The round-3 C1 fix added `server.on("connect", ...)` to satisfy plan 11 §4.6's
text. R4 architectural review confirmed the handler is essentially dead code
on port 443: `https.Server` runs the HTTP parser ABOVE TLS, so a
`server.on("connect")` handler only fires for CONNECT-tunneled-inside-TLS
(HTTPS-proxy-tunneled-in-TLS), not for the "no config required" AgentBridge
DNS-spoof flow where the IDE opens TLS directly to 127.0.0.1:443. Passthrough
for unmapped hosts is structurally handled elsewhere (DNS scoping for default
mode; httpProxyServer.ts:8080 for System-wide proxy mode). Genuine on-wire
bypass-without-decrypt at :443 under direct TLS would require SNI sniffing on
the raw 'connection' event — intentionally out of scope for this release.
This commit:
- adds a block comment above the CONNECT handler explaining the real scope
so future contributors don't assume it covers the primary AgentBridge flow
- guards the `connection` listener with `socket.__mitmCounted` so the
CONNECT "target" branch's `server.emit("connection", clientSocket)`
re-entry doesn't double-increment `stats.activeConnections`
- adds 2 source-grep regression tests asserting both the doc comment and
the guard remain in place
C2 (x-omniroute-source/agent headers) was already correct and is unchanged.
Cover the new CJS routing primitives and the bypass-JSON manager write
path so the C1/C2 contracts cannot regress silently.
- `mitm-server-connect.test.ts` (27 tests): exercises the
`_internal/bypass.cjs` shim used by `server.cjs`:
- DEFAULT_BYPASS_PATTERNS shape (≥4 regexes, all RegExp)
- Default bank / gov / okta / auth0 → bypass
- Bypass beats target match (precedence)
- Known target hostname → target
- Unknown hostname → passthrough
- User glob pattern → bypass
- Empty / undefined hostname → passthrough
- Set-vs-Array shape for targetHosts
- Case-insensitive hostname matching
- bypassGlobMatch wildcard semantics + ReDoS-safe linear walk
- parseBypassJson with valid / empty / malformed / wrong-shape inputs
- Spec assertions on server.cjs source — header injection (C2),
sanitizeErrorMessage wrapping (Hard Rule #12), and CONNECT handler
registration (C1). These three guard against future regressions
that would silently re-introduce the bugs the C1/C2 fixes closed.
- `mitm-manager-bypass-json.test.ts` (5 tests): exercises
`writeBypassJson()`:
- Creates the `mitm/` dir + valid JSON file shape
- Empty array roundtrips as empty patterns
- Falls back to `getUserBypassPatterns()` when no arg passed
- Default patterns from the DB are NOT written to the file
- Overwrites prior content
