billion-context 0.1.63-pr.345.199 → 0.1.63-pr.347.201

package/dist/index.js

@@ -53902,6 +53902,9 @@ var rootCert;
 var rootKey;
 var secureContextCache = /* @__PURE__ */ new Map();
 var SECURE_CONTEXT_CACHE_MAX = 64;
+function rootCaPath() {
+  return path7.join(caDir(), ROOT_CERT_FILE);
+}
 function collectSystemCaPems(env = process.env) {
   const pems = [];
   const seen = /* @__PURE__ */ new Set();
@@ -54536,6 +54539,15 @@ var DEFAULT_MITM_DOMAINS = [
   "chatgpt.com"
 ];
 var MITM_UPSTREAM_KEY = "__biliMitmUpstream";
+var warnedCertRejected = false;
+var CERT_REJECT_RE = /alert (?:certificate unknown|unknown ca|bad certificate|certificate expired|certificate revoked|unsupported certificate)/i;
+function noteMitmTlsError(host, port, message, log2) {
+  log2(`mitm ${maskHostForLog(host)}:${port} TLS error: ${message}`);
+  if (CERT_REJECT_RE.test(message) && !warnedCertRejected) {
+    warnedCertRejected = true;
+    log2(`mitm ${maskHostForLog(host)}:${port} client REJECTED the MITM certificate \u2014 it does not trust bili's root CA. Install it in the client's/system trust store, then restart the client. CA: ${rootCaPath()}`);
+  }
+}
 var MITM_HANDSHAKE_TIMEOUT_MS_DEFAULT = 1e4;
 function mitmHandshakeTimeoutMs() {
   const v2 = Number.parseInt(process.env.BILI_MITM_HANDSHAKE_TIMEOUT_MS ?? "", 10);
@@ -54601,6 +54613,7 @@ function tunnelThrough(clientSocket, host, port, head, log2, proxyUrl) {
     if (head.length > 0) upstream.write(head);
     upstream.pipe(clientSocket);
     clientSocket.pipe(upstream);
+    log2(`tunnel ${maskHostForLog(host)}:${port} established (blind TCP, not decrypted)`);
     const cleanup = (where, err2) => {
       log2(`tunnel ${maskHostForLog(host)}:${port} ${where} closed: ${maskHostInText(err2.message, host)}`);
       upstream.destroy();
@@ -54635,7 +54648,7 @@ function doMitm(server, clientSocket, host, port, head, log2) {
   }
   tlsSocket[MITM_UPSTREAM_KEY] = `https://${host}`;
   tlsSocket.on("error", (err2) => {
-    log2(`mitm ${maskHostForLog(host)}:${port} TLS error: ${err2.message}`);
+    noteMitmTlsError(host, port, err2.message, log2);
     tlsSocket.destroy();
     clientSocket.destroy();
   });
@@ -55752,6 +55765,11 @@ async function handle(req, res, opts, core, config, log2, instanceId) {
       return;
     }
   }
+  if (isAdminPath) {
+    res.writeHead(404, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: { type: "not_found", message: "no such management endpoint" } }));
+    return;
+  }
   let bodyBuffer;
   let urlPath;
   let responsesCompact;
@@ -55838,9 +55856,9 @@ ${bodyBuffer.toString("utf8")}`);
       const betaWindow = anthropicBetaContextWindow(req.headers);
       const pluginWindow = pluginReportedContextWindow(req.headers);
       const launcherWindow = launcherContextWindow(model);
-      const configuredWindow = resolveConfiguredContextLimit(opts.routes, embeddedUrl, model);
       const peekWindow = host ? peekRegistryContext(model, host) : void 0;
-      let native = betaWindow ?? pluginWindow ?? launcherWindow ?? configuredWindow ?? peekWindow ?? lookupContextLimit(model);
+      const configuredWindow = resolveConfiguredContextLimit(opts.routes, embeddedUrl, model);
+      let native = betaWindow ?? pluginWindow ?? launcherWindow ?? peekWindow ?? configuredWindow ?? lookupContextLimit(model);
       const operatorWindowTuned = resolveCompress(opts.routes, embeddedUrl, model, opts.compress).modelContextLimit !== void 0;
       nativeFromFallback = !betaWindow && !pluginWindow && !launcherWindow && !peekWindow && !configuredWindow && !operatorWindowTuned;
       if (!native && host) {