sneakoscope 8.1.2 → 8.2.0

package/dist/core/codex-lb/desktop-bridge/server.js

@@ -1,26 +1,108 @@
-import { randomInt } from 'node:crypto';
+import { createHash, randomInt, timingSafeEqual } from 'node:crypto';
 import http, {} from 'node:http';
 import net, {} from 'node:net';
-import { forwardHttp, prepareDesktopBridgeRequestBody } from './http-forward.js';
-import { assertAllowedOrigin, assertAllowedPath, assertDesktopBridgeRequestPolicy, assertLoopbackPeer, assertLoopbackListenHost, assertWebSocketUpgrade, prepareDesktopBridgeConfig, safeBridgeErrorCode, validatePreparedDesktopBridgeConfig, } from './security.js';
-import { createDesktopBridgePublicState, desktopBridgeStatePath, removeDesktopBridgeStateIfOwned, writeDesktopBridgeState, } from './state.js';
+import { forwardHttp, prepareDesktopBridgeRequest } from './http-forward.js';
+import { assertAllowedOrigin, assertAllowedPath, assertLoopbackPeer, assertLoopbackListenHost, assertWebSocketUpgrade, prepareDesktopBridgeConfig, safeBridgeErrorCode, validatePreparedDesktopBridgeConfig, } from './security.js';
+import { createDesktopBridgePublicState, desktopBridgeListenOrigin, desktopBridgeStatePath, refreshDesktopBridgeState, removeDesktopBridgeStateIfOwned, writeDesktopBridgeState, } from './state.js';
 import { DesktopBridgeError } from './types.js';
+import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL } from './types.js';
 import { forwardWebSocket } from './websocket-forward.js';
-function pathnameFromRequest(req) {
+function authenticateDesktopBridgeClient(req, input) {
+    const raw = String(req.url || '/');
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) || raw.startsWith('//') || /[\r\n\0]/.test(raw)) {
+        throw new DesktopBridgeError('bridge_request_target_invalid');
+    }
+    let parsed;
     try {
-        return new URL(req.url || '/', 'http://bridge.invalid').pathname;
+        parsed = new URL(raw, 'http://bridge.invalid');
     }
     catch {
         throw new DesktopBridgeError('bridge_request_target_invalid');
     }
+    const tokenPrefix = `${DESKTOP_BRIDGE_CLIENT_PATH_PREFIX}/`;
+    if (!parsed.pathname.startsWith(tokenPrefix))
+        throw new DesktopBridgeError('bridge_client_capability_required');
+    const remainder = parsed.pathname.slice(tokenPrefix.length);
+    const separator = remainder.indexOf('/');
+    const capability = separator > 0 ? remainder.slice(0, separator) : '';
+    const canonicalPathname = separator > 0 ? remainder.slice(separator) : '';
+    if (!/^[A-Za-z0-9_-]{43}$/.test(capability) || !canonicalPathname.startsWith('/')) {
+        throw new DesktopBridgeError('bridge_client_capability_invalid');
+    }
+    const actual = createHash('sha256').update(capability).digest();
+    const expected = Buffer.from(input.clientCapabilitySha256, 'hex');
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+        throw new DesktopBridgeError('bridge_client_capability_invalid');
+    }
+    req.url = `${canonicalPathname}${parsed.search}`;
+    return {
+        pathname: canonicalPathname,
+        clientBasePath: `${DESKTOP_BRIDGE_CLIENT_PATH_PREFIX}/${capability}`,
+    };
+}
+function handleDiagnosticWebSocket(req, socket, head) {
+    const protocols = String(req.headers['sec-websocket-protocol'] || '').split(',').map((value) => value.trim());
+    if (!protocols.includes(DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL))
+        throw new DesktopBridgeError('bridge_websocket_protocol_mismatch');
+    const key = String(req.headers['sec-websocket-key'] || '');
+    const accept = createHash('sha1').update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`).digest('base64');
+    socket.write('HTTP/1.1 101 Switching Protocols\r\n'
+        + 'Upgrade: websocket\r\nConnection: Upgrade\r\n'
+        + `Sec-WebSocket-Accept: ${accept}\r\n`
+        + `Sec-WebSocket-Protocol: ${DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL}\r\n\r\n`);
+    let buffered = head;
+    const consume = (chunk) => {
+        if (chunk)
+            buffered = Buffer.concat([buffered, chunk]);
+        while (buffered.length >= 6) {
+            const opcode = buffered[0] & 0x0f;
+            const masked = (buffered[1] & 0x80) !== 0;
+            const length = buffered[1] & 0x7f;
+            if (!masked || length > 125) {
+                socket.destroy();
+                return;
+            }
+            if (buffered.length < 6 + length)
+                return;
+            const mask = buffered.subarray(2, 6);
+            const raw = buffered.subarray(6, 6 + length);
+            const payload = Buffer.alloc(length);
+            for (let index = 0; index < length; index += 1)
+                payload[index] = (raw[index] || 0) ^ (mask[index % 4] || 0);
+            buffered = buffered.subarray(6 + length);
+            if (opcode === 1 || opcode === 2)
+                socket.write(Buffer.concat([Buffer.from([0x80 | opcode, length]), payload]));
+            else if (opcode === 8) {
+                socket.end(Buffer.concat([Buffer.from([0x88, payload.length]), payload]));
+                return;
+            }
+        }
+    };
+    socket.on('data', consume);
+    consume();
 }
 function rejectionStatus(code) {
     if (code === 'bridge_path_not_allowed')
         return 404;
-    if (code.includes('origin') || code.includes('peer') || code.includes('loopback'))
+    if (code === 'bridge_request_capacity_exhausted')
+        return 503;
+    if (code === 'bridge_session_pin_persist_failed' || code.startsWith('bridge_upstream_'))
+        return 502;
+    if (code.includes('origin') || code.includes('peer') || code.includes('loopback') || code.includes('capability'))
         return 403;
     return 400;
 }
+function rejectionStatusText(status) {
+    if (status === 404)
+        return 'Not Found';
+    if (status === 403)
+        return 'Forbidden';
+    if (status === 502)
+        return 'Bad Gateway';
+    if (status === 503)
+        return 'Service Unavailable';
+    return 'Bad Request';
+}
 function writeBridgeRejection(res, error) {
     if (res.headersSent) {
         res.destroy(error instanceof Error ? error : undefined);
@@ -39,13 +121,32 @@ function writeUpgradeRejection(socket, error) {
         return;
     const code = safeBridgeErrorCode(error);
     const status = rejectionStatus(code);
-    socket.end(`HTTP/1.1 ${status} ${status === 404 ? 'Not Found' : status === 403 ? 'Forbidden' : 'Bad Request'}\r\n`
+    socket.end(`HTTP/1.1 ${status} ${rejectionStatusText(status)}\r\n`
         + 'Content-Type: application/json\r\n'
         + 'Cache-Control: no-store\r\n'
         + 'Connection: close\r\n'
         + '\r\n'
         + JSON.stringify({ error: { type: 'sks_bridge_rejection', code, message: code } }));
 }
+function writeDiagnosticHealth(req, res, input) {
+    if (req.method !== 'GET')
+        throw new DesktopBridgeError('bridge_diagnostic_method_not_allowed');
+    const payload = {
+        schema: 'sks.desktop-bridge-health.v1',
+        runtime: 'desktop-bridge',
+        state: 'ready',
+        provider_registry_generation: input.providerRegistry?.generation || null,
+        route_policy_generation: input.routePolicy?.policy_generation || null,
+        catalog_generation: input.routePolicy?.catalog_generation || null,
+        secret_fields_redacted: true
+    };
+    res.writeHead(200, {
+        'content-type': 'application/json',
+        'cache-control': 'no-store',
+        connection: 'close'
+    });
+    res.end(JSON.stringify(payload));
+}
 async function listenExact(server, host, port) {
     await new Promise((resolve, reject) => {
         const onError = (error) => {
@@ -101,23 +202,43 @@ export const preflightDesktopBridge = prepareDesktopBridgeConfig;
 export async function startPreparedDesktopBridge(input, options = {}) {
     validatePreparedDesktopBridgeConfig(input);
     const sockets = new Set();
+    const maxConcurrentRequests = input.maxConcurrentRequests ?? 64;
+    let activeRequests = 0;
     const server = http.createServer((req, res) => {
         void (async () => {
+            let admitted = false;
             try {
+                if (activeRequests >= maxConcurrentRequests)
+                    throw new DesktopBridgeError('bridge_request_capacity_exhausted');
+                activeRequests += 1;
+                admitted = true;
                 assertLoopbackPeer(req.socket.remoteAddress);
+                const authenticated = authenticateDesktopBridgeClient(req, input);
                 assertAllowedOrigin(req.headers, input.allowedOrigins);
-                assertAllowedPath(pathnameFromRequest(req), input.allowedPathPrefixes);
-                assertDesktopBridgeRequestPolicy({ headers: req.headers, config: input });
-                const body = await prepareDesktopBridgeRequestBody(req, input);
-                await forwardHttp(req, res, input, body);
+                if (authenticated.pathname === DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH) {
+                    writeDiagnosticHealth(req, res, input);
+                    return;
+                }
+                assertAllowedPath(authenticated.pathname, input.allowedPathPrefixes);
+                const prepared = await prepareDesktopBridgeRequest(req, input);
+                await forwardHttp(req, res, input, prepared, `${desktopBridgeListenOrigin(input)}${authenticated.clientBasePath}`);
             }
             catch (error) {
-                req.resume();
+                req.pause();
+                res.once('finish', () => {
+                    if (!req.complete)
+                        req.destroy();
+                });
                 writeBridgeRejection(res, error);
             }
+            finally {
+                if (admitted)
+                    activeRequests -= 1;
+            }
         })();
     });
-    server.requestTimeout = 0;
+    server.maxConnections = input.maxConnections ?? 128;
+    server.requestTimeout = input.requestTimeoutMs ?? 30_000;
     server.headersTimeout = Math.max(5_000, input.connectTimeoutMs);
     server.keepAliveTimeout = Math.min(input.idleTimeoutMs, 60_000);
     server.on('connection', (socket) => {
@@ -131,14 +252,15 @@ export async function startPreparedDesktopBridge(input, options = {}) {
     server.on('upgrade', (req, socket, head) => {
         try {
             assertLoopbackPeer(req.socket.remoteAddress);
+            const authenticated = authenticateDesktopBridgeClient(req, input);
             assertAllowedOrigin(req.headers, input.allowedOrigins);
-            assertAllowedPath(pathnameFromRequest(req), input.allowedPathPrefixes);
-            assertDesktopBridgeRequestPolicy({ headers: req.headers, config: input });
             assertWebSocketUpgrade(req.headers, req.method);
-            if (input.providerMode === 'openrouter') {
-                throw new DesktopBridgeError('bridge_openrouter_websocket_unsupported');
+            if (authenticated.pathname === DESKTOP_BRIDGE_DIAGNOSTIC_PATH) {
+                handleDiagnosticWebSocket(req, socket, head);
+                return;
             }
-            forwardWebSocket(req, socket, head, input);
+            assertAllowedPath(authenticated.pathname, input.allowedPathPrefixes);
+            void forwardWebSocket(req, socket, head, input, `${desktopBridgeListenOrigin(input)}${authenticated.clientBasePath}`).catch((error) => writeUpgradeRejection(socket, error));
         }
         catch (error) {
             writeUpgradeRejection(socket, error);
@@ -159,6 +281,11 @@ export async function startPreparedDesktopBridge(input, options = {}) {
         await closeServer(server, sockets);
         throw error;
     }
+    const freshnessMs = input.stateFreshnessMs ?? 5 * 60_000;
+    const heartbeat = statePath ? setInterval(() => {
+        void refreshDesktopBridgeState(statePath, state, new Date(), freshnessMs).catch(() => undefined);
+    }, Math.max(1_000, Math.floor(freshnessMs / 3))) : null;
+    heartbeat?.unref();
     let stopped = false;
     const handle = {
         server,
@@ -169,6 +296,8 @@ export async function startPreparedDesktopBridge(input, options = {}) {
             if (stopped)
                 return;
             stopped = true;
+            if (heartbeat)
+                clearInterval(heartbeat);
             await closeServer(server, sockets);
             if (statePath)
                 await removeDesktopBridgeStateIfOwned(statePath, state);

package/dist/core/codex-lb/desktop-bridge/state.js

@@ -3,85 +3,73 @@ import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { DESKTOP_BRIDGE_STATE_SCHEMA, DesktopBridgeError } from './types.js';
+const DEFAULT_FRESHNESS_MS = 5 * 60_000;
 export function desktopBridgeStatePath(home = os.homedir()) {
-    return path.join(home, '.codex', 'sks', 'codex-lb-desktop-bridge.json');
-}
-export function sha256Hex(value) {
-    return createHash('sha256').update(value).digest('hex');
+    return path.join(home, '.codex', 'sks', 'desktop-bridge-state.json');
 }
+export function sha256Hex(value) { return createHash('sha256').update(value).digest('hex'); }
 export function desktopBridgeListenOrigin(config) {
-    const host = config.listenHost === '::1' ? '[::1]' : config.listenHost;
-    return `http://${host}:${config.listenPort}`;
+    return `http://${config.listenHost === '::1' ? '[::1]' : config.listenHost}:${config.listenPort}`;
 }
 export function desktopBridgeConfigGeneration(config) {
-    const stable = JSON.stringify({
-        listenHost: config.listenHost,
-        listenPort: config.listenPort,
-        providerMode: config.providerMode || 'codex-lb',
-        allowedModels: [...(config.allowedModels || [])].sort(),
-        providerPolicy: config.providerPolicy || null,
-        credentialReadiness: config.credentialReadiness || null,
-        childPolicy: config.childPolicy || null,
-        sessionPins: [...(config.sessionPins || [])].sort((left, right) => left.session_id.localeCompare(right.session_id)),
-        requireSessionPin: config.requireSessionPin === true,
-        remoteBaseUrl: new URL(config.remoteBaseUrl).toString().replace(/\/$/, ''),
-        gatewayAuthTransport: config.gatewayAuthTransport,
-        allowedPathPrefixes: [...config.allowedPathPrefixes],
-        allowedOrigins: [...config.allowedOrigins],
-        connectTimeoutMs: config.connectTimeoutMs,
-        idleTimeoutMs: config.idleTimeoutMs,
-    });
-    return sha256Hex(stable);
+    const registry = config.providerRegistry;
+    return sha256Hex(JSON.stringify({
+        listen_host: config.listenHost, listen_port: config.listenPort,
+        provider_registry_generation: registry.generation,
+        provider_credential_generations: Object.fromEntries(Object.keys(registry.providers).map((id) => [id, registry.providers[id].credential_generation])),
+        route_policy_generation: config.routePolicy.policy_generation,
+        catalog_generation: config.routePolicy.catalog_generation,
+        client_capability_sha256: config.clientCapabilitySha256,
+        allowed_paths: [...config.allowedPathPrefixes], allowed_origins: [...config.allowedOrigins].sort(),
+        connect_timeout_ms: config.connectTimeoutMs, idle_timeout_ms: config.idleTimeoutMs,
+    }));
 }
 export function createDesktopBridgePublicState(config, options = {}) {
-    const listenOrigin = desktopBridgeListenOrigin(config);
-    const remote = new URL(config.remoteBaseUrl);
-    const providerMode = config.providerMode || 'codex-lb';
-    const allowedModels = [...(config.allowedModels || [])].sort();
+    const now = options.now ?? new Date();
+    const registry = config.providerRegistry;
+    const enabled = Object.keys(registry.providers).filter((id) => registry.providers[id].enabled);
+    const credentialGenerations = Object.fromEntries(Object.keys(registry.providers).map((id) => [id, registry.providers[id].credential_generation]));
+    const listen = desktopBridgeListenOrigin(config);
     return {
-        schema: DESKTOP_BRIDGE_STATE_SCHEMA,
-        pid: options.pid ?? process.pid,
-        started_at: (options.now ?? new Date()).toISOString(),
-        listen_origin: listenOrigin,
-        codex_base_url: providerMode === 'openrouter'
-            ? `${listenOrigin}/api/v1`
-            : `${listenOrigin}/backend-api/codex`,
-        provider_mode: providerMode,
-        allowed_models_sha256: sha256Hex(JSON.stringify(allowedModels)),
-        ...(config.providerPolicy ? { provider_policy_sha256: sha256Hex(JSON.stringify(config.providerPolicy)) } : {}),
-        ...(config.childPolicy ? { child_policy_sha256: sha256Hex(JSON.stringify(config.childPolicy)) } : {}),
-        session_pin_enforcement: config.requireSessionPin === true ? 'required' : 'compatibility',
-        remote_origin_sha256: sha256Hex(remote.origin),
-        gateway_auth_transport: config.gatewayAuthTransport,
-        config_generation: desktopBridgeConfigGeneration(config),
+        schema: DESKTOP_BRIDGE_STATE_SCHEMA, runtime: 'desktop-bridge', pid: options.pid ?? process.pid,
+        started_at: now.toISOString(), updated_at: now.toISOString(),
+        stale_after: new Date(now.getTime() + (config.stateFreshnessMs ?? DEFAULT_FRESHNESS_MS)).toISOString(),
+        listen_origin: listen, codex_base_url: `${listen}/backend-api/codex`, process_generation: randomUUID(),
+        provider_registry_generation: registry.generation, route_policy_generation: config.routePolicy.policy_generation,
+        catalog_generation: config.routePolicy.catalog_generation, enabled_providers: enabled,
+        provider_credential_generations: credentialGenerations, last_verified_probe_ids: [], config_generation: desktopBridgeConfigGeneration(config),
     };
 }
+function isGeneration(value) { return typeof value === 'string' && value.length > 0 && value.length <= 256 && !/[\r\n\0]/.test(value); }
 export function isDesktopBridgePublicState(value) {
     if (!value || typeof value !== 'object')
         return false;
     const row = value;
-    return row.schema === DESKTOP_BRIDGE_STATE_SCHEMA
-        && Number.isInteger(row.pid)
-        && Number(row.pid) > 0
-        && typeof row.started_at === 'string'
-        && Number.isFinite(Date.parse(row.started_at))
-        && typeof row.listen_origin === 'string'
-        && /^http:\/\/(?:127\.0\.0\.1|\[::1\]):\d+$/.test(row.listen_origin)
-        && typeof row.codex_base_url === 'string'
-        && (row.provider_mode === 'codex-lb' || row.provider_mode === 'openrouter')
-        && row.codex_base_url === (row.provider_mode === 'openrouter'
-            ? `${row.listen_origin}/api/v1`
-            : `${row.listen_origin}/backend-api/codex`)
-        && typeof row.allowed_models_sha256 === 'string'
-        && /^[a-f0-9]{64}$/.test(row.allowed_models_sha256)
-        && (row.provider_policy_sha256 === undefined || typeof row.provider_policy_sha256 === 'string' && /^[a-f0-9]{64}$/.test(row.provider_policy_sha256))
-        && (row.child_policy_sha256 === undefined || typeof row.child_policy_sha256 === 'string' && /^[a-f0-9]{64}$/.test(row.child_policy_sha256))
-        && (row.session_pin_enforcement === undefined || row.session_pin_enforcement === 'required' || row.session_pin_enforcement === 'compatibility')
-        && typeof row.remote_origin_sha256 === 'string'
-        && /^[a-f0-9]{64}$/.test(row.remote_origin_sha256)
-        && (row.gateway_auth_transport === 'x-codex-lb-api-key' || row.gateway_auth_transport === 'authorization-bearer-compat')
-        && typeof row.config_generation === 'string'
-        && /^[a-f0-9]{64}$/.test(row.config_generation);
+    if (/"(?:api_?key|secret|authorization|cookie|access_token|refresh_token)"\s*:/i.test(JSON.stringify(row)))
+        return false;
+    const dates = ['started_at', 'updated_at', 'stale_after'].every((key) => typeof row[key] === 'string' && Number.isFinite(Date.parse(String(row[key]))));
+    const credentialRows = row.provider_credential_generations;
+    return row.schema === DESKTOP_BRIDGE_STATE_SCHEMA && row.runtime === 'desktop-bridge' && Number.isInteger(row.pid) && Number(row.pid) > 0 && dates
+        && typeof row.listen_origin === 'string' && /^http:\/\/(?:127\.0\.0\.1|\[::1\]):\d+$/.test(row.listen_origin)
+        && row.codex_base_url === `${row.listen_origin}/backend-api/codex` && isGeneration(row.process_generation)
+        && isGeneration(row.provider_registry_generation) && isGeneration(row.route_policy_generation) && isGeneration(row.catalog_generation)
+        && Array.isArray(row.enabled_providers) && row.enabled_providers.every((id) => id === 'codex-lb' || id === 'openrouter')
+        && !!credentialRows && typeof credentialRows === 'object' && isGeneration(credentialRows['codex-lb']) && isGeneration(credentialRows.openrouter)
+        && Array.isArray(row.last_verified_probe_ids) && row.last_verified_probe_ids.every(isGeneration)
+        && typeof row.config_generation === 'string' && /^[a-f0-9]{64}$/.test(row.config_generation);
+}
+export async function refreshDesktopBridgeState(file, state, now = new Date(), freshnessMs = DEFAULT_FRESHNESS_MS) {
+    const current = await readDesktopBridgeState(file).catch(() => null);
+    if (!current || current.schema !== DESKTOP_BRIDGE_STATE_SCHEMA || current.pid !== state.pid
+        || current.process_generation !== state.process_generation || current.config_generation !== state.config_generation)
+        return false;
+    state.updated_at = now.toISOString();
+    state.stale_after = new Date(now.getTime() + freshnessMs).toISOString();
+    await writeDesktopBridgeState(file, state);
+    return true;
+}
+export function isDesktopBridgeStateFresh(state, now = new Date()) {
+    return Date.parse(state.stale_after) > now.getTime();
 }
 export async function writeDesktopBridgeState(file, state) {
     if (!isDesktopBridgePublicState(state))
@@ -109,7 +97,7 @@ export async function readDesktopBridgeState(file) {
             return null;
         throw error;
     }
-    if (!stat.isFile())
+    if (!stat.isFile() || stat.isSymbolicLink())
         throw new DesktopBridgeError('bridge_state_not_file');
     if ((stat.mode & 0o077) !== 0)
         throw new DesktopBridgeError('bridge_state_permissions_unsafe');
@@ -131,9 +119,7 @@ export async function removeDesktopBridgeStateIfOwned(file, expected) {
     const current = await readDesktopBridgeState(file).catch(() => null);
     if (!current || current.pid !== expected.pid || current.config_generation !== expected.config_generation)
         return false;
-    await fsp.unlink(file).catch((error) => {
-        if (error.code !== 'ENOENT')
-            throw error;
-    });
+    await fsp.unlink(file).catch((error) => { if (error.code !== 'ENOENT')
+        throw error; });
     return true;
 }

package/dist/core/codex-lb/desktop-bridge/types.js

@@ -1,4 +1,9 @@
-export const DESKTOP_BRIDGE_STATE_SCHEMA = 'sks.codex-lb-desktop-bridge.v1';
+export const DESKTOP_BRIDGE_STATE_SCHEMA = 'sks.desktop-bridge-state.v2';
+export const DESKTOP_BRIDGE_REGISTRY_SCHEMA = 'sks.desktop-bridge-provider-registry.v1';
+export const DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH = '/__sks/diagnostics/health';
+export const DESKTOP_BRIDGE_DIAGNOSTIC_PATH = '/__sks/diagnostics/websocket';
+export const DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL = 'sks.desktop-bridge.probe.v2';
+export const DESKTOP_BRIDGE_CLIENT_PATH_PREFIX = '/__sks/client';
 export const DESKTOP_BRIDGE_ALLOWED_PATH_PREFIXES = [
     '/backend-api/codex/',
     '/backend-api/files',