// Generated by Local-Cursor. Redirect only Cursor API hosts; keep TLS verification.
'use strict';
const tls = require('node:tls');
const net = require('node:net');
const fs = require('node:fs');
const {X509Certificate} = require('node:crypto');
const port = Number(process.env.CLI_HTTPS_PORT || 39092);
if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error('Invalid CLI HTTPS port');
const localCA = process.env.NODE_EXTRA_CA_CERTS ? fs.readFileSync(process.env.NODE_EXTRA_CA_CERTS) : undefined;
const originalCAPath = process.env.LOCAL_CURSOR_ORIGINAL_CA_FILE;
const extraCA = originalCAPath ? (fs.readFileSync(originalCAPath, 'utf8').match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) || []).filter(cert => new X509Certificate(cert).fingerprint256.replaceAll(':','').toLowerCase() !== '836e6bb84f6c3e63316dbb4ec257223af09f7490e7aae09030b8515ed61ee9ff') : [];
const redirect = host => /^(?:[a-z0-9-]+\.)*api[23]\.cursor\.sh$/i.test(String(host || ''));

function normalized(args) {
  if (args[0] && typeof args[0] === 'object') return { options: { ...args[0] }, callback: args.find(a => typeof a === 'function') };
  const extra = args.find(a => a && typeof a === 'object') || {};
  return { options: { ...extra, port: args[0], ...(typeof args[1] === 'string' ? {host: args[1]} : {}) }, callback: args.find(a => typeof a === 'function') };
}
const originalNetConnect = net.connect;
function connect(...args) {
  const {options, callback} = normalized(args);
  if (!redirect(options.host)) return originalNetConnect.apply(this, args);
  options.host = '127.0.0.1'; options.port = port;
  return originalNetConnect.call(this, options, ...(callback ? [callback] : []));
}
net.connect = net.createConnection = connect;
const originalTLSConnect = tls.connect;
tls.connect = function (...args) {
  const {options, callback} = normalized(args);
  if (!redirect(options.host)) {
    if (!extraCA.length || options.ca !== undefined || options.secureContext) return originalTLSConnect.apply(this, args);
    const defaults = typeof tls.getCACertificates === 'function' ? tls.getCACertificates('default') : tls.rootCertificates;
    options.ca = [...defaults, ...extraCA];
    return originalTLSConnect.call(this, options, ...(callback ? [callback] : []));
  }
  const originalHost = options.host;
  options.host = '127.0.0.1'; options.port = port;
  options.servername = options.servername || originalHost;
  options.rejectUnauthorized = true;
  if (!options.ca && extraCA.length) options.ca = [...(typeof tls.getCACertificates === "function" ? tls.getCACertificates("default") : tls.rootCertificates), ...extraCA];
  if (options.ca && localCA) options.ca = [...(Array.isArray(options.ca) ? options.ca : [options.ca]), localCA];
  return originalTLSConnect.call(this, options, ...(callback ? [callback] : []));
};