@rulemetric/cli 0.6.9 → 0.7.1

package/dist/chunk-7LVVKQMZ.js

@@ -0,0 +1,98 @@
+// src/lib/gateway-identity.ts
+import { execFileSync } from "node:child_process";
+import * as http from "node:http";
+var GATEWAY_IDENTITY_PATH = "/__rulemetric_gateway__";
+var GATEWAY_IDENTITY_SERVICE = "rulemetric-gateway";
+var MAX_IDENTITY_BODY_BYTES = 4096;
+function probeGatewayIdentity(port, timeoutMs = 1500) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      resolve(result);
+    };
+    const req = http.get(
+      { host: "127.0.0.1", port, path: GATEWAY_IDENTITY_PATH, timeout: timeoutMs },
+      (res) => {
+        let body = "";
+        res.setEncoding("utf-8");
+        res.on("data", (chunk) => {
+          body += chunk;
+          if (body.length > MAX_IDENTITY_BODY_BYTES) {
+            req.destroy();
+            finish({ status: "foreign", detail: "oversized identity response" });
+          }
+        });
+        res.on("end", () => {
+          if (res.statusCode === 200) {
+            try {
+              const parsed = JSON.parse(body);
+              if (parsed?.service === GATEWAY_IDENTITY_SERVICE) {
+                finish({
+                  status: "ours-live",
+                  version: typeof parsed.version === "string" ? parsed.version : null,
+                  pid: typeof parsed.pid === "number" ? parsed.pid : null
+                });
+                return;
+              }
+            } catch {
+            }
+          }
+          finish({ status: "foreign", detail: `HTTP ${res.statusCode ?? "?"} without identity marker` });
+        });
+        res.on("error", () => finish({ status: "foreign", detail: "response stream error" }));
+      }
+    );
+    req.on("timeout", () => {
+      req.destroy();
+      finish({ status: "foreign", detail: "accepted TCP but no identity response (timeout)" });
+    });
+    req.on("error", (err) => {
+      const code = err.code;
+      if (code === "ECONNREFUSED") {
+        finish({ status: "dead" });
+      } else {
+        finish({ status: "foreign", detail: `socket error ${code ?? err.message}` });
+      }
+    });
+  });
+}
+async function waitForGatewayIdentity(port, { timeoutMs = 3e3, intervalMs = 150 } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    const identity = await probeGatewayIdentity(port, Math.min(1500, timeoutMs));
+    if (identity.status !== "dead") return identity;
+    if (Date.now() >= deadline) return identity;
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+}
+function runLsofDefault(port) {
+  try {
+    return execFileSync("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], {
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return null;
+  }
+}
+function describePortOwner(port, opts = {}) {
+  const output = (opts.runLsof ?? runLsofDefault)(port);
+  if (!output) return null;
+  const rows = output.split("\n").filter((line) => line.trim().length > 0);
+  const dataRow = rows.find((line) => !/^COMMAND\s/.test(line));
+  if (!dataRow) return null;
+  const [command, pid] = dataRow.trim().split(/\s+/);
+  if (!command) return null;
+  return pid ? `${command} (PID ${pid})` : command;
+}
+
+export {
+  GATEWAY_IDENTITY_PATH,
+  GATEWAY_IDENTITY_SERVICE,
+  probeGatewayIdentity,
+  waitForGatewayIdentity,
+  describePortOwner
+};
+//# sourceMappingURL=chunk-7LVVKQMZ.js.map

package/dist/chunk-7LVVKQMZ.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/gateway-identity.ts"],
+  "sourcesContent": ["/**\n * Gateway identity handshake \u2014 distinguishes OUR gateway from a foreign\n * process squatting on :8787.\n *\n * A bare TCP-accept probe cannot tell the difference, and pinning Claude\n * Code's HTTPS_PROXY at a port owned by some other app breaks ALL of its\n * HTTPS (the worst client-side failure we have). The gateway serves a JSON\n * marker at GATEWAY_IDENTITY_PATH; this module probes it and classifies the\n * port as ours-live / foreign / dead. HTTPS_PROXY may only be pinned on\n * ours-live.\n *\n * Kept free of oclif so gateway-entry (a standalone Node process) can import it.\n */\nimport { execFileSync } from 'node:child_process';\nimport * as http from 'node:http';\n\nexport const GATEWAY_IDENTITY_PATH = '/__rulemetric_gateway__';\nexport const GATEWAY_IDENTITY_SERVICE = 'rulemetric-gateway';\n// The probe reads at most this much of a response \u2014 a foreign server could\n// stream forever on an unknown path.\nconst MAX_IDENTITY_BODY_BYTES = 4096;\n\nexport type GatewayIdentity =\n  /** The port answered with our JSON marker \u2014 safe to pin HTTPS_PROXY. */\n  | { status: 'ours-live'; version: string | null; pid: number | null }\n  /** Something accepts connections but is NOT our gateway \u2014 never pin. */\n  | { status: 'foreign'; detail: string }\n  /** Nothing is listening \u2014 safe to spawn a gateway, unsafe to pin. */\n  | { status: 'dead' };\n\n/**\n * One-shot identity probe against 127.0.0.1:<port>. Connects directly\n * (node:http ignores HTTPS_PROXY env), requests the identity path, and\n * verifies the marker. Anything that accepts TCP but fails the handshake \u2014\n * wrong body, non-JSON, hang, mid-request reset \u2014 is classified foreign:\n * the conservative direction, since foreign means \"do not pin\".\n */\nexport function probeGatewayIdentity(port: number, timeoutMs = 1500): Promise<GatewayIdentity> {\n  return new Promise((resolve) => {\n    let settled = false;\n    const finish = (result: GatewayIdentity) => {\n      if (settled) return;\n      settled = true;\n      resolve(result);\n    };\n\n    const req = http.get(\n      { host: '127.0.0.1', port, path: GATEWAY_IDENTITY_PATH, timeout: timeoutMs },\n      (res) => {\n        let body = '';\n        res.setEncoding('utf-8');\n        res.on('data', (chunk: string) => {\n          body += chunk;\n          if (body.length > MAX_IDENTITY_BODY_BYTES) {\n            req.destroy();\n            finish({ status: 'foreign', detail: 'oversized identity response' });\n          }\n        });\n        res.on('end', () => {\n          if (res.statusCode === 200) {\n            try {\n              const parsed = JSON.parse(body) as { service?: unknown; version?: unknown; pid?: unknown };\n              if (parsed?.service === GATEWAY_IDENTITY_SERVICE) {\n                finish({\n                  status: 'ours-live',\n                  version: typeof parsed.version === 'string' ? parsed.version : null,\n                  pid: typeof parsed.pid === 'number' ? parsed.pid : null,\n                });\n                return;\n              }\n            } catch {\n              /* not our JSON \u2014 fall through to foreign */\n            }\n          }\n          finish({ status: 'foreign', detail: `HTTP ${res.statusCode ?? '?'} without identity marker` });\n        });\n        res.on('error', () => finish({ status: 'foreign', detail: 'response stream error' }));\n      },\n    );\n\n    req.on('timeout', () => {\n      // The connection was accepted but nothing answered the handshake in\n      // time \u2014 on loopback that is a listener that isn't our gateway.\n      req.destroy();\n      finish({ status: 'foreign', detail: 'accepted TCP but no identity response (timeout)' });\n    });\n    req.on('error', (err) => {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code === 'ECONNREFUSED') {\n        finish({ status: 'dead' });\n      } else {\n        // Accepted-then-reset (e.g. a TLS-only listener) and anything else\n        // that isn't a clean refusal means SOMETHING owns the port.\n        finish({ status: 'foreign', detail: `socket error ${code ?? err.message}` });\n      }\n    });\n  });\n}\n\n/**\n * Poll probeGatewayIdentity() until it resolves to a terminal state or the\n * window elapses. 'dead' is the only retryable state (a just-spawned gateway\n * needs a moment to bind); 'ours-live' and 'foreign' can't change by waiting.\n */\nexport async function waitForGatewayIdentity(\n  port: number,\n  { timeoutMs = 3000, intervalMs = 150 }: { timeoutMs?: number; intervalMs?: number } = {},\n): Promise<GatewayIdentity> {\n  const deadline = Date.now() + timeoutMs;\n  for (;;) {\n    const identity = await probeGatewayIdentity(port, Math.min(1500, timeoutMs));\n    if (identity.status !== 'dead') return identity;\n    if (Date.now() >= deadline) return identity;\n    await new Promise((resolve) => setTimeout(resolve, intervalMs));\n  }\n}\n\nexport interface DescribePortOwnerOptions {\n  /** Override the `lsof` exec. Return raw lsof output, or null on failure. Used in tests. */\n  runLsof?: (port: number) => string | null;\n}\n\nfunction runLsofDefault(port: number): string | null {\n  try {\n    return execFileSync('lsof', ['-nP', `-iTCP:${port}`, '-sTCP:LISTEN'], {\n      encoding: 'utf-8',\n      stdio: ['ignore', 'pipe', 'ignore'],\n    });\n  } catch {\n    // lsof missing (some Linuxes) or no permission \u2014 the caller degrades to a\n    // generic \"something else holds the port\" message.\n    return null;\n  }\n}\n\n/**\n * Best-effort \"what is holding this port\" description for user-facing\n * messages, e.g. `dev-server (PID 4242)`. Returns null when it can't tell.\n */\nexport function describePortOwner(port: number, opts: DescribePortOwnerOptions = {}): string | null {\n  const output = (opts.runLsof ?? runLsofDefault)(port);\n  if (!output) return null;\n  // lsof output: header line, then `COMMAND PID USER ...` rows.\n  const rows = output.split('\\n').filter((line) => line.trim().length > 0);\n  const dataRow = rows.find((line) => !/^COMMAND\\s/.test(line));\n  if (!dataRow) return null;\n  const [command, pid] = dataRow.trim().split(/\\s+/);\n  if (!command) return null;\n  return pid ? `${command} (PID ${pid})` : command;\n}\n"],
+  "mappings": ";AAaA,SAAS,oBAAoB;AAC7B,YAAY,UAAU;AAEf,IAAM,wBAAwB;AAC9B,IAAM,2BAA2B;AAGxC,IAAM,0BAA0B;AAiBzB,SAAS,qBAAqB,MAAc,YAAY,MAAgC;AAC7F,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,UAAU;AACd,UAAM,SAAS,CAAC,WAA4B;AAC1C,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ,MAAM;AAAA,IAChB;AAEA,UAAM,MAAW;AAAA,MACf,EAAE,MAAM,aAAa,MAAM,MAAM,uBAAuB,SAAS,UAAU;AAAA,MAC3E,CAAC,QAAQ;AACP,YAAI,OAAO;AACX,YAAI,YAAY,OAAO;AACvB,YAAI,GAAG,QAAQ,CAAC,UAAkB;AAChC,kBAAQ;AACR,cAAI,KAAK,SAAS,yBAAyB;AACzC,gBAAI,QAAQ;AACZ,mBAAO,EAAE,QAAQ,WAAW,QAAQ,8BAA8B,CAAC;AAAA,UACrE;AAAA,QACF,CAAC;AACD,YAAI,GAAG,OAAO,MAAM;AAClB,cAAI,IAAI,eAAe,KAAK;AAC1B,gBAAI;AACF,oBAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,kBAAI,QAAQ,YAAY,0BAA0B;AAChD,uBAAO;AAAA,kBACL,QAAQ;AAAA,kBACR,SAAS,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AAAA,kBAC/D,KAAK,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAAA,gBACrD,CAAC;AACD;AAAA,cACF;AAAA,YACF,QAAQ;AAAA,YAER;AAAA,UACF;AACA,iBAAO,EAAE,QAAQ,WAAW,QAAQ,QAAQ,IAAI,cAAc,GAAG,2BAA2B,CAAC;AAAA,QAC/F,CAAC;AACD,YAAI,GAAG,SAAS,MAAM,OAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAwB,CAAC,CAAC;AAAA,MACtF;AAAA,IACF;AAEA,QAAI,GAAG,WAAW,MAAM;AAGtB,UAAI,QAAQ;AACZ,aAAO,EAAE,QAAQ,WAAW,QAAQ,kDAAkD,CAAC;AAAA,IACzF,CAAC;AACD,QAAI,GAAG,SAAS,CAAC,QAAQ;AACvB,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,gBAAgB;AAC3B,eAAO,EAAE,QAAQ,OAAO,CAAC;AAAA,MAC3B,OAAO;AAGL,eAAO,EAAE,QAAQ,WAAW,QAAQ,gBAAgB,QAAQ,IAAI,OAAO,GAAG,CAAC;AAAA,MAC7E;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACH;AAOA,eAAsB,uBACpB,MACA,EAAE,YAAY,KAAM,aAAa,IAAI,IAAiD,CAAC,GAC7D;AAC1B,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,aAAS;AACP,UAAM,WAAW,MAAM,qBAAqB,MAAM,KAAK,IAAI,MAAM,SAAS,CAAC;AAC3E,QAAI,SAAS,WAAW,OAAQ,QAAO;AACvC,QAAI,KAAK,IAAI,KAAK,SAAU,QAAO;AACnC,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,UAAU,CAAC;AAAA,EAChE;AACF;AAOA,SAAS,eAAe,MAA6B;AACnD,MAAI;AACF,WAAO,aAAa,QAAQ,CAAC,OAAO,SAAS,IAAI,IAAI,cAAc,GAAG;AAAA,MACpE,UAAU;AAAA,MACV,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IACpC,CAAC;AAAA,EACH,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,kBAAkB,MAAc,OAAiC,CAAC,GAAkB;AAClG,QAAM,UAAU,KAAK,WAAW,gBAAgB,IAAI;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,OAAO,OAAO,MAAM,IAAI,EAAE,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,SAAS,CAAC;AACvE,QAAM,UAAU,KAAK,KAAK,CAAC,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC;AAC5D,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,CAAC,SAAS,GAAG,IAAI,QAAQ,KAAK,EAAE,MAAM,KAAK;AACjD,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,MAAM,GAAG,OAAO,SAAS,GAAG,MAAM;AAC3C;",
+  "names": []
+}

package/dist/{chunk-PXVQLD7S.js → chunk-7NNFYWKK.js}

@@ -1,3 +1,11 @@
+import {
+  MitmproxyRespawnMonitor
+} from "./chunk-ILYDELUE.js";
+import {
+  GATEWAY_IDENTITY_PATH,
+  GATEWAY_IDENTITY_SERVICE
+} from "./chunk-7LVVKQMZ.js";
+
 // src/lib/gateway.ts
 import { spawn } from "node:child_process";
 import * as fs from "node:fs";
@@ -11,9 +19,12 @@ var HEALTH_INTERVAL = 3e3;
 var HEALTH_TIMEOUT = 500;
 var RESTART_COOLDOWN_MS = 6e4;
 var VERSION_FILE = path.join(os.homedir(), ".config", "rulemetric", "proxy-addon.version");
+var PROXY_PID_FILE = path.join(os.homedir(), ".config", "rulemetric", "proxy.pid");
 var isProxyAlive = false;
 var lastSeenAddonVersion = null;
 var lastRestartAt = 0;
+var identityVersion = "unknown";
+var respawnMonitor = null;
 function log(msg) {
   const ts = (/* @__PURE__ */ new Date()).toISOString();
   console.log(`[${ts}] ${msg}`);
@@ -46,14 +57,31 @@ function maybeRestartOnDrift(gatewayCliVersion, cliEntry) {
     `addon version drift detected (gateway=${gatewayCliVersion}, addon=${addonVersion}). Restarting proxy to pick up latest code.`
   );
   lastRestartAt = Date.now();
+  spawnProxyRestart(cliEntry);
+}
+function spawnProxyRestart(cliEntry) {
+  if (!cliEntry) {
+    log("cannot restart proxy: no CLI entry recorded (RULEMETRIC_CLI_ENTRY unset)");
+    return false;
+  }
   try {
     const child = spawn(process.execPath, [cliEntry, "proxy", "restart"], {
       detached: true,
       stdio: "ignore"
     });
     child.unref();
+    return true;
   } catch (err) {
     log(`restart spawn failed: ${err.message}`);
+    return false;
+  }
+}
+function proxyCrashEvidence() {
+  try {
+    const content = fs.readFileSync(PROXY_PID_FILE, "utf-8").trim();
+    return /^\d+$/.test(content);
+  } catch {
+    return false;
   }
 }
 function checkProxyHealth(mitmproxyPort) {
@@ -64,12 +92,14 @@ function checkProxyHealth(mitmproxyPort) {
       isProxyAlive = true;
       log(`mitmproxy up on :${mitmproxyPort}, routing through proxy`);
     }
+    respawnMonitor?.onHealthCheck(true);
   });
   sock.on("error", () => {
     if (isProxyAlive) {
       isProxyAlive = false;
       log(`mitmproxy down on :${mitmproxyPort}, routing direct`);
     }
+    respawnMonitor?.onHealthCheck(false);
   });
   sock.on("timeout", () => {
     sock.destroy();
@@ -77,6 +107,7 @@ function checkProxyHealth(mitmproxyPort) {
       isProxyAlive = false;
       log(`mitmproxy timeout on :${mitmproxyPort}, routing direct`);
     }
+    respawnMonitor?.onHealthCheck(false);
   });
 }
 function handleConnect(req, clientSocket, head, mitmproxyPort) {
@@ -133,6 +164,16 @@ function connectDirect(req, clientSocket, head, targetHost, targetPort) {
   });
 }
 function handleRequest(req, res, mitmproxyPort) {
+  if (req.url === GATEWAY_IDENTITY_PATH) {
+    res.writeHead(200, { "content-type": "application/json" });
+    res.end(JSON.stringify({
+      service: GATEWAY_IDENTITY_SERVICE,
+      version: identityVersion,
+      pid: process.pid,
+      mitmproxyAlive: isProxyAlive
+    }));
+    return;
+  }
   const targetUrl = req.url ?? "";
   let parsedUrl;
   try {
@@ -163,6 +204,12 @@ function handleRequest(req, res, mitmproxyPort) {
 function startGateway(port = GATEWAY_PORT, mitmproxyPort = MITMPROXY_PORT, options = {}) {
   const cliVersion = options.cliVersion ?? process.env.RULEMETRIC_CLI_VERSION ?? "unknown";
   const cliEntry = options.cliEntry ?? process.env.RULEMETRIC_CLI_ENTRY ?? null;
+  identityVersion = cliVersion;
+  respawnMonitor = new MitmproxyRespawnMonitor({
+    hasCrashEvidence: proxyCrashEvidence,
+    respawn: () => spawnProxyRestart(cliEntry),
+    log
+  });
   const server = http.createServer((req, res) => {
     handleRequest(req, res, mitmproxyPort);
   });
@@ -193,4 +240,4 @@ export {
   MITMPROXY_PORT,
   startGateway
 };
-//# sourceMappingURL=chunk-PXVQLD7S.js.map
+//# sourceMappingURL=chunk-7NNFYWKK.js.map

package/dist/chunk-7NNFYWKK.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/gateway.ts"],
+  "sourcesContent": ["/**\n * Resilient HTTP proxy gateway that always accepts connections on GATEWAY_PORT.\n * Routes through mitmproxy when it's alive, direct to upstream when it's not.\n */\nimport { spawn } from 'node:child_process';\nimport * as fs from 'node:fs';\nimport * as http from 'node:http';\nimport * as net from 'node:net';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { GATEWAY_IDENTITY_PATH, GATEWAY_IDENTITY_SERVICE } from './gateway-identity.js';\nimport { MitmproxyRespawnMonitor } from './proxy-respawn.js';\n\nexport const GATEWAY_PORT = 8787;\nexport const MITMPROXY_PORT = 8788;\nconst HEALTH_INTERVAL = 3000;\nconst HEALTH_TIMEOUT = 500;\n// Floor on auto-restarts so a misconfigured drift can't trigger a restart\n// loop. Plenty long for the user to fix any underlying problem manually.\nconst RESTART_COOLDOWN_MS = 60_000;\nconst VERSION_FILE = path.join(os.homedir(), '.config', 'rulemetric', 'proxy-addon.version');\n// Crash evidence for the mitmproxy auto-restart: `proxy stop` removes this\n// file, a crash leaves it behind.\nconst PROXY_PID_FILE = path.join(os.homedir(), '.config', 'rulemetric', 'proxy.pid');\n\nlet isProxyAlive = false;\nlet lastState: boolean | null = null;\n// Drift state \u2014 tracked across health-check ticks. lastSeenAddonVersion is\n// what the file said last time we read it; lastRestartAt prevents loops.\nlet lastSeenAddonVersion: string | null = null;\nlet lastRestartAt = 0;\n// Set by startGateway; served on the identity endpoint so callers can verify\n// the thing on :8787 is actually us (and which build).\nlet identityVersion = 'unknown';\n// Mid-session mitmproxy crash recovery \u2014 constructed in startGateway.\nlet respawnMonitor: MitmproxyRespawnMonitor | null = null;\n\nfunction log(msg: string): void {\n  const ts = new Date().toISOString();\n  console.log(`[${ts}] ${msg}`);\n}\n\nfunction readAddonVersion(): string | null {\n  try {\n    return fs.readFileSync(VERSION_FILE, 'utf-8').trim() || null;\n  } catch {\n    // File may not exist yet (proxy not started, or older addon that doesn't\n    // write the file). Returning null disables drift checks for this tick.\n    return null;\n  }\n}\n\nfunction maybeRestartOnDrift(gatewayCliVersion: string, cliEntry: string | null): void {\n  // No reference version means we can't compare \u2014 skip.\n  if (gatewayCliVersion === 'unknown' || !cliEntry) return;\n  const addonVersion = readAddonVersion();\n  if (!addonVersion || addonVersion === 'unknown') return;\n  // Same as last tick \u2014 nothing changed, no need to log or act.\n  if (addonVersion === lastSeenAddonVersion) return;\n  lastSeenAddonVersion = addonVersion;\n\n  if (addonVersion === gatewayCliVersion) {\n    // Drift cleared (e.g. proxy was just restarted). Quiet log, no action.\n    log(`addon version matches gateway (${gatewayCliVersion})`);\n    return;\n  }\n\n  const sinceLast = Date.now() - lastRestartAt;\n  if (sinceLast < RESTART_COOLDOWN_MS) {\n    log(\n      `addon version drift (gateway=${gatewayCliVersion}, addon=${addonVersion}); ` +\n      `restart cooldown active (${Math.round((RESTART_COOLDOWN_MS - sinceLast) / 1000)}s left)`,\n    );\n    return;\n  }\n\n  log(\n    `addon version drift detected (gateway=${gatewayCliVersion}, addon=${addonVersion}). ` +\n    `Restarting proxy to pick up latest code.`,\n  );\n  lastRestartAt = Date.now();\n  spawnProxyRestart(cliEntry);\n}\n\n/**\n * Fire one detached `rulemetric proxy restart` via the CLI entry the spawning\n * process recorded. Shared by the version-drift restart and the mid-session\n * crash auto-restart. Output goes to /dev/null; the proxy.log captures the\n * restart events from mitmproxy itself.\n */\nfunction spawnProxyRestart(cliEntry: string | null): boolean {\n  if (!cliEntry) {\n    log('cannot restart proxy: no CLI entry recorded (RULEMETRIC_CLI_ENTRY unset)');\n    return false;\n  }\n  try {\n    const child = spawn(process.execPath, [cliEntry, 'proxy', 'restart'], {\n      detached: true,\n      stdio: 'ignore',\n    });\n    child.unref();\n    return true;\n  } catch (err) {\n    log(`restart spawn failed: ${(err as Error).message}`);\n    return false;\n  }\n}\n\n/**\n * True when the local proxy.pid file says a local-mode mitmproxy SHOULD be\n * running (numeric PID). `proxy stop` deletes the file, so its absence means\n * a deliberate stop \u2014 never auto-restart over that. A `docker:` marker means\n * Docker owns the lifecycle.\n */\nfunction proxyCrashEvidence(): boolean {\n  try {\n    const content = fs.readFileSync(PROXY_PID_FILE, 'utf-8').trim();\n    return /^\\d+$/.test(content);\n  } catch {\n    return false;\n  }\n}\n\nfunction checkProxyHealth(mitmproxyPort: number): void {\n  const sock = net.connect({ port: mitmproxyPort, timeout: HEALTH_TIMEOUT });\n  sock.on('connect', () => {\n    sock.destroy();\n    if (!isProxyAlive) {\n      isProxyAlive = true;\n      log(`mitmproxy up on :${mitmproxyPort}, routing through proxy`);\n    }\n    respawnMonitor?.onHealthCheck(true);\n  });\n  sock.on('error', () => {\n    if (isProxyAlive) {\n      isProxyAlive = false;\n      log(`mitmproxy down on :${mitmproxyPort}, routing direct`);\n    }\n    respawnMonitor?.onHealthCheck(false);\n  });\n  sock.on('timeout', () => {\n    sock.destroy();\n    if (isProxyAlive) {\n      isProxyAlive = false;\n      log(`mitmproxy timeout on :${mitmproxyPort}, routing direct`);\n    }\n    respawnMonitor?.onHealthCheck(false);\n  });\n}\n\nfunction handleConnect(\n  req: http.IncomingMessage,\n  clientSocket: net.Socket,\n  head: Buffer,\n  mitmproxyPort: number,\n): void {\n  const [targetHost, targetPortStr] = (req.url ?? '').split(':');\n  const targetPort = parseInt(targetPortStr, 10) || 443;\n\n  if (isProxyAlive) {\n    // Forward CONNECT to mitmproxy\n    const proxySocket = net.connect({ port: mitmproxyPort, host: '127.0.0.1' });\n\n    proxySocket.on('connect', () => {\n      // Send the CONNECT request to mitmproxy\n      proxySocket.write(\n        `CONNECT ${req.url} HTTP/1.1\\r\\nHost: ${req.url}\\r\\n\\r\\n`,\n      );\n    });\n\n    // Wait for mitmproxy's 200 response before piping\n    let responseBuffer = Buffer.alloc(0);\n    const onData = (chunk: Buffer) => {\n      responseBuffer = Buffer.concat([responseBuffer, chunk]);\n      const responseStr = responseBuffer.toString();\n      if (responseStr.includes('\\r\\n\\r\\n')) {\n        proxySocket.removeListener('data', onData);\n        // Forward the 200 to client\n        clientSocket.write('HTTP/1.1 200 Connection Established\\r\\n\\r\\n');\n        // Pipe remaining data and head\n        if (head.length > 0) proxySocket.write(head);\n        clientSocket.pipe(proxySocket);\n        proxySocket.pipe(clientSocket);\n      }\n    };\n    proxySocket.on('data', onData);\n\n    proxySocket.on('error', (err) => {\n      log(`proxy socket error for ${req.url}: ${err.message}, falling back to direct`);\n      // Mitmproxy failed mid-connect, fall back to direct\n      connectDirect(req, clientSocket, head, targetHost, targetPort);\n    });\n\n    clientSocket.on('error', () => {\n      proxySocket.destroy();\n    });\n  } else {\n    connectDirect(req, clientSocket, head, targetHost, targetPort);\n  }\n}\n\nfunction connectDirect(\n  req: http.IncomingMessage,\n  clientSocket: net.Socket,\n  head: Buffer,\n  targetHost: string,\n  targetPort: number,\n): void {\n  const upstream = net.connect({ port: targetPort, host: targetHost });\n\n  upstream.on('connect', () => {\n    clientSocket.write('HTTP/1.1 200 Connection Established\\r\\n\\r\\n');\n    if (head.length > 0) upstream.write(head);\n    clientSocket.pipe(upstream);\n    upstream.pipe(clientSocket);\n  });\n\n  upstream.on('error', (err) => {\n    log(`upstream error for ${req.url}: ${err.message}`);\n    clientSocket.end('HTTP/1.1 502 Bad Gateway\\r\\n\\r\\n');\n  });\n\n  clientSocket.on('error', () => {\n    upstream.destroy();\n  });\n}\n\nfunction handleRequest(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  mitmproxyPort: number,\n): void {\n  // Identity handshake (origin-form GET, not a proxy request): lets callers\n  // distinguish OUR gateway from a foreign process squatting on the port \u2014\n  // the gate for pinning HTTPS_PROXY and for idempotent double-spawns.\n  if (req.url === GATEWAY_IDENTITY_PATH) {\n    res.writeHead(200, { 'content-type': 'application/json' });\n    res.end(JSON.stringify({\n      service: GATEWAY_IDENTITY_SERVICE,\n      version: identityVersion,\n      pid: process.pid,\n      mitmproxyAlive: isProxyAlive,\n    }));\n    return;\n  }\n\n  // Plain HTTP proxy (non-CONNECT)\n  const targetUrl = req.url ?? '';\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(targetUrl);\n  } catch {\n    res.writeHead(400);\n    res.end('Bad Request');\n    return;\n  }\n\n  const options: http.RequestOptions = {\n    hostname: isProxyAlive ? '127.0.0.1' : parsedUrl.hostname,\n    port: isProxyAlive ? mitmproxyPort : (parseInt(parsedUrl.port, 10) || 80),\n    path: isProxyAlive ? targetUrl : parsedUrl.pathname + parsedUrl.search,\n    method: req.method,\n    headers: req.headers,\n  };\n\n  const proxyReq = http.request(options, (proxyRes) => {\n    res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);\n    proxyRes.pipe(res);\n  });\n\n  proxyReq.on('error', (err) => {\n    log(`HTTP proxy error for ${targetUrl}: ${err.message}`);\n    res.writeHead(502);\n    res.end('Bad Gateway');\n  });\n\n  req.pipe(proxyReq);\n}\n\nexport function startGateway(\n  port: number = GATEWAY_PORT,\n  mitmproxyPort: number = MITMPROXY_PORT,\n  options: { cliVersion?: string; cliEntry?: string } = {},\n): { server: http.Server; healthInterval: NodeJS.Timeout } {\n  const cliVersion = options.cliVersion ?? process.env.RULEMETRIC_CLI_VERSION ?? 'unknown';\n  const cliEntry = options.cliEntry ?? process.env.RULEMETRIC_CLI_ENTRY ?? null;\n  identityVersion = cliVersion;\n  // Mid-session crash recovery: when the health check sees mitmproxy stay\n  // dead, attempt a bounded, crash-evidence-gated `proxy restart` (see\n  // proxy-respawn.ts for the guard rails).\n  respawnMonitor = new MitmproxyRespawnMonitor({\n    hasCrashEvidence: proxyCrashEvidence,\n    respawn: () => spawnProxyRestart(cliEntry),\n    log,\n  });\n  const server = http.createServer((req, res) => {\n    handleRequest(req, res, mitmproxyPort);\n  });\n\n  server.on('connect', (req, clientSocket, head) => {\n    handleConnect(req, clientSocket as net.Socket, head as Buffer, mitmproxyPort);\n  });\n\n  // Don't crash on client socket errors\n  server.on('clientError', (_err, socket) => {\n    if (socket.writable) {\n      socket.end('HTTP/1.1 400 Bad Request\\r\\n\\r\\n');\n    }\n  });\n\n  const healthInterval = setInterval(() => {\n    checkProxyHealth(mitmproxyPort);\n    maybeRestartOnDrift(cliVersion, cliEntry);\n  }, HEALTH_INTERVAL);\n\n  // Do an immediate check\n  checkProxyHealth(mitmproxyPort);\n  maybeRestartOnDrift(cliVersion, cliEntry);\n\n  server.listen(port, '127.0.0.1', () => {\n    log(\n      `gateway listening on 127.0.0.1:${port} (mitmproxy target: :${mitmproxyPort}, ` +\n      `cli version: ${cliVersion})`,\n    );\n  });\n\n  return { server, healthInterval };\n}\n"],
+  "mappings": ";;;;;;;;;AAIA,SAAS,aAAa;AACtB,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,YAAY,SAAS;AACrB,YAAY,QAAQ;AACpB,YAAY,UAAU;AAIf,IAAM,eAAe;AACrB,IAAM,iBAAiB;AAC9B,IAAM,kBAAkB;AACxB,IAAM,iBAAiB;AAGvB,IAAM,sBAAsB;AAC5B,IAAM,eAAoB,UAAQ,WAAQ,GAAG,WAAW,cAAc,qBAAqB;AAG3F,IAAM,iBAAsB,UAAQ,WAAQ,GAAG,WAAW,cAAc,WAAW;AAEnF,IAAI,eAAe;AAInB,IAAI,uBAAsC;AAC1C,IAAI,gBAAgB;AAGpB,IAAI,kBAAkB;AAEtB,IAAI,iBAAiD;AAErD,SAAS,IAAI,KAAmB;AAC9B,QAAM,MAAK,oBAAI,KAAK,GAAE,YAAY;AAClC,UAAQ,IAAI,IAAI,EAAE,KAAK,GAAG,EAAE;AAC9B;AAEA,SAAS,mBAAkC;AACzC,MAAI;AACF,WAAU,gBAAa,cAAc,OAAO,EAAE,KAAK,KAAK;AAAA,EAC1D,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,mBAA2B,UAA+B;AAErF,MAAI,sBAAsB,aAAa,CAAC,SAAU;AAClD,QAAM,eAAe,iBAAiB;AACtC,MAAI,CAAC,gBAAgB,iBAAiB,UAAW;AAEjD,MAAI,iBAAiB,qBAAsB;AAC3C,yBAAuB;AAEvB,MAAI,iBAAiB,mBAAmB;AAEtC,QAAI,kCAAkC,iBAAiB,GAAG;AAC1D;AAAA,EACF;AAEA,QAAM,YAAY,KAAK,IAAI,IAAI;AAC/B,MAAI,YAAY,qBAAqB;AACnC;AAAA,MACE,gCAAgC,iBAAiB,WAAW,YAAY,+BAC5C,KAAK,OAAO,sBAAsB,aAAa,GAAI,CAAC;AAAA,IAClF;AACA;AAAA,EACF;AAEA;AAAA,IACE,yCAAyC,iBAAiB,WAAW,YAAY;AAAA,EAEnF;AACA,kBAAgB,KAAK,IAAI;AACzB,oBAAkB,QAAQ;AAC5B;AAQA,SAAS,kBAAkB,UAAkC;AAC3D,MAAI,CAAC,UAAU;AACb,QAAI,0EAA0E;AAC9E,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,UAAU,SAAS,SAAS,GAAG;AAAA,MACpE,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AACD,UAAM,MAAM;AACZ,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,yBAA0B,IAAc,OAAO,EAAE;AACrD,WAAO;AAAA,EACT;AACF;AAQA,SAAS,qBAA8B;AACrC,MAAI;AACF,UAAM,UAAa,gBAAa,gBAAgB,OAAO,EAAE,KAAK;AAC9D,WAAO,QAAQ,KAAK,OAAO;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,eAA6B;AACrD,QAAM,OAAW,YAAQ,EAAE,MAAM,eAAe,SAAS,eAAe,CAAC;AACzE,OAAK,GAAG,WAAW,MAAM;AACvB,SAAK,QAAQ;AACb,QAAI,CAAC,cAAc;AACjB,qBAAe;AACf,UAAI,oBAAoB,aAAa,yBAAyB;AAAA,IAChE;AACA,oBAAgB,cAAc,IAAI;AAAA,EACpC,CAAC;AACD,OAAK,GAAG,SAAS,MAAM;AACrB,QAAI,cAAc;AAChB,qBAAe;AACf,UAAI,sBAAsB,aAAa,kBAAkB;AAAA,IAC3D;AACA,oBAAgB,cAAc,KAAK;AAAA,EACrC,CAAC;AACD,OAAK,GAAG,WAAW,MAAM;AACvB,SAAK,QAAQ;AACb,QAAI,cAAc;AAChB,qBAAe;AACf,UAAI,yBAAyB,aAAa,kBAAkB;AAAA,IAC9D;AACA,oBAAgB,cAAc,KAAK;AAAA,EACrC,CAAC;AACH;AAEA,SAAS,cACP,KACA,cACA,MACA,eACM;AACN,QAAM,CAAC,YAAY,aAAa,KAAK,IAAI,OAAO,IAAI,MAAM,GAAG;AAC7D,QAAM,aAAa,SAAS,eAAe,EAAE,KAAK;AAElD,MAAI,cAAc;AAEhB,UAAM,cAAkB,YAAQ,EAAE,MAAM,eAAe,MAAM,YAAY,CAAC;AAE1E,gBAAY,GAAG,WAAW,MAAM;AAE9B,kBAAY;AAAA,QACV,WAAW,IAAI,GAAG;AAAA,QAAsB,IAAI,GAAG;AAAA;AAAA;AAAA,MACjD;AAAA,IACF,CAAC;AAGD,QAAI,iBAAiB,OAAO,MAAM,CAAC;AACnC,UAAM,SAAS,CAAC,UAAkB;AAChC,uBAAiB,OAAO,OAAO,CAAC,gBAAgB,KAAK,CAAC;AACtD,YAAM,cAAc,eAAe,SAAS;AAC5C,UAAI,YAAY,SAAS,UAAU,GAAG;AACpC,oBAAY,eAAe,QAAQ,MAAM;AAEzC,qBAAa,MAAM,6CAA6C;AAEhE,YAAI,KAAK,SAAS,EAAG,aAAY,MAAM,IAAI;AAC3C,qBAAa,KAAK,WAAW;AAC7B,oBAAY,KAAK,YAAY;AAAA,MAC/B;AAAA,IACF;AACA,gBAAY,GAAG,QAAQ,MAAM;AAE7B,gBAAY,GAAG,SAAS,CAAC,QAAQ;AAC/B,UAAI,0BAA0B,IAAI,GAAG,KAAK,IAAI,OAAO,0BAA0B;AAE/E,oBAAc,KAAK,cAAc,MAAM,YAAY,UAAU;AAAA,IAC/D,CAAC;AAED,iBAAa,GAAG,SAAS,MAAM;AAC7B,kBAAY,QAAQ;AAAA,IACtB,CAAC;AAAA,EACH,OAAO;AACL,kBAAc,KAAK,cAAc,MAAM,YAAY,UAAU;AAAA,EAC/D;AACF;AAEA,SAAS,cACP,KACA,cACA,MACA,YACA,YACM;AACN,QAAM,WAAe,YAAQ,EAAE,MAAM,YAAY,MAAM,WAAW,CAAC;AAEnE,WAAS,GAAG,WAAW,MAAM;AAC3B,iBAAa,MAAM,6CAA6C;AAChE,QAAI,KAAK,SAAS,EAAG,UAAS,MAAM,IAAI;AACxC,iBAAa,KAAK,QAAQ;AAC1B,aAAS,KAAK,YAAY;AAAA,EAC5B,CAAC;AAED,WAAS,GAAG,SAAS,CAAC,QAAQ;AAC5B,QAAI,sBAAsB,IAAI,GAAG,KAAK,IAAI,OAAO,EAAE;AACnD,iBAAa,IAAI,kCAAkC;AAAA,EACrD,CAAC;AAED,eAAa,GAAG,SAAS,MAAM;AAC7B,aAAS,QAAQ;AAAA,EACnB,CAAC;AACH;AAEA,SAAS,cACP,KACA,KACA,eACM;AAIN,MAAI,IAAI,QAAQ,uBAAuB;AACrC,QAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;AACzD,QAAI,IAAI,KAAK,UAAU;AAAA,MACrB,SAAS;AAAA,MACT,SAAS;AAAA,MACT,KAAK,QAAQ;AAAA,MACb,gBAAgB;AAAA,IAClB,CAAC,CAAC;AACF;AAAA,EACF;AAGA,QAAM,YAAY,IAAI,OAAO;AAC7B,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,SAAS;AAAA,EAC/B,QAAQ;AACN,QAAI,UAAU,GAAG;AACjB,QAAI,IAAI,aAAa;AACrB;AAAA,EACF;AAEA,QAAM,UAA+B;AAAA,IACnC,UAAU,eAAe,cAAc,UAAU;AAAA,IACjD,MAAM,eAAe,gBAAiB,SAAS,UAAU,MAAM,EAAE,KAAK;AAAA,IACtE,MAAM,eAAe,YAAY,UAAU,WAAW,UAAU;AAAA,IAChE,QAAQ,IAAI;AAAA,IACZ,SAAS,IAAI;AAAA,EACf;AAEA,QAAM,WAAgB,aAAQ,SAAS,CAAC,aAAa;AACnD,QAAI,UAAU,SAAS,cAAc,KAAK,SAAS,OAAO;AAC1D,aAAS,KAAK,GAAG;AAAA,EACnB,CAAC;AAED,WAAS,GAAG,SAAS,CAAC,QAAQ;AAC5B,QAAI,wBAAwB,SAAS,KAAK,IAAI,OAAO,EAAE;AACvD,QAAI,UAAU,GAAG;AACjB,QAAI,IAAI,aAAa;AAAA,EACvB,CAAC;AAED,MAAI,KAAK,QAAQ;AACnB;AAEO,SAAS,aACd,OAAe,cACf,gBAAwB,gBACxB,UAAsD,CAAC,GACE;AACzD,QAAM,aAAa,QAAQ,cAAc,QAAQ,IAAI,0BAA0B;AAC/E,QAAM,WAAW,QAAQ,YAAY,QAAQ,IAAI,wBAAwB;AACzE,oBAAkB;AAIlB,mBAAiB,IAAI,wBAAwB;AAAA,IAC3C,kBAAkB;AAAA,IAClB,SAAS,MAAM,kBAAkB,QAAQ;AAAA,IACzC;AAAA,EACF,CAAC;AACD,QAAM,SAAc,kBAAa,CAAC,KAAK,QAAQ;AAC7C,kBAAc,KAAK,KAAK,aAAa;AAAA,EACvC,CAAC;AAED,SAAO,GAAG,WAAW,CAAC,KAAK,cAAc,SAAS;AAChD,kBAAc,KAAK,cAA4B,MAAgB,aAAa;AAAA,EAC9E,CAAC;AAGD,SAAO,GAAG,eAAe,CAAC,MAAM,WAAW;AACzC,QAAI,OAAO,UAAU;AACnB,aAAO,IAAI,kCAAkC;AAAA,IAC/C;AAAA,EACF,CAAC;AAED,QAAM,iBAAiB,YAAY,MAAM;AACvC,qBAAiB,aAAa;AAC9B,wBAAoB,YAAY,QAAQ;AAAA,EAC1C,GAAG,eAAe;AAGlB,mBAAiB,aAAa;AAC9B,sBAAoB,YAAY,QAAQ;AAExC,SAAO,OAAO,MAAM,aAAa,MAAM;AACrC;AAAA,MACE,kCAAkC,IAAI,wBAAwB,aAAa,kBAC3D,UAAU;AAAA,IAC5B;AAAA,EACF,CAAC;AAED,SAAO,EAAE,QAAQ,eAAe;AAClC;",
+  "names": []
+}

package/dist/{chunk-DTFXCHHI.js → chunk-DNKSVWMD.js}

@@ -1,11 +1,11 @@
-import {
-  toolLabel
-} from "./chunk-RH7NHVSK.js";
 import {
   DIM,
   ORANGE,
   RED
 } from "./chunk-QJQS6TUN.js";
+import {
+  toolLabel
+} from "./chunk-RH7NHVSK.js";
 
 // src/dashboard/launcher/NewLaunchForm.tsx
 import { useState } from "react";
@@ -105,4 +105,4 @@ function NewLaunchForm({
 export {
   NewLaunchForm
 };
-//# sourceMappingURL=chunk-DTFXCHHI.js.map
+//# sourceMappingURL=chunk-DNKSVWMD.js.map

package/dist/{chunk-CNMWYYSV.js → chunk-DUJSRBLP.js}

@@ -8,7 +8,7 @@ import {
 import {
   announcements,
   getDb
-} from "./chunk-6EMZI4Y3.js";
+} from "./chunk-EI5BHWXA.js";
 
 // src/lib/handlers/process-changelog.ts
 import * as fs from "node:fs/promises";
@@ -119,4 +119,4 @@ async function processChangelog(deps = {}) {
 export {
   processChangelog
 };
-//# sourceMappingURL=chunk-CNMWYYSV.js.map
+//# sourceMappingURL=chunk-DUJSRBLP.js.map

package/dist/chunk-EARWG4EV.js

@@ -0,0 +1,22 @@
+// src/lib/capture-hosts.ts
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+function buildAllowHostsArgs(addonDir, env = process.env) {
+  if (env.RULEMETRIC_PROXY_ALL_HOSTS === "1") return [];
+  let patterns;
+  try {
+    patterns = JSON.parse(readFileSync(join(addonDir, "allow_hosts.json"), "utf-8")).allow;
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(patterns) || patterns.length === 0) return [];
+  const valid = patterns.filter((p) => typeof p === "string" && p.length > 0);
+  if (valid.length === 0) return [];
+  const extra = (env.RULEMETRIC_PROXY_EXTRA_HOSTS ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+  return [...valid, ...extra].flatMap((p) => ["--allow-hosts", p]);
+}
+
+export {
+  buildAllowHostsArgs
+};
+//# sourceMappingURL=chunk-EARWG4EV.js.map

package/dist/chunk-EARWG4EV.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/lib/capture-hosts.ts"],
+  "sourcesContent": ["import { readFileSync } from 'node:fs';\nimport { join } from 'node:path';\n\n/**\n * Build the `--allow-hosts` args that scope mitmproxy interception to the\n * hosts the addon can actually capture (LLM provider APIs). Everything else\n * is TUNNELED untouched \u2014 no TLS interception, no CA involvement \u2014 so\n * bundled-CA tools (pip/certifi, gcloud, node without NODE_EXTRA_CA_CERTS)\n * keep working while the machine-wide HTTPS_PROXY is pinned.\n *\n * The canonical pattern list lives in the addon package\n * (`addon/allow_hosts.json`) so the pytest sync-guard there can enforce it\n * covers every `detect_provider()` host \u2014 the CLI only transports it.\n *\n * Escape hatches:\n *   RULEMETRIC_PROXY_ALL_HOSTS=1     \u2192 intercept everything (required for the\n *     generic OpenAI-compatible catch-all on arbitrary self-hosted domains)\n *   RULEMETRIC_PROXY_EXTRA_HOSTS=a,b \u2192 extra host:port regexes appended\n *\n * Failure mode: a missing/corrupt manifest returns [] (intercept everything,\n * the pre-scoping behavior). Tunneling-by-default on a broken read would\n * silently kill ALL capture \u2014 strictly worse than the old blast radius.\n */\nexport function buildAllowHostsArgs(\n  addonDir: string,\n  env: NodeJS.ProcessEnv = process.env,\n): string[] {\n  if (env.RULEMETRIC_PROXY_ALL_HOSTS === '1') return [];\n\n  let patterns: unknown;\n  try {\n    patterns = (\n      JSON.parse(readFileSync(join(addonDir, 'allow_hosts.json'), 'utf-8')) as {\n        allow?: unknown;\n      }\n    ).allow;\n  } catch {\n    return [];\n  }\n  if (!Array.isArray(patterns) || patterns.length === 0) return [];\n  const valid = patterns.filter((p): p is string => typeof p === 'string' && p.length > 0);\n  if (valid.length === 0) return [];\n\n  const extra = (env.RULEMETRIC_PROXY_EXTRA_HOSTS ?? '')\n    .split(',')\n    .map((s) => s.trim())\n    .filter(Boolean);\n\n  return [...valid, ...extra].flatMap((p) => ['--allow-hosts', p]);\n}\n"],
+  "mappings": ";AAAA,SAAS,oBAAoB;AAC7B,SAAS,YAAY;AAsBd,SAAS,oBACd,UACA,MAAyB,QAAQ,KACvB;AACV,MAAI,IAAI,+BAA+B,IAAK,QAAO,CAAC;AAEpD,MAAI;AACJ,MAAI;AACF,eACE,KAAK,MAAM,aAAa,KAAK,UAAU,kBAAkB,GAAG,OAAO,CAAC,EAGpE;AAAA,EACJ,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,EAAG,QAAO,CAAC;AAC/D,QAAM,QAAQ,SAAS,OAAO,CAAC,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC;AACvF,MAAI,MAAM,WAAW,EAAG,QAAO,CAAC;AAEhC,QAAM,SAAS,IAAI,gCAAgC,IAChD,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAEjB,SAAO,CAAC,GAAG,OAAO,GAAG,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACjE;",
+  "names": []
+}