@yhong91/cpac 0.1.25 → 0.1.27

package/dist/proxy.js

@@ -0,0 +1,341 @@
+import { spawn, spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { createServer, request as httpRequest, } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { apiBase, originalBytes, proxyFingerprint, readState, stateBytes, stateProxy, } from "./config.js";
+import { CPACError, atomicWrite, objectValue, resolveApiKey } from "./util.js";
+const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+const CLIENT_CREDENTIAL_HEADERS = new Set([
+    "authorization",
+    "chatgpt-account-id",
+    "cookie",
+    "openai-organization",
+    "openai-project",
+    "x-api-key",
+    "x-opencodex-api-key",
+]);
+function localBrowserOrigin(value) {
+    if (!value)
+        return true;
+    try {
+        const hostname = new URL(value).hostname.toLowerCase();
+        return (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1");
+    }
+    catch {
+        return false;
+    }
+}
+export function proxyHeaders(headers, apiKey) {
+    const forwarded = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined ||
+            name === "host" ||
+            CLIENT_CREDENTIAL_HEADERS.has(name) ||
+            HOP_BY_HOP_HEADERS.has(name)) {
+            continue;
+        }
+        forwarded[name] = value;
+    }
+    forwarded.authorization = `Bearer ${apiKey}`;
+    return forwarded;
+}
+export function responseHeaders(headers) {
+    const forwarded = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined || HOP_BY_HOP_HEADERS.has(name))
+            continue;
+        forwarded[name] = value;
+    }
+    return forwarded;
+}
+export function upstreamUrl(cpaUrl, requestUrl) {
+    try {
+        const incoming = new URL(requestUrl, "http://127.0.0.1");
+        const suffix = incoming.pathname === "/v1"
+            ? ""
+            : incoming.pathname.startsWith("/v1/")
+                ? incoming.pathname.slice(3)
+                : incoming.pathname;
+        return new URL(`${apiBase(cpaUrl)}${suffix}${incoming.search}`);
+    }
+    catch {
+        throw new CPACError(`invalid upstream request URL: ${requestUrl}`);
+    }
+}
+export async function createLoopbackProxy(cpaUrl, apiKey, proxyId, port) {
+    const server = createServer((request, response) => {
+        const requestUrl = request.url ?? "/";
+        if (requestUrl === "/_cpac/health") {
+            if (request.headers["x-cpac-proxy-id"] !== proxyId) {
+                response.writeHead(404).end();
+                return;
+            }
+            response.writeHead(204).end();
+            return;
+        }
+        if (requestUrl === "/_cpac/shutdown" && request.method === "POST") {
+            if (request.headers["x-cpac-proxy-id"] !== proxyId) {
+                response.writeHead(404).end();
+                return;
+            }
+            response.writeHead(204).end();
+            setImmediate(() => {
+                server.closeAllConnections?.();
+                server.close();
+            });
+            return;
+        }
+        if (!localBrowserOrigin(request.headers.origin)) {
+            response.writeHead(403, { "content-type": "application/json" });
+            response.end(JSON.stringify({ error: "non-local origin rejected" }));
+            return;
+        }
+        let target;
+        try {
+            target = upstreamUrl(cpaUrl, requestUrl);
+        }
+        catch {
+            response.writeHead(400).end("invalid request URL");
+            return;
+        }
+        const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+        const upstream = send(target, {
+            method: request.method,
+            headers: proxyHeaders(request.headers, apiKey),
+        }, (upstreamResponse) => {
+            response.writeHead(upstreamResponse.statusCode ?? 502, responseHeaders(upstreamResponse.headers));
+            upstreamResponse.pipe(response);
+        });
+        upstream.once("error", () => {
+            if (!response.headersSent) {
+                response.writeHead(502, { "content-type": "application/json" });
+            }
+            if (!response.writableEnded)
+                response.end(JSON.stringify({ error: "CPA upstream request failed" }));
+        });
+        request.once("aborted", () => upstream.destroy());
+        response.once("close", () => {
+            if (!response.writableEnded)
+                upstream.destroy();
+        });
+        request.pipe(upstream);
+    });
+    server.on("upgrade", (_request, socket) => {
+        socket.end("HTTP/1.1 426 Upgrade Required\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+    });
+    server.on("clientError", (_error, socket) => socket.destroy());
+    await new Promise((resolveListen, rejectListen) => {
+        server.once("error", rejectListen);
+        server.listen(port, "127.0.0.1", () => {
+            server.off("error", rejectListen);
+            resolveListen();
+        });
+    });
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        server.close();
+        throw new CPACError("cannot determine loopback proxy port");
+    }
+    return { server, port: address.port };
+}
+export async function runProxyChild(port) {
+    const cpaUrl = process.env.CPAC_PROXY_UPSTREAM;
+    const apiKey = process.env.CPAC_PROXY_API_KEY;
+    const proxyId = process.env.CPAC_PROXY_ID;
+    if (!cpaUrl || !apiKey || !proxyId)
+        return 1;
+    try {
+        const proxy = await createLoopbackProxy(cpaUrl, apiKey, proxyId, port);
+        process.send?.({ ready: true, port: proxy.port, pid: process.pid });
+        const close = () => {
+            proxy.server.closeAllConnections?.();
+            proxy.server.close();
+        };
+        process.once("SIGINT", close);
+        process.once("SIGTERM", close);
+        await new Promise((resolveClose) => proxy.server.once("close", resolveClose));
+        return 0;
+    }
+    catch (error) {
+        process.send?.({
+            ready: false,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return 1;
+    }
+}
+export async function proxyIsHealthy(proxy) {
+    try {
+        const response = await fetch(`http://127.0.0.1:${proxy.port}/_cpac/health`, {
+            headers: { "x-cpac-proxy-id": proxy.id },
+            signal: AbortSignal.timeout(1_000),
+        });
+        return response.status === 204;
+    }
+    catch {
+        return false;
+    }
+}
+export async function startProxyProcess(config, apiKey) {
+    const id = randomBytes(24).toString("hex");
+    const child = spawn(process.execPath, [
+        fileURLToPath(new URL("./cpac.js", import.meta.url)),
+        "_proxy",
+        String(config.codex_proxy_port),
+    ], {
+        detached: true,
+        env: {
+            ...process.env,
+            CPAC_PROXY_API_KEY: apiKey,
+            CPAC_PROXY_ID: id,
+            CPAC_PROXY_UPSTREAM: config.cpa_url,
+        },
+        stdio: ["ignore", "ignore", "ignore", "ipc"],
+    });
+    return await new Promise((resolveStart, rejectStart) => {
+        let settled = false;
+        let timeout;
+        const finish = (error, value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            child.removeAllListeners();
+            if (child.connected)
+                child.disconnect();
+            child.unref();
+            if (error)
+                rejectStart(error);
+            else
+                resolveStart(value);
+        };
+        timeout = setTimeout(() => {
+            child.kill("SIGKILL");
+            finish(new CPACError("loopback proxy did not become ready"));
+        }, 5_000);
+        child.once("error", (error) => finish(new CPACError(`cannot start loopback proxy: ${error.message}`)));
+        child.once("exit", (code) => finish(new CPACError(`loopback proxy exited before ready (${code ?? 1})`)));
+        child.once("message", (message) => {
+            if (objectValue(message) &&
+                message.ready === true &&
+                typeof message.pid === "number" &&
+                typeof message.port === "number") {
+                finish(undefined, { id, pid: message.pid, port: message.port });
+                return;
+            }
+            const detail = objectValue(message) && typeof message.error === "string"
+                ? `: ${message.error}`
+                : "";
+            finish(new CPACError(`cannot start loopback proxy${detail}`));
+        });
+    });
+}
+function processCommandArgs(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return undefined;
+    try {
+        const proc = `/proc/${pid}/cmdline`;
+        if (existsSync(proc)) {
+            const raw = readFileSync(proc, "utf8");
+            return raw ? raw.split("\0").filter(Boolean) : undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        const result = spawnSync("ps", ["-p", String(pid), "-www", "-o", "args="], {
+            encoding: "utf8",
+            timeout: 1_000,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (result.status !== 0)
+            return undefined;
+        const line = result.stdout.trim();
+        return line ? line.split(/\s+/) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isCpacProxyProcess(pid) {
+    const args = processCommandArgs(pid);
+    if (!args)
+        return false;
+    return (args.includes("_proxy") &&
+        args.some((arg) => arg === "cpac.js" || arg.endsWith("/cpac.js") || arg.endsWith("\\cpac.js")));
+}
+function killCpacProxy(pid, signal) {
+    if (!isCpacProxyProcess(pid))
+        return false;
+    try {
+        process.kill(pid, signal);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function stopProxyProcess(proxy) {
+    if (await proxyIsHealthy(proxy)) {
+        try {
+            await fetch(`http://127.0.0.1:${proxy.port}/_cpac/shutdown`, {
+                method: "POST",
+                headers: { "x-cpac-proxy-id": proxy.id },
+                signal: AbortSignal.timeout(1_000),
+            });
+        }
+        catch {
+            // The server may close the connection while shutting down.
+        }
+    }
+    if (!killCpacProxy(proxy.pid, "SIGTERM"))
+        return;
+    await new Promise((resolveWait) => setTimeout(resolveWait, 200));
+    killCpacProxy(proxy.pid, "SIGKILL");
+}
+export async function runProxy(config) {
+    const apiKey = await resolveApiKey(config.api_key_env);
+    const state = readState(config.state_dir);
+    if (!state)
+        throw new CPACError("no active CPAC injection; run cpac inject first");
+    originalBytes(config.state_dir, state, config.codex_config);
+    const recorded = stateProxy(state);
+    if (!recorded) {
+        throw new CPACError("injection has no loopback proxy state; run cpac inject to migrate it");
+    }
+    if (await proxyIsHealthy(recorded)) {
+        throw new CPACError(`loopback proxy is already running on 127.0.0.1:${recorded.port}`);
+    }
+    const proxy = await createLoopbackProxy(config.cpa_url, apiKey, recorded.id, recorded.port);
+    try {
+        atomicWrite(join(config.state_dir, "state.json"), stateBytes(config, state.config_existed, state.config_mode, { id: recorded.id, pid: process.pid, port: proxy.port }, proxyFingerprint(config, apiKey)));
+    }
+    catch (error) {
+        proxy.server.closeAllConnections?.();
+        proxy.server.close();
+        throw error;
+    }
+    console.log(`CPAC loopback proxy listening on http://127.0.0.1:${proxy.port}/v1`);
+    const close = () => {
+        proxy.server.closeAllConnections?.();
+        proxy.server.close();
+    };
+    process.once("SIGINT", close);
+    process.once("SIGTERM", close);
+    await new Promise((resolveClose) => proxy.server.once("close", resolveClose));
+    return 0;
+}