@yhong91/cpac 0.1.24 → 0.1.26

package/dist/proxy.js

@@ -0,0 +1,341 @@
+import { spawn, spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { createServer, request as httpRequest, } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { apiBase, originalBytes, proxyFingerprint, readState, stateBytes, stateProxy, } from "./config.js";
+import { CPACError, atomicWrite, objectValue, resolveApiKey } from "./util.js";
+const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+const CLIENT_CREDENTIAL_HEADERS = new Set([
+    "authorization",
+    "chatgpt-account-id",
+    "cookie",
+    "openai-organization",
+    "openai-project",
+    "x-api-key",
+    "x-opencodex-api-key",
+]);
+function localBrowserOrigin(value) {
+    if (!value)
+        return true;
+    try {
+        const hostname = new URL(value).hostname.toLowerCase();
+        return (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1");
+    }
+    catch {
+        return false;
+    }
+}
+export function proxyHeaders(headers, apiKey) {
+    const forwarded = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined ||
+            name === "host" ||
+            CLIENT_CREDENTIAL_HEADERS.has(name) ||
+            HOP_BY_HOP_HEADERS.has(name)) {
+            continue;
+        }
+        forwarded[name] = value;
+    }
+    forwarded.authorization = `Bearer ${apiKey}`;
+    return forwarded;
+}
+export function responseHeaders(headers) {
+    const forwarded = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined || HOP_BY_HOP_HEADERS.has(name))
+            continue;
+        forwarded[name] = value;
+    }
+    return forwarded;
+}
+export function upstreamUrl(cpaUrl, requestUrl) {
+    try {
+        const incoming = new URL(requestUrl, "http://127.0.0.1");
+        const suffix = incoming.pathname === "/v1"
+            ? ""
+            : incoming.pathname.startsWith("/v1/")
+                ? incoming.pathname.slice(3)
+                : incoming.pathname;
+        return new URL(`${apiBase(cpaUrl)}${suffix}${incoming.search}`);
+    }
+    catch {
+        throw new CPACError(`invalid upstream request URL: ${requestUrl}`);
+    }
+}
+export async function createLoopbackProxy(cpaUrl, apiKey, proxyId, port) {
+    const server = createServer((request, response) => {
+        const requestUrl = request.url ?? "/";
+        if (requestUrl === "/_cpac/health") {
+            if (request.headers["x-cpac-proxy-id"] !== proxyId) {
+                response.writeHead(404).end();
+                return;
+            }
+            response.writeHead(204).end();
+            return;
+        }
+        if (requestUrl === "/_cpac/shutdown" && request.method === "POST") {
+            if (request.headers["x-cpac-proxy-id"] !== proxyId) {
+                response.writeHead(404).end();
+                return;
+            }
+            response.writeHead(204).end();
+            setImmediate(() => {
+                server.closeAllConnections?.();
+                server.close();
+            });
+            return;
+        }
+        if (!localBrowserOrigin(request.headers.origin)) {
+            response.writeHead(403, { "content-type": "application/json" });
+            response.end(JSON.stringify({ error: "non-local origin rejected" }));
+            return;
+        }
+        let target;
+        try {
+            target = upstreamUrl(cpaUrl, requestUrl);
+        }
+        catch {
+            response.writeHead(400).end("invalid request URL");
+            return;
+        }
+        const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+        const upstream = send(target, {
+            method: request.method,
+            headers: proxyHeaders(request.headers, apiKey),
+        }, (upstreamResponse) => {
+            response.writeHead(upstreamResponse.statusCode ?? 502, responseHeaders(upstreamResponse.headers));
+            upstreamResponse.pipe(response);
+        });
+        upstream.once("error", () => {
+            if (!response.headersSent) {
+                response.writeHead(502, { "content-type": "application/json" });
+            }
+            if (!response.writableEnded)
+                response.end(JSON.stringify({ error: "CPA upstream request failed" }));
+        });
+        request.once("aborted", () => upstream.destroy());
+        response.once("close", () => {
+            if (!response.writableEnded)
+                upstream.destroy();
+        });
+        request.pipe(upstream);
+    });
+    server.on("upgrade", (_request, socket) => {
+        socket.end("HTTP/1.1 426 Upgrade Required\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+    });
+    server.on("clientError", (_error, socket) => socket.destroy());
+    await new Promise((resolveListen, rejectListen) => {
+        server.once("error", rejectListen);
+        server.listen(port, "127.0.0.1", () => {
+            server.off("error", rejectListen);
+            resolveListen();
+        });
+    });
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        server.close();
+        throw new CPACError("cannot determine loopback proxy port");
+    }
+    return { server, port: address.port };
+}
+export async function runProxyChild(port) {
+    const cpaUrl = process.env.CPAC_PROXY_UPSTREAM;
+    const apiKey = process.env.CPAC_PROXY_API_KEY;
+    const proxyId = process.env.CPAC_PROXY_ID;
+    if (!cpaUrl || !apiKey || !proxyId)
+        return 1;
+    try {
+        const proxy = await createLoopbackProxy(cpaUrl, apiKey, proxyId, port);
+        process.send?.({ ready: true, port: proxy.port, pid: process.pid });
+        const close = () => {
+            proxy.server.closeAllConnections?.();
+            proxy.server.close();
+        };
+        process.once("SIGINT", close);
+        process.once("SIGTERM", close);
+        await new Promise((resolveClose) => proxy.server.once("close", resolveClose));
+        return 0;
+    }
+    catch (error) {
+        process.send?.({
+            ready: false,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return 1;
+    }
+}
+export async function proxyIsHealthy(proxy) {
+    try {
+        const response = await fetch(`http://127.0.0.1:${proxy.port}/_cpac/health`, {
+            headers: { "x-cpac-proxy-id": proxy.id },
+            signal: AbortSignal.timeout(1_000),
+        });
+        return response.status === 204;
+    }
+    catch {
+        return false;
+    }
+}
+export async function startProxyProcess(config, apiKey) {
+    const id = randomBytes(24).toString("hex");
+    const child = spawn(process.execPath, [
+        fileURLToPath(new URL("./cpac.js", import.meta.url)),
+        "_proxy",
+        String(config.codex_proxy_port),
+    ], {
+        detached: true,
+        env: {
+            ...process.env,
+            CPAC_PROXY_API_KEY: apiKey,
+            CPAC_PROXY_ID: id,
+            CPAC_PROXY_UPSTREAM: config.cpa_url,
+        },
+        stdio: ["ignore", "ignore", "ignore", "ipc"],
+    });
+    return await new Promise((resolveStart, rejectStart) => {
+        let settled = false;
+        let timeout;
+        const finish = (error, value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            child.removeAllListeners();
+            if (child.connected)
+                child.disconnect();
+            child.unref();
+            if (error)
+                rejectStart(error);
+            else
+                resolveStart(value);
+        };
+        timeout = setTimeout(() => {
+            child.kill("SIGKILL");
+            finish(new CPACError("loopback proxy did not become ready"));
+        }, 5_000);
+        child.once("error", (error) => finish(new CPACError(`cannot start loopback proxy: ${error.message}`)));
+        child.once("exit", (code) => finish(new CPACError(`loopback proxy exited before ready (${code ?? 1})`)));
+        child.once("message", (message) => {
+            if (objectValue(message) &&
+                message.ready === true &&
+                typeof message.pid === "number" &&
+                typeof message.port === "number") {
+                finish(undefined, { id, pid: message.pid, port: message.port });
+                return;
+            }
+            const detail = objectValue(message) && typeof message.error === "string"
+                ? `: ${message.error}`
+                : "";
+            finish(new CPACError(`cannot start loopback proxy${detail}`));
+        });
+    });
+}
+function processCommandArgs(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return undefined;
+    try {
+        const proc = `/proc/${pid}/cmdline`;
+        if (existsSync(proc)) {
+            const raw = readFileSync(proc, "utf8");
+            return raw ? raw.split("\0").filter(Boolean) : undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const result = spawnSync("ps", ["-p", String(pid), "-www", "-o", "args="], {
+            encoding: "utf8",
+            timeout: 1_000,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (result.status !== 0)
+            return undefined;
+        const line = result.stdout.trim();
+        return line ? line.split(/\s+/) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isCpacProxyProcess(pid) {
+    const args = processCommandArgs(pid);
+    if (!args)
+        return false;
+    return (args.includes("_proxy") &&
+        args.some((arg) => arg === "cpac.js" || arg.endsWith("/cpac.js") || arg.endsWith("\\cpac.js")));
+}
+function killCpacProxy(pid, signal) {
+    if (!isCpacProxyProcess(pid))
+        return false;
+    try {
+        process.kill(pid, signal);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function stopProxyProcess(proxy) {
+    if (await proxyIsHealthy(proxy)) {
+        try {
+            await fetch(`http://127.0.0.1:${proxy.port}/_cpac/shutdown`, {
+                method: "POST",
+                headers: { "x-cpac-proxy-id": proxy.id },
+                signal: AbortSignal.timeout(1_000),
+            });
+        }
+        catch {
+            // The server may close the connection while shutting down.
+        }
+    }
+    if (!killCpacProxy(proxy.pid, "SIGTERM"))
+        return;
+    await new Promise((resolveWait) => setTimeout(resolveWait, 200));
+    killCpacProxy(proxy.pid, "SIGKILL");
+}
+export async function runProxy(config) {
+    const apiKey = await resolveApiKey(config.api_key_env);
+    const state = readState(config.state_dir);
+    if (!state)
+        throw new CPACError("no active CPAC injection; run cpac inject first");
+    originalBytes(config.state_dir, state, config.codex_config);
+    const recorded = stateProxy(state);
+    if (!recorded) {
+        throw new CPACError("injection has no loopback proxy state; run cpac inject to migrate it");
+    }
+    if (await proxyIsHealthy(recorded)) {
+        throw new CPACError(`loopback proxy is already running on 127.0.0.1:${recorded.port}`);
+    }
+    const proxy = await createLoopbackProxy(config.cpa_url, apiKey, recorded.id, recorded.port);
+    try {
+        atomicWrite(join(config.state_dir, "state.json"), stateBytes(config, state.config_existed, state.config_mode, { id: recorded.id, pid: process.pid, port: proxy.port }, proxyFingerprint(config, apiKey)));
+    }
+    catch (error) {
+        proxy.server.closeAllConnections?.();
+        proxy.server.close();
+        throw error;
+    }
+    console.log(`CPAC loopback proxy listening on http://127.0.0.1:${proxy.port}/v1`);
+    const close = () => {
+        proxy.server.closeAllConnections?.();
+        proxy.server.close();
+    };
+    process.once("SIGINT", close);
+    process.once("SIGTERM", close);
+    await new Promise((resolveClose) => proxy.server.once("close", resolveClose));
+    return 0;
+}

package/dist/util.js

@@ -0,0 +1,192 @@
+import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, parse } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { Writable } from "node:stream";
+let atomicSequence = 0;
+export class CPACError extends Error {
+}
+export function objectValue(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function expandUserPath(value) {
+    if (value === "~")
+        return homedir();
+    if (value.startsWith("~/") || value.startsWith("~\\"))
+        return join(homedir(), value.slice(2));
+    return value;
+}
+export async function checkboxPicker(title, items, max) {
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw new CPACError("model selection requires an interactive terminal");
+    }
+    const stdin = process.stdin;
+    const out = process.stderr;
+    const selected = new Set();
+    let cursor = 0;
+    const lines = items.length + 1;
+    const render = () => {
+        out.write(`${title} [space: toggle, up/down: move, enter: confirm, q: cancel, max ${max}]\n`);
+        items.forEach((item, index) => {
+            const box = selected.has(index) ? "[x]" : "[ ]";
+            out.write(`${index === cursor ? ">" : " "} ${box} ${item}\n`);
+        });
+    };
+    const redraw = () => {
+        out.write(`\x1b[${lines}F`);
+        for (let line = 0; line < lines; line += 1)
+            out.write("\x1b[2K\x1b[1E");
+        out.write(`\x1b[${lines}F`);
+        render();
+    };
+    return await new Promise((resolvePromise, rejectPromise) => {
+        const finish = (error) => {
+            stdin.removeListener("data", onData);
+            try {
+                stdin.setRawMode(false);
+            }
+            catch {
+                // Terminal already gone; nothing to restore.
+            }
+            stdin.pause();
+            out.write("\n");
+            if (error)
+                rejectPromise(error);
+            else
+                resolvePromise([...selected].map((index) => items[index]));
+        };
+        const onData = (chunk) => {
+            const key = chunk.toString("utf8");
+            if (key === "\x03" || key === "q" || key === "\x1b") {
+                finish(new CPACError("model selection cancelled"));
+                return;
+            }
+            if (key === "\r" || key === "\n") {
+                if (max === 1 && selected.size === 0) {
+                    selected.add(cursor);
+                }
+                finish();
+                return;
+            }
+            if (key === "\x1b[A")
+                cursor = (cursor + items.length - 1) % items.length;
+            else if (key === "\x1b[B")
+                cursor = (cursor + 1) % items.length;
+            else if (key === " ") {
+                if (max === 1) {
+                    selected.clear();
+                    selected.add(cursor);
+                    finish();
+                    return;
+                }
+                if (selected.has(cursor))
+                    selected.delete(cursor);
+                else if (selected.size < max)
+                    selected.add(cursor);
+            }
+            redraw();
+        };
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.on("data", onData);
+        render();
+    });
+}
+export function tomlString(value) {
+    return JSON.stringify(value);
+}
+export function tomlStringArray(values) {
+    return `[ ${values.map(tomlString).join(", ")} ]`;
+}
+export function dominantEol(content) {
+    const crlf = (content.match(/\r\n/g) ?? []).length;
+    if (crlf === 0)
+        return "\n";
+    const bareLf = (content.match(/\n/g) ?? []).length - crlf;
+    return crlf >= bareLf ? "\r\n" : "\n";
+}
+export function atomicWrite(path, data, mode = 0o600) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.cpac.${process.pid}.${Date.now()}.${++atomicSequence}.tmp`;
+    let descriptor;
+    try {
+        descriptor = openSync(temporary, "wx", 0o600);
+        writeFileSync(descriptor, data);
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        chmodSync(temporary, mode);
+        renameSync(temporary, path);
+    }
+    catch (error) {
+        if (descriptor !== undefined) {
+            try {
+                closeSync(descriptor);
+            }
+            catch (closeError) {
+                void closeError;
+            }
+        }
+        try {
+            unlinkSync(temporary);
+        }
+        catch (unlinkError) {
+            void unlinkError;
+        }
+        throw error;
+    }
+}
+export async function promptSecret(name) {
+    if (!process.stdin.isTTY || !process.stderr.isTTY) {
+        throw new CPACError(`environment variable ${name} is not set; run: export ${name}="..."`);
+    }
+    process.stderr.write(`Enter ${name}: `);
+    const silent = new Writable({
+        write(_chunk, _encoding, callback) {
+            callback();
+        },
+    });
+    const prompt = createInterface({
+        input: process.stdin,
+        output: silent,
+        terminal: true,
+    });
+    try {
+        const value = (await prompt.question("")).trim();
+        process.stderr.write("\n");
+        if (!value)
+            throw new CPACError(`${name} must not be empty`);
+        return value;
+    }
+    finally {
+        prompt.close();
+    }
+}
+export async function resolveApiKey(name) {
+    return process.env[name]?.trim() || (await promptSecret(name));
+}
+export function shellProfile() {
+    const shell = parse(process.env.SHELL || "").base;
+    if (shell === "zsh")
+        return join(homedir(), ".zshrc");
+    if (shell === "bash")
+        return join(homedir(), process.platform === "darwin" ? ".bash_profile" : ".bashrc");
+    if (["sh", "dash", "ksh"].includes(shell))
+        return join(homedir(), ".profile");
+    throw new CPACError(`unsupported shell ${shell || "unknown"}; run: export CPA_API_KEY="..."`);
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+export function saveApiKeyExport(profile, name, apiKey) {
+    const start = `# >>> CPAC ${name} >>>`;
+    const end = `# <<< CPAC ${name} <<<`;
+    const block = `${start}\nexport ${name}=${shellQuote(apiKey)}\n${end}`;
+    let content = existsSync(profile) ? readFileSync(profile, "utf8") : "";
+    const managed = new RegExp(`${start.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[\\s\\S]*?${end.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`);
+    content = managed.test(content)
+        ? content.replace(managed, block)
+        : `${content}${content && !content.endsWith("\n") ? "\n" : ""}${block}\n`;
+    const mode = existsSync(profile) ? statSync(profile).mode & 0o7777 : 0o600;
+    atomicWrite(profile, Buffer.from(content), mode);
+}

package/package.json

@@ -1,14 +1,13 @@
 {
   "name": "@yhong91/cpac",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "Connect Codex and Claude Code to a remote CLIProxyAPI gateway",
   "type": "module",
   "bin": {
     "cpac": "dist/cpac.js"
   },
   "files": [
-    "dist/cpac.js",
-    "dist/pi-extension.template",
+    "dist",
     "cpac.example.json",
     "README.md"
   ],