claude-use 5.1.0 → 5.2.0

package/dist/index.cjs

@@ -1828,12 +1828,283 @@ function recoveryDiagnostics(recovery, identity) {
 }
 
 // src/frontdoor/connect.ts
+var import_node_crypto3 = require("node:crypto");
 var fs = __toESM(require("node:fs"), 1);
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
-var net = __toESM(require("node:net"), 1);
+var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
-var import_node_forge = __toESM(require("node-forge"), 1);
+
+// src/frontdoor/x509.ts
+var import_node_crypto2 = require("node:crypto");
+var import_node_net = __toESM(require("node:net"), 1);
+var TAG_BOOLEAN = 1;
+var TAG_INTEGER = 2;
+var TAG_BIT_STRING = 3;
+var TAG_OCTET_STRING = 4;
+var TAG_NULL = 5;
+var TAG_OID = 6;
+var TAG_UTF8_STRING = 12;
+var TAG_UTC_TIME = 23;
+var TAG_GENERALIZED_TIME = 24;
+var TAG_SEQUENCE = 48;
+var TAG_SET = 49;
+var TAG_VERSION = 160;
+var TAG_EXTENSIONS = 163;
+var TAG_GENERAL_NAME_DNS = 130;
+var TAG_GENERAL_NAME_IP = 135;
+var TAG_KEY_IDENTIFIER = 128;
+var OID_COMMON_NAME = "2.5.4.3";
+var OID_SHA256_WITH_RSA = "1.2.840.113549.1.1.11";
+var OID_SUBJECT_KEY_IDENTIFIER = "2.5.29.14";
+var OID_KEY_USAGE = "2.5.29.15";
+var OID_SUBJECT_ALT_NAME = "2.5.29.17";
+var OID_BASIC_CONSTRAINTS = "2.5.29.19";
+var OID_AUTHORITY_KEY_IDENTIFIER = "2.5.29.35";
+var OID_EXT_KEY_USAGE = "2.5.29.37";
+var OID_SERVER_AUTH = "1.3.6.1.5.5.7.3.1";
+var VERSION_3 = 2;
+var SERIAL_NUMBER_BYTES = 16;
+var RSA_MODULUS_BITS = 2048;
+var BITS_PER_BYTE = 8;
+var BYTE_MASK = 255;
+var HIGH_BIT = 128;
+var BASE_128_PAYLOAD_MASK = 127;
+var FIRST_ARC_WEIGHT = 40;
+var SHORT_FORM_MAX_LENGTH = 127;
+var MS_PER_SECOND = 1e3;
+var UTC_TIME_LAST_YEAR = 2049;
+var YEAR_DIGITS = 4;
+var TWO_DIGIT_YEAR_DIGITS = 2;
+var COMPACT_TIME_DIGITS = 14;
+var KEY_USAGE = { digitalSignature: 0, keyEncipherment: 2, keyCertSign: 5, cRLSign: 6 };
+function tlv(tag, content) {
+  const length = content.length;
+  if (length <= SHORT_FORM_MAX_LENGTH) {
+    return Buffer.concat([Buffer.from([tag, length]), content]);
+  }
+  const lengthBytes = [];
+  for (let remaining = length; remaining > 0; remaining = Math.floor(remaining / (BYTE_MASK + 1))) {
+    lengthBytes.unshift(remaining & BYTE_MASK);
+  }
+  return Buffer.concat([Buffer.from([tag, HIGH_BIT | lengthBytes.length, ...lengthBytes]), content]);
+}
+function sequence(...parts) {
+  return tlv(TAG_SEQUENCE, Buffer.concat(parts));
+}
+function unsignedInteger(magnitude) {
+  let start = 0;
+  while (start < magnitude.length - 1 && magnitude[start] === 0) {
+    start += 1;
+  }
+  const trimmed = magnitude.subarray(start);
+  const first = trimmed[0];
+  const padded = first !== void 0 && (first & HIGH_BIT) !== 0 ? Buffer.concat([Buffer.from([0]), trimmed]) : Buffer.from(trimmed);
+  return tlv(TAG_INTEGER, padded);
+}
+function smallInteger(value) {
+  return unsignedInteger(Buffer.from([value]));
+}
+function oid(dotted) {
+  const arcs = dotted.split(".").map(Number);
+  const [first, second, ...rest] = arcs;
+  if (first === void 0 || second === void 0 || arcs.some((arc) => !Number.isInteger(arc) || arc < 0)) {
+    throw new Error(`invalid object identifier ${dotted}`);
+  }
+  const encoded = [];
+  for (const arc of [first * FIRST_ARC_WEIGHT + second, ...rest]) {
+    const groups = [arc & BASE_128_PAYLOAD_MASK];
+    for (let remaining = Math.floor(arc / HIGH_BIT); remaining > 0; remaining = Math.floor(remaining / HIGH_BIT)) {
+      groups.unshift(remaining & BASE_128_PAYLOAD_MASK | HIGH_BIT);
+    }
+    encoded.push(...groups);
+  }
+  return tlv(TAG_OID, Buffer.from(encoded));
+}
+function boolean(value) {
+  return tlv(TAG_BOOLEAN, Buffer.from([value ? BYTE_MASK : 0]));
+}
+function octetString(content) {
+  return tlv(TAG_OCTET_STRING, content);
+}
+function wholeBitString(content) {
+  return tlv(TAG_BIT_STRING, Buffer.concat([Buffer.from([0]), content]));
+}
+function time(instant) {
+  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND) * MS_PER_SECOND).toISOString();
+  const compact = `${iso.replace(/[-:T]/g, "").slice(0, COMPACT_TIME_DIGITS)}Z`;
+  if (instant.getUTCFullYear() > UTC_TIME_LAST_YEAR) {
+    return tlv(TAG_GENERALIZED_TIME, Buffer.from(compact, "ascii"));
+  }
+  return tlv(TAG_UTC_TIME, Buffer.from(compact.slice(YEAR_DIGITS - TWO_DIGIT_YEAR_DIGITS), "ascii"));
+}
+function commonNameOnly(commonName) {
+  return sequence(tlv(TAG_SET, sequence(oid(OID_COMMON_NAME), tlv(TAG_UTF8_STRING, Buffer.from(commonName, "utf8")))));
+}
+var SIGNATURE_ALGORITHM = sequence(oid(OID_SHA256_WITH_RSA), tlv(TAG_NULL, Buffer.alloc(0)));
+function extension(extensionOid, critical, value) {
+  return sequence(oid(extensionOid), ...critical ? [boolean(true)] : [], octetString(value));
+}
+function keyUsageExtension(bits) {
+  const highest = Math.max(...bits);
+  const byteCount = Math.floor(highest / BITS_PER_BYTE) + 1;
+  const bytes = Buffer.alloc(byteCount);
+  for (const bit of bits) {
+    const index = Math.floor(bit / BITS_PER_BYTE);
+    bytes[index] = (bytes[index] ?? 0) | HIGH_BIT >> bit % BITS_PER_BYTE;
+  }
+  const unusedBits = BITS_PER_BYTE - 1 - highest % BITS_PER_BYTE;
+  return extension(OID_KEY_USAGE, true, tlv(TAG_BIT_STRING, Buffer.concat([Buffer.from([unusedBits]), bytes])));
+}
+var IPV6_GROUPS = 8;
+var HEX_RADIX = 16;
+var BYTES_PER_IPV6_GROUP = 2;
+function ipv6Groups(address) {
+  const [head = "", tail] = address.split("::");
+  const split = (text) => text === "" ? [] : text.split(":");
+  const expand = (groups) => groups.flatMap((group) => {
+    if (!import_node_net.default.isIPv4(group)) {
+      return [Number.parseInt(group, HEX_RADIX)];
+    }
+    const [a = 0, b = 0, c = 0, d = 0] = group.split(".").map(Number);
+    return [a * (BYTE_MASK + 1) + b, c * (BYTE_MASK + 1) + d];
+  });
+  const before = expand(split(head));
+  const after = tail === void 0 ? [] : expand(split(tail));
+  const filler = tail === void 0 ? [] : Array.from({ length: IPV6_GROUPS - before.length - after.length }, () => 0);
+  return [...before, ...filler, ...after];
+}
+function ipBytes(address) {
+  if (import_node_net.default.isIPv4(address)) {
+    return Buffer.from(address.split(".").map(Number));
+  }
+  if (!import_node_net.default.isIPv6(address)) {
+    throw new Error(`${address} is not an IP address`);
+  }
+  const bytes = Buffer.alloc(IPV6_GROUPS * BYTES_PER_IPV6_GROUP);
+  ipv6Groups(address).forEach((group, index) => {
+    bytes.writeUInt16BE(group, index * BYTES_PER_IPV6_GROUP);
+  });
+  return bytes;
+}
+function keyIdentifier(publicKey) {
+  return (0, import_node_crypto2.createHash)("sha1").update(publicKey.export({ type: "pkcs1", format: "der" })).digest();
+}
+function readElement(buffer, offset) {
+  const tag = buffer[offset];
+  const first = buffer[offset + 1];
+  if (tag === void 0 || first === void 0) {
+    throw new Error("truncated DER");
+  }
+  let length = first;
+  let contentStart = offset + 2;
+  if ((first & HIGH_BIT) !== 0) {
+    const count = first & BASE_128_PAYLOAD_MASK;
+    length = 0;
+    for (let index = 0; index < count; index += 1) {
+      length = length * (BYTE_MASK + 1) + (buffer[offset + 2 + index] ?? 0);
+    }
+    contentStart = offset + 2 + count;
+  }
+  return { tag, start: offset, contentStart, end: contentStart + length };
+}
+function subjectNameOf(certificateDer) {
+  const certificate = readElement(certificateDer, 0);
+  let cursor = readElement(certificateDer, certificate.contentStart);
+  const tbsEnd = cursor.end;
+  cursor = readElement(certificateDer, cursor.contentStart);
+  if (cursor.tag === TAG_VERSION) {
+    cursor = readElement(certificateDer, cursor.end);
+  }
+  const fieldsBeforeSubject = 4;
+  for (let skipped = 1; skipped < fieldsBeforeSubject; skipped += 1) {
+    cursor = readElement(certificateDer, cursor.end);
+  }
+  const subject = readElement(certificateDer, cursor.end);
+  if (subject.end > tbsEnd) {
+    throw new Error("certificate has no subject");
+  }
+  return Buffer.from(certificateDer.subarray(subject.start, subject.end));
+}
+function toPem(label, der) {
+  const body = Buffer.from(der).toString("base64").match(/.{1,64}/g) ?? [];
+  return `-----BEGIN ${label}-----
+${body.join("\n")}
+-----END ${label}-----
+`;
+}
+function randomSerial() {
+  const bytes = (0, import_node_crypto2.randomBytes)(SERIAL_NUMBER_BYTES);
+  bytes[0] = (bytes[0] ?? 0) & BASE_128_PAYLOAD_MASK | HIGH_BIT >> 1;
+  return bytes;
+}
+function assemble(spec) {
+  const tbs = sequence(
+    tlv(TAG_VERSION, smallInteger(VERSION_3)),
+    unsignedInteger(randomSerial()),
+    SIGNATURE_ALGORITHM,
+    spec.issuerName,
+    sequence(time(spec.notBefore), time(spec.notAfter)),
+    spec.subjectName,
+    spec.subjectPublicKey.export({ type: "spki", format: "der" }),
+    tlv(TAG_EXTENSIONS, sequence(...spec.extensions))
+  );
+  const signature = (0, import_node_crypto2.sign)("sha256", tbs, spec.signingKey);
+  return sequence(tbs, SIGNATURE_ALGORITHM, wholeBitString(signature));
+}
+function subjectKeyIdentifierExtension(publicKey) {
+  return extension(OID_SUBJECT_KEY_IDENTIFIER, false, octetString(keyIdentifier(publicKey)));
+}
+function basicConstraintsExtension(isCa) {
+  return extension(OID_BASIC_CONSTRAINTS, true, sequence(...isCa ? [boolean(true)] : []));
+}
+function rsaKeyPair() {
+  return (0, import_node_crypto2.generateKeyPairSync)("rsa", { modulusLength: RSA_MODULUS_BITS });
+}
+function keyPem(privateKey) {
+  return privateKey.export({ type: "pkcs8", format: "pem" });
+}
+function issueCaCertificate(commonName, notBefore, notAfter) {
+  const { publicKey, privateKey } = rsaKeyPair();
+  const name = commonNameOnly(commonName);
+  const der = assemble({
+    subjectPublicKey: publicKey,
+    subjectName: name,
+    issuerName: name,
+    signingKey: privateKey,
+    notBefore,
+    notAfter,
+    extensions: [basicConstraintsExtension(true), keyUsageExtension([KEY_USAGE.keyCertSign, KEY_USAGE.cRLSign]), subjectKeyIdentifierExtension(publicKey)]
+  });
+  return { certPem: toPem("CERTIFICATE", der), keyPem: keyPem(privateKey) };
+}
+function issueLeafCertificate(ca, names, notBefore, notAfter) {
+  const [commonName] = names;
+  if (commonName === void 0) {
+    throw new Error("a leaf certificate needs at least one name");
+  }
+  const caCertificate = new import_node_crypto2.X509Certificate(ca.certPem);
+  const caPrivateKey = (0, import_node_crypto2.createPrivateKey)(ca.keyPem);
+  const { publicKey, privateKey } = rsaKeyPair();
+  const generalNames = names.map((name) => import_node_net.default.isIP(name) === 0 ? tlv(TAG_GENERAL_NAME_DNS, Buffer.from(name, "ascii")) : tlv(TAG_GENERAL_NAME_IP, ipBytes(name)));
+  const der = assemble({
+    subjectPublicKey: publicKey,
+    subjectName: commonNameOnly(commonName),
+    issuerName: subjectNameOf(caCertificate.raw),
+    signingKey: caPrivateKey,
+    notBefore,
+    notAfter,
+    extensions: [
+      basicConstraintsExtension(false),
+      keyUsageExtension([KEY_USAGE.digitalSignature, KEY_USAGE.keyEncipherment]),
+      extension(OID_EXT_KEY_USAGE, false, sequence(oid(OID_SERVER_AUTH))),
+      extension(OID_SUBJECT_ALT_NAME, false, sequence(...generalNames)),
+      subjectKeyIdentifierExtension(publicKey),
+      extension(OID_AUTHORITY_KEY_IDENTIFIER, false, sequence(tlv(TAG_KEY_IDENTIFIER, keyIdentifier(caCertificate.publicKey))))
+    ]
+  });
+  return { certPem: toPem("CERTIFICATE", der), keyPem: keyPem(privateKey) };
+}
 
 // src/frontdoor/capability.ts
 var CONNECT_PROXY_REALM = "claude-use front door";
@@ -2036,7 +2307,6 @@ var CONNECT_INTERCEPT_HOST = "api.anthropic.com";
 var ROUTED_PATH_PREFIX = "/v1/";
 var HTTPS_PORT = 443;
 var MAX_PORT = 65535;
-var SERIAL_NUMBER_BYTES = 16;
 var HTTP_BAD_GATEWAY = 502;
 var CA_KEY_FILE_MODE = 384;
 var CONNECT_LINE_TOKENS = 3;
@@ -2108,50 +2378,10 @@ function forwardableHeaders(headers) {
   return result;
 }
 function generateCa(now) {
-  const keys = import_node_forge.default.pki.rsa.generateKeyPair({ bits: 2048 });
-  const cert = import_node_forge.default.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = import_node_forge.default.util.bytesToHex(import_node_forge.default.random.getBytesSync(SERIAL_NUMBER_BYTES));
-  cert.validity.notBefore = new Date(now.getTime() - MS_PER_DAY);
-  cert.validity.notAfter = new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY);
-  const subject = [{ name: "commonName", value: CA_SUBJECT_COMMON_NAME }];
-  cert.setSubject(subject);
-  cert.setIssuer(subject);
-  cert.setExtensions([
-    { name: "basicConstraints", cA: true, critical: true },
-    { name: "keyUsage", keyCertSign: true, cRLSign: true, critical: true },
-    { name: "subjectKeyIdentifier" }
-  ]);
-  cert.sign(keys.privateKey, import_node_forge.default.md.sha256.create());
-  return { certPem: import_node_forge.default.pki.certificateToPem(cert), keyPem: import_node_forge.default.pki.privateKeyToPem(keys.privateKey) };
-}
-var SAN_TYPE_DNS = 2;
-var SAN_TYPE_IP = 7;
+  return issueCaCertificate(CA_SUBJECT_COMMON_NAME, new Date(now.getTime() - MS_PER_DAY), new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY));
+}
 function mintLeaf(ca, names, now) {
-  const [commonName] = names;
-  if (commonName === void 0) {
-    throw new Error("a leaf certificate needs at least one name");
-  }
-  const caCert = import_node_forge.default.pki.certificateFromPem(ca.certPem);
-  const caKey = import_node_forge.default.pki.privateKeyFromPem(ca.keyPem);
-  const keys = import_node_forge.default.pki.rsa.generateKeyPair({ bits: 2048 });
-  const cert = import_node_forge.default.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = import_node_forge.default.util.bytesToHex(import_node_forge.default.random.getBytesSync(SERIAL_NUMBER_BYTES));
-  cert.validity.notBefore = new Date(now.getTime() - MS_PER_DAY);
-  cert.validity.notAfter = new Date(now.getTime() + LEAF_VALIDITY_DAYS * MS_PER_DAY);
-  cert.setSubject([{ name: "commonName", value: commonName }]);
-  cert.setIssuer(caCert.subject.attributes);
-  cert.setExtensions([
-    { name: "basicConstraints", cA: false, critical: true },
-    { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
-    { name: "extKeyUsage", serverAuth: true },
-    { name: "subjectAltName", altNames: names.map((name) => net.isIP(name) === 0 ? { type: SAN_TYPE_DNS, value: name } : { type: SAN_TYPE_IP, ip: name }) },
-    { name: "subjectKeyIdentifier" },
-    { name: "authorityKeyIdentifier", keyLocatorFields: [] }
-  ]);
-  cert.sign(caKey, import_node_forge.default.md.sha256.create());
-  return { certPem: import_node_forge.default.pki.certificateToPem(cert), keyPem: import_node_forge.default.pki.privateKeyToPem(keys.privateKey) };
+  return issueLeafCertificate(ca, names, new Date(now.getTime() - MS_PER_DAY), new Date(now.getTime() + LEAF_VALIDITY_DAYS * MS_PER_DAY));
 }
 function createLeafCache(ca, now) {
   const cache = /* @__PURE__ */ new Map();
@@ -2176,8 +2406,8 @@ function ensureCa(store, generate) {
 }
 function caParses(ca) {
   try {
-    import_node_forge.default.pki.certificateFromPem(ca.certPem);
-    import_node_forge.default.pki.privateKeyFromPem(ca.keyPem);
+    new import_node_crypto3.X509Certificate(ca.certPem);
+    (0, import_node_crypto3.createPrivateKey)(ca.keyPem);
     return true;
   } catch {
     return false;
@@ -2383,7 +2613,7 @@ function realConnectEffects() {
   const tlsAgent = new https.Agent({ keepAlive: true });
   const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
     const accepted = /* @__PURE__ */ new Set();
-    const server = net.createServer((socket) => {
+    const server = net2.createServer((socket) => {
       accepted.add(socket);
       socket.on("close", () => {
         accepted.delete(socket);
@@ -2456,7 +2686,7 @@ function realConnectEffects() {
       };
     },
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
-      const socket = net.connect({ host, port });
+      const socket = net2.connect({ host, port });
       socket.once("connect", () => {
         resolve(socket);
       });
@@ -2521,8 +2751,8 @@ function realConnectCertStore(paths) {
   return {
     loadCa: () => {
       const certPem = read(paths.frontdoorCaCertFile);
-      const keyPem = read(paths.frontdoorCaKeyFile);
-      return certPem === void 0 || keyPem === void 0 ? void 0 : { certPem, keyPem };
+      const keyPem2 = read(paths.frontdoorCaKeyFile);
+      return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
     },
     writeCa: (ca) => {
       fs.mkdirSync(paths.frontdoorCaDir, { recursive: true });
@@ -2534,10 +2764,10 @@ function realConnectCertStore(paths) {
 }
 
 // src/frontdoor/ensure.ts
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 
 // src/headroom/state.ts
-var import_node_crypto2 = require("node:crypto");
+var import_node_crypto4 = require("node:crypto");
 var import_node_path6 = __toESM(require("node:path"), 1);
 var import_zod4 = require("zod");
 var HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
@@ -2599,7 +2829,7 @@ function headroomUpstreams(providers, frontDoorOrigin2) {
   return upstreams;
 }
 function hashAllowlist(allowlist) {
-  return (0, import_node_crypto2.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
+  return (0, import_node_crypto4.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
 }
 function readAllProviders(fs2, providersDir) {
   const result = [];
@@ -2683,7 +2913,7 @@ function ensureFrontDoor(params) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
         if (verdict.ok) {
-          const token = (0, import_node_crypto3.randomUUID)();
+          const token = (0, import_node_crypto5.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
           return { port: state.port, connectPort: state.connectPort, token };
         }
@@ -2777,7 +3007,7 @@ function ensureHeadroom(params) {
 }
 
 // src/headroom/settings.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 function settingsOf(config) {
   return {
     ...config.mode === void 0 ? {} : { mode: config.mode },
@@ -2802,7 +3032,7 @@ function settingsEnv(settings) {
   return settings.rolloutChannel === void 0 ? {} : { HEADROOM_ROLLOUT_CHANNEL: settings.rolloutChannel };
 }
 function hashSettings(settings) {
-  return (0, import_node_crypto4.createHash)("sha256").update(JSON.stringify([...settingsArgs(settings), JSON.stringify(settingsEnv(settings))])).digest("hex");
+  return (0, import_node_crypto6.createHash)("sha256").update(JSON.stringify([...settingsArgs(settings), JSON.stringify(settingsEnv(settings))])).digest("hex");
 }
 
 // src/headroom/supervisor.ts