9router 0.3.11 → 0.3.13

package/app/src/mitm/manager.js

@@ -12,6 +12,8 @@ const { generateCert } = require("./cert/generate");
 const { installCert } = require("./cert/install");
 
 const MITM_PORT = 443;
+// Windows: node listens on 8443, netsh portproxy forwards 443→8443
+const MITM_WIN_NODE_PORT = 8443;
 const PID_FILE = path.join(os.homedir(), ".9router", "mitm", ".mitm.pid");
 
 // Resolve server.js path robustly:
@@ -275,12 +277,12 @@ async function killLeftoverMitm(sudoPassword) {
  * Poll MITM health endpoint until server is up or timeout.
  * Returns { ok, pid } on success, null on timeout.
  */
-function pollMitmHealth(timeoutMs) {
+function pollMitmHealth(timeoutMs, port = MITM_PORT) {
   return new Promise((resolve) => {
     const deadline = Date.now() + timeoutMs;
     const check = () => {
       const req = https.request(
-        { hostname: "127.0.0.1", port: 443, path: "/_mitm_health", method: "GET", rejectUnauthorized: false },
+        { hostname: "127.0.0.1", port, path: "/_mitm_health", method: "GET", rejectUnauthorized: false },
         (res) => {
           let body = "";
           res.on("data", (d) => { body += d; });
@@ -366,34 +368,28 @@ async function startMitm(apiKey, sudoPassword) {
   // Kill any leftover MITM server from a previous failed start attempt
   await killLeftoverMitm(sudoPassword);
 
-  // Check port 443 availability BEFORE modifying system
-  // "no-permission" = EACCES: port may be held by a root process, check via lsof/netstat
-  const portStatus = await checkPort443Free();
-  if (portStatus === "in-use" || portStatus === "no-permission") {
-    const owner = await getPort443Owner(sudoPassword);
-    if (owner && owner.name === "node") {
-      // Orphan MITM node process — kill it and continue
-      console.log(`[MITM] Killing orphan node process on port 443 (PID ${owner.pid})...`);
-      try {
-        if (IS_WIN) {
-          await new Promise((resolve) => exec(`taskkill /F /PID ${owner.pid}`, resolve));
-        } else {
+  if (!IS_WIN) {
+    // Check port 443 availability — Windows handles this inside elevated script
+    const portStatus = await checkPort443Free();
+    if (portStatus === "in-use" || portStatus === "no-permission") {
+      const owner = await getPort443Owner(sudoPassword);
+      if (owner && owner.name === "node") {
+        // Orphan MITM node process — kill it and continue
+        console.log(`[MITM] Killing orphan node process on port 443 (PID ${owner.pid})...`);
+        try {
           const { execWithPassword } = require("./dns/dnsConfig");
           await execWithPassword(`kill -9 ${owner.pid}`, sudoPassword);
-        }
-        await new Promise(r => setTimeout(r, 800));
-      } catch {
-        // best effort — continue anyway
+          await new Promise(r => setTimeout(r, 800));
+        } catch { /* best effort */ }
+      } else if (owner) {
+        const shortName = owner.name.includes("/")
+          ? owner.name.split("/").filter(Boolean).pop()
+          : owner.name;
+        throw new Error(
+          `Port 443 is already in use by "${shortName}" (PID ${owner.pid}). Stop that process first, then retry.`
+        );
       }
-    } else if (owner) {
-      const shortName = owner.name.includes("/")
-        ? owner.name.split("/").filter(Boolean).pop()
-        : owner.name;
-      throw new Error(
-        `Port 443 is already in use by "${shortName}" (PID ${owner.pid}). Stop that process first, then retry.`
-      );
     }
-    // owner === null + no-permission → likely just needs sudo, proceed
   }
 
   // 1. Generate SSL certificate if not exists (no elevation needed)
@@ -407,64 +403,86 @@ async function startMitm(apiKey, sudoPassword) {
   console.log("Starting MITM server...");
 
   if (IS_WIN) {
+    // Windows: single UAC via VBScript → elevated PowerShell script that:
+    // 1. Installs SSL cert  2. Adds DNS entries  3. Starts node server.js (elevated → can bind 443)  4. Writes flag
+    // Node polls flag file to know when server is ready, then health-checks port 443
     const hostsFile = path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts");
     const TARGET_HOSTS_WIN = ["daily-cloudcode-pa.googleapis.com", "cloudcode-pa.googleapis.com"];
-    const esc = (s) => s.replace(/'/g, "''");
-    const certPsPath = esc(certPath);
-    const hostsPsPath = esc(hostsFile);
 
-    // Check if one-time setup is already done (urlacl granted + cert installed + DNS added)
-    const settings = _getSettings ? await _getSettings().catch(() => ({})) : {};
-    const setupDone = settings.mitmWinSetupDone && fs.existsSync(certPath) && checkDNSEntry();
-
-    if (!setupDone) {
-      // Phase 1: single UAC prompt — cert + DNS + netsh urlacl (one-time setup)
-      const dnsAddLines = TARGET_HOSTS_WIN.map(h =>
-        `$hc = Get-Content -Path '${hostsPsPath}' -Raw -ErrorAction SilentlyContinue; if ($hc -notmatch '${h}') { Add-Content -Path '${hostsPsPath}' -Value "127.0.0.1 ${h}" -Encoding UTF8 }`
-      ).join("\n");
-
-      const setupScript = `
-# 1. Install cert to Root store
-$certCheck = & certutil -store Root 'daily-cloudcode-pa.googleapis.com' 2>&1
-if ($LASTEXITCODE -ne 0) { & certutil -addstore Root '${certPsPath}' | Out-Null }
-
-# 2. Add DNS entries
-${dnsAddLines}
-& ipconfig /flushdns | Out-Null
-
-# 3. Grant current user permission to bind port 443 (no more UAC needed after this)
-$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
-& netsh http add urlacl url=https://+:443/ sddl="D:(A;;GX;;;$sid)" | Out-Null
-`.trim();
-
-      const tmpSetup = path.join(os.tmpdir(), `mitm_setup_${Date.now()}.ps1`);
-      fs.writeFileSync(tmpSetup, setupScript, "utf8");
-
-      // Run elevated — this is the ONLY UAC prompt
-      await new Promise((resolve, reject) => {
-        const launcher = spawn("powershell", [
-          "-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden",
-          "-Command",
-          `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpSetup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpSetup)}' -ErrorAction SilentlyContinue`
-        ], { stdio: "ignore", windowsHide: true });
-        launcher.on("close", (code) => {
-          if (code === 0) resolve();
-          else reject(new Error(`Setup script failed with code ${code}`));
-        });
-        launcher.on("error", reject);
-      });
-
-      if (_updateSettings) await _updateSettings({ mitmWinSetupDone: true, mitmCertInstalled: true }).catch(() => { });
-    }
-
-    // Phase 2: spawn node directly — no UAC needed (urlacl already granted)
-    serverProcess = spawn(process.execPath, [SERVER_PATH], {
-      detached: true,
-      stdio: "ignore",
-      windowsHide: true,
-      env: { ...process.env, ROUTER_API_KEY: apiKey, NODE_ENV: "production" },
+    // Use Chr(34) in VBScript for quotes — avoid escaping issues
+    const flagFile = path.join(os.tmpdir(), `mitm_ready_${Date.now()}.flag`);
+
+    // PowerShell uses single-quoted strings — escape single quotes only
+    const psSQ = (s) => s.replace(/'/g, "''");
+    const certPs = psSQ(certPath);
+    const hostsPs = psSQ(hostsFile);
+    const nodePs = psSQ(process.execPath);
+    const serverPs = psSQ(SERVER_PATH);
+    const flagPs = psSQ(flagFile);
+
+    const dnsLines = TARGET_HOSTS_WIN.map(h =>
+      `$hc = Get-Content -Path '${hostsPs}' -Raw -ErrorAction SilentlyContinue\n` +
+      `if ($hc -notmatch [regex]::Escape('${h}')) { Add-Content -Path '${hostsPs}' -Value '127.0.0.1 ${h}' -Encoding UTF8 }`
+    ).join("\n");
+
+    const psScript = [
+      `# 0. Kill any orphan node process on port 443`,
+      `$conn = Get-NetTCPConnection -LocalPort 443 -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1`,
+      `if ($conn -and $conn.OwningProcess -gt 4) { Stop-Process -Id $conn.OwningProcess -Force -ErrorAction SilentlyContinue }`,
+      `Start-Sleep -Milliseconds 500`,
+      ``,
+      `# 1. Install SSL cert to Windows Root store`,
+      `$c = & certutil -store Root 'daily-cloudcode-pa.googleapis.com' 2>&1`,
+      `if ($LASTEXITCODE -ne 0) { & certutil -addstore Root '${certPs}' | Out-Null }`,
+      ``,
+      `# 2. Add DNS entries to hosts file`,
+      dnsLines,
+      `& ipconfig /flushdns | Out-Null`,
+      ``,
+      `# 3. Start node MITM server elevated (required to bind port 443)`,
+      `$env:ROUTER_API_KEY = '${psSQ(apiKey)}'`,
+      `$env:NODE_ENV = 'production'`,
+      `Start-Process -FilePath '${nodePs}' -ArgumentList '${serverPs}' -WindowStyle Hidden`,
+      ``,
+      `# 4. Signal ready`,
+      `Start-Sleep -Milliseconds 500`,
+      `Set-Content -Path '${flagPs}' -Value 'ready' -Encoding UTF8`,
+    ].join("\n");
+
+    const tmpPs1 = path.join(os.tmpdir(), `mitm_start_${Date.now()}.ps1`);
+    fs.writeFileSync(tmpPs1, psScript, "utf8");
+
+    // VBScript uses Shell.Application.ShellExecute to trigger UAC from any context
+    // Chr(34) = double-quote, avoids VBScript string escaping issues
+    const vbs = [
+      `Set oShell = CreateObject("Shell.Application")`,
+      `Dim ps`,
+      `ps = Chr(34) & "powershell.exe" & Chr(34)`,
+      `Dim args`,
+      `args = "-NoProfile -ExecutionPolicy Bypass -File " & Chr(34) & "${tmpPs1.replace(/\\/g, "\\\\")}" & Chr(34)`,
+      `oShell.ShellExecute ps, args, "", "runas", 1`,
+    ].join("\r\n");
+    const tmpVbs = path.join(os.tmpdir(), `mitm_uac_${Date.now()}.vbs`);
+    fs.writeFileSync(tmpVbs, vbs, "utf8");
+
+    // Launch VBScript — shows UAC dialog, user confirms, script runs elevated
+    spawn("wscript.exe", [tmpVbs], { stdio: "ignore", windowsHide: false, detached: true }).unref();
+
+    // Poll flag file — resolves when elevated script completes
+    await new Promise((resolve, reject) => {
+      const deadline = Date.now() + 90000; // 90s: UAC wait + cert install + node start
+      const poll = () => {
+        if (fs.existsSync(flagFile)) {
+          try { fs.unlinkSync(flagFile); fs.unlinkSync(tmpPs1); fs.unlinkSync(tmpVbs); } catch { /* ignore */ }
+          return resolve();
+        }
+        if (Date.now() > deadline) return reject(new Error("Timed out waiting for UAC confirmation. Please try again."));
+        setTimeout(poll, 500);
+      };
+      poll();
     });
-    serverProcess.unref();
+
+    if (_updateSettings) await _updateSettings({ mitmCertInstalled: true }).catch(() => { });
   } else {
     // macOS/Linux: install cert + add DNS (requires sudo), then spawn server
     const settings = _getSettings ? await _getSettings().catch(() => ({})) : {};
@@ -487,8 +505,11 @@ $sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
     serverProcess.stdin.end();
   }
 
-  serverPid = serverProcess.pid;
-  fs.writeFileSync(PID_FILE, String(serverPid));
+  // Windows: node was started by elevated script — PID comes from health check later
+  if (!IS_WIN && serverProcess) {
+    serverPid = serverProcess.pid;
+    fs.writeFileSync(PID_FILE, String(serverPid));
+  }
 
   let startError = null;
   if (!IS_WIN) {
@@ -511,9 +532,8 @@ $sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
     });
   }
 
-  // Wait for server to be ready by polling health endpoint
-  // Windows: allow extra time for urlacl setup + node startup on first run
-  const health = await pollMitmHealth(IS_WIN ? 20000 : 8000);
+  // Wait for server to be ready by polling health endpoint on port 443
+  const health = await pollMitmHealth(IS_WIN ? 15000 : 8000, MITM_PORT);
 
   if (!health) {
     if (IS_WIN) serverProcess = null;
@@ -568,14 +588,61 @@ async function stopMitm(sudoPassword) {
     serverPid = null;
   }
 
-  console.log("Removing DNS entry...");
-  await removeDNSEntry(sudoPassword);
+  if (IS_WIN) {
+    // Windows stop: remove DNS entries via elevated VBScript (1 UAC)
+    const hostsFile = path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts");
+    const TARGET_HOSTS_WIN = ["daily-cloudcode-pa.googleapis.com", "cloudcode-pa.googleapis.com"];
+    const psSQ = (s) => s.replace(/'/g, "''");
+
+    // Filter hosts content in Node (read doesn't need elevation)
+    let hostsContent = "";
+    try { hostsContent = fs.readFileSync(hostsFile, "utf8"); } catch { /* ignore */ }
+    const filtered = hostsContent.split(/\r?\n/)
+      .filter(l => !TARGET_HOSTS_WIN.some(h => l.includes(h)))
+      .join("\r\n");
+    const tmpHosts = path.join(os.tmpdir(), "mitm_hosts_clean.tmp");
+    fs.writeFileSync(tmpHosts, filtered, "utf8");
+
+    const flagFile = path.join(os.tmpdir(), "mitm_stop_done.flag");
+    const psScript = [
+      `Copy-Item -Path '${psSQ(tmpHosts)}' -Destination '${psSQ(hostsFile)}' -Force`,
+      `& ipconfig /flushdns | Out-Null`,
+      `Remove-Item '${psSQ(tmpHosts)}' -ErrorAction SilentlyContinue`,
+      `Set-Content -Path '${psSQ(flagFile)}' -Value 'done' -Encoding UTF8`,
+    ].join("\n");
+    const tmpPs1 = path.join(os.tmpdir(), "mitm_stop.ps1");
+    fs.writeFileSync(tmpPs1, psScript, "utf8");
+
+    const vbs = [
+      `Set oShell = CreateObject("Shell.Application")`,
+      `Dim args`,
+      `args = "-NoProfile -ExecutionPolicy Bypass -File " & Chr(34) & "${tmpPs1.replace(/\\/g, "\\\\")}" & Chr(34)`,
+      `oShell.ShellExecute "powershell.exe", args, "", "runas", 1`,
+    ].join("\r\n");
+    const tmpVbs = path.join(os.tmpdir(), "mitm_stop_uac.vbs");
+    fs.writeFileSync(tmpVbs, vbs, "utf8");
+    spawn("wscript.exe", [tmpVbs], { stdio: "ignore", windowsHide: false, detached: true }).unref();
+
+    // Poll flag — best effort, don't block UI if user cancels UAC
+    await new Promise((resolve) => {
+      const deadline = Date.now() + 30000;
+      const poll = () => {
+        if (fs.existsSync(flagFile)) {
+          try { fs.unlinkSync(flagFile); fs.unlinkSync(tmpPs1); fs.unlinkSync(tmpVbs); } catch { /* ignore */ }
+          return resolve();
+        }
+        if (Date.now() > deadline) return resolve();
+        setTimeout(poll, 500);
+      };
+      poll();
+    });
+  } else {
+    console.log("Removing DNS entry...");
+    await removeDNSEntry(sudoPassword);
+  }
 
   try { fs.unlinkSync(PID_FILE); } catch { /* ignore */ }
 
-  // Reset win setup flag so DNS gets re-added on next start
-  if (IS_WIN && _updateSettings) await _updateSettings({ mitmWinSetupDone: false }).catch(() => { });
-
   await saveMitmSettings(false, null);
 
   return { running: false, pid: null };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "9router",
-  "version": "0.3.11",
+  "version": "0.3.13",
   "description": "9Router CLI - Start and manage 9Router server",
   "bin": {
     "9router": "./cli.js"