anyray-connect 0.11.39 → 0.11.41

package/dist/commands/agentProxy.js

@@ -1,670 +0,0 @@
-/**
- * `anyray-connect __anyray-agent-proxy` — the device-capture agent daemon.
- *
- * A loopback HTTP CONNECT proxy the OS system proxy points at (see
- * util/agentTrust.ts). It captures AI inference from apps `connect` can't
- * redirect — the ChatGPT desktop app, Claude desktop app, Copilot, browsers —
- * by intercepting BELOW the app at the network layer (RFC 0002 / 0002a).
- *
- * Per connection:
- *  - host NOT on the AI allowlist  -> blind CONNECT tunnel: the two sockets are
- *    piped byte-for-byte, TLS is never terminated, the agent never sees the
- *    bytes. This is the privacy invariant (RFC 0002 §2) — everything that isn't
- *    a reviewed AI domain is untouched.
- *  - host ON the allowlist         -> MITM locally: terminate TLS with a leaf
- *    minted from the device CA, read the HTTP request, and forward it to the
- *    ORG GATEWAY (not straight to the provider) so spend is metered
- *    content-free. The app's own Authorization (its ChatGPT/Claude/Copilot
- *    session) is preserved; the agent injects the origin host, attribution the
- *    desktop app can't add, and the enrolled dev key.
- *
- * Only Node built-ins (connect ships as a zero-dep binary). Bound to loopback.
- * NEVER logs prompt/response content (privacy invariant) — the MITM path reads
- * a request only to forward it, and logs metadata (host/status) at most.
- *
- * `createInterceptProxy` builds the server (testable, cert minting injected);
- * `runAgentProxy` is the profile-loading entrypoint the OS service launches.
- */
-import http from 'node:http';
-import net from 'node:net';
-import tls from 'node:tls';
-import { lookup as dnsLookup } from 'node:dns/promises';
-import { loadProfile } from '../util/persist.js';
-import { AGENT_HEADERS, DEFAULT_AGENT_PORT } from '../util/agentPaths.js';
-import { decideHost, } from '../util/agentAllowlist.js';
-import { ensureCa, mintLeaf } from '../util/agentCa.js';
-import { restoreSystemProxy } from '../util/agentTrust.js';
-/** Where a decrypted AI request is forwarded on the gateway. */
-export const INTAKE_PATH = '/v1/agent-intake';
-// Hop-by-hop / length headers we must not forward to the gateway verbatim (the
-// fetch client manages host/content-length and decodes content-encoding). Plus
-// anything host-specific to the ORIGINAL upstream that the gateway recomputes.
-const REQUEST_DROP = new Set([
-    'host',
-    'connection',
-    'keep-alive',
-    'proxy-connection',
-    'content-length',
-    'transfer-encoding',
-    'upgrade',
-    'accept-encoding',
-]);
-const RESPONSE_DROP = new Set([
-    'content-encoding',
-    'content-length',
-    'transfer-encoding',
-    'connection',
-    'keep-alive',
-]);
-// Special-purpose prefixes inside 2000::/3 that are not ordinary globally
-// reachable destinations. In particular, 6to4 embeds an IPv4 address and can
-// otherwise turn a private IPv4 target into an apparently public IPv6 target.
-const NON_FORWARDABLE_IPV6 = new net.BlockList();
-NON_FORWARDABLE_IPV6.addSubnet('2001::', 23, 'ipv6');
-NON_FORWARDABLE_IPV6.addSubnet('2001:db8::', 32, 'ipv6');
-NON_FORWARDABLE_IPV6.addSubnet('2002::', 16, 'ipv6');
-NON_FORWARDABLE_IPV6.addSubnet('3fff::', 20, 'ipv6');
-/**
- * SSRF blocklist for the plain-HTTP forward path (`forwardPlainHttp`). The
- * agent binds to 127.0.0.1, but it IS the machine's configured HTTP proxy, so a
- * local page/tool can steer an arbitrary `http://` request at it. On a cloud
- * dev box that turns the proxy into a confused deputy for credential theft — a
- * page that makes the browser fetch `http://169.254.169.254/…` would have us
- * relay the instance metadata (and its IAM creds) straight back. Refuse the
- * hosts real outbound web traffic never legitimately targets: loopback,
- * RFC-1918 / CGNAT / link-local, IPv6 loopback/ULA/link-local, and the cloud
- * metadata endpoints. This is a blocklist, NOT an allowlist — forwarding to
- * arbitrary *public* hosts is the proxy's job and stays allowed.
- *
- */
-export const isForwardableHttpHost = (hostname) => {
-    const host = hostname.toLowerCase().replace(/^\[|\]$/g, ''); // strip IPv6 []
-    if (!host)
-        return false;
-    const BLOCKED_NAMES = new Set([
-        'localhost',
-        '0.0.0.0',
-        'metadata',
-        'metadata.google.internal',
-        'metadata.azure.com',
-        'instance-data',
-        'host.docker.internal',
-    ]);
-    if (BLOCKED_NAMES.has(host))
-        return false;
-    if (host.endsWith('.localhost') ||
-        host.endsWith('.internal') ||
-        host.endsWith('.local')) {
-        return false;
-    }
-    const ipv4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-    if (ipv4) {
-        return isForwardableAddress(host);
-    }
-    if (host.includes(':'))
-        return isForwardableAddress(host);
-    return true; // ordinary external DNS name
-};
-/** True only for globally routable IP addresses. */
-export const isForwardableAddress = (address) => {
-    const host = address.toLowerCase().replace(/^\[|\]$/g, '').split('%')[0];
-    const family = net.isIP(host);
-    if (family === 4) {
-        const [a, b, c] = host.split('.').map(Number);
-        if (a === 0 || a === 10 || a === 127)
-            return false;
-        if (a === 100 && b >= 64 && b <= 127)
-            return false;
-        if (a === 169 && b === 254)
-            return false;
-        if (a === 172 && b >= 16 && b <= 31)
-            return false;
-        if (a === 192 && (b === 0 || b === 168))
-            return false;
-        if (a === 198 && (b === 18 || b === 19))
-            return false;
-        if (a === 198 && b === 51 && c === 100)
-            return false;
-        if (a === 203 && b === 0 && c === 113)
-            return false;
-        if (a >= 224)
-            return false;
-        return true;
-    }
-    if (family === 6) {
-        // Globally routable IPv6 lives in 2000::/3. Refuse every mapped, local,
-        // multicast, transition, documentation, and other special-purpose range.
-        const first = Number.parseInt(host.split(':')[0] || '0', 16);
-        if (first < 0x2000 || first > 0x3fff)
-            return false;
-        return !NON_FORWARDABLE_IPV6.check(host, 'ipv6');
-    }
-    return false;
-};
-/** Normalize a URL/DNS host for literal-address and local-name comparisons. */
-const normalizeHostname = (hostname) => hostname
-    .trim()
-    .toLowerCase()
-    .replace(/^\[|\]$/g, '')
-    .replace(/\.$/, '')
-    .split('%')[0];
-/**
- * Addresses a client may intentionally use for its own on-device gateway.
- * This is range-based (the full IPv4 loopback /8), not tied to one developer's
- * IP. The unspecified IPv4 bind address is mapped to loopback before dialing.
- */
-export const isLocalGatewayAddress = (address) => {
-    const host = normalizeHostname(address);
-    const family = net.isIP(host);
-    if (family === 4) {
-        return host === '0.0.0.0' || Number(host.split('.')[0]) === 127;
-    }
-    return family === 6 && host === '::1';
-};
-/** A plaintext gateway is safe only when it cannot leave this device. */
-const isLocalGatewayHostname = (hostname) => {
-    const host = normalizeHostname(hostname);
-    return host === 'localhost' || isLocalGatewayAddress(host);
-};
-const defaultResolveHost = async (hostname) => {
-    const addresses = await dnsLookup(hostname, { all: true, verbatim: true });
-    return addresses.flatMap(({ address, family }) => family === 4 || family === 6 ? [{ address, family }] : []);
-};
-/** Resolve once, validate the result, then pin the outbound connection to it. */
-export const resolveForwardAddress = async (hostname, resolveHost = defaultResolveHost) => {
-    const host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
-    if (!isForwardableHttpHost(host))
-        return null;
-    const family = net.isIP(host);
-    if (family === 4 || family === 6) {
-        return isForwardableAddress(host) ? { address: host, family } : null;
-    }
-    const addresses = await resolveHost(host);
-    for (const { address } of addresses) {
-        const resolvedFamily = net.isIP(address);
-        if ((resolvedFamily === 4 || resolvedFamily === 6) &&
-            isForwardableAddress(address)) {
-            return { address, family: resolvedFamily };
-        }
-    }
-    return null;
-};
-/**
- * Resolve the configured on-device gateway and pin it to a loopback address.
- * A poisoned localhost mapping cannot turn this exception into an SSRF bypass.
- */
-export const resolveLocalGatewayAddress = async (hostname, resolveHost = defaultResolveHost) => {
-    const host = normalizeHostname(hostname);
-    const family = net.isIP(host);
-    if (family === 4 || family === 6) {
-        if (!isLocalGatewayAddress(host))
-            return null;
-        // 0.0.0.0 is a bind address, not a destination. Preserve the documented
-        // gateway spelling in Host while dialing the local IPv4 listener.
-        return host === '0.0.0.0'
-            ? { address: '127.0.0.1', family: 4 }
-            : { address: host, family };
-    }
-    if (host !== 'localhost')
-        return null;
-    const addresses = await resolveHost(host);
-    const candidates = [];
-    for (const { address } of addresses) {
-        const resolvedFamily = net.isIP(normalizeHostname(address));
-        if ((resolvedFamily === 4 || resolvedFamily === 6) &&
-            isLocalGatewayAddress(address)) {
-            candidates.push({
-                address: normalizeHostname(address),
-                family: resolvedFamily,
-            });
-        }
-    }
-    // The default local gateway binds IPv4. A client that intentionally runs an
-    // IPv6-only gateway can enroll its explicit http://[::1] origin.
-    return (candidates.find(({ family: candidateFamily }) => candidateFamily === 4) ??
-        candidates[0] ??
-        null);
-};
-/**
- * Resolve one plain-HTTP proxy target. The sole non-public exceptions are the
- * exact local `http` origins enrolled or managed by Connect for this client.
- */
-export const resolvePlainHttpAddress = async (target, localForwardOrigins, resolveHost = defaultResolveHost) => {
-    for (const origin of localForwardOrigins) {
-        try {
-            const parsed = new URL(origin);
-            if (parsed.protocol === 'http:' &&
-                isLocalGatewayHostname(parsed.hostname) &&
-                target.host === parsed.host) {
-                return resolveLocalGatewayAddress(target.hostname, resolveHost);
-            }
-        }
-        catch {
-            /* invalid client config gets no exception */
-        }
-    }
-    return resolveForwardAddress(target.hostname, resolveHost);
-};
-/** Build the `x-anyray-metadata` value from base attribution + the app label. */
-export const buildMetadata = (attribution, appLabel) => {
-    const meta = {};
-    if (attribution?.user)
-        meta.user = attribution.user;
-    if (attribution?.team)
-        meta.team = attribution.team;
-    // The intercepted app becomes a filterable intent:<id> tag in the console.
-    meta.intent = appLabel;
-    meta.intentLabel = appLabel;
-    const entries = Object.entries(meta).filter(([, v]) => v);
-    return entries.length ? JSON.stringify(Object.fromEntries(entries)) : undefined;
-};
-/**
- * Build the gateway forward for a decrypted AI request. Pure + exported so the
- * header contract is unit-tested without a live TLS handshake.
- *
- * The upstream the gateway relays to is the ACTUAL host the app contacted
- * (`https://<host>`), not the allowlist's canonical host — so a per-plan Copilot
- * subdomain or a regional endpoint is preserved. The app's own Authorization is
- * kept as-is (the gateway forwards it to the provider); `x-anyray-*` control
- * headers carry the origin, attribution, and Anyray key.
- */
-export const buildGatewayForward = (input) => {
-    const headers = {};
-    for (const [name, value] of Object.entries(input.reqHeaders)) {
-        if (value === undefined)
-            continue;
-        const key = name.toLowerCase();
-        if (REQUEST_DROP.has(key))
-            continue;
-        // Never forward a control header the app somehow set — we set our own below.
-        if (key.startsWith('x-anyray-'))
-            continue;
-        headers[key] = Array.isArray(value) ? value.join(', ') : value;
-    }
-    headers[AGENT_HEADERS.ORIGIN_HOST] = `https://${input.host}`;
-    headers[AGENT_HEADERS.ORIGIN_PATH] = input.path;
-    headers[AGENT_HEADERS.APP] = input.appLabel;
-    const meta = buildMetadata(input.attribution, input.appLabel);
-    if (meta)
-        headers['x-anyray-metadata'] = meta;
-    // The app's Authorization stays put (the seat token the gateway relays); the
-    // Anyray key rides its own header so both authenticate the right hop.
-    if (input.clientKey)
-        headers['x-anyray-api-key'] = input.clientKey;
-    return {
-        url: `${input.gatewayOrigin.replace(/\/+$/, '')}${INTAKE_PATH}`,
-        headers,
-    };
-};
-const readBody = (req) => new Promise((resolve) => {
-    const chunks = [];
-    req.on('data', (c) => chunks.push(c));
-    req.on('end', () => resolve(Buffer.concat(chunks)));
-    req.on('error', () => resolve(Buffer.concat(chunks)));
-});
-/** Stream a fetch Response back to the client, minus runtime-owned headers. */
-const relayResponse = async (clientRes, upstream) => {
-    const headers = {};
-    upstream.headers.forEach((value, key) => {
-        if (!RESPONSE_DROP.has(key.toLowerCase()))
-            headers[key] = value;
-    });
-    clientRes.writeHead(upstream.status, headers);
-    if (!upstream.body) {
-        clientRes.end();
-        return;
-    }
-    const reader = upstream.body.getReader();
-    const onClientGone = () => void reader.cancel().catch(() => { });
-    clientRes.once('close', onClientGone);
-    try {
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            if (!value)
-                continue;
-            if (clientRes.destroyed) {
-                void reader.cancel().catch(() => { });
-                break;
-            }
-            if (!clientRes.write(value)) {
-                await new Promise((resolve) => {
-                    if (clientRes.destroyed || clientRes.writableEnded)
-                        return resolve();
-                    const done2 = () => {
-                        clientRes.off('drain', done2);
-                        clientRes.off('close', done2);
-                        resolve();
-                    };
-                    clientRes.once('drain', done2);
-                    clientRes.once('close', done2);
-                });
-            }
-        }
-    }
-    catch {
-        /* upstream aborted mid-stream */
-    }
-    finally {
-        clientRes.off('close', onClientGone);
-    }
-    if (!clientRes.writableEnded)
-        clientRes.end();
-};
-const sendError = (res, status, message) => {
-    if (res.headersSent) {
-        res.end();
-        return;
-    }
-    res.writeHead(status, { 'content-type': 'application/json' });
-    res.end(JSON.stringify({ error: { type: 'anyray_agent', message } }));
-};
-export const createInterceptProxy = (config) => {
-    const gatewayOrigin = config.gatewayOrigin.replace(/\/+$/, '');
-    const localForwardOrigins = [
-        gatewayOrigin,
-        ...(config.localForwardOrigins ?? []),
-    ];
-    const decide = config.decide ?? decideHost;
-    const mint = config.mintLeaf ?? mintLeaf;
-    const resolveHost = config.resolveHost ?? defaultResolveHost;
-    // The internal server that handles a DECRYPTED request after TLS termination.
-    // Each MITM'd socket is fed here via `emit('connection', tlsSocket)`; the host
-    // is stashed on the socket by the CONNECT handler.
-    const mitmServer = http.createServer((req, res) => {
-        void handleMitmRequest(req, res).catch((error) => {
-            console.error('anyray agent: forward error', error instanceof Error ? error.message : String(error));
-            sendError(res, 502, 'agent forward failed');
-        });
-    });
-    // Never bypass governance by dialing an intercepted AI origin directly. The
-    // gateway intake is request/response-only today, so reject upgrades until it
-    // has an explicitly metered WebSocket route.
-    mitmServer.on('upgrade', (_req, clientSocket) => {
-        clientSocket.end('HTTP/1.1 501 Not Implemented\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
-    });
-    const handleMitmRequest = async (req, res) => {
-        const sock = req.socket;
-        const host = sock._anyrayHost;
-        const appLabel = sock._anyrayApp ?? 'browser';
-        if (!host) {
-            sendError(res, 502, 'missing intercepted host');
-            return;
-        }
-        const method = req.method ?? 'GET';
-        const path = req.url ?? '/';
-        const body = await readBody(req);
-        const { url, headers } = buildGatewayForward({
-            gatewayOrigin,
-            host,
-            path,
-            appLabel,
-            reqHeaders: req.headers,
-            clientKey: config.clientKey,
-            attribution: config.attribution,
-        });
-        let upstream;
-        try {
-            upstream = await fetch(url, {
-                method,
-                headers,
-                body: body.length ? body : undefined,
-                duplex: 'half',
-            });
-        }
-        catch (error) {
-            console.error(`anyray agent: gateway ${gatewayOrigin} unreachable for ${host} — ${error instanceof Error ? error.message : String(error)}`);
-            sendError(res, 502, 'gateway unreachable');
-            return;
-        }
-        await relayResponse(res, upstream);
-    };
-    // The public proxy: handles CONNECT (HTTPS) and origin/absolute-form requests.
-    const server = http.createServer((req, res) => {
-        const url = req.url ?? '/';
-        // Direct health probe (a plain GET to the port, not proxied through us).
-        if (req.method === 'GET' && url === '/__anyray/health') {
-            res.writeHead(200, { 'content-type': 'application/json' });
-            res.end(JSON.stringify({
-                status: 'ok',
-                port: config.port,
-                gatewayOrigin,
-                mode: 'intercept',
-            }));
-            return;
-        }
-        // Plain-HTTP proxy request (absolute-form `http://` URL). AI traffic is
-        // HTTPS (→ CONNECT), so this is non-AI: forward it through untouched, never
-        // decrypt. We only accept `http://` here — an absolute-form `https://` would
-        // make http.request() throw synchronously (protocol mismatch), so it's
-        // rejected rather than crashing the daemon (https always arrives as CONNECT).
-        if (/^http:\/\//i.test(url)) {
-            void forwardPlainHttp(req, res);
-            return;
-        }
-        sendError(res, 400, 'anyray agent: unsupported request');
-    });
-    // HTTPS interception: the app issues `CONNECT host:443`.
-    server.on('connect', (req, clientSocket, head) => {
-        const [rawHost, rawPort] = (req.url ?? '').split(':');
-        const host = rawHost ?? '';
-        const port = Number(rawPort) || 443;
-        const decision = decide(host);
-        clientSocket.on('error', () => clientSocket.destroy());
-        if (!decision.mitm) {
-            tunnel(clientSocket, head, host, port);
-            return;
-        }
-        // A single bad handshake must NEVER crash the daemon — if it died, the OS
-        // proxy would be left pointing at a dead listener, trapping the machine.
-        // mitmConnect handles its own failures (pre-handshake → blind tunnel,
-        // post-handshake → destroy); this .catch() is the last-resort safety net so
-        // an unexpected rejection degrades one connection instead of the process.
-        mitmConnect(clientSocket, head, host, decision.entry).catch((error) => {
-            console.error(`anyray agent: intercept error for ${host} — ${error instanceof Error ? error.message : String(error)}`);
-            clientSocket.destroy();
-        });
-    });
-    /** Blind pass-through: pipe both directions, never decrypt (the invariant). */
-    const tunnel = (clientSocket, head, host, port) => {
-        const upstream = net.connect(port, host, () => {
-            clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-            if (head?.length)
-                upstream.write(head);
-            upstream.pipe(clientSocket);
-            clientSocket.pipe(upstream);
-        });
-        upstream.on('error', () => {
-            clientSocket.destroy();
-            upstream.destroy();
-        });
-        clientSocket.on('error', () => upstream.destroy());
-    };
-    /** Terminate TLS with a minted leaf, then feed the request to the MITM server. */
-    const mitmConnect = async (clientSocket, head, host, entry) => {
-        let leaf;
-        try {
-            leaf = await mint(host);
-        }
-        catch (error) {
-            // Can't mint (openssl missing / CA broken) — don't break the app: fall
-            // back to a blind tunnel so the request still reaches the provider.
-            console.error(`anyray agent: cert mint failed for ${host}, tunneling instead — ${error instanceof Error ? error.message : String(error)}`);
-            tunnel(clientSocket, head, host, 443);
-            return;
-        }
-        // Past this point we've committed to intercepting: the 200 is written and
-        // TLS is terminated locally. A failure here can't cleanly downgrade to a
-        // tunnel (the client already saw the 200), so it destroys the socket rather
-        // than throwing out of the async handler and risking the daemon.
-        try {
-            clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-            // Any bytes the client already sent (the start of its TLS ClientHello) were
-            // consumed off the raw socket by the CONNECT parse — put them BACK on the
-            // socket so the TLS layer reads them as part of the handshake. They are
-            // encrypted TLS bytes, NOT decrypted app data, so they must go through the
-            // TLSSocket, never be emitted as a plaintext 'data' event.
-            if (head?.length)
-                clientSocket.unshift(head);
-            const tlsSocket = new tls.TLSSocket(clientSocket, {
-                isServer: true,
-                key: leaf.key,
-                cert: leaf.cert,
-                // Force HTTP/1.1 — the internal http.Server can't speak h2. A client that
-                // offered h2 falls back to http/1.1 rather than failing the handshake.
-                ALPNProtocols: ['http/1.1'],
-            });
-            tlsSocket._anyrayHost =
-                host;
-            tlsSocket._anyrayApp =
-                entry?.app ?? 'browser';
-            tlsSocket.on('error', () => tlsSocket.destroy());
-            mitmServer.emit('connection', tlsSocket);
-        }
-        catch (error) {
-            console.error(`anyray agent: TLS termination failed for ${host} — ${error instanceof Error ? error.message : String(error)}`);
-            clientSocket.destroy();
-        }
-    };
-    /** Forward a plain-HTTP (non-AI) proxy request straight through, undecrypted. */
-    const forwardPlainHttp = async (req, res) => {
-        let target;
-        try {
-            target = new URL(req.url ?? '');
-        }
-        catch {
-            sendError(res, 400, 'bad proxy url');
-            return;
-        }
-        // Only http:// reaches here (the request handler filters), but guard anyway:
-        // http.request() throws synchronously on a non-http protocol, and any other
-        // sync throw here would take down the daemon.
-        if (target.protocol !== 'http:') {
-            sendError(res, 400, 'unsupported proxy protocol');
-            return;
-        }
-        let resolved;
-        try {
-            resolved = await resolvePlainHttpAddress(target, localForwardOrigins, resolveHost);
-        }
-        catch {
-            sendError(res, 502, 'upstream hostname could not be resolved');
-            return;
-        }
-        if (!resolved) {
-            sendError(res, 403, 'anyray agent: refusing to proxy to a non-forwardable host');
-            return;
-        }
-        try {
-            const headers = {
-                ...req.headers,
-                host: target.host,
-            };
-            delete headers['proxy-authorization'];
-            delete headers['proxy-connection'];
-            // `resolved.address` was resolved once and accepted as either globally
-            // routable or an exact configured loopback origin; the socket is pinned
-            // to that exact address.
-            const upstream = http.request(// lgtm[js/request-forgery]
-            {
-                protocol: 'http:',
-                hostname: resolved.address,
-                family: resolved.family,
-                port: target.port || 80,
-                path: `${target.pathname}${target.search}`,
-                method: req.method,
-                headers,
-            }, (up) => {
-                res.writeHead(up.statusCode ?? 502, up.headers);
-                up.pipe(res);
-            });
-            upstream.on('error', () => sendError(res, 502, 'upstream unreachable'));
-            req.pipe(upstream);
-        }
-        catch (error) {
-            console.error('anyray agent: plain-http forward failed —', error instanceof Error ? error.message : String(error));
-            sendError(res, 502, 'upstream unreachable');
-        }
-    };
-    return { server, mitmServer };
-};
-/**
- * True when forwarding decrypted traffic to `origin` is safe: https, or a
- * loopback host (where plaintext http never leaves the machine). A remote
- * plaintext-http gateway would put the app's decrypted prompts AND its session
- * token on the wire in the clear — unacceptable for a MITM capture agent.
- */
-export const isSafeGatewayOrigin = (origin) => {
-    try {
-        const { protocol, hostname } = new URL(origin);
-        if (protocol === 'https:')
-            return true;
-        return protocol === 'http:' && isLocalGatewayHostname(hostname);
-    }
-    catch {
-        return false;
-    }
-};
-/** OS-service entrypoint: load config from the profile, listen, run forever. */
-export const runAgentProxy = async () => {
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    const gatewayOrigin = profile.gateway?.replace(/\/+$/, '');
-    // Any fatal give-up BEFORE we're listening must revert the system proxy: the
-    // CLI pointed the OS at us before launching, so exiting without restoring
-    // would trap the machine behind a dead listener (fail-open, invariant #3).
-    // This covers a runtime CA failure / bad config at boot, when the supervisor
-    // relaunches us but the persisted system proxy still points at our port. We do
-    // NOT hook SIGTERM — the supervisor sends it on every normal restart, and
-    // reverting the proxy each time would fight the supervisor.
-    const failOpen = async (message) => {
-        console.error(`anyray agent: ${message}`);
-        try {
-            await restoreSystemProxy(port);
-        }
-        catch {
-            /* best-effort — nothing more we can do here */
-        }
-        return 1;
-    };
-    if (!gatewayOrigin) {
-        return failOpen('not configured (missing gateway in ~/.anyray). Run `anyray-connect` then `anyray-connect agent install`.');
-    }
-    if (!isSafeGatewayOrigin(gatewayOrigin)) {
-        return failOpen(`refusing to forward decrypted traffic to a plaintext gateway (${gatewayOrigin}) — ` +
-            'use an https:// gateway so session tokens never cross the network in the clear.');
-    }
-    // Warm the CA so the first interception doesn't pay generation latency (and
-    // fails loudly here if openssl is missing, rather than per-request).
-    try {
-        await ensureCa();
-    }
-    catch (error) {
-        return failOpen(`could not initialize the device CA — ${error instanceof Error ? error.message : String(error)}`);
-    }
-    const proxy = createInterceptProxy({
-        port,
-        gatewayOrigin,
-        localForwardOrigins: profile.fallbackEnabled === true && profile.fallbackPort
-            ? [`http://127.0.0.1:${profile.fallbackPort}`]
-            : undefined,
-        clientKey: profile.clientKey,
-        attribution: { user: profile.name, team: profile.team },
-    });
-    try {
-        await new Promise((resolve, reject) => {
-            proxy.server.once('error', reject);
-            proxy.server.listen(port, '127.0.0.1', () => {
-                console.error(`anyray agent proxy listening on 127.0.0.1:${port} → ${gatewayOrigin} (intercepting AI domains only)`);
-                resolve();
-            });
-        });
-    }
-    catch (error) {
-        return failOpen(`could not bind 127.0.0.1:${port} — ${error instanceof Error ? error.message : String(error)}`);
-    }
-    await new Promise(() => { });
-    return 0;
-};
-//# sourceMappingURL=agentProxy.js.map