klovys99 0.1.0-main.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Korbicorp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,403 @@
+# klovys99
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+klovys99 is a local reverse proxy that anonymizes sensitive prompt data before
+forwarding requests to Anthropic or OpenAI APIs.
+
+It is designed to sit between coding clients such as Claude Code or Codex and
+their upstream API, replacing detected personal or sensitive values with stable
+pseudonym tokens before the request leaves the machine.
+
+## Features
+
+- Local reverse proxy for Anthropic and OpenAI-compatible JSON requests.
+- `npm install` workflow that downloads a prebuilt binary for the current OS
+  and architecture and exposes a `klovys99` command.
+- Client configuration helpers for Codex and Claude Code.
+- Built-in deterministic detectors for common PII and sensitive identifiers.
+- Dynamic detector loading from the official Gitleaks and Microsoft Presidio
+  rule sources.
+- Optional local LLM extraction through Ollama for contextual names, addresses,
+  dates, and vehicle plates.
+- Stable pseudonym tokens for the lifetime of the proxy process.
+- Structured logs with anonymization counters instead of raw prompt values.
+- Disk cache for downloaded external rules to avoid repeated network fetches on
+  every startup.
+
+## Requirements
+
+- Node.js 18 or newer.
+- Network access on first startup to download the default Gitleaks and Presidio
+  rule sources.
+- An Anthropic API key, Claude subscription, or OpenAI API key depending on the
+  client you route through Klovys99.
+- Ollama, only when `KLOVIS_LLM_ENABLED=true`.
+
+Go 1.25 or newer is only required if you work from a source checkout or build
+release binaries yourself.
+
+Check your local tooling:
+
+```sh
+node -v
+npm -v
+go version
+```
+
+Optional LLM mode requires a local Ollama model:
+
+```sh
+ollama --version
+ollama pull mistral
+```
+
+## Installation
+
+From the repository root:
+
+```sh
+npm install
+```
+
+`npm install klovys99` runs a `postinstall` step that downloads the matching
+binary from the GitHub release for the package version into `dist/` and exposes
+the CLI entrypoints `klovys99` and `klovis`. `klovys99` is the preferred name
+and `klovis` remains available for compatibility.
+
+Supported prebuilt targets:
+
+- macOS `arm64`
+- macOS `x64`
+- Linux `arm64`
+- Linux `x64`
+- Windows `arm64`
+- Windows `x64`
+
+For local execution from an unpublished checkout, use:
+
+```sh
+npm install
+npm run cli -- configure claude
+```
+
+If you want the install step to also update your client configuration
+immediately:
+
+```sh
+KLOVIS_CLIENT=claude npm install
+```
+
+Supported values are `codex`, `claude`, and `both`.
+
+## Quick Start
+
+Configure one or both clients to point to Klovys99:
+
+```sh
+npx klovys99 configure codex
+npx klovys99 configure claude
+```
+
+The historical command name still works:
+
+```sh
+npx klovis configure claude
+```
+
+From a local checkout that is not published to npm, prefer:
+
+```sh
+npm run cli -- configure claude
+```
+
+Or configure both at once:
+
+```sh
+npx klovys99 configure both
+```
+
+Then start the proxy:
+
+```sh
+npx klovys99 start
+```
+
+By default, Klovys99 listens on `http://127.0.0.1:8080` and exposes these local
+routes:
+
+- `http://127.0.0.1:8080/anthropic` for Claude Code and other Anthropic clients
+- `http://127.0.0.1:8080/openai/v1` for Codex and other OpenAI-compatible
+  clients
+
+The historical unprefixed route still exists and forwards to
+`KLOVIS_TARGET_URL`, which defaults to `https://api.anthropic.com`.
+
+## Client Configuration
+
+### Codex
+
+```sh
+npx klovys99 configure codex
+```
+
+This updates `~/.codex/config.toml` and sets:
+
+```toml
+openai_base_url = "http://127.0.0.1:8080/openai/v1"
+```
+
+### Claude Code
+
+```sh
+npx klovys99 configure claude
+```
+
+This updates `~/.claude/settings.json` and sets:
+
+```json
+{
+  "env": {
+    "ANTHROPIC_BASE_URL": "http://127.0.0.1:8080/anthropic"
+  }
+}
+```
+
+If you want another listen URL written into both clients, pass `--base-url`:
+
+```sh
+npx klovys99 configure both --base-url http://127.0.0.1:9090
+```
+
+## Quick API Checks
+
+Anthropic-style request through Klovys99:
+
+```sh
+curl http://127.0.0.1:8080/anthropic/v1/messages \
+  -H "x-api-key: $ANTHROPIC_API_KEY" \
+  -H "anthropic-version: 2023-06-01" \
+  -H "content-type: application/json" \
+  -d '{
+    "model": "claude-sonnet-4-5",
+    "max_tokens": 128,
+    "messages": [
+      {
+        "role": "user",
+        "content": "Email Alice at alice@example.com"
+      }
+    ]
+  }'
+```
+
+OpenAI Responses-style request through Klovys99:
+
+```sh
+curl http://127.0.0.1:8080/openai/v1/responses \
+  -H "authorization: Bearer $OPENAI_API_KEY" \
+  -H "content-type: application/json" \
+  -d '{
+    "model": "gpt-5",
+    "input": "Email Alice at alice@example.com"
+  }'
+```
+
+Upstream providers receive the same request shape, with sensitive values
+replaced by pseudonym tokens such as `[EMAIL_1]`.
+
+## How It Works
+
+Klovys99 reads each incoming JSON request body, anonymizes supported prompt
+content, then forwards the modified request to the configured upstream.
+
+The proxy anonymizes:
+
+- every `<session>...</session>` block found anywhere in a JSON request body;
+- text content in prompts, system messages, `<system-reminder>` blocks, text
+  file context, and tool results;
+- text document sources where `source.type` is `text`.
+
+Structural metadata such as model names, roles, content block types, tool IDs,
+tool names, media types, cache-control values, and base64 document data is left
+unchanged so the upstream request shape remains valid.
+
+For a single proxy process, repeated values are mapped to stable tokens. For
+example, the same email address is replaced by the same `[EMAIL_N]` token across
+requests handled by that process.
+
+When matches overlap, the detector with the highest priority wins. If priorities
+are equal, the longest match wins.
+
+## Configuration
+
+Klovys99 runtime is configured with environment variables.
+
+| Variable | Default | Description |
+| --- | --- | --- |
+| `KLOVIS_ADDR` | `127.0.0.1:8080` | Listen address for the local proxy. |
+| `KLOVIS_TARGET_URL` | `https://api.anthropic.com` | Upstream used by legacy unprefixed routes such as `/v1/messages`. |
+| `KLOVIS_ANTHROPIC_TARGET_URL` | `https://api.anthropic.com` | Upstream used by `/anthropic/...` routes. |
+| `KLOVIS_OPENAI_TARGET_URL` | `https://api.openai.com` | Upstream used by `/openai/...` routes. |
+| `KLOVIS_PROXY_DEBUG` | `false` | Enables debug traffic body logging when set to `true`. |
+| `KLOVIS_LOG_TO_FILE` | `false` | Writes logs to `proxy.log` instead of stdout when set to `true`. |
+| `KLOVIS_LLM_ENABLED` | `false` | Enables optional local LLM extraction through Ollama. |
+| `KLOVIS_LLM_URL` | `http://localhost:11434` | Ollama base URL. |
+| `KLOVIS_LLM_MODEL` | `mistral` | Ollama model used for entity extraction. |
+| `KLOVIS_LLM_TIMEOUT` | `30s` | Startup and request timeout for LLM calls. |
+| `KLOVIS_LLM_MAX_CHARS` | `1000` | Maximum input bytes sent to the LLM per chunk. |
+| `KLOVIS_LLM_AUTOSTART` | `false` | Starts `ollama serve` automatically when the Ollama URL is local and not already reachable. |
+
+The npm wrapper also honors:
+
+| Variable | Description |
+| --- | --- |
+| `KLOVIS_CLIENT` | Client to configure during `npm install`: `codex`, `claude`, or `both`. |
+| `KLOVIS_BASE_URL` | Base URL written by `klovys99 configure` or `npm install` auto-configuration. |
+| `KLOVIS_SKIP_DOWNLOAD` | Skips the prebuilt binary download during `postinstall` when set to `true`. |
+| `KLOVIS_SKIP_BUILD` | Skips the local Go build fallback during `postinstall` when set to `true`. |
+| `KLOVIS_SKIP_CONFIGURE` | Skips client configuration during `postinstall` when set to `true`. |
+
+Boolean variables accept only `true` or `false`.
+
+## Logs
+
+Klovys99 writes structured application logs to stdout by default. To write logs to
+`proxy.log` instead, enable file logging:
+
+```sh
+KLOVIS_LOG_TO_FILE=true npx klovys99 start
+```
+
+To inspect request bodies before and after anonymization, enable debug logging:
+
+```sh
+KLOVIS_LOG_TO_FILE=true KLOVIS_PROXY_DEBUG=true npx klovys99 start
+```
+
+Use debug mode carefully, because it records both the original incoming request
+body and the anonymized upstream request body in whichever log destination is
+configured.
+
+## Optional LLM Extraction
+
+LLM extraction is disabled by default. Enable it with:
+
+```sh
+KLOVIS_LLM_ENABLED=true npx klovys99 start
+```
+
+When enabled, Klovys99 checks the Ollama connection during startup and runs a small
+extraction probe before accepting traffic. If startup verification fails, the
+proxy exits.
+
+By default, Klovys99 does not start Ollama for you. Start Ollama separately before
+enabling LLM extraction, or opt in to local autostart:
+
+```sh
+KLOVIS_LLM_ENABLED=true KLOVIS_LLM_AUTOSTART=true npx klovys99 start
+```
+
+Autostart only applies to local Ollama URLs such as `http://localhost:11434` or
+loopback IP addresses. Remote Ollama URLs are never started by Klovys99.
+
+Deterministic detectors remain the baseline. LLM matches are added when
+available and have lower priority than deterministic regex, Gitleaks, and
+Presidio matches. If the LLM fails during a request, Klovys99 logs the technical
+error and continues with deterministic anonymization.
+
+## Detectors
+
+Klovys99 combines built-in detectors with external rules loaded at startup.
+External rule payloads are cached for 24 hours in the user cache directory under
+`klovys99/external-rules`.
+
+| Category | Source | Priority | Description |
+| --- | --- | ---: | --- |
+| `EMAIL` | Built-in / Presidio | 1000 / 600 | Email addresses, normalized in lowercase for stable tokens. |
+| `NIR` | Built-in | 1000 | French social security numbers, including spaced formats and Corsica departments `2A` and `2B`. |
+| `IBAN` | Built-in / Presidio | 1000 / 600 | IBAN-like account identifiers, normalized by removing separators. |
+| `IP` | Built-in / Presidio | 900 / 600 | IPv4 and IPv6 addresses. |
+| `CREDIT_CARD` | Built-in / Presidio | 900 / 600 | Credit card-like digit sequences. |
+| `MAC_ADDRESS` | Built-in / Presidio | 900 / 600 | MAC addresses with `:` or `-` separators. |
+| `PHONE` | Built-in | 700 | French and common international phone numbers. |
+| `DATE` | Built-in / Presidio / LLM | 600 / external / 50 | Conservatively labelled birth dates and supported contextual dates. |
+| `BLOOD_TYPE` | Built-in | 600 | Contextual blood groups such as `Groupe sanguin O+`. |
+| `SECRET` | Gitleaks | 600 | Secrets loaded dynamically from the official Gitleaks config. |
+| `CRYPTO` | Presidio | 600 | Cryptocurrency wallet identifiers loaded from supported Presidio recognizers. |
+| `ADDRESS` | Built-in / LLM | 900 / 700 / 50 | French postal addresses, labelled addresses, and optional contextual LLM matches. |
+| `NAME` | Built-in | 900 | Contextual names following strong French or English cues and form labels. |
+| `FIRST_NAME` | Built-in | 500 | Conservatively labelled first names. |
+| `LAST_NAME` | Built-in | 500 | Conservatively labelled last names. |
+| `NUMERIC_ID` | Built-in | 100 | Generic long numeric IDs. |
+| `REFERENCE_ID` | Built-in | 100 | Labelled alphanumeric references requiring letters and digits. |
+| `PERSON_NAME` | LLM | 50 | Contextual full names found by the local model. |
+| `DATE` | LLM / Presidio | 50 / 600 | Dates tied to identity, family, documents, health, work, or events. |
+| `VEHICLE_PLATE` | LLM | 50 | Vehicle registration plates found by the local model. |
+
+## Claude Code Notes
+
+When Claude Code uses a non-first-party `ANTHROPIC_BASE_URL`, some Claude
+features behave differently upstream. In practice:
+
+- Remote Control is disabled by Claude Code when the base URL does not point to
+  `api.anthropic.com`.
+- Tool search behavior changes when routing through a proxy. If you need
+  deferred tool references, set `ENABLE_TOOL_SEARCH=true` in your Claude
+  environment because Klovys99 forwards `tool_reference` blocks unchanged.
+
+## Development
+
+Clone the repository and install both Node and Go dependencies:
+
+```sh
+git clone https://github.com/Korbicorp/klovys99.git
+cd klovys99
+npm install
+go mod download
+```
+
+Tagged releases build one binary per supported OS and architecture in GitHub
+Actions. If `NPM_TOKEN_KLOVYS` is configured in repository secrets, the same tag
+workflow also publishes the npm package after uploading the release assets.
+
+Run the test suites:
+
+```sh
+go test ./...
+node --test npm/test/*.test.js
+```
+
+Run the proxy locally without npm:
+
+```sh
+go run ./cmd/klovys99
+```
+
+Format Go code before submitting changes:
+
+```sh
+gofmt -w ./cmd ./internal
+```
+
+## Security Notes
+
+Klovys99 reduces the amount of sensitive data sent upstream, but it is not a
+formal data-loss-prevention guarantee. Review detector coverage for your own
+threat model before using it with production data.
+
+External Gitleaks and Presidio rules are loaded from their upstream repositories
+by default. Cached copies are reused for 24 hours and stale cache entries may be
+used as a fallback if a refresh fails.
+
+## Contributing
+
+Issues and pull requests are welcome. For code changes, please include focused
+tests that cover the behavior being changed.
+
+Useful checks before opening a pull request:
+
+```sh
+go test ./...
+node --test npm/test/*.test.js
+gofmt -w ./cmd ./internal
+```

package/npm/cli.js

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+"use strict";
+
+const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+const {
+  DEFAULT_BASE_URL,
+  configureClients,
+  normalizeBaseUrl,
+} = require("./lib/configure");
+
+const packageRoot = path.resolve(__dirname, "..");
+
+function main(argv) {
+  const [command = "start", ...rest] = argv;
+  switch (command) {
+    case "configure":
+      return runConfigure(rest);
+    case "start":
+    case "serve":
+      return runBinary(rest);
+    case "help":
+    case "--help":
+    case "-h":
+      printHelp();
+      return 0;
+    default:
+      return runBinary([command, ...rest]);
+  }
+}
+
+function runConfigure(args) {
+  const options = parseConfigureArgs(args);
+  const results = configureClients(options);
+  for (const result of results) {
+    process.stdout.write(
+      `Configured ${result.client} to use ${result.baseUrl} via ${result.path}\n`,
+    );
+  }
+  return 0;
+}
+
+function parseConfigureArgs(args) {
+  let client = process.env.KLOVIS_CLIENT || "";
+  let baseUrl = process.env.KLOVIS_BASE_URL || DEFAULT_BASE_URL;
+
+  for (let index = 0; index < args.length; index += 1) {
+    const value = args[index];
+    if (value === "--base-url") {
+      const next = args[index + 1];
+      if (!next) {
+        throw new Error("missing value for --base-url");
+      }
+      baseUrl = next;
+      index += 1;
+      continue;
+    }
+    if (value.startsWith("--base-url=")) {
+      baseUrl = value.slice("--base-url=".length);
+      continue;
+    }
+    if (!client) {
+      client = value;
+      continue;
+    }
+    throw new Error(`unexpected argument ${JSON.stringify(value)}`);
+  }
+
+  if (!client) {
+    throw new Error("missing client, expected codex, claude, or both");
+  }
+
+  return {
+    client,
+    baseUrl: normalizeBaseUrl(baseUrl),
+  };
+}
+
+function runBinary(args) {
+  const binaryPath = resolveBinaryPath();
+  const result = spawnSync(binaryPath, args, {
+    cwd: process.cwd(),
+    stdio: "inherit",
+    env: process.env,
+  });
+
+  if (result.error) {
+    throw result.error;
+  }
+
+  return result.status || 0;
+}
+
+function resolveBinaryPath() {
+  const binaryName = process.platform === "win32" ? "klovys99.exe" : "klovys99";
+  const binaryPath = path.join(packageRoot, "dist", binaryName);
+  if (!fs.existsSync(binaryPath)) {
+    throw new Error(
+      `missing installed binary at ${binaryPath}. Run npm install again. ` +
+        `From a source checkout, you can also build with go build -o dist/${binaryName} ./cmd/klovys99.`,
+    );
+  }
+  return binaryPath;
+}
+
+function printHelp() {
+  process.stdout.write(`Klovys99
+
+Usage:
+  klovys99 start
+  klovys99 configure codex [--base-url http://127.0.0.1:8080]
+  klovys99 configure claude [--base-url http://127.0.0.1:8080]
+  klovys99 configure both [--base-url http://127.0.0.1:8080]
+`);
+}
+
+try {
+  process.exitCode = main(process.argv.slice(2));
+} catch (error) {
+  process.stderr.write(`${error.message}\n`);
+  process.exitCode = 1;
+}

package/npm/lib/configure.js

@@ -0,0 +1,164 @@
+"use strict";
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const DEFAULT_BASE_URL = "http://127.0.0.1:8080";
+const KLOVIS_BEGIN_MARKER = "# BEGIN KLOVIS";
+const KLOVIS_END_MARKER = "# END KLOVIS";
+
+function normalizeBaseUrl(baseUrl = DEFAULT_BASE_URL) {
+  const trimmed = String(baseUrl).trim().replace(/\/+$/, "");
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch (error) {
+    throw new Error(`invalid base URL ${JSON.stringify(baseUrl)}: ${error.message}`);
+  }
+  if (!parsed.protocol || !parsed.host) {
+    throw new Error(`invalid base URL ${JSON.stringify(baseUrl)}: missing protocol or host`);
+  }
+  return parsed.toString().replace(/\/+$/, "");
+}
+
+function codexProxyBaseUrl(baseUrl) {
+  return `${normalizeBaseUrl(baseUrl)}/openai/v1`;
+}
+
+function claudeProxyBaseUrl(baseUrl) {
+  return `${normalizeBaseUrl(baseUrl)}/anthropic`;
+}
+
+function configureClients({ client, baseUrl, homeDir = os.homedir() }) {
+  switch (client) {
+    case "codex":
+      return [configureCodex({ baseUrl, homeDir })];
+    case "claude":
+      return [configureClaude({ baseUrl, homeDir })];
+    case "both":
+      return [
+        configureCodex({ baseUrl, homeDir }),
+        configureClaude({ baseUrl, homeDir }),
+      ];
+    default:
+      throw new Error(`unsupported client ${JSON.stringify(client)}`);
+  }
+}
+
+function configureCodex({ baseUrl, homeDir = os.homedir() }) {
+  const configPath = path.join(homeDir, ".codex", "config.toml");
+  const desiredBaseUrl = codexProxyBaseUrl(baseUrl);
+  const existing = readFileIfExists(configPath);
+  const updated = updateCodexConfig(existing, desiredBaseUrl);
+  writeTextFile(configPath, updated);
+  return {
+    client: "codex",
+    path: configPath,
+    baseUrl: desiredBaseUrl,
+  };
+}
+
+function configureClaude({ baseUrl, homeDir = os.homedir() }) {
+  const configPath = path.join(homeDir, ".claude", "settings.json");
+  const desiredBaseUrl = claudeProxyBaseUrl(baseUrl);
+  const existing = readFileIfExists(configPath);
+  const updated = updateClaudeConfig(existing, desiredBaseUrl);
+  writeTextFile(configPath, `${JSON.stringify(updated, null, 2)}\n`);
+  return {
+    client: "claude",
+    path: configPath,
+    baseUrl: desiredBaseUrl,
+  };
+}
+
+function updateCodexConfig(content, desiredBaseUrl) {
+  const managedBlock = [
+    KLOVIS_BEGIN_MARKER,
+    `openai_base_url = ${tomlString(desiredBaseUrl)}`,
+    KLOVIS_END_MARKER,
+  ].join("\n");
+
+  if (!content.trim()) {
+    return `${managedBlock}\n`;
+  }
+
+  const managedBlockPattern = new RegExp(
+    `${escapeRegExp(KLOVIS_BEGIN_MARKER)}[\\s\\S]*?${escapeRegExp(KLOVIS_END_MARKER)}`,
+    "m",
+  );
+  if (managedBlockPattern.test(content)) {
+    return ensureTrailingNewline(content.replace(managedBlockPattern, managedBlock));
+  }
+
+  const openAIBaseURLPattern = /^openai_base_url\s*=.*$/m;
+  if (openAIBaseURLPattern.test(content)) {
+    return ensureTrailingNewline(
+      content.replace(openAIBaseURLPattern, `openai_base_url = ${tomlString(desiredBaseUrl)}`),
+    );
+  }
+
+  const trimmed = content.replace(/\s+$/, "");
+  return `${trimmed}\n\n${managedBlock}\n`;
+}
+
+function updateClaudeConfig(content, desiredBaseUrl) {
+  let parsed;
+  if (content.trim() === "") {
+    parsed = {};
+  } else {
+    try {
+      parsed = JSON.parse(content);
+    } catch (error) {
+      throw new Error(`invalid Claude settings JSON: ${error.message}`);
+    }
+  }
+
+  if (parsed === null || Array.isArray(parsed) || typeof parsed !== "object") {
+    throw new Error("invalid Claude settings JSON: top-level value must be an object");
+  }
+
+  const env = parsed.env;
+  if (env !== undefined && (env === null || Array.isArray(env) || typeof env !== "object")) {
+    throw new Error("invalid Claude settings JSON: env must be an object");
+  }
+
+  parsed.env = { ...(env || {}), ANTHROPIC_BASE_URL: desiredBaseUrl };
+  return parsed;
+}
+
+function readFileIfExists(filePath) {
+  if (!fs.existsSync(filePath)) {
+    return "";
+  }
+  return fs.readFileSync(filePath, "utf8");
+}
+
+function writeTextFile(filePath, content) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content, "utf8");
+}
+
+function tomlString(value) {
+  return JSON.stringify(String(value));
+}
+
+function ensureTrailingNewline(content) {
+  return content.endsWith("\n") ? content : `${content}\n`;
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+module.exports = {
+  DEFAULT_BASE_URL,
+  claudeProxyBaseUrl,
+  codexProxyBaseUrl,
+  configureClaude,
+  configureClients,
+  configureCodex,
+  normalizeBaseUrl,
+  updateClaudeConfig,
+  updateCodexConfig,
+};

package/npm/lib/install.js

@@ -0,0 +1,205 @@
+"use strict";
+
+const fs = require("node:fs");
+const https = require("node:https");
+const path = require("node:path");
+const { pipeline } = require("node:stream/promises");
+
+const RELEASE_HOST = "https://github.com";
+
+function detectTarget(platform = process.platform, arch = process.arch) {
+  const key = `${platform}/${arch}`;
+  switch (key) {
+    case "darwin/arm64":
+      return { os: "darwin", arch: "arm64", extension: "" };
+    case "darwin/x64":
+      return { os: "darwin", arch: "amd64", extension: "" };
+    case "linux/arm64":
+      return { os: "linux", arch: "arm64", extension: "" };
+    case "linux/x64":
+      return { os: "linux", arch: "amd64", extension: "" };
+    case "win32/arm64":
+      return { os: "windows", arch: "arm64", extension: ".exe" };
+    case "win32/x64":
+      return { os: "windows", arch: "amd64", extension: ".exe" };
+    default:
+      throw new Error(
+        `unsupported platform ${JSON.stringify(platform)} and architecture ${JSON.stringify(arch)}`,
+      );
+  }
+}
+
+function releaseTag(version) {
+  const trimmed = String(version || "").trim();
+  if (!trimmed) {
+    throw new Error("missing package version");
+  }
+  return trimmed.startsWith("v") ? trimmed : `v${trimmed}`;
+}
+
+function normalizedVersion(version) {
+  return releaseTag(version).slice(1);
+}
+
+function binaryFileName(platform = process.platform) {
+  return platform === "win32" ? "klovys99.exe" : "klovys99";
+}
+
+function releaseAssetName(version, target) {
+  return `klovys99_${normalizedVersion(version)}_${target.os}_${target.arch}${target.extension}`;
+}
+
+function releaseAssetUrl(version, target, repository = defaultRepository()) {
+  const tag = releaseTag(version);
+  const assetName = releaseAssetName(version, target);
+  return `${RELEASE_HOST}/${repository.owner}/${repository.name}/releases/download/${tag}/${assetName}`;
+}
+
+function readPackageManifest(packageRoot) {
+  const manifestPath = path.join(packageRoot, "package.json");
+  return JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+}
+
+function readPackageVersion(packageRoot) {
+  return readPackageManifest(packageRoot).version;
+}
+
+function readRepository(packageRoot) {
+  const manifest = readPackageManifest(packageRoot);
+  const value =
+    typeof manifest.repository === "string"
+      ? manifest.repository
+      : manifest.repository && typeof manifest.repository.url === "string"
+        ? manifest.repository.url
+        : "";
+  return parseRepository(value);
+}
+
+function defaultRepository() {
+  return {
+    owner: "Korbicorp",
+    name: "klovys99",
+  };
+}
+
+function parseRepository(value) {
+  const trimmed = String(value || "").trim();
+  if (!trimmed) {
+    return defaultRepository();
+  }
+
+  const normalized = trimmed
+    .replace(/^git\+/, "")
+    .replace(/^git@github\.com:/, "https://github.com/")
+    .replace(/\.git$/, "");
+  const match = normalized.match(/github\.com\/([^/]+)\/([^/]+)$/);
+  if (!match) {
+    return defaultRepository();
+  }
+
+  return {
+    owner: match[1],
+    name: match[2],
+  };
+}
+
+async function installReleaseBinary({
+  version,
+  packageRoot,
+  platform = process.platform,
+  arch = process.arch,
+}) {
+  const target = detectTarget(platform, arch);
+  const binaryPath = path.join(packageRoot, "dist", binaryFileName(platform));
+  const assetUrl = releaseAssetUrl(version, target, readRepository(packageRoot));
+
+  await fs.promises.mkdir(path.dirname(binaryPath), { recursive: true });
+  await downloadToFile(assetUrl, binaryPath);
+
+  if (platform !== "win32") {
+    await fs.promises.chmod(binaryPath, 0o755);
+  }
+
+  return {
+    assetUrl,
+    binaryPath,
+    target,
+  };
+}
+
+async function downloadToFile(url, destinationPath) {
+  const tempPath = `${destinationPath}.tmp`;
+  try {
+    await downloadWithRedirects(url, tempPath, 5);
+    await fs.promises.rename(tempPath, destinationPath);
+  } catch (error) {
+    await fs.promises.rm(tempPath, { force: true });
+    throw error;
+  }
+}
+
+async function downloadWithRedirects(url, destinationPath, redirectsRemaining) {
+  const response = await request(url);
+
+  if (response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
+    if (redirectsRemaining <= 0) {
+      response.resume();
+      throw new Error(`too many redirects while downloading ${url}`);
+    }
+    const redirectedUrl = new URL(response.headers.location, url).toString();
+    response.resume();
+    return downloadWithRedirects(redirectedUrl, destinationPath, redirectsRemaining - 1);
+  }
+
+  if (response.statusCode !== 200) {
+    const body = await readResponseBody(response);
+    throw new Error(
+      `download ${url} failed with status ${response.statusCode}${body ? `: ${body}` : ""}`,
+    );
+  }
+
+  const file = fs.createWriteStream(destinationPath, { mode: 0o755 });
+  await pipeline(response, file);
+}
+
+function request(url) {
+  return new Promise((resolve, reject) => {
+    const req = https.get(
+      url,
+      {
+        headers: {
+          "user-agent": "klovys99-installer",
+        },
+      },
+      resolve,
+    );
+    req.on("error", reject);
+  });
+}
+
+async function readResponseBody(response) {
+  let body = "";
+  response.setEncoding("utf8");
+  for await (const chunk of response) {
+    body += chunk;
+    if (body.length > 512) {
+      body = `${body.slice(0, 512)}...`;
+      break;
+    }
+  }
+  return body.trim();
+}
+
+module.exports = {
+  binaryFileName,
+  defaultRepository,
+  detectTarget,
+  installReleaseBinary,
+  normalizedVersion,
+  parseRepository,
+  readPackageVersion,
+  readRepository,
+  releaseAssetName,
+  releaseAssetUrl,
+  releaseTag,
+};

package/npm/postinstall.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+const { configureClients, normalizeBaseUrl } = require("./lib/configure");
+const {
+  binaryFileName,
+  installReleaseBinary,
+  readPackageVersion,
+} = require("./lib/install");
+
+const packageRoot = path.resolve(__dirname, "..");
+
+async function main() {
+  await ensureBinaryInstalled();
+
+  const client = process.env.KLOVIS_CLIENT || process.env.KLOVIS_SETUP_CLIENT;
+  if (!client || process.env.KLOVIS_SKIP_CONFIGURE === "true") {
+    return;
+  }
+
+  const baseUrl = normalizeBaseUrl(process.env.KLOVIS_BASE_URL || "http://127.0.0.1:8080");
+  const results = configureClients({ client, baseUrl });
+  for (const result of results) {
+    process.stdout.write(
+      `Configured ${result.client} to use ${result.baseUrl} via ${result.path}\n`,
+    );
+  }
+}
+
+async function ensureBinaryInstalled() {
+  if (process.env.KLOVIS_SKIP_DOWNLOAD === "true") {
+    process.stdout.write("Skipping Klovys99 binary download because KLOVIS_SKIP_DOWNLOAD=true\n");
+    if (canBuildFromSource()) {
+      buildBinary();
+      return;
+    }
+    throw new Error(
+      "KLOVIS_SKIP_DOWNLOAD=true but no local Go source checkout is available for fallback build",
+    );
+  }
+
+  const version = readPackageVersion(packageRoot);
+  try {
+    const result = await installReleaseBinary({ version, packageRoot });
+    process.stdout.write(`Installed Klovys99 binary from ${result.assetUrl}\n`);
+    return;
+  } catch (error) {
+    if (!canBuildFromSource()) {
+      throw new Error(
+        `unable to install Klovys99 prebuilt binary: ${error.message}. ` +
+          "This package expects a published GitHub release for the current version.",
+      );
+    }
+    process.stdout.write(
+      `Prebuilt Klovys99 binary download failed (${error.message}). Falling back to local Go build.\n`,
+    );
+  }
+
+  buildBinary();
+}
+
+function canBuildFromSource() {
+  return (
+    process.env.KLOVIS_SKIP_BUILD !== "true" &&
+    fs.existsSync(path.join(packageRoot, "cmd", "klovys99"))
+  );
+}
+
+function buildBinary() {
+  const binaryName = binaryFileName(process.platform);
+  const binaryPath = path.join(packageRoot, "dist", binaryName);
+  fs.mkdirSync(path.dirname(binaryPath), { recursive: true });
+
+  const result = spawnSync("go", ["build", "-o", binaryPath, "./cmd/klovys99"], {
+    cwd: packageRoot,
+    stdio: "inherit",
+    env: process.env,
+  });
+
+  if (result.error) {
+    throw new Error(`unable to run go build: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(`go build failed with exit code ${result.status}`);
+  }
+}
+
+try {
+  Promise.resolve(main()).catch((error) => {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  });
+} catch (error) {
+  process.stderr.write(`${error.message}\n`);
+  process.exitCode = 1;
+}

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "klovys99",
+  "version": "0.1.0-main.10",
+  "description": "Local prompt anonymizing proxy for Codex and Claude Code",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Korbicorp/klovys99.git"
+  },
+  "homepage": "https://github.com/Korbicorp/klovys99",
+  "bugs": {
+    "url": "https://github.com/Korbicorp/klovys99/issues"
+  },
+  "files": [
+    "LICENSE",
+    "README.md",
+    "npm/cli.js",
+    "npm/postinstall.js",
+    "npm/lib/"
+  ],
+  "bin": {
+    "klovis": "npm/cli.js",
+    "klovys99": "npm/cli.js"
+  },
+  "scripts": {
+    "cli": "node npm/cli.js",
+    "postinstall": "node npm/postinstall.js",
+    "test:node": "node --test npm/test/*.test.js"
+  }
+}