mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-01 21:02:12 +03:00
bcfc87f31b
Bring `src/mitm/server.cjs` into compliance with the AgentBridge MITM contract (master plan §3.5 / §12 acceptance #16). Prior to this commit the bypass/passthrough logic existed in TS (`src/mitm/passthrough.ts`, `src/mitm/targets/index.ts::routeConnection`, `src/lib/db/agentBridgeBypass.ts`) but was completely disconnected from the running CJS proxy. Changes: - Add `server.on("connect", ...)` so HTTPS proxy clients can still tunnel to non-AgentBridge hosts without losing internet. Per host the handler decides: - bypass (default regex or user glob) → raw TCP pipe, NO TLS decrypt, NO content logging (privacy: bypass = "never see content") - target (in TARGET_HOSTS) → write 200 Connection Established and emit `connection` so the existing `https.createServer` decrypts and routes via the normal flow - passthrough (anything else) → raw TCP pipe - Introduce `src/mitm/_internal/bypass.cjs` shim that mirrors `DEFAULT_BYPASS_PATTERNS` and `routeConnection` from the TS source. Defaults stay hardcoded (banks, gov, okta, auth0); user patterns load from `<DATA_DIR>/mitm/bypass.json` (written by manager — separate commit). - Add a CJS port of `sanitizeErrorMessage` and wire it into the intercept error path so HTTP/SSE error bodies never expose raw `err.message`. Closes a pre-existing Hard Rule #12 violation in the file. Defaults match `src/mitm/passthrough.ts::DEFAULT_BYPASS_PATTERNS` and `shouldBypass` precedence is identical to `routeConnection`. Antigravity non-regression preserved — known hosts still trigger TLS termination via the existing request handler.