donsetch 5.0.0-beta.3 → 5.0.0

package/README.md

@@ -2,7 +2,7 @@
 
 **The web, for AI agents.** Fetch, search, crawl and screenshot from one local binary. Zero API keys, zero accounts.
 
-**v5 beta:** a new fetch engine. No browser in the fetch path: a wall is answered by the right client identity, the site's own challenge program run in-process, or the site's own public interface.
+**v5:** a new fetch engine. No browser in the fetch path: a wall is answered by the right client identity, the site's own challenge program run in-process, or the site's own public interface.
 
 [![Release](https://img.shields.io/github/v/release/dondai44423/donsetch?color=00d4aa&style=flat-square)](https://github.com/dondai44423/donsetch/releases)
 [![CI](https://img.shields.io/github/actions/workflow/status/dondai44423/donsetch/ci.yml?label=CI&style=flat-square)](https://github.com/dondai44423/donsetch/actions/workflows/ci.yml)

package/install.js

@@ -6,6 +6,7 @@
 
 const http = require('http');
 const https = require('https');
+const net = require('net');
 const tls = require('tls');
 const crypto = require('crypto');
 const fs = require('fs');
@@ -159,15 +160,30 @@ function requestDirect(target) {
   });
 }
 
+// Basic credentials from the proxy URL's user:pass@ part, or null when
+// it has none. The URL parser keeps them percent-encoded.
+function proxyAuthorization(proxy) {
+  if (!proxy.username && !proxy.password) return null;
+  const decode = (part) => {
+    try { return decodeURIComponent(part); } catch (_) { return part; }
+  };
+  const pair = `${decode(proxy.username)}:${decode(proxy.password)}`;
+  return `Basic ${Buffer.from(pair).toString('base64')}`;
+}
+
 function requestThroughProxy(target, proxy) {
   return new Promise((resolve, reject) => {
+    const authority = `${target.hostname}:${target.port || 443}`;
+    const connectHeaders = { Host: authority };
+    const authorization = proxyAuthorization(proxy);
+    if (authorization) connectHeaders['Proxy-Authorization'] = authorization;
     const connectTransport = proxy.protocol === 'https:' ? https : http;
     const proxyReq = connectTransport.request({
       hostname: proxy.hostname,
       port: proxy.port || (proxy.protocol === 'https:' ? 443 : 80),
       method: 'CONNECT',
-      path: `${target.hostname}:${target.port || 443}`,
-      headers: { Host: `${target.hostname}:${target.port || 443}` },
+      path: authority,
+      headers: connectHeaders,
     });
     proxyReq.once('connect', (response, socket) => {
       if (response.statusCode !== 200) {
@@ -184,10 +200,17 @@ function requestThroughProxy(target, proxy) {
           Accept: 'application/octet-stream',
           'User-Agent': 'donsetch-npm-installer',
         },
-        agent: false,
+        // No `agent` key: Node uses createConnection only when no agent
+        // is in use, and `agent: false` means a fresh default Agent,
+        // which dials the host directly and leaves the tunnel unused.
+        // Without an agent the request also closes its connection, and
+        // with it the tunnel, once the response ends.
+        // The certificate is verified (tls.connect's default) against
+        // the release host; SNI takes host names only (RFC 6066 3).
         createConnection: () => tls.connect({
           socket,
-          servername: target.hostname,
+          host: target.hostname,
+          servername: net.isIP(target.hostname) ? undefined : target.hostname,
         }),
       }, resolve);
       req.setTimeout(REQUEST_TIMEOUT_MS, () => req.destroy(new Error('request timeout')));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "donsetch",
-  "version": "5.0.0-beta.3",
+  "version": "5.0.0",
   "description": "MCP server that gives AI agents the web: fetch, search, crawl and screenshot from one local Rust binary. Zero API keys, zero accounts, Chrome-true TLS.",
   "license": "AGPL-3.0-only",
   "author": "Bishesh Bhandari",

package/pi-extension.ts

@@ -199,8 +199,8 @@ function startServer(): Promise<void> {
       }
     });
 
-    // The daemon writes diagnostics to stderr (Xvfb warnings,
-    // fallback notices, ghost telemetry). Pi's TUI surfaces stderr
+    // The daemon writes diagnostics to stderr (config warnings,
+    // rerank and OCR notices). Pi's TUI surfaces stderr
     // as user-facing output: raw forwarding used to pop non-fatal
     // warnings up (issue #95). Gate it:
     // - DONSETCH_DEBUG / DEBUG set: forward everything (dev mode)
@@ -449,14 +449,12 @@ function getSearchProvider(sc: any, dbg: any): string {
 }
 
 /**
- * Extract the fetch source label from model state with a
- * client-only diagnostics fallback. Compact MCP contracts keep
- * transport telemetry in _meta["com.donsetch/fetch-debug"], so the
- * tier can live there; older servers still expose it on
- * structuredContent.
- * Returns "cache" when tier is "1(warm)" (warm cookies, not a
- * fresh fetch), "ghost" when tier starts with "2" (browser
- * escalation), or "" for a normal tier-1 fetch.
+ * Extract the fetch source label from the `tier` field that servers
+ * before 5.0 report, in _meta["com.donsetch/fetch-debug"] or on
+ * structuredContent. Returns "cache" when tier is "1(warm)" (warm
+ * cookies, not a fresh fetch), "ghost" when tier starts with "2"
+ * (their browser tier), or "" otherwise. A 5.x server sends no
+ * tier and has no browser tier, so the result is always "".
  */
 function getFetchSource(sc: any, dbg: any): string {
   const tier = String(