peachsim 0.1.527

package/src/host/fetch-proxy-handler.ts

@@ -0,0 +1,449 @@
+// shared fetch-proxy + app-api handlers for the sootsim dev/daemon HTTP
+// surface. both the vite dev middleware (packages/sootsim-shell/src/
+// dev-middleware.ts) and the daemon bridge (packages/sootsim/src/host/
+// bridge-host.ts) mount these on their respective servers so guest bundle
+// fetches resolve the same way regardless of which surface the sim is
+// loaded through.
+//
+// the symptom that drove this extraction: when the shell dev server was
+// not running, sims fell back to the daemon's loopback HTTP server,
+// which only knew about `/__bundle-proxy` and let every `/__fetch-proxy`
+// or `/__app-api` request fall through to the SPA index.html. tenant
+// code (e.g. Expensify's NetInfo reachability poll) saw a 200 response
+// whose body was the shell HTML, parsed it as JSON, failed, and reported
+// `isInternetReachable: false` → "you appear to be offline".
+//
+// routes implemented here:
+//   /__fetch-proxy?url=…    — generic CORS-bypassing proxy
+//   /__proxy?url=…          — alias of /__fetch-proxy (demo-gateway path)
+//   /__app-api?origin=…&path=… — tenant API reverse proxy, stateless
+//                              (bundle origin carried in the query string)
+//   /__app-api/<path>       — legacy form for callers that registered an
+//                              origin separately. requires an out-of-band
+//                              tenant-origin registry to resolve; left as
+//                              the caller's responsibility.
+
+import http, { type IncomingMessage, type ServerResponse } from 'http'
+import https from 'https'
+import { finished, pipeline } from 'stream/promises'
+import { isLoopbackHost, normalizeHostname } from '../backend-origin.ts'
+import {
+  FETCH_PROXY_BROWSER_USER_AGENT,
+  getFetchProxyTargetHeaders,
+} from './fetch-proxy-overrides.ts'
+
+const STRIP_FETCH_PROXY_HEADERS = new Set([
+  'host',
+  'origin',
+  'referer',
+  'user-agent',
+  'accept-encoding',
+  'cookie',
+  'connection',
+  'keep-alive',
+  'transfer-encoding',
+  'upgrade',
+  'content-length',
+  'sec-fetch-site',
+  'sec-fetch-mode',
+  'sec-fetch-dest',
+  'sec-ch-ua',
+  'sec-ch-ua-mobile',
+  'sec-ch-ua-platform',
+])
+
+const FETCH_PROXY_CORS_HEADERS: Record<string, string> = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'GET,POST,PUT,DELETE,PATCH,OPTIONS',
+  'access-control-allow-headers': '*',
+  'access-control-expose-headers': '*',
+  'access-control-max-age': '3600',
+}
+
+const APP_API_HEADER_REWRITES = new Set([
+  'host',
+  'origin',
+  'referer',
+  'sec-fetch-site',
+  'sec-fetch-mode',
+  'sec-fetch-dest',
+])
+
+// a developer's local https stack signs with a locally-trusted CA (mkcert et
+// al) that node's bundled root store cannot see, so proxied requests to it die
+// with SELF_SIGNED_CERT_IN_CHAIN. traffic to a loopback target never leaves
+// the machine, so certificate validation adds nothing there — accept it rather
+// than requiring every host to plumb a CA bundle into a long-lived daemon.
+function loopbackTlsOptions(targetUrl: URL): { rejectUnauthorized?: boolean } {
+  if (targetUrl.protocol !== 'https:') return {}
+  return isLoopbackHost(targetUrl.hostname) ? { rejectUnauthorized: false } : {}
+}
+
+function applyFetchProxyCors(res: ServerResponse) {
+  for (const [key, value] of Object.entries(FETCH_PROXY_CORS_HEADERS)) {
+    res.setHeader(key, value)
+  }
+}
+
+function formatFetchProxyError(targetUrl: string, err: unknown): string {
+  const details: string[] = []
+  const error = err as
+    | {
+        message?: string
+        code?: string
+        cause?: { message?: string; code?: string }
+      }
+    | undefined
+
+  if (error?.code) details.push(error.code)
+  if (error?.message) details.push(error.message)
+  if (error?.cause?.code) details.push(error.cause.code)
+  if (error?.cause?.message) details.push(error.cause.message)
+
+  const uniqueDetails = [...new Set(details.filter(Boolean))]
+  const message = uniqueDetails.join(' | ') || String(err)
+
+  if (targetUrl.includes('stored-in-.env.local')) {
+    return `${message} | upstream url still contains placeholder env values`
+  }
+
+  return message
+}
+
+export function buildFetchProxyHeaders(
+  reqHeaders: Record<string, string | string[] | undefined>,
+  targetUrl?: URL,
+): Record<string, string> {
+  const headers: Record<string, string> = {}
+  for (const [key, value] of Object.entries(reqHeaders)) {
+    if (!value) continue
+    if (STRIP_FETCH_PROXY_HEADERS.has(key.toLowerCase())) continue
+    headers[key] = Array.isArray(value) ? value.join(', ') : value
+  }
+  Object.assign(
+    headers,
+    targetUrl
+      ? getFetchProxyTargetHeaders(targetUrl)
+      : { 'user-agent': FETCH_PROXY_BROWSER_USER_AGENT },
+  )
+  return headers
+}
+
+export function buildAppApiProxyHeaders(
+  reqHeaders: Record<string, string | string[] | undefined>,
+  targetUrl: URL,
+): Record<string, string | string[]> {
+  const headers: Record<string, string | string[]> = {}
+  for (const [key, value] of Object.entries(reqHeaders)) {
+    if (!value) continue
+    if (APP_API_HEADER_REWRITES.has(key.toLowerCase())) continue
+    headers[key] = value
+  }
+  headers.host = targetUrl.host
+  if (!Object.keys(headers).some((name) => name.toLowerCase() === 'expo-origin')) {
+    headers.origin = targetUrl.origin
+    headers.referer = `${targetUrl.origin}/`
+  }
+  return headers
+}
+
+export function isFetchProxyRequestUrl(rawUrl: string | undefined): boolean {
+  return rawUrl?.startsWith('/__fetch-proxy?') || rawUrl?.startsWith('/__proxy?') || false
+}
+
+export function isBundleProxyRequestUrl(rawUrl: string | undefined): boolean {
+  return rawUrl?.startsWith('/__bundle-proxy?') ?? false
+}
+
+export function isAppApiRequestUrl(rawUrl: string | undefined): boolean {
+  if (!rawUrl) return false
+  if (rawUrl.startsWith('/__app-api?')) return true
+  if (rawUrl.startsWith('/__app-api/')) return true
+  return false
+}
+
+export async function handleFetchProxyRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<void> {
+  if (req.method === 'OPTIONS') {
+    applyFetchProxyCors(res)
+    res.writeHead(204)
+    res.end()
+    return
+  }
+
+  const params = new URLSearchParams((req.url || '').split('?')[1] || '')
+  const targetUrl = params.get('url')
+  if (!targetUrl) {
+    applyFetchProxyCors(res)
+    res.writeHead(400, { 'Content-Type': 'text/plain' })
+    res.end('missing url param')
+    return
+  }
+
+  let upstreamUrl: URL
+  try {
+    upstreamUrl = new URL(targetUrl)
+  } catch {
+    applyFetchProxyCors(res)
+    res.writeHead(400, { 'Content-Type': 'text/plain' })
+    res.end('invalid url param')
+    return
+  }
+
+  let body: Buffer | undefined
+  if (req.method !== 'GET' && req.method !== 'HEAD') {
+    const chunks: Buffer[] = []
+    for await (const chunk of req) {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))
+    }
+    if (chunks.length > 0) {
+      body = Buffer.concat(chunks)
+    }
+  }
+
+  const originalMethod = req.method || 'GET'
+  const proxy = async (
+    targetUrl: URL,
+    method: string,
+    nextBody: Buffer | undefined,
+    redirects: number,
+  ): Promise<void> => {
+    const transport = targetUrl.protocol === 'https:' ? https : http
+    const targetHeaders = buildFetchProxyHeaders(req.headers, targetUrl)
+    if (targetUrl.origin !== upstreamUrl.origin) {
+      delete targetHeaders.authorization
+      delete targetHeaders['proxy-authorization']
+    }
+    if (method === 'GET' || method === 'HEAD') {
+      delete targetHeaders['content-length']
+      delete targetHeaders['content-type']
+    } else if (nextBody) {
+      targetHeaders['content-length'] = String(nextBody.byteLength)
+    }
+
+    const proxyRes = await new Promise<IncomingMessage>((resolve, reject) => {
+      const proxyReq = transport.request(
+        {
+          hostname: normalizeHostname(targetUrl.hostname),
+          port: targetUrl.port || (targetUrl.protocol === 'https:' ? 443 : 80),
+          path: targetUrl.pathname + targetUrl.search,
+          method,
+          headers: targetHeaders,
+          ...loopbackTlsOptions(targetUrl),
+        },
+        resolve,
+      )
+      const abort = () => proxyReq.destroy(new Error('fetch proxy client disconnected'))
+      req.once('aborted', abort)
+      proxyReq.once('close', () => req.off('aborted', abort))
+      proxyReq.once('error', reject)
+      if (nextBody === undefined) proxyReq.end()
+      else proxyReq.end(nextBody)
+    })
+
+    const status = proxyRes.statusCode ?? 502
+    const location = proxyRes.headers.location
+    if (
+      location &&
+      (status === 301 ||
+        status === 302 ||
+        status === 303 ||
+        status === 307 ||
+        status === 308)
+    ) {
+      if (redirects >= 10) {
+        proxyRes.destroy()
+        throw new Error('too many redirects')
+      }
+      const switchToGet =
+        ((status === 301 || status === 302) && method === 'POST') ||
+        (status === 303 && method !== 'GET' && method !== 'HEAD')
+      const redirectUrl = new URL(location, targetUrl)
+      proxyRes.resume()
+      await finished(proxyRes)
+      await proxy(
+        redirectUrl,
+        switchToGet ? 'GET' : method,
+        switchToGet ? undefined : nextBody,
+        redirects + 1,
+      )
+      return
+    }
+
+    for (const [key, value] of Object.entries(proxyRes.headers)) {
+      const lowerKey = key.toLowerCase()
+      if (
+        value === undefined ||
+        lowerKey === 'set-cookie' ||
+        lowerKey === 'connection' ||
+        lowerKey === 'keep-alive' ||
+        lowerKey === 'proxy-authenticate' ||
+        lowerKey === 'proxy-authorization' ||
+        lowerKey === 'te' ||
+        lowerKey === 'trailer' ||
+        lowerKey === 'transfer-encoding' ||
+        lowerKey === 'upgrade' ||
+        lowerKey.startsWith('access-control-')
+      ) {
+        continue
+      }
+      res.setHeader(key, value)
+    }
+    applyFetchProxyCors(res)
+    const setCookie = proxyRes.headers['set-cookie'] ?? []
+    if (setCookie.length > 0) {
+      res.setHeader(
+        'x-sootsim-set-cookie',
+        (Array.isArray(setCookie) ? setCookie : [setCookie]).join(', '),
+      )
+    }
+    res.statusCode = status
+    await pipeline(proxyRes, res)
+  }
+
+  try {
+    await proxy(upstreamUrl, originalMethod, body, 0)
+  } catch (err) {
+    if (res.headersSent) {
+      res.destroy(err instanceof Error ? err : new Error(String(err)))
+      return
+    }
+    const norm = normalizeHostname(upstreamUrl.hostname)
+    if (isLoopbackHost(norm) && (err as { code?: string })?.code === 'ECONNREFUSED') {
+      const altHost =
+        norm === '::1' ? '127.0.0.1' : norm === '127.0.0.1' ? '::1' : '127.0.0.1'
+      if (altHost !== norm) {
+        try {
+          const altUrl = new URL(upstreamUrl.href)
+          altUrl.hostname = altHost
+          await proxy(altUrl, originalMethod, body, 0)
+          return
+        } catch {}
+      }
+    }
+    applyFetchProxyCors(res)
+    res.writeHead(502, { 'Content-Type': 'text/plain' })
+    res.end(`fetch proxy error: ${formatFetchProxyError(upstreamUrl.href, err)}`)
+  }
+}
+
+export async function handleBundleProxyRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+): Promise<void> {
+  const params = new URLSearchParams((req.url || '').split('?')[1] || '')
+  const target = params.get('url')
+  if (!target) {
+    applyFetchProxyCors(res)
+    res.writeHead(400, { 'Content-Type': 'text/plain' })
+    res.end('bundle-proxy: missing url query param')
+    return
+  }
+
+  let targetUrl: URL
+  try {
+    targetUrl = new URL(target)
+  } catch {
+    applyFetchProxyCors(res)
+    res.writeHead(400, { 'Content-Type': 'text/plain' })
+    res.end('bundle-proxy: invalid url')
+    return
+  }
+
+  if (!isLoopbackHost(targetUrl.hostname)) {
+    applyFetchProxyCors(res)
+    res.writeHead(403, { 'Content-Type': 'text/plain' })
+    res.end('bundle-proxy: only loopback targets allowed')
+    return
+  }
+
+  await handleFetchProxyRequest(req, res)
+}
+
+export function handleAppApiRequest(req: IncomingMessage, res: ServerResponse): boolean {
+  // returns true if it handled the request, false if the caller should fall
+  // through. /__app-api requires `origin` query param for stateless mode;
+  // without it we return false so the caller decides what to do (the vite
+  // middleware uses its own out-of-band origin registry; the daemon has
+  // no such registry so it returns 400).
+
+  const reqUrl = req.url || ''
+
+  let targetPath = ''
+  let targetOrigin = ''
+  if (reqUrl.startsWith('/__app-api?')) {
+    const parsed = new URL(reqUrl, 'http://sootsim.local')
+    targetPath = parsed.searchParams.get('path') || ''
+    targetOrigin = parsed.searchParams.get('origin')?.trim() || ''
+  } else if (reqUrl.startsWith('/__app-api/')) {
+    targetPath = reqUrl.slice('/__app-api'.length)
+  } else {
+    return false
+  }
+
+  if (!targetOrigin) {
+    res.writeHead(400, { 'Content-Type': 'text/plain' })
+    res.end('app-api: missing origin query param')
+    return true
+  }
+
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, {
+      'Access-Control-Allow-Origin': (req.headers.origin as string) || '*',
+      'Access-Control-Allow-Methods': 'GET,POST,PUT,PATCH,DELETE,OPTIONS',
+      'Access-Control-Allow-Headers':
+        (req.headers['access-control-request-headers'] as string) || '*',
+      'Access-Control-Allow-Credentials': 'true',
+      'Access-Control-Max-Age': '86400',
+    })
+    res.end()
+    return true
+  }
+
+  let targetUrl: URL
+  try {
+    targetUrl = new URL(targetPath, targetOrigin)
+  } catch {
+    res.writeHead(400, { 'Content-Type': 'text/plain' })
+    res.end('app-api: invalid origin or path')
+    return true
+  }
+
+  const transport = targetUrl.protocol === 'https:' ? https : http
+
+  const fwdHeaders = buildAppApiProxyHeaders(req.headers, targetUrl)
+
+  const proxyReq = transport.request(
+    {
+      hostname: normalizeHostname(targetUrl.hostname),
+      port: targetUrl.port || (targetUrl.protocol === 'https:' ? 443 : 80),
+      path: targetUrl.pathname + targetUrl.search,
+      method: req.method,
+      headers: fwdHeaders,
+      ...loopbackTlsOptions(targetUrl),
+    },
+    (proxyRes) => {
+      const exposedHeaders = Object.keys(proxyRes.headers)
+        .filter((name) => {
+          const lower = name.toLowerCase()
+          return !lower.startsWith('access-control-') && lower !== 'set-cookie'
+        })
+        .join(', ')
+      res.writeHead(proxyRes.statusCode ?? 502, {
+        ...proxyRes.headers,
+        'access-control-allow-origin': (req.headers.origin as string) || '*',
+        'access-control-allow-credentials': 'true',
+        'access-control-expose-headers': exposedHeaders,
+      })
+      proxyRes.pipe(res)
+    },
+  )
+  proxyReq.on('error', (err) => {
+    res.statusCode = 502
+    res.end(`app proxy error: ${err.message}`)
+  })
+  req.pipe(proxyReq)
+  return true
+}

package/src/host/fetch-proxy-overrides.ts

@@ -0,0 +1,51 @@
+// shared upstream header policy for SootSim's CORS-bypassing fetch proxy.
+// requests still forward tenant auth and app headers, but the proxy transport
+// defaults to native-app semantics: no browser Origin or Referer. web-backed
+// mobile APIs that require a specific web origin opt in below.
+
+export const FETCH_PROXY_BROWSER_USER_AGENT =
+  'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 ' +
+  '(KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36'
+
+const HOST_HEADER_OVERRIDES: Array<{
+  hostSuffix: string
+  headers: Record<string, string>
+  suppressBrowserUserAgent?: boolean
+}> = [
+  {
+    hostSuffix: 'uniswap.org',
+    headers: {
+      origin: 'https://app.uniswap.org',
+      referer: 'https://app.uniswap.org/',
+    },
+    // uniswap's native gateway accepts the app origin, but forcing a desktop
+    // browser ua on native api posts returns a bogus 414/tcp-stack response.
+    suppressBrowserUserAgent: true,
+  },
+]
+
+function headerOverridesFor(hostname: string):
+  | {
+      headers: Record<string, string>
+      suppressBrowserUserAgent?: boolean
+    }
+  | undefined {
+  const host = hostname.toLowerCase()
+  for (const override of HOST_HEADER_OVERRIDES) {
+    if (host === override.hostSuffix || host.endsWith(`.${override.hostSuffix}`)) {
+      return override
+    }
+  }
+  return undefined
+}
+
+export function getFetchProxyTargetHeaders(targetUrl: URL): Record<string, string> {
+  const hostOverrides = headerOverridesFor(targetUrl.hostname)
+  return {
+    'accept-encoding': 'identity',
+    ...(hostOverrides?.suppressBrowserUserAgent
+      ? {}
+      : { 'user-agent': FETCH_PROXY_BROWSER_USER_AGENT }),
+    ...hostOverrides?.headers,
+  }
+}

package/src/host/open-url.ts

@@ -0,0 +1,89 @@
+import { spawn } from 'child_process'
+
+export type OpenUrlLaunchVia = 'system'
+
+export interface OpenUrlOptions {
+  detached?: boolean
+  background?: boolean
+}
+
+export interface OpenUrlCommandOptions extends OpenUrlOptions {
+  platform?: NodeJS.Platform
+}
+
+export interface OpenUrlCommand {
+  command: string
+  args: string[]
+  via: OpenUrlLaunchVia
+  target?: string
+}
+
+export interface OpenUrlLaunchResult extends OpenUrlCommand {
+  pid?: number
+  attachUrl: string
+}
+
+export function buildOpenUrlCommand(
+  url: string,
+  options: OpenUrlCommandOptions = {},
+): OpenUrlCommand {
+  if (!url) throw new Error('openUrl requires a url')
+
+  const platform = options.platform ?? process.platform
+  if (platform === 'darwin') {
+    return {
+      command: 'open',
+      args: options.background === false ? [url] : ['-g', url],
+      via: 'system',
+    }
+  }
+
+  if (platform === 'win32') {
+    return {
+      command: 'cmd',
+      args: ['/c', 'start', '', url],
+      via: 'system',
+    }
+  }
+
+  return {
+    command: 'xdg-open',
+    args: [url],
+    via: 'system',
+  }
+}
+
+async function spawnLaunch(
+  command: string,
+  args: string[],
+  detached: boolean,
+): Promise<number | undefined> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      detached,
+      stdio: 'ignore',
+    })
+    child.once('error', reject)
+    child.once('spawn', () => {
+      if (detached) child.unref()
+      resolve(child.pid)
+    })
+  })
+}
+
+export async function launchUrl(
+  url: string,
+  options: OpenUrlOptions = {},
+): Promise<OpenUrlLaunchResult> {
+  const command = buildOpenUrlCommand(url, options)
+  const pid = await spawnLaunch(command.command, command.args, options.detached ?? true)
+  return {
+    ...command,
+    pid,
+    attachUrl: url,
+  }
+}
+
+export async function openUrl(url: string, options: OpenUrlOptions = {}): Promise<void> {
+  await launchUrl(url, options)
+}