Add standalone ChatGPT Sites mirror proxy (sites-proxy/) - #16
Add standalone ChatGPT Sites mirror proxy (sites-proxy/)#16tonythethompson wants to merge 2 commits into
Conversation
Additive version of the abandoned codex/chatgpt-dev-proxy experiment: a ~40-line Cloudflare Worker that mirrors trackdub.com under a separate hostname for ChatGPT Sites, without touching the app's package.json, wrangler.jsonc, or any source. - index.js: forwards path/query/method/body upstream, rewrites same-site redirects, preserves external ones, tags x-robots-tag: noindex + mirror header. Upstream origin is env-configurable (defaults to trackdub.com). - proxy.test.mjs: 6 unit tests, zero dependencies (node built-ins only). - build.mjs: emits dist/server/index.js relative to sites-proxy/ so wrangler resolves "main" correctly. - wrangler.jsonc: standalone deploy config for the proxy worker. - README.md: layout, test/build/deploy commands, config notes. Verified: 6/6 tests pass, wrangler --dry-run uploads 1.96 KiB with no bindings, repo-wide eslint + tsc stay green (no app files touched).
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
trackdub-website | d14131d | Commit Preview URL Branch Preview URL |
Aug 07 2026, 11:42 AM |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 10 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
Greptile SummaryThe PR adds a standalone Cloudflare Worker that mirrors the marketing site without modifying the primary application.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| sites-proxy/index.js | Implements request forwarding, exact-origin redirect matching, downstream authority rewriting, and mirror response headers; the follow-up port fixes appear complete. |
| sites-proxy/proxy.test.mjs | Covers forwarding, environment configuration, response tagging, external redirects, bare/www. matching, and the corrected non-default-port behavior. |
| sites-proxy/build.mjs | Builds the standalone worker by copying its entry point into the Wrangler-configured output path. |
| sites-proxy/wrangler.jsonc | Defines the independent Worker deployment, output entry point, compatibility date, observability, and optional upstream configuration. |
| sites-proxy/README.md | Documents the mirror’s behavior, standalone layout, commands, configuration, and redirect policy. |
Reviews (2): Last reviewed commit: "fix: compare full origin when rewriting ..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| # trackdub-dev-proxy | ||
|
|
||
| A tiny Cloudflare Worker that mirrors **trackdub.com** under a separate | ||
| hostname (e.g. `trackdub.dev`) so external platforms — such as OpenAI |
There was a problem hiding this comment.
SUGGESTION: Em dashes in user-facing prose
Lines 4, 5, and 54 use em dashes (—) in user-facing prose. Replace with standard dashes or rephrase to comply with the style guide.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (2 files)
Previous Review Summary (commit 11a1161)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 11a1161)Status: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)SUGGESTION
Files Reviewed (5 files)
Reviewed by step-3.7-flash · Input: 42.6K · Output: 11.2K · Cached: 466K Review guidance: REVIEW.md from base branch |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 5 files
Confidence score: 3/5
- In
sites-proxy/index.js, forwarding all incoming headers and relaying upstreamSet-Cookievalues unchanged between different domains can exposeCookie/Authorizationdata and create broken or unsafe session behavior for mirror visitors; restrict forwarded headers to an allowlist and sanitize or rewrite/dropSet-Cookiebefore returning it.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="sites-proxy/index.js">
<violation number="1" location="sites-proxy/index.js:24">
P2: The worker forwards every incoming header (including `Cookie`/`Authorization`) to the upstream and passes the upstream's `Set-Cookie` back unmodified to mirror visitors. Since the mirror and `trackdub.com` are different origins, this lets each side read/write the other's cookies through the proxy — a visitor's mirror cookies are sent to the canonical site, and any cookie the upstream sets ends up stored and re-sent under the mirror host. For a public marketing mirror this is low impact today, but it becomes a cross-origin session-leak if either endpoint ever carries auth or if ChatGPT Sites' requests include credentials. Consider stripping `cookie`/`authorization` from the upstream request and filtering `set-cookie` (or namespacing/overriding the `Domain`) on the response for this unauthenticated mirror.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| ) { | ||
| const downstreamUrl = new URL(request.url); | ||
| const upstreamUrl = new URL(downstreamUrl.pathname + downstreamUrl.search, upstreamOrigin); | ||
| const upstreamRequest = new Request(upstreamUrl, request); |
There was a problem hiding this comment.
P2: The worker forwards every incoming header (including Cookie/Authorization) to the upstream and passes the upstream's Set-Cookie back unmodified to mirror visitors. Since the mirror and trackdub.com are different origins, this lets each side read/write the other's cookies through the proxy — a visitor's mirror cookies are sent to the canonical site, and any cookie the upstream sets ends up stored and re-sent under the mirror host. For a public marketing mirror this is low impact today, but it becomes a cross-origin session-leak if either endpoint ever carries auth or if ChatGPT Sites' requests include credentials. Consider stripping cookie/authorization from the upstream request and filtering set-cookie (or namespacing/overriding the Domain) on the response for this unauthenticated mirror.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At sites-proxy/index.js, line 24:
<comment>The worker forwards every incoming header (including `Cookie`/`Authorization`) to the upstream and passes the upstream's `Set-Cookie` back unmodified to mirror visitors. Since the mirror and `trackdub.com` are different origins, this lets each side read/write the other's cookies through the proxy — a visitor's mirror cookies are sent to the canonical site, and any cookie the upstream sets ends up stored and re-sent under the mirror host. For a public marketing mirror this is low impact today, but it becomes a cross-origin session-leak if either endpoint ever carries auth or if ChatGPT Sites' requests include credentials. Consider stripping `cookie`/`authorization` from the upstream request and filtering `set-cookie` (or namespacing/overriding the `Domain`) on the response for this unauthenticated mirror.</comment>
<file context>
@@ -0,0 +1,53 @@
+) {
+ const downstreamUrl = new URL(request.url);
+ const upstreamUrl = new URL(downstreamUrl.pathname + downstreamUrl.search, upstreamOrigin);
+ const upstreamRequest = new Request(upstreamUrl, request);
+ const upstreamResponse = await fetchImpl(upstreamRequest, { redirect: "manual" });
+ const headers = new Headers(upstreamResponse.headers);
</file context>
Match Location rewrites by origin (including port), leave different-port redirects alone, and copy hostname/port separately so an upstream port cannot stick on the mirror URL. Co-authored-by: Cursor <cursoragent@cursor.com>
Dismissed because a newer commit was pushed; Greptile will re-review the current head.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Closing as not-planned — the proxy has no consumer in ChatGPT Sites. Primary-source research (OpenAI's own help center — "Creating and managing The supported route is documented in |
1 participant
Summary
Additive, shippable revival of the abandoned
codex/chatgpt-dev-proxyexperiment: a ~40-line Cloudflare Worker that mirrors trackdub.com under a separate hostname (e.g.trackdub.dev) so OpenAI ChatGPT Sites can serve a copy of the marketing site.Unlike the old branch — which replaced the app's
package.json(wiping all scripts/deps) — this version lives entirely insidesites-proxy/and touches no app files.Files
sites-proxy/index.jsx-robots-tag: noindex+x-trackdub-mirror: chatgpt-sitessites-proxy/proxy.test.mjssites-proxy/build.mjsdist/server/index.jsrelative to sites-proxy/ so wrangler resolvesmaincorrectlysites-proxy/wrangler.jsonctrackdub-dev-proxyworker)sites-proxy/README.mdImprovements over the experiment
package.json/wrangler.jsonc/source untouchedUPSTREAM_ORIGINvar, defaults tohttps://trackdub.com) with a dedicated testVerification
node --test sites-proxy/proxy.test.mjs→ 6/6 passwrangler deploy --dry-run→ uploads 1.96 KiB, no bindingseslint .+tsc --noEmit→ green (no app files changed)Notes
dist/is already gitignored repo-wide.Summary by cubic
Adds a tiny Cloudflare Worker in
sites-proxy/that mirrors trackdub.com under a separate hostname for ChatGPT Sites. It’s fully standalone and does not touch any app files.New Features
x-robots-tag: noindex, nofollowandx-trackdub-mirror: chatgpt-sitesheaders.UPSTREAM_ORIGIN(defaults tohttps://trackdub.com).wrangler.jsonc, a simplebuild.mjsemittingdist/server/index.js, and 9 tests using Node built-ins.Migration
npx wrangler deploy --config sites-proxy/wrangler.jsonc. No app changes required.Written for commit d14131d. Summary will update on new commits.
Note
Add Cloudflare Worker proxy that mirrors trackdub.com under an alternate hostname
sites-proxy/package containing a Cloudflare Worker that forwards requests to a configurable upstream origin (defaulting tohttps://trackdub.com) while preserving path, query, method, and body.Locationheader redirects are rewritten to use the mirror hostname; redirects to external origins pass through unchanged.x-robots-tag: noindex, nofollowandx-trackdub-mirror: chatgpt-sitesheaders appended.dist/server/index.js, and unit tests in proxy.test.mjs.Macroscope summarized d14131d.