9router 0.3.5 → 0.3.6

package/app/src/mitm/manager.js

@@ -12,6 +12,8 @@ const { generateCert } = require("./cert/generate");
 const { installCert } = require("./cert/install");
 
 const MITM_PORT = 443;
+// On Windows, node listens on HIGH_PORT and netsh portproxy forwards 443 → HIGH_PORT
+const WIN_NODE_PORT = 8443;
 const PID_FILE = path.join(os.homedir(), ".9router", "mitm", ".mitm.pid");
 
 // Resolve server.js path robustly:
@@ -276,11 +278,12 @@ async function killLeftoverMitm(sudoPassword) {
  * Returns { ok, pid } on success, null on timeout.
  */
 function pollMitmHealth(timeoutMs) {
+  const healthPort = IS_WIN ? WIN_NODE_PORT : MITM_PORT;
   return new Promise((resolve) => {
     const deadline = Date.now() + timeoutMs;
     const check = () => {
       const req = https.request(
-        { hostname: "127.0.0.1", port: 443, path: "/_mitm_health", method: "GET", rejectUnauthorized: false },
+        { hostname: "127.0.0.1", port: healthPort, path: "/_mitm_health", method: "GET", rejectUnauthorized: false },
         (res) => {
           let body = "";
           res.on("data", (d) => { body += d; });
@@ -407,49 +410,60 @@ async function startMitm(apiKey, sudoPassword) {
   console.log("Starting MITM server...");
 
   if (IS_WIN) {
-    // Windows: single UAC prompt does cert install + DNS + server start all at once
     const hostsFile = path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts");
     const TARGET_HOSTS_WIN = ["daily-cloudcode-pa.googleapis.com", "cloudcode-pa.googleapis.com"];
-
-    // Escape paths for PowerShell single-quoted strings
     const esc = (s) => s.replace(/'/g, "''");
-    const nodePsPath = esc(process.execPath);
-    const serverPsPath = esc(SERVER_PATH);
     const certPsPath = esc(certPath);
     const hostsPsPath = esc(hostsFile);
 
-    // Build DNS add lines for each host
     const dnsAddLines = TARGET_HOSTS_WIN.map(h =>
       `if (-not (Select-String -Path '${hostsPsPath}' -Pattern '${h}' -Quiet)) { Add-Content -Path '${hostsPsPath}' -Value "127.0.0.1 ${h}" }`
     ).join("\n");
 
-    const psScript = `
+    // Phase 1: single UAC — cert + DNS + netsh urlacl + netsh portproxy
+    const setupScript = `
 # 1. Install cert if not already in Root store
 $certCheck = & certutil -store Root 'daily-cloudcode-pa.googleapis.com' 2>&1
 if ($LASTEXITCODE -ne 0) {
   & certutil -addstore Root '${certPsPath}' | Out-Null
 }
 
-# 2. Add DNS entries to hosts file
+# 2. Add DNS entries
 ${dnsAddLines}
 & ipconfig /flushdns | Out-Null
 
-# 3. Start node server hidden with env vars
-$env:ROUTER_API_KEY = '${esc(apiKey)}'
-$env:NODE_ENV = 'production'
-Start-Process -FilePath '${nodePsPath}' -ArgumentList '"${serverPsPath}"' -WindowStyle Hidden
+# 3. Allow node to bind port ${WIN_NODE_PORT} without admin
+& netsh http add urlacl url=https://+:${WIN_NODE_PORT}/ user=Everyone | Out-Null
+
+# 4. Forward :443 → :${WIN_NODE_PORT} (portproxy)
+& netsh interface portproxy delete v4tov4 listenport=${MITM_PORT} listenaddress=0.0.0.0 2>&1 | Out-Null
+& netsh interface portproxy add v4tov4 listenport=${MITM_PORT} listenaddress=0.0.0.0 connectport=${WIN_NODE_PORT} connectaddress=127.0.0.1 | Out-Null
 `.trim();
 
-    // Write script to temp file to avoid command-line quoting issues
-    const tmpScript = path.join(os.tmpdir(), `mitm_start_${Date.now()}.ps1`);
-    fs.writeFileSync(tmpScript, psScript, "utf8");
+    const tmpSetup = path.join(os.tmpdir(), `mitm_setup_${Date.now()}.ps1`);
+    fs.writeFileSync(tmpSetup, setupScript, "utf8");
+
+    // Run elevated setup — single UAC prompt, wait for completion
+    await new Promise((resolve, reject) => {
+      const setupProc = spawn("powershell", [
+        "-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden",
+        "-Command",
+        `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpSetup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpSetup)}' -ErrorAction SilentlyContinue`
+      ], { stdio: "ignore", windowsHide: true });
+      setupProc.on("close", () => resolve());
+      setupProc.on("error", reject);
+    });
+
+    if (_updateSettings) await _updateSettings({ mitmCertInstalled: true }).catch(() => { });
 
-    // Single UAC prompt — runs entire setup elevated
-    serverProcess = spawn("powershell", [
-      "-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden",
-      "-Command",
-      `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${tmpScript}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpScript)}' -ErrorAction SilentlyContinue`
-    ], { stdio: "ignore", windowsHide: true });
+    // Phase 2: start node server on WIN_NODE_PORT — no admin needed
+    serverProcess = spawn(process.execPath, [SERVER_PATH], {
+      env: { ...process.env, ROUTER_API_KEY: apiKey, NODE_ENV: "production", MITM_PORT: String(WIN_NODE_PORT) },
+      stdio: "ignore",
+      windowsHide: true,
+      detached: true,
+    });
+    serverProcess.unref();
   } else {
     // macOS/Linux: install cert + add DNS (requires sudo), then spawn server
     const settings = _getSettings ? await _getSettings().catch(() => ({})) : {};
@@ -508,10 +522,7 @@ Start-Process -FilePath '${nodePsPath}' -ArgumentList '"${serverPsPath}"' -Windo
     throw new Error(`MITM server failed to start. ${reason}`);
   }
 
-  // On Windows, mark cert as installed after successful start
-  if (IS_WIN && _updateSettings) await _updateSettings({ mitmCertInstalled: true }).catch(() => { });
-
-  // On Windows, use real PID from health check (launcher exits immediately after UAC)
+  // On Windows, use real PID from health check (node detached, serverProcess.pid may differ)
   if (IS_WIN && health.pid) {
     serverPid = health.pid;
     fs.writeFileSync(PID_FILE, String(serverPid));
@@ -552,8 +563,29 @@ async function stopMitm(sudoPassword) {
     serverPid = null;
   }
 
-  console.log("Removing DNS entry...");
-  await removeDNSEntry(sudoPassword);
+  if (IS_WIN) {
+    // Cleanup netsh portproxy + urlacl — single UAC prompt
+    const cleanupScript = `
+& netsh interface portproxy delete v4tov4 listenport=${MITM_PORT} listenaddress=0.0.0.0 2>&1 | Out-Null
+& netsh http delete urlacl url=https://+:${WIN_NODE_PORT}/ 2>&1 | Out-Null
+`.trim();
+    const tmpCleanup = path.join(os.tmpdir(), `mitm_cleanup_${Date.now()}.ps1`);
+    fs.writeFileSync(tmpCleanup, cleanupScript, "utf8");
+    const esc = (s) => s.replace(/'/g, "''");
+    await new Promise((resolve) => {
+      const p = spawn("powershell", [
+        "-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden",
+        "-Command",
+        `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpCleanup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpCleanup)}' -ErrorAction SilentlyContinue`
+      ], { stdio: "ignore", windowsHide: true });
+      p.on("close", resolve);
+      p.on("error", resolve);
+    });
+    await removeDNSEntry(sudoPassword);
+  } else {
+    console.log("Removing DNS entry...");
+    await removeDNSEntry(sudoPassword);
+  }
 
   try { fs.unlinkSync(PID_FILE); } catch { /* ignore */ }
 

package/app/src/mitm/server.js

@@ -11,7 +11,7 @@ const TARGET_HOSTS = [
   "daily-cloudcode-pa.googleapis.com",
   "cloudcode-pa.googleapis.com"
 ];
-const LOCAL_PORT = 443;
+const LOCAL_PORT = parseInt(process.env.MITM_PORT || "443", 10);
 const ROUTER_URL = "http://localhost:20128/v1/chat/completions";
 const API_KEY = process.env.ROUTER_API_KEY;
 const DB_FILE = path.join(os.homedir(), ".9router", "db.json");

package/cli.js

@@ -360,11 +360,10 @@ fi
     }
 
     const spawnOpts = platform === "win32"
-      ? { stdio: "ignore", windowsHide: true }
-      : { detached: true, stdio: "ignore" };
+      ? { stdio: "ignore", shell: true }   // cmd /c start opens new window
+      : { stdio: "inherit" };              // show progress in current terminal
     const child = spawn(shellCmd[0], shellCmd[1], spawnOpts);
-    child.unref();
-    process.exit(0);
+    child.on("close", () => process.exit(0));
   } catch (err) {
     console.error(`⚠️  Update failed: ${err.message}`);
     console.log(`   Run manually: npm install -g ${pkg.name}@latest\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "9router",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "9Router CLI - Start and manage 9Router server",
   "bin": {
     "9router": "./cli.js"

package/src/cli/tray/tray.js

@@ -5,16 +5,18 @@ const path = require("path");
 let trayInstance = null;
 
 /**
- * Get icon base64 from file or use embedded fallback
+ * Get icon base64 from file — use .ico on Windows, .png on macOS/Linux
  */
 function getIconBase64() {
+  const isWin = process.platform === "win32";
+  const iconFile = isWin ? "icon.ico" : "icon.png";
   try {
-    const iconPath = path.join(__dirname, "icon.png");
+    const iconPath = path.join(__dirname, iconFile);
     if (fs.existsSync(iconPath)) {
       return fs.readFileSync(iconPath).toString("base64");
     }
   } catch (e) {}
-  // Fallback: minimal green dot icon
+  // Fallback: minimal green dot icon (PNG)
   return "iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAABGdBTUEAALGPC/xhBQAAAAlwSFlzAAALEwAACxMBAJqcGAAAAHpJREFUOE9jYBgFgwEwMjIy/Gdg+P8fyP4PxP8ZGBgEcBnGyMjIsICBgSEAhyH/gfgBUNN8XJoZsdkCVL8Ah+b/QPwbqvkBMvk/AwMDAzYX/GdgYAhAN+A/SICRWAMYGfFEJSMjzriEiwDR/xmIa2RkZCSqnZERb3QCAAo3KxzxbKe1AAAAAElFTkSuQmCC";
 }