apt-audit.js scans EVERY file in apt.conf.d for Acquire::*::Proxy, classifying:
- creds: embedded userinfo (plaintext leak + stale-cred hammering risk)
- overrides: sorts after 80proxy-bridge so apt last-wins REPLACES the bridge URL
- external: points at a non-bridge proxy
Installer Legacy section alerts + fixes (backup kept: *.disabled-by-proxy-bridge).
New 'install.js doctor [--fix]': audits apt, bashrc, snap, service drop-ins,
service state, keyring presence; exit 1 when issues found.
Update semantics: deploy writes .installed-from (git commit + file hashes);
runtime JSONs are never created if present and never overwritten; tests prove
3 consecutive installs leave runtime state byte-identical. Downgrade protection
comes from the visible marker + diff reporting, never silent clobbering.
Tests: 6 audit + 2 installer (update-semantics, doctor) — suite now 23/23.
- askConfirm short-circuits non-interactively in --dry-run (prints what would be asked)
- systemd node resolution order: existing unit's pinned binary > newest nvm node >
PATH lookup excluding hermes-agent runtimes > process.execPath. On the live box
this keeps the unit byte-identical (true idempotency for the service section).
After 3 consecutive 407s within 120s (defaults; env-tunable), the bridge stops
sending Proxy-Authorization to that upstream for 300s, then retries once with
refreshed keyring creds. A successful request clears the failure state. Requests
during the lockout fail fast with the upstream's 407 instead of retrying stale
credentials — the exact pattern that locks accounts.
Tests: 407-stub lockout engages on 4th attempt; success mid-stream resets the
counter (re-lock needs a fresh 3); missing creds never send an auth header.
Harness: awaitProxyResponse() decouples client-side settle from server FIN
timing (previous once(end) pattern wedged under node --test).
- parseProxyConfig handles PAC 'HTTPS host:port' (tls.connect + CONNECT inside TLS) in
both the CONNECT and plain-HTTP handlers — ports live fix d8b9db2 into the repo
- CONNECT: split tunnel establishment into establishDirect / sendConnectToProxy,
removing the duplicate DIRECT 'connect' listener that raced onUpstreamData
- env-overridable PROFILE_FILE / REMOTES_FILE / PAC_DIR (test hermeticity)
- tests: +DIRECT echo exactly-once, +HTTPS upstream via local PAC dir + self-signed
TLS stub (no internet needed); 8/8 pass
Add a hot-reloaded override table (overrides.json) that forces specific
hosts/IPs to a chosen profile regardless of the active profile, applied
across all bridge ports. Matching supports exact host, wildcard, domain
suffix, single IP, and CIDR. Managed via `proxy-bridge override
list|add|remove|clear` and surfaced in status/config.
Also fix two PAC sandbox helpers: localHostOrDomainIs (unqualified-host
case) and isInNet (was a no-op stub, now does real IPv4 subnet matching).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Removed hardcoded corporate proxy URL from all scripts.
- Updated bridge.js to load configuration from /opt/proxy-bridge/config.json.
- Updated setup.js to interactively configure upstream proxy and credentials.
- Enhanced install_proxy.sh to automatically configure APT, Bash, and system services.
- Purged sensitive URL from git history and verified zero leakage.
Queries lmstudio and ollama /v1/models endpoints to keep opencode.json
model entries up to date, preserving manual overrides.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move legacy systemscripts into scripts/display and scripts/setup.
Rehome stray top-level tools into their domain folders.
Archive narrow experiments and outdated codegrab leftovers.
Remove empty legacy directories and stale root files.
Expand macOS metadata ignores and update the README with the refined repository structure.
tke