9router 0.3.7 → 0.3.8

package/app/src/mitm/manager.js

@@ -276,12 +276,11 @@ async function killLeftoverMitm(sudoPassword) {
  * Returns { ok, pid } on success, null on timeout.
  */
 function pollMitmHealth(timeoutMs) {
-  const healthPort = MITM_PORT;
   return new Promise((resolve) => {
     const deadline = Date.now() + timeoutMs;
     const check = () => {
       const req = https.request(
-        { hostname: "127.0.0.1", port: healthPort, path: "/_mitm_health", method: "GET", rejectUnauthorized: false },
+        { hostname: "127.0.0.1", port: 443, path: "/_mitm_health", method: "GET", rejectUnauthorized: false },
         (res) => {
           let body = "";
           res.on("data", (d) => { body += d; });
@@ -413,54 +412,59 @@ async function startMitm(apiKey, sudoPassword) {
     const esc = (s) => s.replace(/'/g, "''");
     const certPsPath = esc(certPath);
     const hostsPsPath = esc(hostsFile);
-    const nodePsPath = esc(process.execPath);
-    const serverPsPath = esc(SERVER_PATH);
 
-    const dnsAddLines = TARGET_HOSTS_WIN.map(h =>
-      `if (-not (Select-String -Path '${hostsPsPath}' -Pattern '${h}' -Quiet)) { Add-Content -Path '${hostsPsPath}' -Value "127.0.0.1 ${h}" }`
-    ).join("\n");
+    // Check if one-time setup is already done (urlacl granted + cert installed + DNS added)
+    const settings = _getSettings ? await _getSettings().catch(() => ({})) : {};
+    const setupDone = settings.mitmWinSetupDone && fs.existsSync(certPath) && checkDNSEntry();
+
+    if (!setupDone) {
+      // Phase 1: single UAC prompt — cert + DNS + netsh urlacl (one-time setup)
+      const dnsAddLines = TARGET_HOSTS_WIN.map(h =>
+        `if (-not (Select-String -Path '${hostsPsPath}' -Pattern '${h}' -Quiet)) { Add-Content -Path '${hostsPsPath}' -Value "127.0.0.1 ${h}" }`
+      ).join("\n");
 
-    // Single elevated script: cert + DNS + urlacl (allow node to bind 443) + start node
-    // urlacl grants non-admin processes permission to bind port 443 via HTTP.sys
-    const setupScript = `
-# 1. Install cert to Root store if not present
+      const setupScript = `
+# 1. Install cert to Root store
 $certCheck = & certutil -store Root 'daily-cloudcode-pa.googleapis.com' 2>&1
-if ($LASTEXITCODE -ne 0) {
-  & certutil -addstore Root '${certPsPath}' | Out-Null
-}
+if ($LASTEXITCODE -ne 0) { & certutil -addstore Root '${certPsPath}' | Out-Null }
 
-# 2. Add DNS entries to hosts file
+# 2. Add DNS entries
 ${dnsAddLines}
 & ipconfig /flushdns | Out-Null
 
-# 3. Grant permission for any user to bind HTTPS port 443 (no admin needed after this)
-& netsh http add urlacl url=https://+:${MITM_PORT}/ user=Everyone 2>&1 | Out-Null
-
-# 4. Start node MITM server (now allowed to bind 443 without admin)
-$env:ROUTER_API_KEY = '${esc(apiKey)}'
-$env:NODE_ENV = 'production'
-Start-Process -FilePath '${nodePsPath}' -ArgumentList '"${serverPsPath}"' -WindowStyle Hidden
+# 3. Grant current user permission to bind port 443 (no more UAC needed after this)
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+& netsh http add urlacl url=https://+:443/ sddl="D:(A;;GX;;;$sid)" | Out-Null
 `.trim();
 
-    const tmpSetup = path.join(os.tmpdir(), `mitm_setup_${Date.now()}.ps1`);
-    fs.writeFileSync(tmpSetup, setupScript, "utf8");
-
-    // Outer spawn WITHOUT -NonInteractive so UAC dialog can appear
-    await new Promise((resolve, reject) => {
-      const setupProc = spawn("powershell", [
-        "-NoProfile", "-WindowStyle", "Hidden",
-        "-Command",
-        `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpSetup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpSetup)}' -ErrorAction SilentlyContinue`
-      ], { stdio: "ignore", windowsHide: true });
-      setupProc.on("close", () => resolve());
-      setupProc.on("error", reject);
-    });
+      const tmpSetup = path.join(os.tmpdir(), `mitm_setup_${Date.now()}.ps1`);
+      fs.writeFileSync(tmpSetup, setupScript, "utf8");
+
+      // Run elevated — this is the ONLY UAC prompt
+      await new Promise((resolve, reject) => {
+        const launcher = spawn("powershell", [
+          "-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden",
+          "-Command",
+          `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpSetup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpSetup)}' -ErrorAction SilentlyContinue`
+        ], { stdio: "ignore", windowsHide: true });
+        launcher.on("close", (code) => {
+          if (code === 0) resolve();
+          else reject(new Error(`Setup script failed with code ${code}`));
+        });
+        launcher.on("error", reject);
+      });
 
-    if (_updateSettings) await _updateSettings({ mitmCertInstalled: true }).catch(() => { });
+      if (_updateSettings) await _updateSettings({ mitmWinSetupDone: true, mitmCertInstalled: true }).catch(() => { });
+    }
 
-    // serverProcess reference not available (started inside elevated script)
-    // PID will be captured from health check response
-    serverProcess = { pid: null, killed: false };
+    // Phase 2: spawn node directly — no UAC needed (urlacl already granted)
+    serverProcess = spawn(process.execPath, [SERVER_PATH], {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+      env: { ...process.env, ROUTER_API_KEY: apiKey, NODE_ENV: "production" },
+    });
+    serverProcess.unref();
   } else {
     // macOS/Linux: install cert + add DNS (requires sudo), then spawn server
     const settings = _getSettings ? await _getSettings().catch(() => ({})) : {};
@@ -483,8 +487,8 @@ Start-Process -FilePath '${nodePsPath}' -ArgumentList '"${serverPsPath}"' -Windo
     serverProcess.stdin.end();
   }
 
-  serverPid = IS_WIN ? null : serverProcess.pid;
-  if (serverPid) fs.writeFileSync(PID_FILE, String(serverPid));
+  serverPid = serverProcess.pid;
+  fs.writeFileSync(PID_FILE, String(serverPid));
 
   let startError = null;
   if (!IS_WIN) {
@@ -508,7 +512,8 @@ Start-Process -FilePath '${nodePsPath}' -ArgumentList '"${serverPsPath}"' -Windo
   }
 
   // Wait for server to be ready by polling health endpoint
-  const health = await pollMitmHealth(IS_WIN ? 12000 : 8000);
+  // Windows: allow extra time for urlacl setup + node startup on first run
+  const health = await pollMitmHealth(IS_WIN ? 20000 : 8000);
 
   if (!health) {
     if (IS_WIN) serverProcess = null;
@@ -519,7 +524,10 @@ Start-Process -FilePath '${nodePsPath}' -ArgumentList '"${serverPsPath}"' -Windo
     throw new Error(`MITM server failed to start. ${reason}`);
   }
 
-  // On Windows, use real PID from health check (node detached, serverProcess.pid may differ)
+  // On Windows, mark cert as installed after successful start
+  if (IS_WIN && _updateSettings) await _updateSettings({ mitmCertInstalled: true }).catch(() => { });
+
+  // On Windows, use real PID from health check (launcher exits immediately after UAC)
   if (IS_WIN && health.pid) {
     serverPid = health.pid;
     fs.writeFileSync(PID_FILE, String(serverPid));
@@ -560,45 +568,14 @@ async function stopMitm(sudoPassword) {
     serverPid = null;
   }
 
-  if (IS_WIN) {
-    // Cleanup: remove DNS entries + urlacl — single UAC prompt
-    const hostsFile = path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts");
-    const TARGET_HOSTS_WIN = ["daily-cloudcode-pa.googleapis.com", "cloudcode-pa.googleapis.com"];
-    const esc = (s) => s.replace(/'/g, "''");
-    const hostsPsPath = esc(hostsFile);
-
-    const content = fs.readFileSync(hostsFile, "utf8");
-    const filtered = content.split(/\r?\n/).filter(l => !TARGET_HOSTS_WIN.some(h => l.includes(h))).join("\r\n");
-    const tmpHosts = path.join(os.tmpdir(), "hosts_filtered.tmp");
-    fs.writeFileSync(tmpHosts, filtered, "utf8");
-
-    const cleanupScript = `
-# Remove DNS entries
-Copy-Item -Path '${esc(tmpHosts)}' -Destination '${hostsPsPath}' -Force
-& ipconfig /flushdns | Out-Null
-Remove-Item '${esc(tmpHosts)}' -ErrorAction SilentlyContinue
-
-# Remove urlacl
-& netsh http delete urlacl url=https://+:${MITM_PORT}/ 2>&1 | Out-Null
-`.trim();
-    const tmpCleanup = path.join(os.tmpdir(), `mitm_cleanup_${Date.now()}.ps1`);
-    fs.writeFileSync(tmpCleanup, cleanupScript, "utf8");
-    await new Promise((resolve) => {
-      const p = spawn("powershell", [
-        "-NoProfile", "-WindowStyle", "Hidden",
-        "-Command",
-        `Start-Process powershell -ArgumentList '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File \\"${esc(tmpCleanup)}\\"' -Verb RunAs -Wait; Remove-Item '${esc(tmpCleanup)}' -ErrorAction SilentlyContinue`
-      ], { stdio: "ignore", windowsHide: true });
-      p.on("close", resolve);
-      p.on("error", resolve);
-    });
-  } else {
-    console.log("Removing DNS entry...");
-    await removeDNSEntry(sudoPassword);
-  }
+  console.log("Removing DNS entry...");
+  await removeDNSEntry(sudoPassword);
 
   try { fs.unlinkSync(PID_FILE); } catch { /* ignore */ }
 
+  // Reset win setup flag so DNS gets re-added on next start
+  if (IS_WIN && _updateSettings) await _updateSettings({ mitmWinSetupDone: false }).catch(() => { });
+
   await saveMitmSettings(false, null);
 
   return { running: false, pid: null };

package/cli.js

@@ -360,10 +360,11 @@ fi
     }
 
     const spawnOpts = platform === "win32"
-      ? { stdio: "ignore", shell: true }   // cmd /c start opens new window
-      : { stdio: "inherit" };              // show progress in current terminal
+      ? { stdio: "ignore", windowsHide: true }
+      : { detached: true, stdio: "ignore" };
     const child = spawn(shellCmd[0], shellCmd[1], spawnOpts);
-    child.on("close", () => process.exit(0));
+    child.unref();
+    process.exit(0);
   } catch (err) {
     console.error(`⚠️  Update failed: ${err.message}`);
     console.log(`   Run manually: npm install -g ${pkg.name}@latest\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "9router",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "9Router CLI - Start and manage 9Router server",
   "bin": {
     "9router": "./cli.js"