@piecemaker-legal/piecemaker 2.0.10 → 2.0.12

package/server/piecemaker/anonymizer/dictionary.cjs

@@ -30,6 +30,19 @@ const EMPTY = Object.freeze({
   empty: true,
 });
 
+const MEMO_MIN_LENGTH = 256;
+const MEMO_BUDGET = 16 * 1024 * 1024;
+const memos = new WeakMap();
+
+function memoFor(dictionary) {
+  let memo = memos.get(dictionary);
+  if (!memo) {
+    memo = { entries: new Map(), size: 0 };
+    memos.set(dictionary, memo);
+  }
+  return memo;
+}
+
 function plainObject(value) {
   return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
@@ -49,8 +62,9 @@ function plainObject(value) {
  * ne part pas codé serait un mensonge à l'écran.
  */
 function buildDictionary(document, stamp) {
-  const mapping = plainObject(document?.mapping);
-  const reverse = plainObject(document?.reverse_mapping);
+  const mapping = Object.freeze({ ...plainObject(document?.mapping) });
+  const reverse = Object.freeze(Object.fromEntries(Object.entries(plainObject(document?.reverse_mapping))
+    .map(([code, variants]) => [code, Array.isArray(variants) ? Object.freeze([...variants]) : variants])));
   const canonical = {};
   for (const [code, variants] of Object.entries(reverse)) {
     const name = Array.isArray(variants) ? variants[0] : variants;
@@ -89,7 +103,24 @@ function buildDictionary(document, stamp) {
 
 /** Nom réel → code, sur tout ce qui part vers l'API. */
 function anonymize(text, dictionary) {
-  return dictionary.empty ? text : applyMapping(text, dictionary.mapping);
+  if (dictionary.empty) return text;
+  if (typeof text !== 'string' || text.length < MEMO_MIN_LENGTH) return applyMapping(text, dictionary.mapping);
+  const memo = memoFor(dictionary);
+  const cached = memo.entries.get(text);
+  if (cached !== undefined) {
+    memo.entries.delete(text);
+    memo.entries.set(text, cached);
+    return cached;
+  }
+  const result = applyMapping(text, dictionary.mapping);
+  memo.entries.set(text, result);
+  memo.size += text.length + (result === text ? 0 : result.length);
+  for (const [key, value] of memo.entries) {
+    if (memo.size <= MEMO_BUDGET) break;
+    memo.entries.delete(key);
+    memo.size -= key.length + (value === key ? 0 : value.length);
+  }
+  return result;
 }
 
 /** Code → nom réel, sur tout ce qui revient de l'API vers la machine. */

package/server/piecemaker/anonymizer/hudsucker-fixture.cjs

@@ -49,7 +49,7 @@ async function startHudsuckerSession({
   databasePath,
   upstreamPort,
   harness = null,
-  hosts = ['api.anthropic.com', 'api.openai.com', 'chatgpt.com'],
+  hosts = ['api.anthropic.com', 'api.openai.com', 'chatgpt.com', 'api.mistral.ai'],
   directory = fs.mkdtempSync(path.join(os.tmpdir(), 'pm-hudsucker-')),
 } = {}) {
   const binary = hudsuckerBinary();

package/server/piecemaker/anonymizer/hudsucker-proxy/src/main.rs

@@ -70,6 +70,7 @@ fn provider_for(host: &str) -> &'static str {
     match host {
         "chatgpt.com" => "codex",
         "api.openai.com" => "opencode",
+        "api.mistral.ai" => "mistral",
         _ => "claude",
     }
 }
@@ -471,7 +472,7 @@ async fn main() {
     let hosts = parse_list(&arg("--hosts"));
     let upstream = parse_map(&arg("--upstream-map"));
     if listen.is_empty() || rewriter.is_empty() || ca_cert.is_empty() || ca_key.is_empty() || hosts.is_empty() {
-        eprintln!("usage: piecemaker-hudsucker --listen 127.0.0.1:0 --rewriter http://127.0.0.1:port --ca-cert ca.crt --ca-key ca.key --hosts api.anthropic.com,api.openai.com,chatgpt.com");
+        eprintln!("usage: piecemaker-hudsucker --listen 127.0.0.1:0 --rewriter http://127.0.0.1:port --ca-cert ca.crt --ca-key ca.key --hosts api.anthropic.com,api.openai.com,chatgpt.com,api.mistral.ai");
         std::process::exit(2);
     }
     exit_when_parent_dies();

package/server/piecemaker/anonymizer/hudsucker-smoke.cjs

@@ -0,0 +1,343 @@
+const { execFileSync, spawn } = require('node:child_process');
+const fs = require('node:fs');
+const http = require('node:http');
+const https = require('node:https');
+const os = require('node:os');
+const path = require('node:path');
+const tls = require('node:tls');
+
+const Database = require('better-sqlite3');
+
+const { startRewriterWorker } = require('./rewriter-worker.cjs');
+
+const HOST = 'api.anthropic.com';
+const NAME = 'Jean Dupont';
+const CODE = 'PERSONNE_PHYSIQUE_01';
+const CHECK_TIMEOUT_MS = 10000;
+const SANDBOX_EXEC = '/usr/bin/sandbox-exec';
+
+function defaultBinary() {
+  const name = process.platform === 'win32' ? 'piecemaker-hudsucker.exe' : 'piecemaker-hudsucker';
+  return [
+    path.join(__dirname, 'bin', name),
+    path.join(__dirname, 'hudsucker-proxy', 'target', 'release', name),
+  ].find((candidate) => fs.existsSync(candidate)) || path.join(__dirname, 'bin', name);
+}
+
+function mappingDatabase(directory) {
+  const file = path.join(directory, 'auth.db');
+  const database = new Database(file);
+  database.exec(`
+    CREATE TABLE piecemaker_nodes (project_id TEXT, id TEXT, label TEXT, PRIMARY KEY (project_id, id));
+    CREATE TABLE piecemaker_mappings (project_id TEXT, node_id TEXT, real_value TEXT, masked_value TEXT, updated_at TEXT);
+  `);
+  database.prepare('INSERT INTO piecemaker_nodes VALUES (?, ?, ?)').run('smoke', 'n0', NAME);
+  database.prepare('INSERT INTO piecemaker_mappings VALUES (?, ?, ?, ?, ?)').run('smoke', 'n0', NAME, CODE, '2026-01-01T00:00:00.000Z');
+  database.close();
+  return file;
+}
+
+function temporaryAuthority(directory) {
+  const cert = path.join(directory, 'ca.crt');
+  const key = path.join(directory, 'ca.key');
+  execFileSync('openssl', [
+    'req', '-x509', '-newkey', 'rsa:2048', '-nodes',
+    '-keyout', key, '-out', cert, '-days', '1',
+    '-subj', '/CN=PieceMaker Smoke CA',
+    '-addext', 'basicConstraints=critical,CA:true,pathlen:0',
+    '-addext', 'keyUsage=critical,keyCertSign,cRLSign',
+  ], { stdio: 'ignore' });
+  return { cert, key };
+}
+
+function sseEvent(text) {
+  return `event: content_block_delta\ndata: ${JSON.stringify({
+    type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text },
+  })}\n\n`;
+}
+
+function startUpstream() {
+  const seen = [];
+  const server = http.createServer((request, response) => {
+    const chunks = [];
+    request.on('data', (chunk) => chunks.push(chunk));
+    request.on('end', () => {
+      const body = Buffer.concat(chunks).toString('utf8');
+      seen.push(body);
+      if (request.headers['x-smoke-mode'] === 'sse') {
+        response.writeHead(200, { 'content-type': 'text/event-stream' });
+        for (const text of ['Le client ', 'PERSONNE_', 'PHYSIQUE', '_01', ' a signé.']) response.write(sseEvent(text));
+        response.end('event: content_block_stop\ndata: {"type":"content_block_stop","index":0}\n\n');
+        return;
+      }
+      response.writeHead(200, { 'content-type': 'application/json' });
+      response.end(JSON.stringify({ echo: body }));
+    });
+  });
+  return new Promise((resolve) => {
+    server.listen(0, '127.0.0.1', () => resolve({ seen, server, port: server.address().port }));
+  });
+}
+
+function sandboxProfile(directory) {
+  const writable = JSON.stringify(fs.realpathSync(directory));
+  return [
+    '(version 1)',
+    '(allow default)',
+    '(deny network-outbound)',
+    '(allow network-outbound (remote ip "localhost:*"))',
+    '(allow network-outbound (remote unix-socket))',
+    '(deny file-write*)',
+    `(allow file-write* (subpath ${writable}) (literal "/dev/null") (literal "/dev/tty"))`,
+  ].join('\n');
+}
+
+function launch(binary, args, directory, sandboxed) {
+  const env = {
+    ...process.env,
+    HOME: directory,
+    USERPROFILE: directory,
+    HTTPS_PROXY: '', HTTP_PROXY: '', ALL_PROXY: '', https_proxy: '', http_proxy: '', all_proxy: '',
+  };
+  const options = { cwd: directory, env, stdio: ['pipe', 'pipe', 'pipe'] };
+  if (sandboxed) return spawn(SANDBOX_EXEC, ['-p', sandboxProfile(directory), binary, ...args], options);
+  return spawn(binary, args, options);
+}
+
+function waitForListening(child, logs) {
+  return new Promise((resolve, reject) => {
+    let buffer = '';
+    const timer = setTimeout(() => reject(new Error(`aucune écoute après 15 s : ${logs.text || buffer}`)), 15000);
+    child.stdout.on('data', (chunk) => {
+      buffer += chunk;
+      const match = buffer.match(/listening 127\.0\.0\.1:(\d+)/);
+      if (!match) return;
+      clearTimeout(timer);
+      if (Number(match[1]) === 0) reject(new Error('port annoncé 0 : binaire antérieur au source, à recompiler'));
+      else resolve(Number(match[1]));
+    });
+    child.once('error', (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.once('exit', (code, signal) => {
+      clearTimeout(timer);
+      reject(new Error(`sorti (${code ?? signal}) : ${logs.text || buffer}`));
+    });
+  });
+}
+
+function withTimeout(promise, label) {
+  let timer;
+  return Promise.race([
+    promise,
+    new Promise((_, reject) => { timer = setTimeout(() => reject(new Error(`${label} : délai dépassé`)), CHECK_TIMEOUT_MS); }),
+  ]).finally(() => clearTimeout(timer));
+}
+
+function health(port) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: '/health' }, (response) => {
+      let body = '';
+      response.on('data', (chunk) => { body += chunk; });
+      response.on('end', () => resolve({ status: response.statusCode, body }));
+    }).on('error', reject);
+  });
+}
+
+function refuseDirectResolution(hostname, _options, callback) {
+  callback(new Error(`résolution directe de ${hostname} interdite : tout doit passer par le proxy`));
+}
+
+function postThroughProxy(port, ca, { body, contentType = 'application/json', mode = 'json' }) {
+  return new Promise((resolve, reject) => {
+    const connect = http.request({ host: '127.0.0.1', port, method: 'CONNECT', path: `${HOST}:443`, headers: { host: `${HOST}:443` } });
+    connect.once('error', reject);
+    connect.once('connect', (answer, socket) => {
+      if (answer.statusCode !== 200) {
+        socket.destroy();
+        reject(new Error(`CONNECT refusé (${answer.statusCode})`));
+        return;
+      }
+      const request = https.request({
+        host: HOST,
+        path: '/v1/messages',
+        method: 'POST',
+        lookup: refuseDirectResolution,
+        headers: { 'content-type': contentType, 'content-length': Buffer.byteLength(body), 'x-smoke-mode': mode },
+        createConnection: () => tls.connect({ socket, servername: HOST, ca }),
+      }, (response) => {
+        let text = '';
+        response.setEncoding('utf8');
+        response.on('data', (chunk) => { text += chunk; });
+        response.on('end', () => {
+          socket.destroy();
+          resolve({ status: response.statusCode, body: text });
+        });
+      });
+      request.once('error', reject);
+      request.end(body);
+    });
+    connect.end();
+  });
+}
+
+function streamedText(body) {
+  return body
+    .split('\n')
+    .filter((line) => line.startsWith('data: '))
+    .map((line) => {
+      try {
+        return JSON.parse(line.slice(6))?.delta?.text || '';
+      } catch {
+        return '';
+      }
+    })
+    .join('');
+}
+
+function waitForExit(child, timeoutMs) {
+  if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true);
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => resolve(false), timeoutMs);
+    child.once('exit', () => {
+      clearTimeout(timer);
+      resolve(true);
+    });
+  });
+}
+
+async function runHudsuckerSmokeTest({ binary: requestedBinary = defaultBinary(), caCert = null, caKey = null, sandbox = true, report = () => {} } = {}) {
+  const binary = path.resolve(requestedBinary);
+  const checks = [];
+  const record = (name, ok, detail = '') => {
+    checks.push({ name, ok, detail });
+    report({ name, ok, detail });
+    return ok;
+  };
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'pm-hudsucker-smoke-'));
+  const sandboxed = sandbox && process.platform === 'darwin' && fs.existsSync(SANDBOX_EXEC);
+  let child = null;
+  let bridge = null;
+  let upstream = null;
+  try {
+    if (!fs.existsSync(binary)) {
+      record('binaire présent', false, binary);
+      return { ok: false, sandboxed, checks };
+    }
+    const authority = caCert && caKey ? { cert: caCert, key: caKey } : temporaryAuthority(directory);
+    for (const file of [authority.cert, authority.key]) {
+      if (!fs.existsSync(file)) {
+        record('autorité locale présente', false, file);
+        return { ok: false, sandboxed, checks };
+      }
+    }
+    const ca = fs.readFileSync(authority.cert);
+
+    bridge = await startRewriterWorker({ databasePath: mappingDatabase(directory), homeDir: directory });
+    upstream = await startUpstream();
+
+    const logs = { text: '' };
+    child = launch(binary, [
+      '--listen', '127.0.0.1:0',
+      '--rewriter', `http://127.0.0.1:${bridge.port}`,
+      '--ca-cert', authority.cert,
+      '--ca-key', authority.key,
+      '--hosts', HOST,
+      '--upstream-map', `${HOST}=127.0.0.1:${upstream.port}`,
+    ], directory, sandboxed);
+    child.stderr.on('data', (chunk) => { logs.text += chunk; });
+
+    let port;
+    try {
+      port = await waitForListening(child, logs);
+      record('démarrage', true, `écoute sur 127.0.0.1:${port}${sandboxed ? ', dans sandbox-exec' : ''}`);
+    } catch (error) {
+      record('démarrage', false, error.message);
+      return { ok: false, sandboxed, checks };
+    }
+
+    const step = async (name, run) => {
+      try {
+        const detail = await withTimeout(run(), name);
+        record(name, true, detail || '');
+      } catch (error) {
+        record(name, false, error.message);
+      }
+    };
+
+    await step('santé', async () => {
+      const { status, body } = await health(port);
+      if (status !== 200 || !body.includes('"rewriter":"ok"')) throw new Error(`HTTP ${status} ${body}`);
+    });
+
+    await step('anonymisation JSON aller-retour', async () => {
+      const before = upstream.seen.length;
+      const response = await postThroughProxy(port, ca, {
+        body: JSON.stringify({ messages: [{ role: 'user', content: `Contrat de ${NAME}` }] }),
+      });
+      const sent = upstream.seen[before] || '';
+      if (response.status !== 200) throw new Error(`HTTP ${response.status} ${response.body}`);
+      if (sent.includes(NAME) || !sent.includes(CODE)) throw new Error(`le serveur distant a reçu : ${sent}`);
+      if (!response.body.includes(NAME) || response.body.includes(CODE)) throw new Error(`réponse non restituée : ${response.body}`);
+      return `le distant voit ${CODE}, le client lit « ${NAME} »`;
+    });
+
+    await step('flux SSE restitué', async () => {
+      const response = await postThroughProxy(port, ca, { body: JSON.stringify({ stream: true, messages: [] }), mode: 'sse' });
+      const text = streamedText(response.body);
+      if (response.status !== 200 || text !== `Le client ${NAME} a signé.`) throw new Error(`HTTP ${response.status}, texte « ${text} »`);
+    });
+
+    await step('refus d’un corps non JSON', async () => {
+      const before = upstream.seen.length;
+      const response = await postThroughProxy(port, ca, { body: `Contrat de ${NAME}`, contentType: 'text/plain' });
+      if (response.status !== 415 || upstream.seen.length !== before) throw new Error(`HTTP ${response.status}, transmis : ${upstream.seen.length - before}`);
+    });
+
+    await step('refus si le réécrivain tombe', async () => {
+      await bridge.close();
+      bridge = null;
+      const before = upstream.seen.length;
+      const response = await postThroughProxy(port, ca, { body: JSON.stringify({ messages: [{ role: 'user', content: NAME }] }) });
+      if (response.status !== 502 || upstream.seen.length !== before) throw new Error(`HTTP ${response.status}, transmis : ${upstream.seen.length - before}`);
+    });
+
+    await step('arrêt avec son parent', async () => {
+      child.stdin.end();
+      if (!(await waitForExit(child, 3000))) throw new Error('toujours en vie 3 s après la fermeture de son entrée');
+    });
+
+    return { ok: checks.every((check) => check.ok), sandboxed, checks };
+  } catch (error) {
+    record('banc de test', false, error.message);
+    return { ok: false, sandboxed, checks };
+  } finally {
+    if (child && child.exitCode === null && child.signalCode === null) {
+      child.kill('SIGKILL');
+      await waitForExit(child, 2000);
+    }
+    if (bridge) await bridge.close();
+    if (upstream) await new Promise((resolve) => upstream.server.close(resolve));
+    fs.rmSync(directory, { recursive: true, force: true });
+  }
+}
+
+function argument(name) {
+  const index = process.argv.indexOf(name);
+  return index === -1 ? null : process.argv[index + 1] || null;
+}
+
+if (require.main === module) {
+  runHudsuckerSmokeTest({
+    binary: argument('--binary') || defaultBinary(),
+    caCert: argument('--ca-cert'),
+    caKey: argument('--ca-key'),
+    sandbox: !process.argv.includes('--no-sandbox'),
+    report: ({ name, ok, detail }) => console.log(`${ok ? 'OK ' : 'ÉCHEC'} ${name}${detail ? ` — ${detail}` : ''}`),
+  }).then((result) => {
+    process.exitCode = result.ok ? 0 : 1;
+  });
+}
+
+module.exports = { runHudsuckerSmokeTest };

package/server/piecemaker/anonymizer/rewrite.cjs

@@ -218,7 +218,7 @@ function createSseRewriter(transform) {
       return lines(JSON.stringify(parsed), undefined);
     }
     const keys = [...held.keys()].filter((key) => key.startsWith(keyPrefix));
-    return withFlush(keys, JSON.stringify(parsed), parsed.type);
+    return withFlush(keys, JSON.stringify(rewriteJsonValue(parsed, transform)), parsed.type);
   }
 
   function rewriteResponses(parsed) {
@@ -236,7 +236,7 @@ function createSseRewriter(transform) {
     const keys = eventType === 'response.completed'
       ? [...held.keys()]
       : eventType.endsWith('.done') ? [key] : [];
-    return withFlush(keys, JSON.stringify(parsed), parsed.type);
+    return withFlush(keys, JSON.stringify(rewriteJsonValue(parsed, transform)), parsed.type);
   }
 
   function rewriteChatChunk(parsed) {

package/server/piecemaker/anonymizer/rewriter-bridge.cjs

@@ -84,6 +84,7 @@ function startRewriterBridge({ dictionary, harness = null }) {
   const server = http.createServer((request, response) => {
     const provider = header(request, 'x-piecemaker-provider') || 'claude';
     const current = () => dictionary.get();
+    const outbound = () => (dictionary.getForOutbound ? dictionary.getForOutbound() : dictionary.get());
 
     if (request.method === 'GET' && request.url === '/health') {
       response.writeHead(200);
@@ -95,14 +96,14 @@ function startRewriterBridge({ dictionary, harness = null }) {
       readBody(request).then((body) => {
         stats.requests += 1;
         const contentType = header(request, 'content-type') || 'application/json';
-        observeRequest(harness, body, contentType, provider);
-        const dict = current();
+        const dict = outbound();
         const rewritten = !body.length || dict.empty
           ? body
           : Buffer.from(rewriteJsonBody(body, (text) => anonymize(text, dict)), 'utf8');
         if (!rewritten.equals(body)) stats.anonymized += 1;
         response.writeHead(200, { 'content-type': 'application/octet-stream', 'content-length': rewritten.length });
         response.end(rewritten);
+        setImmediate(() => observeRequest(harness, body, contentType, provider));
       }).catch((error) => {
         stats.failures += 1;
         stats.lastError = error.message;
@@ -165,15 +166,16 @@ function startRewriterBridge({ dictionary, harness = null }) {
       const id = header(request, 'x-piecemaker-ws');
       const direction = header(request, 'x-piecemaker-direction');
       readBody(request).then((body) => {
-        const dict = current();
         const text = body.toString('utf8');
         if (direction === 'out') {
-          observeRequest(harness, body, 'application/json', provider);
+          const dict = outbound();
           const rewritten = dict.empty ? text : rewriteJsonBody(text, (value) => anonymize(value, dict));
           response.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' });
           response.end(rewritten);
+          setImmediate(() => observeRequest(harness, body, 'application/json', provider));
           return;
         }
+        const dict = current();
         let entry = sessions.get(id);
         if (!entry) {
           entry = { rewriter: createSseRewriter((value) => deanonymize(value, dict)) };
@@ -208,6 +210,7 @@ function startRewriterBridge({ dictionary, harness = null }) {
     response.writeHead(404);
     response.end();
   });
+  server.requestTimeout = 0;
 
   return new Promise((resolve, reject) => {
     server.once('error', reject);

package/server/piecemaker/anonymizer/rewriter-worker.cjs

@@ -0,0 +1,85 @@
+const path = require('node:path');
+const { SHARE_ENV, Worker, isMainThread, parentPort, workerData } = require('node:worker_threads');
+
+const STATS_INTERVAL_MS = 1000;
+const CLOSE_TIMEOUT_MS = 2000;
+
+function runInsideWorker() {
+  const { createSqliteDictionaryLoader } = require('./sqlite-dictionary.cjs');
+  const { startRewriterBridge } = require('./rewriter-bridge.cjs');
+  const { createHarnessJuridique } = require('../harness/index.cjs');
+
+  const dictionary = createSqliteDictionaryLoader({ databasePath: workerData.databasePath });
+  const harness = createHarnessJuridique({ homeDir: workerData.homeDir, verifyResponses: false });
+
+  startRewriterBridge({ dictionary, harness }).then((bridge) => {
+    let published = '';
+    const publishStats = () => {
+      const snapshot = JSON.stringify(bridge.stats);
+      if (snapshot === published) return;
+      published = snapshot;
+      parentPort.postMessage({ type: 'stats', stats: bridge.stats });
+    };
+    const timer = setInterval(publishStats, STATS_INTERVAL_MS);
+    parentPort.on('message', (message) => {
+      if (message?.type !== 'close') return;
+      clearInterval(timer);
+      publishStats();
+      bridge.close().finally(() => {
+        dictionary.close();
+        parentPort.postMessage({ type: 'closed' });
+      });
+    });
+    parentPort.postMessage({ type: 'listening', port: bridge.port });
+  }, (error) => {
+    dictionary.close();
+    parentPort.postMessage({ type: 'error', message: error.message });
+  });
+}
+
+function startRewriterWorker({ databasePath, homeDir }) {
+  const worker = new Worker(path.join(__dirname, 'rewriter-worker.cjs'), {
+    workerData: { databasePath, homeDir },
+    env: SHARE_ENV,
+  });
+  const stats = { requests: 0, anonymized: 0, deanonymized: 0, failures: 0, lastError: null };
+
+  return new Promise((resolve, reject) => {
+    const fail = (error) => {
+      worker.terminate();
+      reject(error);
+    };
+    worker.on('error', (error) => {
+      stats.failures += 1;
+      stats.lastError = error.message;
+      fail(error);
+    });
+    worker.once('exit', (code) => reject(new Error(`réécrivain arrêté (${code})`)));
+    worker.on('message', (message) => {
+      if (message?.type === 'stats') Object.assign(stats, message.stats);
+      if (message?.type === 'error') fail(new Error(message.message));
+      if (message?.type !== 'listening') return;
+      resolve({
+        port: message.port,
+        stats,
+        close() {
+          return new Promise((done) => {
+            const timer = setTimeout(() => worker.terminate().then(() => done()), CLOSE_TIMEOUT_MS);
+            worker.once('exit', () => {
+              clearTimeout(timer);
+              done();
+            });
+            worker.on('message', (reply) => {
+              if (reply?.type === 'closed') worker.terminate();
+            });
+            worker.postMessage({ type: 'close' });
+          });
+        },
+      });
+    });
+  });
+}
+
+if (!isMainThread && workerData?.databasePath) runInsideWorker();
+
+module.exports = { startRewriterWorker };

package/server/piecemaker/anonymizer/service.cjs

@@ -5,16 +5,16 @@ const path = require('node:path');
 const tls = require('node:tls');
 
 const { createSqliteDictionaryLoader } = require('./sqlite-dictionary.cjs');
-const { startRewriterBridge } = require('./rewriter-bridge.cjs');
+const { startRewriterWorker } = require('./rewriter-worker.cjs');
 const { removeLegacyProxyConfig } = require('./client-config.cjs');
-const { createHarnessJuridique } = require('../harness/index.cjs');
 
 const DEFAULT_UPSTREAM = 'https://api.anthropic.com';
-const INTERCEPTED_HOSTS = ['api.anthropic.com', 'api.openai.com', 'chatgpt.com'];
+const INTERCEPTED_HOSTS = ['api.anthropic.com', 'api.openai.com', 'chatgpt.com', 'api.mistral.ai'];
 const COVERAGE = {
   claude: { state: 'filtered', detail: null, file: null },
   codex: { state: 'filtered', detail: null, file: null },
   opencode: { state: 'filtered', detail: null, file: null },
+  mistral: { state: 'filtered', detail: null, file: null },
   cursor: { state: 'blocked', detail: 'not-interceptable', file: null },
 };
 
@@ -52,7 +52,9 @@ function hudsuckerBinary() {
     path.join(__dirname, 'hudsucker-proxy', 'target', 'release', name),
     path.join(__dirname, 'hudsucker-proxy', 'target', 'debug', name),
   ];
-  return candidates.find((candidate) => fs.existsSync(candidate)) || candidates[0];
+  const present = candidates.filter((candidate) => fs.existsSync(candidate));
+  if (!present.length) return candidates[0];
+  return present.reduce((newest, candidate) => (fs.statSync(candidate).mtimeMs > fs.statSync(newest).mtimeMs ? candidate : newest));
 }
 
 function certificatePaths() {
@@ -136,8 +138,8 @@ function proxyEnvironment(proxyUrl, caFile, trustBundle) {
 }
 
 function createAnonymizerService({ homeDir, userHome = os.homedir(), logger = console }) {
-  const dictionary = createSqliteDictionaryLoader({ databasePath: process.env.DATABASE_PATH || path.join(homeDir, 'auth.db') });
-  const harness = createHarnessJuridique({ homeDir, verifyResponses: false });
+  const databasePath = process.env.DATABASE_PATH || path.join(homeDir, 'auth.db');
+  const dictionary = createSqliteDictionaryLoader({ databasePath });
   const binDir = path.join(homeDir, 'bin');
   const state = { enabled: false, reason: 'not_started', origin: null, upstream: null, coverage: {} };
   let proxy = null;
@@ -165,7 +167,7 @@ function createAnonymizerService({ homeDir, userHome = os.homedir(), logger = co
     const hosts = [...new Set([...INTERCEPTED_HOSTS, new URL(upstream).hostname])];
 
     try {
-      bridge = await startRewriterBridge({ dictionary, harness });
+      bridge = await startRewriterWorker({ databasePath, homeDir });
     } catch (error) {
       state.reason = `listen_failed: ${error.message}`;
       logger.warn?.(`[piecemaker] réécriture PII non démarrée : ${error.message}`);
@@ -221,7 +223,7 @@ function createAnonymizerService({ homeDir, userHome = os.homedir(), logger = co
       upstream,
       coverage: COVERAGE,
     });
-    logger.log?.(`[piecemaker] anonymisation active sur ${origin} (claude, codex, opencode ; cursor bloqué)`);
+    logger.log?.(`[piecemaker] anonymisation active sur ${origin} (claude, codex, opencode, mistral ; cursor bloqué)`);
     return state;
   }