sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -1,57 +1,79 @@
 import http, {} from 'node:http';
 import https from 'node:https';
 import { pipeline } from 'node:stream/promises';
-import { buildUpstreamHeaders, rewriteResponseHeaders } from './header-policy.js';
-import { assertDesktopBridgeRequestPolicy, resolveDesktopBridgeTarget, safeBridgeErrorCode, } from './security.js';
+import { buildProviderUpstreamHeaders, rewriteResponseHeaders } from './header-policy.js';
+import { resolveAndBindDesktopBridgeRouteContext, resolveCodexSessionIdentity, resolveDesktopBridgeTarget, safeBridgeErrorCode, singleBridgeHeader } from './security.js';
 import { desktopBridgeListenOrigin } from './state.js';
 import { DesktopBridgeError } from './types.js';
-const MAX_MODEL_VALIDATION_BODY_BYTES = 16 * 1024 * 1024;
-function isResponsesPath(rawUrl) {
+const MAX_UPSTREAM_ERROR_BODY_BYTES = 1024 * 1024;
+function bodyCarriesModel(rawUrl) {
     const pathname = new URL(String(rawUrl || '/'), 'http://bridge.invalid').pathname;
-    return pathname === '/backend-api/codex/responses'
-        || pathname === '/api/v1/responses'
-        || pathname === '/v1/responses';
+    return pathname === '/backend-api/codex/responses' || pathname === '/api/v1/responses' || pathname === '/v1/responses';
 }
-export async function prepareDesktopBridgeRequestBody(req, config) {
-    if (!config.providerMode || !isResponsesPath(req.url))
-        return null;
+async function readBoundedBody(req, maximum) {
     const declared = Number(req.headers['content-length'] || 0);
-    if (Number.isFinite(declared) && declared > MAX_MODEL_VALIDATION_BODY_BYTES) {
+    if (Number.isFinite(declared) && declared > maximum)
         throw new DesktopBridgeError('bridge_request_body_too_large');
-    }
     const chunks = [];
     let total = 0;
     for await (const raw of req) {
         const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
         total += chunk.length;
-        if (total > MAX_MODEL_VALIDATION_BODY_BYTES)
+        if (total > maximum)
             throw new DesktopBridgeError('bridge_request_body_too_large');
         chunks.push(chunk);
     }
-    const body = Buffer.concat(chunks);
-    let payload;
-    try {
-        payload = JSON.parse(body.toString('utf8'));
+    return Buffer.concat(chunks);
+}
+async function resolveCredential(config, route) {
+    const provider = config.providers[route.provider_id];
+    if (!provider)
+        throw new DesktopBridgeError('bridge_provider_route_unavailable');
+    const credential = await config.resolveProviderCredential(route.provider_id, provider.credential_generation);
+    if (credential.provider_id !== route.provider_id || credential.generation !== provider.credential_generation
+        || (provider.credential_fingerprint && credential.fingerprint !== provider.credential_fingerprint)) {
+        throw new DesktopBridgeError('bridge_provider_credential_generation_mismatch');
     }
-    catch {
-        throw new DesktopBridgeError('bridge_responses_body_invalid_json');
+    return credential;
+}
+export async function prepareDesktopBridgeRequest(req, config) {
+    const pathname = new URL(String(req.url || '/'), 'http://bridge.invalid').pathname;
+    let body = null;
+    let payload = null;
+    if (bodyCarriesModel(req.url)) {
+        body = await readBoundedBody(req, config.maxRequestBodyBytes ?? 16 * 1024 * 1024);
+        try {
+            const parsed = JSON.parse(body.toString('utf8'));
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                throw new Error();
+            payload = parsed;
+        }
+        catch {
+            throw new DesktopBridgeError('bridge_responses_body_invalid_json');
+        }
     }
-    const model = payload && typeof payload === 'object' && !Array.isArray(payload)
-        ? payload.model
-        : null;
-    assertDesktopBridgeRequestPolicy({ headers: req.headers, config, model });
-    return body;
+    const headerModel = singleBridgeHeader(req.headers, 'x-sks-model');
+    const model = typeof payload?.model === 'string' ? payload.model : headerModel;
+    const sessionIdentity = resolveCodexSessionIdentity(req.headers, payload);
+    const route = await resolveAndBindDesktopBridgeRouteContext({
+        public_model: String(model || ''), session_id: sessionIdentity.thread_id,
+        pathname, transport: 'http', headers: req.headers,
+    }, config);
+    if (payload && payload.model !== route.upstream_model) {
+        payload.model = route.upstream_model;
+        body = Buffer.from(JSON.stringify(payload));
+    }
+    const credential = await resolveCredential(config, route);
+    return { body, route, credential };
 }
 function connectTimeout(request, config) {
     request.once('socket', (socket) => {
         if (!socket.connecting)
             return;
-        const timer = setTimeout(() => {
-            request.destroy(new DesktopBridgeError('bridge_upstream_connect_timeout'));
-        }, config.connectTimeoutMs);
+        const timer = setTimeout(() => request.destroy(new DesktopBridgeError('bridge_upstream_connect_timeout')), config.connectTimeoutMs);
         timer.unref();
-        const event = config.remote.secure ? 'secureConnect' : 'connect';
-        socket.once(event, () => clearTimeout(timer));
+        socket.once('connect', () => clearTimeout(timer));
+        socket.once('secureConnect', () => clearTimeout(timer));
         socket.once('close', () => clearTimeout(timer));
     });
 }
@@ -61,80 +83,90 @@ function writeHttpBridgeError(res, error) {
         res.destroy(error instanceof Error ? error : undefined);
         return;
     }
-    res.writeHead(502, {
-        'content-type': 'application/json',
-        'cache-control': 'no-store',
-        connection: 'close',
+    res.writeHead(code.startsWith('catalog_') || code.startsWith('session_') || code.includes('route_') ? 409 : 502, {
+        'content-type': 'application/json', 'cache-control': 'no-store', connection: 'close',
     });
-    res.end(JSON.stringify({
+    res.end(JSON.stringify({ error: { type: 'sks_bridge_error', code, message: code } }));
+}
+async function readRedactedUpstreamError(response) {
+    let total = 0;
+    for await (const raw of response) {
+        const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+        total += chunk.length;
+        if (total > MAX_UPSTREAM_ERROR_BODY_BYTES) {
+            response.destroy();
+            break;
+        }
+    }
+    return Buffer.from(JSON.stringify({
         error: {
-            type: 'sks_bridge_error',
-            code,
-            message: code,
-        },
+            type: 'upstream_error',
+            code: 'bridge_upstream_request_failed',
+            message: 'Upstream request failed'
+        }
     }));
 }
-export async function forwardHttp(req, res, config, bufferedBody = null) {
-    const target = resolveDesktopBridgeTarget(req.url, config.remote);
-    const transport = config.remote.secure ? https : http;
-    const headers = buildUpstreamHeaders(req.headers, config, target.host);
-    const localOrigin = desktopBridgeListenOrigin(config);
+export async function forwardHttp(req, res, config, prepared, authenticatedLocalBaseUrl = desktopBridgeListenOrigin(config)) {
     try {
+        const request = prepared || await prepareDesktopBridgeRequest(req, config);
+        const provider = config.providers[request.route.provider_id];
+        if (!provider)
+            throw new DesktopBridgeError('bridge_provider_route_unavailable');
+        const target = resolveDesktopBridgeTarget(req.url, provider.remote);
+        const transport = provider.remote.secure ? https : http;
+        const headers = buildProviderUpstreamHeaders(req.headers, {
+            providerId: provider.provider_id, authTransport: provider.auth_transport, credential: request.credential,
+        }, target.host);
+        if (request.body)
+            headers['content-length'] = String(request.body.length);
+        else
+            delete headers['content-length'];
         await new Promise((resolve, reject) => {
             let responseStarted = false;
             let settled = false;
-            const finish = (error) => {
-                if (settled)
-                    return;
-                settled = true;
-                if (error)
-                    reject(error);
-                else
-                    resolve();
-            };
+            const finish = (error) => { if (settled)
+                return; settled = true; error ? reject(error) : resolve(); };
             const upstream = transport.request({
-                protocol: target.protocol,
-                hostname: config.remote.address,
-                family: config.remote.family,
-                port: config.remote.port,
-                method: req.method,
-                path: `${target.pathname}${target.search}`,
-                headers,
-                ...(config.remote.tlsServername ? { servername: config.remote.tlsServername } : {}),
+                protocol: target.protocol, hostname: provider.remote.address, family: provider.remote.family,
+                port: provider.remote.port, method: req.method, path: `${target.pathname}${target.search}`, headers,
+                ...(provider.remote.tlsServername ? { servername: provider.remote.tlsServername } : {}),
             });
             connectTimeout(upstream, config);
-            upstream.setTimeout(config.idleTimeoutMs, () => {
-                upstream.destroy(new DesktopBridgeError('bridge_upstream_idle_timeout'));
-            });
-            const abortUpstream = () => {
-                if (!res.writableEnded)
-                    upstream.destroy(new DesktopBridgeError('bridge_client_disconnected'));
-            };
-            req.once('aborted', abortUpstream);
-            res.once('close', abortUpstream);
+            upstream.setTimeout(config.idleTimeoutMs, () => upstream.destroy(new DesktopBridgeError('bridge_upstream_idle_timeout')));
+            const abort = () => { if (!res.writableEnded)
+                upstream.destroy(new DesktopBridgeError('bridge_client_disconnected')); };
+            req.once('aborted', abort);
+            res.once('close', abort);
             upstream.once('error', finish);
-            upstream.once('response', (upstreamResponse) => {
+            upstream.once('response', (response) => {
+                const statusCode = response.statusCode || 502;
+                if (statusCode >= 400) {
+                    void readRedactedUpstreamError(response).then((body) => {
+                        responseStarted = true;
+                        const responseHeaders = rewriteResponseHeaders(response.headers, provider.base_url, authenticatedLocalBaseUrl);
+                        responseHeaders['content-length'] = String(body.length);
+                        delete responseHeaders['transfer-encoding'];
+                        res.writeHead(statusCode, responseHeaders);
+                        res.end(body, () => finish());
+                    }).catch(finish);
+                    return;
+                }
                 responseStarted = true;
                 try {
-                    const responseHeaders = rewriteResponseHeaders(upstreamResponse.headers, config, localOrigin);
-                    res.writeHead(upstreamResponse.statusCode || 502, responseHeaders);
+                    res.writeHead(statusCode, rewriteResponseHeaders(response.headers, provider.base_url, authenticatedLocalBaseUrl));
                 }
                 catch (error) {
-                    upstreamResponse.destroy(error instanceof Error ? error : undefined);
+                    response.destroy(error instanceof Error ? error : undefined);
                     finish(error);
                     return;
                 }
-                void pipeline(upstreamResponse, res).then(() => finish(), finish);
+                void pipeline(response, res).then(() => finish(), finish);
             });
-            if (bufferedBody) {
-                upstream.end(bufferedBody);
-            }
-            else {
-                void pipeline(req, upstream).catch((error) => {
-                    if (!responseStarted)
-                        finish(error);
-                });
-            }
+            if (request.body)
+                upstream.end(request.body);
+            else
+                void pipeline(req, upstream).catch((error) => { if (!responseStarted)
+                    finish(error); });
         });
     }
     catch (error) {

package/dist/core/codex-lb/desktop-bridge/launchd.js

@@ -3,7 +3,8 @@ import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { DesktopBridgeError } from './types.js';
-export const DESKTOP_BRIDGE_LAUNCHD_LABEL = 'com.sneakoscope.codex-lb-desktop-bridge';
+import { withFileLock } from '../../locks/file-lock.js';
+export const DESKTOP_BRIDGE_LAUNCHD_LABEL = 'com.sneakoscope.desktop-bridge';
 export function desktopBridgeLaunchdPlistPath(home = os.homedir()) {
     return path.join(home, 'Library', 'LaunchAgents', `${DESKTOP_BRIDGE_LAUNCHD_LABEL}.plist`);
 }
@@ -66,16 +67,22 @@ ${programArguments}
 `;
 }
 export async function writeDesktopBridgeLaunchdPlist(file, options) {
-    const contents = renderDesktopBridgeLaunchdPlist(options);
-    const directory = path.dirname(file);
-    await fsp.mkdir(directory, { recursive: true, mode: 0o700 });
-    const temp = path.join(directory, `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
-    try {
-        await fsp.writeFile(temp, contents, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
-        await fsp.rename(temp, file);
-        await fsp.chmod(file, 0o600);
-    }
-    finally {
-        await fsp.rm(temp, { force: true }).catch(() => undefined);
-    }
+    await withFileLock({
+        lockPath: `${path.resolve(file)}.lock`,
+        timeoutMs: 10_000,
+        staleMs: 60_000
+    }, async () => {
+        const contents = renderDesktopBridgeLaunchdPlist(options);
+        const directory = path.dirname(file);
+        await fsp.mkdir(directory, { recursive: true, mode: 0o700 });
+        const temp = path.join(directory, `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
+        try {
+            await fsp.writeFile(temp, contents, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+            await fsp.rename(temp, file);
+            await fsp.chmod(file, 0o600);
+        }
+        finally {
+            await fsp.rm(temp, { force: true }).catch(() => undefined);
+        }
+    });
 }

package/dist/core/codex-lb/desktop-bridge/location-rewrite.js

@@ -13,7 +13,10 @@ export function rewriteLocationHeader(value, remoteBaseUrl, localOrigin) {
         throw new DesktopBridgeError('bridge_location_origin_forbidden');
     }
     const local = new URL(localOrigin);
-    local.pathname = location.pathname;
+    const authenticatedBasePath = local.pathname === '/'
+        ? ''
+        : local.pathname.replace(/\/+$/, '');
+    local.pathname = `${authenticatedBasePath}${location.pathname}`;
     local.search = location.search;
     local.hash = '';
     if (location.protocol === 'wss:' || location.protocol === 'ws:')