import{F3 as I,I3 as f,P3 as E,Q3 as _,V3 as v}from"./cli-0.5.4-9e7rkd8e.mjs";import"./cli-0.5.4-hambpq58.mjs";import"./cli-0.5.4-j7kkqxv6.mjs";import"./cli-0.5.4-qrwczx7j.mjs";import"./cli-0.5.4-v2z6p9td.mjs";import{kca as H,nca as d}from"./cli-0.5.4-cbq01zg3.mjs";import"./cli-0.5.4-37v5fhf1.mjs";import"./cli-0.5.4-7grzwf6q.mjs";import"./cli-0.5.4-9qmek5dq.mjs";import"./cli-0.5.4-9c6r1fjg.mjs";import"./cli-0.5.4-2dw33ms6.mjs";import"./cli-0.5.4-x1fzfxmm.mjs";import"./cli-0.5.4-e822fzaq.mjs";import"./cli-0.5.4-09dvrzcr.mjs";import{Pfa as M,Sfa as N,cfa as P,efa as u}from"./cli-0.5.4-end8wj9r.mjs";import"./cli-0.5.4-4x206j04.mjs";import{cga as W,mga as i}from"./cli-0.5.4-yd3rd9qt.mjs";import{Iga as S,Nga as c}from"./cli-0.5.4-sgcaw17t.mjs";import"./cli-0.5.4-jmc3bzbn.mjs";import"./cli-0.5.4-959vxhhb.mjs";import{_ma as L}from"./cli-0.5.4-aacw1src.mjs";d();u();N();i();c();import{mkdir as l,readFile as C,unlink as n,writeFile as r}from"fs/promises";import{homedir as o}from"os";import{join as U}from"path";N();f();v();import{createServer as y}from"node:net";var R,m=524288,b=30000;function O(q){let z=q.length,Q=[],J=z;while(J>127)Q.push(J&127|128),J>>>=7;Q.push(J);let Z=new Uint8Array(1+Q.length+z);return Z[0]=10,Z.set(Q,1),Z.set(q,1+Q.length),Z}function w(q){if(q.length===0)return new Uint8Array(0);if(q[0]!==10)return null;let z=0,Q=0,J=1;while(J<q.length){let Z=q[J];if(z|=(Z&127)<<Q,J++,(Z&128)===0)break;if(Q+=7,Q>28)return null}if(J+z>q.length)return null;return q.subarray(J,J+z)}function j(){return{connectBuf:Buffer.alloc(0),pending:[],wsOpen:!1,established:!1,closed:!1}}async function A(q){let z="Basic "+Buffer.from(`${q.sessionId}:${q.token}`).toString("base64"),Q=`Bearer ${q.token}`,J=typeof Bun<"u"?h(q.wsUrl,z,Q):await p(q.wsUrl,z,Q);return M(`[upstreamproxy] relay listening on 127.0.0.1:${J.port}`),J}function h(q,z,Q){let J=Bun.listen({hostname:"127.0.0.1",port:0,socket:{open(Z){Z.data={...j(),writeBuf:[]}},data(Z,G){let V=Z.data;T({write:($)=>{let Y=typeof $==="string"?Buffer.from($,"utf8"):$;if(V.writeBuf.length>0){V.writeBuf.push(Y);return}let x=Z.write(Y);if(x<Y.length)V.writeBuf.push(Y.subarray(x))},end:()=>Z.end()},V,G,q,z,Q)},drain(Z){let G=Z.data;while(G.writeBuf.length>0){let V=G.writeBuf[0],K=Z.write(V);if(K<V.length){G.writeBuf[0]=V.subarray(K);return}G.writeBuf.shift()}},close(Z){B(Z.data)},error(Z,G){M(`[upstreamproxy] client socket error: ${G.message}`),B(Z.data)}}});return{port:J.port,stop:()=>J.stop(!0)}}async function p(q,z,Q){R=(await import("./wrapper-0.5.4-yv1ed0cm.mjs")).default;let J=new WeakMap,Z=y((G)=>{let V=j();J.set(G,V);let K={write:($)=>{G.write(typeof $==="string"?$:Buffer.from($))},end:()=>G.end()};G.on("data",($)=>T(K,V,$,q,z,Q)),G.on("close",()=>B(J.get(G))),G.on("error",($)=>{M(`[upstreamproxy] client socket error: ${$.message}`),B(J.get(G))})});return new Promise((G,V)=>{Z.once("error",V),Z.listen(0,"127.0.0.1",()=>{let K=Z.address();if(K===null||typeof K==="string"){V(Error("upstreamproxy: server has no TCP address"));return}G({port:K.port,stop:()=>Z.close()})})})}function T(q,z,Q,J,Z,G){if(!z.ws){z.connectBuf=Buffer.concat([z.connectBuf,Q]);let V=z.connectBuf.indexOf(`\r
\r
`);if(V===-1){if(z.connectBuf.length>8192)q.write(`HTTP/1.1 400 Bad Request\r
\r
`),q.end();return}let $=z.connectBuf.subarray(0,V).toString("utf8").split(`\r
`)[0]??"";if(!$.match(/^CONNECT\s+(\S+)\s+HTTP\/1\.[01]$/i)){q.write(`HTTP/1.1 405 Method Not Allowed\r
\r
`),q.end();return}let x=z.connectBuf.subarray(V+4);if(x.length>0)z.pending.push(Buffer.from(x));z.connectBuf=Buffer.alloc(0),k(q,z,$,J,Z,G);return}if(!z.wsOpen){z.pending.push(Buffer.from(Q));return}F(z.ws,Q)}function k(q,z,Q,J,Z,G){let V={"Content-Type":"application/proto",Authorization:G},K;if(R)K=new R(J,{headers:V,agent:E(J),...I()});else K=new globalThis.WebSocket(J,{headers:V,proxy:_(J),tls:I()||void 0});K.binaryType="arraybuffer",z.ws=K,K.onopen=()=>{let $=`${Q}\r
Proxy-Authorization: ${Z}\r
\r
`;K.send(O(Buffer.from($,"utf8"))),z.wsOpen=!0;for(let Y of z.pending)F(K,Y);z.pending=[],z.pinger=setInterval(g,b,K)},K.onmessage=($)=>{let Y=$.data instanceof ArrayBuffer?new Uint8Array($.data):new Uint8Array(Buffer.from($.data)),x=w(Y);if(x&&x.length>0)z.established=!0,q.write(x)},K.onerror=($)=>{let Y="message"in $?String($.message):"websocket error";if(M(`[upstreamproxy] ws error: ${Y}`),z.closed)return;if(z.closed=!0,!z.established)q.write(`HTTP/1.1 502 Bad Gateway\r
\r
`);q.end(),B(z)},K.onclose=()=>{if(z.closed)return;z.closed=!0,q.end(),B(z)}}function g(q){if(q.readyState===WebSocket.OPEN)q.send(O(new Uint8Array(0)))}function F(q,z){if(q.readyState!==WebSocket.OPEN)return;for(let Q=0;Q<z.length;Q+=m){let J=z.subarray(Q,Q+m);q.send(O(J))}}function B(q){if(!q)return;if(q.pinger)clearInterval(q.pinger);if(q.ws&&q.ws.readyState<=WebSocket.OPEN)try{q.ws.close()}catch{}q.ws=void 0}var a="/run/ccr/session_token",e="/etc/ssl/certs/ca-certificates.crt",D=["localhost","127.0.0.1","::1","169.254.0.0/16","10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","anthropic.com",".anthropic.com","*.anthropic.com","github.com","api.github.com","*.github.com","*.githubusercontent.com","registry.npmjs.org","pypi.org","files.pythonhosted.org","index.crates.io","proxy.golang.org"].join(","),X={enabled:!1};async function Oq(q){if(!W(process.env.CLAUDE_CODE_REMOTE))return X;if(!W(process.env.CCR_UPSTREAM_PROXY_ENABLED))return X;let z=process.env.CLAUDE_CODE_REMOTE_SESSION_ID;if(!z)return M("[upstreamproxy] CLAUDE_CODE_REMOTE_SESSION_ID unset; proxy disabled",{level:"warn"}),X;let Q=q?.tokenPath??a,J=await s(Q);if(!J)return M("[upstreamproxy] no session token file; proxy disabled"),X;qq();let Z=H(),G=q?.ccrBaseUrl??(Z?.transport==="anthropic"?Z.baseUrl:void 0)??"https://api.anthropic.com",V=q?.caBundlePath??U(o(),".ccr","ca-bundle.crt");if(!await zq(G,q?.systemCaPath??e,V))return X;try{let $=G.replace(/^http/,"ws")+"/v1/code/upstreamproxy/ws",Y=await A({wsUrl:$,sessionId:z,token:J});P(async()=>Y.stop()),X={enabled:!0,port:Y.port,caBundlePath:V},M(`[upstreamproxy] enabled on 127.0.0.1:${Y.port}`),await n(Q).catch(()=>{M("[upstreamproxy] token file unlink failed",{level:"warn"})})}catch($){M(`[upstreamproxy] relay start failed: ${$ instanceof Error?$.message:String($)}; proxy disabled`,{level:"warn"})}return X}function Wq(){if(!X.enabled||!X.port||!X.caBundlePath){if(process.env.HTTPS_PROXY&&process.env.SSL_CERT_FILE){let z={};for(let Q of["HTTPS_PROXY","https_proxy","NO_PROXY","no_proxy","SSL_CERT_FILE","NODE_EXTRA_CA_CERTS","REQUESTS_CA_BUNDLE","CURL_CA_BUNDLE"])if(process.env[Q])z[Q]=process.env[Q];return z}return{}}let q=`http://127.0.0.1:${X.port}`;return{HTTPS_PROXY:q,https_proxy:q,NO_PROXY:D,no_proxy:D,SSL_CERT_FILE:X.caBundlePath,NODE_EXTRA_CA_CERTS:X.caBundlePath,REQUESTS_CA_BUNDLE:X.caBundlePath,CURL_CA_BUNDLE:X.caBundlePath}}function mq(){X={enabled:!1}}function t(q){if(!q||!q.trim())return!1;return/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g.test(q)}async function s(q){try{return(await C(q,"utf8")).trim()||null}catch(z){if(S(z))return null;return M(`[upstreamproxy] token read failed: ${z instanceof Error?z.message:String(z)}`,{level:"warn"}),null}}function qq(){if(process.platform!=="linux"||typeof Bun>"u")return;try{let z=L("bun:ffi").dlopen("libc.so.6",{prctl:{args:["int","u64","u64","u64","u64"],returns:"int"}}),Q=4;if(z.symbols.prctl(4,0n,0n,0n,0n)!==0)M("[upstreamproxy] prctl(PR_SET_DUMPABLE,0) returned nonzero",{level:"warn"})}catch(q){M(`[upstreamproxy] prctl unavailable: ${q instanceof Error?q.message:String(q)}`,{level:"warn"})}}async function zq(q,z,Q){try{let J=await fetch(`${q}/v1/code/upstreamproxy/ca-cert`,{signal:AbortSignal.timeout(5000)});if(!J.ok)return M(`[upstreamproxy] ca-cert fetch ${J.status}; proxy disabled`,{level:"warn"}),!1;let Z=await J.text();if(!t(Z))return M("[upstreamproxy] ca-cert response is not valid PEM; proxy disabled",{level:"warn"}),!1;let G=await C(z,"utf8").catch(()=>"");return await l(U(Q,".."),{recursive:!0}),await r(Q,G+`
`+Z,"utf8"),!0}catch(J){return M(`[upstreamproxy] ca-cert download failed: ${J instanceof Error?J.message:String(J)}; proxy disabled`,{level:"warn"}),!1}}export{mq as resetUpstreamProxyForTests,t as isValidPemContent,Oq as initUpstreamProxy,Wq as getUpstreamProxyEnv,a as SESSION_TOKEN_PATH};
