[Init] Initial commit - NetMesh terminal manager

electron/bridges/httpNetworkProxyAgent.cjs

@@ -0,0 +1,154 @@
+/**
+ * Build a Node http(s) Agent for outbound requests based on current
+ * app-level proxy settings. Used by AI providerHandlers / streamRequest.
+ *
+ * Prefer Electron session.resolveProxy so "system" mode works on Windows
+ * (where Node does not read the OS proxy by itself).
+ */
+
+"use strict";
+
+const { URL } = require("node:url");
+
+let HttpsProxyAgent;
+let HttpProxyAgent;
+let SocksProxyAgent;
+
+function loadAgents() {
+  if (!HttpsProxyAgent) {
+    ({ HttpsProxyAgent } = require("https-proxy-agent"));
+  }
+  if (!HttpProxyAgent) {
+    ({ HttpProxyAgent } = require("http-proxy-agent"));
+  }
+  if (!SocksProxyAgent) {
+    try {
+      ({ SocksProxyAgent } = require("socks-proxy-agent"));
+    } catch {
+      SocksProxyAgent = null;
+    }
+  }
+}
+
+function createAgentFromProxyUrl(proxyUrl, targetIsHttps, options = {}) {
+  loadAgents();
+  const trimmed = String(proxyUrl || "").trim();
+  if (!trimmed) return undefined;
+
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return undefined;
+  }
+
+  // Do not pass rejectUnauthorized into the proxy-agent constructor: that option
+  // weakens TLS to the *proxy hop*. allowInsecure / skipTLS only applies to the
+  // tunneled target via applyInsecureTargetTls below.
+  const protocol = parsed.protocol.toLowerCase();
+  let agent;
+  if (protocol === "socks:" || protocol === "socks5:" || protocol === "socks4:") {
+    if (!SocksProxyAgent) return undefined;
+    agent = new SocksProxyAgent(trimmed);
+  } else if (targetIsHttps) {
+    agent = new HttpsProxyAgent(trimmed);
+  } else {
+    agent = new HttpProxyAgent(trimmed);
+  }
+
+  // https-proxy-agent / socks-proxy-agent apply constructor rejectUnauthorized to
+  // the proxy hop, not the tunneled target TLS upgrade. When callers need
+  // allowInsecure for self-signed *targets*, force it on the connect opts.
+  if (options.rejectUnauthorized === false && targetIsHttps) {
+    applyInsecureTargetTls(agent);
+  }
+
+  return agent;
+}
+
+/**
+ * Force rejectUnauthorized:false onto the tunneled target TLS upgrade.
+ * Constructor options alone only affect the proxy hop.
+ */
+function applyInsecureTargetTls(agent) {
+  if (!agent || typeof agent.connect !== "function") return agent;
+  const originalConnect = agent.connect.bind(agent);
+  agent.connect = (req, opts) =>
+    originalConnect(req, { ...opts, rejectUnauthorized: false });
+  return agent;
+}
+
+/**
+ * Parse Chromium resolveProxy result, e.g. "PROXY 127.0.0.1:7890" / "SOCKS5 host:1080" / "DIRECT".
+ */
+function proxyInfoFromResolveResult(result) {
+  const text = String(result || "").trim();
+  if (!text || /^DIRECT\b/i.test(text)) return null;
+
+  // Take the first directive only.
+  const first = text.split(";")[0].trim();
+  const match = first.match(/^(PROXY|HTTPS|HTTP|SOCKS5|SOCKS4|SOCKS)\s+(.+)$/i);
+  if (!match) return null;
+
+  const kind = match[1].toUpperCase();
+  const endpoint = match[2].trim();
+  if (kind.startsWith("SOCKS")) {
+    const scheme = kind === "SOCKS4" ? "socks4" : "socks5";
+    return `${scheme}://${endpoint}`;
+  }
+  if (kind === "HTTPS") {
+    return `https://${endpoint}`;
+  }
+  return `http://${endpoint}`;
+}
+
+/**
+ * @param {string} targetUrl
+ * @param {{ session?: Electron.Session, settings?: { mode: string, url: string } }} [deps]
+ * @returns {Promise<import('node:http').Agent | undefined>}
+ */
+async function resolveOutboundHttpAgent(targetUrl, deps = {}) {
+  const {
+    getCurrentProxySettings,
+  } = require("./httpNetworkProxyBridge.cjs");
+
+  const settings = deps.settings || getCurrentProxySettings();
+  if (!settings || settings.mode === "direct") return undefined;
+
+  let targetIsHttps = true;
+  try {
+    targetIsHttps = new URL(targetUrl).protocol === "https:";
+  } catch {
+    // keep https default
+  }
+
+  const agentOptions = {};
+  if (deps.rejectUnauthorized === false) {
+    agentOptions.rejectUnauthorized = false;
+  }
+
+  const session = deps.session || null;
+  if (session?.resolveProxy) {
+    try {
+      const resolved = await session.resolveProxy(targetUrl);
+      const proxyUrl = proxyInfoFromResolveResult(resolved);
+      if (!proxyUrl) return undefined;
+      return createAgentFromProxyUrl(proxyUrl, targetIsHttps, agentOptions);
+    } catch {
+      // fall through to custom URL
+    }
+  }
+
+  if (settings.mode === "custom" && settings.url) {
+    return createAgentFromProxyUrl(settings.url, targetIsHttps, agentOptions);
+  }
+
+  return undefined;
+}
+
+module.exports = {
+  createAgentFromProxyUrl,
+  applyInsecureTargetTls,
+  proxyInfoFromResolveResult,
+  resolveOutboundHttpAgent,
+};