9router 0.3.6 → 0.3.8

package/app/src/mitm/manager.js

@@ -12,8 +12,6 @@ const { generateCert } = require("./cert/generate");
 const { installCert } = require("./cert/install");
 
 const MITM_PORT = 443;
-// On Windows, node listens on HIGH_PORT and netsh portproxy forwards 443 → HIGH_PORT
-const WIN_NODE_PORT = 8443;
 const PID_FILE = path.join(os.homedir(), ".9router", "mitm", ".mitm.pid");
 
 // Resolve server.js path robustly:
@@ -278,12 +276,11 @@ async function killLeftoverMitm(sudoPassword) {
  * Returns { ok, pid } on success, null on timeout.
  */
 function pollMitmHealth(timeoutMs) {
-  const healthPort = IS_WIN ? WIN_NODE_PORT : MITM_PORT;
   return new Promise((resolve) => {
     const deadline = Date.now() + timeoutMs;
     const check = () => {
       const req = https.request(
-        { hostname: "127.0.0.1", port: healthPort, path: "/_mitm_health", method: "GET", rejectUnauthorized: false },
+        { hostname: "127.0.0.1", port: 443, path: "/_mitm_health", method: "GET", rejectUnauthorized: false },
         (res) => {
           let body = "";
           res.on("data", (d) => { body += d; });
@@ -416,52 +413,56 @@ async function startMitm(apiKey, sudoPassword) {
     const certPsPath = esc(certPath);
     const hostsPsPath = esc(hostsFile);
 
-    const dnsAddLines = TARGET_HOSTS_WIN.map(h =>
-      `if (-not (Select-String -Path '${hostsPsPath}' -Pattern '${h}' -Quiet)) { Add-Content -Path '${hostsPsPath}' -Value "127.0.0.1 ${h}" }`
-    ).join("\n");
+    // Check if one-time setup is already done (urlacl granted + cert installed + DNS added)
+    const settings = _getSettings ? await _getSettings().catch(() => ({})) : {};
+    const setupDone = settings.mitmWinSetupDone && fs.existsSync(certPath) && checkDNSEntry();
+
+    if (!setupDone) {
+      // Phase 1: single UAC prompt — cert + DNS + netsh urlacl (one-time setup)
+      const dnsAddLines = TARGET_HOSTS_WIN.map(h =>
+        `if (-not (Select-String -Path '${hostsPsPath}' -Pattern '${h}' -Quiet)) { Add-Content -Path '${hostsPsPath}' -Value "127.0.0.1 ${h}" }`
+      ).join("\n");
 
-    // Phase 1: single UAC — cert + DNS + netsh urlacl + netsh portproxy
-    const setupScript = `
-# 1. Install cert if not already in Root store
+      const setupScript = `
+# 1. Install cert to Root store
 $certCheck = & certutil -store Root 'daily-cloudcode-pa.googleapis.com' 2>&1
-if ($LASTEXITCODE -ne 0) {
-  & certutil -addstore Root '${certPsPath}' | Out-Null
-}
+if ($LASTEXITCODE -ne 0) { & certutil -addstore Root '${certPsPath}' | Out-Null }
 
 # 2. Add DNS entries
 ${dnsAddLines}
 & ipconfig /flushdns | Out-Null
 
-# 3. Allow node to bind port ${WIN_NODE_PORT} without admin
-& netsh http add urlacl url=https://+:${WIN_NODE_PORT}/ user=Everyone | Out-Null
-
-# 4. Forward :443 → :${WIN_NODE_PORT} (portproxy)
-& netsh interface portproxy delete v4tov4 listenport=${MITM_PORT} listenaddress=0.0.0.0 2>&1 | Out-Null
-& netsh interface portproxy add v4tov4 listenport=${MITM_PORT} listenaddress=0.0.0.0 connectport=${WIN_NODE_PORT} connectaddress=127.0.0.1 | Out-Null
+# 3. Grant current user permission to bind port 443 (no more UAC needed after this)
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+& netsh http add urlacl url=https://+:443/ sddl="D:(A;;GX;;;$sid)" | Out-Null
 `.trim();
 
-    const tmpSetup = path.join(os.tmpdir(), `mitm_setup_${Date.now()}.ps1`);
-    fs.writeFileSync(tmpSetup, setupScript, "utf8");
-
-    // Run elevated setup — single UAC prompt, wait for completion
-    await new Promise((resolve, reject) => {
-      const setupProc = spawn("powershell", [
-        "-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden",
-        "-Command",
-        `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpSetup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpSetup)}' -ErrorAction SilentlyContinue`
-      ], { stdio: "ignore", windowsHide: true });
-      setupProc.on("close", () => resolve());
-      setupProc.on("error", reject);
-    });
+      const tmpSetup = path.join(os.tmpdir(), `mitm_setup_${Date.now()}.ps1`);
+      fs.writeFileSync(tmpSetup, setupScript, "utf8");
+
+      // Run elevated — this is the ONLY UAC prompt
+      await new Promise((resolve, reject) => {
+        const launcher = spawn("powershell", [
+          "-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden",
+          "-Command",
+          `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpSetup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpSetup)}' -ErrorAction SilentlyContinue`
+        ], { stdio: "ignore", windowsHide: true });
+        launcher.on("close", (code) => {
+          if (code === 0) resolve();
+          else reject(new Error(`Setup script failed with code ${code}`));
+        });
+        launcher.on("error", reject);
+      });
 
-    if (_updateSettings) await _updateSettings({ mitmCertInstalled: true }).catch(() => { });
+      if (_updateSettings) await _updateSettings({ mitmWinSetupDone: true, mitmCertInstalled: true }).catch(() => { });
+    }
 
-    // Phase 2: start node server on WIN_NODE_PORT — no admin needed
+    // Phase 2: spawn node directly — no UAC needed (urlacl already granted)
     serverProcess = spawn(process.execPath, [SERVER_PATH], {
-      env: { ...process.env, ROUTER_API_KEY: apiKey, NODE_ENV: "production", MITM_PORT: String(WIN_NODE_PORT) },
+      detached: true,
       stdio: "ignore",
       windowsHide: true,
-      detached: true,
+      env: { ...process.env, ROUTER_API_KEY: apiKey, NODE_ENV: "production" },
     });
     serverProcess.unref();
   } else {
@@ -511,7 +512,8 @@ ${dnsAddLines}
   }
 
   // Wait for server to be ready by polling health endpoint
-  const health = await pollMitmHealth(IS_WIN ? 12000 : 8000);
+  // Windows: allow extra time for urlacl setup + node startup on first run
+  const health = await pollMitmHealth(IS_WIN ? 20000 : 8000);
 
   if (!health) {
     if (IS_WIN) serverProcess = null;
@@ -522,7 +524,10 @@ ${dnsAddLines}
     throw new Error(`MITM server failed to start. ${reason}`);
   }
 
-  // On Windows, use real PID from health check (node detached, serverProcess.pid may differ)
+  // On Windows, mark cert as installed after successful start
+  if (IS_WIN && _updateSettings) await _updateSettings({ mitmCertInstalled: true }).catch(() => { });
+
+  // On Windows, use real PID from health check (launcher exits immediately after UAC)
   if (IS_WIN && health.pid) {
     serverPid = health.pid;
     fs.writeFileSync(PID_FILE, String(serverPid));
@@ -563,32 +568,14 @@ async function stopMitm(sudoPassword) {
     serverPid = null;
   }
 
-  if (IS_WIN) {
-    // Cleanup netsh portproxy + urlacl — single UAC prompt
-    const cleanupScript = `
-& netsh interface portproxy delete v4tov4 listenport=${MITM_PORT} listenaddress=0.0.0.0 2>&1 | Out-Null
-& netsh http delete urlacl url=https://+:${WIN_NODE_PORT}/ 2>&1 | Out-Null
-`.trim();
-    const tmpCleanup = path.join(os.tmpdir(), `mitm_cleanup_${Date.now()}.ps1`);
-    fs.writeFileSync(tmpCleanup, cleanupScript, "utf8");
-    const esc = (s) => s.replace(/'/g, "''");
-    await new Promise((resolve) => {
-      const p = spawn("powershell", [
-        "-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden",
-        "-Command",
-        `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpCleanup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpCleanup)}' -ErrorAction SilentlyContinue`
-      ], { stdio: "ignore", windowsHide: true });
-      p.on("close", resolve);
-      p.on("error", resolve);
-    });
-    await removeDNSEntry(sudoPassword);
-  } else {
-    console.log("Removing DNS entry...");
-    await removeDNSEntry(sudoPassword);
-  }
+  console.log("Removing DNS entry...");
+  await removeDNSEntry(sudoPassword);
 
   try { fs.unlinkSync(PID_FILE); } catch { /* ignore */ }
 
+  // Reset win setup flag so DNS gets re-added on next start
+  if (IS_WIN && _updateSettings) await _updateSettings({ mitmWinSetupDone: false }).catch(() => { });
+
   await saveMitmSettings(false, null);
 
   return { running: false, pid: null };

package/app/src/mitm/server.js

@@ -11,7 +11,7 @@ const TARGET_HOSTS = [
   "daily-cloudcode-pa.googleapis.com",
   "cloudcode-pa.googleapis.com"
 ];
-const LOCAL_PORT = parseInt(process.env.MITM_PORT || "443", 10);
+const LOCAL_PORT = 443;
 const ROUTER_URL = "http://localhost:20128/v1/chat/completions";
 const API_KEY = process.env.ROUTER_API_KEY;
 const DB_FILE = path.join(os.homedir(), ".9router", "db.json");

package/cli.js

@@ -360,10 +360,11 @@ fi
     }
 
     const spawnOpts = platform === "win32"
-      ? { stdio: "ignore", shell: true }   // cmd /c start opens new window
-      : { stdio: "inherit" };              // show progress in current terminal
+      ? { stdio: "ignore", windowsHide: true }
+      : { detached: true, stdio: "ignore" };
     const child = spawn(shellCmd[0], shellCmd[1], spawnOpts);
-    child.on("close", () => process.exit(0));
+    child.unref();
+    process.exit(0);
   } catch (err) {
     console.error(`⚠️  Update failed: ${err.message}`);
     console.log(`   Run manually: npm install -g ${pkg.name}@latest\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "9router",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "9Router CLI - Start and manage 9Router server",
   "bin": {
     "9router": "./cli.js"