@piecemaker-legal/piecemaker 1.1.0 → 2.0.1

package/server/modules/cli/desktop-shortcut.ts

@@ -0,0 +1,89 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+type ShortcutOutput = {
+  log(message: string): void;
+};
+
+const SHORTCUT_NAME = 'PieceMaker';
+
+function desktopDirectory(): string {
+  return process.env.PIECEMAKER_DESKTOP_DIR || path.join(os.homedir(), 'Desktop');
+}
+
+function launchCommand(): { executable: string; argument: string } {
+  return { executable: process.execPath, argument: process.argv[1] || '' };
+}
+
+function createMacShortcut(desktop: string): string | null {
+  const { executable, argument } = launchCommand();
+  if (!argument) return null;
+  const bundle = path.join(desktop, `${SHORTCUT_NAME}.app`);
+  if (fs.existsSync(bundle)) return null;
+
+  const macOsDirectory = path.join(bundle, 'Contents', 'MacOS');
+  fs.mkdirSync(macOsDirectory, { recursive: true });
+  fs.writeFileSync(
+    path.join(bundle, 'Contents', 'Info.plist'),
+    `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleName</key><string>${SHORTCUT_NAME}</string>
+  <key>CFBundleIdentifier</key><string>legal.piecemaker.launcher</string>
+  <key>CFBundleExecutable</key><string>${SHORTCUT_NAME}</string>
+  <key>CFBundlePackageType</key><string>APPL</string>
+  <key>LSUIElement</key><true/>
+</dict>
+</plist>
+`,
+  );
+
+  const launcher = path.join(macOsDirectory, SHORTCUT_NAME);
+  fs.writeFileSync(launcher, `#!/bin/sh\nexec ${JSON.stringify(executable)} ${JSON.stringify(argument)} start\n`);
+  fs.chmodSync(launcher, 0o755);
+  return bundle;
+}
+
+function createWindowsShortcut(desktop: string): string | null {
+  const { executable, argument } = launchCommand();
+  if (!argument) return null;
+  const shortcut = path.join(desktop, `${SHORTCUT_NAME}.lnk`);
+  if (fs.existsSync(shortcut)) return null;
+
+  const script = [
+    '$shell = New-Object -ComObject WScript.Shell',
+    `$shortcut = $shell.CreateShortcut(${JSON.stringify(shortcut)})`,
+    `$shortcut.TargetPath = ${JSON.stringify(executable)}`,
+    `$shortcut.Arguments = ${JSON.stringify(`${JSON.stringify(argument)} start`)}`,
+    `$shortcut.WorkingDirectory = ${JSON.stringify(path.dirname(executable))}`,
+    '$shortcut.WindowStyle = 7',
+    `$shortcut.Description = ${JSON.stringify('Ouvre PieceMaker')}`,
+    '$shortcut.Save()',
+  ].join('; ');
+  execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], { stdio: 'ignore' });
+  return shortcut;
+}
+
+/**
+ * Creates the PieceMaker desktop icon once, right after a fresh install, so the
+ * application can be reopened without a terminal. Existing shortcuts are left
+ * untouched and any failure is reported without interrupting the launch.
+ */
+export function ensureDesktopShortcut(output: ShortcutOutput): void {
+  if (process.platform !== 'darwin' && process.platform !== 'win32') return;
+
+  const desktop = desktopDirectory();
+  if (!fs.existsSync(desktop)) return;
+
+  try {
+    const created = process.platform === 'darwin'
+      ? createMacShortcut(desktop)
+      : createWindowsShortcut(desktop);
+    if (created) output.log(`[OK] PieceMaker desktop icon created at ${created}`);
+  } catch {
+    output.log('[WARN] Could not create the PieceMaker desktop icon.');
+  }
+}

package/server/modules/cli/pwa-launcher.ts

@@ -4,6 +4,8 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
+import { ensureDesktopShortcut } from './desktop-shortcut.js';
+
 type PwaOutput = {
   log(message: string): void;
 };
@@ -102,7 +104,22 @@ async function waitForServer(url: string): Promise<boolean> {
   return false;
 }
 
-/** Starts PieceMaker in an isolated Chromium app window after its backend is ready. */
+const SHUTDOWN_GRACE_MS = 10_000;
+const DELEGATED_LAUNCH_MS = 3_000;
+
+function shutdownAfterWindowClosed(output: PwaOutput): void {
+  output.log('[OK] PieceMaker window closed; stopping the local server.');
+  const forced = setTimeout(() => process.exit(0), SHUTDOWN_GRACE_MS);
+  forced.unref();
+  if (process.listenerCount('SIGTERM') > 0) process.emit('SIGTERM', 'SIGTERM');
+  else process.exit(0);
+}
+
+/**
+ * Starts PieceMaker in an isolated Chromium app window after its backend is
+ * ready, and ties the server's lifetime to that window: closing it shuts the
+ * local server down through the same graceful path as SIGTERM.
+ */
 export async function launchPwa(output: PwaOutput = DEFAULT_OUTPUT): Promise<void> {
   const url = pwaUrl();
   if (!(await waitForServer(url))) {
@@ -116,16 +133,24 @@ export async function launchPwa(output: PwaOutput = DEFAULT_OUTPUT): Promise<voi
     return;
   }
 
+  ensureDesktopShortcut(output);
+
   const profileDirectory = pwaProfileDirectory();
   fs.mkdirSync(profileDirectory, { recursive: true });
+  const openedAt = Date.now();
   const child = spawn(browser, [`--app=${url}`, `--user-data-dir=${profileDirectory}`], {
-    detached: true,
     stdio: 'ignore',
     windowsHide: true,
   });
   child.on('error', () => {
     output.log(`[WARN] Could not open the PieceMaker PWA; open ${url} manually.`);
   });
-  child.unref();
-  output.log(`[OK] PieceMaker PWA opened at ${url}`);
+  child.on('exit', () => {
+    if (Date.now() - openedAt < DELEGATED_LAUNCH_MS) {
+      output.log(`[WARN] The PieceMaker window is owned by another browser process; the server keeps running.`);
+      return;
+    }
+    shutdownAfterWindowClosed(output);
+  });
+  output.log(`[OK] PieceMaker PWA opened at ${url} — closing the window stops the server.`);
 }

package/server/piecemaker/anonymizer/client-config.cjs

@@ -1,19 +1,7 @@
-/**
- * Écriture atomique des configurations Claude Code et Codex pour les faire
- * passer par le proxy PII de ce dépôt (`./proxy.cjs`).
- *
- * Propre à ce fichier, sans dépendance vendor : l'identifiant de bloc
- * `piecemaker_proxy` et les marqueurs qui l'entourent n'appartiennent qu'à
- * ce proxy. Le fournisseur Codex géré n'a jamais parlé que HTTP Responses.
- */
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 
-const CODEX_PROVIDER_ID = 'piecemaker_proxy';
-const CODEX_BLOCK_START = '# >>> PieceMaker Proxy PII (géré automatiquement)';
-const CODEX_BLOCK_END = '# <<< PieceMaker Proxy PII';
-
 function atomicWrite(file, content, mode = 0o600) {
   fs.mkdirSync(path.dirname(file), { recursive: true });
   const temporary = `${file}.piecemaker-${process.pid}-${Date.now()}`;
@@ -21,18 +9,28 @@ function atomicWrite(file, content, mode = 0o600) {
   fs.renameSync(temporary, file);
 }
 
-/** Une base que PieceMaker a écrite — donc que PieceMaker peut réécrire ou retirer. */
-function isOwnLoopbackUrl(value, suffix) {
+const PROXY_ENV = {
+  HTTPS_PROXY: (proxyUrl) => proxyUrl,
+  HTTP_PROXY: (proxyUrl) => proxyUrl,
+  ALL_PROXY: (proxyUrl) => proxyUrl,
+  NO_PROXY: () => 'localhost,127.0.0.1,::1',
+  NODE_USE_ENV_PROXY: () => '1',
+  NODE_EXTRA_CA_CERTS: (_proxyUrl, caFile) => caFile,
+  SSL_CERT_FILE: (_proxyUrl, caFile) => caFile,
+  CODEX_CA_CERTIFICATE: (_proxyUrl, caFile) => caFile,
+  REQUESTS_CA_BUNDLE: (_proxyUrl, caFile) => caFile,
+};
+
+function isLoopbackProxy(value) {
   try {
     const url = new URL(String(value || ''));
-    return ['127.0.0.1', 'localhost'].includes(url.hostname)
-      && url.pathname.replace(/\/$/, '') === suffix;
+    return ['127.0.0.1', 'localhost'].includes(url.hostname);
   } catch {
     return false;
   }
 }
 
-function configureClaudeCodeProxy({ baseUrl, userHome = os.homedir() } = {}) {
+function configureClaudeCodeProxy({ proxyUrl, caFile, userHome = os.homedir() } = {}) {
   const settingsFile = path.join(userHome, '.claude', 'settings.json');
   let settings = {};
   try {
@@ -50,13 +48,21 @@ function configureClaudeCodeProxy({ baseUrl, userHome = os.homedir() } = {}) {
     return { configured: false, changed: false, conflict: true, file: settingsFile, reason: 'env-invalid' };
   }
   if (!settings.env) settings.env = {};
-  const existing = settings.env.ANTHROPIC_BASE_URL;
-  if (existing && existing !== baseUrl && !isOwnLoopbackUrl(existing, '/anthropic')) {
-    return { configured: false, changed: false, conflict: true, file: settingsFile, reason: 'base-url-conflict' };
+  const existingProxy = settings.env.HTTPS_PROXY;
+  if (existingProxy && existingProxy !== proxyUrl && !isLoopbackProxy(existingProxy)) {
+    return { configured: false, changed: false, conflict: true, file: settingsFile, reason: 'proxy-conflict' };
+  }
+
+  let changed = false;
+  for (const [key, produce] of Object.entries(PROXY_ENV)) {
+    const value = produce(proxyUrl, caFile);
+    if (!value) continue;
+    if (settings.env[key] !== value) {
+      settings.env[key] = value;
+      changed = true;
+    }
   }
-  if (existing === baseUrl) return { configured: true, changed: false, conflict: false, file: settingsFile };
-
-  settings.env.ANTHROPIC_BASE_URL = baseUrl;
+  if (!changed) return { configured: true, changed: false, conflict: false, file: settingsFile };
   atomicWrite(settingsFile, `${JSON.stringify(settings, null, 2)}\n`);
   return { configured: true, changed: true, conflict: false, file: settingsFile };
 }
@@ -76,159 +82,36 @@ function bypassClaudeCodeProxy({ userHome = os.homedir() } = {}) {
   }
 
   const env = settings.env;
-  if (env === undefined || (env && typeof env === 'object' && !Array.isArray(env)
-      && !env.ANTHROPIC_BASE_URL)) {
-    return { bypassed: true, changed: false, conflict: false, file: settingsFile };
-  }
   if (!env || typeof env !== 'object' || Array.isArray(env)) {
+    if (env === undefined) return { bypassed: true, changed: false, conflict: false, file: settingsFile };
     return { bypassed: false, changed: false, conflict: true, file: settingsFile, reason: 'env-invalid' };
   }
-  if (!isOwnLoopbackUrl(env.ANTHROPIC_BASE_URL, '/anthropic')) {
-    return { bypassed: true, changed: false, conflict: false, file: settingsFile };
-  }
+  if (!isLoopbackProxy(env.HTTPS_PROXY)) return { bypassed: true, changed: false, conflict: false, file: settingsFile };
 
-  delete env.ANTHROPIC_BASE_URL;
+  let changed = false;
+  if (isLoopbackProxy(env.HTTPS_PROXY)) {
+    for (const key of Object.keys(PROXY_ENV)) {
+      if (env[key] !== undefined) {
+        delete env[key];
+        changed = true;
+      }
+    }
+  }
+  if (!changed) return { bypassed: true, changed: false, conflict: false, file: settingsFile };
   if (Object.keys(env).length === 0) delete settings.env;
   atomicWrite(settingsFile, `${JSON.stringify(settings, null, 2)}\n`);
   return { bypassed: true, changed: true, conflict: false, file: settingsFile };
 }
 
-function tomlString(value) {
-  return JSON.stringify(String(value));
-}
-
-function topLevelAssignment(lines, key) {
-  const expression = new RegExp(`^\\s*${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=\\s*(.*?)\\s*$`);
-  for (let index = 0; index < lines.length; index += 1) {
-    const line = lines[index];
-    if (/^\s*\[/.test(line)) break;
-    const match = line.match(expression);
-    if (match) return { index, raw: match[1] };
-  }
-  return null;
-}
-
-function parseTomlString(raw) {
-  const value = String(raw || '').trim();
-  if (value.startsWith('"')) {
-    const literal = value.match(/^("(?:\\.|[^"\\])*")/)?.[1];
-    try { return literal ? JSON.parse(literal) : null; } catch { return null; }
-  }
-  const literal = value.match(/^'([^']*)'/)?.[1];
-  if (literal !== undefined) return literal;
-  return null;
-}
-
-function configureCodexProxy({
-  baseUrl,
-  codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'),
-} = {}) {
-  const configFile = path.join(codexHome, 'config.toml');
-  let content = '';
-  try { content = fs.existsSync(configFile) ? fs.readFileSync(configFile, 'utf8') : ''; } catch {
-    return { configured: false, changed: false, conflict: true, file: configFile, reason: 'config-unreadable' };
-  }
-
-  const lines = content.replace(/^/, '').split(/\r?\n/);
-  const provider = topLevelAssignment(lines, 'model_provider');
-  const providerValue = provider ? parseTomlString(provider.raw) : 'openai';
-  if (provider && !['openai', CODEX_PROVIDER_ID].includes(providerValue)) {
-    return { configured: false, changed: false, conflict: true, file: configFile, reason: 'provider-conflict' };
-  }
-
-  const managedTable = lines.findIndex((line) => line.trim() === `[model_providers.${CODEX_PROVIDER_ID}]`);
-  const managedStart = lines.findIndex((line) => line.trim() === CODEX_BLOCK_START);
-  let managedEnd = lines.findIndex((line) => line.trim() === CODEX_BLOCK_END);
-  if (managedTable >= 0 && managedStart < 0) {
-    return { configured: false, changed: false, conflict: true, file: configFile, reason: 'provider-table-conflict' };
-  }
-  if (managedStart >= 0 && managedEnd < managedStart) {
-    let end = managedTable >= managedStart ? managedTable : managedStart;
-    for (let index = end + 1; index < lines.length; index += 1) {
-      if (/^\s*\[/.test(lines[index])) break;
-      end = index;
-    }
-    managedEnd = end;
-  }
-
-  if (provider) {
-    lines[provider.index] = `model_provider = ${tomlString(CODEX_PROVIDER_ID)} # géré par PieceMaker`;
-  } else {
-    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
-    lines.splice(firstTable < 0 ? 0 : firstTable, 0,
-      '# Fournisseur Responses protégé par PieceMaker.',
-      `model_provider = ${tomlString(CODEX_PROVIDER_ID)} # géré par PieceMaker`,
-      '');
-  }
-
-  // Le proxy de ce dépôt parle HTTP Responses, jamais WebSocket.
-  const block = [
-    CODEX_BLOCK_START,
-    `[model_providers.${CODEX_PROVIDER_ID}]`,
-    'name = "PieceMaker · Proxy PII"',
-    `base_url = ${tomlString(baseUrl)}`,
-    'requires_openai_auth = true',
-    'wire_api = "responses"',
-    'supports_websockets = false',
-    CODEX_BLOCK_END,
-  ];
-  if (managedStart >= 0 && managedEnd >= managedStart) {
-    lines.splice(managedStart, managedEnd - managedStart + 1, ...block);
-  } else {
-    while (lines.at(-1) === '') lines.pop();
-    lines.push('', ...block);
-  }
-  const normalized = `${lines.join('\n').replace(/\n+$/, '')}\n`;
-  if (normalized === `${content.replace(/^/, '').replace(/\n*$/, '')}\n`) {
-    return { configured: true, changed: false, conflict: false, file: configFile };
-  }
-  atomicWrite(configFile, normalized);
-  return { configured: true, changed: true, conflict: false, file: configFile };
+function configureCodexProxy() {
+  return { configured: true, changed: false, conflict: false, file: null };
 }
 
-function bypassCodexProxy({
-  codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'),
-} = {}) {
-  const configFile = path.join(codexHome, 'config.toml');
-  if (!fs.existsSync(configFile)) {
-    return { bypassed: true, changed: false, conflict: false, file: configFile };
-  }
-
-  let content;
-  try { content = fs.readFileSync(configFile, 'utf8'); } catch {
-    return { bypassed: false, changed: false, conflict: true, file: configFile, reason: 'config-unreadable' };
-  }
-
-  const lines = content.replace(/^/, '').split(/\r?\n/);
-  const provider = topLevelAssignment(lines, 'model_provider');
-  const providerValue = provider ? parseTomlString(provider.raw) : 'openai';
-  const managedStart = lines.findIndex((line) => line.trim() === CODEX_BLOCK_START);
-  const managedEnd = lines.findIndex((line) => line.trim() === CODEX_BLOCK_END);
-  if ((managedStart < 0) !== (managedEnd < 0) || managedEnd < managedStart) {
-    return { bypassed: false, changed: false, conflict: true, file: configFile, reason: 'provider-block-invalid' };
-  }
-  if (providerValue !== CODEX_PROVIDER_ID && managedStart < 0) {
-    return { bypassed: true, changed: false, conflict: false, file: configFile };
-  }
-  if (managedStart >= 0) lines.splice(managedStart, managedEnd - managedStart + 1);
-
-  if (providerValue === CODEX_PROVIDER_ID) {
-    lines[provider.index] = 'model_provider = "openai"';
-    if (lines[provider.index - 1]?.trim() === '# Fournisseur Responses protégé par PieceMaker.') {
-      lines.splice(provider.index - 1, 1);
-    }
-  }
-
-  const normalized = `${lines.join('\n').replace(/\n+$/, '')}\n`;
-  if (normalized === `${content.replace(/^/, '').replace(/\n*$/, '')}\n`) {
-    return { bypassed: true, changed: false, conflict: false, file: configFile };
-  }
-  atomicWrite(configFile, normalized);
-  return { bypassed: true, changed: true, conflict: false, file: configFile };
+function bypassCodexProxy() {
+  return { bypassed: true, changed: false, conflict: false, file: null };
 }
 
 module.exports = {
-  CODEX_PROVIDER_ID,
   configureClaudeCodeProxy,
   bypassClaudeCodeProxy,
   configureCodexProxy,

package/server/piecemaker/anonymizer/hudsucker-fixture.cjs

@@ -0,0 +1,127 @@
+const { execFileSync, spawn } = require('node:child_process');
+const fs = require('node:fs');
+const net = require('node:net');
+const os = require('node:os');
+const path = require('node:path');
+
+const { startRewriterBridge } = require('./rewriter-bridge.cjs');
+const { createSqliteDictionaryLoader } = require('./sqlite-dictionary.cjs');
+
+function hudsuckerBinary() {
+  if (process.env.PIECEMAKER_HUDSUCKER_BIN) return process.env.PIECEMAKER_HUDSUCKER_BIN;
+  return path.join(__dirname, 'hudsucker-proxy', 'target', 'release', 'piecemaker-hudsucker');
+}
+
+function makeCertificateAuthority(directory) {
+  const cert = path.join(directory, 'ca.crt');
+  const key = path.join(directory, 'ca.key');
+  execFileSync('openssl', [
+    'req', '-x509', '-newkey', 'rsa:2048', '-nodes',
+    '-keyout', key, '-out', cert, '-days', '30',
+    '-subj', '/CN=PieceMaker Test CA',
+    '-addext', 'basicConstraints=critical,CA:true,pathlen:0',
+    '-addext', 'keyUsage=critical,keyCertSign,cRLSign',
+  ], { stdio: 'ignore' });
+  return { cert, key };
+}
+
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const { port } = server.address();
+      server.close((error) => (error ? reject(error) : resolve(port)));
+    });
+  });
+}
+
+function waitForOutput(child, needle, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let buffer = '';
+    const timer = setTimeout(() => {
+      reject(new Error(`hudsucker n'a pas écouté : ${buffer}`));
+    }, timeoutMs);
+    const take = (chunk) => {
+      buffer += chunk.toString();
+      if (!buffer.includes(needle)) return;
+      clearTimeout(timer);
+      resolve(buffer);
+    };
+    child.stdout.on('data', take);
+    child.stderr.on('data', take);
+    child.once('exit', (code) => {
+      clearTimeout(timer);
+      reject(new Error(`hudsucker sorti (${code}) : ${buffer}`));
+    });
+  });
+}
+
+async function startHudsuckerSession({
+  databasePath,
+  upstreamPort,
+  harness = null,
+  hosts = ['api.anthropic.com', 'api.openai.com', 'chatgpt.com'],
+  directory = fs.mkdtempSync(path.join(os.tmpdir(), 'pm-hudsucker-')),
+} = {}) {
+  const binary = hudsuckerBinary();
+  if (!fs.existsSync(binary)) {
+    throw new Error(`binaire hudsucker absent : ${binary}`);
+  }
+  const ca = makeCertificateAuthority(directory);
+  const dictionary = createSqliteDictionaryLoader({ databasePath });
+  const bridge = await startRewriterBridge({ dictionary, harness });
+  const port = await freePort();
+  const upstreamMap = hosts.map((host) => `${host}=127.0.0.1:${upstreamPort}`).join(',');
+  const child = spawn(binary, [
+    '--listen', `127.0.0.1:${port}`,
+    '--rewriter', `http://127.0.0.1:${bridge.port}`,
+    '--ca-cert', ca.cert,
+    '--ca-key', ca.key,
+    '--hosts', hosts.join(','),
+    '--upstream-map', upstreamMap,
+  ], {
+    stdio: ['ignore', 'pipe', 'pipe'],
+    env: { ...process.env, HTTPS_PROXY: '', HTTP_PROXY: '', ALL_PROXY: '', http_proxy: '', https_proxy: '' },
+  });
+  try {
+    await waitForOutput(child, `listening 127.0.0.1:${port}`, 15000);
+  } catch (error) {
+    child.kill('SIGKILL');
+    await bridge.close();
+    dictionary.close();
+    throw error;
+  }
+  return {
+    origin: `http://127.0.0.1:${port}`,
+    caFile: ca.cert,
+    stats: bridge.stats,
+    async close() {
+      child.kill('SIGTERM');
+      await new Promise((resolve) => child.once('exit', resolve));
+      await bridge.close();
+      dictionary.close();
+    },
+  };
+}
+
+async function postThrough(origin, caFile, body, route = '/v1/messages', host = 'api.anthropic.com') {
+  const { ProxyAgent, fetch } = await import('undici');
+  const agent = new ProxyAgent({
+    uri: origin,
+    requestTls: { ca: fs.readFileSync(caFile) },
+  });
+  const response = await fetch(`https://${host}${route}`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body,
+    dispatcher: agent,
+  });
+  return response.text();
+}
+
+module.exports = {
+  hudsuckerBinary,
+  postThrough,
+  startHudsuckerSession,
+};