[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_168":169,"_170":171},"routes/_app.x.$handle.$name",{"_94":93,"_32":45,"_103":84,"_27":36,"_13":14,"_104":-5,"_11":105,"_106":107,"_108":109,"_110":111,"_112":113,"_20":-5,"_114":-5,"_115":-5,"_116":25,"_117":118,"_119":120,"_121":-5,"_122":-5,"_123":124},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":36,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":77,"_78":79,"_80":81,"_82":25},"version",7,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","exit_node.ts","latestPath","fileId","68bff842-539c-11f1-90ec-ee650bb23af1","name","fileType","script","content","","// mhrv-rs exit node — deploy as an HTTP endpoint on any serverless\n// TypeScript host with a public IP that isn't a Google datacenter\n// (Deno Deploy, fly.io, your own VPS, etc.). Uses only web-standard\n// `Request` / `Response` / `fetch` so it's portable across runtimes.\n//\n// Purpose: chain client → Apps Script → this exit node → destination.\n// Apps Script's UrlFetchApp can't reach Cloudflare-protected sites that\n// flag Google datacenter IPs as bots (chatgpt.com, claude.ai, grok.com,\n// many other CF-fronted SaaS). This exit node sits between Apps Script\n// and the destination; the destination sees the exit node's outbound IP\n// (generally not flagged as Google datacenter) and accepts the request.\n//\n// Setup:\n// 1. Pick a host that runs web-standard fetch handlers (e.g. Deno\n// Deploy, fly.io with a thin server wrapper, or any cheap VPS\n// running Deno / Node + this script as a handler).\n// 2. Paste the contents of this file as the request handler.\n// 3. Set PSK below to a strong secret (`openssl rand -hex 32` from\n// a terminal — DO NOT leave the placeholder in production).\n// 4. Deploy and copy the public URL of the deployed handler.\n// 5. In mhrv-rs config.json, add:\n// \"exit_node\": {\n// \"enabled\": true,\n// \"relay_url\": \"https://your-deployed-exit-node.example.com\",\n// \"psk\": \"\",\n// \"mode\": \"selective\",\n// \"hosts\": [\"chatgpt.com\", \"claude.ai\", \"x.com\", \"grok.com\"]\n// }\n//\n// Threat model: PSK is the only thing keeping this from being an open\n// proxy on the public internet. Treat it like a password: do not commit\n// to source control, do not share publicly, rotate if leaked. The exit\n// node refuses all requests that don't carry the matching PSK.\n//\n// Failure mode: if the exit node is unreachable, mhrv-rs falls back to\n// the regular Apps Script relay automatically — the only consequence\n// of an offline exit node is that ChatGPT/Claude/Grok stop working;\n// other sites are unaffected.\n\nconst PSK = \"CHANGE_ME_TO_A_STRONG_SECRET\";\n\n// Headers the client may send that must NOT be forwarded to the\n// destination — they're hop-by-hop or would break re-encoding.\nconst STRIP_HEADERS = new Set([\n \"host\",\n \"connection\",\n \"content-length\",\n \"transfer-encoding\",\n \"proxy-connection\",\n \"proxy-authorization\",\n \"x-forwarded-for\",\n \"x-forwarded-host\",\n \"x-forwarded-proto\",\n \"x-forwarded-port\",\n \"x-real-ip\",\n \"forwarded\",\n \"via\",\n]);\n\nfunction decodeBase64ToBytes(input: string): Uint8Array {\n const bin = atob(input);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nfunction encodeBytesToBase64(bytes: Uint8Array): string {\n let bin = \"\";\n for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);\n return btoa(bin);\n}\n\nfunction sanitizeHeaders(h: unknown): Record {\n const out: Record = {};\n if (!h || typeof h !== \"object\") return out;\n for (const [k, v] of Object.entries(h as Record)) {\n if (!k) continue;\n if (STRIP_HEADERS.has(k.toLowerCase())) continue;\n out[k] = String(v ?? \"\");\n }\n return out;\n}\n\nexport async function handleExitNodeRequest(req: Request): Promise {\n // Fail closed on the placeholder PSK so a fresh deploy without setup\n // can't accidentally serve as an open relay.\n if (PSK === \"CHANGE_ME_TO_A_STRONG_SECRET\") {\n return Response.json(\n {\n e: \"exit_node misconfigured: PSK is still the placeholder. Set \" +\n \"a strong secret in the source before deploying.\",\n },\n { status: 503 },\n );\n }\n\n try {\n if (req.method !== \"POST\") {\n return Response.json({ e: \"method_not_allowed\" }, { status: 405 });\n }\n\n const body = await req.json();\n if (!body || typeof body !== \"object\") {\n return Response.json({ e: \"bad_json\" }, { status: 400 });\n }\n\n const k = String((body as any).k ?? \"\");\n const u = String((body as any).u ?? \"\");\n const m = String((body as any).m ?? \"GET\").toUpperCase();\n const h = sanitizeHeaders((body as any).h);\n const b64 = (body as any).b;\n\n if (k !== PSK) {\n return Response.json({ e: \"unauthorized\" }, { status: 401 });\n }\n if (!/^https?:\\/\\//i.test(u)) {\n return Response.json({ e: \"bad url\" }, { status: 400 });\n }\n\n // Loop guard: if u points at this exit node's own host, refuse.\n // Without this, a misconfigured client could chain exit-node →\n // exit-node → exit-node → ... and burn the host's runtime budget.\n try {\n const reqUrl = new URL(req.url);\n const dstUrl = new URL(u);\n if (\n reqUrl.host === dstUrl.host &&\n reqUrl.protocol === dstUrl.protocol\n ) {\n return Response.json({ e: \"exit-node loop refused\" }, { status: 400 });\n }\n } catch {\n // Malformed URL — let the fetch below 400.\n }\n\n let payload: Uint8Array | undefined;\n if (typeof b64 === \"string\" && b64.length > 0) {\n payload = decodeBase64ToBytes(b64);\n }\n\n const resp = await fetch(u, {\n method: m,\n headers: h,\n body: payload,\n redirect: \"manual\",\n });\n\n // `fetch()` (Deno / Bun / Node) auto-decompresses gzip / br / deflate\n // responses, so `resp.arrayBuffer()` returns plain bytes — but the\n // destination's `Content-Encoding` header is still on `resp.headers`.\n // Forwarding it would tell the client browser \"this body is gzipped\"\n // when it isn't, producing `Content Encoding Error` (#964). Same goes\n // for `Content-Length` — the post-decompression byte count is\n // different from what the destination announced. Strip both. The\n // Apps Script + Rust transport layer below us re-frames the wire body\n // anyway, so neither header is meaningful to forward.\n const data = new Uint8Array(await resp.arrayBuffer());\n const respHeaders: Record = {};\n resp.headers.forEach((value, key) => {\n const lower = key.toLowerCase();\n if (lower === \"content-encoding\" || lower === \"content-length\") return;\n respHeaders[key] = value;\n });\n\n return Response.json({\n s: resp.status,\n h: respHeaders,\n b: encodeBytesToBase64(data),\n });\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n return Response.json({ e: message }, { status: 500 });\n }\n}\n\nexport default {\n fetch: handleExitNodeRequest,\n};","createdAt",["D",1779206714157],"branchVersion","branchId","b7518872-5392-11f1-a9df-ee650bb23af1","id","b750d85a-5392-11f1-a9df-ee650bb23af1","mhvr",["D",1779202503104],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","305706e8-b63a-4a62-9f83-b6a783fa2bb1","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019e40ba-bf7a-7223-a785-e55eb1e3aeaf","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_94":93,"_102":98},"org",{"_94":93,"_95":96,"_97":98,"_18":54,"_99":100,"_101":25},"branch",{"_13":83,"_32":84,"_43":42,"_85":44,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":45,"_92":93},"isOwned",9,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","saeedbarzegari","handle","displayName","Saeed barzegari","avatar","https://lh3.googleusercontent.com/a/ACg8ocKSjt-pf1MAW7docxcbML2Wtu6_VeyBZHKz_WcNlSOopxRZLQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":164,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":36,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":165,"_78":166,"_80":167,"_82":25},"tree",[155,156],"files",[155,156],"counts",{"_144":60,"_145":146,"_147":60,"_148":149,"_150":151},"contents",[125,126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":139,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_132":25,"_38":140,"_13":141,"_33":34,"_35":37,"_24":25,"_137":142,"_27":143},{"_43":127,"_32":128,"_30":129,"_130":-5,"_41":42,"_40":131,"_132":25,"_38":133,"_13":134,"_33":135,"_35":136,"_24":25,"_137":-5,"_27":138},"546db2ea-539b-11f1-82e4-ee650bb23af1","main.ts","b7541b8c-5392-11f1-a9df-ee650bb23af1","parentId",4,"latest",["D",1779206202649],3,"http","// mhrv-rs exit node — deploy as an HTTP endpoint on any serverless\n// TypeScript host with a public IP that isn't a Google datacenter\n// (Deno Deploy, fly.io, your own VPS, etc.). Uses only web-standard\n// `Request` / `Response` / `fetch` so it's portable across runtimes.\n//\n// Purpose: chain client → Apps Script → this exit node → destination.\n// Apps Script's UrlFetchApp can't reach Cloudflare-protected sites that\n// flag Google datacenter IPs as bots (chatgpt.com, claude.ai, grok.com,\n// many other CF-fronted SaaS). This exit node sits between Apps Script\n// and the destination; the destination sees the exit node's outbound IP\n// (generally not flagged as Google datacenter) and accepts the request.\n//\n// Setup:\n// 1. Pick a host that runs web-standard fetch handlers (e.g. Deno\n// Deploy, fly.io with a thin server wrapper, or any cheap VPS\n// running Deno / Node + this script as a handler).\n// 2. Paste the contents of this file as the request handler.\n// 3. Set PSK below to a strong secret (`openssl rand -hex 32` from\n// a terminal — DO NOT leave the placeholder in production).\n// 4. Deploy and copy the public URL of the deployed handler.\n// 5. In mhrv-rs config.json, add:\n// \"exit_node\": {\n// \"enabled\": true,\n// \"relay_url\": \"https://your-deployed-exit-node.example.com\",\n// \"psk\": \"\",\n// \"mode\": \"selective\",\n// \"hosts\": [\"chatgpt.com\", \"claude.ai\", \"x.com\", \"grok.com\"]\n// }\n//\n// Threat model: PSK is the only thing keeping this from being an open\n// proxy on the public internet. Treat it like a password: do not commit\n// to source control, do not share publicly, rotate if leaked. The exit\n// node refuses all requests that don't carry the matching PSK.\n//\n// Failure mode: if the exit node is unreachable, mhrv-rs falls back to\n// the regular Apps Script relay automatically — the only consequence\n// of an offline exit node is that ChatGPT/Claude/Grok stop working;\n// other sites are unaffected.\n\nconst PSK = \"Ss@32440899\";\n\n// Headers the client may send that must NOT be forwarded to the\n// destination — they're hop-by-hop or would break re-encoding.\nconst STRIP_HEADERS = new Set([\n \"host\",\n \"connection\",\n \"content-length\",\n \"transfer-encoding\",\n \"proxy-connection\",\n \"proxy-authorization\",\n \"x-forwarded-for\",\n \"x-forwarded-host\",\n \"x-forwarded-proto\",\n \"x-forwarded-port\",\n \"x-real-ip\",\n \"forwarded\",\n \"via\",\n]);\n\nfunction decodeBase64ToBytes(input: string): Uint8Array {\n const bin = atob(input);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nfunction encodeBytesToBase64(bytes: Uint8Array): string {\n let bin = \"\";\n for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);\n return btoa(bin);\n}\n\nfunction sanitizeHeaders(h: unknown): Record {\n const out: Record = {};\n if (!h || typeof h !== \"object\") return out;\n for (const [k, v] of Object.entries(h as Record)) {\n if (!k) continue;\n if (STRIP_HEADERS.has(k.toLowerCase())) continue;\n out[k] = String(v ?? \"\");\n }\n return out;\n}\n\nexport async function handleExitNodeRequest(req: Request): Promise {\n // Fail closed on the placeholder PSK so a fresh deploy without setup\n // can't accidentally serve as an open relay.\n if (PSK === \"CHANGE_ME_TO_A_STRONG_SECRET\") {\n return Response.json(\n {\n e: \"exit_node misconfigured: PSK is still the placeholder. Set \" +\n \"a strong secret in the source before deploying.\",\n },\n { status: 503 },\n );\n }\n\n try {\n if (req.method !== \"POST\") {\n return Response.json({ e: \"method_not_allowed\" }, { status: 405 });\n }\n\n const body = await req.json();\n if (!body || typeof body !== \"object\") {\n return Response.json({ e: \"bad_json\" }, { status: 400 });\n }\n\n const k = String((body as any).k ?? \"\");\n const u = String((body as any).u ?? \"\");\n const m = String((body as any).m ?? \"GET\").toUpperCase();\n const h = sanitizeHeaders((body as any).h);\n const b64 = (body as any).b;\n\n if (k !== PSK) {\n return Response.json({ e: \"unauthorized\" }, { status: 401 });\n }\n if (!/^https?:\\/\\//i.test(u)) {\n return Response.json({ e: \"bad url\" }, { status: 400 });\n }\n\n // Loop guard: if u points at this exit node's own host, refuse.\n // Without this, a misconfigured client could chain exit-node →\n // exit-node → exit-node → ... and burn the host's runtime budget.\n try {\n const reqUrl = new URL(req.url);\n const dstUrl = new URL(u);\n if (\n reqUrl.host === dstUrl.host &&\n reqUrl.protocol === dstUrl.protocol\n ) {\n return Response.json({ e: \"exit-node loop refused\" }, { status: 400 });\n }\n } catch {\n // Malformed URL — let the fetch below 400.\n }\n\n let payload: Uint8Array | undefined;\n if (typeof b64 === \"string\" && b64.length > 0) {\n payload = decodeBase64ToBytes(b64);\n }\n\n const resp = await fetch(u, {\n method: m,\n headers: h,\n body: payload,\n redirect: \"manual\",\n });\n\n // `fetch()` (Deno / Bun / Node) auto-decompresses gzip / br / deflate\n // responses, so `resp.arrayBuffer()` returns plain bytes — but the\n // destination's `Content-Encoding` header is still on `resp.headers`.\n // Forwarding it would tell the client browser \"this body is gzipped\"\n // when it isn't, producing `Content Encoding Error` (#964). Same goes\n // for `Content-Length` — the post-decompression byte count is\n // different from what the destination announced. Strip both. The\n // Apps Script + Rust transport layer below us re-frames the wire body\n // anyway, so neither header is meaningful to forward.\n const data = new Uint8Array(await resp.arrayBuffer());\n const respHeaders: Record = {};\n resp.headers.forEach((value, key) => {\n const lower = key.toLowerCase();\n if (lower === \"content-encoding\" || lower === \"content-length\") return;\n respHeaders[key] = value;\n });\n\n return Response.json({\n s: resp.status,\n h: respHeaders,\n b: encodeBytesToBase64(data),\n });\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n return Response.json({ e: message }, { status: 500 });\n }\n}\n\nexport default {\n fetch: handleExitNodeRequest,\n};","label",[128],"854f561a-539c-11f1-86f3-ee650bb23af1",["D",1779206714157],2,"mhvrsaeed",[28],"pulls","branches",1,"forks","envVars",{"_152":60,"_154":60},"connections",{"_152":60,"_153":60},"count","unfilledCount","emptyCount",{"_43":139,"_32":28,"_30":31,"_130":-5,"_41":42,"_40":14,"_132":25,"_38":161,"_13":141,"_33":34,"_35":37,"_24":25,"_137":142,"_158":162,"_27":163},{"_43":127,"_32":128,"_30":129,"_130":-5,"_41":42,"_40":131,"_132":25,"_38":157,"_13":134,"_33":135,"_35":136,"_24":25,"_137":-5,"_158":159,"_27":160},["D",1779206202649],"children",[],[128],["D",1779206714157],[],[28],["D",1779202503104],{"_94":93,"_102":98},{"_94":93,"_95":96,"_97":98,"_18":54,"_99":100,"_101":25},{"_13":83,"_32":84,"_43":42,"_85":44,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":45,"_92":93},"ctx",{"_76":-5,"_122":201,"_202":203,"_204":205,"_206":25,"_207":25,"_208":25,"_209":120,"_210":-5,"_211":-7,"_212":-7,"_213":60,"_214":25,"_215":25,"_216":-5,"_217":25,"_218":25,"_219":25,"_220":-5},"ENV",{"_172":173,"_174":175,"_176":84,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v7