sliccy 6.130.0 → 6.131.0

package/dist/node-server/_shared/proxy-headers.js

@@ -0,0 +1,133 @@
+/**
+ * proxy-headers — pure helpers for the `/api/fetch-proxy` forbidden-header
+ * transport.
+ *
+ * The browser silently strips a small set of "forbidden" request headers
+ * (Cookie, Origin, Referer, Proxy-*) when calling `fetch()` from page code.
+ * The proxy server restores them by reading `X-Proxy-*` headers we send in
+ * their place. Likewise, `Set-Cookie` is stripped from response headers,
+ * so the proxy bundles all `Set-Cookie` values into a JSON-encoded
+ * `X-Proxy-Set-Cookie` header that the browser can read.
+ *
+ * Extracted from `proxied-fetch.ts` so the LLM-proxy service worker can
+ * reuse them — the SW build is a standalone IIFE bundle and can't import
+ * the shell-side `proxied-fetch` module which pulls in a much larger graph.
+ */
+/**
+ * Encode request headers that browsers silently strip (forbidden headers).
+ * Cookie → X-Proxy-Cookie, Origin → X-Proxy-Origin, Referer → X-Proxy-Referer, Proxy-* → X-Proxy-Proxy-*
+ */
+export function encodeForbiddenRequestHeaders(headers) {
+    if (!headers)
+        return {};
+    const result = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        if (lower === 'cookie') {
+            result['X-Proxy-Cookie'] = value;
+        }
+        else if (lower === 'origin') {
+            result['X-Proxy-Origin'] = value;
+        }
+        else if (lower === 'referer') {
+            result['X-Proxy-Referer'] = value;
+        }
+        else if (lower.startsWith('proxy-')) {
+            result[`X-Proxy-${key}`] = value;
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Decode request headers from the X-Proxy-* transport back to their real names.
+ * X-Proxy-Cookie → cookie, X-Proxy-Origin → origin, X-Proxy-Referer → referer,
+ * X-Proxy-Proxy-* → proxy-*. Inverse of `encodeForbiddenRequestHeaders` —
+ * used by the proxy server side (CLI Express handler, extension SW) before
+ * calling upstream `fetch()`. Match is case-insensitive on the `X-Proxy-`
+ * prefix; the decoded key is always lowercase.
+ */
+export function decodeForbiddenRequestHeaders(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        if (lower === 'x-proxy-cookie') {
+            result['cookie'] = value;
+        }
+        else if (lower === 'x-proxy-origin') {
+            result['origin'] = value;
+        }
+        else if (lower === 'x-proxy-referer') {
+            result['referer'] = value;
+        }
+        else if (lower.startsWith('x-proxy-proxy-')) {
+            result[lower.replace(/^x-proxy-/, '')] = value;
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Decode response headers that the proxy transported under non-forbidden names.
+ * X-Proxy-Set-Cookie (JSON array) → set-cookie (JSON array string)
+ */
+export function decodeForbiddenResponseHeaders(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        if (lower === 'x-proxy-set-cookie') {
+            // Value is a JSON array of Set-Cookie strings from the proxy.
+            // Keep as JSON array string since Record<string,string> can only hold one value.
+            result['set-cookie'] = value;
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/** Convert Headers or Record<string, string> to a plain Record<string, string>. */
+export function headersToRecord(headers) {
+    if (!headers)
+        return undefined;
+    if (headers instanceof Headers) {
+        const rec = {};
+        headers.forEach((v, k) => {
+            rec[k] = v;
+        });
+        return rec;
+    }
+    return headers;
+}
+/**
+ * Coerce any `HeadersInit` shape (Headers / record / [k,v][] array) to a
+ * plain record so it can ride on `SecureFetchOptions.headers`. Returns
+ * `undefined` when no headers are present (or the result would be empty)
+ * so callers can omit the field entirely — preserving the "no empty
+ * object leak" contract verified by the `asWebFetch` Origin-propagation
+ * tests.
+ */
+export function normalizeHeadersInit(headers) {
+    if (!headers)
+        return undefined;
+    if (headers instanceof Headers) {
+        const rec = {};
+        headers.forEach((v, k) => {
+            rec[k] = v;
+        });
+        return Object.keys(rec).length === 0 ? undefined : rec;
+    }
+    if (Array.isArray(headers)) {
+        const rec = {};
+        for (const [k, v] of headers)
+            rec[k] = v;
+        return Object.keys(rec).length === 0 ? undefined : rec;
+    }
+    const rec = { ...headers };
+    return Object.keys(rec).length === 0 ? undefined : rec;
+}
+//# sourceMappingURL=proxy-headers.js.map

package/dist/node-server/_shared/proxy-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-headers.js","sourceRoot":"","sources":["../src/proxy-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA2C;IAE3C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;QACnC,CAAC;aAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;QACnC,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,CAAC,iBAAiB,CAAC,GAAG,KAAK,CAAC;QACpC,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA+B;IAE/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;YACtC,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;aAAM,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAA+B;IAE/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;YACnC,8DAA8D;YAC9D,iFAAiF;YACjF,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAC7B,OAAqD;IAErD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+E;IAE/E,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,YAAY,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,GAAI,OAAkC,EAAE,CAAC;IACvD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC"}

package/dist/node-server/_shared/well-known-probe.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Well-known probe for Agentic Resource Discovery (ARD) artifacts.
+ *
+ * When a response carries no `ai-catalog` `Link` header (see
+ * `discovery-link.ts`), an origin can still publish discovery artifacts at
+ * their standardized well-known locations:
+ *
+ *   - `/.well-known/ai-catalog.json` — the ARD capability manifest
+ *   - `/llms.txt`                    — the llmstxt.org digest for LLMs
+ *
+ * `probeWellKnown` issues a bounded GET to each location and returns the ones
+ * that answer `200` with a plausible content-type. It is pure core: the fetch
+ * implementation is injected and every network failure / timeout is caught and
+ * treated as "no match" (never thrown). No float wiring lives here.
+ *
+ * Probes are credential-free (`credentials: 'omit'`) and never follow
+ * redirects (`redirect: 'manual'`): the extension float runs them through the
+ * SW's `host_permissions`-privileged fetch while the user's tab may be in the
+ * middle of an SSO login on the very same origin — a credentialed probe that
+ * chases the auth-bounce chain poisons the IdP's pending return-URL state and
+ * hijacks the tab to `<origin>/llms.txt` (see probeOne).
+ *
+ * Content-type is lenient by design — a missing header is accepted (some static
+ * hosts omit it), but an HTML response is always rejected: a manifest / digest
+ * served as HTML is a misconfiguration, not the artifact.
+ */
+import type { DiscoveryKind } from './agent-wire-types.js';
+/** Structural subset of a `fetch` Response the probe needs (no DOM lib dep). */
+export interface ProbeResponse {
+    ok: boolean;
+    status: number;
+    headers: {
+        get(name: string): string | null;
+    };
+}
+/** Injected fetch. Compatible with the global `fetch`. */
+export type ProbeFetch = (url: string, init?: {
+    method?: string;
+    signal?: AbortSignal;
+    redirect?: string;
+    credentials?: string;
+}) => Promise<ProbeResponse>;
+export interface DiscoveryProbeMatch {
+    kind: DiscoveryKind;
+    /** Absolute URL of the artifact that answered. */
+    url: string;
+}
+export interface ProbeOptions {
+    /** Per-request timeout in milliseconds. Defaults to 3000. */
+    timeoutMs?: number;
+}
+/**
+ * Probe an origin's well-known discovery locations. Returns one match per
+ * artifact that answered `200` with a plausible content-type. Both probes run
+ * concurrently; a failure of one never affects the other.
+ */
+export declare function probeWellKnown(origin: string, fetchImpl: ProbeFetch, options?: ProbeOptions): Promise<DiscoveryProbeMatch[]>;
+/**
+ * Decide whether a response content-type is plausible for the given artifact.
+ * HTML is always rejected; a missing/empty header is accepted (lenient).
+ */
+export declare function contentTypeOk(raw: string | null, kind: DiscoveryKind): boolean;
+//# sourceMappingURL=well-known-probe.d.ts.map

package/dist/node-server/_shared/well-known-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known-probe.d.ts","sourceRoot":"","sources":["../src/well-known-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC/C;AAED,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAAG,CACvB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,KACtF,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,aAAa,CAAC;IACpB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAcD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,EACrB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAahC;AAyCD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAU9E"}

package/dist/node-server/_shared/well-known-probe.js

@@ -0,0 +1,104 @@
+/**
+ * Well-known probe for Agentic Resource Discovery (ARD) artifacts.
+ *
+ * When a response carries no `ai-catalog` `Link` header (see
+ * `discovery-link.ts`), an origin can still publish discovery artifacts at
+ * their standardized well-known locations:
+ *
+ *   - `/.well-known/ai-catalog.json` — the ARD capability manifest
+ *   - `/llms.txt`                    — the llmstxt.org digest for LLMs
+ *
+ * `probeWellKnown` issues a bounded GET to each location and returns the ones
+ * that answer `200` with a plausible content-type. It is pure core: the fetch
+ * implementation is injected and every network failure / timeout is caught and
+ * treated as "no match" (never thrown). No float wiring lives here.
+ *
+ * Probes are credential-free (`credentials: 'omit'`) and never follow
+ * redirects (`redirect: 'manual'`): the extension float runs them through the
+ * SW's `host_permissions`-privileged fetch while the user's tab may be in the
+ * middle of an SSO login on the very same origin — a credentialed probe that
+ * chases the auth-bounce chain poisons the IdP's pending return-URL state and
+ * hijacks the tab to `<origin>/llms.txt` (see probeOne).
+ *
+ * Content-type is lenient by design — a missing header is accepted (some static
+ * hosts omit it), but an HTML response is always rejected: a manifest / digest
+ * served as HTML is a misconfiguration, not the artifact.
+ */
+const TARGETS = [
+    { kind: 'ai-catalog', path: '/.well-known/ai-catalog.json' },
+    { kind: 'llms-txt', path: '/llms.txt' },
+];
+const DEFAULT_TIMEOUT_MS = 3000;
+/**
+ * Probe an origin's well-known discovery locations. Returns one match per
+ * artifact that answered `200` with a plausible content-type. Both probes run
+ * concurrently; a failure of one never affects the other.
+ */
+export async function probeWellKnown(origin, fetchImpl, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let base;
+    try {
+        base = new URL(origin).origin;
+    }
+    catch {
+        return [];
+    }
+    const settled = await Promise.all(TARGETS.map((target) => probeOne(base, target, fetchImpl, timeoutMs)));
+    return settled.filter((m) => m !== null);
+}
+async function probeOne(base, target, fetchImpl, timeoutMs) {
+    const url = base + target.path;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(new Error('timeout')), timeoutMs);
+    try {
+        // The probe fires while the user's tab may be mid-SSO on the same origin.
+        // It must be side-effect-free on auth state: `credentials: 'omit'` keeps
+        // profile cookies out of the request AND ignores Set-Cookie on the
+        // response, and `redirect: 'manual'` refuses to chase an auth-bounce
+        // chain. A credentialed, redirect-following probe joins the in-flight
+        // login and can overwrite the IdP's cookie-keyed return-URL slot — the
+        // user's tab then lands on `<origin>/llms.txt` after completing Okta/SSO.
+        // An artifact that doesn't answer 200 anonymously at its canonical
+        // location is not a published advertisement, so a redirect is "no match"
+        // (browser fetch surfaces it as an opaqueredirect, status 0).
+        const res = await fetchImpl(url, {
+            method: 'GET',
+            signal: ctrl.signal,
+            redirect: 'manual',
+            credentials: 'omit',
+        });
+        // Require an exact 200. `res.ok` also accepts 204 No Content / 206 Partial
+        // Content, which would surface a discovery lick for an empty / no-body
+        // artifact (especially when the server omits a content-type).
+        if (res.status !== 200)
+            return null;
+        if (!contentTypeOk(res.headers.get('content-type'), target.kind))
+            return null;
+        return { kind: target.kind, url };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Decide whether a response content-type is plausible for the given artifact.
+ * HTML is always rejected; a missing/empty header is accepted (lenient).
+ */
+export function contentTypeOk(raw, kind) {
+    if (raw == null)
+        return true;
+    const ct = raw.toLowerCase();
+    if (ct.length === 0)
+        return true;
+    if (ct.includes('text/html') || ct.includes('application/xhtml'))
+        return false;
+    if (kind === 'ai-catalog') {
+        return ct.includes('json') || ct.includes('text/plain') || ct.includes('octet-stream');
+    }
+    // llms-txt
+    return ct.includes('text/plain') || ct.includes('markdown') || ct.includes('octet-stream');
+}
+//# sourceMappingURL=well-known-probe.js.map

package/dist/node-server/_shared/well-known-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known-probe.js","sourceRoot":"","sources":["../src/well-known-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAiCH,MAAM,OAAO,GAA2B;IACtC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,8BAA8B,EAAE;IAC5D,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE;CACxC,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,SAAqB,EACrB,OAAO,GAAiB,EAAE;IAE1B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CACtE,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAA4B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,MAAmB,EACnB,SAAqB,EACrB,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC/B,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;QACH,2EAA2E;QAC3E,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAkB,EAAE,IAAmB;IACnE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACzF,CAAC;IACD,WAAW;IACX,OAAO,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC7F,CAAC"}

package/dist/node-server/electron-controller.d.ts

@@ -72,6 +72,16 @@ interface RunningProcessInfo {
     commandLine: string;
     executablePath: string | null;
 }
+/**
+ * One element of a CDP `Network.Request.postDataEntries` array. `bytes` is the
+ * protocol `binary` type — base64 in the JSON wire form, so it survives bodies
+ * that are not valid UTF-8. Entries backed by a file or blob (a `<input
+ * type=file>` part) carry NO `bytes`: Chrome does not expose those bytes over
+ * CDP at all.
+ */
+export interface CdpPostDataEntry {
+    bytes?: string;
+}
 export declare function findMatchingElectronAppPids(runningProcesses: RunningProcessInfo[], processMatchPatterns: string[], currentPid?: number): number[];
 export declare class ElectronAppAlreadyRunningError extends Error {
     constructor(message: string);
@@ -108,6 +118,47 @@ export declare function computeAverageLuminance(pixels: Buffer, width: number, h
  * actually needs unblocking when the parent is a local file.
  */
 export declare function resolveFetchProxyOrigin(targetUrl: string, servePort: number): string;
+/**
+ * Outcome of reconstructing an intercepted request's POST body from the CDP
+ * `Fetch.requestPaused` payload.
+ *
+ * - `none` — the request has no body (a GET/HEAD navigation).
+ * - `bytes` — the exact body bytes, recovered losslessly.
+ * - `unrecoverable` — the request HAS a body but CDP did not hand us its bytes.
+ *   The caller must fail the request; forwarding a guess would silently corrupt
+ *   the origin's copy of the upload.
+ */
+export type CdpPostBody = {
+    kind: 'none';
+} | {
+    kind: 'bytes';
+    bytes: Buffer;
+} | {
+    kind: 'unrecoverable';
+    reason: string;
+};
+/**
+ * Recover the byte-exact POST body of an intercepted `Fetch.requestPaused`
+ * request. A document POST is a byte pipe: multipart boundaries wrapping a JPEG
+ * are not UTF-8, so `Buffer.from(request.postData)` (Node's implicit UTF-8) or
+ * `String.data(using: .utf8)` expands every byte ≥0x80 (`80` → `C2 80`) and the
+ * origin receives a corrupt body behind a successful fulfill (#2886).
+ *
+ * Order of trust:
+ * 1. `postDataEntries[].bytes` — base64 over the wire, so byte-exact for any
+ *    body. This is the CDP-recommended source (`postData` is deprecated).
+ * 2. `postData` **only when it is pure ASCII** — then UTF-8, latin1 and the raw
+ *    bytes all coincide, so the string cannot be lossy. Covers the ordinary
+ *    `application/x-www-form-urlencoded` form post, which percent-encodes.
+ * 3. Anything else (a file/blob entry Chrome never exposes, `hasPostData` with
+ *    the body dropped for length, or a non-ASCII `postData` string with no
+ *    entries) is unrecoverable. We fail rather than substitute bytes.
+ */
+export declare function decodeCdpRequestPostBody(request: {
+    postData?: string;
+    hasPostData?: boolean;
+    postDataEntries?: CdpPostDataEntry[];
+}): CdpPostBody;
 /**
  * Pre-built bootstrap scripts for thin-mode injection — one per overlay
  * role. The injector picks `leader` for the first injected target and

package/dist/node-server/electron-controller.js

@@ -442,6 +442,81 @@ export function resolveFetchProxyOrigin(targetUrl, servePort) {
     }
     return `http://localhost:${servePort}`;
 }
+/** True when every code unit of `value` is ASCII (0x00-0x7F). */
+function isPureAscii(value) {
+    for (let i = 0; i < value.length; i++) {
+        if (value.charCodeAt(i) > 0x7f)
+            return false;
+    }
+    return true;
+}
+/**
+ * Recover the byte-exact POST body of an intercepted `Fetch.requestPaused`
+ * request. A document POST is a byte pipe: multipart boundaries wrapping a JPEG
+ * are not UTF-8, so `Buffer.from(request.postData)` (Node's implicit UTF-8) or
+ * `String.data(using: .utf8)` expands every byte ≥0x80 (`80` → `C2 80`) and the
+ * origin receives a corrupt body behind a successful fulfill (#2886).
+ *
+ * Order of trust:
+ * 1. `postDataEntries[].bytes` — base64 over the wire, so byte-exact for any
+ *    body. This is the CDP-recommended source (`postData` is deprecated).
+ * 2. `postData` **only when it is pure ASCII** — then UTF-8, latin1 and the raw
+ *    bytes all coincide, so the string cannot be lossy. Covers the ordinary
+ *    `application/x-www-form-urlencoded` form post, which percent-encodes.
+ * 3. Anything else (a file/blob entry Chrome never exposes, `hasPostData` with
+ *    the body dropped for length, or a non-ASCII `postData` string with no
+ *    entries) is unrecoverable. We fail rather than substitute bytes.
+ */
+export function decodeCdpRequestPostBody(request) {
+    const entries = request.postDataEntries;
+    if (entries && entries.length > 0) {
+        const chunks = [];
+        for (const entry of entries) {
+            if (typeof entry.bytes !== 'string') {
+                return {
+                    kind: 'unrecoverable',
+                    reason: 'postDataEntries contains a file/blob element with no bytes',
+                };
+            }
+            chunks.push(Buffer.from(entry.bytes, 'base64'));
+        }
+        return { kind: 'bytes', bytes: Buffer.concat(chunks) };
+    }
+    const postData = request.postData;
+    if (typeof postData === 'string' && postData.length > 0) {
+        if (isPureAscii(postData)) {
+            // ASCII: UTF-8, latin1 and the raw bytes all agree, so no codec can lose.
+            return { kind: 'bytes', bytes: Buffer.from(postData, 'latin1') };
+        }
+        return {
+            kind: 'unrecoverable',
+            reason: 'postData is not pure ASCII and no postDataEntries were provided',
+        };
+    }
+    if (request.hasPostData) {
+        return { kind: 'unrecoverable', reason: 'hasPostData is set but CDP provided no body' };
+    }
+    return { kind: 'none' };
+}
+/**
+ * Build the outgoing proxy request's headers from the intercepted ones: drop the
+ * browser's `content-length` and re-derive it from the body we are actually
+ * forwarding (`null` = no body). The intercepted value counts the ORIGINAL bytes,
+ * so any body-length drift — like the UTF-8 expansion this hop used to do —
+ * turned into a mismatched `Content-Length` the origin read the wrong way.
+ */
+function buildProxyRequestHeaders(requestHeaders, bodyLength) {
+    const headers = {};
+    for (const [name, value] of Object.entries(requestHeaders)) {
+        if (name.toLowerCase() === 'content-length')
+            continue;
+        headers[name] = value;
+    }
+    if (bodyLength !== null) {
+        headers['Content-Length'] = String(bodyLength);
+    }
+    return headers;
+}
 /**
  * Translate a Node http(s) response's headers into the array shape required by
  * `Fetch.fulfillRequest`, stripping CSP and other hop-by-hop headers that are
@@ -1094,13 +1169,20 @@ export class ElectronOverlayInjector {
         const url = request.url || '';
         const method = request.method || 'GET';
         const requestHeaders = request.headers || {};
-        const postData = request.postData;
         // Only proxy HTML document requests (Accept header contains text/html)
         const acceptHeader = requestHeaders['Accept'] || requestHeaders['accept'] || '';
         if (!acceptHeader.includes('text/html')) {
             send('Fetch.continueRequest', { requestId });
             return;
         }
+        // A document POST (a navigating <form>, including multipart with a file) is
+        // a byte pipe. Recover the exact bytes or fail — never forward a guess.
+        const postBody = decodeCdpRequestPostBody(request);
+        if (postBody.kind === 'unrecoverable') {
+            console.error(`[electron-float] Cannot recover POST body byte-exactly (${postBody.reason}); failing instead of forwarding corrupt bytes: ${url.substring(0, 60)}`);
+            send('Fetch.failRequest', { requestId, errorReason: 'Failed' });
+            return;
+        }
         console.log(`[electron-float] Proxying request to strip CSP: ${url.substring(0, 60)}`);
         // Make the request ourselves using Node.js http/https
         const parsedUrl = new URL(url);
@@ -1110,7 +1192,7 @@ export class ElectronOverlayInjector {
             port: parsedUrl.port || (parsedUrl.protocol === 'https:' ? 443 : 80),
             path: parsedUrl.pathname + parsedUrl.search,
             method: method,
-            headers: requestHeaders,
+            headers: buildProxyRequestHeaders(requestHeaders, postBody.kind === 'bytes' ? postBody.bytes.length : null),
         };
         const proxyReq = transport.request(options, (proxyRes) => {
             const bodyChunks = [];
@@ -1137,9 +1219,10 @@ export class ElectronOverlayInjector {
                 send('Fetch.failRequest', { requestId, errorReason: 'Failed' });
             }
         });
-        // Forward request body if present (for POST/PUT requests)
-        if (postData) {
-            proxyReq.write(postData);
+        // Forward request body if present (for POST/PUT requests) as raw bytes —
+        // writing the CDP `postData` string here is what UTF-8-expanded it (#2886).
+        if (postBody.kind === 'bytes') {
+            proxyReq.write(postBody.bytes);
         }
         proxyReq.end();
     }