9router 0.5.86 → 0.5.95

package/hooks/trayRuntime.js

@@ -5,9 +5,17 @@
 //
 // We use the maintained `systray2` fork. The original `systray@1.0.5` package
 // bundles a 2017 x86_64 Go binary whose Mach-O headers are rejected by modern
-// dyld (macOS 14+), so the tray silently fails to register on Apple Silicon.
+// dyld (macOS 14+), so it fails to load at all.
+//
+// Note that systray2 is NOT an Apple Silicon fix: like its predecessor it ships
+// only an x86_64 `tray_darwin_release`, and picks it by process.platform with no
+// process.arch branch, so there is no native slice to select. On arm64 macOS the
+// tray therefore needs Rosetta 2 and dies with EBADARCH without it. We overlay
+// our own arm64 build of the same upstream source on top — see ensureArm64TrayBin.
 const { spawnSync } = require("child_process");
+const crypto = require("crypto");
 const fs = require("fs");
+const os = require("os");
 const path = require("path");
 const { getRuntimeDir, getRuntimeNodeModules, runNpmInstall, summarizeNpmError } = require("./sqliteRuntime");
 
@@ -15,6 +23,19 @@ const SYSTRAY_PKG = "systray2";
 const SYSTRAY_VERSION = "2.1.4";
 const LEGACY_SYSTRAY_PKG = "systray";
 
+// Pinned `tray-binaries` release rather than `latest`, so the URL is stable and
+// the artifact can only change by a deliberate re-upload. The workflow's publish
+// step re-derives this repo from the literal below and refuses to upload
+// anywhere else, so the integrity gate can't drift from what clients fetch.
+//
+// The asset is built by .github/workflows/tray-binaries.yml on a macos-15 runner.
+// cgo compiles AppKit against the runner's SDK, so this value tracks that image:
+// when GitHub updates it the sha changes, the workflow refuses to publish, and
+// this constant must be bumped in the same change as the re-upload.
+const ARM64_TRAY_URL = "https://github.com/decolua/9router/releases/download/tray-binaries/tray_darwin_arm64";
+const ARM64_TRAY_SHA256 = "487e3c365aaa1eb6ad295bf3989711e975b52cee07505bf641c8559954881c81";
+const ARM64_RETRY_COOLDOWN_MS = 24 * 60 * 60 * 1000;
+
 function hasSystray() {
   return fs.existsSync(path.join(getRuntimeNodeModules(), SYSTRAY_PKG, "package.json"));
 }
@@ -71,6 +92,124 @@ function ensureRuntimeDir() {
   return dir;
 }
 
+// A thin (non-fat) 64-bit Mach-O stores its magic then cputype, both LE.
+// CPU_TYPE_ARM64 is CPU_TYPE_ARM | CPU_ARCH_ABI64. Fat/universal binaries use a
+// different magic and are reported as "not arm64" here, which is fine: we only
+// ever overlay a thin arm64 build and only need to tell it apart from x86_64.
+function isArm64MachO(file) {
+  let fd = null;
+  try {
+    fd = fs.openSync(file, "r");
+    const buf = Buffer.alloc(8);
+    fs.readSync(fd, buf, 0, 8, 0);
+    if (buf.readUInt32LE(0) !== 0xfeedfacf) return false;
+    return buf.readUInt32LE(4) === 0x0100000c;
+  } catch {
+    return false;
+  } finally {
+    if (fd !== null) try { fs.closeSync(fd); } catch {}
+  }
+}
+
+// systray2 is constructed with copyDir:true, so what actually executes is
+// ~/.cache/node-systray/<version>/tray_darwin_release, and index.js only re-copies
+// when that path is absent. An overlaid binary stays invisible until this is cleared.
+// Scoped to our systray2 version: the parent dir is machine-global and shared
+// with any other node-systray consumer.
+function bustSystrayCopyCache() {
+  try {
+    fs.rmSync(path.join(os.homedir(), ".cache", "node-systray", SYSTRAY_VERSION), { recursive: true, force: true });
+  } catch {}
+}
+
+function arm64AttemptMarker() {
+  return path.join(getRuntimeDir(), ".tray-arm64-attempt");
+}
+
+// ensureTrayRuntime runs synchronously on every `9router` start (cli.js), so a
+// failed download must not re-block the next launch. Retry at most daily.
+function recentlyAttemptedArm64() {
+  try {
+    const at = Number(fs.readFileSync(arm64AttemptMarker(), "utf8").trim());
+    return Number.isFinite(at) && Date.now() - at < ARM64_RETRY_COOLDOWN_MS;
+  } catch {
+    return false;
+  }
+}
+
+function markArm64Attempt() {
+  try { fs.writeFileSync(arm64AttemptMarker(), String(Date.now())); } catch {}
+}
+
+// Cleared on success so the cooldown only ever throttles *failures*. Without
+// this, anything that restores systray2's x86_64 binary later — notably a
+// globally installed 9router older than this change, which shares the same
+// ~/.9router/runtime — would leave the user waiting out the cooldown.
+function clearArm64Attempt() {
+  try { fs.rmSync(arm64AttemptMarker(), { force: true }); } catch {}
+}
+
+// Throws on any failure so the caller has a single error path.
+function downloadFile(url, dest, timeoutSec) {
+  // darwin-only path, and curl ships with macOS, so this needs no extra dep and
+  // keeps the caller synchronous.
+  const res = spawnSync("curl", ["-fsSL", "--max-time", String(timeoutSec), "-o", dest, url], {
+    encoding: "utf8",
+    timeout: (timeoutSec + 5) * 1000
+  });
+  if (res.status === 0 && fs.existsSync(dest)) return;
+  const detail = (res.stderr || res.error?.message || `curl exit ${res.status}`).trim().split("\n").pop();
+  throw new Error(detail || "download failed");
+}
+
+function sha256File(file) {
+  return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+}
+
+// Replace systray2's x86_64 macOS binary with a native arm64 build so Apple
+// Silicon users get a tray without installing Rosetta 2. Any failure leaves the
+// Intel binary untouched, which still works under Rosetta.
+//
+// Takes no `silent` flag on purpose: cli.js calls ensureTrayRuntime({silent:true})
+// synchronously on every start, and a stalled curl would otherwise freeze the
+// launch for up to 30s with no output at all. These lines print at most once per
+// 24h on failure and once ever on success, so they are worth more than the quiet.
+function ensureArm64TrayBin() {
+  if (process.platform !== "darwin" || process.arch !== "arm64") return { skipped: true };
+
+  const binPath = path.join(getRuntimeNodeModules(), SYSTRAY_PKG, "traybin", "tray_darwin_release");
+  if (!fs.existsSync(binPath)) return { skipped: true };
+  if (isArm64MachO(binPath)) return { native: true };
+  if (recentlyAttemptedArm64()) return { deferred: true };
+
+  markArm64Attempt();
+  console.log("⏳ Downloading native Apple Silicon tray binary...");
+  // pid-scoped: two concurrent starts (postinstall racing cli.js, or two
+  // terminals) would otherwise interleave writes to one file, fail each other's
+  // checksum, and delete each other's in-flight download from the catch below.
+  const tmp = `${binPath}.arm64.${process.pid}.tmp`;
+  try {
+    downloadFile(ARM64_TRAY_URL, tmp, 30);
+    const sum = sha256File(tmp);
+    // Integrity matters more than usual: this is an executable that runs on
+    // every Apple Silicon user's machine.
+    if (sum !== ARM64_TRAY_SHA256) throw new Error(`checksum mismatch (got ${sum.slice(0, 12)}…)`);
+    if (!isArm64MachO(tmp)) throw new Error("downloaded file is not an arm64 Mach-O");
+    fs.chmodSync(tmp, 0o755);
+    fs.renameSync(tmp, binPath);
+    bustSystrayCopyCache();
+    clearArm64Attempt();
+    console.log("✅ Native Apple Silicon tray installed");
+    return { native: true, installed: true };
+  } catch (e) {
+    try { fs.rmSync(tmp, { force: true }); } catch {}
+    console.warn("⚠️  Native tray download failed — falling back to the Intel binary");
+    console.warn(`   Reason: ${e.message}`);
+    console.warn("   The Intel tray needs Rosetta 2: softwareupdate --install-rosetta --agree-to-license");
+    return { native: false, error: e.message };
+  }
+}
+
 function npmInstall(pkgs, { silent = false } = {}) {
   const cwd = ensureRuntimeDir();
   if (!silent) console.log("⏳ Installing system tray (first run)...");
@@ -94,14 +233,20 @@ function ensureTrayRuntime({ silent = false } = {}) {
   if (process.platform === "win32") {
     return { systray: false, skipped: true };
   }
-  if (hasSystray()) {
+
+  let ready = hasSystray();
+  if (!ready) {
+    ready = npmInstall([`${SYSTRAY_PKG}@${SYSTRAY_VERSION}`], { silent }) && hasSystray();
+  }
+  if (ready) {
     chmodSystrayBin({ silent });
     if (!silent) console.log("✅ System tray ready");
-    return { systray: true };
   }
-  const ok = npmInstall([`${SYSTRAY_PKG}@${SYSTRAY_VERSION}`], { silent });
-  if (ok) chmodSystrayBin({ silent });
-  return { systray: ok && hasSystray() };
+
+  // Runs after the ready log so a download failure doesn't read as a broken
+  // tray — the Intel binary still works under Rosetta.
+  const arm64 = ready ? ensureArm64TrayBin() : { skipped: true };
+  return { systray: ready, arm64 };
 }
 
-module.exports = { ensureTrayRuntime };
+module.exports = { ensureTrayRuntime, ensureArm64TrayBin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "9router",
-  "version": "0.5.86",
+  "version": "0.5.95",
   "description": "9Router CLI - Start and manage 9Router server",
   "bin": {
     "9router": "./cli.js"
@@ -16,6 +16,7 @@
   "scripts": {
     "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",
     "build": "node scripts/build-cli.js",
+    "build:tray-arm64": "node scripts/buildTrayArm64.js",
     "pack:cli": "npm run build && npm pack --pack-destination ..",
     "publish:cli": "npm run build && npm publish",
     "postinstall": "node hooks/postinstall.js",
@@ -26,10 +27,12 @@
     "node-forge": "^1.3.3",
     "node-machine-id": "^1.1.12",
     "react": "19.2.1",
-    "react-dom": "19.2.1"
+    "react-dom": "19.2.1",
+    "confbox": "^0.2.4"
   },
   "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into ~/.9router/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",
-  "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.9router/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",
+  "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into ~/.9router/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails to load on modern macOS dyld. Neither package ships an arm64 macOS binary, so on Apple Silicon hooks/trayRuntime.js overlays our own arm64 build from the tray-binaries GitHub release; without it the tray requires Rosetta 2.",
+  "comment_tray_arm64": "tray_darwin_arm64 is built by scripts/buildTrayArm64.js (npm run build:tray-arm64) from felixhao28/systray-portable — the same source systray2's binary comes from — and uploaded to the pinned 'tray-binaries' GitHub release. Its sha256 is pinned as ARM64_TRAY_SHA256 in hooks/trayRuntime.js and verified after every download; rebuild and update both together. .github/workflows/tray-binaries.yml builds the same artifact in CI but refuses to publish when the sha diverges from the pin.",
   "engines": {
     "node": ">=18.0.0"
   },

package/src/cli/commands/connect.js

@@ -0,0 +1,269 @@
+/**
+ * `9router connect <server-url>` — point local CLI tools (Claude Code, Codex, …) at a
+ * REMOTE 9router server. Nothing runs locally: we log in with the dashboard
+ * password, reuse/create an API key for this machine, then write the tool's
+ * settings files (see connectTools.js). Works via `npx 9router connect …` with no global install.
+ *
+ * The password and API key are never printed (key is masked).
+ */
+
+const os = require("os");
+const { TOOL_IDS, CLAUDE_MODELS, resolveTools } = require("./connectTools");
+
+const DEFAULT_MODEL = "cc/claude-sonnet-5";
+
+const HELP = `
+Usage: 9router connect <server-url> [options]
+
+Configure CLI tools on THIS machine to use a remote 9router server.
+No local server is started. Run without installing:
+
+  npx 9router connect http://<server-host>:20128
+  npx 9router connect http://<server-host>:20128 --tools claude,codex,opencode
+
+Options:
+  --tools <list>         Comma-separated tools to configure (prompted if omitted
+                         in a terminal; default: claude). Supported:
+                         ${TOOL_IDS.join(", ")}, all
+  --password <pw>        Dashboard password (or env NINE_ROUTER_PASSWORD;
+                         prompted if omitted — preferred, keeps it out of shell history)
+  --key-name <name>      API key name to reuse/create (default: cli-<hostname>)
+  --api-key <key>        Use this API key, skip login + key lookup
+  --model <model>        Model for non-Claude tools (default: ${DEFAULT_MODEL})
+  --fable|--opus|--sonnet|--haiku <model>
+                         Override Claude Code model mapping
+  --print-env            Also print OpenAI-compatible env vars for other CLIs
+  --reset                Remove 9router settings from the selected tools and exit
+  -h, --help             Show this help
+`;
+
+function parseArgs(argv) {
+  const opts = {
+    password: process.env.NINE_ROUTER_PASSWORD || null,
+    keyName: `cli-${os.hostname()}`.slice(0, 64),
+    apiKey: null,
+    models: {},
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const next = () => {
+      const v = argv[++i];
+      if (v === undefined) throw new Error(`Missing value for ${a}`);
+      return v;
+    };
+    if (a === "--password") opts.password = next();
+    else if (a === "--key-name") opts.keyName = next();
+    else if (a === "--api-key") opts.apiKey = next();
+    else if (a === "--tools") opts.tools = next().split(",");
+    else if (a === "--model") opts.model = next();
+    else if (a === "--print-env") opts.printEnv = true;
+    else if (a === "--reset") opts.reset = true;
+    else if (a === "-h" || a === "--help") opts.help = true;
+    else if (a.startsWith("--") && CLAUDE_MODELS.some((m) => `--${m.flag}` === a)) opts.models[a.slice(2)] = next();
+    else if (!a.startsWith("-") && !opts.url) opts.url = a;
+    else throw new Error(`Unknown option: ${a}`);
+  }
+  return opts;
+}
+
+function normalizeServerUrl(input) {
+  let raw = String(input || "").trim();
+  if (!/^https?:\/\//i.test(raw)) raw = `http://${raw}`;
+  const u = new URL(raw);
+  // Accept pasted dashboard/API URLs: keep only origin.
+  return u.origin;
+}
+
+function maskKey(key) {
+  if (!key || key.length < 12) return "****";
+  return `${key.slice(0, 6)}…${key.slice(-4)}`;
+}
+
+// Enquirer rejects with an empty value on Ctrl+C / Esc.
+class Cancelled extends Error {}
+const prompt = (p) => p.run().catch((err) => { throw err || new Cancelled("Cancelled"); });
+
+async function promptPassword() {
+  if (!process.stdin.isTTY) throw new Error("Password required: pass --password or set NINE_ROUTER_PASSWORD");
+  const { Password } = require("enquirer");
+  return prompt(new Password({ message: "9router dashboard password" }));
+}
+
+async function request(url, { method = "GET", body, cookie, apiKey } = {}) {
+  const headers = { Accept: "application/json" };
+  if (body) headers["Content-Type"] = "application/json";
+  if (cookie) headers.Cookie = cookie;
+  if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
+  let res;
+  try {
+    res = await fetch(url, { method, headers, body: body ? JSON.stringify(body) : undefined, redirect: "manual" });
+  } catch (err) {
+    throw new Error(`Cannot reach ${new URL(url).origin}: ${err.cause?.code || err.message}`);
+  }
+  let data = null;
+  try { data = await res.json(); } catch { /* non-JSON */ }
+  // Server-controlled strings get printed later — strip control chars (terminal escape injection).
+  if (typeof data?.error === "string") data.error = data.error.replace(/[\x00-\x1f\x7f]/g, "");
+  return { status: res.status, headers: res.headers, data };
+}
+
+function extractAuthCookie(headers) {
+  const list = typeof headers.getSetCookie === "function" ? headers.getSetCookie() : [headers.get("set-cookie") || ""];
+  for (const c of list) {
+    const m = /(?:^|,\s*)auth_token=([^;]+)/.exec(c);
+    if (m) return `auth_token=${m[1]}`;
+  }
+  return null;
+}
+
+async function login(server, password) {
+  const res = await request(`${server}/api/auth/login`, { method: "POST", body: { password } });
+  if (res.status === 200 && res.data?.success) {
+    const cookie = extractAuthCookie(res.headers);
+    if (!cookie) throw new Error("Login succeeded but server returned no session cookie");
+    return cookie;
+  }
+  throw new Error(`Login failed (${res.status}): ${res.data?.error || "unknown error"}`);
+}
+
+async function getOrCreateApiKey(server, cookie, keyName) {
+  const list = await request(`${server}/api/keys`, { cookie });
+  if (list.status === 401) throw new Error("Unauthorized listing API keys — wrong password or session rejected");
+  if (list.status !== 200) throw new Error(`Failed to list API keys (${list.status}): ${list.data?.error || ""}`);
+  const keys = (list.data?.keys || []).filter((k) => k.isActive !== false);
+  const existing = keys.find((k) => k.name === keyName);
+  if (existing) return { key: existing.key, created: false };
+
+  const created = await request(`${server}/api/keys`, { method: "POST", cookie, body: { name: keyName } });
+  if (created.status !== 201 || !created.data?.key) {
+    throw new Error(`Failed to create API key (${created.status}): ${created.data?.error || ""}`);
+  }
+  return { key: created.data.key, created: true };
+}
+
+async function listModels(server, apiKey) {
+  const res = await request(`${server}/v1/models`, { apiKey });
+  if (res.status === 401) throw new Error("API key rejected by server (/v1/models returned 401)");
+  if (res.status !== 200) return null;
+  return new Set((res.data?.data || []).map((m) => m.id));
+}
+
+async function promptTools() {
+  const { MultiSelect } = require("enquirer");
+  const { TOOLS } = require("./connectTools");
+  return prompt(new MultiSelect({
+    message: "Select CLI tools to configure (space to toggle, enter to confirm)",
+    choices: TOOLS.map((t) => ({ name: t.id, message: t.name, hint: t.paths()[0], enabled: t.id === "claude" })),
+    validate: (v) => v.length > 0 || "Select at least one tool",
+  }));
+}
+
+async function selectTools(opts) {
+  if (opts.tools) return resolveTools(opts.tools);
+  if (process.stdin.isTTY) return resolveTools(await promptTools());
+  return resolveTools(["claude"]);
+}
+
+async function run(argv) {
+  try {
+    return await runConnect(argv);
+  } catch (err) {
+    if (err instanceof Cancelled) {
+      console.log("Cancelled.");
+      return 130;
+    }
+    throw err;
+  }
+}
+
+async function runConnect(argv) {
+  const opts = parseArgs(argv);
+  if (opts.help) {
+    console.log(HELP);
+    return 0;
+  }
+  if (!opts.reset && !opts.url) {
+    console.log(HELP);
+    return 1;
+  }
+
+  // Pick tools before any network call: bad names fail fast, and cancelling
+  // the picker never leaves a freshly created key on the server.
+  const tools = await selectTools(opts);
+
+  if (opts.reset) {
+    let failed = 0;
+    for (const t of tools) {
+      try {
+        const files = await t.reset();
+        console.log(files.length ? `✅ ${t.name}: removed 9router settings (${files.join(", ")})` : `• ${t.name}: nothing to reset`);
+      } catch (err) {
+        failed++;
+        console.log(`❌ ${t.name}: ${err.message}`);
+      }
+    }
+    return failed ? 1 : 0;
+  }
+
+  const server = normalizeServerUrl(opts.url);
+  const isRemoteHttp = server.startsWith("http://") && !/^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|$)/.test(server);
+  if (isRemoteHttp) {
+    console.log("\x1b[33m⚠ Plain HTTP: password and API key travel unencrypted. Use only on a trusted LAN/VPN.\x1b[0m");
+  }
+
+  let apiKey = opts.apiKey;
+  if (apiKey) {
+    console.log("• Using provided API key");
+  } else {
+    const password = opts.password ?? (await promptPassword());
+    console.log(`• Logging in to ${server}`);
+    const cookie = await login(server, password);
+    const result = await getOrCreateApiKey(server, cookie, opts.keyName);
+    apiKey = result.key;
+    console.log(`• ${result.created ? "Created" : "Reusing"} API key "${opts.keyName}" (${maskKey(apiKey)})`);
+  }
+
+  const available = await listModels(server, apiKey);
+  const warnMissing = (label, model, flag) => {
+    if (available && !available.has(model)) {
+      console.log(`\x1b[33m⚠ ${label}: "${model}" not listed by server — override with ${flag} <model>\x1b[0m`);
+    }
+  };
+
+  const claudeModels = {};
+  if (tools.some((t) => t.id === "claude")) {
+    for (const m of CLAUDE_MODELS) {
+      claudeModels[m.envKey] = opts.models[m.flag] || m.defaultValue;
+      warnMissing(`claude ${m.flag}`, claudeModels[m.envKey], `--${m.flag}`);
+    }
+  }
+  const model = opts.model || DEFAULT_MODEL;
+  if (tools.some((t) => t.id !== "claude")) warnMissing("model", model, "--model");
+
+  const ctx = { baseUrl: server, apiKey, model, claudeModels };
+  let failed = 0;
+  for (const t of tools) {
+    try {
+      const files = await t.apply(ctx);
+      console.log(`✅ ${t.name} → ${files.join(", ")}`);
+    } catch (err) {
+      failed++;
+      console.log(`❌ ${t.name}: ${err.message}`);
+    }
+  }
+  console.log(`   Base URL: ${server}/v1`);
+  if (tools.some((t) => t.id === "claude")) {
+    for (const m of CLAUDE_MODELS) console.log(`   ${m.envKey}=${claudeModels[m.envKey]}`);
+  }
+  if (tools.some((t) => t.id !== "claude")) console.log(`   Model (other tools): ${model}`);
+  console.log(`   Restart the tools to apply. Undo: npx 9router connect --reset --tools ${tools.map((t) => t.id).join(",")}`);
+
+  if (opts.printEnv) {
+    console.log("\nOpenAI-compatible CLIs (codex, opencode, aider, …):");
+    console.log(`   OPENAI_BASE_URL=${server}/v1`);
+    console.log(`   OPENAI_API_KEY=${apiKey}`);
+  }
+  return failed ? 1 : 0;
+}
+
+module.exports = { run, __test__: { parseArgs, normalizeServerUrl, extractAuthCookie, maskKey, Cancelled } };