@piecemaker-legal/piecemaker 2.0.10 → 2.0.11

package/server/piecemaker/agent-instructions.ts

@@ -0,0 +1,148 @@
+import { constants, watch, type FSWatcher } from 'fs';
+import { copyFile, lstat, readFile, realpath, rename, stat, writeFile } from 'fs/promises';
+import path from 'path';
+
+import express, { type Request, type Response } from 'express';
+
+import { projectsDb } from '@/modules/database/index.js';
+
+const CLAUDE_FILE = 'CLAUDE.md';
+const AGENTS_FILE = 'AGENTS.md';
+const WATCHED_FILES = new Set([CLAUDE_FILE, AGENTS_FILE]);
+const PROJECT_REFRESH_INTERVAL_MS = 5000;
+const MIRROR_DEBOUNCE_MS = 300;
+
+async function isPresent(filePath: string): Promise<boolean> {
+  try {
+    await lstat(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function agentInstructionsTemplate(sharedInstructionsFile: string): string {
+  return [
+    `@${sharedInstructionsFile}`,
+    '',
+    '# Ce dossier',
+    '<!-- Éléments propres à ce dossier : parties, juridiction, échéances, particularités. À compléter. -->',
+    '',
+  ].join('\n');
+}
+
+export async function ensureAgentInstructionFiles(projectRoot: string, sharedInstructionsFile: string): Promise<string[]> {
+  const claudePath = path.join(projectRoot, CLAUDE_FILE);
+  const agentsPath = path.join(projectRoot, AGENTS_FILE);
+  const [hasClaude, hasAgents] = await Promise.all([isPresent(claudePath), isPresent(agentsPath)]);
+  if (hasClaude && hasAgents) return [];
+  if (hasClaude) {
+    await copyFile(claudePath, agentsPath, constants.COPYFILE_EXCL);
+    return [AGENTS_FILE];
+  }
+  if (hasAgents) {
+    await copyFile(agentsPath, claudePath, constants.COPYFILE_EXCL);
+    return [CLAUDE_FILE];
+  }
+  const template = agentInstructionsTemplate(sharedInstructionsFile);
+  await writeFile(claudePath, template, { flag: 'wx' });
+  await writeFile(agentsPath, template, { flag: 'wx' });
+  return [CLAUDE_FILE, AGENTS_FILE];
+}
+
+const lastMirroredContents = new Map<string, Buffer>();
+
+export async function mirrorAgentInstructionFiles(projectRoot: string): Promise<void> {
+  try {
+    const claudePath = path.join(projectRoot, CLAUDE_FILE);
+    const agentsPath = path.join(projectRoot, AGENTS_FILE);
+    await Promise.all([stat(claudePath), stat(agentsPath)]);
+    if ((await realpath(claudePath)) === (await realpath(agentsPath))) return;
+    const [claudeContent, agentsContent] = await Promise.all([readFile(claudePath), readFile(agentsPath)]);
+    if (claudeContent.equals(agentsContent)) {
+      lastMirroredContents.set(projectRoot, claudeContent);
+      return;
+    }
+    const lastMirrored = lastMirroredContents.get(projectRoot);
+    if (!lastMirrored) return;
+    const claudeChanged = agentsContent.equals(lastMirrored);
+    if (!claudeChanged && !claudeContent.equals(lastMirrored)) return;
+    const [content, targetPath] = claudeChanged ? [claudeContent, agentsPath] : [agentsContent, claudePath];
+    const temporaryPath = `${targetPath}.piecemaker-${process.pid}.tmp`;
+    await writeFile(temporaryPath, content);
+    await rename(temporaryPath, targetPath);
+    lastMirroredContents.set(projectRoot, content);
+  } catch {
+    return;
+  }
+}
+
+export function startAgentInstructionsMirror(listProjectRoots: () => string[]): () => void {
+  const watchers = new Map<string, FSWatcher>();
+  const pendingMirrors = new Map<string, NodeJS.Timeout>();
+
+  const scheduleMirror = (projectRoot: string) => {
+    clearTimeout(pendingMirrors.get(projectRoot));
+    pendingMirrors.set(projectRoot, setTimeout(() => {
+      pendingMirrors.delete(projectRoot);
+      void mirrorAgentInstructionFiles(projectRoot);
+    }, MIRROR_DEBOUNCE_MS).unref());
+  };
+
+  const forget = (projectRoot: string) => {
+    watchers.get(projectRoot)?.close();
+    watchers.delete(projectRoot);
+  };
+
+  const refreshWatchers = () => {
+    let projectRoots: Set<string>;
+    try {
+      projectRoots = new Set(listProjectRoots().map((projectRoot) => path.resolve(projectRoot)));
+    } catch {
+      return;
+    }
+    for (const projectRoot of watchers.keys()) {
+      if (!projectRoots.has(projectRoot)) forget(projectRoot);
+    }
+    for (const projectRoot of projectRoots) {
+      if (watchers.has(projectRoot)) continue;
+      try {
+        const watcher = watch(projectRoot, { persistent: false }, (_event, fileName) => {
+          if (!fileName || WATCHED_FILES.has(fileName.toString())) scheduleMirror(projectRoot);
+        });
+        watcher.on('error', () => forget(projectRoot));
+        watchers.set(projectRoot, watcher);
+        scheduleMirror(projectRoot);
+      } catch {
+        continue;
+      }
+    }
+  };
+
+  refreshWatchers();
+  const interval = setInterval(refreshWatchers, PROJECT_REFRESH_INTERVAL_MS).unref();
+  return () => {
+    clearInterval(interval);
+    for (const timer of pendingMirrors.values()) clearTimeout(timer);
+    for (const projectRoot of [...watchers.keys()]) forget(projectRoot);
+  };
+}
+
+export function createAgentInstructionsRouter(sharedInstructionsFile: string) {
+  const router = express.Router();
+
+  router.post('/agent-instructions', async (request: Request, response: Response) => {
+    const projectId = typeof request.body?.projectId === 'string' ? request.body.projectId : '';
+    const projectRoot = projectId ? projectsDb.getProjectPathById(projectId) : null;
+    if (!projectRoot) return response.status(404).json({ error: 'Projet introuvable.' });
+    try {
+      const created = await ensureAgentInstructionFiles(projectRoot, sharedInstructionsFile);
+      await mirrorAgentInstructionFiles(projectRoot);
+      response.json({ ok: true, created });
+    } catch (error) {
+      response.status(500).json({ error: error instanceof Error ? error.message : String(error) });
+    }
+  });
+
+  return router;
+}

package/server/piecemaker/anonymizer/dictionary.cjs

@@ -30,6 +30,19 @@ const EMPTY = Object.freeze({
   empty: true,
 });
 
+const MEMO_MIN_LENGTH = 256;
+const MEMO_BUDGET = 16 * 1024 * 1024;
+const memos = new WeakMap();
+
+function memoFor(dictionary) {
+  let memo = memos.get(dictionary);
+  if (!memo) {
+    memo = { entries: new Map(), size: 0 };
+    memos.set(dictionary, memo);
+  }
+  return memo;
+}
+
 function plainObject(value) {
   return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -49,8 +62,9 @@ function plainObject(value) {
  * ne part pas codé serait un mensonge à l'écran.
  */
 function buildDictionary(document, stamp) {
-  const mapping = plainObject(document?.mapping);
-  const reverse = plainObject(document?.reverse_mapping);
+  const mapping = Object.freeze({ ...plainObject(document?.mapping) });
+  const reverse = Object.freeze(Object.fromEntries(Object.entries(plainObject(document?.reverse_mapping))
+    .map(([code, variants]) => [code, Array.isArray(variants) ? Object.freeze([...variants]) : variants])));
   const canonical = {};
   for (const [code, variants] of Object.entries(reverse)) {
     const name = Array.isArray(variants) ? variants[0] : variants;
@@ -89,7 +103,24 @@ function buildDictionary(document, stamp) {
 
 /** Nom réel → code, sur tout ce qui part vers l'API. */
 function anonymize(text, dictionary) {
-  return dictionary.empty ? text : applyMapping(text, dictionary.mapping);
+  if (dictionary.empty) return text;
+  if (typeof text !== 'string' || text.length < MEMO_MIN_LENGTH) return applyMapping(text, dictionary.mapping);
+  const memo = memoFor(dictionary);
+  const cached = memo.entries.get(text);
+  if (cached !== undefined) {
+    memo.entries.delete(text);
+    memo.entries.set(text, cached);
+    return cached;
+  }
+  const result = applyMapping(text, dictionary.mapping);
+  memo.entries.set(text, result);
+  memo.size += text.length + (result === text ? 0 : result.length);
+  for (const [key, value] of memo.entries) {
+    if (memo.size <= MEMO_BUDGET) break;
+    memo.entries.delete(key);
+    memo.size -= key.length + (value === key ? 0 : value.length);
+  }
+  return result;
 }
 
 /** Code → nom réel, sur tout ce qui revient de l'API vers la machine. */

package/server/piecemaker/anonymizer/hudsucker-smoke.cjs

@@ -0,0 +1,343 @@
+const { execFileSync, spawn } = require('node:child_process');
+const fs = require('node:fs');
+const http = require('node:http');
+const https = require('node:https');
+const os = require('node:os');
+const path = require('node:path');
+const tls = require('node:tls');
+
+const Database = require('better-sqlite3');
+
+const { startRewriterWorker } = require('./rewriter-worker.cjs');
+
+const HOST = 'api.anthropic.com';
+const NAME = 'Jean Dupont';
+const CODE = 'PERSONNE_PHYSIQUE_01';
+const CHECK_TIMEOUT_MS = 10000;
+const SANDBOX_EXEC = '/usr/bin/sandbox-exec';
+
+function defaultBinary() {
+  const name = process.platform === 'win32' ? 'piecemaker-hudsucker.exe' : 'piecemaker-hudsucker';
+  return [
+    path.join(__dirname, 'bin', name),
+    path.join(__dirname, 'hudsucker-proxy', 'target', 'release', name),
+  ].find((candidate) => fs.existsSync(candidate)) || path.join(__dirname, 'bin', name);
+}
+
+function mappingDatabase(directory) {
+  const file = path.join(directory, 'auth.db');
+  const database = new Database(file);
+  database.exec(`
+    CREATE TABLE piecemaker_nodes (project_id TEXT, id TEXT, label TEXT, PRIMARY KEY (project_id, id));
+    CREATE TABLE piecemaker_mappings (project_id TEXT, node_id TEXT, real_value TEXT, masked_value TEXT, updated_at TEXT);
+  `);
+  database.prepare('INSERT INTO piecemaker_nodes VALUES (?, ?, ?)').run('smoke', 'n0', NAME);
+  database.prepare('INSERT INTO piecemaker_mappings VALUES (?, ?, ?, ?, ?)').run('smoke', 'n0', NAME, CODE, '2026-01-01T00:00:00.000Z');
+  database.close();
+  return file;
+}
+
+function temporaryAuthority(directory) {
+  const cert = path.join(directory, 'ca.crt');
+  const key = path.join(directory, 'ca.key');
+  execFileSync('openssl', [
+    'req', '-x509', '-newkey', 'rsa:2048', '-nodes',
+    '-keyout', key, '-out', cert, '-days', '1',
+    '-subj', '/CN=PieceMaker Smoke CA',
+    '-addext', 'basicConstraints=critical,CA:true,pathlen:0',
+    '-addext', 'keyUsage=critical,keyCertSign,cRLSign',
+  ], { stdio: 'ignore' });
+  return { cert, key };
+}
+
+function sseEvent(text) {
+  return `event: content_block_delta\ndata: ${JSON.stringify({
+    type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text },
+  })}\n\n`;
+}
+
+function startUpstream() {
+  const seen = [];
+  const server = http.createServer((request, response) => {
+    const chunks = [];
+    request.on('data', (chunk) => chunks.push(chunk));
+    request.on('end', () => {
+      const body = Buffer.concat(chunks).toString('utf8');
+      seen.push(body);
+      if (request.headers['x-smoke-mode'] === 'sse') {
+        response.writeHead(200, { 'content-type': 'text/event-stream' });
+        for (const text of ['Le client ', 'PERSONNE_', 'PHYSIQUE', '_01', ' a signé.']) response.write(sseEvent(text));
+        response.end('event: content_block_stop\ndata: {"type":"content_block_stop","index":0}\n\n');
+        return;
+      }
+      response.writeHead(200, { 'content-type': 'application/json' });
+      response.end(JSON.stringify({ echo: body }));
+    });
+  });
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => resolve({ seen, server, port: server.address().port }));
+  });
+}
+
+function sandboxProfile(directory) {
+  const writable = JSON.stringify(fs.realpathSync(directory));
+  return [
+    '(version 1)',
+    '(allow default)',
+    '(deny network-outbound)',
+    '(allow network-outbound (remote ip "localhost:*"))',
+    '(allow network-outbound (remote unix-socket))',
+    '(deny file-write*)',
+    `(allow file-write* (subpath ${writable}) (literal "/dev/null") (literal "/dev/tty"))`,
+  ].join('\n');
+}
+
+function launch(binary, args, directory, sandboxed) {
+  const env = {
+    ...process.env,
+    HOME: directory,
+    USERPROFILE: directory,
+    HTTPS_PROXY: '', HTTP_PROXY: '', ALL_PROXY: '', https_proxy: '', http_proxy: '', all_proxy: '',
+  };
+  const options = { cwd: directory, env, stdio: ['pipe', 'pipe', 'pipe'] };
+  if (sandboxed) return spawn(SANDBOX_EXEC, ['-p', sandboxProfile(directory), binary, ...args], options);
+  return spawn(binary, args, options);
+}
+
+function waitForListening(child, logs) {
+  return new Promise((resolve, reject) => {
+    let buffer = '';
+    const timer = setTimeout(() => reject(new Error(`aucune écoute après 15 s : ${logs.text || buffer}`)), 15000);
+    child.stdout.on('data', (chunk) => {
+      buffer += chunk;
+      const match = buffer.match(/listening 127\.0\.0\.1:(\d+)/);
+      if (!match) return;
+      clearTimeout(timer);
+      if (Number(match[1]) === 0) reject(new Error('port annoncé 0 : binaire antérieur au source, à recompiler'));
+      else resolve(Number(match[1]));
+    });
+    child.once('error', (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.once('exit', (code, signal) => {
+      clearTimeout(timer);
+      reject(new Error(`sorti (${code ?? signal}) : ${logs.text || buffer}`));
+    });
+  });
+}
+
+function withTimeout(promise, label) {
+  let timer;
+  return Promise.race([
+    promise,
+    new Promise((_, reject) => { timer = setTimeout(() => reject(new Error(`${label} : délai dépassé`)), CHECK_TIMEOUT_MS); }),
+  ]).finally(() => clearTimeout(timer));
+}
+
+function health(port) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: '/health' }, (response) => {
+      let body = '';
+      response.on('data', (chunk) => { body += chunk; });
+      response.on('end', () => resolve({ status: response.statusCode, body }));
+    }).on('error', reject);
+  });
+}
+
+function refuseDirectResolution(hostname, _options, callback) {
+  callback(new Error(`résolution directe de ${hostname} interdite : tout doit passer par le proxy`));
+}
+
+function postThroughProxy(port, ca, { body, contentType = 'application/json', mode = 'json' }) {
+  return new Promise((resolve, reject) => {
+    const connect = http.request({ host: '127.0.0.1', port, method: 'CONNECT', path: `${HOST}:443`, headers: { host: `${HOST}:443` } });
+    connect.once('error', reject);
+    connect.once('connect', (answer, socket) => {
+      if (answer.statusCode !== 200) {
+        socket.destroy();
+        reject(new Error(`CONNECT refusé (${answer.statusCode})`));
+        return;
+      }
+      const request = https.request({
+        host: HOST,
+        path: '/v1/messages',
+        method: 'POST',
+        lookup: refuseDirectResolution,
+        headers: { 'content-type': contentType, 'content-length': Buffer.byteLength(body), 'x-smoke-mode': mode },
+        createConnection: () => tls.connect({ socket, servername: HOST, ca }),
+      }, (response) => {
+        let text = '';
+        response.setEncoding('utf8');
+        response.on('data', (chunk) => { text += chunk; });
+        response.on('end', () => {
+          socket.destroy();
+          resolve({ status: response.statusCode, body: text });
+        });
+      });
+      request.once('error', reject);
+      request.end(body);
+    });
+    connect.end();
+  });
+}
+
+function streamedText(body) {
+  return body
+    .split('\n')
+    .filter((line) => line.startsWith('data: '))
+    .map((line) => {
+      try {
+        return JSON.parse(line.slice(6))?.delta?.text || '';
+      } catch {
+        return '';
+      }
+    })
+    .join('');
+}
+
+function waitForExit(child, timeoutMs) {
+  if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true);
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => resolve(false), timeoutMs);
+    child.once('exit', () => {
+      clearTimeout(timer);
+      resolve(true);
+    });
+  });
+}
+
+async function runHudsuckerSmokeTest({ binary: requestedBinary = defaultBinary(), caCert = null, caKey = null, sandbox = true, report = () => {} } = {}) {
+  const binary = path.resolve(requestedBinary);
+  const checks = [];
+  const record = (name, ok, detail = '') => {
+    checks.push({ name, ok, detail });
+    report({ name, ok, detail });
+    return ok;
+  };
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'pm-hudsucker-smoke-'));
+  const sandboxed = sandbox && process.platform === 'darwin' && fs.existsSync(SANDBOX_EXEC);
+  let child = null;
+  let bridge = null;
+  let upstream = null;
+  try {
+    if (!fs.existsSync(binary)) {
+      record('binaire présent', false, binary);
+      return { ok: false, sandboxed, checks };
+    }
+    const authority = caCert && caKey ? { cert: caCert, key: caKey } : temporaryAuthority(directory);
+    for (const file of [authority.cert, authority.key]) {
+      if (!fs.existsSync(file)) {
+        record('autorité locale présente', false, file);
+        return { ok: false, sandboxed, checks };
+      }
+    }
+    const ca = fs.readFileSync(authority.cert);
+
+    bridge = await startRewriterWorker({ databasePath: mappingDatabase(directory), homeDir: directory });
+    upstream = await startUpstream();
+
+    const logs = { text: '' };
+    child = launch(binary, [
+      '--listen', '127.0.0.1:0',
+      '--rewriter', `http://127.0.0.1:${bridge.port}`,
+      '--ca-cert', authority.cert,
+      '--ca-key', authority.key,
+      '--hosts', HOST,
+      '--upstream-map', `${HOST}=127.0.0.1:${upstream.port}`,
+    ], directory, sandboxed);
+    child.stderr.on('data', (chunk) => { logs.text += chunk; });
+
+    let port;
+    try {
+      port = await waitForListening(child, logs);
+      record('démarrage', true, `écoute sur 127.0.0.1:${port}${sandboxed ? ', dans sandbox-exec' : ''}`);
+    } catch (error) {
+      record('démarrage', false, error.message);
+      return { ok: false, sandboxed, checks };
+    }
+
+    const step = async (name, run) => {
+      try {
+        const detail = await withTimeout(run(), name);
+        record(name, true, detail || '');
+      } catch (error) {
+        record(name, false, error.message);
+      }
+    };
+
+    await step('santé', async () => {
+      const { status, body } = await health(port);
+      if (status !== 200 || !body.includes('"rewriter":"ok"')) throw new Error(`HTTP ${status} ${body}`);
+    });
+
+    await step('anonymisation JSON aller-retour', async () => {
+      const before = upstream.seen.length;
+      const response = await postThroughProxy(port, ca, {
+        body: JSON.stringify({ messages: [{ role: 'user', content: `Contrat de ${NAME}` }] }),
+      });
+      const sent = upstream.seen[before] || '';
+      if (response.status !== 200) throw new Error(`HTTP ${response.status} ${response.body}`);
+      if (sent.includes(NAME) || !sent.includes(CODE)) throw new Error(`le serveur distant a reçu : ${sent}`);
+      if (!response.body.includes(NAME) || response.body.includes(CODE)) throw new Error(`réponse non restituée : ${response.body}`);
+      return `le distant voit ${CODE}, le client lit « ${NAME} »`;
+    });
+
+    await step('flux SSE restitué', async () => {
+      const response = await postThroughProxy(port, ca, { body: JSON.stringify({ stream: true, messages: [] }), mode: 'sse' });
+      const text = streamedText(response.body);
+      if (response.status !== 200 || text !== `Le client ${NAME} a signé.`) throw new Error(`HTTP ${response.status}, texte « ${text} »`);
+    });
+
+    await step('refus d’un corps non JSON', async () => {
+      const before = upstream.seen.length;
+      const response = await postThroughProxy(port, ca, { body: `Contrat de ${NAME}`, contentType: 'text/plain' });
+      if (response.status !== 415 || upstream.seen.length !== before) throw new Error(`HTTP ${response.status}, transmis : ${upstream.seen.length - before}`);
+    });
+
+    await step('refus si le réécrivain tombe', async () => {
+      await bridge.close();
+      bridge = null;
+      const before = upstream.seen.length;
+      const response = await postThroughProxy(port, ca, { body: JSON.stringify({ messages: [{ role: 'user', content: NAME }] }) });
+      if (response.status !== 502 || upstream.seen.length !== before) throw new Error(`HTTP ${response.status}, transmis : ${upstream.seen.length - before}`);
+    });
+
+    await step('arrêt avec son parent', async () => {
+      child.stdin.end();
+      if (!(await waitForExit(child, 3000))) throw new Error('toujours en vie 3 s après la fermeture de son entrée');
+    });
+
+    return { ok: checks.every((check) => check.ok), sandboxed, checks };
+  } catch (error) {
+    record('banc de test', false, error.message);
+    return { ok: false, sandboxed, checks };
+  } finally {
+    if (child && child.exitCode === null && child.signalCode === null) {
+      child.kill('SIGKILL');
+      await waitForExit(child, 2000);
+    }
+    if (bridge) await bridge.close();
+    if (upstream) await new Promise((resolve) => upstream.server.close(resolve));
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+}
+
+function argument(name) {
+  const index = process.argv.indexOf(name);
+  return index === -1 ? null : process.argv[index + 1] || null;
+}
+
+if (require.main === module) {
+  runHudsuckerSmokeTest({
+    binary: argument('--binary') || defaultBinary(),
+    caCert: argument('--ca-cert'),
+    caKey: argument('--ca-key'),
+    sandbox: !process.argv.includes('--no-sandbox'),
+    report: ({ name, ok, detail }) => console.log(`${ok ? 'OK ' : 'ÉCHEC'} ${name}${detail ? ` — ${detail}` : ''}`),
+  }).then((result) => {
+    process.exitCode = result.ok ? 0 : 1;
+  });
+}
+
+module.exports = { runHudsuckerSmokeTest };

package/server/piecemaker/anonymizer/rewriter-bridge.cjs

@@ -84,6 +84,7 @@ function startRewriterBridge({ dictionary, harness = null }) {
   const server = http.createServer((request, response) => {
     const provider = header(request, 'x-piecemaker-provider') || 'claude';
     const current = () => dictionary.get();
+    const outbound = () => (dictionary.getForOutbound ? dictionary.getForOutbound() : dictionary.get());
 
     if (request.method === 'GET' && request.url === '/health') {
       response.writeHead(200);
@@ -95,14 +96,14 @@ function startRewriterBridge({ dictionary, harness = null }) {
       readBody(request).then((body) => {
         stats.requests += 1;
         const contentType = header(request, 'content-type') || 'application/json';
-        observeRequest(harness, body, contentType, provider);
-        const dict = current();
+        const dict = outbound();
         const rewritten = !body.length || dict.empty
           ? body
           : Buffer.from(rewriteJsonBody(body, (text) => anonymize(text, dict)), 'utf8');
         if (!rewritten.equals(body)) stats.anonymized += 1;
         response.writeHead(200, { 'content-type': 'application/octet-stream', 'content-length': rewritten.length });
         response.end(rewritten);
+        setImmediate(() => observeRequest(harness, body, contentType, provider));
       }).catch((error) => {
         stats.failures += 1;
         stats.lastError = error.message;
@@ -165,15 +166,16 @@ function startRewriterBridge({ dictionary, harness = null }) {
       const id = header(request, 'x-piecemaker-ws');
       const direction = header(request, 'x-piecemaker-direction');
       readBody(request).then((body) => {
-        const dict = current();
         const text = body.toString('utf8');
         if (direction === 'out') {
-          observeRequest(harness, body, 'application/json', provider);
+          const dict = outbound();
           const rewritten = dict.empty ? text : rewriteJsonBody(text, (value) => anonymize(value, dict));
           response.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' });
           response.end(rewritten);
+          setImmediate(() => observeRequest(harness, body, 'application/json', provider));
           return;
         }
+        const dict = current();
         let entry = sessions.get(id);
         if (!entry) {
           entry = { rewriter: createSseRewriter((value) => deanonymize(value, dict)) };
@@ -208,6 +210,7 @@ function startRewriterBridge({ dictionary, harness = null }) {
     response.writeHead(404);
     response.end();
   });
+  server.requestTimeout = 0;
 
   return new Promise((resolve, reject) => {
     server.once('error', reject);

package/server/piecemaker/anonymizer/rewriter-worker.cjs

@@ -0,0 +1,85 @@
+const path = require('node:path');
+const { SHARE_ENV, Worker, isMainThread, parentPort, workerData } = require('node:worker_threads');
+
+const STATS_INTERVAL_MS = 1000;
+const CLOSE_TIMEOUT_MS = 2000;
+
+function runInsideWorker() {
+  const { createSqliteDictionaryLoader } = require('./sqlite-dictionary.cjs');
+  const { startRewriterBridge } = require('./rewriter-bridge.cjs');
+  const { createHarnessJuridique } = require('../harness/index.cjs');
+
+  const dictionary = createSqliteDictionaryLoader({ databasePath: workerData.databasePath });
+  const harness = createHarnessJuridique({ homeDir: workerData.homeDir, verifyResponses: false });
+
+  startRewriterBridge({ dictionary, harness }).then((bridge) => {
+    let published = '';
+    const publishStats = () => {
+      const snapshot = JSON.stringify(bridge.stats);
+      if (snapshot === published) return;
+      published = snapshot;
+      parentPort.postMessage({ type: 'stats', stats: bridge.stats });
+    };
+    const timer = setInterval(publishStats, STATS_INTERVAL_MS);
+    parentPort.on('message', (message) => {
+      if (message?.type !== 'close') return;
+      clearInterval(timer);
+      publishStats();
+      bridge.close().finally(() => {
+        dictionary.close();
+        parentPort.postMessage({ type: 'closed' });
+      });
+    });
+    parentPort.postMessage({ type: 'listening', port: bridge.port });
+  }, (error) => {
+    dictionary.close();
+    parentPort.postMessage({ type: 'error', message: error.message });
+  });
+}
+
+function startRewriterWorker({ databasePath, homeDir }) {
+  const worker = new Worker(path.join(__dirname, 'rewriter-worker.cjs'), {
+    workerData: { databasePath, homeDir },
+    env: SHARE_ENV,
+  });
+  const stats = { requests: 0, anonymized: 0, deanonymized: 0, failures: 0, lastError: null };
+
+  return new Promise((resolve, reject) => {
+    const fail = (error) => {
+      worker.terminate();
+      reject(error);
+    };
+    worker.on('error', (error) => {
+      stats.failures += 1;
+      stats.lastError = error.message;
+      fail(error);
+    });
+    worker.once('exit', (code) => reject(new Error(`réécrivain arrêté (${code})`)));
+    worker.on('message', (message) => {
+      if (message?.type === 'stats') Object.assign(stats, message.stats);
+      if (message?.type === 'error') fail(new Error(message.message));
+      if (message?.type !== 'listening') return;
+      resolve({
+        port: message.port,
+        stats,
+        close() {
+          return new Promise((done) => {
+            const timer = setTimeout(() => worker.terminate().then(() => done()), CLOSE_TIMEOUT_MS);
+            worker.once('exit', () => {
+              clearTimeout(timer);
+              done();
+            });
+            worker.on('message', (reply) => {
+              if (reply?.type === 'closed') worker.terminate();
+            });
+            worker.postMessage({ type: 'close' });
+          });
+        },
+      });
+    });
+  });
+}
+
+if (!isMainThread && workerData?.databasePath) runInsideWorker();
+
+module.exports = { startRewriterWorker };