github-router 0.3.137 → 0.3.138

package/dist/{peer-mcp-personas-KHFhxjFn.js → peer-mcp-personas-CThUmeHE.js}

@@ -13,7 +13,7 @@ import process$1 from "node:process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { chmodSync, closeSync, cpSync, existsSync, mkdirSync, openSync, promises, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { Agent } from "undici";
+import { Agent, ProxyAgent } from "undici";
 import { performance } from "node:perf_hooks";
 import { createInterface } from "node:readline";
 import Parser from "web-tree-sitter";
@@ -1049,7 +1049,7 @@ function collapsePathKeys(env) {
 
 //#endregion
 //#region src/lib/insecure-tls.ts
-const IS_BUN = typeof globalThis.Bun !== "undefined";
+const IS_BUN$1 = typeof globalThis.Bun !== "undefined";
 let sharedInsecureDispatcher;
 function insecureDispatcher() {
 	return sharedInsecureDispatcher ??= new Agent({ connect: { rejectUnauthorized: false } });
@@ -1060,7 +1060,7 @@ function insecureDispatcher() {
 * `dispatcher`. Exported so BOTH runtime branches are unit-testable under one
 * interpreter (the untested Node branch is exactly what shipped broken).
 */
-function applyInsecureTls(init, isBun = IS_BUN) {
+function applyInsecureTls(init, isBun = IS_BUN$1) {
 	if (isBun) init.tls = { rejectUnauthorized: false };
 	else init.dispatcher = insecureDispatcher();
 }
@@ -1471,6 +1471,37 @@ function stringProp$1(description) {
 	};
 }
 
+//#endregion
+//#region src/lib/fleet/mesh-egress-agent.ts
+const IS_BUN = typeof globalThis.Bun !== "undefined";
+/** Thrown when a mesh request is attempted under Bun (no Bearer-proxy support). */
+var MeshEgressUnsupportedRuntimeError = class extends Error {
+	constructor() {
+		super("mesh egress routing is unsupported under Bun (dev runtime): Bun's fetch cannot send a Proxy-Authorization Bearer header. Run the built Node binary (dist/main.js) to drive mesh peers.");
+		this.name = "MeshEgressUnsupportedRuntimeError";
+	}
+};
+/**
+* Attach the egress-proxy mechanism to a fetch init for a single mesh peer request.
+* Node → a NEW undici `ProxyAgent` dispatcher whose CONNECT carries the Bearer
+* `Proxy-Authorization`. A new agent per request is intentional: the credential can
+* rotate when the sidecar restarts, so a cached agent could pin a stale token, and a
+* per-request agent avoids stashing the credential in longer-lived state. The caller
+* MUST `close()` the returned agent after the request (it holds a socket pool).
+*
+* `isBun` is injectable so BOTH branches are unit-testable under one interpreter.
+* Under Bun this THROWS {@link MeshEgressUnsupportedRuntimeError} (fail closed).
+*/
+function applyMeshEgressProxy(init, meshProxy, isBun = IS_BUN) {
+	if (isBun) throw new MeshEgressUnsupportedRuntimeError();
+	const agent = new ProxyAgent({
+		uri: meshProxy.url,
+		headers: { "Proxy-Authorization": meshProxy.authHeader }
+	});
+	init.dispatcher = agent;
+	return agent;
+}
+
 //#endregion
 //#region src/lib/fleet/tunnel-auth.ts
 var TunnelAuthError = class extends Error {
@@ -1722,6 +1753,8 @@ var FleetClient = class {
 	getTunnelToken;
 	onTunnelAuthInvalidate;
 	insecureTLS;
+	meshProxy;
+	applyMeshEgress;
 	constructor(options) {
 		this.baseUrl = options.url.replace(/\/+$/, "");
 		this.origin = new URL(this.baseUrl).origin;
@@ -1733,6 +1766,8 @@ var FleetClient = class {
 		this.getTunnelToken = options.getTunnelToken;
 		this.onTunnelAuthInvalidate = options.onTunnelAuthInvalidate;
 		this.insecureTLS = options.insecureTLS === true;
+		this.meshProxy = options.meshProxy;
+		this.applyMeshEgress = options.applyMeshEgress ?? applyMeshEgressProxy;
 	}
 	capabilities(signal) {
 		return this.request("GET", "/api/control/capabilities", void 0, void 0, signal);
@@ -1810,6 +1845,11 @@ var FleetClient = class {
 			message: "fleet request URL origin did not match the registered instance origin",
 			retryable: false
 		});
+		if (this.auth.type === "mesh" && this.meshProxy === void 0) throw new FleetError({
+			code: "MESH_UNCONFIGURED",
+			message: "mesh egress unconfigured or stale: no live loopback egress proxy for this tailnet peer. Start (or restart) the local ai-or-die `--mesh` sidecar so it publishes a fresh mesh/egress.json; this host cannot reach a `.ts.net` peer directly.",
+			retryable: true
+		});
 		const devtunnelHost = isDevtunnelHost(url.hostname);
 		const tunnelEligible = this.getTunnelToken !== void 0 && devtunnelHost && url.protocol === "https:";
 		for (let attempt = 0; attempt < 2; attempt++) {
@@ -1828,6 +1868,7 @@ var FleetClient = class {
 				...body === void 0 ? {} : { "Content-Type": "application/json" }
 			};
 			let response;
+			let meshAgent;
 			try {
 				const init = {
 					method,
@@ -1837,8 +1878,17 @@ var FleetClient = class {
 					signal
 				};
 				if (this.insecureTLS) applyInsecureTls(init);
+				if (this.auth.type === "mesh") {
+					if (this.meshProxy === void 0) throw new FleetError({
+						code: "MESH_UNCONFIGURED",
+						message: "mesh egress unconfigured or stale: refusing a direct fetch to a tailnet peer.",
+						retryable: true
+					});
+					meshAgent = this.applyMeshEgress(init, this.meshProxy);
+				}
 				response = await this.fetchFn(url.toString(), init);
 			} catch (err) {
+				await closeQuietly(meshAgent);
 				if (canRetry && method === "GET") {
 					this.onTunnelAuthInvalidate();
 					continue;
@@ -1846,13 +1896,18 @@ var FleetClient = class {
 				throw this.auth.type === "mesh" ? mapMeshUnreachable(err) : mapNetworkError(err, devtunnelHost);
 			}
 			if (!response.ok) {
+				await closeQuietly(meshAgent);
 				if ((response.status === 401 || response.status === 403) && canRetry) {
 					this.onTunnelAuthInvalidate();
 					continue;
 				}
 				throw await mapHttpError(response, url.toString());
 			}
-			return await response.json();
+			try {
+				return await response.json();
+			} finally {
+				await closeQuietly(meshAgent);
+			}
 		}
 		throw new FleetError({
 			code: "AUTH_FAILED",
@@ -1976,19 +2031,31 @@ function detailToSearchString(detail) {
 	}
 }
 function mapMeshUnreachable(err) {
+	if (err instanceof FleetError) return err;
+	if (err instanceof MeshEgressUnsupportedRuntimeError) return new FleetError({
+		code: "MESH_UNCONFIGURED",
+		message: err.message,
+		retryable: false
+	});
 	if (isAbortLike$1(err)) return new FleetError({
 		code: "TIMEOUT",
 		message: "fleet mesh peer request timed out or was aborted",
-		retryable: true,
-		detail: err
+		retryable: true
 	});
 	return new FleetError({
 		code: "TAILNET_UNREACHABLE",
-		message: `fleet mesh peer unreachable: ${err instanceof Error ? err.message : String(err)} — the peer is a tailnet node but the request did not land. A mesh ACL drops blocked traffic SILENTLY, so the likely cause is the \`tag:aiordie\` ACL (verify the peer permits this node), not a dead instance; also confirm the peer's mesh sidecar is up and serving HTTPS on the tailnet.`,
-		retryable: true,
-		detail: err
+		message: `fleet mesh peer unreachable${meshErrorClass(err)} — the request went through the local egress proxy but did not land on the peer. A mesh ACL drops blocked traffic SILENTLY, so the likely cause is the \`tag:aiordie\` ACL (verify the peer permits this node), not a dead instance; also confirm the peer's mesh sidecar is up and serving HTTPS on the tailnet, and that the local egress sidecar is still running.`,
+		retryable: true
 	});
 }
+function meshErrorClass(err) {
+	if (typeof err !== "object" || err === null) return "";
+	const record = err;
+	const parts = [];
+	if (typeof record.name === "string" && record.name !== "" && record.name !== "Error") parts.push(record.name);
+	if (typeof record.code === "string" && record.code !== "") parts.push(record.code);
+	return parts.length === 0 ? "" : ` (${parts.join(" ")})`;
+}
 function mapNetworkError(err, devtunnelHost = false) {
 	if (isAbortLike$1(err)) return new FleetError({
 		code: "TIMEOUT",
@@ -2028,6 +2095,13 @@ function detailToMessage(detail) {
 function isAbortLike$1(err) {
 	return err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
 }
+async function closeQuietly(agent) {
+	if (agent === void 0) return;
+	try {
+		if (typeof agent.destroy === "function") await agent.destroy();
+		else if (typeof agent.close === "function") await agent.close();
+	} catch {}
+}
 
 //#endregion
 //#region src/lib/fleet/registry.ts
@@ -2266,6 +2340,9 @@ function isNodeErrorCode(err, code) {
 */
 const DISCOVERY_CACHE_TTL_MS = 5e3;
 const PEERS_JSON_MAX_BYTES = 256 * 1024;
+const EGRESS_TTL_MS = 12e4;
+const EGRESS_FUTURE_SKEW_MS = 5e3;
+const EGRESS_JSON_MAX_BYTES = 64 * 1024;
 /** The ai-or-die app data dir (NOT github-router's) — mirrors MeshManager's `base`. */
 function aiordieAppDir() {
 	if (process.platform === "win32") {
@@ -2279,6 +2356,11 @@ function meshPeersFilePath() {
 	if (override && override.trim() !== "") return override.trim();
 	return nodePath.join(aiordieAppDir(), "mesh", "peers.json");
 }
+function meshEgressFilePath() {
+	const override = process.env.GH_ROUTER_FLEET_EGRESS_FILE;
+	if (override && override.trim() !== "") return override.trim();
+	return nodePath.join(aiordieAppDir(), "mesh", "egress.json");
+}
 function meshDiscoveryDisabled() {
 	return process.env.GH_ROUTER_FLEET_DISCOVERY === "0";
 }
@@ -2347,16 +2429,104 @@ function toInfo(instance) {
 		url: instance.url
 	};
 }
+function defaultPidAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return typeof err === "object" && err !== null && err.code === "EPERM";
+	}
+}
+function validLoopbackHttpUrl(raw) {
+	if (typeof raw !== "string" || raw.trim() === "") return void 0;
+	let url;
+	try {
+		url = new URL(raw.trim());
+	} catch {
+		return;
+	}
+	if (url.protocol !== "http:") return void 0;
+	if (url.username !== "" || url.password !== "") return void 0;
+	if (url.pathname !== "" && url.pathname !== "/" || url.search !== "" || url.hash !== "") return void 0;
+	if (url.port === "") return void 0;
+	const host = url.hostname.replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
+	if (host !== "127.0.0.1" && host !== "::1") return void 0;
+	return `http://${host === "::1" ? "[::1]" : host}:${url.port}`;
+}
+function validEgressToken(raw) {
+	if (typeof raw !== "string" || raw === "") return void 0;
+	if (/[\s\u0000-\u001f\u007f\u0080-\u009f]/.test(raw)) return void 0;
+	return raw;
+}
+/**
+* Read + validate the sidecar's `mesh/egress.json` into a {@link FleetMeshProxy}.
+* Best-effort like {@link readMeshPeers}: NEVER throws — a missing / unreadable /
+* oversized / malformed / stale / dead-pid file yields `undefined`. The returned
+* `authHeader` is a credential: it lives only here and in the ProxyAgent header,
+* never in `FleetInstanceInfo` / logs / errors.
+*/
+async function readMeshEgress(options = {}) {
+	if (meshDiscoveryDisabled()) return void 0;
+	const readFileFn = options.readFileFn ?? ((p) => fs.readFile(p, "utf8"));
+	const now = options.now ?? (() => Date.now());
+	const pidAlive = options.pidAlive ?? defaultPidAlive;
+	let raw;
+	try {
+		raw = await readFileFn(meshEgressFilePath());
+	} catch {
+		return;
+	}
+	if (typeof raw !== "string") return void 0;
+	if (Buffer.byteLength(raw, "utf8") > EGRESS_JSON_MAX_BYTES) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	if (parsed.version !== 1) return void 0;
+	const url = validLoopbackHttpUrl(parsed.url);
+	if (url === void 0) return void 0;
+	const token = validEgressToken(parsed.token);
+	if (token === void 0) return void 0;
+	if (typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return void 0;
+	let alive;
+	try {
+		alive = pidAlive(parsed.pid);
+	} catch {
+		return;
+	}
+	if (!alive) return void 0;
+	if (typeof parsed.updatedAt !== "number" || !Number.isFinite(parsed.updatedAt)) return void 0;
+	let age;
+	try {
+		age = now() - parsed.updatedAt;
+	} catch {
+		return;
+	}
+	if (!Number.isFinite(age)) return void 0;
+	if (age > EGRESS_TTL_MS || age < -EGRESS_FUTURE_SKEW_MS) return void 0;
+	return {
+		url,
+		authHeader: `Bearer ${token}`
+	};
+}
 /**
 * Registry that merges a static `fleet.json` registry with mesh discovery. Static
 * ALWAYS wins on an id collision (a discovered peer sharing a static id is dropped
 * — never overwrites a configured instance, never merges auth across sources).
 * Discovery is cached briefly so a fan-out doesn't re-read the file per call, and a
 * failed discovery read leaves the static set untouched.
+*
+* The mesh egress proxy (from `egress.json`) is read in the SAME cached window and
+* attached to EVERY discovered mesh peer — the egress is per-conductor/self, shared
+* by all peers on this tailnet. Static bearer instances never carry one.
 */
 var MergedFleetRegistry = class {
 	staticRegistry;
 	discover;
+	discoverEgress;
 	cache;
 	inflight;
 	ttlMs;
@@ -2364,6 +2534,7 @@ var MergedFleetRegistry = class {
 	constructor(options = {}) {
 		this.staticRegistry = options.staticRegistry ?? new FleetRegistry();
 		this.discover = options.discover ?? (() => readMeshPeers());
+		this.discoverEgress = options.discoverEgress ?? (() => readMeshEgress());
 		this.ttlMs = options.ttlMs ?? DISCOVERY_CACHE_TTL_MS;
 		this.now = options.now ?? (() => Date.now());
 	}
@@ -2372,17 +2543,18 @@ var MergedFleetRegistry = class {
 		if (this.cache && now - this.cache.at < this.ttlMs) return this.cache.peers;
 		if (this.inflight) return this.inflight;
 		this.inflight = (async () => {
-			let peers;
-			try {
-				peers = await this.discover();
-			} catch {
-				peers = [];
-			}
+			const [peersResult, egressResult] = await Promise.allSettled([this.discover(), this.discoverEgress()]);
+			const peers = peersResult.status === "fulfilled" ? peersResult.value : [];
+			const egress = egressResult.status === "fulfilled" ? egressResult.value : void 0;
+			const withEgress = egress === void 0 ? peers : peers.map((peer) => peer.auth.type === "mesh" ? {
+				...peer,
+				meshProxy: egress
+			} : peer);
 			this.cache = {
 				at: this.now(),
-				peers
+				peers: withEgress
 			};
-			return peers;
+			return withEgress;
 		})().finally(() => {
 			this.inflight = void 0;
 		});
@@ -2445,6 +2617,12 @@ function createFleetTools(options = {}) {
 		return defaultRegistry;
 	}
 	function clientFor(instance) {
+		if (instance.auth.type === "mesh") return options.createClient ? options.createClient(instance) : new FleetClient({
+			url: instance.url,
+			auth: instance.auth,
+			fetchFn: options.fetchFn,
+			meshProxy: instance.meshProxy
+		});
 		const key = `${instance.id}\0${instance.url}\0${instance.auth.type}\0${instance.token}\0${instance.tunnelId ?? ""}\0${instance.tunnelToken ?? ""}\0${instance.insecureTLS === true ? "1" : "0"}`;
 		const existing = clients.get(key);
 		if (existing) return existing;
@@ -2930,6 +3108,8 @@ function fleetProbeHint(code) {
 		case "RELAY_ERROR": return "tunnel relay returned an error; the host may be down, restarting, or under load";
 		case "TIMEOUT": return "no response before the probe deadline; the host may be slow or the tunnel may have no host";
 		case "UNREACHABLE": return "could not connect (DNS or connection failure); check the instance url";
+		case "MESH_UNCONFIGURED": return "mesh egress unconfigured or stale; (re)start the local ai-or-die --mesh sidecar so it publishes a fresh mesh/egress.json";
+		case "TAILNET_UNREACHABLE": return "reached the local egress proxy but the request did not land on the tailnet peer; likely the tag:aiordie ACL, or the peer's sidecar is down";
 		default: return;
 	}
 }
@@ -2944,7 +3124,9 @@ function isFleetErrorCode(code) {
 		case "NO_HOST":
 		case "RELAY_ERROR":
 		case "BAD_REQUEST":
-		case "RATE_LIMITED": return true;
+		case "RATE_LIMITED":
+		case "TAILNET_UNREACHABLE":
+		case "MESH_UNCONFIGURED": return true;
 		default: return false;
 	}
 }
@@ -22915,4 +23097,4 @@ async function runStandInToolCall(args, signal) {
 
 //#endregion
 export { readIteratorWithTimeout as $, state as $t, DEFAULT_MODEL as A, generateRandomPort as At, toolbeltSkipSet as B, filterBetaHeader as Bt, repoRoot as C, toolbeltPathOverride as Ct, resolveSealedGate as D, DEFAULT_PORT as Dt, trustRepo as E, DEFAULT_CODEX_MODEL_FALLBACKS as Et, runWorkerAgent as F, setupGitHubToken as Ft, ADVISOR_INTERNAL_TOOL_NAME as G, getModels as Gt, TOOLBELT_TOOLS$1 as H, resolveCodexModel as Ht, withNoOutputRetry as I, tryRefreshAndRetry as It, injectAdvisorTool as J, forwardError as Jt, ADVISOR_TOOL_INSTRUCTIONS as K, fetchWithTransientRetry as Kt, availableToolCommands as L, cacheCopilotVersion as Lt, PLAN_DEFAULT_MODEL as M, getPackageVersion as Mt, REVIEW_DEFAULT_MODEL as N, withInstallLock as Nt, liveExec as O, UPSTREAM_FETCH_TIMEOUT_MS as Ot, appendPlanReminder as P, setupCopilotToken as Pt, logStreamError as Q, githubHeaders as Qt, buildToolbeltAwareness as R, cacheModels as Rt, repoFingerprint as S, collapsePathKeys as St, stopReviewStateDir as T, DEFAULT_CODEX_MODEL as Tt, assetFor as U, resolveModel as Ut, vscodeRipgrepPath as V, isNullish as Vt, searchWeb as W, sleep as Wt, buildOpenAIErrorEvent as X, copilotBaseUrl as Xt, isAdvisorRequested as Y, GITHUB_API_BASE_URL as Yt, isControllerClosedError as Z, copilotHeaders as Zt, fileBaselineStore as _, provisionAndIndexColbert as _t, buildPeerAwarenessSnippet as a, standInToolEnabled as at, fileReviewDebounce as b, shouldUseInsecureTls as bt, buildSessionBindHookCommand as c, createMessages as ct, decideStopHook as d, createChatCompletions as dt, relayAnthropicStream as et, fileBlockBudget as f, MAX_RESPONSE_BODY_BYTES as ft, stopReviewEnabled as g, hasSupportedBrowserInstalled as gt, stopGateId as h, provisionBrowserAssets as ht, buildAgentPrompt as i, fleetToolsEnabled as it, IMPLEMENT_DEFAULT_MODEL as j, pickClaudeDefault as jt, BROWSE_DEFAULT_MODEL as k, UPSTREAM_INACTIVITY_TIMEOUT_MS as kt, buildStopHookCommand as l, getTokenCount as lt, launchBaselineKey as m, parseJsonOrDiagnose as mt, MCP_GROUPS as n, handleMcpPost as nt, personasFor as o, workerToolsEnabled as ot, injectStopHookIntoSettingsFile as p, readResponseBodyCapped as pt, buildAdvisorStream as q, HTTPError as qt, assertMcpToolSurfaceConsistent as r, browserToolsEnabled as rt, buildArtifactOpenHookCommand as s, countTokens as st, GROUP_META as t, handleMcpDelete as tt, captureLaunchBaseline as u, createResponses as ut, fileFindingsStore as v, extractTarGzMember as vt, stopGateEnabledForRepo as w, DEFAULT_CLAUDE_MODEL_FALLBACKS as wt, isSubagentContext as x, ArtifactClient as xt, fileLastPromptStore as y, extractZipMember as yt, toolbeltEnabled as z, cacheVSCodeVersion as zt };
-//# sourceMappingURL=peer-mcp-personas-KHFhxjFn.js.map
+//# sourceMappingURL=peer-mcp-personas-CThUmeHE.js.map