@rogatio/cli 6.16.1 → 6.16.3

package/dist/node/index.js

@@ -2301,6 +2301,7 @@ import { isAbsolute as isAbsolute3 } from "node:path";
 import { Buffer as Buffer2 } from "node:buffer";
 import { existsSync as existsSync2 } from "node:fs";
 import { join as join6 } from "node:path";
+import { lookup as dnsLookup2 } from "node:dns/promises";
 import {
   createServer as createServer2
 } from "node:http";
@@ -22681,6 +22682,18 @@ async function readPreviousRogatioCa(caCertFile) {
     return void 0;
   }
 }
+async function assertReadableIfRegular(path2, snapshot2) {
+  if (snapshot2 !== void 0) return;
+  try {
+    const info = await lstat(path2);
+    if (!info.isFile()) return;
+  } catch {
+    return;
+  }
+  throw new TrustError("trust.write-failed", "CA file could not be read", [
+    "trust.write-failed"
+  ]);
+}
 async function discardPreviousCa(caPreviousCertFile) {
   try {
     await rm(caPreviousCertFile, { force: true });
@@ -22732,6 +22745,9 @@ function createRequestBodyTrustController(options = {}) {
   let reusedExisting = false;
   let previousKeyPem;
   let previousPubPem;
+  let replacedKey = false;
+  let replacedPub = false;
+  let replacedCert = false;
   const caCertFile = join2(
     installRoot,
     options.caCertFileName ?? ".rogatio-ca.crt"
@@ -22838,32 +22854,35 @@ function createRequestBodyTrustController(options = {}) {
       console.error("[rogatio] previous CA trust anchor was not removed");
     }
   }
-  async function removeLiveCaFiles() {
-    await rm(caKeyFile, { force: true });
-    await rm(caPubFile, { force: true });
-    await rm(caCertFile, { force: true });
+  async function removeReplacedCaFiles() {
+    if (replacedKey) await rm(caKeyFile, { force: true });
+    if (replacedPub) await rm(caPubFile, { force: true });
+    if (replacedCert) await rm(caCertFile, { force: true });
+  }
+  async function restoreOrDrop(path2, snapshot2, replaced, mode) {
+    if (snapshot2 !== void 0) {
+      await writeFileAtomic(path2, snapshot2, mode);
+      return;
+    }
+    if (replaced) await rm(path2, { force: true });
   }
   async function rollbackReplacedCa() {
     if (reusedExisting) return;
     if (!replacingPrevious) {
-      await removeLiveCaFiles();
+      await removeReplacedCaFiles();
       return;
     }
     const saved = await readPreviousRogatioCa(caPreviousCertFile);
     const live = await readPreviousRogatioCa(caCertFile);
     const copyKept = rememberedFingerprint !== void 0 && saved?.fingerprint === rememberedFingerprint;
     const liveDiffers = live?.fingerprint !== rememberedFingerprint;
-    if (copyKept && liveDiffers) {
-      await removeLiveCaFiles();
+    if (copyKept && replacedCert && liveDiffers) {
+      await removeReplacedCaFiles();
       return;
     }
-    if (copyKept && !liveDiffers) {
-      if (previousKeyPem !== void 0) {
-        await writeFileAtomic(caKeyFile, previousKeyPem, 384);
-      }
-      if (previousPubPem !== void 0) {
-        await writeFileAtomic(caPubFile, previousPubPem);
-      }
+    if (copyKept && !replacedCert) {
+      await restoreOrDrop(caKeyFile, previousKeyPem, replacedKey, 384);
+      await restoreOrDrop(caPubFile, previousPubPem, replacedPub);
     }
   }
   async function runCaTrust() {
@@ -22881,12 +22900,21 @@ function createRequestBodyTrustController(options = {}) {
     reusedExisting = false;
     previousKeyPem = void 0;
     previousPubPem = void 0;
+    replacedKey = false;
+    replacedPub = false;
+    replacedCert = false;
     const reusable = await reusableCaMaterial();
     reusedExisting = reusable;
     const liveAnchor = await readPreviousRogatioCa(caCertFile);
     const siblingAnchor = await readPreviousRogatioCa(caPreviousCertFile);
     let preserved;
     if (!reusable) {
+      const rawCert = await readNoFollowRegularFile(caCertFile);
+      previousKeyPem = await readNoFollowRegularFile(caKeyFile);
+      previousPubPem = await readNoFollowRegularFile(caPubFile);
+      await assertReadableIfRegular(caCertFile, rawCert);
+      await assertReadableIfRegular(caKeyFile, previousKeyPem);
+      await assertReadableIfRegular(caPubFile, previousPubPem);
       replacingPrevious = liveAnchor !== void 0 || siblingAnchor !== void 0;
       const { privateKey } = generateCaKeyPair(TRUST_LIMITS.caKeyBits);
       const certResult = await createCertificate(
@@ -22914,11 +22942,12 @@ function createRequestBodyTrustController(options = {}) {
       } else if (siblingAnchor) {
         await discardPreviousCa(caPreviousCertFile);
       }
-      previousKeyPem = await readNoFollowRegularFile(caKeyFile);
-      previousPubPem = await readNoFollowRegularFile(caPubFile);
       await writeFileAtomic(caKeyFile, certResult.keyPem, 384);
+      replacedKey = true;
       await writeFileAtomic(caPubFile, certResult.certPem);
+      replacedPub = true;
       await writeFileAtomic(caCertFile, certResult.certPem);
+      replacedCert = true;
     }
     let installedNew = false;
     if (caTrustInstaller && !installerCalled) {
@@ -25103,6 +25132,133 @@ function forwardRequestHeaders(headers, host, contentLength) {
   }
   return out;
 }
+var defaultResolver2 = {
+  async lookup(hostname, signal) {
+    if (signal?.aborted) throw new Error("aborted");
+    const addresses = await dnsLookup2(hostname, { all: true });
+    return addresses.map((address) => ({
+      address: address.address,
+      family: address.family === 6 ? 6 : 4
+    }));
+  }
+};
+var defaultDial = (port, address) => connect(port, address);
+function localOriginsFromProject(project) {
+  if (project === null || typeof project !== "object") return [];
+  const policy = project.requestBodyPolicy;
+  if (policy === null || typeof policy !== "object") return [];
+  const origins = policy.localOrigins;
+  if (!Array.isArray(origins)) return [];
+  return origins.filter(
+    (origin) => typeof origin === "string"
+  );
+}
+function effectiveLocalOrigins(policy) {
+  if (policy === null) return /* @__PURE__ */ new Set();
+  const raw = policy.localOrigins ?? localOriginsFromProject(policy.project);
+  const origins = /* @__PURE__ */ new Set();
+  for (const origin of raw) {
+    const normalized = normalizeSiteOrigin(origin);
+    if (normalized !== null) origins.add(normalized);
+  }
+  return origins;
+}
+function compareAddresses(left, right) {
+  return left.family - right.family || (left.address < right.address ? -1 : left.address > right.address ? 1 : 0);
+}
+function selectPinnedAddress(addresses, allowNonPublic) {
+  const publicOnly = validateResolvedAddresses(
+    addresses,
+    RUNTIME_LIMITS.maxDnsAddresses
+  );
+  if (publicOnly !== null) return publicOnly[0] ?? null;
+  if (!allowNonPublic) return null;
+  if (addresses.length === 0 || addresses.length > RUNTIME_LIMITS.maxDnsAddresses) {
+    return null;
+  }
+  const checked = [];
+  for (const address of addresses) {
+    if (address.family !== 4 && address.family !== 6) return null;
+    const classification = classifyAddress(address.address);
+    if (classification === "invalid" || classification === "public") {
+      return null;
+    }
+    checked.push({ address: address.address, family: address.family });
+  }
+  checked.sort(compareAddresses);
+  return checked[0] ?? null;
+}
+async function pinHostname(hostname, origin, deps) {
+  if (hostname.length === 0) return null;
+  let resolved;
+  try {
+    resolved = await deps.resolver.lookup(hostname);
+  } catch {
+    return null;
+  }
+  const normalized = normalizeSiteOrigin(origin);
+  const allowNonPublic = normalized !== null && deps.localOrigins.has(normalized);
+  return selectPinnedAddress(resolved, allowNonPublic);
+}
+function httpUpstreamPort(target) {
+  if (target.protocol !== "http:") return null;
+  if (target.username.length > 0 || target.password.length > 0) return null;
+  if (target.port.length === 0 || target.port === "80") return 80;
+  return null;
+}
+function formatUpstreamRequest(method, path2, headers) {
+  const lines = [];
+  for (const [name, value] of Object.entries(headers)) {
+    if (name.includes("\r") || name.includes("\n") || value.includes("\r") || value.includes("\n")) {
+      return null;
+    }
+    lines.push(`${name}: ${value}`);
+  }
+  return `${method} ${path2} HTTP/1.1\r
+${lines.join("\r\n")}\r
+\r
+`;
+}
+function httpsOrigin(host) {
+  const authority = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+  try {
+    return new URL(`https://${authority}`).origin;
+  } catch {
+    return null;
+  }
+}
+function parseConnectAuthority(authority) {
+  if (authority.length === 0) return null;
+  let host;
+  let portText;
+  if (authority.startsWith("[")) {
+    const end = authority.indexOf("]");
+    if (end <= 1) return null;
+    host = authority.slice(1, end);
+    const rest = authority.slice(end + 1);
+    if (!rest.startsWith(":")) return null;
+    portText = rest.slice(1);
+  } else {
+    const colon = authority.lastIndexOf(":");
+    if (colon <= 0) return null;
+    host = authority.slice(0, colon);
+    portText = authority.slice(colon + 1);
+  }
+  if (host.length === 0 || !/^\d+$/.test(portText)) return null;
+  const port = Number(portText);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+  return { host, port };
+}
+function endConnect(socket, status, reason) {
+  if (socket.destroyed || socket.writableEnded) return;
+  socket.end(
+    `HTTP/1.1 ${status} ${reason}\r
+Content-Length: 0\r
+Connection: close\r
+\r
+`
+  );
+}
 function pipeSockets(a, b) {
   a.pipe(b);
   b.pipe(a);
@@ -25115,11 +25271,16 @@ function pipeSockets(a, b) {
   a.on("close", () => b.destroy());
   b.on("close", () => a.destroy());
 }
-async function upstreamHttp(method, target, headers, body) {
-  const port = target.port ? Number(target.port) : 80;
+async function upstreamHttp(method, target, headers, body, deps) {
+  const port = httpUpstreamPort(target);
+  if (port === null) return { ok: false, status: 403 };
   const path2 = `${target.pathname}${target.search}`;
+  const head = formatUpstreamRequest(method, path2, headers);
+  if (head === null) return { ok: false, status: 403 };
+  const pinned = await pinHostname(target.hostname, target.origin, deps);
+  if (pinned === null) return { ok: false, status: 403 };
   return new Promise((resolve12, reject) => {
-    const socket = connect(port, target.hostname);
+    const socket = deps.dial(port, pinned.address);
     let buf = Buffer.alloc(0);
     let settled = false;
     const fail2 = (err) => {
@@ -25132,11 +25293,7 @@ async function upstreamHttp(method, target, headers, body) {
     socket.on("timeout", () => fail2(new Error("upstream timeout")));
     socket.on("error", (err) => fail2(err));
     socket.on("connect", () => {
-      const lines = Object.entries(headers).map(([k, v]) => `${k}: ${v}`).join("\r\n");
-      socket.write(`${method} ${path2} HTTP/1.1\r
-${lines}\r
-\r
-`);
+      socket.write(head);
       if (body.byteLength > 0) socket.write(body);
     });
     socket.on("data", (chunk) => {
@@ -25144,9 +25301,9 @@ ${lines}\r
       buf = Buffer.concat([buf, piece]);
       const sep = buf.indexOf("\r\n\r\n");
       if (sep < 0) return;
-      const head = buf.subarray(0, sep).toString("latin1");
+      const head2 = buf.subarray(0, sep).toString("latin1");
       const statusMatch = /^HTTP\/1\.[01] (\d+)(?: (.*))?/.exec(
-        head.split("\r\n")[0] ?? ""
+        head2.split("\r\n")[0] ?? ""
       );
       if (!statusMatch) {
         fail2(new Error("bad upstream status"));
@@ -25155,7 +25312,7 @@ ${lines}\r
       const status = Number(statusMatch[1]);
       const statusMessage = statusMatch[2]?.trim() ?? "";
       const headerMap = {};
-      for (const line of head.split("\r\n").slice(1)) {
+      for (const line of head2.split("\r\n").slice(1)) {
         const i = line.indexOf(":");
         if (i <= 0) continue;
         const name = line.slice(0, i).trim().toLowerCase();
@@ -25175,6 +25332,7 @@ ${lines}\r
         settled = true;
         socket.destroy();
         resolve12({
+          ok: true,
           status,
           statusMessage,
           headers: headerMap,
@@ -25190,16 +25348,16 @@ ${lines}\r
         fail2(new Error("upstream closed early"));
         return;
       }
-      const head = buf.subarray(0, sep).toString("latin1");
+      const head2 = buf.subarray(0, sep).toString("latin1");
       const statusMatch = /^HTTP\/1\.[01] (\d+)(?: (.*))?/.exec(
-        head.split("\r\n")[0] ?? ""
+        head2.split("\r\n")[0] ?? ""
       );
       if (!statusMatch) {
         fail2(new Error("bad upstream status"));
         return;
       }
       const headerMap = {};
-      for (const line of head.split("\r\n").slice(1)) {
+      for (const line of head2.split("\r\n").slice(1)) {
         const i = line.indexOf(":");
         if (i <= 0) continue;
         headerMap[line.slice(0, i).trim().toLowerCase()] = line.slice(i + 1).trim();
@@ -25214,6 +25372,7 @@ ${lines}\r
       }
       settled = true;
       resolve12({
+        ok: true,
         status: Number(statusMatch[1]),
         statusMessage: statusMatch[2]?.trim() ?? "",
         headers: headerMap,
@@ -25289,6 +25448,8 @@ function authorizeOp(policy, op, url, method, headers) {
 async function startInterceptProxy(options = {}) {
   let policy = options.policy ?? null;
   const serveMock = options.serveMock;
+  const resolver = options.resolver ?? defaultResolver2;
+  const dial = options.dial ?? defaultDial;
   let activeMocks = 0;
   const mockAborts = /* @__PURE__ */ new Set();
   let stopped = false;
@@ -25383,8 +25544,24 @@ async function startInterceptProxy(options = {}) {
         method,
         target,
         forwardHeaders,
-        requestBody
+        requestBody,
+        {
+          resolver,
+          dial,
+          localOrigins: effectiveLocalOrigins(active)
+        }
       );
+      if (!upstream.ok) {
+        if (!res.headersSent) {
+          res.writeHead(upstream.status, {
+            "cache-control": "no-store",
+            "content-length": "0",
+            connection: "close"
+          });
+          res.end();
+        }
+        return;
+      }
       let responseBody = upstream.body;
       if (responseOp !== null && active !== null) {
         if (responseBody.byteLength > RUNTIME_LIMITS.maxResponseBodyBytes) {
@@ -25580,25 +25757,52 @@ async function startInterceptProxy(options = {}) {
     );
   }
   function handleConnect(req, clientSocket, head) {
-    const authority = req.url ?? "";
-    const [host, portText] = authority.split(":");
-    const port = Number(portText);
-    if (!host || !Number.isInteger(port) || port <= 0) {
-      clientSocket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
-      clientSocket.destroy();
+    void tunnelConnect(req, clientSocket, head);
+  }
+  async function tunnelConnect(req, clientSocket, head) {
+    let upstream;
+    clientSocket.on("error", () => upstream?.destroy());
+    const parsed = parseConnectAuthority(req.url ?? "");
+    if (parsed === null) {
+      endConnect(clientSocket, 400, "Bad Request");
+      return;
+    }
+    if (parsed.port !== 443) {
+      endConnect(clientSocket, 403, "Forbidden");
+      return;
+    }
+    const pinned = await pinHostname(
+      parsed.host,
+      httpsOrigin(parsed.host) ?? "",
+      {
+        resolver,
+        dial,
+        localOrigins: effectiveLocalOrigins(policy)
+      }
+    );
+    if (pinned === null || clientSocket.destroyed) {
+      endConnect(clientSocket, 403, "Forbidden");
       return;
     }
-    const upstream = connect(port, host);
-    upstream.on("connect", () => {
+    let upstreamSocket;
+    try {
+      upstreamSocket = dial(443, pinned.address);
+    } catch {
+      endConnect(clientSocket, 502, "Bad Gateway");
+      return;
+    }
+    upstream = upstreamSocket;
+    upstreamSocket.on("connect", () => {
       clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
-      if (head.byteLength > 0) upstream.write(head);
-      pipeSockets(clientSocket, upstream);
+      if (head.byteLength > 0) upstreamSocket.write(head);
+      pipeSockets(clientSocket, upstreamSocket);
     });
-    upstream.on("error", () => {
-      clientSocket.write("HTTP/1.1 502 Bad Gateway\r\n\r\n");
-      clientSocket.destroy();
+    upstreamSocket.on("error", () => {
+      if (!clientSocket.destroyed && !clientSocket.writableEnded) {
+        endConnect(clientSocket, 502, "Bad Gateway");
+      }
+      upstreamSocket.destroy();
     });
-    clientSocket.on("error", () => upstream.destroy());
   }
   const endpoint = await new Promise((resolve12, reject) => {
     server.once("error", reject);
@@ -25649,7 +25853,10 @@ async function startInterception(activation, policyDigest, extensionId, pacRoute
   const sessionId = `session-${activation.startedAt}-${Math.random().toString(36).slice(2)}`;
   let proxy;
   try {
-    const started = await registeredProvider.start(activation);
+    const started = await registeredProvider.start({
+      ...activation,
+      localOrigins: targetPolicy.localOrigins
+    });
     if (started && typeof started === "object" && typeof started.host === "string" && typeof started.port === "number") {
       proxy = started;
     } else if (activation.proxy) {
@@ -27386,6 +27593,25 @@ function createNativeHost(options) {
     ...options.clock ? { clock: options.clock } : {}
   });
   let interceptProxy = null;
+  function policyForProxy(activation) {
+    const policy = controller.getActivePolicy();
+    if (!policy) return null;
+    const fromProject = localOriginsFromProject(policy.project);
+    const fromSession = activation.localOrigins ?? [];
+    const localOrigins = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const origin of [...fromProject, ...fromSession]) {
+      if (seen.has(origin)) continue;
+      seen.add(origin);
+      localOrigins.push(origin);
+    }
+    return {
+      project: policy.project,
+      operations: policy.operations,
+      presetDigest: policy.presetDigest,
+      localOrigins
+    };
+  }
   let outboundWrite = null;
   let hostRequestCounter = 0;
   const pendingHost = /* @__PURE__ */ new Map();
@@ -27454,18 +27680,13 @@ function createNativeHost(options) {
       } catch {
       }
     },
-    async startTlsProxy() {
+    async startTlsProxy(activation) {
       if (interceptProxy) {
         await interceptProxy.stop();
         interceptProxy = null;
       }
-      const policy = controller.getActivePolicy();
       interceptProxy = await startInterceptProxy({
-        policy: policy ? {
-          project: policy.project,
-          operations: policy.operations,
-          presetDigest: policy.presetDigest
-        } : null,
+        policy: policyForProxy(activation),
         serveMock: (request) => controller.serveMock(request.token, {
           method: request.method,
           signal: request.signal
@@ -27488,14 +27709,7 @@ function createNativeHost(options) {
     async start(activation) {
       const routes = pendingRoutes.length > 0 ? pendingRoutes : activation.pacRoutes;
       const endpoint = await platformProvider.start(activation, routes);
-      const policy = controller.getActivePolicy();
-      interceptProxy?.setPolicy(
-        policy ? {
-          project: policy.project,
-          operations: policy.operations,
-          presetDigest: policy.presetDigest
-        } : null
-      );
+      interceptProxy?.setPolicy(policyForProxy(activation));
       return endpoint;
     },
     async stop() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.16.1",
+  "version": "6.16.3",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",