9router 0.3.6 → 0.3.7

package/app/src/mitm/manager.js

@@ -12,8 +12,6 @@ const { generateCert } = require("./cert/generate");
 const { installCert } = require("./cert/install");
 
 const MITM_PORT = 443;
-// On Windows, node listens on HIGH_PORT and netsh portproxy forwards 443 → HIGH_PORT
-const WIN_NODE_PORT = 8443;
 const PID_FILE = path.join(os.homedir(), ".9router", "mitm", ".mitm.pid");
 
 // Resolve server.js path robustly:
@@ -278,7 +276,7 @@ async function killLeftoverMitm(sudoPassword) {
  * Returns { ok, pid } on success, null on timeout.
  */
 function pollMitmHealth(timeoutMs) {
-  const healthPort = IS_WIN ? WIN_NODE_PORT : MITM_PORT;
+  const healthPort = MITM_PORT;
   return new Promise((resolve) => {
     const deadline = Date.now() + timeoutMs;
     const check = () => {
@@ -415,38 +413,42 @@ async function startMitm(apiKey, sudoPassword) {
     const esc = (s) => s.replace(/'/g, "''");
     const certPsPath = esc(certPath);
     const hostsPsPath = esc(hostsFile);
+    const nodePsPath = esc(process.execPath);
+    const serverPsPath = esc(SERVER_PATH);
 
     const dnsAddLines = TARGET_HOSTS_WIN.map(h =>
       `if (-not (Select-String -Path '${hostsPsPath}' -Pattern '${h}' -Quiet)) { Add-Content -Path '${hostsPsPath}' -Value "127.0.0.1 ${h}" }`
     ).join("\n");
 
-    // Phase 1: single UAC — cert + DNS + netsh urlacl + netsh portproxy
+    // Single elevated script: cert + DNS + urlacl (allow node to bind 443) + start node
+    // urlacl grants non-admin processes permission to bind port 443 via HTTP.sys
     const setupScript = `
-# 1. Install cert if not already in Root store
+# 1. Install cert to Root store if not present
 $certCheck = & certutil -store Root 'daily-cloudcode-pa.googleapis.com' 2>&1
 if ($LASTEXITCODE -ne 0) {
   & certutil -addstore Root '${certPsPath}' | Out-Null
 }
 
-# 2. Add DNS entries
+# 2. Add DNS entries to hosts file
 ${dnsAddLines}
 & ipconfig /flushdns | Out-Null
 
-# 3. Allow node to bind port ${WIN_NODE_PORT} without admin
-& netsh http add urlacl url=https://+:${WIN_NODE_PORT}/ user=Everyone | Out-Null
+# 3. Grant permission for any user to bind HTTPS port 443 (no admin needed after this)
+& netsh http add urlacl url=https://+:${MITM_PORT}/ user=Everyone 2>&1 | Out-Null
 
-# 4. Forward :443 → :${WIN_NODE_PORT} (portproxy)
-& netsh interface portproxy delete v4tov4 listenport=${MITM_PORT} listenaddress=0.0.0.0 2>&1 | Out-Null
-& netsh interface portproxy add v4tov4 listenport=${MITM_PORT} listenaddress=0.0.0.0 connectport=${WIN_NODE_PORT} connectaddress=127.0.0.1 | Out-Null
+# 4. Start node MITM server (now allowed to bind 443 without admin)
+$env:ROUTER_API_KEY = '${esc(apiKey)}'
+$env:NODE_ENV = 'production'
+Start-Process -FilePath '${nodePsPath}' -ArgumentList '"${serverPsPath}"' -WindowStyle Hidden
 `.trim();
 
     const tmpSetup = path.join(os.tmpdir(), `mitm_setup_${Date.now()}.ps1`);
     fs.writeFileSync(tmpSetup, setupScript, "utf8");
 
-    // Run elevated setup — single UAC prompt, wait for completion
+    // Outer spawn WITHOUT -NonInteractive so UAC dialog can appear
     await new Promise((resolve, reject) => {
       const setupProc = spawn("powershell", [
-        "-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden",
+        "-NoProfile", "-WindowStyle", "Hidden",
         "-Command",
         `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpSetup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpSetup)}' -ErrorAction SilentlyContinue`
       ], { stdio: "ignore", windowsHide: true });
@@ -456,14 +458,9 @@ ${dnsAddLines}
 
     if (_updateSettings) await _updateSettings({ mitmCertInstalled: true }).catch(() => { });
 
-    // Phase 2: start node server on WIN_NODE_PORT — no admin needed
-    serverProcess = spawn(process.execPath, [SERVER_PATH], {
-      env: { ...process.env, ROUTER_API_KEY: apiKey, NODE_ENV: "production", MITM_PORT: String(WIN_NODE_PORT) },
-      stdio: "ignore",
-      windowsHide: true,
-      detached: true,
-    });
-    serverProcess.unref();
+    // serverProcess reference not available (started inside elevated script)
+    // PID will be captured from health check response
+    serverProcess = { pid: null, killed: false };
   } else {
     // macOS/Linux: install cert + add DNS (requires sudo), then spawn server
     const settings = _getSettings ? await _getSettings().catch(() => ({})) : {};
@@ -486,8 +483,8 @@ ${dnsAddLines}
     serverProcess.stdin.end();
   }
 
-  serverPid = serverProcess.pid;
-  fs.writeFileSync(PID_FILE, String(serverPid));
+  serverPid = IS_WIN ? null : serverProcess.pid;
+  if (serverPid) fs.writeFileSync(PID_FILE, String(serverPid));
 
   let startError = null;
   if (!IS_WIN) {
@@ -564,24 +561,37 @@ async function stopMitm(sudoPassword) {
   }
 
   if (IS_WIN) {
-    // Cleanup netsh portproxy + urlacl — single UAC prompt
+    // Cleanup: remove DNS entries + urlacl — single UAC prompt
+    const hostsFile = path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts");
+    const TARGET_HOSTS_WIN = ["daily-cloudcode-pa.googleapis.com", "cloudcode-pa.googleapis.com"];
+    const esc = (s) => s.replace(/'/g, "''");
+    const hostsPsPath = esc(hostsFile);
+
+    const content = fs.readFileSync(hostsFile, "utf8");
+    const filtered = content.split(/\r?\n/).filter(l => !TARGET_HOSTS_WIN.some(h => l.includes(h))).join("\r\n");
+    const tmpHosts = path.join(os.tmpdir(), "hosts_filtered.tmp");
+    fs.writeFileSync(tmpHosts, filtered, "utf8");
+
     const cleanupScript = `
-& netsh interface portproxy delete v4tov4 listenport=${MITM_PORT} listenaddress=0.0.0.0 2>&1 | Out-Null
-& netsh http delete urlacl url=https://+:${WIN_NODE_PORT}/ 2>&1 | Out-Null
+# Remove DNS entries
+Copy-Item -Path '${esc(tmpHosts)}' -Destination '${hostsPsPath}' -Force
+& ipconfig /flushdns | Out-Null
+Remove-Item '${esc(tmpHosts)}' -ErrorAction SilentlyContinue
+
+# Remove urlacl
+& netsh http delete urlacl url=https://+:${MITM_PORT}/ 2>&1 | Out-Null
 `.trim();
     const tmpCleanup = path.join(os.tmpdir(), `mitm_cleanup_${Date.now()}.ps1`);
     fs.writeFileSync(tmpCleanup, cleanupScript, "utf8");
-    const esc = (s) => s.replace(/'/g, "''");
     await new Promise((resolve) => {
       const p = spawn("powershell", [
-        "-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden",
+        "-NoProfile", "-WindowStyle", "Hidden",
         "-Command",
         `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpCleanup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpCleanup)}' -ErrorAction SilentlyContinue`
       ], { stdio: "ignore", windowsHide: true });
       p.on("close", resolve);
       p.on("error", resolve);
     });
-    await removeDNSEntry(sudoPassword);
   } else {
     console.log("Removing DNS entry...");
     await removeDNSEntry(sudoPassword);

package/app/src/mitm/server.js

@@ -11,7 +11,7 @@ const TARGET_HOSTS = [
   "daily-cloudcode-pa.googleapis.com",
   "cloudcode-pa.googleapis.com"
 ];
-const LOCAL_PORT = parseInt(process.env.MITM_PORT || "443", 10);
+const LOCAL_PORT = 443;
 const ROUTER_URL = "http://localhost:20128/v1/chat/completions";
 const API_KEY = process.env.ROUTER_API_KEY;
 const DB_FILE = path.join(os.homedir(), ".9router", "db.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "9router",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "9Router CLI - Start and manage 9Router server",
   "bin": {
     "9router": "./cli.js"