@fudrouter/fsrouter 0.6.37 → 0.6.39

package/bin/cli.cjs

@@ -0,0 +1,764 @@
+#!/usr/bin/env node
+
+const { spawn, exec, execSync } = require("child_process");
+const path = require("path");
+const fs = require("fs");
+const https = require("https");
+const os = require("os");
+
+// Native spinner - no external dependency
+function createSpinner(text) {
+  const frames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+  let i = 0;
+  let interval = null;
+  let currentText = text;
+  return {
+    start() {
+      if (process.stdout.isTTY) {
+        process.stdout.write(`\r${frames[0]} ${currentText}`);
+        interval = setInterval(() => {
+          process.stdout.write(`\r${frames[i++ % frames.length]} ${currentText}`);
+        }, 80);
+      }
+      return this;
+    },
+    stop() {
+      if (interval) {
+        clearInterval(interval);
+        interval = null;
+      }
+      if (process.stdout.isTTY) {
+        process.stdout.write("\r\x1b[K");
+      }
+    },
+    succeed(msg) {
+      this.stop();
+      console.log(`✅ ${msg}`);
+    },
+    fail(msg) {
+      this.stop();
+      console.log(`❌ ${msg}`);
+    }
+  };
+}
+
+const pkg = require("../package.json");
+const { ensureSqliteRuntime, buildEnvWithRuntime } = require("./hooks/sqliteRuntime.cjs");
+const { ensureTrayRuntime } = require("./hooks/trayRuntime.cjs");
+const args = process.argv.slice(2);
+
+// Self-heal SQLite runtime deps (sql.js + better-sqlite3) into ~/.9router/runtime
+// so the server can resolve them via NODE_PATH. Best-effort — sql.js is required,
+// better-sqlite3 is optional. Logs to stderr only on failure.
+try { ensureSqliteRuntime({ silent: true }); } catch {}
+
+// Self-heal tray runtime (systray for macOS/Linux only). Windows skipped.
+try { ensureTrayRuntime({ silent: true }); } catch {}
+
+// Configuration constants
+const APP_NAME = pkg.name; // Use from package.json
+const INSTALL_CMD_LATEST = `npm i -g ${APP_NAME}@latest --prefer-online`;
+
+const DEFAULT_PORT = 20128;
+const DEFAULT_HOST = "0.0.0.0";
+const MAX_PORT_ATTEMPTS = 10;
+// Identifiers for killAllAppProcesses - only kill 9router specifically
+const PROCESS_IDENTIFIERS = [
+  '9router'  // Only package name - avoid killing other apps
+];
+
+// Parse arguments
+let port = DEFAULT_PORT;
+let host = DEFAULT_HOST;
+let noBrowser = false;
+let skipUpdate = false;
+let showLog = false;
+let trayMode = false;
+
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === "--port" || args[i] === "-p") {
+    port = parseInt(args[i + 1], 10) || DEFAULT_PORT;
+    i++;
+  } else if (args[i] === "--host" || args[i] === "-H") {
+    host = args[i + 1] || DEFAULT_HOST;
+    i++;
+  } else if (args[i] === "--no-browser" || args[i] === "-n") {
+    noBrowser = true;
+  } else if (args[i] === "--log" || args[i] === "-l") {
+    showLog = true;
+  } else if (args[i] === "--skip-update") {
+    skipUpdate = true;
+  } else if (args[i] === "--tray" || args[i] === "-t") {
+    trayMode = true;
+    process.env.TRAY_MODE = "1";
+  } else if (args[i] === "--help" || args[i] === "-h") {
+    console.log(`
+Usage: ${APP_NAME} [options]
+
+Options:
+  -p, --port <port>   Port to run the server (default: ${DEFAULT_PORT})
+  -H, --host <host>   Host to bind (default: ${DEFAULT_HOST})
+  -n, --no-browser    Don't open browser automatically
+  -l, --log           Show server logs (default: hidden)
+  -t, --tray          Run in system tray mode (background)
+  --skip-update       Skip auto-update check
+  -h, --help          Show this help message
+  -v, --version       Show version
+`);
+    process.exit(0);
+  } else if (args[i] === "--version" || args[i] === "-v") {
+    console.log(pkg.version);
+    process.exit(0);
+  }
+}
+
+// Auto-relaunch after update: detached process has no TTY → fallback to tray (only if desktop display is available)
+const hasDisplay = process.platform === "win32" || process.platform === "darwin" || process.env.DISPLAY;
+if (skipUpdate && !trayMode && !process.stdin.isTTY && hasDisplay) {
+  trayMode = true;
+  process.env.TRAY_MODE = "1";
+}
+
+// Always use Node.js runtime with absolute path
+const RUNTIME = process.execPath;
+
+// Compare semver versions: returns 1 if a > b, -1 if a < b, 0 if equal
+function compareVersions(a, b) {
+  const partsA = a.split(".").map(Number);
+  const partsB = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if (partsA[i] > partsB[i]) return 1;
+    if (partsA[i] < partsB[i]) return -1;
+  }
+  return 0;
+}
+
+// Get app data dir (matches app/src/lib/dataDir.js convention)
+function getAppDataDir() {
+  return process.platform === "win32"
+    ? path.join(process.env.APPDATA || "", "9router")
+    : path.join(os.homedir(), ".9router");
+}
+
+// Kill PID from file (best-effort, removes file after)
+function killByPidFile(pidFile) {
+  try {
+    if (!fs.existsSync(pidFile)) return;
+    const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim(), 10);
+    if (!pid) return;
+    try {
+      if (process.platform === "win32") {
+        execSync(`taskkill /F /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 3000 });
+      } else {
+        process.kill(pid, "SIGKILL");
+      }
+    } catch { }
+    try { fs.unlinkSync(pidFile); } catch { }
+  } catch { }
+}
+
+// Kill tunnel processes (cloudflared/tailscale) by their PID files
+function killTunnelByPidFile() {
+  const tunnelDir = path.join(getAppDataDir(), "tunnel");
+  killByPidFile(path.join(tunnelDir, "cloudflared.pid"));
+  killByPidFile(path.join(tunnelDir, "tailscale.pid"));
+}
+
+// Kill cloudflared whose --url targets this app's port (covers stale PID file case)
+function killCloudflaredByAppPort(appPort) {
+  if (!appPort) return [];
+  const portMatchers = [`localhost:${appPort}`, `127.0.0.1:${appPort}`];
+  const pids = [];
+  try {
+    if (process.platform === "win32") {
+      const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"cloudflared.exe\\"' | Select-Object ProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation"`;
+      const output = execSync(psCmd, { encoding: "utf8", windowsHide: true, timeout: 5000 });
+      const lines = output.split("\n").slice(1).filter(l => l.trim());
+      lines.forEach(line => {
+        if (portMatchers.some(m => line.includes(m))) {
+          const match = line.match(/^"(\d+)"/);
+          if (match && match[1]) pids.push(match[1]);
+        }
+      });
+    } else {
+      const output = execSync("ps -eo pid,command 2>/dev/null", { encoding: "utf8", timeout: 5000 });
+      output.split("\n").forEach(line => {
+        if (line.includes("cloudflared") && portMatchers.some(m => line.includes(m))) {
+          const parts = line.trim().split(/\s+/);
+          const pid = parts[0];
+          if (pid && !isNaN(pid)) pids.push(pid);
+        }
+      });
+    }
+  } catch { }
+  return pids;
+}
+
+// Kill all 9router processes
+function killAllAppProcesses(appPort) {
+  return new Promise((resolve) => {
+    try {
+      // Kill MIT first (privileged process, needs special handling)
+      killProxyByPidFile();
+      // Kill cloudflared/tailscale by PID file (precise, only this app's tunnel)
+      killTunnelByPidFile();
+
+      const platform = process.platform;
+      let pids = [];
+
+      // Catch stale PID files: kill cloudflared bound to this app's port
+      pids.push(...killCloudflaredByAppPort(appPort));
+
+      if (platform === "win32") {
+        // Windows: use WMI to get full CommandLine (tasklist /V doesn't include it)
+        try {
+          const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"node.exe\\"' | Select-Object ProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation"`;
+          const output = execSync(psCmd, {
+            encoding: "utf8",
+            windowsHide: true,
+            timeout: 5000
+          });
+          const lines = output.split("\n").slice(1).filter(l => l.trim());
+          lines.forEach(line => {
+            // Whitelist: real node process running 9router/cli.js, or next-server.
+            // Avoids killing editors/grep/strace/cursor that just have "9router" in cmdline.
+            const cmd = line.toLowerCase();
+            const isAppProcess =
+              (cmd.includes("node") && cmd.includes("9router") && (cmd.includes("cli.js") || cmd.includes("\\9router") || cmd.includes("/9router")))
+              || cmd.includes("next-server");
+            if (isAppProcess) {
+              const match = line.match(/^"(\d+)"/);
+              if (match && match[1] && match[1] !== process.pid.toString()) {
+                pids.push(match[1]);
+              }
+            }
+          });
+        } catch (e) {
+          // No processes found or error - continue
+        }
+      } else {
+        // macOS/Linux: use ps to find all matching processes
+        try {
+          const output = execSync('ps aux 2>/dev/null', {
+            encoding: 'utf8',
+            timeout: 5000
+          });
+          const lines = output.split('\n');
+
+          lines.forEach(line => {
+            // Whitelist: real node process running 9router/cli.js, or next-server.
+            // Avoids killing grep/strace/editors/cursor that incidentally match "9router".
+            const cmd = line.toLowerCase();
+            const isAppProcess =
+              (cmd.includes("node") && cmd.includes("9router") && (cmd.includes("cli.js") || cmd.includes("/9router")))
+              || cmd.includes("next-server");
+            if (isAppProcess) {
+              const parts = line.trim().split(/\s+/);
+              const pid = parts[1];
+              if (pid && !isNaN(pid) && pid !== process.pid.toString()) {
+                pids.push(pid);
+              }
+            }
+          });
+        } catch (e) {
+          // No processes found or error - continue
+        }
+      }
+
+      // Kill all found processes
+      if (pids.length > 0) {
+        pids.forEach(pid => {
+          try {
+            if (platform === "win32") {
+              execSync(`taskkill /F /PID ${pid} 2>nul`, { stdio: 'ignore', shell: true, windowsHide: true, timeout: 3000 });
+            } else {
+              execSync(`kill -9 ${pid} 2>/dev/null`, { stdio: 'ignore', timeout: 3000 });
+            }
+          } catch (err) {
+            // Process already dead or can't kill - continue
+          }
+        });
+
+        // Wait for processes to fully terminate
+        setTimeout(() => resolve(), 1000);
+      } else {
+        resolve();
+      }
+    } catch (err) {
+      // Silent fail - continue anyway
+      resolve();
+    }
+  });
+}
+
+// Sleep helper using SharedArrayBuffer wait (sync, no busy-loop)
+function sleepSync(ms) {
+  try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); } catch { /* ignore */ }
+}
+
+// Wait until process dies or timeout reached
+function waitForExit(pid, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try { process.kill(pid, 0); } catch { return true; }
+    sleepSync(100);
+  }
+  return false;
+}
+
+// Kill MIT server by PID file (runs privileged, needs special handling)
+// Sends SIGTERM first so MIT can clean up host entries before dying.
+function killProxyByPidFile() {
+  try {
+    const pidFile = path.join(getAppDataDir(), "mitm", ".mitm.pid");
+    if (!fs.existsSync(pidFile)) return;
+    const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim(), 10);
+    if (!pid) return;
+
+    if (process.platform === "win32") {
+      // Graceful first (lets server cleanup hosts), then force
+      try { execSync(`taskkill /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 2000 }); } catch { }
+      if (!waitForExit(pid, 1500)) {
+        try { execSync(`taskkill /F /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 3000 }); } catch { }
+      }
+      // Last-resort: PowerShell Stop-Process (sometimes succeeds where taskkill fails on admin processes)
+      if (!waitForExit(pid, 500)) {
+        try { execSync(`powershell -NonInteractive -WindowStyle Hidden -Command "Stop-Process -Id ${pid} -Force"`, { stdio: "ignore", windowsHide: true, timeout: 3000 }); } catch { }
+      }
+    } else {
+      // SIGTERM via cached sudo token first
+      try { execSync(`sudo -n kill -TERM ${pid} 2>/dev/null`, { stdio: "ignore", timeout: 2000 }); }
+      catch { try { process.kill(pid, "SIGTERM"); } catch { } }
+      if (!waitForExit(pid, 1500)) {
+        try { execSync(`sudo -n kill -9 ${pid} 2>/dev/null`, { stdio: "ignore", timeout: 2000 }); }
+        catch { try { process.kill(pid, "SIGKILL"); } catch { } }
+      }
+    }
+    try { fs.unlinkSync(pidFile); } catch { }
+  } catch { }
+}
+
+// Kill any process on specific port
+function killProcessOnPort(port) {
+  return new Promise((resolve) => {
+    try {
+      const platform = process.platform;
+      let pid;
+
+      if (platform === "win32") {
+        try {
+          const output = execSync(`netstat -ano | findstr :${port}`, {
+            encoding: 'utf8',
+            shell: true,
+            windowsHide: true,
+            timeout: 5000
+          }).trim();
+          const lines = output.split('\n').filter(l => l.includes('LISTENING'));
+          if (lines.length > 0) {
+            pid = lines[0].trim().split(/\s+/).pop();
+            execSync(`taskkill /F /PID ${pid} 2>nul`, { stdio: 'ignore', shell: true, windowsHide: true, timeout: 3000 });
+          }
+        } catch (e) {
+          // Port is free or error
+        }
+      } else {
+        // macOS/Linux
+        try {
+          const pidOutput = execSync(`lsof -ti:${port}`, {
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'ignore']
+          }).trim();
+          if (pidOutput) {
+            pid = pidOutput.split('\n')[0];
+            execSync(`kill -9 ${pid} 2>/dev/null`, { stdio: 'ignore', timeout: 3000 });
+          }
+        } catch (e) {
+          // Port is free or error
+        }
+      }
+
+      // Wait for port to be released
+      setTimeout(() => resolve(), 500);
+    } catch (err) {
+      // Silent fail - continue anyway
+      resolve();
+    }
+  });
+}
+
+
+// Detect if running in restricted environment (Codespaces, Docker)
+function isRestrictedEnvironment() {
+  // Check for Codespaces
+  if (process.env.CODESPACES === "true" || process.env.GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN) {
+    return "GitHub Codespaces";
+  }
+
+  // Check for Docker
+  if (fs.existsSync("/.dockerenv") || (fs.existsSync("/proc/1/cgroup") && fs.readFileSync("/proc/1/cgroup", "utf8").includes("docker"))) {
+    return "Docker";
+  }
+
+  return null;
+}
+
+function checkForUpdate() {
+  return new Promise((resolve) => {
+    resolve(null);
+  });
+}
+
+// Open browser
+function openBrowser(url) {
+  const platform = process.platform;
+  let cmd;
+
+  if (platform === "darwin") {
+    cmd = `open "${url}"`;
+  } else if (platform === "win32") {
+    cmd = `start "" "${url}"`;
+  } else {
+    cmd = `xdg-open "${url}"`;
+  }
+
+  exec(cmd, { windowsHide: true }, (err) => {
+    if (err) {
+      console.log(`Open browser manually: ${url}`);
+    }
+  });
+}
+
+// Find standalone server (compiled in dist/server.js for published package)
+const standaloneDir = path.join(__dirname, "..");
+const serverPath = path.join(standaloneDir, "dist/server.js");
+
+if (!fs.existsSync(serverPath)) {
+  console.error("Error: Standalone build not found.");
+  console.error("Please run 'npm run build:cli' first.");
+  process.exit(1);
+}
+
+// Check for updates FIRST, then start server
+checkForUpdate().then((latestVersion) => {
+  killAllAppProcesses(port).then(() => {
+    return killProcessOnPort(port);
+  }).then(() => {
+    startServer(latestVersion);
+  });
+});
+
+// Show interface selection menu
+async function showInterfaceMenu(latestVersion) {
+  const { selectMenu } = require("../dist/cli/utils/input");
+  const { clearScreen } = require("../dist/cli/utils/display");
+  const { getEndpoint } = require("../dist/cli/utils/endpoint");
+
+  clearScreen();
+
+  const displayHost = host === DEFAULT_HOST ? "localhost" : host;
+
+  // Detect tunnel/local mode for server URL display
+  let serverUrl;
+  try {
+    const { endpoint, tunnelEnabled } = await getEndpoint(port);
+    serverUrl = tunnelEnabled ? endpoint.replace(/\/v1$/, "") : `http://${displayHost}:${port}`;
+  } catch (e) {
+    serverUrl = `http://${displayHost}:${port}`;
+  }
+
+  const subtitle = `🚀 Server: \x1b[32m${serverUrl}\x1b[0m`;
+
+  const menuItems = [];
+
+  if (latestVersion) {
+    menuItems.push({ label: `Update to v${latestVersion} (current: v${pkg.version})`, icon: "⬆" });
+  }
+
+  menuItems.push(
+    { label: "Web UI (Open in Browser)", icon: "🌐" },
+    { label: "Terminal UI (Interactive CLI)", icon: "💻" },
+    { label: "Hide to Tray (Background)", icon: "🔔" },
+    { label: "Exit", icon: "🚪" }
+  );
+
+  const selected = await selectMenu(`Choose Interface (v${pkg.version})`, menuItems, 0, subtitle);
+
+  const offset = latestVersion ? 1 : 0;
+
+  if (latestVersion && selected === 0) return "update";
+  if (selected === offset) return "web";
+  if (selected === offset + 1) return "terminal";
+  if (selected === offset + 2) return "hide";
+  return "exit";
+}
+
+const MAX_RESTARTS = 2;
+const RESTART_RESET_MS = 30000; // Reset counter if alive > 30s
+
+function startServer(latestVersion) {
+  const displayHost = host === DEFAULT_HOST ? "localhost" : host;
+  const url = `http://${displayHost}:${port}/dashboard`;
+
+  let restartCount = 0;
+  let serverStartTime = Date.now();
+
+  const CRASH_LOG_LINES = 50;
+  let crashLog = [];
+
+  function spawnServer() {
+    serverStartTime = Date.now();
+    crashLog = [];
+    const child = spawn(RUNTIME, ["--import", "tsx", "--max-old-space-size=6144", serverPath], {
+      cwd: standaloneDir,
+      stdio: showLog ? "inherit" : ["ignore", "ignore", "pipe"],
+      detached: true,
+      windowsHide: true,
+      env: {
+        ...buildEnvWithRuntime(process.env),
+        PORT: port.toString(),
+        HOSTNAME: host
+      }
+    });
+    if (!showLog && child.stderr) {
+      child.stderr.on("data", (data) => {
+        const lines = data.toString().split("\n").filter(Boolean);
+        crashLog.push(...lines);
+        if (crashLog.length > CRASH_LOG_LINES) crashLog = crashLog.slice(-CRASH_LOG_LINES);
+      });
+    }
+    return child;
+  }
+
+  let server = spawnServer();
+
+  // Cleanup function - force kill server process
+  let isCleaningUp = false;
+  function cleanup() {
+    if (isCleaningUp) return;
+    isCleaningUp = true;
+    try {
+      // Kill tray if running
+      try {
+        const { killTray } = require("../dist/cli/tray/tray");
+        killTray();
+      } catch (e) { }
+      // Kill MIT server (privileged process) via PID file
+      killProxyByPidFile();
+      // Kill cloudflared/tailscale via PID file (only this app's tunnel)
+      killTunnelByPidFile();
+      // Kill server process directly
+      if (server.pid) {
+        process.kill(server.pid, "SIGKILL");
+      }
+      // Also try to kill process group
+      process.kill(-server.pid, "SIGKILL");
+    } catch (e) { }
+  }
+
+  // Suppress all errors during shutdown (systray lib throws JSON parse errors)
+  let isShuttingDown = false;
+  process.on("uncaughtException", (err) => {
+    if (isShuttingDown) return;
+    console.error("Error:", err.message);
+  });
+
+  // Handle all exit scenarios
+  process.on("SIGINT", () => {
+    if (isShuttingDown) return;
+    isShuttingDown = true;
+    console.log("\nExiting...");
+    cleanup();
+    setTimeout(() => process.exit(0), 100);
+  });
+  process.on("SIGTERM", () => {
+    if (isShuttingDown) return;
+    isShuttingDown = true;
+    cleanup();
+    setTimeout(() => process.exit(0), 100);
+  });
+  process.on("SIGHUP", () => {
+    if (isShuttingDown) return;
+    isShuttingDown = true;
+    cleanup();
+    setTimeout(() => process.exit(0), 100);
+  });
+
+  // Initialize tray icon (runs alongside TUI)
+  const initTrayIcon = () => {
+    try {
+      const { initTray } = require("../dist/cli/tray/tray");
+      initTray({
+        port,
+        onQuit: () => {
+          isShuttingDown = true;
+          console.log("\n👋 Shutting down from tray...");
+          cleanup();
+          setTimeout(() => process.exit(0), 100);
+        },
+        onOpenDashboard: () => openBrowser(url)
+      });
+    } catch (err) {
+      // Tray not available - continue without it
+    }
+  };
+
+  // Tray-only mode: no TUI, just tray icon
+  if (trayMode) {
+    // Ignore SIGHUP so macOS terminal close doesn't kill the background tray process
+    process.removeAllListeners("SIGHUP");
+    process.on("SIGHUP", () => {});
+
+    console.log(`\n🚀 ${pkg.name} v${pkg.version}`);
+    console.log(`Server: http://${displayHost}:${port}`);
+
+    setTimeout(() => {
+      initTrayIcon();
+      console.log("\n💡 Router is now running in system tray. Close this terminal if you want.");
+      console.log("   Right-click tray icon to open dashboard or quit.\n");
+    }, 2000);
+
+    return;
+  }
+
+  // Wait for server to be ready, then show interface menu loop + tray
+  setTimeout(async () => {
+    // Start tray icon alongside TUI
+    initTrayIcon();
+
+    try {
+      while (true) {
+        const choice = await showInterfaceMenu(latestVersion);
+
+        if (choice === "update") {
+          isShuttingDown = true;
+          const { clearScreen } = require("../dist/cli/utils/display");
+          clearScreen();
+          console.log(`\n⬆  Update v${pkg.version} → v${latestVersion}\n`);
+          console.log(`Run this after exit:\n`);
+          console.log(`   \x1b[33m${INSTALL_CMD_LATEST}\x1b[0m\n`);
+          cleanup();
+          await killAllAppProcesses(port);
+          await killProcessOnPort(port);
+          setTimeout(() => process.exit(0), 200);
+          return;
+        } else if (choice === "web") {
+          openBrowser(url);
+          // Wait for user to come back
+          const { pause } = require("../dist/cli/utils/input");
+          await pause("\nPress Enter to go back to menu...");
+        } else if (choice === "terminal") {
+          // Start Terminal UI - it will return when user selects Back
+          const { startTerminalUI } = require("../dist/cli/terminalUI");
+          await startTerminalUI(port);
+          // Loop continues, show menu again
+        } else if (choice === "hide") {
+          const { clearScreen } = require("../dist/cli/utils/display");
+          clearScreen();
+
+          // Enable auto startup on OS boot
+          try {
+            const { enableAutoStart } = require("../dist/cli/tray/autostart");
+            enableAutoStart(__filename);
+          } catch (e) { }
+
+          if (process.platform === "darwin") {
+            // macOS: keep current process alive — spawning a detached child puts
+            // it outside the login session so NSStatusItem silently fails.
+            process.removeAllListeners("SIGHUP");
+            process.on("SIGHUP", () => {});
+
+            console.log(`\n⏳ Switching to tray mode... (icon already visible in menu bar)`);
+            console.log(`🔔 9Router is running in tray (PID: ${process.pid})`);
+            console.log(`   Server: http://${displayHost}:${port}`);
+            console.log(`\n💡 You can close this terminal. Right-click tray icon to quit.\n`);
+
+            // Tray already init'd at startup — just keep event loop alive.
+            return;
+          }
+
+          // Windows/Linux: spawn detached bgProcess (systray works fine in child)
+          console.log(`\n⏳ Starting background process... (tray icon will appear in ~3s)`);
+
+          const bgProcess = spawn(process.execPath, [__filename, "--tray", "--skip-update", "-p", port.toString()], {
+            detached: true,
+            stdio: "ignore",
+            windowsHide: true,
+            env: { ...process.env }
+          });
+          bgProcess.unref();
+
+          console.log(`🔔 9Router is now running in background (PID: ${bgProcess.pid})`);
+          console.log(`   Server: http://${displayHost}:${port}`);
+          console.log(`\n💡 You can close this terminal. Right-click tray icon to quit.\n`);
+
+          // cleanup() kills server so bgProcess can claim the port fresh
+          cleanup();
+          process.exit(0);
+        } else if (choice === "exit") {
+          isShuttingDown = true;
+          console.log("\nExiting...");
+          cleanup();
+          setTimeout(() => process.exit(0), 100);
+        }
+      }
+    } catch (err) {
+      console.error("Error:", err.message);
+      cleanup();
+      process.exit(1);
+    }
+  }, 3000);
+
+  function attachServerEvents() {
+    server.on("error", (err) => {
+      console.error("Failed to start server:", err.message);
+      if (!isShuttingDown) tryRestart();
+      else { cleanup(); process.exit(1); }
+    });
+
+    server.on("close", (code) => {
+      if (isShuttingDown || code === 0) {
+        process.exit(code || 0);
+        return;
+      }
+      tryRestart(code);
+    });
+  }
+
+  function tryRestart(code) {
+    const aliveMs = Date.now() - serverStartTime;
+    // Reset counter if last run was stable
+    if (aliveMs >= RESTART_RESET_MS) restartCount = 0;
+
+    if (restartCount >= MAX_RESTARTS) {
+      console.error(`\n⚠️  Server crashed ${MAX_RESTARTS} times. Disabling MIT and restarting...`);
+      try {
+        const dbPath = path.join(os.homedir(), process.platform === "win32" ? path.join("AppData", "Roaming", "9router", "db.json") : path.join(".9router", "db.json"));
+        if (fs.existsSync(dbPath)) {
+          const db = JSON.parse(fs.readFileSync(dbPath, "utf-8"));
+          if (db.settings) db.settings.mitmEnabled = false;
+          fs.writeFileSync(dbPath, JSON.stringify(db, null, 2));
+        }
+      } catch { /* best effort */ }
+      restartCount = 0;
+      server = spawnServer();
+      attachServerEvents();
+      return;
+    }
+
+    restartCount++;
+    const delay = Math.min(1000 * restartCount, 10000);
+    console.error(`\n⚠️  Server exited (code=${code ?? "unknown"}). Restarting in ${delay / 1000}s... (${restartCount}/${MAX_RESTARTS})`);
+    if (crashLog.length) {
+      console.error("\n--- Server crash log ---");
+      crashLog.forEach(l => console.error(l));
+      console.error("--- End crash log ---\n");
+    }
+
+    setTimeout(() => {
+      server = spawnServer();
+      attachServerEvents();
+    }, delay);
+  }
+
+  attachServerEvents();
+}

package/bin/copyJs.js

@@ -0,0 +1,114 @@
+import fs from "fs";
+import path from "path";
+
+const srcDir = path.join(process.cwd(), "src");
+const distDir = path.join(process.cwd(), "dist");
+
+function rewriteImports(content, filePath, isJsCopy = false) {
+  const dir = path.dirname(filePath);
+  const relToRoot = path.relative(dir, process.cwd()).replace(/\\/g, '/') || '.';
+  const relToDist = path.relative(dir, distDir).replace(/\\/g, '/') || '.';
+
+  let updated = content;
+
+  // 1. Fix @/ shared/lib/store/etc -> relative imports
+  // If we are copying JS/TS files to dist, they need to resolve relative to dist root
+  updated = updated.replace(/from\s+['"]@\/lib\/([^'"]+)['"]/g, (m, impPath) => {
+    let resolved = impPath;
+    if (!resolved.endsWith('.js') && !resolved.endsWith('.ts') && !resolved.endsWith('.json')) {
+      resolved += '.js';
+    }
+    return `from '${relToDist}/lib/${resolved}'`;
+  });
+  updated = updated.replace(/from\s+['"]@\/lib['"]/g, `from '${relToDist}/lib'`);
+  updated = updated.replace(/require\(['"]@\/lib\/([^'"]+)['"]\)/g, (m, impPath) => `require('${relToDist}/lib/${impPath}')`);
+  updated = updated.replace(/require\(['"]@\/lib['"]\)/g, `require('${relToDist}/lib')`);
+
+  updated = updated.replace(/from\s+['"]@\/shared\/([^'"]+)['"]/g, (m, impPath) => {
+    let resolved = impPath;
+    if (!resolved.endsWith('.js') && !resolved.endsWith('.ts') && !resolved.endsWith('.json')) {
+      resolved += '.js';
+    }
+    return `from '${relToDist}/shared/${resolved}'`;
+  });
+  updated = updated.replace(/require\(['"]@\/shared\/([^'"]+)['"]\)/g, (m, impPath) => `require('${relToDist}/shared/${impPath}')`);
+
+  updated = updated.replace(/from\s+['"]@\/store\/([^'"]+)['"]/g, (m, impPath) => `from '${relToDist}/store/${impPath}'`);
+  updated = updated.replace(/require\(['"]@\/store\/([^'"]+)['"]\)/g, (m, impPath) => `require('${relToDist}/store/${impPath}')`);
+
+  updated = updated.replace(/from\s+['"]@\/services\/([^'"]+)['"]/g, (m, impPath) => `from '${relToDist}/services/${impPath}'`);
+  updated = updated.replace(/require\(['"]@\/services\/([^'"]+)['"]\)/g, (m, impPath) => `require('${relToDist}/services/${impPath}')`);
+
+  updated = updated.replace(/from\s+['"]@\/utils\/([^'"]+)['"]/g, (m, impPath) => `from '${relToDist}/utils/${impPath}'`);
+  updated = updated.replace(/require\(['"]@\/utils\/([^'"]+)['"]\)/g, (m, impPath) => `require('${relToDist}/utils/${impPath}')`);
+
+  // 2. Fix open-sse bare imports to use relative imports from package root
+  // Rel to root points to package root. open-sse is at package root.
+  // Wait, if files are under dist/ (e.g. dist/lib/mcp/stdioSseBridge.js), the package root is relToRoot/.. because processed dir is inside dist.
+  // Wait, copyFiles writes directly to dist. So path.relative(dir, distDir) will resolve back to dist.
+  // Package root is parent of dist. So we can use:
+  const relToPkgRoot = isJsCopy ? path.relative(dir, process.cwd()).replace(/\\/g, '/') : relToRoot;
+  
+  updated = updated.replace(/from\s+['"]open-sse\/([^'"]+)['"]/g, (m, impPath) => `from '${relToPkgRoot}/open-sse/${impPath}'`);
+  updated = updated.replace(/from\s+['"]open-sse['"]/g, `from '${relToPkgRoot}/open-sse/index.js'`);
+  updated = updated.replace(/import\s+['"]open-sse\/([^'"]+)['"]/g, (m, impPath) => `import '${relToPkgRoot}/open-sse/${impPath}'`);
+  updated = updated.replace(/import\s+['"]open-sse['"]/g, `import '${relToPkgRoot}/open-sse/index.js'`);
+
+  // 3. Fix local relative imports that mistakenly double dist
+  updated = updated.replace(/\.\.\/\.\.\/\.\.\/src\//g, '../../../');
+  updated = updated.replace(/\.\.\/\.\.\/src\//g, '../../');
+  
+  // Specific fix for tokenRefresh/providers
+  if (filePath.includes('tokenRefresh')) {
+    updated = updated.replace(/\.\.\/\.\.\/\.\.\/dist\/lib\/oauth\/kiroExternalIdp.js/g, '../../../dist/lib/oauth/kiroExternalIdp.js');
+  }
+
+  return updated;
+}
+
+function copyFiles(src, dist) {
+  if (!fs.existsSync(src)) return;
+  if (!fs.existsSync(dist)) {
+    fs.mkdirSync(dist, { recursive: true });
+  }
+
+  const entries = fs.readdirSync(src, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const srcPath = path.join(src, entry.name);
+    const distPath = path.join(dist, entry.name);
+
+    if (entry.isDirectory()) {
+      if (entry.name === "node_modules" || entry.name === "dist") continue;
+      copyFiles(srcPath, distPath);
+    } else if (entry.isFile() && (entry.name.endsWith(".js") || entry.name.endsWith(".json"))) {
+      let content = fs.readFileSync(srcPath, 'utf8');
+      content = rewriteImports(content, distPath, true);
+      fs.writeFileSync(distPath, content);
+    }
+  }
+}
+
+// Copy open-sse directory recursively to dist
+function copyDirRecursive(src, dest) {
+  if (!fs.existsSync(src)) return;
+  if (!fs.existsSync(dest)) {
+    fs.mkdirSync(dest, { recursive: true });
+  }
+  const entries = fs.readdirSync(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = path.join(src, entry.name);
+    const destPath = path.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      copyDirRecursive(srcPath, destPath);
+    } else {
+      let content = fs.readFileSync(srcPath, 'utf8');
+      content = rewriteImports(content, destPath, false);
+      fs.writeFileSync(destPath, content);
+    }
+  }
+}
+copyDirRecursive(path.join(process.cwd(), "open-sse"), path.join(distDir, "open-sse"));
+
+copyFiles(srcDir, distDir);
+console.log("Copied all JS files from src/ to dist/ with resolved path imports successfully!");

package/bin/hooks/postinstall.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+
+// Postinstall: warm-up SQLite deps into ~/.9router/runtime so the first
+// `9router` start doesn't need network. Failure here is non-fatal —
+// cli.js will retry at runtime if anything is missing.
+const { ensureSqliteRuntime } = require("./sqliteRuntime");
+const { ensureTrayRuntime } = require("./trayRuntime");
+
+try {
+  ensureSqliteRuntime({ silent: false });
+  console.log("[9router] runtime SQLite deps ready");
+} catch (e) {
+  console.warn(`[9router] runtime warm-up skipped: ${e.message}`);
+}
+
+try {
+  ensureTrayRuntime({ silent: false });
+} catch (e) {
+  console.warn(`[9router] tray runtime skipped: ${e.message}`);
+}
+
+process.exit(0);

package/bin/hooks/sqliteRuntime.cjs

@@ -0,0 +1,139 @@
+// Ensure better-sqlite3 is installed in USER_DATA_DIR/runtime/node_modules
+// (user-writable, avoids Windows EBUSY locks during npm i -g updates).
+// sql.js is bundled in bin/app already; node:sqlite / bun:sqlite are built-in.
+const { execSync, spawnSync } = require("child_process");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const BETTER_SQLITE3_VERSION = "12.6.2";
+
+function getDataDir() {
+  if (process.env.DATA_DIR) return process.env.DATA_DIR;
+  return process.platform === "win32"
+    ? path.join(process.env.APPDATA || os.homedir(), "9router")
+    : path.join(os.homedir(), ".9router");
+}
+
+function getRuntimeDir() {
+  return path.join(getDataDir(), "runtime");
+}
+
+function getRuntimeNodeModules() {
+  return path.join(getRuntimeDir(), "node_modules");
+}
+
+function ensureRuntimeDir() {
+  const dir = getRuntimeDir();
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+
+  // Minimal package.json so npm treats it as a project root
+  const pkgPath = path.join(dir, "package.json");
+  if (!fs.existsSync(pkgPath)) {
+    fs.writeFileSync(pkgPath, JSON.stringify({
+      name: "9router-runtime",
+      version: "1.0.0",
+      private: true,
+      description: "User-writable runtime deps for 9router (better-sqlite3 native binary)",
+    }, null, 2));
+  }
+  return dir;
+}
+
+function hasModule(name) {
+  return fs.existsSync(path.join(getRuntimeNodeModules(), name, "package.json"));
+}
+
+function isBetterSqliteBinaryValid() {
+  const binary = path.join(getRuntimeNodeModules(), "better-sqlite3", "build", "Release", "better_sqlite3.node");
+  if (!fs.existsSync(binary)) return false;
+  try {
+    const fd = fs.openSync(binary, "r");
+    const buf = Buffer.alloc(4);
+    fs.readSync(fd, buf, 0, 4, 0);
+    fs.closeSync(fd);
+    const magic = buf.toString("hex");
+    if (process.platform === "linux") return magic.startsWith("7f454c46");
+    if (process.platform === "darwin") return magic.startsWith("cffaedfe") || magic.startsWith("cefaedfe");
+    if (process.platform === "win32") return magic.startsWith("4d5a");
+    return true;
+  } catch { return false; }
+}
+
+// Extract a short, user-friendly reason from npm stderr.
+function summarizeNpmError(stderr = "") {
+  const text = String(stderr);
+  if (/ENOTFOUND|ETIMEDOUT|EAI_AGAIN|network|getaddrinfo/i.test(text)) return "No internet connection or registry unreachable";
+  if (/EACCES|EPERM|permission denied/i.test(text)) return "Permission denied (check folder permissions)";
+  if (/ENOSPC|no space/i.test(text)) return "Not enough disk space";
+  if (/node-gyp|gyp ERR|python|MSBuild|Visual Studio|Xcode/i.test(text)) return "Missing build tools (Xcode CLT / Python / VS Build Tools)";
+  if (/ETARGET|version.*not found/i.test(text)) return "Package version not found on registry";
+  const m = text.match(/npm ERR! (.+)/);
+  if (m) return m[1].slice(0, 200);
+  const lastLine = text.trim().split(/\r?\n/).filter(Boolean).pop();
+  return lastLine ? lastLine.slice(0, 200) : "Unknown error";
+}
+
+function runNpmInstall({ cwd, pkgs, extraArgs = [], timeout = 180000 }) {
+  const args = ["install", ...pkgs, "--no-audit", "--no-fund", "--prefer-online", ...extraArgs];
+  const npmCmd = process.platform === "win32" ? "npm.cmd" : "npm";
+  const res = spawnSync(npmCmd, args, {
+    cwd,
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout,
+    shell: process.platform === "win32",
+    encoding: "utf8",
+  });
+  return { ok: res.status === 0, code: res.status, stderr: res.stderr || "", stdout: res.stdout || "" };
+}
+
+function npmInstall(pkgs, opts = {}) {
+  const cwd = ensureRuntimeDir();
+  const extra = opts.optional ? ["--no-save"] : [];
+  if (!opts.silent) console.log("⏳ Installing SQLite engine (first run)...");
+  const res = runNpmInstall({ cwd, pkgs, extraArgs: extra, timeout: opts.timeout || 180000 });
+  if (!res.ok && !opts.silent) {
+    const reason = summarizeNpmError(res.stderr);
+    console.warn("⚠️  SQLite engine install failed — using fallback");
+    console.warn(`   Reason: ${reason}`);
+    console.warn(`   Retry:  cd "${cwd}" && npm install ${pkgs.join(" ")}`);
+  }
+  return res.ok;
+}
+
+// Public: ensure better-sqlite3 native module is installed in user-writable
+// runtime dir. sql.js is bundled in bin/app already; node:sqlite is built-in.
+// This is purely a *speed optimization* — app works without it via fallbacks.
+function ensureSqliteRuntime({ silent = false } = {}) {
+  ensureRuntimeDir();
+
+  const needBetterSqlite = !hasModule("better-sqlite3") || !isBetterSqliteBinaryValid();
+  if (!needBetterSqlite) {
+    if (!silent) console.log("✅ SQLite engine ready");
+    return { betterSqlite: true };
+  }
+
+  const ok = npmInstall([`better-sqlite3@${BETTER_SQLITE3_VERSION}`], { optional: true, silent });
+  return {
+    betterSqlite: ok && hasModule("better-sqlite3") && isBetterSqliteBinaryValid(),
+  };
+}
+
+// Inject runtime + bundled node_modules into NODE_PATH so child Node processes
+// resolve sql.js (bundled in bin/app/node_modules) and better-sqlite3 (runtime).
+function buildEnvWithRuntime(baseEnv = process.env) {
+  const runtimeNm = getRuntimeNodeModules();
+  const bundledNm = path.join(__dirname, "..", "app", "node_modules");
+  const existing = baseEnv.NODE_PATH || "";
+  const NODE_PATH = [runtimeNm, bundledNm, existing].filter(Boolean).join(path.delimiter);
+  return { ...baseEnv, NODE_PATH };
+}
+
+module.exports = {
+  ensureSqliteRuntime,
+  buildEnvWithRuntime,
+  getRuntimeDir,
+  getRuntimeNodeModules,
+  runNpmInstall,
+  summarizeNpmError,
+};

package/bin/hooks/trayRuntime.cjs

@@ -0,0 +1,107 @@
+// Lazy install systray2 for macOS/Linux into USER_DATA_DIR/runtime/node_modules.
+// Windows uses PowerShell NotifyIcon (no binary) → no systray needed.
+// This keeps the published npm tarball free of unsigned Go binaries that
+// trigger antivirus false positives (e.g. Kaspersky flagging tray_windows.exe).
+//
+// We use the maintained `systray2` fork. The original `systray@1.0.5` package
+// bundles a 2017 x86_64 Go binary whose Mach-O headers are rejected by modern
+// dyld (macOS 14+), so the tray silently fails to register on Apple Silicon.
+const { spawnSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+const { getRuntimeDir, getRuntimeNodeModules, runNpmInstall, summarizeNpmError } = require("./sqliteRuntime.cjs");
+
+const SYSTRAY_PKG = "systray2";
+const SYSTRAY_VERSION = "2.1.4";
+const LEGACY_SYSTRAY_PKG = "systray";
+
+function hasSystray() {
+  return fs.existsSync(path.join(getRuntimeNodeModules(), SYSTRAY_PKG, "package.json"));
+}
+
+// Remove the legacy `systray` package from all known locations.
+// On Windows it was an AV false-positive risk; on macOS/Linux its bundled
+// binary is broken on modern OS versions.
+function cleanupLegacySystray({ silent = false } = {}) {
+  // 1) Runtime dir: ~/.9router/runtime/node_modules/systray (or %APPDATA% on Win)
+  // 2) npm global nested: <npm_prefix>/node_modules/9router/node_modules/systray
+  //    __dirname here = <pkg root>/hooks → up 1 = pkg root
+  const targets = [
+    path.join(getRuntimeNodeModules(), LEGACY_SYSTRAY_PKG),
+    path.join(__dirname, "..", "node_modules", LEGACY_SYSTRAY_PKG)
+  ];
+  for (const dir of targets) {
+    if (fs.existsSync(dir)) {
+      try {
+        fs.rmSync(dir, { recursive: true, force: true });
+        if (!silent) console.log(`[9router][runtime] removed legacy systray: ${dir}`);
+      } catch (e) {
+        if (!silent) console.warn(`[9router][runtime] failed to remove ${dir}: ${e.message}`);
+      }
+    }
+  }
+}
+
+// systray2's npm tarball sometimes ships the bundled Go binary without the
+// executable bit set on macOS, causing spawn() to fail with EACCES. Set +x
+// best-effort so the tray actually starts.
+function chmodSystrayBin({ silent = false } = {}) {
+  if (process.platform === "win32") return;
+  const binName = process.platform === "darwin" ? "tray_darwin_release" : "tray_linux_release";
+  const binPath = path.join(getRuntimeNodeModules(), SYSTRAY_PKG, "traybin", binName);
+  if (!fs.existsSync(binPath)) return;
+  try {
+    fs.chmodSync(binPath, 0o755);
+  } catch (e) {
+    if (!silent) console.warn(`[9router][runtime] chmod tray bin failed: ${e.message}`);
+  }
+}
+
+function ensureRuntimeDir() {
+  const dir = getRuntimeDir();
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  const pkgPath = path.join(dir, "package.json");
+  if (!fs.existsSync(pkgPath)) {
+    fs.writeFileSync(pkgPath, JSON.stringify({
+      name: "9router-runtime",
+      version: "1.0.0",
+      private: true
+    }, null, 2));
+  }
+  return dir;
+}
+
+function npmInstall(pkgs, { silent = false } = {}) {
+  const cwd = ensureRuntimeDir();
+  if (!silent) console.log("⏳ Installing system tray (first run)...");
+  const res = runNpmInstall({ cwd, pkgs, extraArgs: ["--no-save"], timeout: 120000 });
+  if (!res.ok && !silent) {
+    const reason = summarizeNpmError(res.stderr);
+    console.warn("⚠️  System tray install failed — tray disabled");
+    console.warn(`   Reason: ${reason}`);
+    console.warn(`   Retry:  cd "${cwd}" && npm install ${pkgs.join(" ")}`);
+  }
+  return res.ok;
+}
+
+// Public: ensure systray2 is installed on macOS/Linux only.
+// Windows skips entirely (uses PowerShell tray).
+function ensureTrayRuntime({ silent = false } = {}) {
+  // Always evict the legacy `systray` package — its binary is broken on
+  // modern macOS and an AV false-positive on Windows.
+  cleanupLegacySystray({ silent });
+
+  if (process.platform === "win32") {
+    return { systray: false, skipped: true };
+  }
+  if (hasSystray()) {
+    chmodSystrayBin({ silent });
+    if (!silent) console.log("✅ System tray ready");
+    return { systray: true };
+  }
+  const ok = npmInstall([`${SYSTRAY_PKG}@${SYSTRAY_VERSION}`], { silent });
+  if (ok) chmodSystrayBin({ silent });
+  return { systray: ok && hasSystray() };
+}
+
+module.exports = { ensureTrayRuntime };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fudrouter/fsrouter",
-  "version": "0.6.37",
+  "version": "0.6.39",
   "private": false,
   "type": "module",
   "description": "9Router v2 \u2014 Express Backend (API, SSE, DB, Auth, MITM)",
@@ -30,22 +30,14 @@
     "socks-proxy-agent": "^8.0.5",
     "sql.js": "^1.14.1",
     "undici": "^7.10.0",
-    "uuid": "^11.1.0"
+    "uuid": "^11.1.0",
+    "tsx": "^4.19.4",
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@types/node": "^24.0.0"
   },
   "imports": {
     "@/*": "./dist/*",
     "open-sse": "./open-sse/index.js",
     "open-sse/*": "./open-sse/*"
-  },
-  "devDependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "@types/bcryptjs": "^2.4.6",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/cookie-parser": "^1.4.8",
-    "@types/cors": "^2.8.17",
-    "@types/express": "^5.0.3",
-    "@types/node": "^24.0.0",
-    "tsx": "^4.19.4",
-    "typescript": "^5.8.3"
   }
 }