@rogatio/cli 6.16.2 → 6.16.4

package/dist/editor/index.js

@@ -531,7 +531,11 @@ function createAIAssistPanel(_container, _editor, onApply, onClose, onSend) {
       `;
       const addDetail = (label, value) => {
         const detail = document.createElement("div");
-        detail.innerHTML = `<span style="color:#666;">${label}:</span> ${value}`;
+        const labelEl = document.createElement("span");
+        labelEl.style.color = "#666";
+        labelEl.textContent = `${label}:`;
+        detail.appendChild(labelEl);
+        detail.appendChild(document.createTextNode(` ${value}`));
         ruleDetails.appendChild(detail);
       };
       if (rule.source) {

package/dist/node/index.js

@@ -2301,6 +2301,7 @@ import { isAbsolute as isAbsolute3 } from "node:path";
 import { Buffer as Buffer2 } from "node:buffer";
 import { existsSync as existsSync2 } from "node:fs";
 import { join as join6 } from "node:path";
+import { lookup as dnsLookup2 } from "node:dns/promises";
 import {
   createServer as createServer2
 } from "node:http";
@@ -20072,7 +20073,7 @@ var require_x509_cjs = __commonJS({
     var _X509Certificate_signature;
     var _X509Certificate_extensions;
     var _X509Certificate_publicKey;
-    var X509Certificate5 = class extends PemData {
+    var X509Certificate4 = class extends PemData {
       get publicKey() {
         if (!tslib.__classPrivateFieldGet(this, _X509Certificate_publicKey, "f")) {
           tslib.__classPrivateFieldSet(this, _X509Certificate_publicKey, new PublicKey(this.asn.tbsCertificate.subjectPublicKeyInfo, this.parseOptions), "f");
@@ -20315,7 +20316,7 @@ var require_x509_cjs = __commonJS({
       }
     };
     _X509Certificate_tbs = /* @__PURE__ */ new WeakMap(), _X509Certificate_serialNumber = /* @__PURE__ */ new WeakMap(), _X509Certificate_subjectName = /* @__PURE__ */ new WeakMap(), _X509Certificate_subject = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuerName = /* @__PURE__ */ new WeakMap(), _X509Certificate_issuer = /* @__PURE__ */ new WeakMap(), _X509Certificate_notBefore = /* @__PURE__ */ new WeakMap(), _X509Certificate_notAfter = /* @__PURE__ */ new WeakMap(), _X509Certificate_signatureAlgorithm = /* @__PURE__ */ new WeakMap(), _X509Certificate_signature = /* @__PURE__ */ new WeakMap(), _X509Certificate_extensions = /* @__PURE__ */ new WeakMap(), _X509Certificate_publicKey = /* @__PURE__ */ new WeakMap();
-    X509Certificate5.NAME = "Certificate";
+    X509Certificate4.NAME = "Certificate";
     var _X509Certificates_options;
     var X509Certificates = class extends Array {
       constructor(param, options) {
@@ -20323,7 +20324,7 @@ var require_x509_cjs = __commonJS({
         _X509Certificates_options.set(this, void 0);
         if (PemData.isAsnEncoded(param)) {
           this.import(param, options);
-        } else if (param instanceof X509Certificate5) {
+        } else if (param instanceof X509Certificate4) {
           this.push(param);
         } else if (Array.isArray(param)) {
           for (const item of param) {
@@ -20361,7 +20362,7 @@ var require_x509_cjs = __commonJS({
         const certificates = [];
         for (const item of signedData.certificates || []) {
           if (item.certificate) {
-            certificates.push(new X509Certificate5(item.certificate, options));
+            certificates.push(new X509Certificate4(item.certificate, options));
           }
         }
         this.clear();
@@ -20553,7 +20554,7 @@ var require_x509_cjs = __commonJS({
           throw Error("Cannot convert ASN.1 signature value to WebCrypto format");
         }
         asnX509.signatureValue = asnSignature;
-        return new X509Certificate5(asn1Schema.AsnConvert.serialize(asnX509));
+        return new X509Certificate4(asn1Schema.AsnConvert.serialize(asnX509));
       }
     };
     var _X509CrlEntry_serialNumber;
@@ -20774,7 +20775,7 @@ var require_x509_cjs = __commonJS({
         let publicKey;
         const paramsKey = params.publicKey;
         try {
-          if (paramsKey instanceof X509Certificate5) {
+          if (paramsKey instanceof X509Certificate4) {
             keyAlgorithm = {
               ...paramsKey.publicKey.algorithm,
               ...paramsKey.signatureAlgorithm
@@ -20978,7 +20979,7 @@ var require_x509_cjs = __commonJS({
     exports.TextObject = TextObject;
     exports.UPN = UPN;
     exports.URL = URL2;
-    exports.X509Certificate = X509Certificate5;
+    exports.X509Certificate = X509Certificate4;
     exports.X509CertificateGenerator = X509CertificateGenerator2;
     exports.X509Certificates = X509Certificates;
     exports.X509ChainBuilder = X509ChainBuilder;
@@ -24441,11 +24442,6 @@ function parseMockRedirect(rawUrl) {
   if (!isSingleSegment(token) || !isSingleSegment(digest)) return null;
   return { token, digest };
 }
-function supportedContentType(value) {
-  if (value === void 0) return false;
-  const mediaType = value.split(";", 1)[0]?.trim().toLowerCase() ?? "";
-  return mediaType === "application/json" || mediaType.startsWith("application/") && mediaType.endsWith("+json") || mediaType === "application/x-www-form-urlencoded" || mediaType.startsWith("text/");
-}
 var REGEX_WORKER_SOURCE = `
 const workerThreads =
   typeof process.getBuiltinModule === "function"
@@ -24603,6 +24599,11 @@ function runRegexReplace(text, pattern, replacement, deadlineMs) {
     }
   );
 }
+function supportedContentType(value) {
+  if (value === void 0) return false;
+  const mediaType = value.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+  return mediaType === "application/json" || mediaType.startsWith("application/") && mediaType.endsWith("+json") || mediaType === "application/x-www-form-urlencoded" || mediaType.startsWith("text/");
+}
 async function rewriteRequestBody(input, action, captureContext) {
   if (!supportedContentType(input.contentType)) {
     return failure("runtime.request-body-unsupported-mime-type");
@@ -24881,8 +24882,12 @@ async function rewriteResponseBody(input, replacements, replaceAction, captureCo
     for (const entry of replacements) {
       if (entry.pattern.length === 0 || entry.pattern.length > LIMITS.maxResponseBodyPatternLength || entry.replacement.length > LIMITS.maxResponseBodyReplacementLength)
         return failure("runtime.size-limit");
-      const regex = new RegExp(entry.pattern, "gu");
-      text = text.replace(regex, entry.replacement);
+      text = await runRegexReplace(
+        text,
+        entry.pattern,
+        entry.replacement,
+        RUNTIME_LIMITS.maxRegexDeadlineMs
+      );
       if (new TextEncoder().encode(text).byteLength > RUNTIME_LIMITS.maxResponseBodyBytes)
         return failure("runtime.size-limit");
     }
@@ -25131,6 +25136,133 @@ function forwardRequestHeaders(headers, host, contentLength) {
   }
   return out;
 }
+var defaultResolver2 = {
+  async lookup(hostname, signal) {
+    if (signal?.aborted) throw new Error("aborted");
+    const addresses = await dnsLookup2(hostname, { all: true });
+    return addresses.map((address) => ({
+      address: address.address,
+      family: address.family === 6 ? 6 : 4
+    }));
+  }
+};
+var defaultDial = (port, address) => connect(port, address);
+function localOriginsFromProject(project) {
+  if (project === null || typeof project !== "object") return [];
+  const policy = project.requestBodyPolicy;
+  if (policy === null || typeof policy !== "object") return [];
+  const origins = policy.localOrigins;
+  if (!Array.isArray(origins)) return [];
+  return origins.filter(
+    (origin) => typeof origin === "string"
+  );
+}
+function effectiveLocalOrigins(policy) {
+  if (policy === null) return /* @__PURE__ */ new Set();
+  const raw = policy.localOrigins ?? localOriginsFromProject(policy.project);
+  const origins = /* @__PURE__ */ new Set();
+  for (const origin of raw) {
+    const normalized = normalizeSiteOrigin(origin);
+    if (normalized !== null) origins.add(normalized);
+  }
+  return origins;
+}
+function compareAddresses(left, right) {
+  return left.family - right.family || (left.address < right.address ? -1 : left.address > right.address ? 1 : 0);
+}
+function selectPinnedAddress(addresses, allowNonPublic) {
+  const publicOnly = validateResolvedAddresses(
+    addresses,
+    RUNTIME_LIMITS.maxDnsAddresses
+  );
+  if (publicOnly !== null) return publicOnly[0] ?? null;
+  if (!allowNonPublic) return null;
+  if (addresses.length === 0 || addresses.length > RUNTIME_LIMITS.maxDnsAddresses) {
+    return null;
+  }
+  const checked = [];
+  for (const address of addresses) {
+    if (address.family !== 4 && address.family !== 6) return null;
+    const classification = classifyAddress(address.address);
+    if (classification === "invalid" || classification === "public") {
+      return null;
+    }
+    checked.push({ address: address.address, family: address.family });
+  }
+  checked.sort(compareAddresses);
+  return checked[0] ?? null;
+}
+async function pinHostname(hostname, origin, deps) {
+  if (hostname.length === 0) return null;
+  let resolved;
+  try {
+    resolved = await deps.resolver.lookup(hostname);
+  } catch {
+    return null;
+  }
+  const normalized = normalizeSiteOrigin(origin);
+  const allowNonPublic = normalized !== null && deps.localOrigins.has(normalized);
+  return selectPinnedAddress(resolved, allowNonPublic);
+}
+function httpUpstreamPort(target) {
+  if (target.protocol !== "http:") return null;
+  if (target.username.length > 0 || target.password.length > 0) return null;
+  if (target.port.length === 0 || target.port === "80") return 80;
+  return null;
+}
+function formatUpstreamRequest(method, path2, headers) {
+  const lines = [];
+  for (const [name, value] of Object.entries(headers)) {
+    if (name.includes("\r") || name.includes("\n") || value.includes("\r") || value.includes("\n")) {
+      return null;
+    }
+    lines.push(`${name}: ${value}`);
+  }
+  return `${method} ${path2} HTTP/1.1\r
+${lines.join("\r\n")}\r
+\r
+`;
+}
+function httpsOrigin(host) {
+  const authority = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+  try {
+    return new URL(`https://${authority}`).origin;
+  } catch {
+    return null;
+  }
+}
+function parseConnectAuthority(authority) {
+  if (authority.length === 0) return null;
+  let host;
+  let portText;
+  if (authority.startsWith("[")) {
+    const end = authority.indexOf("]");
+    if (end <= 1) return null;
+    host = authority.slice(1, end);
+    const rest = authority.slice(end + 1);
+    if (!rest.startsWith(":")) return null;
+    portText = rest.slice(1);
+  } else {
+    const colon = authority.lastIndexOf(":");
+    if (colon <= 0) return null;
+    host = authority.slice(0, colon);
+    portText = authority.slice(colon + 1);
+  }
+  if (host.length === 0 || !/^\d+$/.test(portText)) return null;
+  const port = Number(portText);
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+  return { host, port };
+}
+function endConnect(socket, status, reason) {
+  if (socket.destroyed || socket.writableEnded) return;
+  socket.end(
+    `HTTP/1.1 ${status} ${reason}\r
+Content-Length: 0\r
+Connection: close\r
+\r
+`
+  );
+}
 function pipeSockets(a, b) {
   a.pipe(b);
   b.pipe(a);
@@ -25143,11 +25275,16 @@ function pipeSockets(a, b) {
   a.on("close", () => b.destroy());
   b.on("close", () => a.destroy());
 }
-async function upstreamHttp(method, target, headers, body) {
-  const port = target.port ? Number(target.port) : 80;
+async function upstreamHttp(method, target, headers, body, deps) {
+  const port = httpUpstreamPort(target);
+  if (port === null) return { ok: false, status: 403 };
   const path2 = `${target.pathname}${target.search}`;
+  const head = formatUpstreamRequest(method, path2, headers);
+  if (head === null) return { ok: false, status: 403 };
+  const pinned = await pinHostname(target.hostname, target.origin, deps);
+  if (pinned === null) return { ok: false, status: 403 };
   return new Promise((resolve12, reject) => {
-    const socket = connect(port, target.hostname);
+    const socket = deps.dial(port, pinned.address);
     let buf = Buffer.alloc(0);
     let settled = false;
     const fail2 = (err) => {
@@ -25160,11 +25297,7 @@ async function upstreamHttp(method, target, headers, body) {
     socket.on("timeout", () => fail2(new Error("upstream timeout")));
     socket.on("error", (err) => fail2(err));
     socket.on("connect", () => {
-      const lines = Object.entries(headers).map(([k, v]) => `${k}: ${v}`).join("\r\n");
-      socket.write(`${method} ${path2} HTTP/1.1\r
-${lines}\r
-\r
-`);
+      socket.write(head);
       if (body.byteLength > 0) socket.write(body);
     });
     socket.on("data", (chunk) => {
@@ -25172,9 +25305,9 @@ ${lines}\r
       buf = Buffer.concat([buf, piece]);
       const sep = buf.indexOf("\r\n\r\n");
       if (sep < 0) return;
-      const head = buf.subarray(0, sep).toString("latin1");
+      const head2 = buf.subarray(0, sep).toString("latin1");
       const statusMatch = /^HTTP\/1\.[01] (\d+)(?: (.*))?/.exec(
-        head.split("\r\n")[0] ?? ""
+        head2.split("\r\n")[0] ?? ""
       );
       if (!statusMatch) {
         fail2(new Error("bad upstream status"));
@@ -25183,7 +25316,7 @@ ${lines}\r
       const status = Number(statusMatch[1]);
       const statusMessage = statusMatch[2]?.trim() ?? "";
       const headerMap = {};
-      for (const line of head.split("\r\n").slice(1)) {
+      for (const line of head2.split("\r\n").slice(1)) {
         const i = line.indexOf(":");
         if (i <= 0) continue;
         const name = line.slice(0, i).trim().toLowerCase();
@@ -25203,6 +25336,7 @@ ${lines}\r
         settled = true;
         socket.destroy();
         resolve12({
+          ok: true,
           status,
           statusMessage,
           headers: headerMap,
@@ -25218,16 +25352,16 @@ ${lines}\r
         fail2(new Error("upstream closed early"));
         return;
       }
-      const head = buf.subarray(0, sep).toString("latin1");
+      const head2 = buf.subarray(0, sep).toString("latin1");
       const statusMatch = /^HTTP\/1\.[01] (\d+)(?: (.*))?/.exec(
-        head.split("\r\n")[0] ?? ""
+        head2.split("\r\n")[0] ?? ""
       );
       if (!statusMatch) {
         fail2(new Error("bad upstream status"));
         return;
       }
       const headerMap = {};
-      for (const line of head.split("\r\n").slice(1)) {
+      for (const line of head2.split("\r\n").slice(1)) {
         const i = line.indexOf(":");
         if (i <= 0) continue;
         headerMap[line.slice(0, i).trim().toLowerCase()] = line.slice(i + 1).trim();
@@ -25242,6 +25376,7 @@ ${lines}\r
       }
       settled = true;
       resolve12({
+        ok: true,
         status: Number(statusMatch[1]),
         statusMessage: statusMatch[2]?.trim() ?? "",
         headers: headerMap,
@@ -25317,6 +25452,8 @@ function authorizeOp(policy, op, url, method, headers) {
 async function startInterceptProxy(options = {}) {
   let policy = options.policy ?? null;
   const serveMock = options.serveMock;
+  const resolver = options.resolver ?? defaultResolver2;
+  const dial = options.dial ?? defaultDial;
   let activeMocks = 0;
   const mockAborts = /* @__PURE__ */ new Set();
   let stopped = false;
@@ -25411,8 +25548,24 @@ async function startInterceptProxy(options = {}) {
         method,
         target,
         forwardHeaders,
-        requestBody
+        requestBody,
+        {
+          resolver,
+          dial,
+          localOrigins: effectiveLocalOrigins(active)
+        }
       );
+      if (!upstream.ok) {
+        if (!res.headersSent) {
+          res.writeHead(upstream.status, {
+            "cache-control": "no-store",
+            "content-length": "0",
+            connection: "close"
+          });
+          res.end();
+        }
+        return;
+      }
       let responseBody = upstream.body;
       if (responseOp !== null && active !== null) {
         if (responseBody.byteLength > RUNTIME_LIMITS.maxResponseBodyBytes) {
@@ -25608,25 +25761,52 @@ async function startInterceptProxy(options = {}) {
     );
   }
   function handleConnect(req, clientSocket, head) {
-    const authority = req.url ?? "";
-    const [host, portText] = authority.split(":");
-    const port = Number(portText);
-    if (!host || !Number.isInteger(port) || port <= 0) {
-      clientSocket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
-      clientSocket.destroy();
+    void tunnelConnect(req, clientSocket, head);
+  }
+  async function tunnelConnect(req, clientSocket, head) {
+    let upstream;
+    clientSocket.on("error", () => upstream?.destroy());
+    const parsed = parseConnectAuthority(req.url ?? "");
+    if (parsed === null) {
+      endConnect(clientSocket, 400, "Bad Request");
+      return;
+    }
+    if (parsed.port !== 443) {
+      endConnect(clientSocket, 403, "Forbidden");
       return;
     }
-    const upstream = connect(port, host);
-    upstream.on("connect", () => {
+    const pinned = await pinHostname(
+      parsed.host,
+      httpsOrigin(parsed.host) ?? "",
+      {
+        resolver,
+        dial,
+        localOrigins: effectiveLocalOrigins(policy)
+      }
+    );
+    if (pinned === null || clientSocket.destroyed) {
+      endConnect(clientSocket, 403, "Forbidden");
+      return;
+    }
+    let upstreamSocket;
+    try {
+      upstreamSocket = dial(443, pinned.address);
+    } catch {
+      endConnect(clientSocket, 502, "Bad Gateway");
+      return;
+    }
+    upstream = upstreamSocket;
+    upstreamSocket.on("connect", () => {
       clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
-      if (head.byteLength > 0) upstream.write(head);
-      pipeSockets(clientSocket, upstream);
+      if (head.byteLength > 0) upstreamSocket.write(head);
+      pipeSockets(clientSocket, upstreamSocket);
     });
-    upstream.on("error", () => {
-      clientSocket.write("HTTP/1.1 502 Bad Gateway\r\n\r\n");
-      clientSocket.destroy();
+    upstreamSocket.on("error", () => {
+      if (!clientSocket.destroyed && !clientSocket.writableEnded) {
+        endConnect(clientSocket, 502, "Bad Gateway");
+      }
+      upstreamSocket.destroy();
     });
-    clientSocket.on("error", () => upstream.destroy());
   }
   const endpoint = await new Promise((resolve12, reject) => {
     server.once("error", reject);
@@ -25677,7 +25857,10 @@ async function startInterception(activation, policyDigest, extensionId, pacRoute
   const sessionId = `session-${activation.startedAt}-${Math.random().toString(36).slice(2)}`;
   let proxy;
   try {
-    const started = await registeredProvider.start(activation);
+    const started = await registeredProvider.start({
+      ...activation,
+      localOrigins: targetPolicy.localOrigins
+    });
     if (started && typeof started === "object" && typeof started.host === "string" && typeof started.port === "number") {
       proxy = started;
     } else if (activation.proxy) {
@@ -27414,6 +27597,25 @@ function createNativeHost(options) {
     ...options.clock ? { clock: options.clock } : {}
   });
   let interceptProxy = null;
+  function policyForProxy(activation) {
+    const policy = controller.getActivePolicy();
+    if (!policy) return null;
+    const fromProject = localOriginsFromProject(policy.project);
+    const fromSession = activation.localOrigins ?? [];
+    const localOrigins = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const origin of [...fromProject, ...fromSession]) {
+      if (seen.has(origin)) continue;
+      seen.add(origin);
+      localOrigins.push(origin);
+    }
+    return {
+      project: policy.project,
+      operations: policy.operations,
+      presetDigest: policy.presetDigest,
+      localOrigins
+    };
+  }
   let outboundWrite = null;
   let hostRequestCounter = 0;
   const pendingHost = /* @__PURE__ */ new Map();
@@ -27482,18 +27684,13 @@ function createNativeHost(options) {
       } catch {
       }
     },
-    async startTlsProxy() {
+    async startTlsProxy(activation) {
       if (interceptProxy) {
         await interceptProxy.stop();
         interceptProxy = null;
       }
-      const policy = controller.getActivePolicy();
       interceptProxy = await startInterceptProxy({
-        policy: policy ? {
-          project: policy.project,
-          operations: policy.operations,
-          presetDigest: policy.presetDigest
-        } : null,
+        policy: policyForProxy(activation),
         serveMock: (request) => controller.serveMock(request.token, {
           method: request.method,
           signal: request.signal
@@ -27516,14 +27713,7 @@ function createNativeHost(options) {
     async start(activation) {
       const routes = pendingRoutes.length > 0 ? pendingRoutes : activation.pacRoutes;
       const endpoint = await platformProvider.start(activation, routes);
-      const policy = controller.getActivePolicy();
-      interceptProxy?.setPolicy(
-        policy ? {
-          project: policy.project,
-          operations: policy.operations,
-          presetDigest: policy.presetDigest
-        } : null
-      );
+      interceptProxy?.setPolicy(policyForProxy(activation));
       return endpoint;
     },
     async stop() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "6.16.2",
+  "version": "6.16.4",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",