llm-switcher 1.1.0

package/tests/blindfold.test.mjs

@@ -0,0 +1,307 @@
+// Tests for blindfold/blindfold.mjs — the routing decision of a TLS-intercepting proxy.
+//
+// Real-world failure (2026-09-20, adversarial review): the first version decided with a
+// bare `startsWith(API_PREFIX)` on the raw request target. Node does not normalize a
+// request target, but the gateway does (`new URL(...).pathname`). So
+// `/backend-api/codex/%2e%2e/api/logs` passed the prefix test, was forwarded as
+// `/v1/%2e%2e/api/logs`, and the gateway resolved it to `/api/logs`. The forwarded
+// headers also forge a loopback Host, which satisfies the admin API's only guard.
+// One request through the proxy could read the provider API key.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import zlib from 'node:zlib';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import http from 'node:http';
+import net from 'node:net';
+import {
+  isGatewayPath, toGatewayPath, isInterceptedHost, isLocalAddress, checkDestination,
+  API_PREFIX, GATEWAY_PREFIX, redactHeaders, captureName, decodeBody, writeCaptureFile,
+  relayToGateway, relayUpgradeToGateway
+} from '../blindfold/blindfold.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+test('a dot-segment escape never reaches the gateway', () => {
+  for (const attack of [
+    '/backend-api/codex/%2e%2e/api/logs',
+    '/backend-api/codex/../api/logs',
+    '/backend-api/codex/%2E%2E/%2e%2e/api/fetch-models',
+    '/backend-api/codex/a/../../api/save-profile'
+  ]) {
+    assert.equal(isGatewayPath(attack), false, `must not route: ${attack}`);
+  }
+});
+
+test('a path that only shares the prefix string is passed through', () => {
+  assert.equal(isGatewayPath('/backend-api/codex-usage'), false);
+  assert.equal(isGatewayPath('/backend-api/codexfoo'), false);
+  assert.equal(isGatewayPath('/backend-api/codex_settings'), false);
+});
+
+test('a real Codex API path is routed, and its query string survives', () => {
+  assert.equal(isGatewayPath('/backend-api/codex/responses'), true);
+  assert.equal(isGatewayPath(API_PREFIX), true);
+  assert.equal(toGatewayPath('/backend-api/codex/x?y=1&z=2'), `${GATEWAY_PREFIX}/x?y=1&z=2`);
+  assert.equal(toGatewayPath('/backend-api/codex/responses'), `${GATEWAY_PREFIX}/responses`);
+});
+
+// A CONNECT to any other host must be tunneled, not intercepted: the process then
+// only copies bytes and never holds that host's plaintext.
+test('only the target host is intercepted; every other public host is tunneled', () => {
+  assert.equal(isInterceptedHost('chatgpt.com'), true);
+  for (const other of ['api.openai.com', 'auth.openai.com', 'example.com', 'chatgpt.com.evil.test']) {
+    assert.equal(isInterceptedHost(other), false, `must not intercept ${other}`);
+  }
+});
+
+// The listener is a proxy on loopback, so every local process can ask it for a
+// destination. A local destination would turn it into a way to reach a service that
+// listens only on this machine. The test runs on the resolved address, never on a spelling.
+test('a local or private address is refused', () => {
+  for (const local of [
+    '127.0.0.1', '127.255.0.9', '0.0.0.0', '::1', '::', '::ffff:127.0.0.1', '::ffff:10.1.2.3',
+    '10.0.0.5', '192.168.1.10', '172.16.0.1', '172.31.255.254', '169.254.169.254', 'fe80::1', 'fd00::1', 'not-an-address', ''
+  ]) {
+    assert.equal(isLocalAddress(local), true, `must refuse ${local || '(empty)'}`);
+  }
+  // Shared address space (cloud metadata at 100.100.100.200, CGNAT, Tailscale), benchmark and IETF blocks,
+  // and IPv4 that NAT64 or 6to4 carries inside an IPv6 address.
+  for (const local of ['100.100.100.200', '100.64.0.1', '198.18.0.1', '192.0.0.8', '64:ff9b::a9fe:a9fe', '64:ff9b::10.0.0.5', '2002:7f00:1::1', '2002:c0a8:0101::']) {
+    assert.equal(isLocalAddress(local), true, `must refuse ${local}`);
+  }
+  // A public address that only looks similar stays allowed, also inside NAT64 and 6to4.
+  for (const publicHost of ['172.32.0.1', '11.0.0.1', '193.168.1.10', '8.8.8.8', '2606:4700::1111', '64:ff9b::808:808', '2002:0808:0808::1', '100.128.0.1']) {
+    assert.equal(isLocalAddress(publicHost), false, `must not refuse ${publicHost}`);
+  }
+});
+
+test('checkDestination refuses a name when any answer is local, and returns the checked address', async () => {
+  const lookupOf = (answers) => async () => answers.map(address => ({ address, family: address.includes(':') ? 6 : 4 }));
+  assert.deepEqual(await checkDestination('api.example.test', { lookup: lookupOf(['93.184.216.34']) }), { address: '93.184.216.34' });
+  assert.match((await checkDestination('rebind.example.test', { lookup: lookupOf(['93.184.216.34', '127.0.0.1']) })).refused, /local address 127\.0\.0\.1/);
+  assert.match((await checkDestination('[::1]', { lookup: lookupOf(['::1']) })).refused, /local/);
+  assert.match((await checkDestination('', {})).refused, /no host/);
+  const failed = await checkDestination('nx.example.test', { lookup: async () => { throw Object.assign(new Error('x'), { code: 'ENOTFOUND' }); } });
+  assert.equal(failed.status, 502);
+  // Real resolver, numeric spellings: no network needed.
+  for (const spelling of ['2130706433', '0x7f000001', '0', '127.1', 'localhost']) {
+    assert.ok((await checkDestination(spelling)).refused, `must refuse ${spelling}`);
+  }
+});
+
+test('a malformed target is refused rather than guessed', () => {
+  for (const bad of ['', null, undefined, 'http://evil.example/backend-api/codex/responses']) {
+    assert.equal(isGatewayPath(bad), false, `must not route: ${String(bad)}`);
+  }
+});
+
+// A capture records what a real client sends, so it must never record how that
+// client authenticates. The header name stays so the request shape is still
+// readable; only the value goes.
+test('capture redaction removes credential values and keeps everything else', () => {
+  const out = redactHeaders({
+    'Authorization': 'Bearer secret-token',
+    'COOKIE': 'session=abc',
+    'X-Api-Key': 'sk-123',
+    'proxy-authorization': 'Basic zzz',
+    'Content-Type': 'application/json',
+    'user-agent': 'codex_cli_rs/0.154.0'
+  });
+  assert.equal(out['Authorization'], '<redacted>');
+  assert.equal(out['COOKIE'], '<redacted>', 'matching must be case-insensitive');
+  assert.equal(out['X-Api-Key'], '<redacted>');
+  assert.equal(out['proxy-authorization'], '<redacted>');
+  assert.equal(out['Content-Type'], 'application/json');
+  assert.equal(out['user-agent'], 'codex_cli_rs/0.154.0');
+  assert.ok(Object.keys(out).includes('Authorization'), 'the header name must survive');
+});
+
+// Real-world failure (2026-09-20): a capture of Claude Code recorded 647 bytes of
+// gzip for a response that carried a full SSE stream. The client sends
+// "accept-encoding: gzip", so reading the wire bytes as UTF-8 stores noise. The
+// capture looked like an empty response and the defect was invisible until the
+// file was parsed.
+test('a compressed response body is decoded for the capture', () => {
+  const sse = 'event: message_start\ndata: {"type":"message_start"}\n\n';
+  assert.equal(decodeBody(zlib.gzipSync(Buffer.from(sse)), 'gzip'), sse);
+  assert.equal(decodeBody(zlib.gzipSync(Buffer.from(sse)), 'GZIP'), sse, 'must be case-insensitive');
+  assert.equal(decodeBody(zlib.brotliCompressSync(Buffer.from(sse)), 'br'), sse);
+  assert.equal(decodeBody(zlib.deflateSync(Buffer.from(sse)), 'deflate'), sse);
+  assert.equal(decodeBody(zlib.zstdCompressSync(Buffer.from(sse)), 'zstd'), sse);
+});
+
+test('an unencoded body is passed through untouched', () => {
+  const plain = '{"ok":true}';
+  assert.equal(decodeBody(Buffer.from(plain), undefined), plain);
+  assert.equal(decodeBody(Buffer.from(plain), 'identity'), plain);
+  assert.equal(decodeBody(Buffer.from(plain), ''), plain);
+});
+
+// A truncated stream is normal: the client can abort mid-answer. The capture must
+// still be written, and it must not store bytes that read like a provider reply.
+test('a body that cannot be decoded reports the reason instead of storing noise', () => {
+  const broken = zlib.gzipSync(Buffer.from('hello')).subarray(0, 8);
+  const out = decodeBody(broken, 'gzip');
+  assert.match(out, /^\[capture: cannot decode gzip body of 8 bytes: /);
+});
+
+test('capture filenames carry no path separator', () => {
+  const n = captureName('post', '/backend-api/codex/responses?stream=true', 1700000000000);
+  assert.ok(!/[\\/]/.test(n), `unsafe filename: ${n}`);
+  assert.match(n, /^1700000000000-POST-/);
+  assert.ok(!n.includes('?'), 'the query string must not reach the filename');
+  assert.match(captureName('GET', '/'), /-root\.json$/);
+});
+
+// A capture holds full prompts and answers. It must stay private to the owner, and it must
+// never be written into a directory that another account created first.
+test('captures are written 0600 inside a 0700 directory, never into a foreign directory', { skip: process.platform === 'win32' && 'posix modes' }, () => {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-cap-'));
+  try {
+    const dir = path.join(base, 'captures');
+    assert.equal(writeCaptureFile(dir, 'a.json', { ok: true }), true);
+    assert.equal((fs.statSync(dir).mode & 0o777).toString(8), '700');
+    assert.equal((fs.statSync(path.join(dir, 'a.json')).mode & 0o777).toString(8), '600');
+
+    // A symlink planted at the capture path must not redirect captures or re-mode its target.
+    const target = path.join(base, 'target');
+    fs.mkdirSync(target, { mode: 0o755 });
+    fs.chmodSync(target, 0o755);
+    fs.symlinkSync(target, path.join(base, 'linked'));
+    assert.equal(writeCaptureFile(path.join(base, 'linked'), 'c.json', { ok: true }), false);
+    assert.equal((fs.statSync(target).mode & 0o777).toString(8), '755', 'the symlink target keeps its mode');
+    assert.deepEqual(fs.readdirSync(target), []);
+
+    const foreign = path.join(base, 'foreign');
+    fs.mkdirSync(foreign, { mode: 0o777 });
+    const otherUid = (process.getuid?.() ?? 0) + 4242;
+    assert.equal(writeCaptureFile(foreign, 'b.json', { ok: true }, { uid: otherUid }), false);
+    assert.deepEqual(fs.readdirSync(foreign), [], 'nothing is written into a directory owned by another uid');
+  } finally {
+    fs.rmSync(base, { recursive: true, force: true });
+  }
+});
+
+// make-certs.sh writes the CA key. With a directory in /tmp (the documented recipe) another
+// account can create it first or plant symlinks, so the script must refuse a directory it
+// does not own and must write every file private.
+test('make-certs.sh writes private files and refuses a directory it does not own', { skip: (process.platform === 'win32' || !fs.existsSync('/usr/bin/openssl')) && 'posix + openssl' }, () => {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-certs-'));
+  const script = path.join(ROOT, 'blindfold', 'make-certs.sh');
+  try {
+    const out = path.join(base, 'certs');
+    execFileSync('bash', [script, 'example.test', out], { stdio: 'ignore' });
+    assert.equal((fs.statSync(out).mode & 0o777).toString(8), '700');
+    for (const f of ['ca.key', 'leaf.key', 'ca.pem', 'leaf.pem']) {
+      assert.equal((fs.statSync(path.join(out, f)).mode & 0o777).toString(8), '600', f);
+    }
+    // A failed rebuild (here: no openssl on PATH) must leave the working set untouched.
+    const caBefore = fs.readFileSync(path.join(out, 'ca.pem'));
+    const bin = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-bin-'));
+    for (const tool of ['mkdir', 'stat', 'id', 'chmod', 'rm', 'cat', 'dirname', 'mv', 'mktemp']) {
+      const real = execFileSync('bash', ['-c', `command -v ${tool}`], { encoding: 'utf8' }).trim();
+      fs.symlinkSync(real, path.join(bin, tool));
+    }
+    let rebuildFailed = false;
+    try { execFileSync('/bin/bash', [script, 'example.test', out], { stdio: 'ignore', env: { ...process.env, PATH: bin } }); } catch { rebuildFailed = true; }
+    fs.rmSync(bin, { recursive: true, force: true });
+    assert.ok(rebuildFailed, 'the rebuild fails without openssl');
+    assert.deepEqual(fs.readFileSync(path.join(out, 'ca.pem')), caBefore, 'the previous CA survives a failed rebuild');
+    assert.ok(fs.existsSync(path.join(out, 'leaf.key')), 'the previous leaf key survives');
+    assert.deepEqual(fs.readdirSync(out).filter(f => f.startsWith('.build')), [], 'no build directory is left behind');
+
+    // /usr/share/doc exists and belongs to root: the script must stop before writing.
+    const rootOwned = '/usr/share/doc';
+    let failed = false;
+    try { execFileSync('bash', [script, 'example.test', rootOwned], { stdio: 'ignore' }); } catch { failed = true; }
+    assert.ok(failed, 'a directory owned by another account is refused with a non-zero exit');
+    assert.ok(!fs.existsSync(path.join(rootOwned, 'ca.key')));
+  } finally {
+    fs.rmSync(base, { recursive: true, force: true });
+  }
+});
+
+// ---- relay behaviour, through the real handlers against a stub gateway ----
+
+const CREDENTIALS = {
+  authorization: 'Bearer chatgpt-oauth', 'proxy-authorization': 'Basic x', cookie: 'sid=1',
+  'chatgpt-account-id': 'acct-1', 'openai-organization': 'org-1'
+};
+
+function listen(server) {
+  return new Promise(r => server.listen(0, '127.0.0.1', () => r(server.address().port)));
+}
+
+// The gateway port is plain HTTP on loopback. Codex's ChatGPT credentials must never travel
+// there: the gateway does not read them, and another account can hold a freed port.
+test('the gateway relay strips Codex credentials and keeps tracing headers', async () => {
+  const seen = [];
+  const stub = http.createServer((req, res) => { seen.push(req.headers); res.end('ok'); });
+  stub.on('upgrade', (req, socket) => { seen.push(req.headers); socket.end('HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n'); });
+  const stubPort = await listen(stub);
+  const front = http.createServer((req, res) => relayToGateway(req, res, { host: '127.0.0.1', port: stubPort }));
+  front.on('upgrade', (req, socket, head) => relayUpgradeToGateway(req, socket, head, { host: '127.0.0.1', port: stubPort }));
+  const frontPort = await listen(front);
+  try {
+    const r = await fetch(`http://127.0.0.1:${frontPort}${API_PREFIX}/responses`, { headers: { ...CREDENTIALS, 'x-request-id': 'trace-1' } });
+    assert.equal(await r.text(), 'ok');
+    await new Promise((resolve, reject) => {
+      const s = net.connect(frontPort, '127.0.0.1', () => {
+        const extra = Object.entries(CREDENTIALS).map(([k, v]) => `${k}: ${v}`).join('\r\n');
+        s.write(`GET ${API_PREFIX}/responses HTTP/1.1\r\nHost: chatgpt.com\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\nSec-WebSocket-Version: 13\r\nx-request-id: trace-2\r\n${extra}\r\n\r\n`);
+      });
+      s.on('data', () => { s.destroy(); resolve(); });
+      s.on('error', reject);
+    });
+    assert.equal(seen.length, 2);
+    for (const h of seen) {
+      for (const name of Object.keys(CREDENTIALS)) assert.equal(h[name], undefined, `${name} must not reach the gateway`);
+      assert.match(h['x-request-id'], /^trace-/);
+    }
+  } finally {
+    front.close(); stub.close();
+  }
+});
+
+test('the gateway relay ends the client response when the gateway dies mid-body', async () => {
+  const stub = http.createServer((req, res) => { res.writeHead(200, { 'content-type': 'text/event-stream' }); res.write('data: partial\n\n'); setTimeout(() => res.socket.destroy(), 50); });
+  const stubPort = await listen(stub);
+  const front = http.createServer((req, res) => relayToGateway(req, res, { host: '127.0.0.1', port: stubPort }));
+  const frontPort = await listen(front);
+  try {
+    const outcome = await new Promise(resolve => {
+      const timer = setTimeout(() => resolve('hung'), 2000);
+      http.get({ host: '127.0.0.1', port: frontPort, path: `${API_PREFIX}/responses` }, (res) => {
+        res.on('data', () => {});
+        res.on('close', () => { clearTimeout(timer); resolve('ended'); });
+      }).on('error', () => { clearTimeout(timer); resolve('ended'); });
+    });
+    assert.equal(outcome, 'ended');
+  } finally {
+    front.close(); stub.close();
+  }
+});
+
+test('the gateway relay closes the upstream request when the client aborts', async () => {
+  let upstreamClosed;
+  const closed = new Promise(r => { upstreamClosed = r; });
+  const stub = http.createServer((req, res) => { res.writeHead(200); res.write('start'); req.socket.on('close', upstreamClosed); });
+  const stubPort = await listen(stub);
+  const front = http.createServer((req, res) => relayToGateway(req, res, { host: '127.0.0.1', port: stubPort }));
+  const frontPort = await listen(front);
+  try {
+    const client = http.get({ host: '127.0.0.1', port: frontPort, path: `${API_PREFIX}/responses` }, (res) => {
+      res.once('data', () => client.destroy());
+    });
+    client.on('error', () => {});
+    const result = await Promise.race([closed.then(() => 'closed'), new Promise(r => setTimeout(() => r('still open'), 2000))]);
+    assert.equal(result, 'closed');
+  } finally {
+    front.close(); stub.close();
+  }
+});

package/tests/blindfold.wire.test.mjs

@@ -0,0 +1,170 @@
+// Wire tests for blindfold.mjs: a real interceptor process, a real TLS session through CONNECT,
+// and a fake gateway. They cover the capture path and the local-destination guard (audit F03,
+// F15, F16).
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import tls from 'node:tls';
+import crypto from 'node:crypto';
+import { spawn, execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { createFrameReader } from '../blindfold/wsframe.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HAS_OPENSSL = (() => { try { execFileSync('openssl', ['version'], { stdio: 'ignore' }); return true; } catch { return false; } })();
+const SKIP = (process.platform === 'win32' || !HAS_OPENSSL) && 'posix + openssl';
+
+let dir, certDir, captureDir, gateway, gatewayPort;
+
+function freePort() {
+  return new Promise(resolve => { const s = net.createServer().listen(0, '127.0.0.1', () => { const { port } = s.address(); s.close(() => resolve(port)); }); });
+}
+
+function frame(opcode, text, { mask = false, length } = {}) {
+  const data = Buffer.from(text);
+  const len = length ?? data.length;
+  const head = len < 126 ? Buffer.from([0x80 | opcode, (mask ? 0x80 : 0) | len])
+    : Buffer.concat([Buffer.from([0x80 | opcode, (mask ? 0x80 : 0) | 127]), (() => { const b = Buffer.alloc(8); b.writeBigUInt64BE(BigInt(len)); return b; })()]);
+  if (!mask) return Buffer.concat([head, data]);
+  const key = crypto.randomBytes(4);
+  return Buffer.concat([head, key, Buffer.from(data.map((b, i) => b ^ key[i & 3]))]);
+}
+
+// Fake gateway: answers the WS upgrade, then greets with one text frame.
+function startGateway() {
+  gateway = net.createServer(socket => {
+    let head = '';
+    socket.on('data', chunk => {
+      if (head.includes('\r\n\r\n')) return;
+      head += chunk.toString('latin1');
+      if (!head.includes('\r\n\r\n')) return;
+      socket.write('HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: x\r\n\r\n');
+      socket.write(frame(1, 'hello from gateway'));
+    });
+    socket.on('error', () => {});
+  });
+  return new Promise(r => gateway.listen(0, '127.0.0.1', () => { gatewayPort = gateway.address().port; r(); }));
+}
+
+async function startInterceptor() {
+  const port = await freePort();
+  const child = spawn(process.execPath, [path.join(ROOT, 'blindfold', 'blindfold.mjs'),
+    '--port', String(port), '--gateway-port', String(gatewayPort), '--certs', certDir,
+    '--capture', captureDir, '--token-file', path.join(dir, 'admin.token')], { stdio: ['ignore', 'pipe', 'pipe'] });
+  let out = '';
+  child.stdout.on('data', d => { out += d; });
+  child.stderr.on('data', d => { out += d; });
+  const exited = new Promise(r => child.on('exit', (code, signal) => r({ code, signal })));
+  for (let i = 0; i < 50 && !out.includes('proxy on'); i++) await new Promise(r => setTimeout(r, 100));
+  assert.match(out, /proxy on/, out);
+  return { port, child, exited, output: () => out };
+}
+
+function connectVia(port, target) {
+  return new Promise((resolve, reject) => {
+    const s = net.connect(port, '127.0.0.1', () => s.write(`CONNECT ${target} HTTP/1.1\r\nHost: ${target}\r\n\r\n`));
+    let reply = '';
+    const onData = d => {
+      reply += d.toString('latin1');
+      if (!reply.includes('\r\n\r\n')) return;
+      s.off('data', onData);
+      resolve({ socket: s, status: Number(reply.split(' ')[1]) });
+    };
+    s.on('data', onData);
+    s.on('error', reject);
+  });
+}
+
+// CONNECT, TLS with the private CA, then a WS upgrade on the Codex path.
+async function openCodexWs(port) {
+  const { socket } = await connectVia(port, 'chatgpt.com:443');
+  const secure = tls.connect({ socket, servername: 'chatgpt.com', ca: fs.readFileSync(path.join(certDir, 'ca.pem')) });
+  await new Promise((r, j) => { secure.once('secureConnect', r); secure.once('error', j); });
+  secure.write(`GET /backend-api/codex/responses HTTP/1.1\r\nHost: chatgpt.com\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Key: ${crypto.randomBytes(16).toString('base64')}\r\n\r\n`);
+  const read = createFrameReader();
+  const messages = [];
+  let head = '';
+  secure.on('data', d => {
+    if (!head.includes('\r\n\r\n')) {
+      head += d.toString('latin1');
+      const end = head.indexOf('\r\n\r\n');
+      if (end < 0) return;
+      d = Buffer.from(head.slice(end + 4), 'latin1');
+    }
+    for (const f of read(d)) messages.push(f.payload?.toString());
+  });
+  secure.on('error', () => {});
+  for (let i = 0; i < 50 && !messages.length; i++) await new Promise(r => setTimeout(r, 50));
+  assert.deepEqual(messages, ['hello from gateway']);
+  return secure;
+}
+
+const captures = () => fs.readdirSync(captureDir).filter(f => f.endsWith('.json')).map(f => fs.readFileSync(path.join(captureDir, f), 'utf8'));
+
+before(async () => {
+  if (SKIP) return;
+  dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-wire-'));
+  certDir = path.join(dir, 'certs');
+  captureDir = path.join(dir, 'captures');
+  execFileSync('bash', [path.join(ROOT, 'blindfold', 'make-certs.sh'), 'chatgpt.com', certDir], { stdio: 'ignore' });
+  fs.writeFileSync(path.join(dir, 'admin.token'), 'wire-test-token', { mode: 0o600 });
+  await startGateway();
+});
+
+after(() => {
+  gateway?.close();
+  if (dir) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+test('a SIGTERM writes the WS capture that is still waiting for its quiet period', { skip: SKIP }, async () => {
+  fs.rmSync(captureDir, { recursive: true, force: true });
+  const bf = await startInterceptor();
+  try {
+    const ws = await openCodexWs(bf.port);
+    ws.write(frame(1, 'hi from client', { mask: true }));
+    await new Promise(r => setTimeout(r, 100));
+    bf.child.kill('SIGTERM');
+    await bf.exited;
+    const all = captures().join('\n');
+    assert.match(all, /hello from gateway/);
+    assert.match(all, /hi from client/);
+  } finally {
+    bf.child.kill('SIGKILL');
+  }
+});
+
+test('an undecodable WS frame in capture mode is recorded, and the interceptor keeps running', { skip: SKIP }, async () => {
+  fs.rmSync(captureDir, { recursive: true, force: true });
+  const bf = await startInterceptor();
+  try {
+    const ws = await openCodexWs(bf.port);
+    ws.write(frame(1, '', { mask: true, length: 2 ** 60 }).subarray(0, 14));
+    await new Promise(r => setTimeout(r, 300));
+    assert.equal(bf.child.exitCode, null, `interceptor exited:\n${bf.output()}`);
+    const next = await openCodexWs(bf.port);
+    next.destroy();
+    ws.destroy();
+    bf.child.kill('SIGTERM');
+    await bf.exited;
+    assert.match(captures().join('\n'), /"type": "error"/);
+  } finally {
+    bf.child.kill('SIGKILL');
+  }
+});
+
+test('a CONNECT to a local address is refused whatever its spelling', { skip: SKIP }, async () => {
+  const bf = await startInterceptor();
+  try {
+    for (const target of ['2130706433:22', '0x7f000001:22', '0:22', '[::ffff:127.0.0.1]:22', '[::]:22', '127.1:22']) {
+      const { socket, status } = await connectVia(bf.port, target);
+      socket.destroy();
+      assert.equal(status, 403, target);
+    }
+    assert.match(bf.output(), /refused CONNECT/);
+  } finally {
+    bf.child.kill('SIGKILL');
+  }
+});