@pellux/goodvibes-tui 0.18.4

package/src/runtime/network/inbound.ts

@@ -0,0 +1,131 @@
+import { existsSync } from 'node:fs';
+import type { ConfigManager } from '../../config/manager.ts';
+import { getDefaultInboundCertPaths, inspectPrivateKeyPermissions, resolvePathFromGoodVibesRoot } from './shared.ts';
+
+export type InboundTlsMode = 'off' | 'proxy' | 'direct';
+export type InboundServerSurface = 'controlPlane' | 'httpListener';
+
+export interface InboundTlsSnapshot {
+  readonly surface: InboundServerSurface;
+  readonly host: string;
+  readonly port: number;
+  readonly mode: InboundTlsMode;
+  readonly scheme: 'http' | 'https';
+  readonly trustProxy: boolean;
+  readonly certFile?: string;
+  readonly keyFile?: string;
+  readonly usingDefaultPaths: boolean;
+  readonly ready: boolean;
+  readonly errors: readonly string[];
+  readonly keyPermissions?: {
+    readonly available: boolean;
+    readonly safe?: boolean;
+    readonly mode?: string;
+  };
+}
+
+export interface ResolvedInboundTlsContext extends InboundTlsSnapshot {
+  readonly tls?: Bun.TLSOptions;
+}
+
+function readMode(configManager: ConfigManager, surface: InboundServerSurface): InboundTlsMode {
+  return surface === 'controlPlane'
+    ? configManager.get('controlPlane.tls.mode')
+    : configManager.get('httpListener.tls.mode');
+}
+
+function readTrustProxy(configManager: ConfigManager, surface: InboundServerSurface): boolean {
+  return surface === 'controlPlane'
+    ? Boolean(configManager.get('controlPlane.trustProxy'))
+    : Boolean(configManager.get('httpListener.trustProxy'));
+}
+
+function readHost(configManager: ConfigManager, surface: InboundServerSurface): string {
+  return String(surface === 'controlPlane'
+    ? configManager.get('controlPlane.host')
+    : configManager.get('httpListener.host'));
+}
+
+function readPort(configManager: ConfigManager, surface: InboundServerSurface): number {
+  return Number(surface === 'controlPlane'
+    ? configManager.get('controlPlane.port')
+    : configManager.get('httpListener.port'));
+}
+
+function readConfiguredCertPath(configManager: ConfigManager, surface: InboundServerSurface): string | null {
+  return resolvePathFromGoodVibesRoot(
+    surface === 'controlPlane'
+      ? configManager.get('controlPlane.tls.certFile')
+      : configManager.get('httpListener.tls.certFile'),
+    configManager,
+  );
+}
+
+function readConfiguredKeyPath(configManager: ConfigManager, surface: InboundServerSurface): string | null {
+  return resolvePathFromGoodVibesRoot(
+    surface === 'controlPlane'
+      ? configManager.get('controlPlane.tls.keyFile')
+      : configManager.get('httpListener.tls.keyFile'),
+    configManager,
+  );
+}
+
+export function inspectInboundTls(configManager: ConfigManager, surface: InboundServerSurface): InboundTlsSnapshot {
+  const mode = readMode(configManager, surface);
+  const trustProxy = readTrustProxy(configManager, surface);
+  const host = readHost(configManager, surface);
+  const port = readPort(configManager, surface);
+  if (mode !== 'direct') {
+    return {
+      surface,
+      host,
+      port,
+      mode,
+      scheme: mode === 'proxy' ? 'https' : 'http',
+      trustProxy,
+      usingDefaultPaths: false,
+      ready: true,
+      errors: [],
+    };
+  }
+
+  const defaults = getDefaultInboundCertPaths(configManager);
+  const certFile = readConfiguredCertPath(configManager, surface) ?? defaults.certFile;
+  const keyFile = readConfiguredKeyPath(configManager, surface) ?? defaults.keyFile;
+  const usingDefaultPaths = certFile === defaults.certFile && keyFile === defaults.keyFile;
+  const errors: string[] = [];
+  if (!existsSync(certFile)) errors.push(`Certificate file not found: ${certFile}`);
+  if (!existsSync(keyFile)) errors.push(`Private key file not found: ${keyFile}`);
+  const keyPermissions = inspectPrivateKeyPermissions(keyFile);
+  return {
+    surface,
+    host,
+    port,
+    mode,
+    scheme: 'https',
+    trustProxy,
+    certFile,
+    keyFile,
+    usingDefaultPaths,
+    ready: errors.length === 0,
+    errors,
+    keyPermissions,
+  };
+}
+
+export function resolveInboundTlsContext(configManager: ConfigManager, surface: InboundServerSurface): ResolvedInboundTlsContext {
+  const snapshot = inspectInboundTls(configManager, surface);
+  if (snapshot.mode !== 'direct') return snapshot;
+  if (!snapshot.ready || !snapshot.certFile || !snapshot.keyFile) {
+    throw new Error(
+      `${surface} direct TLS is enabled but certificate files are not ready: ${snapshot.errors.join('; ')}`,
+    );
+  }
+  return {
+    ...snapshot,
+    tls: {
+      cert: Bun.file(snapshot.certFile),
+      key: Bun.file(snapshot.keyFile),
+    },
+  };
+}

package/src/runtime/network/index.ts

@@ -0,0 +1,30 @@
+export type {
+  InboundServerSurface,
+  InboundTlsMode,
+  InboundTlsSnapshot,
+  ResolvedInboundTlsContext,
+} from './inbound.ts';
+export {
+  inspectInboundTls,
+  resolveInboundTlsContext,
+} from './inbound.ts';
+export type {
+  OutboundTlsSnapshot,
+  OutboundTrustMode,
+} from './outbound.ts';
+export {
+  applyOutboundTlsToFetchInit,
+  createNetworkFetch,
+  GlobalNetworkTransportInstaller,
+  inspectOutboundTls,
+} from './outbound.ts';
+export {
+  extractForwardedClientIp,
+  getDefaultCertDirectory,
+  getDefaultInboundCertPaths,
+  getGoodVibesRootDir,
+  inspectPrivateKeyPermissions,
+  isLocalHostname,
+  readPemEntriesFromDirectory,
+  resolvePathFromGoodVibesRoot,
+} from './shared.ts';

package/src/runtime/network/outbound.ts

@@ -0,0 +1,292 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { getCACertificates } from 'node:tls';
+import type { ConfigManager } from '../../config/manager.ts';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils/logger';
+import { isLocalHostname, readPemEntriesFromDirectory, resolvePathFromGoodVibesRoot } from './shared.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils/error-display';
+
+export type OutboundTrustMode = 'bundled' | 'bundled+custom' | 'custom';
+
+type FetchTlsOptions = Bun.TLSOptions & {
+  checkServerIdentity?: NonNullable<import('node:tls').ConnectionOptions['checkServerIdentity']>;
+};
+
+type FetchInitWithTls = RequestInit & {
+  tls?: FetchTlsOptions;
+};
+
+export interface OutboundTlsSnapshot {
+  readonly mode: OutboundTrustMode;
+  readonly allowInsecureLocalhost: boolean;
+  readonly customCaFile?: string;
+  readonly customCaDir?: string;
+  readonly customCaEntryCount: number;
+  readonly effectiveCaStrategy: 'bun-default' | 'bundled+custom' | 'custom';
+  readonly errors: readonly string[];
+}
+
+interface ResolvedOutboundTlsContext {
+  readonly snapshot: OutboundTlsSnapshot;
+  readonly caEntries?: readonly string[];
+}
+
+const NETWORK_FETCH_WRAPPER = Symbol.for('goodvibes.network.fetch-wrapper');
+const NETWORK_FETCH_MANAGER = Symbol.for('goodvibes.network.fetch-manager');
+
+type WrappedNetworkFetch = typeof globalThis.fetch & {
+  [NETWORK_FETCH_WRAPPER]?: true;
+  [NETWORK_FETCH_MANAGER]?: GlobalNetworkTransportInstaller;
+};
+
+function readMode(configManager: ConfigManager): OutboundTrustMode {
+  return configManager.get('network.outboundTls.mode');
+}
+
+function readAllowInsecureLocalhost(configManager: ConfigManager): boolean {
+  return Boolean(configManager.get('network.outboundTls.allowInsecureLocalhost'));
+}
+
+function readCustomCaFile(configManager: ConfigManager): string | null {
+  return resolvePathFromGoodVibesRoot(configManager.get('network.outboundTls.customCaFile'), configManager);
+}
+
+function readCustomCaDir(configManager: ConfigManager): string | null {
+  return resolvePathFromGoodVibesRoot(configManager.get('network.outboundTls.customCaDir'), configManager);
+}
+
+function loadCustomCaEntries(configManager: ConfigManager): {
+  readonly entries: readonly string[];
+  readonly errors: readonly string[];
+  readonly customCaFile?: string;
+  readonly customCaDir?: string;
+} {
+  const errors: string[] = [];
+  const entries: string[] = [];
+  const customCaFile = readCustomCaFile(configManager);
+  const customCaDir = readCustomCaDir(configManager);
+
+  if (customCaFile) {
+    if (existsSync(customCaFile)) {
+      entries.push(readFileSync(customCaFile, 'utf-8'));
+    } else {
+      errors.push(`Custom CA file not found: ${customCaFile}`);
+    }
+  }
+
+  if (customCaDir) {
+    if (existsSync(customCaDir)) {
+      for (const path of readPemEntriesFromDirectory(customCaDir)) {
+        entries.push(readFileSync(path, 'utf-8'));
+      }
+    } else {
+      errors.push(`Custom CA directory not found: ${customCaDir}`);
+    }
+  }
+
+  return {
+    entries,
+    errors,
+    ...(customCaFile ? { customCaFile } : {}),
+    ...(customCaDir ? { customCaDir } : {}),
+  };
+}
+
+function getBundledCaEntries(): readonly string[] {
+  return getCACertificates('bundled');
+}
+
+export function inspectOutboundTls(configManager: ConfigManager): OutboundTlsSnapshot {
+  const mode = readMode(configManager);
+  const allowInsecureLocalhost = readAllowInsecureLocalhost(configManager);
+  const custom = loadCustomCaEntries(configManager);
+  return {
+    mode,
+    allowInsecureLocalhost,
+    ...(custom.customCaFile ? { customCaFile: custom.customCaFile } : {}),
+    ...(custom.customCaDir ? { customCaDir: custom.customCaDir } : {}),
+    customCaEntryCount: custom.entries.length,
+    effectiveCaStrategy: mode === 'bundled'
+      ? 'bun-default'
+      : mode === 'bundled+custom'
+        ? 'bundled+custom'
+        : 'custom',
+    errors: custom.errors,
+  };
+}
+
+function resolveOutboundTlsContext(configManager: ConfigManager): ResolvedOutboundTlsContext {
+  const snapshot = inspectOutboundTls(configManager);
+  const custom = loadCustomCaEntries(configManager);
+  const caEntries = snapshot.mode === 'bundled'
+    ? undefined
+    : snapshot.mode === 'bundled+custom'
+      ? [...getBundledCaEntries(), ...custom.entries]
+      : [...custom.entries];
+  return { snapshot, ...(caEntries ? { caEntries } : {}) };
+}
+
+function extractRequestUrl(input: RequestInfo | URL): URL | null {
+  try {
+    if (typeof input === 'string') return new URL(input);
+    if (input instanceof URL) return input;
+    if (typeof Request !== 'undefined' && input instanceof Request) return new URL(input.url);
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+function extractRequestMethod(input: RequestInfo | URL, init?: RequestInit): string {
+  if (init?.method) return init.method.toUpperCase();
+  if (typeof Request !== 'undefined' && input instanceof Request) return input.method.toUpperCase();
+  return 'GET';
+}
+
+function extractHeaderValue(headers: HeadersInit | undefined, name: string): string | undefined {
+  if (!headers) return undefined;
+  if (headers instanceof Headers) return headers.get(name) ?? undefined;
+  if (Array.isArray(headers)) {
+    const loweredName = name.toLowerCase();
+    const match = headers.find(([key]) => key.toLowerCase() === loweredName);
+    return match?.[1];
+  }
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== name.toLowerCase()) continue;
+    if (Array.isArray(value)) return value.join(', ');
+    return value;
+  }
+  return undefined;
+}
+
+function shouldTraceProviderRequest(url: URL, method: string): boolean {
+  if (method !== 'POST') return false;
+  return (
+    url.pathname.endsWith('/chat/completions') ||
+    url.pathname.endsWith('/responses') ||
+    url.pathname.endsWith('/messages')
+  );
+}
+
+async function executeNetworkFetch(
+  fetchImpl: typeof globalThis.fetch,
+  input: RequestInfo | URL,
+  init: RequestInit | undefined,
+  configManager: ConfigManager,
+): Promise<Response> {
+  const nextInit = applyOutboundTlsToFetchInit(input, init, configManager);
+  const url = extractRequestUrl(input);
+  const method = extractRequestMethod(input, nextInit);
+  const shouldTrace = url ? shouldTraceProviderRequest(url, method) : false;
+
+  if (shouldTrace && url) {
+    logger.debug('Outbound provider request', {
+      method,
+      host: url.host,
+      path: url.pathname,
+      contentType: extractHeaderValue(nextInit.headers, 'content-type'),
+      contentLength: extractHeaderValue(nextInit.headers, 'content-length'),
+    });
+  }
+
+  try {
+    const response = await fetchImpl(input, nextInit);
+    if (shouldTrace && url) {
+      logger.debug('Outbound provider response', {
+        method,
+        host: url.host,
+        path: url.pathname,
+        status: response.status,
+        requestId: response.headers.get('x-request-id') ?? response.headers.get('request-id') ?? undefined,
+      });
+    }
+    return response;
+  } catch (error) {
+    if (shouldTrace && url) {
+      logger.error('Outbound provider request failed', {
+        method,
+        host: url.host,
+        path: url.pathname,
+        error: summarizeError(error),
+      });
+    }
+    throw error;
+  }
+}
+
+export function applyOutboundTlsToFetchInit(
+  input: RequestInfo | URL,
+  init: RequestInit | undefined,
+  configManager: ConfigManager,
+): FetchInitWithTls {
+  const url = extractRequestUrl(input);
+  const nextInit = { ...(init ?? {}) } as FetchInitWithTls;
+  if (!url || url.protocol !== 'https:') return nextInit;
+
+  const context = resolveOutboundTlsContext(configManager);
+  const existingTls = nextInit.tls ?? {};
+  const nextTls: FetchTlsOptions = { ...existingTls };
+
+  if (context.snapshot.mode === 'custom' && !nextTls.ca && (!context.caEntries || context.caEntries.length === 0)) {
+    throw new Error(
+      'network.outboundTls.mode is custom, but no custom CA entries were loaded. Configure network.outboundTls.customCaFile or network.outboundTls.customCaDir.',
+    );
+  }
+
+  if (!nextTls.ca && context.caEntries && context.caEntries.length > 0) {
+    nextTls.ca = [...context.caEntries];
+  }
+
+  if (
+    context.snapshot.allowInsecureLocalhost
+    && nextTls.rejectUnauthorized === undefined
+    && isLocalHostname(url.hostname)
+  ) {
+    nextTls.rejectUnauthorized = false;
+  }
+
+  return Object.keys(nextTls).length > 0
+    ? { ...nextInit, tls: nextTls }
+    : nextInit;
+}
+
+export function createNetworkFetch(
+  fetchImpl: typeof globalThis.fetch,
+  configManager: ConfigManager,
+): typeof globalThis.fetch {
+  const wrapped = (async (input: RequestInfo | URL, init?: RequestInit) =>
+    executeNetworkFetch(fetchImpl, input, init, configManager)) as typeof globalThis.fetch;
+  Object.assign(wrapped, fetchImpl);
+  return wrapped;
+}
+
+export class GlobalNetworkTransportInstaller {
+  private originalFetchRef: typeof globalThis.fetch | null = null;
+  private configManager: ConfigManager | null = null;
+
+  setConfigManager(configManager: ConfigManager): void {
+    this.configManager = configManager;
+  }
+
+  install(configManager: ConfigManager): void {
+    const currentFetch = globalThis.fetch as WrappedNetworkFetch;
+    if (currentFetch[NETWORK_FETCH_MANAGER]) {
+      currentFetch[NETWORK_FETCH_MANAGER]!.setConfigManager(configManager);
+      logger.debug('Updated global network transport', { ...inspectOutboundTls(configManager) });
+      return;
+    }
+
+    this.configManager = configManager;
+    this.originalFetchRef = globalThis.fetch.bind(globalThis);
+    const wrapped = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (!this.originalFetchRef || !this.configManager) {
+        throw new Error('Global network transport is not initialized correctly.');
+      }
+      return executeNetworkFetch(this.originalFetchRef, input, init, this.configManager);
+    }) as WrappedNetworkFetch;
+    Object.assign(wrapped, globalThis.fetch);
+    wrapped[NETWORK_FETCH_WRAPPER] = true;
+    wrapped[NETWORK_FETCH_MANAGER] = this;
+    globalThis.fetch = wrapped;
+    logger.debug('Installed global network transport', { ...inspectOutboundTls(configManager) });
+  }
+}

package/src/runtime/network/shared.ts

@@ -0,0 +1,82 @@
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { basename, dirname, extname, isAbsolute, join, resolve } from 'node:path';
+import type { ConfigManager } from '../../config/manager.ts';
+
+const PEM_EXTENSIONS = new Set(['.pem', '.crt', '.cer']);
+
+type NetworkRootConfig = Pick<ConfigManager, 'getControlPlaneConfigDir'>;
+
+export function getGoodVibesRootDir(configManager: NetworkRootConfig): string {
+  const configuredDir = configManager.getControlPlaneConfigDir();
+  return resolve(configuredDir);
+}
+
+export function getDefaultCertDirectory(configManager: NetworkRootConfig): string {
+  return join(getGoodVibesRootDir(configManager), 'certs');
+}
+
+export function getDefaultInboundCertPaths(configManager: NetworkRootConfig): {
+  readonly certFile: string;
+  readonly keyFile: string;
+} {
+  const certDir = getDefaultCertDirectory(configManager);
+  return {
+    certFile: join(certDir, 'fullchain.pem'),
+    keyFile: join(certDir, 'privkey.pem'),
+  };
+}
+
+export function resolvePathFromGoodVibesRoot(
+  value: string | null | undefined,
+  configManager: NetworkRootConfig,
+): string | null {
+  const trimmed = value?.trim();
+  if (!trimmed) return null;
+  return isAbsolute(trimmed)
+    ? trimmed
+    : resolve(getGoodVibesRootDir(configManager), trimmed);
+}
+
+export function readPemEntriesFromDirectory(path: string): string[] {
+  if (!existsSync(path)) return [];
+  return readdirSync(path, { withFileTypes: true })
+    .filter((entry) => entry.isFile() && PEM_EXTENSIONS.has(extname(entry.name).toLowerCase()))
+    .map((entry) => join(path, entry.name))
+    .sort((a, b) => a.localeCompare(b));
+}
+
+export function isLocalHostname(hostname: string): boolean {
+  const normalized = hostname.trim().toLowerCase();
+  return normalized === 'localhost'
+    || normalized === '127.0.0.1'
+    || normalized === '::1'
+    || normalized === '[::1]';
+}
+
+export function extractForwardedClientIp(req: Request, trustProxy: boolean): string | undefined {
+  if (!trustProxy) return undefined;
+  const forwarded = req.headers.get('x-forwarded-for');
+  if (forwarded) {
+    const first = forwarded.split(',').map((value) => value.trim()).find(Boolean);
+    if (first) return first;
+  }
+  const realIp = req.headers.get('x-real-ip')?.trim();
+  return realIp ? realIp : undefined;
+}
+
+export function inspectPrivateKeyPermissions(path: string): {
+  readonly available: boolean;
+  readonly safe?: boolean;
+  readonly mode?: string;
+} {
+  if (!existsSync(path) || process.platform === 'win32') {
+    return { available: false };
+  }
+  const stat = statSync(path);
+  const mode = stat.mode & 0o777;
+  return {
+    available: true,
+    safe: (mode & 0o077) === 0,
+    mode: `0${mode.toString(8)}`,
+  };
+}