refactor(proxy): export the Node adapter from the main entry point

.fallowrc.json

@@ -16,7 +16,6 @@
     "src/sdk/finders.ts",
     "src/ai-sdk/index.ts",
     "packages/proxy/src/index.ts",
-    "packages/proxy/src/node.ts",
     "packages/proxy/tsdown.config.ts",
     "src/bin.ts",
     "src/client/companion-tunnel.ts",
@@ -280,7 +279,7 @@
     },
     {
       "comment": "Published package surfaces (see each package.json#exports); consumers may be external or reach them through workspace package exports Fallow does not follow.",
-      "file": "{src/sdk/*.ts,src/ai-sdk/index.ts,packages/proxy/src/index.ts,packages/proxy/src/node.ts}",
+      "file": "{src/sdk/*.ts,src/ai-sdk/index.ts,packages/proxy/src/index.ts}",
       "exports": ["*"]
     },
     {

packages/proxy/README.md

@@ -25,7 +25,7 @@ different RPC protocol version, before any command runs.
 ## Serve the proxy over HTTP
 
 ```ts
-import { createDaemonProxyServer } from '@agent-device/proxy/node';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 
 const server = createDaemonProxyServer({
   upstreamBaseUrl: 'http://127.0.0.1:4310',

packages/proxy/package.json

@@ -19,10 +19,6 @@
       "types": "./src/index.ts",
       "default": "./src/index.ts"
     },
-    "./node": {
-      "types": "./src/node.ts",
-      "default": "./src/node.ts"
-    },
     "./package.json": "./package.json"
   },
   "files": [
@@ -43,10 +39,6 @@
         "types": "./dist/index.d.mts",
         "import": "./dist/index.mjs"
       },
-      "./node": {
-        "types": "./dist/node.d.mts",
-        "import": "./dist/node.mjs"
-      },
       "./package.json": "./package.json"
     }
   }

packages/proxy/src/daemon-proxy.ts

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import http from 'node:http';
 import { AppError, normalizeError } from '@agent-device/kernel/errors';
 import { timingSafeStringEqual } from '@agent-device/host-kit/transport';
 import {
@@ -86,6 +87,21 @@ export function createDaemonProxy(options: DaemonProxyOptions): DaemonProxy {
   };
 }
 
+export function createDaemonProxyServer(options: DaemonProxyOptions): http.Server {
+  return http.createServer(createDaemonProxyRequestListener(createDaemonProxy(options)));
+}
+
+/** Serves a proxy from any `node:http` or `node:https` server; upload tickets follow its scheme. */
+export function createDaemonProxyRequestListener(proxy: DaemonProxy): http.RequestListener {
+  return (req, res) => {
+    void import('./node-http.ts')
+      .then(({ serveProxyRequest }) => serveProxyRequest(proxy, req, res))
+      .catch((error: unknown) => {
+        if (!res.destroyed) res.destroy(error instanceof Error ? error : undefined);
+      });
+  };
+}
+
 async function handleProxyRequest(
   request: Request,
   options: NormalizedProxyOptions,

packages/proxy/src/index.ts

@@ -1,5 +1,7 @@
 export {
   createDaemonProxy,
+  createDaemonProxyRequestListener,
+  createDaemonProxyServer,
   type DaemonProxy,
   type DaemonProxyOptions,
   type DaemonProxyUpstreamFetch,

packages/proxy/src/node-http.test.ts

@@ -1,21 +1,26 @@
 import { EventEmitter } from 'node:events';
-import type { IncomingMessage, ServerResponse } from 'node:http';
+import http, { type IncomingMessage, type ServerResponse } from 'node:http';
+import type { AddressInfo } from 'node:net';
 import { Socket } from 'node:net';
 import { Readable } from 'node:stream';
 import { TLSSocket } from 'node:tls';
 import { expect, test } from 'vitest';
 import type { DaemonProxy } from './daemon-proxy.ts';
-import { createDaemonProxyRequestListener } from './node-http.ts';
+import { serveProxyRequest } from './node-http.ts';
 
 async function serveThroughListener(
   socket: Socket,
   host: string,
-): Promise<{ seenUrl: string | null; status: number }> {
+  { responseClosed = false } = {},
+): Promise<{ seenUrl: string | null; clientGone: boolean; status: number; ended: boolean }> {
   let seenUrl: string | null = null;
+  let clientGone = false;
+  let ended = false;
   const proxy: DaemonProxy = {
     instanceId: 'test',
     handle: async (request) => {
       seenUrl = request.url;
+      clientGone = request.signal.aborted;
       return new Response(null, { status: 204 });
     },
   };
@@ -29,15 +34,14 @@ async function serveThroughListener(
     statusCode: 200,
     writableFinished: false,
     destroyed: false,
+    closed: responseClosed,
     setHeader: () => {},
-    end: () => {},
-  });
-  const ended = new Promise<void>((resolve) => {
-    res.end = () => resolve();
+    end: () => {
+      ended = true;
+    },
   });
-  createDaemonProxyRequestListener(proxy)(req, res as unknown as ServerResponse);
-  await ended;
-  return { seenUrl, status: res.statusCode };
+  await serveProxyRequest(proxy, req, res as unknown as ServerResponse);
+  return { seenUrl, clientGone, status: res.statusCode, ended };
 }
 
 test('requests arriving over TLS reach the proxy with an https URL', async () => {
@@ -52,5 +56,44 @@ test('plain requests reach the proxy with an http URL', async () => {
 
 test('a Host header that cannot form a URL is answered with 400 instead of a dropped socket', async () => {
   const served = await serveThroughListener(new Socket(), 'gateway example');
-  expect(served).toEqual({ seenUrl: null, status: 400 });
+  expect(served).toMatchObject({ seenUrl: null, status: 400, ended: true });
+});
+
+test('a URL carrying credentials is answered with 400 instead of a dropped socket', async () => {
+  const served = await serveThroughListener(new Socket(), 'user:secret@gateway.example.test');
+  expect(served).toMatchObject({ seenUrl: null, status: 400, ended: true });
+});
+
+test('a client gone before the adapter loads reaches the proxy as an aborted request', async () => {
+  const served = await serveThroughListener(new Socket(), 'gateway.example.test', {
+    responseClosed: true,
+  });
+  expect(served.clientGone).toBe(true);
+});
+
+test('a method Fetch refuses is answered with 404 instead of a dropped socket', async () => {
+  const proxy: DaemonProxy = {
+    instanceId: 'test',
+    handle: async () => new Response(null, { status: 204 }),
+  };
+  const server = http.createServer((req, res) => void serveProxyRequest(proxy, req, res));
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  try {
+    const { port } = server.address() as AddressInfo;
+    const status = await new Promise<number | undefined>((resolve, reject) => {
+      http
+        .request(
+          { port, host: '127.0.0.1', method: 'TRACE', path: '/agent-device/health' },
+          (res) => {
+            res.resume();
+            resolve(res.statusCode);
+          },
+        )
+        .on('error', reject)
+        .end();
+    });
+    expect(status).toBe(404);
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
 });

packages/proxy/src/node-http.ts

@@ -1,34 +1,25 @@
-import http, { type IncomingMessage, type ServerResponse } from 'node:http';
+import type { IncomingMessage, ServerResponse } from 'node:http';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { TLSSocket } from 'node:tls';
-import { createDaemonProxy, type DaemonProxy, type DaemonProxyOptions } from './daemon-proxy.ts';
+import type { DaemonProxy } from './daemon-proxy.ts';
 
-export function createDaemonProxyServer(options: DaemonProxyOptions): http.Server {
-  return http.createServer(createDaemonProxyRequestListener(createDaemonProxy(options)));
-}
-
-/** Serves a proxy from any `node:http` or `node:https` server; upload tickets follow its scheme. */
-export function createDaemonProxyRequestListener(proxy: DaemonProxy): http.RequestListener {
-  return (req, res) => {
-    void serveProxyRequest(proxy, req, res).catch((error: unknown) => {
-      if (!res.destroyed) res.destroy(error instanceof Error ? error : undefined);
-    });
-  };
-}
-
-async function serveProxyRequest(
+export async function serveProxyRequest(
   proxy: DaemonProxy,
   req: IncomingMessage,
   res: ServerResponse,
 ): Promise<void> {
-  const request = toWebRequest(req, res);
-  if (!request) {
-    res.statusCode = 400;
-    res.end();
+  // Fetch refuses TRACE. node:http rejects TRACK and routes CONNECT to the 'connect' event.
+  if (req.method === 'TRACE') {
+    endWithStatus(res, 404);
     return;
   }
-  const response = await proxy.handle(request);
+  const url = requestUrl(req);
+  if (!url) {
+    endWithStatus(res, 400);
+    return;
+  }
+  const response = await proxy.handle(toWebRequest(url, req, res));
   res.statusCode = response.status;
   for (const [name, value] of response.headers) res.setHeader(name, value);
   if (!response.body) {
@@ -38,11 +29,20 @@ async function serveProxyRequest(
   await pipeline(Readable.fromWeb(response.body as Parameters<typeof Readable.fromWeb>[0]), res);
 }
 
-/** `null` when the Host header and path do not form a URL. */
-function toWebRequest(req: IncomingMessage, res: ServerResponse): Request | null {
+function endWithStatus(res: ServerResponse, status: number): void {
+  res.statusCode = status;
+  res.end();
+}
+
+/** `null` when the Host header and path do not form a URL that Fetch accepts. */
+function requestUrl(req: IncomingMessage): URL | null {
   const scheme = req.socket instanceof TLSSocket ? 'https' : 'http';
   const url = URL.parse(req.url ?? '/', `${scheme}://${req.headers.host ?? '127.0.0.1'}`);
-  if (!url) return null;
+  if (!url || url.username || url.password) return null;
+  return url;
+}
+
+function toWebRequest(url: URL, req: IncomingMessage, res: ServerResponse): Request {
   const method = req.method ?? 'GET';
   const hasBody = method !== 'GET' && method !== 'HEAD';
   return new Request(url, {
@@ -72,5 +72,6 @@ function clientGoneSignal(req: IncomingMessage, res: ServerResponse): AbortSigna
   };
   req.on('aborted', abortIfResponseIncomplete);
   res.on('close', abortIfResponseIncomplete);
+  if (res.closed) abortIfResponseIncomplete();
   return clientGone.signal;
 }

packages/proxy/tsdown.config.ts

@@ -6,7 +6,7 @@ const { default: getTypeScript7ExePath } = await import(
 );
 
 export default defineConfig({
-  entry: { index: 'src/index.ts', node: 'src/node.ts' },
+  entry: { index: 'src/index.ts' },
   outDir: 'dist',
   format: 'esm',
   platform: 'node',

src/__tests__/daemon-proxy.test.ts

@@ -2,7 +2,7 @@ import { test } from 'vitest';
 import assert from 'node:assert/strict';
 import crypto from 'node:crypto';
 import http from 'node:http';
-import { createDaemonProxyServer } from '@agent-device/proxy/node';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 import { createDaemonHttpServer } from '../daemon/server/http-server.ts';
 import { getRequestSignal } from '@agent-device/host-kit/request';
 import { readHostCpuArch } from '@agent-device/host-kit/process';

src/cli/commands/proxy.ts

@@ -1,5 +1,5 @@
 import { randomBytes } from 'node:crypto';
-import { createDaemonProxyServer } from '@agent-device/proxy/node';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 import { buildDaemonHttpBaseUrl } from '@agent-device/contracts/daemon-http';
 import {
   ensureDaemon,

src/daemon-client/__tests__/daemon-client-transport.test.ts

@@ -21,7 +21,7 @@ import {
   sendRequest,
 } from '../daemon-client-transport.ts';
 import { resolveDaemonPaths } from '../../daemon-resolution.ts';
-import { createDaemonProxyServer } from '@agent-device/proxy/node';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 import {
   closeLoopbackServer,
   listenOnLoopback,

test/integration/provider-scenarios/remote-daemon-client.test.ts

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { test } from 'vitest';
 import { createAgentDeviceClient } from '../../../src/agent-device-client.ts';
 import { prepareRemoteRequestArtifacts } from '../../../src/remote/daemon-artifacts.ts';
-import { createDaemonProxyServer } from '@agent-device/proxy/node';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 import { normalizeAgentDeviceError } from '@agent-device/kernel/errors';
 import {
   closeLoopbackServer,

test/integration/provider-scenarios/remote-proxy-artifact-tenant.test.ts

@@ -12,7 +12,7 @@ import { finalizeDaemonResponse } from '../../../src/daemon/request-finalization
 import { createDaemonHttpServer } from '../../../src/daemon/server/http-server.ts';
 import { normalizeAgentDeviceError } from '@agent-device/kernel/errors';
 import { downloadRemoteArtifact } from '../../../src/remote/daemon-artifacts.ts';
-import { createDaemonProxyServer } from '@agent-device/proxy/node';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 import {
   closeLoopbackServer,
   listenOnLoopback,

test/integration/provider-scenarios/remote-proxy-parity.test.ts

@@ -9,7 +9,7 @@ import { LeaseRegistry } from '../../../src/daemon/lease-registry.ts';
 import { createDaemonHttpServer } from '../../../src/daemon/server/http-server.ts';
 import { resolveSessionRequestLogPath } from '../../../src/daemon/session-artifact-paths.ts';
 import type { DaemonRequest, DaemonResponse } from '../../../src/daemon/daemon-request.ts';
-import { createDaemonProxyServer } from '@agent-device/proxy/node';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 import { AppError, type DaemonError } from '@agent-device/kernel/errors';
 import {
   closeLoopbackServer,

test/integration/provider-scenarios/remote-proxy-request-diagnostics.test.ts

@@ -16,7 +16,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { test } from 'vitest';
 import { createDaemonHttpServer } from '../../../src/daemon/server/http-server.ts';
-import { createDaemonProxyServer } from '@agent-device/proxy/node';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 import { localizeRemoteDaemonError } from '../../../src/remote/remote-request-diagnostics.ts';
 import { resolveSessionRequestLogPath } from '../../../src/daemon/session-artifact-paths.ts';
 import { safeSessionName } from '@agent-device/host-kit/session-paths';