billion-context 0.1.53-pr.239.81 → 0.1.53-pr.239.86

package/README.md

@@ -148,6 +148,23 @@ bili --no-auto-update        # disable self-update for this run
 
 Flags override env vars and the config file. `bili --help` lists them all.
 
+### Remote agents (`--host`)
+
+By default the proxy binds `127.0.0.1` and only accepts loopback
+connections. To serve agents on other machines, bind a non-loopback host:
+
+```bash
+bili --host 0.0.0.0           # all interfaces (or use your LAN IP)
+```
+
+- Remote agents point their model `baseURL` at `http://<this-host>:<port>/bili/…`.
+- MITM-mode `CONNECT` then also accepts remote clients — for **whitelisted
+  model hosts only**. Blind tunnels to arbitrary hosts stay loopback-only, so
+  the proxy can never be used as an open relay.
+- There is **no authentication**: only do this on a trusted LAN or behind a
+  firewall. The `/__bili/` management endpoints remain loopback-only.
+- A startup `[security]` warning reminds you of the above.
+
 ### Debugging
 
 Three ways to enable verbose logging (priority: flag > env > config):

package/README.zh-CN.md

@@ -133,6 +133,21 @@ bili --no-auto-update        # 本次启动禁用自动更新
 
 参数优先级高于环境变量和配置文件。`bili --help` 列出全部。
 
+### 远程 agent（`--host`）
+
+默认绑定 `127.0.0.1`，只接受本机连接。要给其他机器上的 agent 用，绑定非 loopback 地址:
+
+```bash
+bili --host 0.0.0.0           # 所有网卡(或直接用局域网 IP)
+```
+
+- 远程 agent 把模型 `baseURL` 指向 `http://<本机IP>:<端口>/bili/…`。
+- MITM 模式的 `CONNECT` 也会接受远程客户端 —— 但仅限**白名单内的模型域名**;
+  到任意主机的盲隧道仍仅限本机，代理不会沦为开放中继。
+- **没有任何鉴权**: 只应在可信局域网或防火墙内使用。`/__bili/` 管理
+  端点仍仅限本机访问。
+- 启动时的 `[security]` 警告会提醒上述事项。
+
 ### 调试
 
 三种方式打开详细日志(优先级:参数 > 环境变量 > 配置):

package/dist/index.js

@@ -53228,17 +53228,23 @@ function isMitmHost(host, extraDomains = []) {
   return all.some((d) => h === d || h.endsWith("." + d));
 }
 function setupMitm(server, extraDomains = [], log2 = () => {
-}, resolveProxyUrl) {
+}, resolveProxyUrl, allowRemoteClients = false) {
   ensureRootCA();
   server.on("connect", (req, clientSocket, head) => {
-    if (!isLoopbackAddress(clientSocket.remoteAddress)) {
-      log2(`CONNECT ${req.url} rejected: non-loopback client ${clientSocket.remoteAddress}`);
+    const remote = !isLoopbackAddress(clientSocket.remoteAddress);
+    if (remote && !allowRemoteClients) {
+      log2(`CONNECT ${req.url} rejected: non-loopback client ${clientSocket.remoteAddress} (bind a non-loopback --host to allow remote clients)`);
       clientSocket.end("HTTP/1.1 403 Forbidden\r\n\r\n");
       return;
     }
     const { hostname, port } = parseHostPort(req.url ?? "");
     const targetPort = port || 443;
     if (!isMitmHost(hostname, extraDomains)) {
+      if (remote) {
+        log2(`CONNECT ${req.url} rejected: remote client ${clientSocket.remoteAddress} tunneling non-whitelisted host`);
+        clientSocket.end("HTTP/1.1 403 Forbidden\r\n\r\n");
+        return;
+      }
       const proxyUrl = resolveProxyUrl?.(hostname);
       tunnelThrough(clientSocket, hostname, targetPort, head, log2, proxyUrl);
       return;
@@ -54158,10 +54164,12 @@ Content-Length: ${Buffer.byteLength(body)}\r
     );
   });
   if (opts.mitm.enabled) {
-    setupMitm(server, opts.mitm.domains, (msg) => log2("info", msg), (host) => resolveProxy(opts.routes, opts.proxy, `https://${host}`, opts.proxyFallback));
+    const allowRemoteConnect = opts.host === "0.0.0.0" || opts.host === "::" || !isLoopbackAddress(opts.host);
+    setupMitm(server, opts.mitm.domains, (msg) => log2("info", msg), (host) => resolveProxy(opts.routes, opts.proxy, `https://${host}`, opts.proxyFallback), allowRemoteConnect);
   }
   server.listen(opts.port, opts.host, () => {
-    const displayHost = opts.host === "0.0.0.0" ? "localhost" : opts.host;
+    const nonLoopbackBind = opts.host === "0.0.0.0" || opts.host === "::" || !isLoopbackAddress(opts.host);
+    const displayHost = nonLoopbackBind ? opts.host : opts.host === "0.0.0.0" ? "localhost" : opts.host;
     try {
       fs6.mkdirSync(stateDir(), { recursive: true });
       const originHost = opts.host === "0.0.0.0" || opts.host === "::" || opts.host === "localhost" ? "127.0.0.1" : opts.host.includes(":") && !opts.host.startsWith("[") ? `[${opts.host}]` : opts.host;
@@ -54174,6 +54182,12 @@ Content-Length: ${Buffer.byteLength(body)}\r
       "info",
       `acp-proxy listening on http://${displayHost}:${opts.port} \u2014 web UI: http://${displayHost}:${opts.port}/__bili/ \u2014 zero-config: prefix any baseURL with http://${displayHost}:${opts.port}/bili/` + (nOverrides ? ` \u2014 context overrides for ${nOverrides} upstream URL(s)` : "") + (opts.mitm.enabled ? ` \u2014 MITM proxy on (whitelist)${opts.mitm.domains.length ? ` +${opts.mitm.domains.join(",")}` : ""}` : "")
     );
+    if (nonLoopbackBind) {
+      log2(
+        "warn",
+        `[security] bound to ${opts.host} \u2014 proxy endpoints (/bili/, CONNECT for whitelisted model hosts) are reachable from the network with NO authentication; /__bili/ management endpoints stay loopback-only. Restrict access with a firewall on untrusted networks. Remote agents: point baseURL at http://<this-host>:${opts.port}/bili/`
+      );
+    }
     if (opts.debug) {
       log2("info", `[debug] build features: raw-HTTP-capture(on) | remote_compaction_v2-strip(on) | cert-MITM-launcher(on) | strip-acp-summary(on) \u2014 seeing this line confirms the launcher build (not registry 0.1.34)`);
     }