@piecemaker-legal/piecemaker 1.1.1 → 2.0.2

package/server/piecemaker/anonymizer/client-config.cjs

@@ -1,19 +1,7 @@
-/**
- * Écriture atomique des configurations Claude Code et Codex pour les faire
- * passer par le proxy PII de ce dépôt (`./proxy.cjs`).
- *
- * Propre à ce fichier, sans dépendance vendor : l'identifiant de bloc
- * `piecemaker_proxy` et les marqueurs qui l'entourent n'appartiennent qu'à
- * ce proxy. Le fournisseur Codex géré n'a jamais parlé que HTTP Responses.
- */
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 
-const CODEX_PROVIDER_ID = 'piecemaker_proxy';
-const CODEX_BLOCK_START = '# >>> PieceMaker Proxy PII (géré automatiquement)';
-const CODEX_BLOCK_END = '# <<< PieceMaker Proxy PII';
-
 function atomicWrite(file, content, mode = 0o600) {
   fs.mkdirSync(path.dirname(file), { recursive: true });
   const temporary = `${file}.piecemaker-${process.pid}-${Date.now()}`;
@@ -21,18 +9,28 @@ function atomicWrite(file, content, mode = 0o600) {
   fs.renameSync(temporary, file);
 }
 
-/** Une base que PieceMaker a écrite — donc que PieceMaker peut réécrire ou retirer. */
-function isOwnLoopbackUrl(value, suffix) {
+const PROXY_ENV = {
+  HTTPS_PROXY: (proxyUrl) => proxyUrl,
+  HTTP_PROXY: (proxyUrl) => proxyUrl,
+  ALL_PROXY: (proxyUrl) => proxyUrl,
+  NO_PROXY: () => 'localhost,127.0.0.1,::1',
+  NODE_USE_ENV_PROXY: () => '1',
+  NODE_EXTRA_CA_CERTS: (_proxyUrl, caFile) => caFile,
+  SSL_CERT_FILE: (_proxyUrl, caFile) => caFile,
+  CODEX_CA_CERTIFICATE: (_proxyUrl, caFile) => caFile,
+  REQUESTS_CA_BUNDLE: (_proxyUrl, caFile) => caFile,
+};
+
+function isLoopbackProxy(value) {
   try {
     const url = new URL(String(value || ''));
-    return ['127.0.0.1', 'localhost'].includes(url.hostname)
-      && url.pathname.replace(/\/$/, '') === suffix;
+    return ['127.0.0.1', 'localhost'].includes(url.hostname);
   } catch {
     return false;
   }
 }
 
-function configureClaudeCodeProxy({ baseUrl, userHome = os.homedir() } = {}) {
+function configureClaudeCodeProxy({ proxyUrl, caFile, userHome = os.homedir() } = {}) {
   const settingsFile = path.join(userHome, '.claude', 'settings.json');
   let settings = {};
   try {
@@ -50,13 +48,21 @@ function configureClaudeCodeProxy({ baseUrl, userHome = os.homedir() } = {}) {
     return { configured: false, changed: false, conflict: true, file: settingsFile, reason: 'env-invalid' };
   }
   if (!settings.env) settings.env = {};
-  const existing = settings.env.ANTHROPIC_BASE_URL;
-  if (existing && existing !== baseUrl && !isOwnLoopbackUrl(existing, '/anthropic')) {
-    return { configured: false, changed: false, conflict: true, file: settingsFile, reason: 'base-url-conflict' };
+  const existingProxy = settings.env.HTTPS_PROXY;
+  if (existingProxy && existingProxy !== proxyUrl && !isLoopbackProxy(existingProxy)) {
+    return { configured: false, changed: false, conflict: true, file: settingsFile, reason: 'proxy-conflict' };
+  }
+
+  let changed = false;
+  for (const [key, produce] of Object.entries(PROXY_ENV)) {
+    const value = produce(proxyUrl, caFile);
+    if (!value) continue;
+    if (settings.env[key] !== value) {
+      settings.env[key] = value;
+      changed = true;
+    }
   }
-  if (existing === baseUrl) return { configured: true, changed: false, conflict: false, file: settingsFile };
-
-  settings.env.ANTHROPIC_BASE_URL = baseUrl;
+  if (!changed) return { configured: true, changed: false, conflict: false, file: settingsFile };
   atomicWrite(settingsFile, `${JSON.stringify(settings, null, 2)}\n`);
   return { configured: true, changed: true, conflict: false, file: settingsFile };
 }
@@ -76,159 +82,36 @@ function bypassClaudeCodeProxy({ userHome = os.homedir() } = {}) {
   }
 
   const env = settings.env;
-  if (env === undefined || (env && typeof env === 'object' && !Array.isArray(env)
-      && !env.ANTHROPIC_BASE_URL)) {
-    return { bypassed: true, changed: false, conflict: false, file: settingsFile };
-  }
   if (!env || typeof env !== 'object' || Array.isArray(env)) {
+    if (env === undefined) return { bypassed: true, changed: false, conflict: false, file: settingsFile };
     return { bypassed: false, changed: false, conflict: true, file: settingsFile, reason: 'env-invalid' };
   }
-  if (!isOwnLoopbackUrl(env.ANTHROPIC_BASE_URL, '/anthropic')) {
-    return { bypassed: true, changed: false, conflict: false, file: settingsFile };
-  }
+  if (!isLoopbackProxy(env.HTTPS_PROXY)) return { bypassed: true, changed: false, conflict: false, file: settingsFile };
 
-  delete env.ANTHROPIC_BASE_URL;
+  let changed = false;
+  if (isLoopbackProxy(env.HTTPS_PROXY)) {
+    for (const key of Object.keys(PROXY_ENV)) {
+      if (env[key] !== undefined) {
+        delete env[key];
+        changed = true;
+      }
+    }
+  }
+  if (!changed) return { bypassed: true, changed: false, conflict: false, file: settingsFile };
   if (Object.keys(env).length === 0) delete settings.env;
   atomicWrite(settingsFile, `${JSON.stringify(settings, null, 2)}\n`);
   return { bypassed: true, changed: true, conflict: false, file: settingsFile };
 }
 
-function tomlString(value) {
-  return JSON.stringify(String(value));
-}
-
-function topLevelAssignment(lines, key) {
-  const expression = new RegExp(`^\\s*${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=\\s*(.*?)\\s*$`);
-  for (let index = 0; index < lines.length; index += 1) {
-    const line = lines[index];
-    if (/^\s*\[/.test(line)) break;
-    const match = line.match(expression);
-    if (match) return { index, raw: match[1] };
-  }
-  return null;
-}
-
-function parseTomlString(raw) {
-  const value = String(raw || '').trim();
-  if (value.startsWith('"')) {
-    const literal = value.match(/^("(?:\\.|[^"\\])*")/)?.[1];
-    try { return literal ? JSON.parse(literal) : null; } catch { return null; }
-  }
-  const literal = value.match(/^'([^']*)'/)?.[1];
-  if (literal !== undefined) return literal;
-  return null;
-}
-
-function configureCodexProxy({
-  baseUrl,
-  codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'),
-} = {}) {
-  const configFile = path.join(codexHome, 'config.toml');
-  let content = '';
-  try { content = fs.existsSync(configFile) ? fs.readFileSync(configFile, 'utf8') : ''; } catch {
-    return { configured: false, changed: false, conflict: true, file: configFile, reason: 'config-unreadable' };
-  }
-
-  const lines = content.replace(/^/, '').split(/\r?\n/);
-  const provider = topLevelAssignment(lines, 'model_provider');
-  const providerValue = provider ? parseTomlString(provider.raw) : 'openai';
-  if (provider && !['openai', CODEX_PROVIDER_ID].includes(providerValue)) {
-    return { configured: false, changed: false, conflict: true, file: configFile, reason: 'provider-conflict' };
-  }
-
-  const managedTable = lines.findIndex((line) => line.trim() === `[model_providers.${CODEX_PROVIDER_ID}]`);
-  const managedStart = lines.findIndex((line) => line.trim() === CODEX_BLOCK_START);
-  let managedEnd = lines.findIndex((line) => line.trim() === CODEX_BLOCK_END);
-  if (managedTable >= 0 && managedStart < 0) {
-    return { configured: false, changed: false, conflict: true, file: configFile, reason: 'provider-table-conflict' };
-  }
-  if (managedStart >= 0 && managedEnd < managedStart) {
-    let end = managedTable >= managedStart ? managedTable : managedStart;
-    for (let index = end + 1; index < lines.length; index += 1) {
-      if (/^\s*\[/.test(lines[index])) break;
-      end = index;
-    }
-    managedEnd = end;
-  }
-
-  if (provider) {
-    lines[provider.index] = `model_provider = ${tomlString(CODEX_PROVIDER_ID)} # géré par PieceMaker`;
-  } else {
-    const firstTable = lines.findIndex((line) => /^\s*\[/.test(line));
-    lines.splice(firstTable < 0 ? 0 : firstTable, 0,
-      '# Fournisseur Responses protégé par PieceMaker.',
-      `model_provider = ${tomlString(CODEX_PROVIDER_ID)} # géré par PieceMaker`,
-      '');
-  }
-
-  // Le proxy de ce dépôt parle HTTP Responses, jamais WebSocket.
-  const block = [
-    CODEX_BLOCK_START,
-    `[model_providers.${CODEX_PROVIDER_ID}]`,
-    'name = "PieceMaker · Proxy PII"',
-    `base_url = ${tomlString(baseUrl)}`,
-    'requires_openai_auth = true',
-    'wire_api = "responses"',
-    'supports_websockets = false',
-    CODEX_BLOCK_END,
-  ];
-  if (managedStart >= 0 && managedEnd >= managedStart) {
-    lines.splice(managedStart, managedEnd - managedStart + 1, ...block);
-  } else {
-    while (lines.at(-1) === '') lines.pop();
-    lines.push('', ...block);
-  }
-  const normalized = `${lines.join('\n').replace(/\n+$/, '')}\n`;
-  if (normalized === `${content.replace(/^/, '').replace(/\n*$/, '')}\n`) {
-    return { configured: true, changed: false, conflict: false, file: configFile };
-  }
-  atomicWrite(configFile, normalized);
-  return { configured: true, changed: true, conflict: false, file: configFile };
+function configureCodexProxy() {
+  return { configured: true, changed: false, conflict: false, file: null };
 }
 
-function bypassCodexProxy({
-  codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'),
-} = {}) {
-  const configFile = path.join(codexHome, 'config.toml');
-  if (!fs.existsSync(configFile)) {
-    return { bypassed: true, changed: false, conflict: false, file: configFile };
-  }
-
-  let content;
-  try { content = fs.readFileSync(configFile, 'utf8'); } catch {
-    return { bypassed: false, changed: false, conflict: true, file: configFile, reason: 'config-unreadable' };
-  }
-
-  const lines = content.replace(/^/, '').split(/\r?\n/);
-  const provider = topLevelAssignment(lines, 'model_provider');
-  const providerValue = provider ? parseTomlString(provider.raw) : 'openai';
-  const managedStart = lines.findIndex((line) => line.trim() === CODEX_BLOCK_START);
-  const managedEnd = lines.findIndex((line) => line.trim() === CODEX_BLOCK_END);
-  if ((managedStart < 0) !== (managedEnd < 0) || managedEnd < managedStart) {
-    return { bypassed: false, changed: false, conflict: true, file: configFile, reason: 'provider-block-invalid' };
-  }
-  if (providerValue !== CODEX_PROVIDER_ID && managedStart < 0) {
-    return { bypassed: true, changed: false, conflict: false, file: configFile };
-  }
-  if (managedStart >= 0) lines.splice(managedStart, managedEnd - managedStart + 1);
-
-  if (providerValue === CODEX_PROVIDER_ID) {
-    lines[provider.index] = 'model_provider = "openai"';
-    if (lines[provider.index - 1]?.trim() === '# Fournisseur Responses protégé par PieceMaker.') {
-      lines.splice(provider.index - 1, 1);
-    }
-  }
-
-  const normalized = `${lines.join('\n').replace(/\n+$/, '')}\n`;
-  if (normalized === `${content.replace(/^/, '').replace(/\n*$/, '')}\n`) {
-    return { bypassed: true, changed: false, conflict: false, file: configFile };
-  }
-  atomicWrite(configFile, normalized);
-  return { bypassed: true, changed: true, conflict: false, file: configFile };
+function bypassCodexProxy() {
+  return { bypassed: true, changed: false, conflict: false, file: null };
 }
 
 module.exports = {
-  CODEX_PROVIDER_ID,
   configureClaudeCodeProxy,
   bypassClaudeCodeProxy,
   configureCodexProxy,

package/server/piecemaker/anonymizer/hudsucker-fixture.cjs

@@ -0,0 +1,127 @@
+const { execFileSync, spawn } = require('node:child_process');
+const fs = require('node:fs');
+const net = require('node:net');
+const os = require('node:os');
+const path = require('node:path');
+
+const { startRewriterBridge } = require('./rewriter-bridge.cjs');
+const { createSqliteDictionaryLoader } = require('./sqlite-dictionary.cjs');
+
+function hudsuckerBinary() {
+  if (process.env.PIECEMAKER_HUDSUCKER_BIN) return process.env.PIECEMAKER_HUDSUCKER_BIN;
+  return path.join(__dirname, 'hudsucker-proxy', 'target', 'release', 'piecemaker-hudsucker');
+}
+
+function makeCertificateAuthority(directory) {
+  const cert = path.join(directory, 'ca.crt');
+  const key = path.join(directory, 'ca.key');
+  execFileSync('openssl', [
+    'req', '-x509', '-newkey', 'rsa:2048', '-nodes',
+    '-keyout', key, '-out', cert, '-days', '30',
+    '-subj', '/CN=PieceMaker Test CA',
+    '-addext', 'basicConstraints=critical,CA:true,pathlen:0',
+    '-addext', 'keyUsage=critical,keyCertSign,cRLSign',
+  ], { stdio: 'ignore' });
+  return { cert, key };
+}
+
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const { port } = server.address();
+      server.close((error) => (error ? reject(error) : resolve(port)));
+    });
+  });
+}
+
+function waitForOutput(child, needle, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let buffer = '';
+    const timer = setTimeout(() => {
+      reject(new Error(`hudsucker n'a pas écouté : ${buffer}`));
+    }, timeoutMs);
+    const take = (chunk) => {
+      buffer += chunk.toString();
+      if (!buffer.includes(needle)) return;
+      clearTimeout(timer);
+      resolve(buffer);
+    };
+    child.stdout.on('data', take);
+    child.stderr.on('data', take);
+    child.once('exit', (code) => {
+      clearTimeout(timer);
+      reject(new Error(`hudsucker sorti (${code}) : ${buffer}`));
+    });
+  });
+}
+
+async function startHudsuckerSession({
+  databasePath,
+  upstreamPort,
+  harness = null,
+  hosts = ['api.anthropic.com', 'api.openai.com', 'chatgpt.com'],
+  directory = fs.mkdtempSync(path.join(os.tmpdir(), 'pm-hudsucker-')),
+} = {}) {
+  const binary = hudsuckerBinary();
+  if (!fs.existsSync(binary)) {
+    throw new Error(`binaire hudsucker absent : ${binary}`);
+  }
+  const ca = makeCertificateAuthority(directory);
+  const dictionary = createSqliteDictionaryLoader({ databasePath });
+  const bridge = await startRewriterBridge({ dictionary, harness });
+  const port = await freePort();
+  const upstreamMap = hosts.map((host) => `${host}=127.0.0.1:${upstreamPort}`).join(',');
+  const child = spawn(binary, [
+    '--listen', `127.0.0.1:${port}`,
+    '--rewriter', `http://127.0.0.1:${bridge.port}`,
+    '--ca-cert', ca.cert,
+    '--ca-key', ca.key,
+    '--hosts', hosts.join(','),
+    '--upstream-map', upstreamMap,
+  ], {
+    stdio: ['ignore', 'pipe', 'pipe'],
+    env: { ...process.env, HTTPS_PROXY: '', HTTP_PROXY: '', ALL_PROXY: '', http_proxy: '', https_proxy: '' },
+  });
+  try {
+    await waitForOutput(child, `listening 127.0.0.1:${port}`, 15000);
+  } catch (error) {
+    child.kill('SIGKILL');
+    await bridge.close();
+    dictionary.close();
+    throw error;
+  }
+  return {
+    origin: `http://127.0.0.1:${port}`,
+    caFile: ca.cert,
+    stats: bridge.stats,
+    async close() {
+      child.kill('SIGTERM');
+      await new Promise((resolve) => child.once('exit', resolve));
+      await bridge.close();
+      dictionary.close();
+    },
+  };
+}
+
+async function postThrough(origin, caFile, body, route = '/v1/messages', host = 'api.anthropic.com') {
+  const { ProxyAgent, fetch } = await import('undici');
+  const agent = new ProxyAgent({
+    uri: origin,
+    requestTls: { ca: fs.readFileSync(caFile) },
+  });
+  const response = await fetch(`https://${host}${route}`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body,
+    dispatcher: agent,
+  });
+  return response.text();
+}
+
+module.exports = {
+  hudsuckerBinary,
+  postThrough,
+  startHudsuckerSession,
+};