- RiskNoticeBanner: use lazy useState initializer for localStorage read
instead of useEffect + setState
- ModelSelectorModal: move fetch logic to useCallback, call from useEffect
to avoid setState directly in effect body
Add ~90 i18n keys under agentBridge.* namespace (server card, agent list,
agent card, setup wizard, model mapping, bypass list, upstream CA, empty
state, risk banner, sidebar title/subtitle) in en.json and pt-BR.json.
Other 39 locales get EN fallback automatically (D17).
12 REST routes under /api/tools/agent-bridge/ covering all AgentBridge
backend surfaces: server lifecycle, per-agent state/DNS/mappings/detect,
cert status/download/regenerate, bypass pattern CRUD, upstream CA config.
All routes use Zod validation and route errors through sanitizeErrorMessage.
feat(authz): mark agent-bridge LOCAL_ONLY + SPAWN_CAPABLE (F5)
Adds /api/tools/agent-bridge/ to both LOCAL_ONLY_API_PREFIXES and
SPAWN_CAPABLE_PREFIXES in routeGuard.ts — satisfying Hard Rules #15 + #17.
- mitm-handler-base: hookBufferStart returns InterceptedRequest with
sanitized headers, extractSourceModel parses body.model, writeError
emits JSON with sanitized message (Hard Rule #12).
- mitm-handler-<id>: nine per-agent happy-path tests (antigravity,
kiro, copilot, codex, cursor, zed, claude-code, open-code) exercise
full intercept() with mocked fetch via _mitmHandlerHarness.ts;
asserts mapped model is forwarded and AgentBridge correlation
headers are present. Trae test confirms intercept() rejects with a
structured error.
- mitm-targets-resolve: ALL_TARGETS contains 9 entries; resolveTarget
is case-insensitive and returns null for unknown hosts.
- mitm-targets-route: bypass > target > passthrough precedence
validated against representative hostnames.
- mitm-detection: DETECTORS covers every AgentId; detectAgent never
throws and returns DetectionResult-shaped objects for all probes.
Two additions to src/mitm/manager.ts:
1. writeTargetsJson(targets?) — persists the static ALL_TARGETS
registry to <DATA_DIR>/mitm/targets.json. server.cjs reads this
file at boot and extends its baseline TARGET_HOSTS set so the
full AgentBridge target catalog is intercepted alongside the
historical antigravity hosts.
2. getAllAgentsStatus() — read-only aggregate of every registered
target plus its current installation detection result, used by
the AgentBridge dashboard.
startMitm() now invokes writeTargetsJson() before any DNS/cert work;
write failures are logged but never block startup.
server.cjs now reads <DATA_DIR>/mitm/targets.json at startup and
adds the listed hostnames to TARGET_HOSTS. The antigravity baseline
remains hard-coded so existing installs continue to work even if
targets.json is missing or malformed (loader catches all errors and
returns 0).
All additions are marked with // T-A-F3: comments to make the
forward-port-only changes easy to audit.
Filesystem-only installation probes for antigravity, kiro, copilot,
codex, cursor, zed, claude-code, and open-code. detectAgent(id)
dispatcher returns {installed, path?} without ever spawning a shell
or interpolating runtime paths (Hard Rule #13).
Trae has no detector — its entry in the dispatch table returns
{installed: false} until upstream viability is confirmed.
ALL_TARGETS aggregates the nine MitmTarget descriptors in canonical
order. resolveTarget(hostname) does a case-insensitive exact-match
lookup against each target.hosts list. routeConnection(hostname,
userBypass) returns {kind: bypass|target|passthrough} per plan 11
§4.6 precedence: default+user bypass > known target host > passthrough.
Implements MitmHandlerBase abstract class with shared concerns
(request body capture, secret masking, router forwarding, SSE
piping, Traffic Inspector hooks via dynamic import) plus concrete
handlers for antigravity, kiro, copilot, codex, cursor, zed,
claude-code, open-code, and trae (stub for investigating viability).
Each concrete handler maps request body model field to a configured
target, forwards to OmniRoute router, and pipes back SSE.
Targets antigravity and kiro updated to the new MitmTarget shape
while preserving legacy MITM_PROFILE export aliases.
