@piecemaker-legal/piecemaker 1.0.0

package/scripts/piecemaker/hooks/proxy-guard.mjs

@@ -0,0 +1,286 @@
+#!/usr/bin/env node
+/**
+ * Hook SessionStart — garde-fou contre le port mort du proxy PII.
+ *
+ * Le proxy de ce dépôt (server/piecemaker/anonymizer/proxy.cjs, démarré par
+ * service.cjs) écoute un port fixe et vit avec le process serveur. Il meurt
+ * avec lui, mais la configuration qu'il a écrite survit sur disque : une
+ * session démarrée serveur éteint pointe alors vers un port fermé en boucle,
+ * sans pouvoir se corriger elle-même en cours de route.
+ *
+ * Ce hook sert deux clients, distingués par la variable d'environnement
+ * PIECEMAKER_HOOK_CLIENT :
+ *   - claude (valeur par défaut) : la base vient de ~/.claude/settings.json
+ *     → env.ANTHROPIC_BASE_URL, pathname attendu /anthropic. Nettoyage via
+ *     bypassClaudeCodeProxy() (server/piecemaker/anonymizer/client-config.cjs).
+ *   - codex : la base vient de ~/.codex/config.toml (ou $CODEX_HOME), dans
+ *     le bloc géré délimité par les marqueurs PieceMaker Proxy PII, table
+ *     [model_providers.piecemaker_proxy], pathname attendu /chatgpt.
+ *     Nettoyage via bypassCodexProxy() du même module.
+ *
+ * Il sonde le port concerné, et si le proxy est bien mort retire l'entrée
+ * périmée pour laisser la session démarrer en accès direct plutôt qu'en
+ * échec de connexion permanent. Fail-open strict : aucune exception ne doit
+ * empêcher le démarrage de la session.
+ *
+ * Verdicts possibles, journalisés dans ~/.piecemaker/proxy-guard.log :
+ *   - direct  : aucune base configurée, la session n'est pas anonymisée.
+ *   - externe : une base est configurée mais n'appartient pas à ce proxy.
+ *   - actif   : notre base est configurée et le proxy répond.
+ *   - nettoye : notre base est configurée mais le proxy est mort ; l'entrée
+ *               vient d'être retirée.
+ */
+
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+
+const DEFAULT_PORT = 4111;
+const PROBE_TIMEOUT_MS = 1500;
+const GUARD_NAME = 'repo';
+const CODEX_BLOCK_START = '# >>> PieceMaker Proxy PII (géré automatiquement)';
+const CODEX_BLOCK_END = '# <<< PieceMaker Proxy PII';
+
+function lireEntierPort(valeur) {
+  const nombre = Number.parseInt(valeur, 10);
+  if (Number.isInteger(nombre) && nombre >= 1024 && nombre <= 65535) return nombre;
+  return DEFAULT_PORT;
+}
+
+function lireJsonSiPresent(fichier) {
+  try {
+    if (!fs.existsSync(fichier)) return {};
+    const contenu = fs.readFileSync(fichier, 'utf8');
+    const analyse = JSON.parse(contenu);
+    if (analyse && typeof analyse === 'object' && !Array.isArray(analyse)) return analyse;
+    return {};
+  } catch {
+    return {};
+  }
+}
+
+function lireStdin(delaiMs = 500) {
+  return new Promise((resolve) => {
+    if (process.stdin.isTTY) {
+      resolve('');
+      return;
+    }
+    let donnees = '';
+    let termine = false;
+    const finir = () => {
+      if (termine) return;
+      termine = true;
+      resolve(donnees);
+    };
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (bloc) => { donnees += bloc; });
+    process.stdin.on('end', finir);
+    process.stdin.on('error', finir);
+    setTimeout(finir, delaiMs);
+  });
+}
+
+function estUrlLoopback(valeur, pathAttendu) {
+  try {
+    const url = new URL(String(valeur || ''));
+    const estLoopback = url.hostname === '127.0.0.1' || url.hostname === 'localhost';
+    return estLoopback && url.pathname.replace(/\/$/, '') === pathAttendu;
+  } catch {
+    return false;
+  }
+}
+
+function extraireBaseUrlClaude(userHome) {
+  const settingsFile = path.join(userHome, '.claude', 'settings.json');
+  const settings = lireJsonSiPresent(settingsFile);
+  const env = settings && typeof settings.env === 'object' && settings.env !== null ? settings.env : {};
+  return env.ANTHROPIC_BASE_URL;
+}
+
+function extraireBlocCodex(contenu) {
+  const debut = contenu.indexOf(CODEX_BLOCK_START);
+  const fin = contenu.indexOf(CODEX_BLOCK_END);
+  if (debut === -1 || fin === -1 || fin < debut) return null;
+  return contenu.slice(debut, fin + CODEX_BLOCK_END.length);
+}
+
+function extraireBaseUrlCodex(codexHome) {
+  try {
+    const configFile = path.join(codexHome, 'config.toml');
+    if (!fs.existsSync(configFile)) return undefined;
+    const contenu = fs.readFileSync(configFile, 'utf8');
+    const bloc = extraireBlocCodex(contenu);
+    if (!bloc) return undefined;
+    const correspondance = bloc.match(/^\s*base_url\s*=\s*(?:"([^"]*)"|'([^']*)')/m);
+    if (!correspondance) return undefined;
+    return correspondance[1] !== undefined ? correspondance[1] : correspondance[2];
+  } catch {
+    return undefined;
+  }
+}
+
+function portDeLaBase(valeur, portParDefaut) {
+  try {
+    const url = new URL(String(valeur || ''));
+    if (url.port) return lireEntierPort(url.port);
+    return url.protocol === 'https:' ? 443 : 80;
+  } catch {
+    return portParDefaut;
+  }
+}
+
+function sonderPort(port) {
+  return new Promise((resolve) => {
+    const requete = http.request({ host: '127.0.0.1', port, path: '/', method: 'GET', timeout: PROBE_TIMEOUT_MS }, (reponse) => {
+      reponse.resume();
+      resolve('vivant');
+    });
+    requete.on('timeout', () => { requete.destroy(); resolve('mort'); });
+    requete.on('error', () => resolve('mort'));
+    requete.end();
+  });
+}
+
+function journaliser(homeDir, entree) {
+  try {
+    const fichier = path.join(homeDir, '.piecemaker', 'proxy-guard.log');
+    fs.mkdirSync(path.dirname(fichier), { recursive: true });
+    fs.appendFileSync(fichier, `${JSON.stringify(entree)}\n`, 'utf8');
+  } catch {
+  }
+}
+
+function sortir(payload) {
+  if (payload) process.stdout.write(`${JSON.stringify(payload)}\n`);
+  process.exit(0);
+}
+
+async function main() {
+  const debut = Date.now();
+  const userHome = os.homedir();
+  const client = process.env.PIECEMAKER_HOOK_CLIENT === 'codex' ? 'codex' : 'claude';
+  let route = 'inconnue';
+  let verdict = 'inconnu';
+  let probe = null;
+  let port = DEFAULT_PORT;
+
+  try {
+    const entree = await lireStdin();
+    let stdinAnalyse = {};
+    try { stdinAnalyse = entree ? JSON.parse(entree) : {}; } catch { stdinAnalyse = {}; }
+    const sessionId = stdinAnalyse.session_id ?? null;
+    const source = stdinAnalyse.source ?? null;
+
+    const terminer = (payload) => {
+      journaliser(userHome, {
+        ts: new Date().toISOString(), event: 'SessionStart', source, sessionId,
+        client, port, route, probe, verdict, dureeMs: Date.now() - debut, guard: GUARD_NAME,
+      });
+      sortir(payload);
+    };
+
+    if (client === 'codex') {
+      const codexHome = process.env.CODEX_HOME || path.join(userHome, '.codex');
+      const baseUrl = extraireBaseUrlCodex(codexHome);
+
+      if (!baseUrl) {
+        route = 'absente';
+        verdict = 'direct';
+        terminer({
+          systemMessage: "PieceMaker : aucun proxy PII configuré pour cette session Codex — elle démarre en accès direct, sans anonymisation.",
+          hookSpecificOutput: {
+            hookEventName: 'SessionStart',
+            additionalContext: "Aucun fournisseur piecemaker_proxy n'est configuré dans ~/.codex/config.toml : la session n'est pas routée par le proxy PII PieceMaker, aucune anonymisation n'est appliquée.",
+          },
+        });
+        return;
+      }
+
+      if (!estUrlLoopback(baseUrl, '/chatgpt')) {
+        route = 'externe';
+        verdict = 'externe';
+        terminer(null);
+        return;
+      }
+
+      route = 'proxy_piecemaker';
+      port = portDeLaBase(baseUrl, DEFAULT_PORT);
+      probe = await sonderPort(port);
+
+      if (probe === 'vivant') {
+        verdict = 'actif';
+        terminer(null);
+        return;
+      }
+
+      const { bypassCodexProxy } = require('../../../server/piecemaker/anonymizer/client-config.cjs');
+      bypassCodexProxy({ codexHome });
+
+      verdict = 'nettoye';
+      terminer({
+        systemMessage: `⚠️ PIECEMAKER : proxy PII injoignable sur le port ${port}. La configuration périmée a été retirée de ~/.codex/config.toml — cette session Codex démarre en ACCÈS DIRECT, SANS ANONYMISATION. Démarrer le serveur PieceMaker (commande \`piecemaker\`) pour rétablir la protection.`,
+        hookSpecificOutput: {
+          hookEventName: 'SessionStart',
+          additionalContext: `Le proxy PII PieceMaker était configuré sur le port ${port} mais ne répond pas. Le bloc géré a été retiré de ~/.codex/config.toml et model_provider est revenu à "openai". Cette session n'est PAS anonymisée tant que le serveur PieceMaker (commande \`piecemaker\`) n'est pas relancé.`,
+        },
+      });
+      return;
+    }
+
+    const configFile = path.join(userHome, '.piecemaker', 'config.json');
+    const config = lireJsonSiPresent(configFile);
+    port = lireEntierPort(config.mikePiiPort);
+
+    const baseUrl = extraireBaseUrlClaude(userHome);
+
+    if (!baseUrl) {
+      route = 'absente';
+      verdict = 'direct';
+      terminer({
+        systemMessage: "PieceMaker : aucun proxy PII configuré pour cette session — elle démarre en accès direct, sans anonymisation.",
+        hookSpecificOutput: {
+          hookEventName: 'SessionStart',
+          additionalContext: "Aucune base ANTHROPIC_BASE_URL n'est configurée : la session n'est pas routée par le proxy PII PieceMaker, aucune anonymisation n'est appliquée.",
+        },
+      });
+      return;
+    }
+
+    if (!estUrlLoopback(baseUrl, '/anthropic')) {
+      route = 'externe';
+      verdict = 'externe';
+      terminer(null);
+      return;
+    }
+
+    route = 'proxy_piecemaker';
+    port = portDeLaBase(baseUrl, port);
+    probe = await sonderPort(port);
+
+    if (probe === 'vivant') {
+      verdict = 'actif';
+      terminer(null);
+      return;
+    }
+
+    const { bypassClaudeCodeProxy } = require('../../../server/piecemaker/anonymizer/client-config.cjs');
+    bypassClaudeCodeProxy({ userHome });
+
+    verdict = 'nettoye';
+    terminer({
+      systemMessage: `⚠️ PIECEMAKER : proxy PII injoignable sur le port ${port}. La configuration périmée a été retirée — cette session démarre en ACCÈS DIRECT, SANS ANONYMISATION. Démarrer le serveur PieceMaker (commande \`piecemaker\`) pour rétablir la protection.`,
+      hookSpecificOutput: {
+        hookEventName: 'SessionStart',
+        additionalContext: `Le proxy PII PieceMaker était configuré sur le port ${port} mais ne répond pas. L'entrée ANTHROPIC_BASE_URL périmée a été retirée de ~/.claude/settings.json. Cette session n'est PAS anonymisée tant que le serveur PieceMaker (commande \`piecemaker\`) n'est pas relancé.`,
+      },
+    });
+  } catch {
+    sortir(null);
+  }
+}
+
+main();

package/scripts/promote-dist-server.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+// The server build stages into dist-server.next and this script promotes it
+// into place. The live dist-server must never be deleted before the new build
+// is complete: an interrupted build would otherwise leave the installation
+// without a server entrypoint, crash-looping on MODULE_NOT_FOUND at every
+// start until someone rebuilds it by hand.
+import fs from 'node:fs';
+
+const NEXT = 'dist-server.next';
+const LIVE = 'dist-server';
+const OLD = 'dist-server.old';
+const ENTRY = 'server/index.js';
+
+const mode = process.argv[2] ?? 'promote';
+
+if (mode === 'recover') {
+  // Ran before every server start: if a promotion was interrupted between the
+  // two renames, put the previous build back so the server can boot.
+  if (!fs.existsSync(`${LIVE}/${ENTRY}`) && fs.existsSync(`${OLD}/${ENTRY}`)) {
+    console.error('promote-dist-server: restoring previous dist-server after an interrupted promotion.');
+    fs.rmSync(LIVE, { recursive: true, force: true });
+    fs.renameSync(OLD, LIVE);
+  }
+  process.exit(0);
+}
+
+if (mode !== 'promote') {
+  console.error(`promote-dist-server: unknown mode "${mode}" (expected "promote" or "recover").`);
+  process.exit(64);
+}
+
+if (!fs.existsSync(`${NEXT}/${ENTRY}`)) {
+  console.error(`promote-dist-server: ${NEXT}/${ENTRY} is missing; leaving the current ${LIVE} untouched.`);
+  process.exit(1);
+}
+
+fs.rmSync(OLD, { recursive: true, force: true });
+if (fs.existsSync(LIVE)) {
+  fs.renameSync(LIVE, OLD);
+}
+try {
+  fs.renameSync(NEXT, LIVE);
+} catch (error) {
+  // Put the previous build back before failing so the installation still boots.
+  if (fs.existsSync(OLD) && !fs.existsSync(LIVE)) {
+    fs.renameSync(OLD, LIVE);
+  }
+  throw error;
+}
+fs.rmSync(OLD, { recursive: true, force: true });

package/scripts/release/build-server-bundle.js

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import { createReadStream, readFileSync } from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { loadProductConfig } from '../../shared/product-config.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const rootDir = path.resolve(__dirname, '..', '..');
+const packageJson = JSON.parse(
+  await fs.readFile(path.join(rootDir, 'package.json'), 'utf8'),
+);
+const product = loadProductConfig();
+
+function getElectronVersion() {
+  try {
+    return JSON.parse(
+      readFileSync(path.join(rootDir, 'node_modules', 'electron', 'package.json'), 'utf8'),
+    ).version;
+  } catch {
+    try {
+      return JSON.parse(
+        readFileSync(path.join(rootDir, 'package-lock.json'), 'utf8'),
+      ).packages['node_modules/electron'].version;
+    } catch {
+      throw new Error('Could not resolve an exact Electron version for server native rebuild.');
+    }
+  }
+}
+
+function mapArch(arch = process.arch) {
+  return arch === 'arm64' ? 'arm64' : 'x64';
+}
+
+function mapPlatform(platform = process.platform) {
+  if (platform === 'darwin') return 'mac';
+  if (platform === 'win32') return 'win';
+  return 'linux';
+}
+
+function run(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      stdio: 'inherit',
+      shell: process.platform === 'win32',
+      ...options,
+    });
+    child.once('error', reject);
+    child.once('exit', (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`${command} ${args.join(' ')} exited with code ${code}`));
+    });
+  });
+}
+
+async function pathExists(filePath) {
+  try {
+    await fs.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function copyRequired(stageDir, relativePath) {
+  const from = path.join(rootDir, relativePath);
+  if (!(await pathExists(from))) {
+    throw new Error(`Required server bundle input is missing: ${relativePath}`);
+  }
+  await fs.cp(from, path.join(stageDir, relativePath), { recursive: true });
+}
+
+async function copyIfExists(stageDir, relativePath) {
+  const from = path.join(rootDir, relativePath);
+  if (!(await pathExists(from))) return;
+  await fs.cp(from, path.join(stageDir, relativePath), { recursive: true });
+}
+
+async function writeServerPackageJson(stageDir) {
+  const stagedPackageJson = {
+    ...packageJson,
+    scripts: {
+      ...(packageJson.scripts || {}),
+    },
+  };
+  // The bundle stage is not a git checkout with dev dependencies, so lifecycle
+  // scripts such as Husky prepare must not run there. Dependency install scripts
+  // still run; native modules need them before the Electron ABI rebuild below.
+  delete stagedPackageJson.scripts.postinstall;
+  delete stagedPackageJson.scripts.prepare;
+  delete stagedPackageJson.scripts.prepublishOnly;
+  await fs.writeFile(
+    path.join(stageDir, 'package.json'),
+    `${JSON.stringify(stagedPackageJson, null, 2)}\n`,
+    'utf8',
+  );
+}
+
+function sha256(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = createReadStream(filePath);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('end', () => resolve(hash.digest('hex')));
+    stream.on('error', reject);
+  });
+}
+
+const platform = mapPlatform(process.env.CLOUDCLI_BUNDLE_PLATFORM || process.platform);
+const arch = mapArch(process.env.CLOUDCLI_BUNDLE_ARCH || process.arch);
+const version = packageJson.version;
+const bundleName = `${product.slug}-local-server-${version}-${platform}-${arch}.tar.gz`;
+const bundleRoot = path.join(rootDir, 'release', 'local-server');
+const stageDir = path.join(bundleRoot, `.stage-${version}-${platform}-${arch}`);
+const archivePath = path.join(bundleRoot, bundleName);
+
+await fs.rm(stageDir, { recursive: true, force: true });
+await fs.mkdir(stageDir, { recursive: true });
+await fs.mkdir(bundleRoot, { recursive: true });
+
+await copyRequired(stageDir, 'dist');
+await copyRequired(stageDir, 'dist-server');
+await copyRequired(stageDir, 'public');
+await copyRequired(stageDir, 'shared');
+await copyRequired(stageDir, 'package-lock.json');
+await copyIfExists(stageDir, 'scripts/fix-node-pty.js');
+await writeServerPackageJson(stageDir);
+
+console.log('Installing production server dependencies into bundle stage...');
+await run('npm', ['ci', '--omit=dev'], {
+  cwd: stageDir,
+  env: {
+    ...process.env,
+    npm_config_audit: 'false',
+    npm_config_fund: 'false',
+  },
+});
+
+const electronVersion = getElectronVersion();
+const electronRebuild = process.platform === 'win32'
+  ? path.join(rootDir, 'node_modules', '.bin', 'electron-rebuild.cmd')
+  : path.join(rootDir, 'node_modules', '.bin', 'electron-rebuild');
+console.log(`Rebuilding native server dependencies for Electron ${electronVersion} (${arch})...`);
+await run(electronRebuild, ['--version', electronVersion, '--module-dir', stageDir, '--arch', arch, '--force'], {
+  cwd: rootDir,
+  env: {
+    ...process.env,
+    npm_config_audit: 'false',
+    npm_config_fund: 'false',
+  },
+});
+
+if (await pathExists(path.join(stageDir, 'scripts', 'fix-node-pty.js'))) {
+  await run(process.execPath, ['scripts/fix-node-pty.js'], { cwd: stageDir });
+}
+
+await fs.writeFile(
+  path.join(stageDir, '.installed.json'),
+  JSON.stringify({ version, platform, arch, builtAt: new Date().toISOString() }, null, 2),
+  'utf8',
+);
+
+await fs.rm(archivePath, { force: true });
+const tarArgs = process.platform === 'win32'
+  ? ['-czf', archivePath, '-C', stageDir, '.']
+  : ['-czf', archivePath, '-C', stageDir, '.'];
+await run('tar', tarArgs);
+
+const digest = await sha256(archivePath);
+const checksumPath = `${archivePath}.sha256`;
+await fs.writeFile(checksumPath, `${digest}  ${bundleName}\n`, 'utf8');
+await fs.rm(stageDir, { recursive: true, force: true });
+
+const size = (await fs.stat(archivePath)).size / 1024 / 1024;
+console.log(`Wrote ${path.relative(rootDir, archivePath)} (${size.toFixed(1)} MB)`);
+console.log(`Wrote ${path.relative(rootDir, checksumPath)}`);

package/scripts/release/package-piecemaker.sh

@@ -0,0 +1,73 @@
+#!/bin/sh
+
+# Build a PieceMaker npm package from the latest fast-forwardable remote commit.
+# Nothing is published or pushed unless PUBLISH=1 or PUSH=1 is supplied.
+
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+ROOT_DIR=$(CDPATH= cd -- "$SCRIPT_DIR/../.." && pwd)
+REMOTE=${REMOTE:-origin}
+BUMP=${1:-patch}
+OUTPUT_DIR=${OUTPUT_DIR:-"$ROOT_DIR/release/npm"}
+REGISTRY=${REGISTRY:-https://registry.npmjs.org}
+
+cd "$ROOT_DIR"
+
+case "$BUMP" in
+  patch|minor|major)
+    VERSION_ARGUMENT=$BUMP
+    ;;
+  v[0-9]*|[0-9]*)
+    VERSION_ARGUMENT=$BUMP
+    ;;
+  *)
+    printf '%s\n' 'Usage: npm run package:release -- [patch|minor|major|VERSION]' >&2
+    exit 2
+    ;;
+esac
+
+if [ -n "$(git status --porcelain)" ]; then
+  printf '%s\n' 'Release aborted: the working tree is not clean.' >&2
+  printf '%s\n' 'Commit or stash existing changes before regenerating the package.' >&2
+  exit 1
+fi
+
+BRANCH=$(git symbolic-ref --quiet --short HEAD || true)
+if [ -z "$BRANCH" ]; then
+  printf '%s\n' 'Release aborted: HEAD is detached.' >&2
+  exit 1
+fi
+
+printf 'Updating %s from %s/%s...\n' "$BRANCH" "$REMOTE" "$BRANCH"
+git fetch "$REMOTE" "$BRANCH"
+git pull --ff-only "$REMOTE" "$BRANCH"
+
+printf 'Bumping package version (%s)...\n' "$VERSION_ARGUMENT"
+npm version "$VERSION_ARGUMENT" --no-git-tag-version
+VERSION=$(node -p "require('./package.json').version")
+PACKAGE_NAME=$(node -p "require('./package.json').name")
+
+printf 'Building %s %s...\n' "$PACKAGE_NAME" "$VERSION"
+npm run build
+
+mkdir -p "$OUTPUT_DIR"
+printf 'Creating package archive in %s...\n' "$OUTPUT_DIR"
+npm pack --pack-destination "$OUTPUT_DIR"
+
+if [ "${PUBLISH:-0}" = "1" ]; then
+  printf 'Publishing %s to %s...\n' "$PACKAGE_NAME" "$REGISTRY"
+  npm publish --registry "$REGISTRY" --access public
+else
+  printf '%s\n' 'Not publishing. Set PUBLISH=1 to publish to the selected registry.'
+fi
+
+if [ "${PUSH:-0}" = "1" ]; then
+  git add package.json package-lock.json
+  git commit -m "release: PieceMaker $VERSION"
+  git push "$REMOTE" "$BRANCH"
+else
+  printf '%s\n' 'Not pushing the version bump. Set PUSH=1 to commit and push it.'
+fi
+
+printf 'Done: %s %s\n' "$PACKAGE_NAME" "$VERSION"