After 3 consecutive 407s within 120s (defaults; env-tunable), the bridge stops
sending Proxy-Authorization to that upstream for 300s, then retries once with
refreshed keyring creds. A successful request clears the failure state. Requests
during the lockout fail fast with the upstream's 407 instead of retrying stale
credentials — the exact pattern that locks accounts.
Tests: 407-stub lockout engages on 4th attempt; success mid-stream resets the
counter (re-lock needs a fresh 3); missing creds never send an auth header.
Harness: awaitProxyResponse() decouples client-side settle from server FIN
timing (previous once(end) pattern wedged under node --test).
- parseProxyConfig handles PAC 'HTTPS host:port' (tls.connect + CONNECT inside TLS) in
both the CONNECT and plain-HTTP handlers — ports live fix d8b9db2 into the repo
- CONNECT: split tunnel establishment into establishDirect / sendConnectToProxy,
removing the duplicate DIRECT 'connect' listener that raced onUpstreamData
- env-overridable PROFILE_FILE / REMOTES_FILE / PAC_DIR (test hermeticity)
- tests: +DIRECT echo exactly-once, +HTTPS upstream via local PAC dir + self-signed
TLS stub (no internet needed); 8/8 pass
- Removed hardcoded corporate proxy URL from all scripts.
- Updated bridge.js to load configuration from /opt/proxy-bridge/config.json.
- Updated setup.js to interactively configure upstream proxy and credentials.
- Enhanced install_proxy.sh to automatically configure APT, Bash, and system services.
- Purged sensitive URL from git history and verified zero leakage.
- Add 32 new tool and dockerfile entries to README.md catalog.
- Increase 'what' shortlist limit to 100 for better search recall.
- Update 'what' default model to gemma4 and improve robust JSON parsing.
Add dockerpullsave.py - a Python utility that downloads Docker images
directly from registries and saves them as tar archives without requiring
Docker daemon to be running.
Features:
- Supports multiple registries (Docker Hub, GHCR, ECR, private registries)
- Handles authentication via bearer tokens and registry discovery
- Multi-architecture manifest list support (defaults to linux/amd64)
- Robust digest-based image selection for consistent pulls
- Progress bar for large layer downloads with Docker-style formatting
- Proper Docker image structure generation for 'docker load' compatibility
Usage examples:
./dockerpullsave.py ubuntu:latest
./dockerpullsave.py ghcr.io/oras-project/oras:v1.1.0
./dockerpullsave.py alpine@sha256:f271e74b17ced...
Output: Creates {image}_{tag}.tar file ready for 'docker load -i'
This tool is particularly useful for:
- Air-gapped environments where Docker daemon cannot access registries
- Batch image downloading and offline distribution
- Registry migration and backup scenarios
- Security scanning workflows requiring image inspection
imphash : generates a Virustotal compatible IMPHASH for a binary
ltop : does 'sort|uniq -c' but with live update in ncurses
smtpbanner : grabs smtp banner
uniq : like uniq but does not need sorting.
uniqrs : same as uniq but written in Rust
tke