Something went wrong. Try again.
source dump of claude code forked from oppi.li/claude-code
Something went wrong. Try again.
4.7 kB · 179 lines
TypeScript
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180import type * as https from 'https'import { Agent as HttpsAgent } from 'https'import memoize from 'lodash-es/memoize.js'import type * as tls from 'tls'import type * as undici from 'undici'import { getCACertificates } from './caCerts.js'import { logForDebugging } from './debug.js'import { getFsImplementation } from './fsOperations.js'
export type MTLSConfig = { cert?: string key?: string passphrase?: string}
export type TLSConfig = MTLSConfig & { ca?: string | string[] | Buffer}
/** * Get mTLS configuration from environment variables */export const getMTLSConfig = memoize((): MTLSConfig | undefined => { const config: MTLSConfig = {}
// Note: NODE_EXTRA_CA_CERTS is automatically handled by Node.js at runtime // We don't need to manually load it - Node.js appends it to the built-in CAs automatically
// Client certificate if (process.env.CLAUDE_CODE_CLIENT_CERT) { try { config.cert = getFsImplementation().readFileSync( process.env.CLAUDE_CODE_CLIENT_CERT, { encoding: 'utf8' }, ) logForDebugging( 'mTLS: Loaded client certificate from CLAUDE_CODE_CLIENT_CERT', ) } catch (error) { logForDebugging(`mTLS: Failed to load client certificate: ${error}`, { level: 'error', }) } }
// Client key if (process.env.CLAUDE_CODE_CLIENT_KEY) { try { config.key = getFsImplementation().readFileSync( process.env.CLAUDE_CODE_CLIENT_KEY, { encoding: 'utf8' }, ) logForDebugging('mTLS: Loaded client key from CLAUDE_CODE_CLIENT_KEY') } catch (error) { logForDebugging(`mTLS: Failed to load client key: ${error}`, { level: 'error', }) } }
// Key passphrase if (process.env.CLAUDE_CODE_CLIENT_KEY_PASSPHRASE) { config.passphrase = process.env.CLAUDE_CODE_CLIENT_KEY_PASSPHRASE logForDebugging('mTLS: Using client key passphrase') }
// Only return config if at least one option is set if (Object.keys(config).length === 0) { return undefined }
return config})
/** * Create an HTTPS agent with mTLS configuration */export const getMTLSAgent = memoize((): HttpsAgent | undefined => { const mtlsConfig = getMTLSConfig() const caCerts = getCACertificates()
if (!mtlsConfig && !caCerts) { return undefined }
const agentOptions: https.AgentOptions = { ...mtlsConfig, ...(caCerts && { ca: caCerts }), // Enable keep-alive for better performance keepAlive: true, }
logForDebugging('mTLS: Creating HTTPS agent with custom certificates') return new HttpsAgent(agentOptions)})
/** * Get TLS options for WebSocket connections */export function getWebSocketTLSOptions(): tls.ConnectionOptions | undefined { const mtlsConfig = getMTLSConfig() const caCerts = getCACertificates()
if (!mtlsConfig && !caCerts) { return undefined }
return { ...mtlsConfig, ...(caCerts && { ca: caCerts }), }}
/** * Get fetch options with TLS configuration (mTLS + CA certs) for undici */export function getTLSFetchOptions(): { tls?: TLSConfig dispatcher?: undici.Dispatcher} { const mtlsConfig = getMTLSConfig() const caCerts = getCACertificates()
if (!mtlsConfig && !caCerts) { return {} }
const tlsConfig: TLSConfig = { ...mtlsConfig, ...(caCerts && { ca: caCerts }), }
if (typeof Bun !== 'undefined') { return { tls: tlsConfig } } logForDebugging('TLS: Created undici agent with custom certificates') // Create a custom undici Agent with TLS options. Lazy-required so that // the ~1.5MB undici package is only loaded when mTLS/CA certs are configured. // eslint-disable-next-line @typescript-eslint/no-require-imports const undiciMod = require('undici') as typeof undici const agent = new undiciMod.Agent({ connect: { cert: tlsConfig.cert, key: tlsConfig.key, passphrase: tlsConfig.passphrase, ...(tlsConfig.ca && { ca: tlsConfig.ca }), }, pipelining: 1, })
return { dispatcher: agent }}
/** * Clear the mTLS configuration cache. */export function clearMTLSCache(): void { getMTLSConfig.cache.clear?.() getMTLSAgent.cache.clear?.() logForDebugging('Cleared mTLS configuration cache')}
/** * Configure global Node.js TLS settings */export function configureGlobalMTLS(): void { const mtlsConfig = getMTLSConfig()
if (!mtlsConfig) { return }
// NODE_EXTRA_CA_CERTS is automatically handled by Node.js at runtime if (process.env.NODE_EXTRA_CA_CERTS) { logForDebugging( 'NODE_EXTRA_CA_CERTS detected - Node.js will automatically append to built-in CAs', ) }}