import{i as e}from"./chunk-DR8-3Aex.js";import{s as t,u as n}from"./envUtils-BWeoiL4Y.js";import{G as r,Q as i,U as a,Z as o,l as s,p as c}from"./debug-otxXY3j-.js";import{c as l,g as u,h as d,l as f,u as p}from"./proxy-CF7ZDxaW.js";import{homedir as m}from"os";import{join as h}from"path";import{mkdir as g,readFile as _,unlink as v,writeFile as y}from"fs/promises";import{createServer as b}from"node:net";t(),o(),a(),s(),u(),p();var x,S=512*1024,C=3e4;function w(e){let t=e.length,n=[],r=t;for(;r>127;)n.push(r&127|128),r>>>=7;n.push(r);let i=new Uint8Array(1+n.length+t);return i[0]=10,i.set(n,1),i.set(e,1+n.length),i}function T(e){if(e.length===0)return new Uint8Array;if(e[0]!==10)return null;let t=0,n=0,r=1;for(;r<e.length;){let i=e[r];if(t|=(i&127)<<n,r++,!(i&128))break;if(n+=7,n>28)return null}return r+t>e.length?null:e.subarray(r,r+t)}function E(){return{connectBuf:Buffer.alloc(0),pending:[],wsOpen:!1,established:!1,closed:!1}}async function D(e){let t=`Basic `+Buffer.from(`${e.sessionId}:${e.token}`).toString(`base64`),n=`Bearer ${e.token}`,r=typeof Bun<`u`?O(e.wsUrl,t,n):await k(e.wsUrl,t,n);return c(`[upstreamproxy] relay listening on 127.0.0.1:${r.port}`),r}function O(e,t,n){let r=Bun.listen({hostname:`127.0.0.1`,port:0,socket:{open(e){e.data={...E(),writeBuf:[]}},data(r,i){let a=r.data;A({write:e=>{let t=typeof e==`string`?Buffer.from(e,`utf8`):e;if(a.writeBuf.length>0){a.writeBuf.push(t);return}let n=r.write(t);n<t.length&&a.writeBuf.push(t.subarray(n))},end:()=>r.end()},a,i,e,t,n)},drain(e){let t=e.data;for(;t.writeBuf.length>0;){let n=t.writeBuf[0],r=e.write(n);if(r<n.length){t.writeBuf[0]=n.subarray(r);return}t.writeBuf.shift()}},close(e){P(e.data)},error(e,t){c(`[upstreamproxy] client socket error: ${t.message}`),P(e.data)}}});return{port:r.port,stop:()=>r.stop(!0)}}async function k(e,t,n){x=(await import(`./wrapper-BSK0MCQH.js`)).default;let r=new WeakMap,i=b(i=>{let a=E();r.set(i,a);let o={write:e=>{i.write(typeof e==`string`?e:Buffer.from(e))},end:()=>i.end()};i.on(`data`,r=>A(o,a,r,e,t,n)),i.on(`close`,()=>P(r.get(i))),i.on(`error`,e=>{c(`[upstreamproxy] client socket error: ${e.message}`),P(r.get(i))})});return new Promise((e,t)=>{i.once(`error`,t),i.listen(0,`127.0.0.1`,()=>{let n=i.address();if(n===null||typeof n==`string`){t(Error(`upstreamproxy: server has no TCP address`));return}e({port:n.port,stop:()=>i.close()})})})}function A(e,t,n,r,i,a){if(!t.ws){t.connectBuf=Buffer.concat([t.connectBuf,n]);let o=t.connectBuf.indexOf(`\r
\r
`);if(o===-1){t.connectBuf.length>8192&&(e.write(`HTTP/1.1 400 Bad Request\r
\r
`),e.end());return}let s=t.connectBuf.subarray(0,o).toString(`utf8`).split(`\r
`)[0]??``;if(!s.match(/^CONNECT\s+(\S+)\s+HTTP\/1\.[01]$/i)){e.write(`HTTP/1.1 405 Method Not Allowed\r
\r
`),e.end();return}let c=t.connectBuf.subarray(o+4);c.length>0&&t.pending.push(Buffer.from(c)),t.connectBuf=Buffer.alloc(0),j(e,t,s,r,i,a);return}if(!t.wsOpen){t.pending.push(Buffer.from(n));return}N(t.ws,n)}function j(e,t,n,r,i,a){let o={"Content-Type":`application/proto`,Authorization:a},s;s=x?new x(r,{headers:o,agent:l(r),...d()}):new globalThis.WebSocket(r,{headers:o,proxy:f(r),tls:d()||void 0}),s.binaryType=`arraybuffer`,t.ws=s,s.onopen=()=>{let e=`${n}\r\nProxy-Authorization: ${i}\r\n\r\n`;s.send(w(new Uint8Array(Buffer.from(e,`utf8`)))),t.wsOpen=!0;for(let e of t.pending)N(s,e);t.pending=[],t.pinger=setInterval(M,C,s)},s.onmessage=n=>{let r=T(n.data instanceof ArrayBuffer?new Uint8Array(n.data):new Uint8Array(Buffer.from(n.data)));r&&r.length>0&&(t.established=!0,e.write(r))},s.onerror=n=>{c(`[upstreamproxy] ws error: ${`message`in n?String(n.message):`websocket error`}`),!t.closed&&(t.closed=!0,t.established||e.write(`HTTP/1.1 502 Bad Gateway\r
\r
`),e.end(),P(t))},s.onclose=()=>{t.closed||(t.closed=!0,e.end(),P(t))}}function M(e){e.readyState===WebSocket.OPEN&&e.send(w(new Uint8Array))}function N(e,t){if(e.readyState===WebSocket.OPEN)for(let n=0;n<t.length;n+=S){let r=new Uint8Array(t.subarray(n,n+S));e.send(w(r))}}function P(e){if(e){if(e.pinger&&clearInterval(e.pinger),e.ws&&e.ws.readyState<=WebSocket.OPEN)try{e.ws.close()}catch{}e.ws=void 0}}s();var F=`/etc/ssl/certs/ca-certificates.crt`,I=[`localhost`,`127.0.0.1`,`::1`,`169.254.0.0/16`,`10.0.0.0/8`,`172.16.0.0/12`,`192.168.0.0/16`,`anthropic.com`,`.anthropic.com`,`*.anthropic.com`,`github.com`,`api.github.com`,`*.github.com`,`*.githubusercontent.com`,`registry.npmjs.org`,`pypi.org`,`files.pythonhosted.org`,`index.crates.io`,`proxy.golang.org`].join(`,`),L={enabled:!1};async function R(e){if(!n(process.env.CLAUDE_CODE_REMOTE)||!n(process.env.CCR_UPSTREAM_PROXY_ENABLED))return L;let t=process.env.CLAUDE_CODE_REMOTE_SESSION_ID;if(!t)return c(`[upstreamproxy] CLAUDE_CODE_REMOTE_SESSION_ID unset; proxy disabled`,{level:`warn`}),L;let r=e?.tokenPath??`/run/ccr/session_token`,a=await B(r);if(!a)return c(`[upstreamproxy] no session token file; proxy disabled`),L;V();let o=e?.ccrBaseUrl??process.env.ANTHROPIC_BASE_URL??`https://api.anthropic.com`,s=e?.caBundlePath??h(m(),`.ccr`,`ca-bundle.crt`);if(!await H(o,e?.systemCaPath??F,s))return L;try{let e=await D({wsUrl:o.replace(/^http/,`ws`)+`/v1/code/upstreamproxy/ws`,sessionId:t,token:a});i(async()=>e.stop()),L={enabled:!0,port:e.port,caBundlePath:s},c(`[upstreamproxy] enabled on 127.0.0.1:${e.port}`),await v(r).catch(()=>{c(`[upstreamproxy] token file unlink failed`,{level:`warn`})})}catch(e){c(`[upstreamproxy] relay start failed: ${e instanceof Error?e.message:String(e)}; proxy disabled`,{level:`warn`})}return L}function z(){if(!L.enabled||!L.port||!L.caBundlePath){if(process.env.HTTPS_PROXY&&process.env.SSL_CERT_FILE){let e={};for(let t of[`HTTPS_PROXY`,`https_proxy`,`NO_PROXY`,`no_proxy`,`SSL_CERT_FILE`,`NODE_EXTRA_CA_CERTS`,`REQUESTS_CA_BUNDLE`,`CURL_CA_BUNDLE`])process.env[t]&&(e[t]=process.env[t]);return e}return{}}let e=`http://127.0.0.1:${L.port}`;return{HTTPS_PROXY:e,https_proxy:e,NO_PROXY:I,no_proxy:I,SSL_CERT_FILE:L.caBundlePath,NODE_EXTRA_CA_CERTS:L.caBundlePath,REQUESTS_CA_BUNDLE:L.caBundlePath,CURL_CA_BUNDLE:L.caBundlePath}}async function B(e){try{return(await _(e,`utf8`)).trim()||null}catch(e){return r(e)||c(`[upstreamproxy] token read failed: ${e instanceof Error?e.message:String(e)}`,{level:`warn`}),null}}function V(){if(!(process.platform!==`linux`||typeof Bun>`u`))try{e(`bun:ffi`).dlopen(`libc.so.6`,{prctl:{args:[`int`,`u64`,`u64`,`u64`,`u64`],returns:`int`}}).symbols.prctl(4,0n,0n,0n,0n)!==0&&c(`[upstreamproxy] prctl(PR_SET_DUMPABLE,0) returned nonzero`,{level:`warn`})}catch(e){c(`[upstreamproxy] prctl unavailable: ${e instanceof Error?e.message:String(e)}`,{level:`warn`})}}async function H(e,t,n){try{let r=await fetch(`${e}/v1/code/upstreamproxy/ca-cert`,{signal:AbortSignal.timeout(5e3)});if(!r.ok)return c(`[upstreamproxy] ca-cert fetch ${r.status}; proxy disabled`,{level:`warn`}),!1;let i=await r.text(),a=await _(t,`utf8`).catch(()=>``);return await g(h(n,`..`),{recursive:!0}),await y(n,a+`
`+i,`utf8`),!0}catch(e){return c(`[upstreamproxy] ca-cert download failed: ${e instanceof Error?e.message:String(e)}; proxy disabled`,{level:`warn`}),!1}}export{z as getUpstreamProxyEnv,R as initUpstreamProxy};