claude-mem-lite 6.22.1 → 6.23.2

package/lib/anthropic-base-url.mjs

@@ -0,0 +1,97 @@
+// lib/anthropic-base-url.mjs - one resolver for ANTHROPIC_BASE_URL.
+//
+// Two callers need the same answer and used to derive it differently:
+// haiku-client's callModelAPI builds the request URL from it, and
+// lib/llm-provider-probe.mjs picks the host + port doctor probes. When the two
+// disagree, doctor certifies a hop the product never uses - the false-green
+// shape this seam exists to remove. So the trim, the URL parse, and the
+// validity verdict live here and both sites read the same result.
+//
+// ANTHROPIC_BASE_URL is the Claude Code / Anthropic SDK convention: an origin
+// (+ optional /anthropic path on Azure Foundry) with NO /v1 suffix - callers
+// append the endpoint path. Unset or blank keeps the public API, which is the
+// behaviour before the gateway override existed.
+
+import net from 'node:net';
+
+const DEFAULT_ANTHROPIC_BASE_URL = 'https://api.anthropic.com';
+
+// Plain http:// is allowed only to loopback. Anywhere else it puts the
+// x-api-key on the wire unencrypted (and prompts in the clear), so that value
+// is refused rather than silently honoured.
+function isLoopbackHost(host) {
+  return (
+    host === 'localhost' ||
+    host.endsWith('.localhost') ||
+    host === '::1' ||
+    host === '[::1]' ||
+    // A real dotted-quad loopback, not a DNS name that merely starts "127."
+    // ("127.attacker.example" resolves wherever its owner says).
+    (net.isIP(host) === 4 && host.startsWith('127.'))
+  );
+}
+
+/**
+ * Resolve the configured base URL into a usable origin + path.
+ *
+ * Never throws and always returns a well-formed `url` a caller can append
+ * `/v1/messages` to: blank / unset keeps the public default, and a value that is
+ * set but unusable (unparseable, non-http(s) scheme, userinfo, a query string or
+ * fragment, or plain http to a non-loopback host) also returns the default so
+ * callers always get a parseable value. `error` names why; the direct API leg
+ * ignores the fallback and skips itself when a configured value is unusable, and
+ * doctor surfaces the same reason instead of probing a hop nothing uses.
+ *
+ * @returns {{url: string, configured: boolean, error: string|null}}
+ *   url        normalized origin+path, no trailing slash
+ *   configured ANTHROPIC_BASE_URL was set to a non-blank value
+ *   error      why a configured value is unusable, or null when it is fine
+ */
+export function resolveAnthropicBaseUrl() {
+  const raw = (process.env.ANTHROPIC_BASE_URL || '').trim();
+  if (!raw) return { url: DEFAULT_ANTHROPIC_BASE_URL, configured: false, error: null };
+
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return {
+      url: DEFAULT_ANTHROPIC_BASE_URL,
+      configured: true,
+      error: 'ANTHROPIC_BASE_URL is not a valid URL',
+    };
+  }
+  if (parsed.username || parsed.password) {
+    // fetch() refuses to build a request with credentials in the URL, so every
+    // call would fall back to the CLI while doctor reported the host reachable.
+    return {
+      url: DEFAULT_ANTHROPIC_BASE_URL,
+      configured: true,
+      error: 'ANTHROPIC_BASE_URL must not include userinfo (user:pass@)',
+    };
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    return {
+      url: DEFAULT_ANTHROPIC_BASE_URL,
+      configured: true,
+      error: `ANTHROPIC_BASE_URL must use http or https (got ${parsed.protocol})`,
+    };
+  }
+  // Raw string, not URL.search/hash: a bare trailing "?" or "#" leaves both
+  // empty while still swallowing the appended path into the query.
+  if (/[?#]/.test(raw)) {
+    return {
+      url: DEFAULT_ANTHROPIC_BASE_URL,
+      configured: true,
+      error: 'ANTHROPIC_BASE_URL must not include a query string or fragment',
+    };
+  }
+  if (parsed.protocol === 'http:' && !isLoopbackHost(parsed.hostname)) {
+    return {
+      url: DEFAULT_ANTHROPIC_BASE_URL,
+      configured: true,
+      error: `ANTHROPIC_BASE_URL uses plain http to a non-loopback host (${parsed.hostname}); the direct API leg will not send the API key there unencrypted, but the claude CLI fallback reads the same variable and still does`,
+    };
+  }
+  return { url: raw.replace(/\/+$/, ''), configured: true, error: null };
+}

package/lib/delete-core.mjs

@@ -86,6 +86,11 @@ export function deleteObservations(db, ids, { snapshotTag = 'pre-delete' } = {})
          WHERE superseded_by IN (${placeholders}) AND id NOT IN (${placeholders})`,
       )
       .run(...ids, ...ids).changes;
+    if (db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'search_results'").get()) {
+      db.prepare(
+        `UPDATE search_results SET snapshot_label = NULL WHERE source = 'obs' AND result_id IN (${placeholders})`,
+      ).run(...ids);
+    }
     // Execute deletion (FTS5 cleanup handled by the observations_ad trigger).
     const deleted = db.prepare(`DELETE FROM observations WHERE id IN (${placeholders})`).run(...ids);
     return { changes: deleted.changes, recovered, restoredSuperseded };

package/lib/llm-provider-probe.mjs

@@ -18,6 +18,7 @@ import net from 'node:net';
 import { accessSync, statSync, constants as fsConstants } from 'node:fs';
 import { join, delimiter } from 'node:path';
 import { httpConnectProxyFor, connectProbeViaProxy, redactProxyUrl } from './proxy-fetch.mjs';
+import { resolveAnthropicBaseUrl } from './anthropic-base-url.mjs';
 
 /**
  * Does `cmd` name an executable file — directly when it carries a path separator, else by a
@@ -45,6 +46,21 @@ function resolvesToExecutable(cmd, env = process.env) {
 
 const PROVIDER_HOST = { api: 'api.anthropic.com', openrouter: 'openrouter.ai' };
 
+/**
+ * Host and port the keyed provider actually serves from. The direct-API leg
+ * honours ANTHROPIC_BASE_URL (haiku-client's callModelAPI), so probing
+ * api.anthropic.com would certify a gateway deployment against a hop the
+ * product never uses - the same false-green shape the proxy seam below exists
+ * to avoid.
+ * @param {'api'|'openrouter'} mode
+ * @returns {{host: string, port: number}}
+ */
+function providerEndpoint(mode) {
+  if (mode !== 'api') return { host: PROVIDER_HOST[mode], port: 443 };
+  const u = new URL(resolveAnthropicBaseUrl().url);
+  return { host: u.hostname, port: u.port ? Number(u.port) : u.protocol === 'https:' ? 443 : 80 };
+}
+
 /**
  * Open and immediately close a TCP connection. No TLS, no request, no key.
  * @param {string} host
@@ -126,8 +142,30 @@ export async function llmProviderStatus({
     };
   }
 
-  const host = PROVIDER_HOST[mode];
-  const proxy = httpConnectProxyFor(`https://${host}/`);
+  // A set-but-unusable base URL is the always-unset variant of the false green:
+  // callModelAPI skips the direct leg entirely, so every keyed call falls back
+  // to the claude CLI and probing any host would just certify a hop nothing
+  // uses. Warn and stop instead of probing a hop the configuration does not
+  // describe.
+  const base = resolveAnthropicBaseUrl();
+  if (mode === 'api' && base.error) {
+    return {
+      mode,
+      level: 'warn',
+      message:
+        `LLM provider: ${base.error} - ` +
+        'the direct API leg is skipped and every background LLM call falls back to the ' +
+        'claude CLI, which starts a process per call; fix or unset ANTHROPIC_BASE_URL.',
+    };
+  }
+
+  const { host, port } = providerEndpoint(mode);
+  // Select the proxy off the SAME URL the product calls, so doctor exercises the
+  // hop the direct leg actually takes. A plain http gateway (loopback) bypasses
+  // the TLS-only tunnel in the product, so it must bypass it here too or doctor
+  // reports "via proxy" for a request that never touches one.
+  const proxyTarget = mode === 'api' ? `${base.url}/` : `https://${host}/`;
+  const proxy = httpConnectProxyFor(proxyTarget);
   // Report the hop actually exercised. When a proxy is configured the request
   // path is node → proxy → host, so probing the host directly would answer a
   // question the product never asks — and on a machine where only the proxy is
@@ -142,7 +180,11 @@ export async function llmProviderStatus({
     // occupied": a plain TCP connect passes against a SOCKS-only listener or a
     // proxy that forbids CONNECT, and doctor would then certify a dead
     // provider. (pre-tag review)
-    result = proxy ? await _proxyProbe(proxy, host, { timeout: 4000 }) : await _probe(host, { port: 443 });
+    // URL.hostname keeps an IPv6 literal's brackets, which CONNECT needs ([::1]:443) and
+    // net.connect cannot resolve (ENOTFOUND), so only the direct probe drops them.
+    result = proxy
+      ? await _proxyProbe(proxy, host, { timeout: 4000, port })
+      : await _probe(host.replace(/^\[|\]$/g, ''), { port });
   } catch (e) {
     result = { reachable: false, error: e?.message || String(e) };
   }

package/lib/proxy-fetch.mjs

@@ -21,6 +21,7 @@
 
 import http from 'node:http';
 import https from 'node:https';
+import net from 'node:net';
 import tls from 'node:tls';
 
 /**
@@ -35,18 +36,61 @@ export function httpConnectProxyFor(targetUrl) {
     process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy;
   if (!proxy || !/^https?:\/\//.test(proxy)) return null; // socks5 ALL_PROXY not supported here
   try {
-    const host = new URL(targetUrl).hostname;
-    const noProxy = (process.env.NO_PROXY || process.env.no_proxy || '')
-      .split(',')
-      .map((s) => s.trim())
-      .filter(Boolean);
-    if (noProxy.some((n) => n === host || (n.startsWith('.') && host.endsWith(n.slice(1))))) return null;
+    const target = new URL(targetUrl);
+    // The tunnel below is TLS-only (https.request + tls.connect). A plain
+    // http:// target must NOT take it: the CONNECT succeeds, then the request
+    // throws ERR_INVALID_PROTOCOL from inside an event handler, past the
+    // caller's try/catch, and takes the process (MCP server included) down.
+    // Native fetch handles http directly, so the caller keeps that path.
+    if (target.protocol !== 'https:') return null;
+    const noProxy = process.env.NO_PROXY || process.env.no_proxy || '';
+    if (noProxyMatches(target.hostname, Number(target.port) || 443, noProxy)) return null;
     return proxy;
   } catch {
     return null;
   }
 }
 
+/**
+ * Does a NO_PROXY list exempt this host? NO_PROXY has no standard (survey:
+ * about.gitlab.com/blog/we-need-to-talk-no-proxy). Every common client suffix-matches a
+ * name; beyond that they disagree, so for names and ports this accepts the UNION of the
+ * forms curl, Python and Go accept, and it can exempt a host one of them would still
+ * proxy. Case-insensitive; a '*' entry exempts every host (Go); a name entry covers itself
+ * and every subdomain on a '.' boundary, with or without a leading '.' (curl, Python) or
+ * '*.' (Go); an optional :port narrows the entry to that port (Python, Go); IPv6 with or
+ * without brackets. Narrower than the union: an IP entry matches only the canonical
+ * spelling URL.hostname uses, never as a suffix (Python suffix-matches IPs), no CIDR
+ * (curl, Go), no IDN-to-xn-- conversion (Go), no DNS lookups. NO_PROXY is read before
+ * no_proxy; curl, Python and Go (golang.org/x/net/http/httpproxy) read no_proxy first.
+ * @param {string} hostname URL.hostname (lowercase; IPv6 bracketed)
+ * @param {number} port effective target port
+ * @param {string} list raw NO_PROXY value
+ * @returns {boolean}
+ */
+function noProxyMatches(hostname, port, list) {
+  const host = hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '');
+  for (const raw of list.split(',')) {
+    let entry = raw.trim().toLowerCase();
+    if (!entry) continue;
+    if (entry === '*') return true;
+    let entryPort = null;
+    const bracketed = /^\[([^\]]+)\](?::(\d+))?$/.exec(entry);
+    if (bracketed) {
+      entry = bracketed[1];
+      entryPort = bracketed[2] ?? null;
+    } else if (entry.split(':').length === 2) {
+      [entry, entryPort] = entry.split(':');
+    }
+    if (entryPort !== null && Number(entryPort) !== port) continue;
+    entry = entry.replace(/^\*?\./, '').replace(/\.$/, '');
+    if (!entry) continue;
+    if (host === entry) return true;
+    if (!net.isIP(host) && host.endsWith(`.${entry}`)) return true;
+  }
+  return false;
+}
+
 /**
  * Proxy-Authorization header for a proxy URL that carries credentials, or {} when it does
  * not. R10 P2-14.
@@ -173,6 +217,13 @@ export function onceViaConnectProxy(
     } catch (e) {
       return reject(e);
     }
+    // TLS-only: reject here, synchronously, rather than let https.request throw
+    // ERR_INVALID_PROTOCOL inside the CONNECT callback where no caller can see
+    // it. httpConnectProxyFor already declines http targets; this is the second
+    // lock on the same door for any direct caller. (pre-tag review on #33)
+    if (t.protocol !== 'https:') {
+      return reject(new Error(`CONNECT tunnel supports https targets only (got ${t.protocol})`));
+    }
     const port = Number(t.port) || 443;
     let settled = false;
     const finish = (fn, arg) => {
@@ -220,11 +271,24 @@ export function onceViaConnectProxy(
         socket.destroy();
         return finish(reject, new Error(`proxy CONNECT ${res.statusCode}`));
       }
+      // SNI carries DNS names only: Node throws ERR_INVALID_ARG_VALUE for an IP
+      // servername, and a base URL (#33) can be an IP literal. `host` still drives
+      // the certificate identity check, brackets stripped for IPv6.
+      const tlsHost = t.hostname.replace(/^\[|\]$/g, '');
+      const sni = net.isIP(tlsHost) ? {} : { servername: tlsHost };
       const req = https.request(
         url,
-        { method, headers, createConnection: () => tls.connect({ socket, servername: t.hostname }) },
+        { method, headers, createConnection: () => tls.connect({ socket, host: tlsHost, ...sni }) },
         (resp) => {
           const chunks = [];
+          // A connection dropped mid-body destroys the response without 'end' (and
+          // emits 'error' only to a listener), but 'close' always fires. Without this
+          // the call stayed pending until the unref'd overall timer, so an otherwise
+          // idle worker exited with it unsettled and its caller's fallback never ran.
+          // Native fetch rejects here too.
+          resp.on('close', () => {
+            if (!resp.complete) finish(reject, new Error('proxy response closed before the body ended'));
+          });
           resp.on('data', (c) => chunks.push(Buffer.from(c)));
           resp.on('end', () => {
             const buf = Buffer.concat(chunks);