mancode 0.6.3 → 0.6.5

package/dist/chunk-THOE33LU.js

@@ -0,0 +1,1124 @@
+import {
+  GatewayError,
+  SseDecoder,
+  encodeSse,
+  gatewayErrorCode
+} from "./chunk-GI24QVXE.js";
+import {
+  readProjectRuntimeContext
+} from "./chunk-WRBNOPFA.js";
+import {
+  DEFAULT_RULE_IDS,
+  RULESET_VERSION
+} from "./chunk-IRZQYMHD.js";
+
+// src/commands/privacy-gateway.ts
+import { execFile } from "child_process";
+import { randomBytes as randomBytes2 } from "crypto";
+import { rm as rm2 } from "fs/promises";
+import path2 from "path";
+import { promisify } from "util";
+
+// src/gateway/config.ts
+import {
+  createHash,
+  createHmac,
+  randomBytes,
+  timingSafeEqual
+} from "crypto";
+import { constants } from "fs";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  open,
+  readdir,
+  realpath,
+  rename,
+  rm,
+  writeFile
+} from "fs/promises";
+import os from "os";
+import path from "path";
+var UPSTREAMS = {
+  openai: {
+    origin: "https://api.openai.com",
+    protocol: "responses",
+    envKey: "OPENAI_API_KEY"
+  },
+  anthropic: {
+    origin: "https://api.anthropic.com",
+    protocol: "messages",
+    envKey: "ANTHROPIC_API_KEY"
+  }
+};
+var hashValue = (value) => createHash("sha256").update(value).digest("hex");
+async function gatewayLocation(root) {
+  const resolved = await realpath(root);
+  let workspaceId = null;
+  let checkoutId = null;
+  let initialized = false;
+  try {
+    await lstat(path.join(resolved, ".mancode"));
+    initialized = true;
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw new GatewayError("MANCODE_GATEWAY_SCOPE_UNAVAILABLE");
+  }
+  if (initialized) {
+    try {
+      const runtime = await readProjectRuntimeContext(resolved);
+      workspaceId = runtime.workspaceId;
+      checkoutId = runtime.checkoutId;
+    } catch {
+      throw new GatewayError("MANCODE_GATEWAY_SCOPE_UNAVAILABLE");
+    }
+  }
+  const physical = await lstat(resolved);
+  const scope = {
+    principal: hashValue(`${os.homedir()}:${process.getuid?.() ?? "user"}`),
+    checkout: hashValue(
+      JSON.stringify({
+        root: resolved,
+        device: physical.dev,
+        inode: physical.ino,
+        created: physical.birthtimeMs,
+        workspaceId,
+        checkoutId
+      })
+    ),
+    workspaceId,
+    checkoutId
+  };
+  return {
+    directory: path.join(
+      os.homedir(),
+      ".mancode",
+      "privacy-gateway",
+      scope.checkout
+    ),
+    scope
+  };
+}
+function assertKeys(value, expected) {
+  if (Object.keys(value).some((key) => !expected.includes(key)) || expected.some((key) => !(key in value)))
+    throw new GatewayError("MANCODE_GATEWAY_CONFIG_INVALID");
+}
+function parseGatewayConfig(value, scope) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new GatewayError("MANCODE_GATEWAY_CONFIG_INVALID");
+  const config = value;
+  assertKeys(config, [
+    "schemaVersion",
+    "enabled",
+    "upstreamId",
+    "envKey",
+    "clientHost",
+    "accessToken",
+    "port",
+    "scope",
+    "ruleIds",
+    "rulesetVersion"
+  ]);
+  if (config.schemaVersion !== 1 || typeof config.enabled !== "boolean" || !(config.upstreamId === "openai" || config.upstreamId === "anthropic") || typeof config.envKey !== "string" || !/^[A-Z][A-Z0-9_]{0,63}$/.test(config.envKey) || typeof config.accessToken !== "string" || !/^[a-f0-9]{64}$/.test(config.accessToken) || !Number.isInteger(config.port) || Number(config.port) < 1024 || Number(config.port) > 65535 || !["codex-cli/0.153.4", "claude-code/2.1.142", "unverified"].includes(
+    String(config.clientHost)
+  ) || config.rulesetVersion !== RULESET_VERSION || !Array.isArray(config.ruleIds) || config.ruleIds.length === 0 || config.ruleIds.some(
+    (id) => typeof id !== "string" || !DEFAULT_RULE_IDS.includes(id)
+  ) || new Set(config.ruleIds).size !== config.ruleIds.length)
+    throw new GatewayError("MANCODE_GATEWAY_CONFIG_INVALID");
+  const binding = config.scope;
+  if (config.clientHost === "codex-cli/0.153.4" && config.upstreamId !== "openai" || config.clientHost === "claude-code/2.1.142" && config.upstreamId !== "anthropic")
+    throw new GatewayError("MANCODE_GATEWAY_HOST_UPSTREAM_MISMATCH");
+  if (binding?.principal !== scope.principal || binding?.checkout !== scope.checkout || binding?.workspaceId !== scope.workspaceId || binding?.checkoutId !== scope.checkoutId || Object.keys(binding).length !== 4)
+    throw new GatewayError("MANCODE_GATEWAY_CONFIG_SCOPE_MISMATCH");
+  return { ...config, scope: { ...scope } };
+}
+async function readPrivateJson(file) {
+  let handle;
+  try {
+    handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const stat = await handle.stat();
+    if (!stat.isFile() || stat.size > 64 * 1024 || process.platform !== "win32" && ((stat.mode & 63) !== 0 || stat.uid !== process.getuid?.()))
+      throw new GatewayError("MANCODE_GATEWAY_PRIVATE_FILE_UNSAFE");
+    return JSON.parse(await handle.readFile("utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    if (error instanceof GatewayError) throw error;
+    throw new GatewayError("MANCODE_GATEWAY_PRIVATE_FILE_INVALID");
+  } finally {
+    await handle?.close();
+  }
+}
+async function readGatewayConfig(root) {
+  const location = await gatewayLocation(root);
+  const value = await readPrivateJson(
+    path.join(location.directory, "config.json")
+  );
+  return value === null ? null : parseGatewayConfig(value, location.scope);
+}
+async function ensurePrivateDirectory(directory) {
+  await mkdir(directory, { recursive: true, mode: 448 });
+  const stat = await lstat(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || process.platform !== "win32" && stat.uid !== process.getuid?.())
+    throw new GatewayError("MANCODE_GATEWAY_PRIVATE_DIRECTORY_UNSAFE");
+  await chmod(directory, 448);
+}
+async function writePrivateJson(file, value) {
+  const temporary = `${file}.${randomBytes(8).toString("hex")}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(value, null, 2)}
+`, {
+      flag: "wx",
+      mode: 384
+    });
+    await rename(temporary, file);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function configureGateway(root, options) {
+  const binding = await gatewayLocation(root);
+  if (!binding.scope.workspaceId || !binding.scope.checkoutId)
+    throw new GatewayError("MANCODE_GATEWAY_NOT_INITIALIZED");
+  return withGatewayLifecycleLock(root, async () => {
+    const location = await gatewayLocation(root);
+    const existing = await readGatewayConfig(root);
+    const config = parseGatewayConfig(
+      {
+        schemaVersion: 1,
+        enabled: options.enabled,
+        upstreamId: options.upstreamId ?? existing?.upstreamId ?? "openai",
+        envKey: options.envKey ?? (options.upstreamId && options.upstreamId !== existing?.upstreamId ? UPSTREAMS[options.upstreamId].envKey : existing?.envKey) ?? UPSTREAMS[options.upstreamId ?? "openai"].envKey,
+        clientHost: options.clientHost ?? (options.upstreamId && options.upstreamId !== existing?.upstreamId ? "unverified" : existing?.clientHost) ?? "unverified",
+        accessToken: existing?.accessToken ?? randomBytes(32).toString("hex"),
+        port: options.port ?? existing?.port ?? 17641,
+        scope: location.scope,
+        ruleIds: existing?.ruleIds ?? [...DEFAULT_RULE_IDS],
+        rulesetVersion: RULESET_VERSION
+      },
+      location.scope
+    );
+    await writePrivateJson(
+      path.join(location.directory, "config.json"),
+      config
+    );
+    return config;
+  });
+}
+async function withGatewayLifecycleLock(root, action) {
+  const location = await gatewayLocation(root);
+  await ensurePrivateDirectory(path.dirname(location.directory));
+  await ensurePrivateDirectory(location.directory);
+  const lock = path.join(location.directory, "config-locks");
+  const release = await acquireConfigLock(lock);
+  try {
+    return await action();
+  } finally {
+    await release();
+  }
+}
+async function acquireConfigLock(lock) {
+  await ensurePrivateDirectory(lock);
+  const owner = {
+    processId: process.pid,
+    nonce: randomBytes(16).toString("hex"),
+    choosing: true,
+    ticket: 0
+  };
+  const candidate = path.join(lock, `${owner.nonce}.json`);
+  const contenders = async () => {
+    const result = [];
+    for (const name of await readdir(lock)) {
+      if (!/^[a-f0-9]{32}\.json$/.test(name)) continue;
+      const file = path.join(lock, name);
+      const current = await readPrivateJson(file);
+      if (!current) continue;
+      if (!Number.isSafeInteger(current.processId) || current.processId < 1 || current.nonce !== name.slice(0, -5) || typeof current.choosing !== "boolean" || !Number.isSafeInteger(current.ticket) || current.ticket < 0)
+        throw new GatewayError("MANCODE_GATEWAY_CONFIG_LOCK_UNVERIFIED");
+      if (!processIsAlive(current.processId)) {
+        await rm(file, { force: true });
+        continue;
+      }
+      result.push(current);
+    }
+    if (result.length > 64)
+      throw new GatewayError("MANCODE_GATEWAY_CONFIG_BUSY", 409);
+    return result;
+  };
+  await writePrivateJson(candidate, owner);
+  let acquired = false;
+  try {
+    owner.ticket = Math.max(0, ...(await contenders()).map((other) => other.ticket)) + 1;
+    if (!Number.isSafeInteger(owner.ticket))
+      throw new GatewayError("MANCODE_GATEWAY_CONFIG_BUSY", 409);
+    owner.choosing = false;
+    await writePrivateJson(candidate, owner);
+    for (let attempt = 0; attempt < 100; attempt++) {
+      const blocked = (await contenders()).some(
+        (other) => other.nonce !== owner.nonce && (other.choosing || other.ticket < owner.ticket || other.ticket === owner.ticket && other.nonce < owner.nonce)
+      );
+      if (!blocked) {
+        acquired = true;
+        return async () => {
+          await rm(candidate, { force: true });
+        };
+      }
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    throw new GatewayError("MANCODE_GATEWAY_CONFIG_BUSY", 409);
+  } finally {
+    if (!acquired) await rm(candidate, { force: true });
+  }
+}
+function processIsAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid < 1) return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code !== "ESRCH";
+  }
+}
+function gatewayConfigDigest(config) {
+  return hashValue(
+    JSON.stringify({
+      upstreamId: config.upstreamId,
+      envKey: config.envKey,
+      clientHost: config.clientHost,
+      port: config.port,
+      scope: config.scope,
+      rulesetVersion: config.rulesetVersion,
+      ruleIds: config.ruleIds,
+      tokenBinding: hashValue(config.accessToken)
+    })
+  );
+}
+function constantTokenEquals(left, right) {
+  const a = Buffer.from(left);
+  const b = Buffer.from(right);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function controlProof(token, instanceId, loadedDigest, challenge, action = "probe") {
+  return createHmac("sha256", token).update(
+    JSON.stringify({
+      purpose: "mancode-gateway-control-v1",
+      instanceId,
+      loadedDigest,
+      challenge,
+      action
+    })
+  ).digest("hex");
+}
+
+// src/gateway/server.ts
+import { randomUUID } from "crypto";
+import { once } from "events";
+import {
+  createServer
+} from "http";
+
+// src/gateway/worker-client.ts
+import { Worker } from "worker_threads";
+var GatewayWorker = class {
+  worker;
+  sequence = 0;
+  closed = false;
+  pending = /* @__PURE__ */ new Map();
+  constructor(scope, rules, host, url = new URL("./gateway/worker.js", import.meta.url)) {
+    this.worker = new Worker(url, {
+      workerData: { scope, rules, host },
+      resourceLimits: {
+        maxOldGenerationSizeMb: 128,
+        maxYoungGenerationSizeMb: 32
+      }
+    });
+    this.worker.on(
+      "message",
+      (message) => {
+        const pending = this.pending.get(message.sequence);
+        if (!pending) return;
+        clearTimeout(pending.timer);
+        this.pending.delete(message.sequence);
+        if (message.error)
+          pending.reject(new GatewayError(message.error, message.status));
+        else pending.resolve(message.value);
+      }
+    );
+    this.worker.on("error", () => {
+      void this.close();
+    });
+    this.worker.on("exit", () => {
+      void this.close();
+    });
+  }
+  call(operation) {
+    if (this.closed)
+      return Promise.reject(
+        new GatewayError("MANCODE_GATEWAY_WORKER_UNAVAILABLE", 503)
+      );
+    if (this.pending.size >= 32)
+      return Promise.reject(
+        new GatewayError("MANCODE_GATEWAY_WORKER_QUEUE_LIMIT", 429)
+      );
+    const sequence = ++this.sequence;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        void this.close();
+      }, 1e4);
+      this.pending.set(sequence, {
+        resolve: (value) => resolve(value),
+        reject,
+        timer
+      });
+      this.worker.postMessage({ sequence, operation });
+    });
+  }
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(
+        new GatewayError("MANCODE_GATEWAY_WORKER_UNAVAILABLE", 503)
+      );
+    }
+    this.pending.clear();
+    await this.worker.terminate();
+  }
+};
+
+// src/gateway/server.ts
+var GATEWAY_LIMITS = {
+  requestBytes: 1024 * 1024,
+  responseBytes: 4 * 1024 * 1024,
+  streamBytes: 16 * 1024 * 1024,
+  concurrentRequests: 8,
+  idleMs: 3e4,
+  generationMs: 3e5,
+  drainMs: 5e3
+};
+async function readBody(request, signal) {
+  const length = request.headers["content-length"];
+  if (length && (!/^\d+$/.test(length) || Number(length) > GATEWAY_LIMITS.requestBytes))
+    throw new GatewayError("MANCODE_GATEWAY_REQUEST_LIMIT", 413);
+  const parts = [];
+  let total = 0;
+  for await (const chunk of request) {
+    signal.throwIfAborted();
+    total += chunk.length;
+    if (total > GATEWAY_LIMITS.requestBytes)
+      throw new GatewayError("MANCODE_GATEWAY_REQUEST_LIMIT", 413);
+    parts.push(chunk);
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(
+      Buffer.concat(parts)
+    );
+  } catch {
+    throw new GatewayError("MANCODE_GATEWAY_INVALID_UTF8");
+  }
+}
+async function emit(response, text, signal) {
+  signal.throwIfAborted();
+  if (!response.write(text)) await once(response, "drain", { signal });
+}
+function errorResponse(response, error) {
+  if (response.headersSent) {
+    response.destroy();
+    return;
+  }
+  response.writeHead(error instanceof GatewayError ? error.status : 502, {
+    "content-type": "application/json",
+    "cache-control": "no-store",
+    connection: "close"
+  });
+  response.end(
+    JSON.stringify({
+      error: {
+        code: gatewayErrorCode(error),
+        message: "Gateway request was not forwarded or could not be completed safely."
+      }
+    })
+  );
+}
+async function startGatewayServer(config, dependencies = {}) {
+  if (!config.enabled) throw new GatewayError("MANCODE_GATEWAY_DISABLED", 503);
+  const upstream = UPSTREAMS[config.upstreamId];
+  const upstreamKey = dependencies.upstreamKey ?? process.env[config.envKey];
+  if (!upstreamKey || /[\r\n]/.test(upstreamKey))
+    throw new GatewayError("MANCODE_GATEWAY_UPSTREAM_KEY_UNAVAILABLE", 503);
+  const instanceId = randomUUID();
+  const loadedDigest = gatewayConfigDigest(config);
+  const worker = new GatewayWorker(
+    hashValue(
+      JSON.stringify({
+        scope: config.scope,
+        instanceId,
+        upstream: config.upstreamId,
+        loadedDigest
+      })
+    ),
+    config.ruleIds,
+    config.clientHost,
+    dependencies.workerUrl
+  );
+  const fetchUpstream = dependencies.fetchUpstream ?? fetch;
+  const active = /* @__PURE__ */ new Set();
+  let draining = false;
+  let port = config.port;
+  let routeObservedAt = null;
+  let observedHostBinding = null;
+  let opaqueBlocks = 0;
+  let lastAudit = null;
+  let resolveClosed = () => {
+  };
+  const closed = new Promise((resolve) => {
+    resolveClosed = resolve;
+  });
+  let stopping;
+  const health = () => ({
+    instanceId,
+    loadedDigest,
+    scope: config.scope,
+    state: draining ? "draining" : "accepting",
+    port,
+    activeRequests: active.size,
+    routeVerified: false,
+    routeObservedAt,
+    observedHostBinding,
+    coverage: "text-only-with-opaque-exclusions",
+    opaqueBlocks,
+    lastAudit,
+    history: "memory-only; restart invalidates previous_response_id"
+  });
+  const server = createServer(
+    {
+      maxHeaderSize: 16 * 1024,
+      requestTimeout: GATEWAY_LIMITS.idleMs,
+      headersTimeout: 1e4
+    },
+    (request, response) => {
+      void handle(request, response).catch(
+        (error) => errorResponse(response, error)
+      );
+    }
+  );
+  server.maxConnections = 24;
+  server.keepAliveTimeout = 5e3;
+  server.on("upgrade", (_request, socket) => {
+    socket.end(
+      "HTTP/1.1 426 Upgrade Required\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
+    );
+  });
+  server.on("connect", (_request, socket) => {
+    socket.end(
+      "HTTP/1.1 405 Method Not Allowed\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
+    );
+  });
+  server.on("clientError", (_error, socket) => {
+    socket.end(
+      "HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"
+    );
+  });
+  const stop = () => {
+    if (stopping) return stopping;
+    draining = true;
+    stopping = new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        for (const controller of active) controller.abort();
+        server.closeAllConnections();
+      }, dependencies.drainMs ?? GATEWAY_LIMITS.drainMs);
+      server.close(() => {
+        clearTimeout(timer);
+        void worker.close().finally(() => {
+          resolve();
+          resolveClosed();
+        });
+      });
+      server.closeIdleConnections();
+    });
+    return stopping;
+  };
+  async function handle(request, response) {
+    if (request.headers.host !== `127.0.0.1:${port}` || request.headers.origin !== void 0 || request.url?.startsWith("http"))
+      throw new GatewayError("MANCODE_GATEWAY_HOST_REJECTED", 403);
+    const challenge = request.method === "GET" ? /^\/__mancode\/probe\?challenge=([a-f0-9]{64})$/.exec(
+      request.url ?? ""
+    )?.[1] : void 0;
+    if (challenge) {
+      response.writeHead(200, {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      });
+      response.end(
+        JSON.stringify({
+          instanceId,
+          loadedDigest,
+          challenge,
+          proof: controlProof(
+            config.accessToken,
+            instanceId,
+            loadedDigest,
+            challenge
+          )
+        })
+      );
+      return;
+    }
+    const authorization = request.headers.authorization ?? (typeof request.headers["x-api-key"] === "string" ? `Bearer ${request.headers["x-api-key"]}` : "");
+    const controlAction = request.method === "GET" && request.url === "/__mancode/health" ? "health" : request.method === "POST" && request.url === "/__mancode/stop" ? "stop" : void 0;
+    const nonce = request.headers["x-mancode-control-nonce"];
+    const proof = request.headers["x-mancode-control-proof"];
+    const provedControl = controlAction && request.headers["x-mancode-instance"] === instanceId && typeof nonce === "string" && /^[a-f0-9]{64}$/.test(nonce) && typeof proof === "string" && constantTokenEquals(
+      proof,
+      controlProof(
+        config.accessToken,
+        instanceId,
+        loadedDigest,
+        nonce,
+        controlAction
+      )
+    );
+    if (!provedControl && !constantTokenEquals(authorization, `Bearer ${config.accessToken}`))
+      throw new GatewayError("MANCODE_GATEWAY_AUTH_REQUIRED", 401);
+    if (request.method === "GET" && request.url === "/__mancode/health") {
+      response.writeHead(200, {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      });
+      response.end(JSON.stringify(health()));
+      return;
+    }
+    if (request.method === "POST" && request.url === "/__mancode/stop") {
+      draining = true;
+      response.writeHead(202, {
+        "content-type": "application/json",
+        connection: "close"
+      });
+      response.end(JSON.stringify({ instanceId, state: "draining" }));
+      setImmediate(() => {
+        void stop();
+      });
+      return;
+    }
+    if (draining) throw new GatewayError("MANCODE_GATEWAY_DRAINING", 503);
+    const metadata = request.method === "GET" && /^\/v1\/models(?:\?client_version=\d+\.\d+\.\d+)?$/.test(
+      request.url ?? ""
+    );
+    const generationPath = upstream.protocol === "responses" ? request.url === "/v1/responses" : request.url === "/v1/messages" || request.url === "/v1/messages?beta=true";
+    if (!metadata && (request.method !== "POST" || !generationPath))
+      throw new GatewayError("MANCODE_GATEWAY_PATH_UNSUPPORTED", 404);
+    if (request.headers["content-encoding"] && request.headers["content-encoding"] !== "identity")
+      throw new GatewayError("MANCODE_GATEWAY_ENCODING_UNSUPPORTED", 415);
+    if (!metadata && !/^application\/json(?:\s*;\s*charset=utf-8)?$/i.test(
+      request.headers["content-type"] ?? ""
+    ))
+      throw new GatewayError("MANCODE_GATEWAY_CONTENT_TYPE_UNSUPPORTED", 415);
+    if (active.size >= GATEWAY_LIMITS.concurrentRequests)
+      throw new GatewayError("MANCODE_GATEWAY_CONCURRENCY_LIMIT", 429);
+    const controller = new AbortController();
+    active.add(controller);
+    const id = randomUUID();
+    const timer = setTimeout(
+      () => controller.abort(),
+      GATEWAY_LIMITS.generationMs
+    );
+    request.setTimeout(GATEWAY_LIMITS.idleMs, () => {
+      controller.abort();
+      request.destroy();
+    });
+    response.on("close", () => {
+      if (!response.writableEnded) controller.abort();
+    });
+    let began = false;
+    try {
+      const headers = {
+        accept: "application/json, text/event-stream",
+        "accept-encoding": "identity"
+      };
+      if (config.upstreamId === "openai")
+        headers.authorization = `Bearer ${upstreamKey}`;
+      else {
+        headers["x-api-key"] = upstreamKey;
+        const version = request.headers["anthropic-version"];
+        if (version !== void 0 && (typeof version !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(version)))
+          throw new GatewayError("MANCODE_GATEWAY_HEADER_UNSUPPORTED");
+        headers["anthropic-version"] = typeof version === "string" ? version : "2023-06-01";
+        const beta = request.headers["anthropic-beta"];
+        if (beta !== void 0) {
+          if (typeof beta !== "string" || !/^[a-z0-9, -]{1,512}$/.test(beta))
+            throw new GatewayError("MANCODE_GATEWAY_HEADER_UNSUPPORTED");
+          headers["anthropic-beta"] = beta;
+        }
+      }
+      let body;
+      if (!metadata) {
+        const input = await readBody(request, controller.signal);
+        const masked = await worker.call({
+          kind: "begin",
+          id,
+          body: input,
+          protocol: upstream.protocol
+        });
+        began = true;
+        controller.signal.throwIfAborted();
+        body = masked.body;
+        opaqueBlocks += masked.opaqueBlocks;
+        headers["content-type"] = "application/json";
+      } else if (request.headers["content-length"] || request.headers["transfer-encoding"])
+        throw new GatewayError("MANCODE_GATEWAY_METADATA_BODY_REJECTED");
+      const upstreamResponse = await fetchUpstream(
+        `${upstream.origin}${request.url}`,
+        {
+          method: request.method,
+          headers,
+          body,
+          redirect: "manual",
+          signal: controller.signal
+        }
+      );
+      if (!upstreamResponse.ok || !upstreamResponse.body)
+        throw new GatewayError("MANCODE_GATEWAY_UPSTREAM_REJECTED", 502);
+      const encoding = upstreamResponse.headers.get("content-encoding");
+      if (encoding && encoding !== "identity")
+        throw new GatewayError("MANCODE_GATEWAY_ENCODING_UNSUPPORTED", 502);
+      const contentType = upstreamResponse.headers.get("content-type") ?? "";
+      if (!metadata) {
+        routeObservedAt = (/* @__PURE__ */ new Date()).toISOString();
+        observedHostBinding = request.headers["x-mancode-host"] === config.clientHost ? config.clientHost : "unverified-client";
+      }
+      const reader = upstreamResponse.body.getReader();
+      let total = 0;
+      const parts = [];
+      const decoder = new SseDecoder();
+      const streaming = !metadata && /^text\/event-stream(?:;|$)/i.test(contentType);
+      if (!streaming && !/^application\/json(?:;|$)/i.test(contentType))
+        throw new GatewayError(
+          "MANCODE_GATEWAY_UPSTREAM_CONTENT_UNSUPPORTED",
+          502
+        );
+      if (streaming)
+        response.writeHead(200, {
+          "content-type": "text/event-stream",
+          "cache-control": "no-store",
+          "x-mancode-coverage": "text-only; opaque-blocks-excluded"
+        });
+      for (; ; ) {
+        const idle = setTimeout(
+          () => controller.abort(),
+          GATEWAY_LIMITS.idleMs
+        );
+        let result;
+        try {
+          result = await reader.read();
+        } finally {
+          clearTimeout(idle);
+        }
+        controller.signal.throwIfAborted();
+        if (result.done) break;
+        total += result.value.length;
+        if (total > (streaming ? GATEWAY_LIMITS.streamBytes : GATEWAY_LIMITS.responseBytes))
+          throw new GatewayError("MANCODE_GATEWAY_RESPONSE_LIMIT", 502);
+        if (!streaming) parts.push(Buffer.from(result.value));
+        else
+          for (const frame of decoder.push(result.value)) {
+            const transformed = await worker.call({ kind: "frame", id, frame });
+            opaqueBlocks = Math.max(opaqueBlocks, transformed.opaqueBlocks);
+            for (const output of transformed.frames)
+              await emit(response, encodeSse(output), controller.signal);
+          }
+      }
+      if (streaming) {
+        decoder.push(new Uint8Array(), true);
+        const finished = await worker.call({
+          kind: "finish",
+          id
+        });
+        lastAudit = finished.audit;
+        response.end();
+      } else {
+        let original;
+        try {
+          original = new TextDecoder("utf-8", { fatal: true }).decode(
+            Buffer.concat(parts)
+          );
+        } catch {
+          throw new GatewayError("MANCODE_GATEWAY_INVALID_UTF8", 502);
+        }
+        const output = metadata ? { body: original, audit: null } : await worker.call({
+          kind: "response",
+          id,
+          body: original
+        });
+        lastAudit = output.audit;
+        response.writeHead(200, {
+          "content-type": "application/json",
+          "cache-control": "no-store",
+          "x-mancode-coverage": metadata ? "metadata-endpoint" : "text-only; opaque-blocks-excluded"
+        });
+        response.end(output.body);
+      }
+    } catch (error) {
+      dependencies.onDiagnostic?.(gatewayErrorCode(error));
+      controller.abort();
+      errorResponse(response, error);
+    } finally {
+      clearTimeout(timer);
+      active.delete(controller);
+      if (began) await worker.call({ kind: "release", id }).catch(() => {
+      });
+    }
+  }
+  try {
+    await new Promise((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(config.port, "127.0.0.1", () => {
+        server.removeListener("error", reject);
+        resolve();
+      });
+    });
+    const address = server.address();
+    if (!address || typeof address === "string")
+      throw new GatewayError("MANCODE_GATEWAY_BIND_FAILED", 503);
+    port = address.port;
+    return { port, instanceId, health, stop, closed };
+  } catch {
+    await worker.close();
+    throw new GatewayError("MANCODE_GATEWAY_BIND_FAILED", 503);
+  }
+}
+
+// src/commands/privacy-gateway.ts
+async function control(config, record, action) {
+  const challenge = randomBytes2(32).toString("hex");
+  const probe = await fetch(
+    `http://127.0.0.1:${record.port}/__mancode/probe?challenge=${challenge}`,
+    { signal: AbortSignal.timeout(750), redirect: "error" }
+  );
+  const proof = await readControlJson(probe, 2048);
+  if (proof.instanceId !== record.instanceId || proof.loadedDigest !== record.loadedDigest || proof.challenge !== challenge || typeof proof.proof !== "string" || !constantTokenEquals(
+    proof.proof,
+    controlProof(
+      config.accessToken,
+      record.instanceId,
+      record.loadedDigest,
+      challenge
+    )
+  ))
+    throw new GatewayError("MANCODE_GATEWAY_RUNTIME_UNCONFIRMED");
+  const response = await fetch(
+    `http://127.0.0.1:${record.port}/__mancode/${action}`,
+    {
+      method: action === "stop" ? "POST" : "GET",
+      headers: {
+        "x-mancode-instance": record.instanceId,
+        "x-mancode-control-nonce": challenge,
+        "x-mancode-control-proof": controlProof(
+          config.accessToken,
+          record.instanceId,
+          record.loadedDigest,
+          challenge,
+          action
+        )
+      },
+      signal: AbortSignal.timeout(750),
+      redirect: "error"
+    }
+  );
+  return readControlJson(response, 32 * 1024);
+}
+async function readControlJson(response, limit) {
+  if (!response.ok || !response.body)
+    throw new GatewayError("MANCODE_GATEWAY_RUNTIME_UNCONFIRMED");
+  const reader = response.body.getReader();
+  const parts = [];
+  let size = 0;
+  for (; ; ) {
+    const value = await reader.read();
+    if (value.done) break;
+    size += value.value.length;
+    if (size > limit) {
+      await reader.cancel();
+      throw new GatewayError("MANCODE_GATEWAY_RUNTIME_UNCONFIRMED");
+    }
+    parts.push(Buffer.from(value.value));
+  }
+  return JSON.parse(Buffer.concat(parts).toString("utf8"));
+}
+async function inspectRuntime(root, config) {
+  const location = await gatewayLocation(root);
+  const raw = await readPrivateJson(
+    path2.join(location.directory, "runtime.json")
+  );
+  if (raw === null) return { state: "stopped", record: null, health: null };
+  const record = raw;
+  if (record.schemaVersion !== 1 || typeof record.instanceId !== "string" || !/^[a-f0-9-]{36}$/.test(record.instanceId) || !Number.isSafeInteger(record.processId) || record.processId < 1 || !Number.isInteger(record.port) || record.port < 1024 || record.port > 65535 || typeof record.loadedDigest !== "string" || !/^[a-f0-9]{64}$/.test(record.loadedDigest) || JSON.stringify(record.scope) !== JSON.stringify(config.scope))
+    throw new GatewayError("MANCODE_GATEWAY_RUNTIME_RECORD_INVALID");
+  if (!processIsAlive(record.processId))
+    return { state: "stopped", record, health: null };
+  try {
+    const health = await control(config, record, "health");
+    if (health.instanceId !== record.instanceId || health.loadedDigest !== record.loadedDigest || JSON.stringify(health.scope) !== JSON.stringify(record.scope) || health.port !== record.port || !["accepting", "draining"].includes(health.state) || health.routeVerified !== false)
+      throw new GatewayError("MANCODE_GATEWAY_RUNTIME_SCOPE_MISMATCH");
+    return { state: health.state, record, health };
+  } catch {
+    return {
+      state: processIsAlive(record.processId) ? "unconfirmed" : "stopped",
+      record,
+      health: null
+    };
+  }
+}
+async function readPrivacyGatewayStatus(root = process.cwd()) {
+  const empty = {
+    schemaVersion: 1,
+    configured: false,
+    enabled: false,
+    configurationStatus: "missing",
+    runtime: "stopped",
+    routeVerified: false,
+    routeObservedAt: null,
+    observedHostBinding: null,
+    loadedDigest: null,
+    configuredDigest: null,
+    pendingRestart: false,
+    scope: null,
+    upstreamId: null,
+    clientHost: null,
+    coverage: "Responses/Anthropic Messages HTTP/SSE text only; opaque thinking/signature/encrypted blocks excluded; unsupported executable tool restoration blocked"
+  };
+  try {
+    const config = await readGatewayConfig(root);
+    if (!config) return empty;
+    const runtime = await inspectRuntime(root, config);
+    const configuredDigest = gatewayConfigDigest(config);
+    return {
+      ...empty,
+      configured: true,
+      enabled: config.enabled,
+      configurationStatus: "valid",
+      runtime: runtime.state,
+      configuredDigest,
+      loadedDigest: runtime.health?.loadedDigest ?? null,
+      pendingRestart: Boolean(
+        runtime.health && runtime.health.loadedDigest !== configuredDigest
+      ),
+      routeObservedAt: runtime.health?.routeObservedAt ?? null,
+      observedHostBinding: runtime.health?.observedHostBinding ?? null,
+      scope: config.scope,
+      upstreamId: config.upstreamId,
+      clientHost: config.clientHost
+    };
+  } catch (error) {
+    return {
+      ...empty,
+      enabled: null,
+      configurationStatus: "invalid",
+      runtime: "unconfirmed",
+      error: gatewayErrorCode(error)
+    };
+  }
+}
+async function configurePrivacyGateway(root, options) {
+  await configureGateway(root, options);
+  return readPrivacyGatewayStatus(root);
+}
+async function disablePrivacyGateway(root) {
+  const config = await readGatewayConfig(root);
+  if (!config) return readPrivacyGatewayStatus(root);
+  await configureGateway(root, { enabled: false });
+  const runtime = await inspectRuntime(root, config);
+  if (runtime.health && runtime.record) {
+    const stopped = await control(config, runtime.record, "stop");
+    if (stopped.instanceId !== runtime.record.instanceId)
+      throw new GatewayError("MANCODE_GATEWAY_RUNTIME_SCOPE_MISMATCH");
+    for (let attempt = 0; attempt < 60; attempt++) {
+      await new Promise((resolve) => setTimeout(resolve, 100));
+      const status = await readPrivacyGatewayStatus(root);
+      if (status.runtime === "stopped") return status;
+    }
+  }
+  return readPrivacyGatewayStatus(root);
+}
+async function verifyInstalledHost(config) {
+  if (config.clientHost === "unverified") return "unverified";
+  const executable = config.clientHost.startsWith("codex-cli/") ? "codex" : "claude";
+  try {
+    const result = await promisify(execFile)(executable, ["--version"], {
+      timeout: 5e3,
+      maxBuffer: 16 * 1024
+    });
+    const actual = executable === "codex" ? /codex-cli (\d+\.\d+\.\d+)/.exec(result.stdout)?.[1] : /^(\d+\.\d+\.\d+) \(Claude Code\)/.exec(result.stdout)?.[1];
+    if (actual !== config.clientHost.split("/")[1])
+      throw new GatewayError("MANCODE_GATEWAY_HOST_VERSION_UNVERIFIED");
+    return config.clientHost;
+  } catch {
+    throw new GatewayError("MANCODE_GATEWAY_HOST_VERSION_UNVERIFIED");
+  }
+}
+async function runPrivacyGateway(root, dependencies = {}) {
+  const binding = await gatewayLocation(root);
+  if (!binding.scope.workspaceId || !binding.scope.checkoutId)
+    throw new GatewayError("MANCODE_GATEWAY_NOT_INITIALIZED");
+  const { config, server, file } = await withGatewayLifecycleLock(
+    root,
+    async () => {
+      const config2 = await readGatewayConfig(root);
+      if (!config2?.enabled) throw new GatewayError("MANCODE_GATEWAY_DISABLED");
+      await verifyInstalledHost(config2);
+      const runtime = await inspectRuntime(root, config2);
+      if (runtime.state !== "stopped")
+        throw new GatewayError(
+          "MANCODE_GATEWAY_ALREADY_RUNNING_OR_UNCONFIRMED"
+        );
+      const location = await gatewayLocation(root);
+      const server2 = await (dependencies.startServer ?? startGatewayServer)(
+        config2
+      );
+      const record = {
+        schemaVersion: 1,
+        instanceId: server2.instanceId,
+        processId: process.pid,
+        port: server2.port,
+        scope: config2.scope,
+        loadedDigest: gatewayConfigDigest(config2),
+        startedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const file2 = path2.join(location.directory, "runtime.json");
+      try {
+        await writePrivateJson(file2, record);
+      } catch (error) {
+        await server2.stop();
+        throw error;
+      }
+      return { config: config2, server: server2, file: file2 };
+    }
+  );
+  const stop = () => {
+    void server.stop();
+  };
+  try {
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+    process.stdout.write(
+      `${JSON.stringify({ gateway: "running", ...server.health(), clientHost: config.clientHost, note: "Dedicated checkout instance. Route verification requires current client evidence. No client configuration was changed." })}
+`
+    );
+    await server.closed;
+  } finally {
+    process.removeListener("SIGINT", stop);
+    process.removeListener("SIGTERM", stop);
+    await server.stop();
+    const current = await readPrivateJson(file);
+    if (current?.instanceId === server.instanceId)
+      await rm2(file, { force: true });
+  }
+}
+async function printPrivacyGatewayConfig(root, host) {
+  const config = await readGatewayConfig(root);
+  if (!config) throw new GatewayError("MANCODE_GATEWAY_NOT_CONFIGURED");
+  const { directory } = await gatewayLocation(root);
+  const note = `# Review before applying. Read accessToken from the private file ${path2.join(directory, "config.json")}.
+# Put it in MANCODE_GATEWAY_TOKEN for this shell only. No credentials are printed here.
+# Only this checkout is covered; no desktop, subscription, or cloud routing claim.
+`;
+  if (host === "codex") {
+    if (config.upstreamId !== "openai")
+      throw new GatewayError("MANCODE_GATEWAY_HOST_UPSTREAM_MISMATCH");
+    return `${note}# User-level Codex configuration fragment; choose this provider explicitly.
+[model_providers.mancode_privacy]
+name = "mancode privacy"
+base_url = "http://127.0.0.1:${config.port}/v1"
+wire_api = "responses"
+env_key = "MANCODE_GATEWAY_TOKEN"
+supports_websockets = false
+http_headers = { "X-Mancode-Host" = "${config.clientHost}" }
+`;
+  }
+  if (host === "claude") {
+    if (config.upstreamId !== "anthropic")
+      throw new GatewayError("MANCODE_GATEWAY_HOST_UPSTREAM_MISMATCH");
+    return `${note}# Shell fragment for an explicit Claude Code API-key session.
+export ANTHROPIC_BASE_URL='http://127.0.0.1:${config.port}'
+export ANTHROPIC_API_KEY="$MANCODE_GATEWAY_TOKEN"
+export ANTHROPIC_CUSTOM_HEADERS='X-Mancode-Host: ${config.clientHost}'
+# Run the gateway in a separate shell with the real upstream env-key reference.
+`;
+  }
+  throw new GatewayError("MANCODE_GATEWAY_HOST_UNSUPPORTED");
+}
+function registerPrivacyGatewayCommands(privacy) {
+  const gateway = privacy.command("gateway").description("Configure and run the optional private local model gateway");
+  const execute = (action) => action().then((value) => {
+    if (value !== void 0)
+      process.stdout.write(
+        `${typeof value === "string" ? value : JSON.stringify(value, null, 2)}
+`
+      );
+  }).catch((error) => {
+    process.stderr.write(
+      `${JSON.stringify({ error: gatewayErrorCode(error) })}
+`
+    );
+    process.exitCode = 2;
+  });
+  gateway.command("enable").description("Record intent; does not start or reroute a client").option("--upstream <id>", "openai or anthropic").option(
+    "--env-key <name>",
+    "Reference to the upstream key environment variable"
+  ).option(
+    "--client-host <host>",
+    "codex-cli/0.153.4, claude-code/2.1.142, or unverified"
+  ).option("--port <port>", "Loopback port, 1024\u201365535").option("--json").action(
+    (options) => execute(
+      () => configurePrivacyGateway(process.cwd(), {
+        enabled: true,
+        upstreamId: options.upstream,
+        envKey: options.envKey,
+        clientHost: options.clientHost,
+        port: options.port === void 0 ? void 0 : Number(options.port)
+      })
+    )
+  );
+  gateway.command("disable").description(
+    "Stop new requests and drain the current instance; never enable plaintext forwarding"
+  ).option("--json").action(() => execute(() => disablePrivacyGateway(process.cwd())));
+  gateway.command("status").description("Read configured intent and authenticated runtime evidence").option("--json").action(() => execute(() => readPrivacyGatewayStatus()));
+  gateway.command("doctor").description(
+    "Read local runtime and installed host version; does not call a model"
+  ).option("--json").action(
+    () => execute(async () => {
+      const status = await readPrivacyGatewayStatus();
+      const config = await readGatewayConfig(process.cwd());
+      let hostVersion = "unverified";
+      if (config) {
+        try {
+          hostVersion = await verifyInstalledHost(config);
+        } catch {
+          hostVersion = "version-mismatch-or-unavailable";
+        }
+      }
+      return {
+        ...status,
+        installedHost: hostVersion,
+        upstreamKeyPresent: Boolean(config && process.env[config.envKey]),
+        routeVerified: false
+      };
+    })
+  );
+  gateway.command("run").description("Run one dedicated checkout instance in the foreground").action(() => execute(() => runPrivacyGateway(process.cwd())));
+  gateway.command("print-config").description(
+    "Print a reviewable fragment without credentials or applying it"
+  ).requiredOption("--host <host>", "codex or claude").action(
+    (options) => execute(() => printPrivacyGatewayConfig(process.cwd(), options.host))
+  );
+}
+
+export {
+  readPrivacyGatewayStatus,
+  configurePrivacyGateway,
+  disablePrivacyGateway,
+  runPrivacyGateway,
+  printPrivacyGatewayConfig,
+  registerPrivacyGatewayCommands
+};
+//# sourceMappingURL=chunk-THOE33LU.js.map