9router 0.3.55 → 0.3.57

package/app/src/mitm/server2.js

@@ -1,1099 +0,0 @@
-const https = require("https");
-const fs = require("fs");
-const path = require("path");
-const dns = require("dns");
-const { promisify } = require("util");
-const Database = require("better-sqlite3");
-
-const CURSOR_GLOBAL_DB = path.join(
-  process.env.HOME,
-  "Library/Application Support/Cursor/User/globalStorage/state.vscdb"
-);
-
-// Read full conversation from Cursor global DB
-function readConversationFromDb(conversationId) {
-  try {
-    const db = new Database(CURSOR_GLOBAL_DB, { readonly: true, fileMustExist: true });
-    const stmt = db.prepare("SELECT value FROM cursorDiskKV WHERE key=?");
-
-    const row = stmt.get(`composerData:${conversationId}`);
-    if (!row) { db.close(); return null; }
-
-    const composer = JSON.parse(row.value);
-    const headers = composer.fullConversationHeadersOnly || [];
-    const name = composer.name || "";
-
-    const messages = [];
-    for (const h of headers) {
-      const brow = stmt.get(`bubbleId:${conversationId}:${h.bubbleId}`);
-      if (!brow) continue;
-      const bubble = JSON.parse(brow.value);
-      const role = h.type === 1 ? "user" : "assistant";
-      const text = (bubble.text || "").trim();
-      const ts = bubble.createdAt || null;
-
-      // Tool call bubble (no text but has toolFormerData)
-      const tool = bubble.toolFormerData && bubble.toolFormerData.name
-        ? { name: bubble.toolFormerData.name, args: bubble.toolFormerData.rawArgs || null, status: bubble.toolFormerData.status || null }
-        : null;
-
-      if (!text && !tool) continue;
-      messages.push({ role, text: text || null, tool, ts });
-    }
-
-    db.close();
-    return { name, totalMessages: headers.length, messages };
-  } catch (e) {
-    return { error: e.message };
-  }
-}
-
-const INTERNAL_REQUEST_HEADER = { name: "x-request-source", value: "local" };
-
-// All intercepted domains across all tools
-const TARGET_HOSTS = [
-  "daily-cloudcode-pa.googleapis.com",
-  "cloudcode-pa.googleapis.com",
-  "api.individual.githubcopilot.com",
-];
-
-const LOCAL_PORT = 443;
-const ROUTER_URL = "http://localhost:20128/v1/chat/completions";
-const API_KEY = process.env.ROUTER_API_KEY;
-const { DATA_DIR, MITM_DIR } = require("./paths");
-const DB_FILE = path.join(DATA_DIR, "db.json");
-
-const ENABLE_FILE_LOG = false;
-const CURSOR_LOG_DIR = path.join(__dirname, "../../logs/cursor");
-if (!fs.existsSync(CURSOR_LOG_DIR)) fs.mkdirSync(CURSOR_LOG_DIR, { recursive: true });
-const CURSOR_JSONL = path.join(CURSOR_LOG_DIR, "cursor_messages.jsonl");
-
-const CURSOR_ENDPOINTS = [
-  "/agent.v1.AgentService/RunPoll",
-  "/aiserver.v1.BidiService/BidiAppend",
-  "/agent.v1.AgentService/Run",
-  "/agent.v1.AgentService/RunSSE",
-];
-
-// Mock rules: if last user message contains key → reply with value
-const MOCK_RULES = {
-  "aaa": "bbb",
-};
-
-// conversationId → mock reply (set when AgentRunRequest matches a rule)
-const mockPending = new Map();
-
-/**
- * Decode Connect-RPC frame: [1 byte flags][4 bytes length][protobuf body]
- * Then walk raw protobuf fields and extract readable strings/numbers.
- */
-function decodeConnectFrame(buf) {
-  if (!buf || buf.length < 5) return null;
-  const msgLen = buf.readUInt32BE(1);
-  if (buf.length < 5 + msgLen) return null;
-  return decodeProtoRaw(buf.slice(5, 5 + msgLen));
-}
-
-function decodeProtoRaw(buf, depth = 0) {
-  if (depth > 6) return {};
-  const result = {};
-  let offset = 0;
-  try {
-    while (offset < buf.length) {
-      const tag = readVarint(buf, offset);
-      if (!tag) break;
-      offset += tag.bytes;
-      const fieldNum = tag.value >> 3;
-      const wireType = tag.value & 0x7;
-
-      if (wireType === 0) {
-        // varint
-        const v = readVarint(buf, offset);
-        if (!v) break;
-        offset += v.bytes;
-        result[`f${fieldNum}`] = v.value;
-      } else if (wireType === 2) {
-        // length-delimited: string, bytes, or nested message
-        const lenV = readVarint(buf, offset);
-        if (!lenV) break;
-        offset += lenV.bytes;
-        const data = buf.slice(offset, offset + lenV.value);
-        offset += lenV.value;
-        // Try as UTF-8 string first
-        const str = data.toString("utf8");
-        const isPrintable = /^[\x20-\x7E\n\r\t]*$/.test(str) && str.length > 0;
-        if (isPrintable) {
-          result[`f${fieldNum}`] = str;
-        } else if (data.length > 0 && data.length < 4096) {
-          // Try nested decode
-          const nested = decodeProtoRaw(data, depth + 1);
-          result[`f${fieldNum}`] = Object.keys(nested).length ? nested : data.toString("hex").substring(0, 64);
-        }
-      } else if (wireType === 5) {
-        offset += 4;
-      } else if (wireType === 1) {
-        offset += 8;
-      } else {
-        break;
-      }
-    }
-  } catch { /* best effort */ }
-  return result;
-}
-
-function readVarint(buf, offset) {
-  let value = 0, shift = 0, bytes = 0;
-  while (offset + bytes < buf.length) {
-    const b = buf[offset + bytes++];
-    value |= (b & 0x7f) << shift;
-    shift += 7;
-    if (!(b & 0x80)) return { value, bytes };
-    if (shift >= 28) break;
-  }
-  return null;
-}
-
-const zlib = require("zlib");
-
-/**
- * Deep decode protobuf buffer — returns structured object.
- * Tries to interpret each length-delimited field as:
- *   1. UTF-8 string (if fully printable)
- *   2. Nested proto message (recursive)
- *   3. Hex string fallback
- */
-function deepDecodeProto(buf, depth = 0) {
-  if (depth > 10 || buf.length === 0) return null;
-  const result = {};
-  let off = 0;
-  try {
-    while (off < buf.length) {
-      // Read varint tag
-      let tag = 0, shift = 0;
-      while (off < buf.length) {
-        const b = buf[off++];
-        tag |= (b & 0x7f) << shift;
-        shift += 7;
-        if (!(b & 0x80)) break;
-        if (shift > 28) break;
-      }
-      if (tag === 0) break;
-      const field = tag >> 3;
-      const wire = tag & 7;
-      const key = `f${field}`;
-
-      if (wire === 0) {
-        // varint
-        let v = 0, s = 0;
-        while (off < buf.length) {
-          const b = buf[off++];
-          v |= (b & 0x7f) << s;
-          s += 7;
-          if (!(b & 0x80)) break;
-        }
-        result[key] = v;
-      } else if (wire === 2) {
-        // length-delimited
-        let len = 0, s = 0;
-        while (off < buf.length) {
-          const b = buf[off++];
-          len |= (b & 0x7f) << s;
-          s += 7;
-          if (!(b & 0x80)) break;
-        }
-        if (off + len > buf.length || len < 0) break;
-        const data = buf.slice(off, off + len);
-        off += len;
-
-        if (len === 0) {
-          result[key] = "";
-          continue;
-        }
-
-        // Try UTF-8 string
-        const str = data.toString("utf8");
-        const isPrintable = str.length > 0 && !/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(str);
-        if (isPrintable) {
-          // Accumulate repeated fields as array
-          if (key in result) {
-            result[key] = [].concat(result[key], str);
-          } else {
-            result[key] = str;
-          }
-          continue;
-        }
-
-        // Try nested proto
-        if (len >= 2 && len <= 500000) {
-          const nested = deepDecodeProto(data, depth + 1);
-          if (nested && Object.keys(nested).length > 0) {
-            if (key in result) {
-              result[key] = [].concat(result[key], [nested]);
-            } else {
-              result[key] = nested;
-            }
-            continue;
-          }
-        }
-
-        // Fallback: hex (truncate at 64 bytes)
-        result[key] = data.slice(0, 64).toString("hex");
-      } else if (wire === 5) {
-        off += 4;
-      } else if (wire === 1) {
-        off += 8;
-      } else {
-        break;
-      }
-    }
-  } catch { /* best effort */ }
-  return result;
-}
-
-// ── Proto helpers ──────────────────────────────────────────────
-function protoReadVarint(buf, off) {
-  let v = 0, shift = 0;
-  while (off < buf.length) {
-    const b = buf[off++];
-    v |= (b & 0x7f) << shift;
-    shift += 7;
-    if (!(b & 0x80)) return { v, off };
-    if (shift > 49) break;
-  }
-  return null;
-}
-
-function protoWalkFields(buf) {
-  const fields = [];
-  let off = 0;
-  while (off < buf.length) {
-    const t = protoReadVarint(buf, off);
-    if (!t || t.v === 0) break;
-    off = t.off;
-    const field = t.v >> 3, wire = t.v & 7;
-    if (wire === 0) {
-      const r = protoReadVarint(buf, off);
-      if (!r) break;
-      off = r.off;
-      fields.push({ field, wire, value: r.v });
-    } else if (wire === 2) {
-      const r = protoReadVarint(buf, off);
-      if (!r) break;
-      off = r.off;
-      if (off + r.v > buf.length) break;
-      fields.push({ field, wire, data: buf.slice(off, off + r.v) });
-      off += r.v;
-    } else if (wire === 5) { off += 4; }
-    else if (wire === 1) { off += 8; }
-    else break;
-  }
-  return fields;
-}
-
-function protoStr(buf) {
-  if (!buf || buf.length === 0) return null;
-  const s = buf.toString("utf8");
-  return /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(s) ? null : s;
-}
-
-// ── Schema-aware decoders ──────────────────────────────────────
-
-// BidiAppendRequest: f1=data(hex-encoded AgentClientMessage), f2=requestId{f1=uuid}, f3=seqno
-function decodeBidiAppend(buf) {
-  const fields = protoWalkFields(buf);
-  const result = {};
-  for (const f of fields) {
-    if (f.field === 1 && f.data) {
-      // f1.data is ASCII hex string → decode to actual proto bytes
-      try {
-        const hexStr = f.data.toString("utf8");
-        const protoBytes = Buffer.from(hexStr, "hex");
-        result.agentMsg = decodeAgentClientMsg(protoBytes);
-      } catch { result.agentMsg = { type: "hex_decode_error" }; }
-    } else if (f.field === 2 && f.data) {
-      const inner = protoWalkFields(f.data);
-      const id = inner.find(x => x.field === 1 && x.data);
-      result.requestId = id ? protoStr(id.data) : null;
-    } else if (f.field === 3) result.seqno = f.value;
-  }
-  return result;
-}
-
-// AgentClientMessage oneof: f1=AgentRunRequest, f2=ExecClientMessage, f3=KvClientMessage, f4=ConversationAction, f5=ExecClientControlMessage, f6=InteractionResponse, f7=ClientHeartbeat
-function decodeAgentClientMsg(buf) {
-  const fields = protoWalkFields(buf);
-  for (const f of fields) {
-    // f7=ClientHeartbeat: wire-type 2 but empty (len=0), data is Buffer(0)
-    if (f.field === 7) return { type: "ClientHeartbeat" };
-    if (f.data === undefined || f.data === null) continue;
-    if (f.field === 1 && f.data.length > 0) return { type: "AgentRunRequest", ...decodeAgentRunRequest(f.data) };
-    if (f.field === 2 && f.data.length > 0) return { type: "ExecClientMessage", ...decodeExecClientMessage(f.data) };
-    if (f.field === 3) return { type: "KvClientMessage" };
-    if (f.field === 4 && f.data.length > 0) return { type: "ConversationAction", ...decodeConversationAction(f.data) };
-    if (f.field === 5) return { type: "ExecClientControlMessage" };
-    if (f.field === 6) return { type: "InteractionResponse" };
-  }
-  return { type: "unknown" };
-}
-
-// AgentRunRequest: f1=conversation_state, f2=action, f3=model_details, f4=mcp_tools, f5=conversation_id, f6=mcp_file_system_options, f7=skill_options
-function decodeAgentRunRequest(buf) {
-  const fields = protoWalkFields(buf);
-  const result = {};
-
-  for (const f of fields) {
-    if (f.field === 1 && f.data) result.state = decodeConversationState(f.data);
-    if (f.field === 2 && f.data) result.action = decodeConversationAction(f.data);
-    if (f.field === 3 && f.data) result.model = decodeModelDetails(f.data);
-    if (f.field === 4 && f.data) result.mcpTools = decodeMcpTools(f.data);
-    if (f.field === 5 && f.data) result.conversationId = protoStr(f.data);
-  }
-  return result;
-}
-
-// McpTools: f1=repeated McpDescriptor (f1=serverName, f2=repeated tools)
-function decodeMcpTools(buf) {
-  const fields = protoWalkFields(buf);
-  const descriptors = [];
-  for (const f of fields) {
-    if (f.field === 1 && f.data) {
-      const inner = protoWalkFields(f.data);
-      const name = inner.find(x => x.field === 1 && x.data);
-      const tools = inner.filter(x => x.field === 2 && x.data).map(t => {
-        const tf = protoWalkFields(t.data);
-        const tname = tf.find(x => x.field === 1 && x.data);
-        return tname ? protoStr(tname.data) : null;
-      }).filter(Boolean);
-      descriptors.push({ server: name ? protoStr(name.data) : null, tools });
-    }
-  }
-  return descriptors;
-}
-
-// ExecClientMessage: f1=id(uint32), f2=shellResult, f3=writeResult, etc.
-function decodeExecClientMessage(buf) {
-  const fields = protoWalkFields(buf);
-  const result = { id: null, execId: null, resultType: "unknown" };
-  for (const f of fields) {
-    if (f.field === 1 && f.value !== undefined) result.id = f.value;
-    if (f.field === 15 && f.data) result.execId = protoStr(f.data);
-    // Detect result type by field number (oneof)
-    const resultTypes = { 2: "shellResult", 3: "writeResult", 4: "deleteResult", 5: "grepResult", 7: "readResult", 8: "lsResult", 9: "diagnosticsResult", 10: "requestContextResult", 11: "mcpResult", 14: "shellStream", 16: "backgroundShellSpawnResult" };
-    if (f.data && resultTypes[f.field]) result.resultType = resultTypes[f.field];
-  }
-  return result;
-}
-
-// ModelDetails — scan all string fields
-function decodeModelDetails(buf) {
-  const fields = protoWalkFields(buf);
-  const result = {};
-  for (const f of fields) {
-    if (f.data) {
-      const s = protoStr(f.data);
-      if (s && s.length > 0) result[`f${f.field}`] = s;
-    } else if (f.value !== undefined) {
-      result[`f${f.field}`] = f.value;
-    }
-  }
-  return result;
-}
-
-// ConversationAction: f1=StartChatAction → f1=userMsg{f1=text,f2=uuid,f8=lexical}, f2=history{f2=contextFiles,f7=tools}
-function decodeConversationAction(buf) {
-  const result = {};
-  const topFields = protoWalkFields(buf);
-
-  // action.f1 = StartChatAction wrapper
-  const f1 = topFields.find(f => f.field === 1 && f.data && f.data.length > 0);
-  if (!f1) {
-    // No StartChatAction — show which fields are present for debugging
-    const presentFields = topFields.map(f => `f${f.field}`);
-    if (presentFields.length > 0) result._fields = presentFields;
-    return result;
-  }
-  const f1Fields = protoWalkFields(f1.data);
-
-  // ── User message: action.f1.f1 ──────────────────────────────
-  const f1f1 = f1Fields.find(f => f.field === 1 && f.data);
-  if (f1f1) {
-    for (const f of protoWalkFields(f1f1.data)) {
-      if (!f.data) continue;
-      const s = protoStr(f.data);
-      if (f.field === 1 && s) result.text = s;
-      if (f.field === 2 && s) result.messageId = s;
-      if (f.field === 8 && s) {
-        try {
-          const lex = JSON.parse(s);
-          const texts = [];
-          function extractLexText(node) {
-            if (node?.text) texts.push(node.text);
-            (node?.children || []).forEach(extractLexText);
-          }
-          extractLexText(lex?.root);
-          result.textFull = texts.join("");
-        } catch { result.lexical = s.substring(0, 300); }
-      }
-    }
-  }
-
-  // ── Conversation history: action.f1.f2 ──────────────────────
-  const f1f2 = f1Fields.find(f => f.field === 2 && f.data);
-  if (f1f2) {
-    const histFields = protoWalkFields(f1f2.data);
-
-    // f2 repeated = context files (rules, open files...)
-    result.contextFiles = histFields
-      .filter(f => f.field === 2 && f.data)
-      .map(t => {
-        const tf = protoWalkFields(t.data);
-        const name = tf.find(f => f.field === 1 && f.data);
-        const content = tf.find(f => f.field === 2 && f.data);
-        return {
-          path: name ? protoStr(name.data) : null,
-          content: content ? protoStr(content.data)?.substring(0, 500) : null,
-        };
-      })
-      .filter(x => x.path);
-
-    // f7 repeated = MCP tools
-    result.tools = histFields
-      .filter(f => f.field === 7 && f.data)
-      .map(t => {
-        const tf = protoWalkFields(t.data);
-        const name = tf.find(f => f.field === 1 && f.data);
-        const desc = tf.find(f => f.field === 2 && f.data);
-        return {
-          name: name ? protoStr(name.data) : null,
-          description: desc ? protoStr(desc.data) : null,
-        };
-      })
-      .filter(x => x.name);
-
-  }
-
-  return result;
-}
-
-/**
- * Recursively decode any proto buffer into a plain JS object for debugging.
- * Each field: try UTF-8 string → nested proto → hex fallback.
- * Repeated fields become arrays.
- */
-function protoTreeToObj(buf, depth = 0) {
-  if (depth > 12 || !buf || buf.length === 0) return null;
-  const result = {};
-  const fields = protoWalkFields(buf);
-  for (const f of fields) {
-    const key = `f${f.field}`;
-    let val;
-    if (f.data !== undefined) {
-      const s = protoStr(f.data);
-      if (s !== null) {
-        // Detect hex-encoded proto (BidiAppend.data field)
-        if (/^[0-9a-f]{20,}$/i.test(s)) {
-          try {
-            const dec = protoTreeToObj(Buffer.from(s, "hex"), depth + 1);
-            val = (dec && Object.keys(dec).length > 0) ? dec : s;
-          } catch { val = s; }
-        } else {
-          try { val = JSON.parse(s); } catch { val = s; }
-        }
-      } else if (f.data.length > 0) {
-        const nested = protoTreeToObj(f.data, depth + 1);
-        val = (nested && Object.keys(nested).length > 0)
-          ? nested
-          : f.data.toString("hex");
-      } else {
-        val = "";
-      }
-    } else {
-      val = f.value;
-    }
-    // Accumulate repeated fields as array
-    if (key in result) {
-      result[key] = [].concat(result[key], [val]);
-    } else {
-      result[key] = val;
-    }
-  }
-  return result;
-}
-
-// ConversationStateStructure: f1=root_prompt_messages_json(encrypted bytes), f3=todos, f8=turns, f10=mode
-function decodeConversationState(buf) {
-  const fields = protoWalkFields(buf);
-  const turns = [], todos = [];
-  let mode = null, messageCount = 0;
-  for (const f of fields) {
-    if (f.field === 10 && f.value !== undefined) {
-      const modes = ["unspecified", "agent", "ask", "plan", "debug", "triage"];
-      mode = modes[f.value] || `mode_${f.value}`;
-    }
-    if (!f.data) continue;
-    if (f.field === 1) {
-      // Encrypted bytes — just count, cannot decode
-      messageCount++;
-    } else if (f.field === 8) {
-      // f8 = repeated bytes (ConversationTurn OR encrypted blob)
-      // Encrypted turns: binary blobs that don't parse as valid proto strings
-      if (f.data.length === 32) continue; // 32-byte encrypted blob
-      const inner = protoWalkFields(f.data);
-      const strs = inner.filter(x => x.data).map(x => protoStr(x.data)).filter(s => s && s.length > 3);
-      if (strs.length) turns.push(strs.slice(0, 3));
-    } else if (f.field === 3) {
-      // f3 = repeated bytes (TodoItem OR encrypted blob)
-      // Encrypted: 32-byte binary (shows as 64-char hex in protoStr-reject path)
-      // TodoItem: f1=id(str), f2=content(str), f3=status(varint)
-      if (f.data.length === 32) {
-        // 32 bytes = encrypted blob, skip
-        continue;
-      }
-      const inner = protoWalkFields(f.data);
-      const id = inner.find(x => x.field === 1 && x.data);
-      const content = inner.find(x => x.field === 2 && x.data);
-      const status = inner.find(x => x.field === 3 && x.value !== undefined);
-      const idStr = id ? protoStr(id.data) : null;
-      const contentStr = content ? protoStr(content.data) : null;
-      // If neither id nor content is readable string, it's encrypted
-      if (!idStr && !contentStr) continue;
-      const statusMap = ["unspecified", "pending", "in_progress", "completed", "cancelled"];
-      todos.push({
-        id: idStr,
-        content: contentStr,
-        status: status ? (statusMap[status.value] || `status_${status.value}`) : null,
-      });
-    }
-  }
-  return { mode, messageCount, turns: turns.slice(0, 5), todos: todos.slice(0, 20) };
-}
-
-// ── Save per-chat JSON file ────────────────────────────────────
-// Only logs AgentRunRequest and ExecClientMessage — skips noise (RunPoll, KvClientMessage, ClientHeartbeat...)
-function saveCursorLogFull(url, headers, buf) {
-  try {
-    if (buf.length < 5) return;
-    if (!url.includes("BidiAppend")) return;
-
-    const isGzip = buf[0] === 0x1f && buf[1] === 0x8b;
-    const raw = isGzip ? zlib.gunzipSync(buf) : (buf[0] === 0x00 || buf[0] === 0x01 ? buf.slice(5) : buf);
-
-    const decoded = decodeBidiAppend(raw);
-    const msgType = decoded?.agentMsg?.type;
-
-    // Only log meaningful message types
-    if (msgType !== "AgentRunRequest" && msgType !== "ExecClientMessage") return;
-
-    const action = decoded?.agentMsg?.action || {};
-    const userMessage = action.textFull || action.text || null;
-
-    // Fetch full conversation from DB for AgentRunRequest
-    const conversationId = decoded?.agentMsg?.conversationId || null;
-    let conversation = null;
-    if (conversationId && msgType === "AgentRunRequest") {
-      conversation = readConversationFromDb(conversationId);
-
-      // Check MOCK_RULES against last user message
-      const lastMsg = userMessage || "";
-      for (const [keyword, reply] of Object.entries(MOCK_RULES)) {
-        if (lastMsg.toLowerCase().includes(keyword.toLowerCase())) {
-          mockPending.set(conversationId, reply);
-          console.log(`[MOCK] Triggered rule "${keyword}" → "${reply}" for conv=${conversationId}`);
-          break;
-        }
-      }
-    }
-
-    const ts = new Date().toISOString().replace(/[:.]/g, "-");
-    fs.writeFileSync(
-      path.join(CURSOR_LOG_DIR, `${ts}_${msgType}_chat.json`),
-      JSON.stringify({
-        ts: new Date().toISOString(),
-        type: msgType,
-        version: headers["x-cursor-client-version"] || null,
-        sizeIn: buf.length,
-        userMessage,
-        decoded,
-        conversation,
-      }, null, 2)
-    );
-
-    const convName = conversation?.name ? ` | conv="${conversation.name}" (${conversation.totalMessages} msgs)` : "";
-    console.log(`[CURSOR] ${msgType} | msg=${userMessage || "(none)"}${convName} | ${buf.length}B`);
-  } catch (e) {
-    console.error(`[CURSOR] decode error: ${e.message}`);
-  }
-}
-
-if (!API_KEY) {
-  console.error("❌ ROUTER_API_KEY required");
-  process.exit(1);
-}
-
-const { getCertForDomain } = require("./cert/generate");
-
-// Certificate cache for performance
-const certCache = new Map();
-
-// SNI callback for dynamic certificate generation
-function sniCallback(servername, cb) {
-  try {
-    // Check cache first
-    if (certCache.has(servername)) {
-      const cached = certCache.get(servername);
-      return cb(null, cached);
-    }
-
-    // Generate new cert for this domain
-    const certData = getCertForDomain(servername);
-    if (!certData) {
-      return cb(new Error(`Failed to generate cert for ${servername}`));
-    }
-
-    // Create secure context
-    const ctx = require("tls").createSecureContext({
-      key: certData.key,
-      cert: certData.cert
-    });
-
-    // Cache it
-    certCache.set(servername, ctx);
-    console.log(`✅ Generated cert for: ${servername}`);
-
-    cb(null, ctx);
-  } catch (error) {
-    console.error(`❌ SNI error for ${servername}:`, error.message);
-    cb(error);
-  }
-}
-
-// Load Root CA for default context
-const certDir = MITM_DIR;
-const rootCAKeyPath = path.join(certDir, "rootCA.key");
-const rootCACertPath = path.join(certDir, "rootCA.crt");
-
-let sslOptions;
-try {
-  sslOptions = {
-    key: fs.readFileSync(rootCAKeyPath),
-    cert: fs.readFileSync(rootCACertPath),
-    SNICallback: sniCallback
-  };
-} catch (e) {
-  console.error(`❌ Root CA not found in ${certDir}: ${e.message}`);
-  process.exit(1);
-}
-
-// Antigravity: Gemini generateContent endpoints
-const ANTIGRAVITY_URL_PATTERNS = [":generateContent", ":streamGenerateContent"];
-// Copilot: OpenAI-compatible + Anthropic endpoints
-const COPILOT_URL_PATTERNS = ["/chat/completions", "/v1/messages", "/responses"];
-
-const LOG_DIR = path.join(__dirname, "../../logs/mitm");
-if (ENABLE_FILE_LOG && !fs.existsSync(LOG_DIR)) fs.mkdirSync(LOG_DIR, { recursive: true });
-
-function saveRequestLog(url, bodyBuffer) {
-  if (!ENABLE_FILE_LOG) return;
-  try {
-    const ts = new Date().toISOString().replace(/[:.]/g, "-");
-    const urlSlug = url.replace(/[^a-zA-Z0-9]/g, "_").substring(0, 60);
-    const filePath = path.join(LOG_DIR, `${ts}_${urlSlug}.json`);
-    const body = JSON.parse(bodyBuffer.toString());
-    fs.writeFileSync(filePath, JSON.stringify(body, null, 2));
-  } catch { /* ignore */ }
-}
-
-const cachedTargetIPs = {};
-async function resolveTargetIP(hostname) {
-  if (cachedTargetIPs[hostname]) return cachedTargetIPs[hostname];
-  const resolver = new dns.Resolver();
-  resolver.setServers(["8.8.8.8"]);
-  const resolve4 = promisify(resolver.resolve4.bind(resolver));
-  const addresses = await resolve4(hostname);
-  cachedTargetIPs[hostname] = addresses[0];
-  return cachedTargetIPs[hostname];
-}
-
-function collectBodyRaw(req) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    req.on("data", chunk => chunks.push(chunk));
-    req.on("end", () => resolve(Buffer.concat(chunks)));
-    req.on("error", reject);
-  });
-}
-
-// Extract model from URL path (Gemini) or body (OpenAI/Anthropic)
-function extractModel(url, body) {
-  const urlMatch = url.match(/\/models\/([^/:]+)/);
-  if (urlMatch) return urlMatch[1];
-  try { return JSON.parse(body.toString()).model || null; } catch { return null; }
-}
-
-function getMappedModel(tool, model) {
-  if (!model) return null;
-  try {
-    if (!fs.existsSync(DB_FILE)) return null;
-    const db = JSON.parse(fs.readFileSync(DB_FILE, "utf-8"));
-    return db.mitmAlias?.[tool]?.[model] || null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Determine which tool this request belongs to based on hostname
- */
-function getToolForHost(host) {
-  const h = (host || "").split(":")[0];
-  if (h === "api.individual.githubcopilot.com") return "copilot";
-  if (h === "daily-cloudcode-pa.googleapis.com" || h === "cloudcode-pa.googleapis.com") return "antigravity";
-  return null;
-}
-
-/**
- * Encode a single protobuf length-delimited field: (fieldNum << 3 | wireType) + varint(len) + bytes
- * wireType 2 = length-delimited, wireType 0 = varint
- */
-function protoEncodeField(fieldNum, wireType, data) {
-  const tag = (fieldNum << 3) | wireType;
-  const tagBuf = encodeVarint(tag);
-  if (wireType === 2) {
-    const lenBuf = encodeVarint(data.length);
-    return Buffer.concat([tagBuf, lenBuf, data]);
-  }
-  // wireType 0: data is already a varint buffer
-  return Buffer.concat([tagBuf, data]);
-}
-
-function encodeVarint(n) {
-  const bufs = [];
-  while (n > 0x7f) {
-    bufs.push((n & 0x7f) | 0x80);
-    n >>>= 7;
-  }
-  bufs.push(n & 0x7f);
-  return Buffer.from(bufs);
-}
-
-/**
- * Build a Connect-RPC streaming frame: [flags=0][4-byte big-endian length][body]
- */
-function buildConnectFrame(body) {
-  const lenBuf = Buffer.alloc(4);
-  lenBuf.writeUInt32BE(body.length, 0);
-  return Buffer.concat([Buffer.from([0x00]), lenBuf, body]);
-}
-
-/**
- * Build one gzip-compressed Connect-RPC data frame containing a BidiPollResponse.
- * BidiPollResponse: f1=seqno(varint), f2=data(hex string of AgentServerMessage)
- * AgentServerMessage.f1 = InteractionUpdate.f1 = TextDeltaUpdate.f1 = text
- */
-function buildFakePollFrame(text, seqno) {
-  const zlib = require("zlib");
-
-  // TextDeltaUpdate { f1: text }
-  const textDelta = protoEncodeField(1, 2, Buffer.from(text, "utf8"));
-  // InteractionUpdate { f1: TextDeltaUpdate }
-  const interactionUpdate = protoEncodeField(1, 2, textDelta);
-  // AgentServerMessage { f1: InteractionUpdate }
-  const agentMsg = protoEncodeField(1, 2, interactionUpdate);
-
-  // BidiPollResponse { f1: seqno, f2: hex(agentMsg) }
-  let pollResp = protoEncodeField(1, 0, encodeVarint(seqno));
-  pollResp = Buffer.concat([pollResp, protoEncodeField(2, 2, Buffer.from(agentMsg.toString("hex"), "utf8"))]);
-
-  // Gzip compress (flags=1)
-  const compressed = zlib.gzipSync(pollResp);
-  const lenBuf = Buffer.alloc(4);
-  lenBuf.writeUInt32BE(compressed.length, 0);
-  return Buffer.concat([Buffer.from([0x01]), lenBuf, compressed]);
-}
-
-/**
- * Build Connect-RPC end-of-stream trailer frame: flags=0x02, body={}
- */
-function buildTrailerFrame() {
-  const body = Buffer.from("{}", "utf8");
-  const lenBuf = Buffer.alloc(4);
-  lenBuf.writeUInt32BE(body.length, 0);
-  return Buffer.concat([Buffer.from([0x02]), lenBuf, body]);
-}
-
-/**
- * Send fake RunPoll response matching real Cursor server format
- */
-function sendMockResponse(res, replyText) {
-  res.writeHead(200, {
-    "content-type": "application/connect+proto",
-    "transfer-encoding": "chunked",
-  });
-
-  // Send text as single frame + trailer
-  res.write(buildFakePollFrame(replyText, 1));
-  res.write(buildTrailerFrame());
-  res.end();
-  console.log(`[MOCK] RunPoll → "${replyText}"`);
-}
-
-async function passthrough(req, res, bodyBuffer, captureFile = null) {
-  const targetHost = (req.headers.host || TARGET_HOSTS[0]).split(":")[0];
-  const targetIP = await resolveTargetIP(targetHost);
-
-  const forwardReq = https.request({
-    hostname: targetIP,
-    port: 443,
-    path: req.url,
-    method: req.method,
-    headers: { ...req.headers, host: targetHost },
-    servername: targetHost,
-    rejectUnauthorized: false
-  }, (forwardRes) => {
-    // Log headers + first frame raw bytes of first RunPoll response for mock calibration
-    if (req.url.includes("RunPoll") && !passthrough._loggedRunPollHeaders) {
-      passthrough._loggedRunPollHeaders = true;
-      console.log("[DBG] RunPoll headers:", JSON.stringify(forwardRes.headers));
-      const origWrite = res.write.bind(res);
-      let logged = false;
-      res.write = function(chunk) {
-        if (!logged) {
-          logged = true;
-          console.log("[DBG] RunPoll first chunk hex:", Buffer.isBuffer(chunk) ? chunk.slice(0, 80).toString("hex") : Buffer.from(chunk).slice(0, 80).toString("hex"));
-        }
-        return origWrite(chunk);
-      };
-    }
-    res.writeHead(forwardRes.statusCode, forwardRes.headers);
-
-    if (!captureFile) {
-      forwardRes.pipe(res);
-      return;
-    }
-
-    // Tee response: forward to client AND decode+save to file
-    const chunks = [];
-    forwardRes.on("data", chunk => {
-      chunks.push(chunk);
-      res.write(chunk);
-    });
-    forwardRes.on("end", () => {
-      res.end();
-      try {
-        const raw = Buffer.concat(chunks);
-        // Save first RunPoll raw that has text (frames > 20)
-        if (req.url.includes("RunPoll") && !passthrough._savedTextRaw && frameCount > 20) {
-          passthrough._savedTextRaw = true;
-          fs.writeFileSync(path.join(CURSOR_LOG_DIR, "_runpoll_text_raw.hex"), raw.toString("hex"));
-          console.log("[DBG] RunPoll TEXT raw saved, len=", raw.length, "frames=", frameCount);
-        }
-        // Decode Connect-RPC streaming frames: each frame = [1B flags][4B len][proto body]
-        const textChunks = [];
-        const toolCalls = [];
-        let frameCount = 0;
-        let offset = 0;
-
-        while (offset + 5 <= raw.length) {
-          const flags = raw[offset];
-          const msgLen = raw.readUInt32BE(offset + 1);
-          if (offset + 5 + msgLen > raw.length) break;
-          let body = raw.slice(offset + 5, offset + 5 + msgLen);
-          offset += 5 + msgLen;
-          frameCount++;
-
-          // Decompress gzip frame (flags=1)
-          if (flags === 1) {
-            try { body = zlib.gunzipSync(body); } catch { continue; }
-          }
-
-          // BidiPollResponse: f1=seqno(varint), f2=data(hex-encoded AgentServerMessage)
-          const pollFields = protoWalkFields(body);
-          const dataField = pollFields.find(f => f.field === 2 && f.data);
-          if (!dataField) continue;
-
-          // f2.data is ASCII hex string → decode to actual AgentServerMessage bytes
-          const hexStr = dataField.data.toString("utf8");
-          if (!/^[0-9a-f]+$/i.test(hexStr)) continue;
-          const agentMsg = Buffer.from(hexStr, "hex");
-
-          // AgentServerMessage: f1=InteractionUpdate, f2=ExecServerMessage
-          const agentFields = protoWalkFields(agentMsg);
-
-          // f1 = InteractionUpdate → f1=TextDeltaUpdate.f1=text
-          const interactionUpdate = agentFields.find(f => f.field === 1 && f.data);
-          if (interactionUpdate) {
-            const iuFields = protoWalkFields(interactionUpdate.data);
-            const textDelta = iuFields.find(f => f.field === 1 && f.data);
-            if (textDelta) {
-              const tdFields = protoWalkFields(textDelta.data);
-              const textField = tdFields.find(f => f.field === 1 && f.data);
-              if (textField) {
-                const text = textField.data.toString("utf8");
-                if (text.length > 0) textChunks.push(text);
-              }
-            }
-          }
-
-          // f2 = ExecServerMessage → decode tool call
-          // ExecServerMessage: f1=id(varint), f15=exec_id(str), f2=shell, f3=write, f4=delete, f5=grep, f7=read, f8=ls
-          const execMsg = agentFields.find(f => f.field === 2 && f.data);
-          if (execMsg) {
-            const execFields = protoWalkFields(execMsg.data);
-            const toolFieldMap = { 2: "shell", 3: "write", 4: "delete", 5: "grep", 7: "read", 8: "ls", 11: "mcp", 14: "shell_stream", 20: "fetch" };
-            const toolField = execFields.find(f => toolFieldMap[f.field] && f.data);
-            if (toolField) {
-              const toolName = toolFieldMap[toolField.field];
-              // Extract first string field as main arg (command/path)
-              const argFields = protoWalkFields(toolField.data);
-              const mainArg = argFields.find(f => f.field === 1 && f.data);
-              const arg = mainArg ? mainArg.data.toString("utf8") : null;
-              toolCalls.push({ tool: toolName, arg });
-            }
-          }
-        }
-
-        const assembled = textChunks.length > 0 ? textChunks.join("") : null;
-        // Only save file if there's actual content
-        if (assembled || toolCalls.length > 0) {
-          const entry = { ts: new Date().toISOString(), frames: frameCount };
-          if (assembled) entry.text = assembled;
-          if (toolCalls.length > 0) entry.tools = toolCalls;
-          fs.writeFileSync(captureFile, JSON.stringify(entry, null, 2));
-          const toolSummary = toolCalls.map(t => `${t.tool}(${(t.arg || "").slice(0, 40)})`).join(", ");
-          const preview = assembled ? `"${assembled.slice(0, 80)}"` : "";
-          console.log(`[CURSOR] RunPoll ← ${preview}${toolSummary ? ` [${toolSummary}]` : ""}`);
-        }
-      } catch { /* ignore */ }
-    });
-  });
-
-  forwardReq.on("error", (err) => {
-    console.error(`❌ Passthrough error: ${err.message}`);
-    if (!res.headersSent) res.writeHead(502);
-    res.end("Bad Gateway");
-  });
-
-  if (bodyBuffer.length > 0) forwardReq.write(bodyBuffer);
-  forwardReq.end();
-}
-
-async function intercept(req, res, bodyBuffer, mappedModel) {
-  try {
-    const body = JSON.parse(bodyBuffer.toString());
-    body.model = mappedModel;
-
-    const response = await fetch(ROUTER_URL, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Authorization": `Bearer ${API_KEY}`
-      },
-      body: JSON.stringify(body)
-    });
-
-    if (!response.ok) {
-      const errText = await response.text().catch(() => "");
-      throw new Error(`9Router ${response.status}: ${errText}`);
-    }
-
-    const ct = response.headers.get("content-type") || "application/json";
-    const resHeaders = { "Content-Type": ct, "Cache-Control": "no-cache", "Connection": "keep-alive" };
-    if (ct.includes("text/event-stream")) resHeaders["X-Accel-Buffering"] = "no";
-    res.writeHead(200, resHeaders);
-
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) { res.end(); break; }
-      res.write(decoder.decode(value, { stream: true }));
-    }
-  } catch (error) {
-    console.error(`❌ ${error.message}`);
-    if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: { message: error.message, type: "mitm_error" } }));
-  }
-}
-
-const server = https.createServer(sslOptions, async (req, res) => {
-  if (req.url === "/_mitm_health") {
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ ok: true, pid: process.pid }));
-    return;
-  }
-
-  console.log(`[MITM] ${req.method} https://${req.headers.host}${req.url}`);
-
-  const bodyBuffer = await collectBodyRaw(req);
-  if (bodyBuffer.length > 0) saveRequestLog(req.url, bodyBuffer);
-
-  // Decode and log Cursor protobuf request endpoints
-  if (CURSOR_ENDPOINTS.some(e => req.url.includes(e))) {
-    saveCursorLogFull(req.url, req.headers, bodyBuffer);
-  }
-
-  // Capture response of RunPoll (server streams BidiPollResponse chunks back)
-  const isRunPoll = req.url.includes("RunPoll");
-  if (isRunPoll) {
-    // Check if there's a mock rule pending for this conversation
-    // Extract conversationId from BidiPollRequest.f1 (BidiRequestId) → need to check mockPending
-    // Simple approach: check all pending mocks and reply for any RunPoll within same session
-    // Since mockPending is keyed by conversationId and RunPoll doesn't carry it directly,
-    // we intercept the first RunPoll after a matching AgentRunRequest by checking pendingQueue
-    if (mockPending.size > 0) {
-      // Pick the first pending mock (FIFO) — matches the most recent matching conversation
-      const [convId, replyText] = mockPending.entries().next().value;
-      mockPending.delete(convId);
-      return sendMockResponse(res, replyText);
-    }
-
-    const ts = new Date().toISOString().replace(/[:.]/g, "-");
-    const captureFile = path.join(CURSOR_LOG_DIR, `${ts}_RunPoll_response.json`);
-    return passthrough(req, res, bodyBuffer, captureFile);
-  }
-
-  // Anti-loop: requests originating from 9Router bypass interception
-  if (req.headers[INTERNAL_REQUEST_HEADER.name] === INTERNAL_REQUEST_HEADER.value) {
-    return passthrough(req, res, bodyBuffer);
-  }
-
-  const tool = getToolForHost(req.headers.host);
-  if (!tool) return passthrough(req, res, bodyBuffer);
-
-  // Check if this URL should be intercepted based on tool
-  const isChat = tool === "antigravity"
-    ? ANTIGRAVITY_URL_PATTERNS.some(p => req.url.includes(p))
-    : COPILOT_URL_PATTERNS.some(p => req.url.includes(p));
-
-  if (!isChat) return passthrough(req, res, bodyBuffer);
-
-  const model = extractModel(req.url, bodyBuffer);
-  console.log("Extracted model:",  model)
-  const mappedModel = getMappedModel(tool, model);
-
-  if (!mappedModel) return passthrough(req, res, bodyBuffer);
-
-  return intercept(req, res, bodyBuffer, mappedModel);
-});
-
-server.listen(LOCAL_PORT, () => {
-  console.log(`🚀 MITM ready on :${LOCAL_PORT}`);
-});
-
-server.on("error", (error) => {
-  if (error.code === "EADDRINUSE") {
-    console.error(`❌ Port ${LOCAL_PORT} already in use`);
-  } else if (error.code === "EACCES") {
-    console.error(`❌ Permission denied for port ${LOCAL_PORT}`);
-  } else {
-    console.error(`❌ ${error.message}`);
-  }
-  process.exit(1);
-});
-
-const shutdown = () => { server.close(() => process.exit(0)); };
-process.on("SIGTERM", shutdown);
-process.on("SIGINT", shutdown);
-if (process.platform === "win32") {
-  process.on("SIGBREAK", shutdown);
-}