch;
-    Object.assign(wrapped, globalThis.fetch);
-    wrapped[NETWORK_FETCH_WRAPPER] = true;
-    wrapped[NETWORK_FETCH_MANAGER] = this;
-    globalThis.fetch = wrapped;
-    logger.debug('Installed global network transport', { ...inspectOutboundTls(configManager) });
-  }
-}

package/src/runtime/network/shared.ts

@@ -1,82 +0,0 @@
-import { existsSync, readdirSync, statSync } from 'node:fs';
-import { basename, dirname, extname, isAbsolute, join, resolve } from 'node:path';
-import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config/manager';
-
-const PEM_EXTENSIONS = new Set(['.pem', '.crt', '.cer']);
-
-type NetworkRootConfig = Pick<ConfigManager, 'getControlPlaneConfigDir'>;
-
-export function getGoodVibesRootDir(configManager: NetworkRootConfig): string {
-  const configuredDir = configManager.getControlPlaneConfigDir();
-  return resolve(configuredDir);
-}
-
-export function getDefaultCertDirectory(configManager: NetworkRootConfig): string {
-  return join(getGoodVibesRootDir(configManager), 'certs');
-}
-
-export function getDefaultInboundCertPaths(configManager: NetworkRootConfig): {
-  readonly certFile: string;
-  readonly keyFile: string;
-} {
-  const certDir = getDefaultCertDirectory(configManager);
-  return {
-    certFile: join(certDir, 'fullchain.pem'),
-    keyFile: join(certDir, 'privkey.pem'),
-  };
-}
-
-export function resolvePathFromGoodVibesRoot(
-  value: string | null | undefined,
-  configManager: NetworkRootConfig,
-): string | null {
-  const trimmed = value?.trim();
-  if (!trimmed) return null;
-  return isAbsolute(trimmed)
-    ? trimmed
-    : resolve(getGoodVibesRootDir(configManager), trimmed);
-}
-
-export function readPemEntriesFromDirectory(path: string): string[] {
-  if (!existsSync(path)) return [];
-  return readdirSync(path, { withFileTypes: true })
-    .filter((entry) => entry.isFile() && PEM_EXTENSIONS.has(extname(entry.name).toLowerCase()))
-    .map((entry) => join(path, entry.name))
-    .sort((a, b) => a.localeCompare(b));
-}
-
-export function isLocalHostname(hostname: string): boolean {
-  const normalized = hostname.trim().toLowerCase();
-  return normalized === 'localhost'
-    || normalized === '127.0.0.1'
-    || normalized === '::1'
-    || normalized === '[::1]';
-}
-
-export function extractForwardedClientIp(req: Request, trustProxy: boolean): string | undefined {
-  if (!trustProxy) return undefined;
-  const forwarded = req.headers.get('x-forwarded-for');
-  if (forwarded) {
-    const first = forwarded.split(',').map((value) => value.trim()).find(Boolean);
-    if (first) return first;
-  }
-  const realIp = req.headers.get('x-real-ip')?.trim();
-  return realIp ? realIp : undefined;
-}
-
-export function inspectPrivateKeyPermissions(path: string): {
-  readonly available: boolean;
-  readonly safe?: boolean;
-  readonly mode?: string;
-} {
-  if (!existsSync(path) || process.platform === 'win32') {
-    return { available: false };
-  }
-  const stat = statSync(path);
-  const mode = stat.mode & 0o777;
-  return {
-    available: true,
-    safe: (mode & 0o077) === 0,
-    mode: `0${mode.toString(8)}`,
-  };
-}