@sifxprime/krouter 0.5.145 → 0.5.147

package/app/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sifxprime/krouter",
-  "version": "0.5.145",
+  "version": "0.5.147",
   "description": "kRouter (Kodelyth Router) CLI — Kodelyth AI Infrastructure",
   "homepage": "https://github.com/sifxprime/krouter",
   "repository": {

package/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "krouter-app",
-  "version": "0.5.145",
+  "version": "0.5.147",
   "description": "kRouter (Kodelyth Router) web dashboard — Kodelyth AI Infrastructure",
   "private": true,
   "scripts": {

package/app/src/lib/db/backup.js

@@ -0,0 +1,35 @@
+import fs from "node:fs";
+import path from "node:path";
+import { BACKUPS_DIR, ensureDirs } from "./paths.js";
+import { timestampSlug, getAppVersion } from "./version.js";
+
+const KEEP_BACKUPS = 5;
+
+export function makeBackupDir(label) {
+  ensureDirs();
+  const ver = getAppVersion();
+  const slug = `${label}-${ver}-${timestampSlug()}`;
+  const dir = path.join(BACKUPS_DIR, slug);
+  fs.mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+export function backupFile(srcPath, destDir, destName = null) {
+  if (!fs.existsSync(srcPath)) return null;
+  const name = destName || path.basename(srcPath);
+  const dest = path.join(destDir, name);
+  fs.copyFileSync(srcPath, dest);
+  return dest;
+}
+
+export function pruneOldBackups() {
+  if (!fs.existsSync(BACKUPS_DIR)) return;
+  const entries = fs.readdirSync(BACKUPS_DIR, { withFileTypes: true })
+    .filter((e) => e.isDirectory())
+    .map((e) => ({ name: e.name, full: path.join(BACKUPS_DIR, e.name), mtime: fs.statSync(path.join(BACKUPS_DIR, e.name)).mtimeMs }))
+    .sort((a, b) => b.mtime - a.mtime);
+
+  for (const old of entries.slice(KEEP_BACKUPS)) {
+    try { fs.rmSync(old.full, { recursive: true, force: true }); } catch {}
+  }
+}

package/app/src/mitm/server.js

@@ -43,7 +43,7 @@ data: [DONE]
       '-WindowStyle','Hidden','-EncodedCommand','${t}'
     ) -Verb RunAs -Wait -PassThru -WindowStyle Hidden;
     if ($proc.ExitCode -ne 0) { throw "Elevated command exited with code $($proc.ExitCode)" }
-  `;return new Promise((r,n)=>{su(`powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command ${lu(a)}`,{windowsHide:!0},(s,i,o)=>{if(s){let u=o||s.message;u.includes("canceled by the user")||u.includes("operation was canceled")?n(new Error("User canceled UAC prompt")):n(new Error(u))}else r(i)})})}cu.exports={isAdmin:uu,runElevatedPowerShell:Qd,quotePs:lu}});var Eu=F((Pp,Cu)=>{var{exec:kp,spawn:du,execSync:Hr}=require("child_process"),_e=require("fs"),$d=require("path"),Dp=require("os"),{log:_a,err:Yd}=Rt(),{TOOL_HOSTS:Gt}=iu(),{runElevatedPowerShell:hu,isAdmin:Up}=fu();function pu(e,t,a){let r=`${e}.krouter.new`,n=`${e}.krouter.bak`;try{_e.writeFileSync(r,a,"utf8");try{_e.unlinkSync(n)}catch{}_e.renameSync(e,n);try{_e.renameSync(r,e)}catch(s){try{_e.renameSync(n,e)}catch{_e.writeFileSync(e,t,"utf8")}throw s}try{_e.unlinkSync(n)}catch{}}finally{try{_e.unlinkSync(r)}catch{}}}var wt=process.platform==="win32",gu=process.platform==="darwin",Ze=wt?$d.join(process.env.SystemRoot||"C:\\Windows","System32","drivers","etc","hosts"):"/etc/hosts";function wa(){if(wt)return!1;try{return Hr("command -v sudo",{stdio:"ignore",windowsHide:!0}),!0}catch{return!1}}function yu(){if(wt||!wa())return!0;try{return Hr("sudo -n true",{stdio:"ignore",windowsHide:!0}),!0}catch{return!1}}function jd(){return!wt&&wa()&&!yu()}function Gr(e,t){return new Promise((a,r)=>{let n=wa(),s=n?du("sudo",["-S","sh","-c",e],{stdio:["pipe","pipe","pipe"],windowsHide:!0}):du("sh",["-c",e],{stdio:["ignore","pipe","pipe"],windowsHide:!0}),i="",o="";s.stdout.on("data",u=>{i+=u}),s.stderr.on("data",u=>{o+=u}),s.on("close",u=>{u===0?a(i):r(new Error(o||`Exit code ${u}`))}),n&&(s.stdin.write(`${t}
+  `;return new Promise((r,n)=>{su(`powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command ${lu(a)}`,{windowsHide:!0},(s,i,o)=>{if(s){let u=o||s.message;u.includes("canceled by the user")||u.includes("operation was canceled")?n(new Error("User canceled UAC prompt")):n(new Error(u))}else r(i)})})}cu.exports={isAdmin:uu,runElevatedPowerShell:Qd,quotePs:lu}});var Eu=F((Pp,Cu)=>{var{exec:kp,spawn:du,execSync:Hr}=require("child_process"),_e=require("fs"),$d=require("path"),Dp=require("os"),{log:_a,err:Yd}=Rt(),{TOOL_HOSTS:Gt}=iu(),{runElevatedPowerShell:hu,isAdmin:Up}=fu();function pu(e,t,a){let r=`${e}.krouter.new`,n=`${e}.krouter.bak`;try{_e.writeFileSync(r,a,"utf8");try{_e.unlinkSync(n)}catch{}_e.renameSync(e,n);try{_e.renameSync(r,e)}catch(s){try{_e.renameSync(n,e)}catch{_e.writeFileSync(e,t,"utf8")}throw s}try{_e.unlinkSync(n)}catch{}}finally{try{_e.unlinkSync(r)}catch{}}}var wt=process.platform==="win32",gu=process.platform==="darwin",Ze=wt?$d.join(process.env.SystemRoot||"C:\\Windows","System32","drivers","etc","hosts"):"/etc/hosts";function wa(){if(wt)return!1;try{return Hr("command -v sudo",{stdio:"ignore",windowsHide:!0}),!0}catch{return!1}}function yu(){if(wt||!wa())return!0;try{return Hr("sudo -n true",{stdio:"ignore",windowsHide:!0}),!0}catch{return!1}}function jd(){return!wt&&wa()&&!yu()}function Gr(e,t){return new Promise((a,r)=>{let n=wa(),s=n?du("sudo",["-S","-p","","sh","-c",e],{stdio:["pipe","pipe","pipe"],windowsHide:!0}):du("sh",["-c",e],{stdio:["ignore","pipe","pipe"],windowsHide:!0}),i="",o="";s.stdout.on("data",u=>{i+=u}),s.stderr.on("data",u=>{o+=u}),s.on("close",u=>{u===0?a(i):r(new Error(o||`Exit code ${u}`))}),n&&(s.stdin.write(`${t}
 `),s.stdin.end())})}async function vu(e){wt||(gu?await Gr("dscacheutil -flushcache && killall -HUP mDNSResponder",e):await Gr("resolvectl flush-caches 2>/dev/null || true",e))}function On(e=null){try{let t=_e.readFileSync(Ze,"utf8");return e?t.includes(e):Gt.antigravity.every(a=>t.includes(a))}catch{return!1}}function Wd(){try{let e=_e.readFileSync(Ze,"utf8"),t={};for(let[a,r]of Object.entries(Gt))t[a]=r.every(n=>e.includes(n));return t}catch{return Object.fromEntries(Object.keys(Gt).map(e=>[e,!1]))}}async function Xd(e,t){let a=Gt[e];if(!a)throw new Error(`Unknown tool: ${e}`);let r=a.filter(n=>!On(n));if(r.length===0){_a(`\u{1F310} DNS ${e}: already active`);return}try{if(wt){let n=_e.readFileSync(Ze,"utf8"),s=n.replace(/[\r\n\s]+$/g,""),i=r.map(u=>`127.0.0.1 ${u}`).join(`\r
 `),o=`${s}\r
 ${i}\r

package/cli.js

@@ -50,10 +50,24 @@ const args = process.argv.slice(2);
 // Self-heal SQLite runtime deps (sql.js + better-sqlite3) into ~/.krouter/runtime
 // so the server can resolve them via NODE_PATH. Best-effort — sql.js is required,
 // better-sqlite3 is optional. Logs to stderr only on failure.
-try { ensureSqliteRuntime({ silent: true }); } catch {}
-
-// Self-heal tray runtime (systray for macOS/Linux only). Windows skipped.
-try { ensureTrayRuntime({ silent: true }); } catch {}
+//
+// This runs before the argument parser, so `--version` and `--help` used to pay for
+// it too: on a machine where the runtime is missing it shells out to a blocking
+// `npm install` whose spawnSync timeout is 180s, printing nothing the whole time.
+// Asking a program its version should never reach the network.
+//
+// KROUTER_SKIP_RUNTIME_HEAL=1 opts out entirely, for an air-gapped or CI machine where
+// reaching npm is either impossible or unwanted. The server still starts; it just uses
+// whatever runtime is already present instead of trying to repair it.
+const RUNTIME_FREE_ARGS = new Set(["--version", "-v", "--help", "-h"]);
+const skipRuntimeHeal =
+  process.env.KROUTER_SKIP_RUNTIME_HEAL === "1" ||
+  process.env.KROUTER_SKIP_RUNTIME_HEAL === "true";
+if (!skipRuntimeHeal && !args.some((a) => RUNTIME_FREE_ARGS.has(a))) {
+  try { ensureSqliteRuntime({ silent: true }); } catch {}
+  // Self-heal tray runtime (systray for macOS/Linux only). Windows skipped.
+  try { ensureTrayRuntime({ silent: true }); } catch {}
+}
 
 // Sweep autostart entries whose binary path no longer exists on disk (e.g. the
 // user uninstalled the global kRouter then reinstalled to a different path).
@@ -79,57 +93,14 @@ const PROCESS_IDENTIFIERS = ['krouter'];
 // fixed in 0.5.51. Safe to re-run — only touches rows that actually
 // have something to lift.
 if (args[0] === "backfill-tokens") {
-  const candidates = [
-    path.join(process.env.HOME || "", ".krouter", "db", "data.sqlite"),
-    process.env.APPDATA ? path.join(process.env.APPDATA, "krouter", "db", "data.sqlite") : null,
-  ].filter(Boolean);
-  const dbPath = candidates.find(p => fs.existsSync(p));
-  if (!dbPath) {
-    console.error("No krouter database found at:", candidates.join(" or "));
-    process.exit(1);
-  }
-  console.log("DB:", dbPath);
-  const rows = JSON.parse(execSync(
-    `sqlite3 -json "${dbPath}" "SELECT id, data FROM requestDetails WHERE json_extract(data,'$.tokens.prompt_tokens')=0 AND (json_extract(data,'$.providerResponse.response.usageMetadata.promptTokenCount') IS NOT NULL OR json_extract(data,'$.providerResponse.usageMetadata.promptTokenCount') IS NOT NULL)"`,
-    { encoding: "utf8", maxBuffer: 512 * 1024 * 1024 }
-  ) || "[]");
-  console.log(`Candidates with extractable tokens: ${rows.length}`);
-  let updated = 0;
-  // 0.5.53 — stream UPDATEs through stdin so SQLite parses each statement
-  // itself. Avoids the JSON-in-shell-quoted-SQL mangling that swallowed
-  // every row silently on the first attempt.
-  const tmpScript = path.join(os.tmpdir(), `krouter-backfill-${Date.now()}.sql`);
-  const sqlLines = ["BEGIN;"];
-  for (const row of rows) {
-    try {
-      const d = JSON.parse(row.data);
-      const um = d.providerResponse?.response?.usageMetadata || d.providerResponse?.usageMetadata;
-      if (!um) continue;
-      const promptTokens = um.promptTokenCount || 0;
-      const completionTokens = um.candidatesTokenCount || 0;
-      const reasoningTokens = um.thoughtsTokenCount;
-      if (promptTokens === 0 && completionTokens === 0) continue;
-      d.tokens = { ...(d.tokens || {}), prompt_tokens: promptTokens, completion_tokens: completionTokens };
-      if (reasoningTokens !== undefined) d.tokens.reasoning_tokens = reasoningTokens;
-      const escapedData = JSON.stringify(d).replace(/'/g, "''");
-      const escapedId = String(row.id).replace(/'/g, "''");
-      sqlLines.push(`UPDATE requestDetails SET data='${escapedData}' WHERE id='${escapedId}';`);
-      updated++;
-    } catch (e) {
-      console.error(`  row ${row.id} skipped: ${e.message}`);
-    }
-  }
-  sqlLines.push("COMMIT;");
-  fs.writeFileSync(tmpScript, sqlLines.join("\n"));
-  try {
-    execSync(`sqlite3 "${dbPath}" < "${tmpScript}"`, { stdio: ["ignore", "pipe", "pipe"] });
-    console.log(`Backfilled ${updated} rows. Usage page totals will now reflect real token spend.`);
-  } catch (e) {
-    console.error(`Failed to apply: ${e.message?.split("\n")?.[0] || e}`);
-    console.error(`SQL script left at ${tmpScript} for inspection.`);
-    process.exit(2);
-  }
-  try { fs.unlinkSync(tmpScript); } catch { /* ignore */ }
+  // Kept so any script that calls it keeps working, but it no longer does the work
+  // itself. It used to shell out to the `sqlite3` CLI, which is not present on a
+  // stock Windows install, so it exited with a raw Node stack there. The same
+  // backfill now runs unconditionally at every server start via
+  // autoBackfillTokensIfNeeded() in src/shared/services/initializeApp.js, in pure JS
+  // through the app's own DB adapter — no external binary, no shell quoting.
+  console.log("Token backfill now runs automatically every time kRouter starts.");
+  console.log("Nothing to do here — start kRouter normally and it will be applied.");
   process.exit(0);
 }
 
@@ -141,23 +112,49 @@ let skipUpdate = false;
 let showLog = false;
 let trayMode = false;
 
+// `--flag=value` is the other half of the convention people expect; it used to fall
+// through every branch and be dropped in silence, so `--port=3000` started the server
+// on the default port instead.
+function splitInlineValue(arg) {
+  const eq = arg.indexOf("=");
+  if (!arg.startsWith("-") || eq < 0) return null;
+  return { flag: arg.slice(0, eq), value: arg.slice(eq + 1) };
+}
+
 for (let i = 0; i < args.length; i++) {
-  if (args[i] === "--port" || args[i] === "-p") {
-    port = parseInt(args[i + 1], 10) || DEFAULT_PORT;
-    i++;
-  } else if (args[i] === "--host" || args[i] === "-H") {
-    host = args[i + 1] || DEFAULT_HOST;
-    i++;
-  } else if (args[i] === "--no-browser" || args[i] === "-n") {
+  const inline = splitInlineValue(args[i]);
+  const arg = inline ? inline.flag : args[i];
+  // Reading a value consumes the next argv entry only when it was not inlined.
+  const takeValue = () => (inline ? inline.value : args[++i]);
+
+  if (arg === "--port" || arg === "-p") {
+    const raw = takeValue();
+    // parseInt used to accept "3000abc" as 3000 and turn a typo, an empty value or a
+    // missing one into DEFAULT_PORT — which is then force-freed by killProcessOnPort.
+    // Silently starting on a different port than asked is worse than refusing.
+    const parsed = Number(raw);
+    if (raw === undefined || raw === "" || !Number.isInteger(parsed) || parsed < 1 || parsed > 65535) {
+      console.error(`Invalid --port value: ${raw === undefined || raw === "" ? "(missing)" : raw}. Expected an integer between 1 and 65535.`);
+      process.exit(2);
+    }
+    port = parsed;
+  } else if (arg === "--host" || arg === "-H") {
+    const raw = takeValue();
+    if (!raw) {
+      console.error("Invalid --host value: (missing). Expected a hostname or IP, e.g. 127.0.0.1.");
+      process.exit(2);
+    }
+    host = raw;
+  } else if (arg === "--no-browser" || arg === "-n") {
     noBrowser = true;
-  } else if (args[i] === "--log" || args[i] === "-l") {
+  } else if (arg === "--log" || arg === "-l") {
     showLog = true;
-  } else if (args[i] === "--skip-update") {
+  } else if (arg === "--skip-update") {
     skipUpdate = true;
-  } else if (args[i] === "--tray" || args[i] === "-t") {
+  } else if (arg === "--tray" || arg === "-t") {
     trayMode = true;
     process.env.TRAY_MODE = "1";
-  } else if (args[i] === "--help" || args[i] === "-h") {
+  } else if (arg === "--help" || arg === "-h") {
     console.log(`
 Usage: ${APP_NAME} [options]
 
@@ -172,9 +169,16 @@ Options:
   -v, --version       Show version
 `);
     process.exit(0);
-  } else if (args[i] === "--version" || args[i] === "-v") {
+  } else if (arg === "--version" || arg === "-v") {
     console.log(pkg.version);
     process.exit(0);
+  } else {
+    // No terminal branch existed, so anything unrecognised was dropped without a
+    // word: `krouter --prot 3000` or `krouter start` ran on the default port and
+    // looked like it had worked.
+    console.error(`Unknown option: ${args[i]}`);
+    console.error(`Run \`${APP_NAME} --help\` to see the available options.`);
+    process.exit(2);
   }
 }
 
@@ -278,58 +282,92 @@ function killAllAppProcesses(appPort) {
       if (platform === "win32") {
         // Windows: use WMI to get full CommandLine (tasklist /V doesn't include it)
         try {
-          const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"node.exe\\"' | Select-Object ProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation"`;
+          // Same ancestry rule as the POSIX branch below: a bare "next-server" match
+          // would take down every Next server on the machine, our own being
+          // indistinguishable from anyone else's by command line.
+          const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"node.exe\\"' | Select-Object ProcessId,ParentProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation"`;
           const output = execSync(psCmd, {
             encoding: "utf8",
             windowsHide: true,
             timeout: 5000
           });
-          const lines = output.split("\n").slice(1).filter(l => l.trim());
-          lines.forEach(line => {
-            // Whitelist: real node process running krouter cli.js, or next-server.
-            // Avoids killing editors/grep/strace/cursor that just incidentally match the name.
-            const cmd = line.toLowerCase();
-            const hasAppName = cmd.includes("krouter");
-            const hasAppPath = cmd.includes("cli.js") || cmd.includes("\\krouter") || cmd.includes("/krouter");
-            const isAppProcess =
-              (cmd.includes("node") && hasAppName && hasAppPath)
-              || cmd.includes("next-server");
-            if (isAppProcess) {
-              const match = line.match(/^"(\d+)"/);
-              if (match && match[1] && match[1] !== process.pid.toString()) {
-                pids.push(match[1]);
-              }
+          const rows = output.split("\n").slice(1).filter(l => l.trim()).map(line => {
+            const m = line.match(/^"(\d+)","(\d+)",(.*)$/);
+            return m ? { pid: m[1], ppid: m[2], cmd: (m[3] || "").toLowerCase() } : null;
+          }).filter(Boolean);
+
+          // Same rule as the POSIX branch: the invoked script, not any mention of it.
+          const isCliInvocation = (cmd) =>
+            /(^|[\s"'])[^\s"']*[\/\\]krouter[\/\\]cli\.js(\s|$|["'])/i.test(cmd) ||
+            /(^|[\s"'])[^\s"']*[\/\\]\.bin[\/\\]krouter(\s|$|["'])/i.test(cmd);
+          const roots = new Set(rows.filter(r => isCliInvocation(r.cmd)).map(r => r.pid));
+          const byParent = new Map();
+          for (const r of rows) {
+            if (!byParent.has(r.ppid)) byParent.set(r.ppid, []);
+            byParent.get(r.ppid).push(r.pid);
+          }
+          const doomed = new Set(roots);
+          const queue = [...roots];
+          while (queue.length) {
+            for (const child of byParent.get(queue.shift()) || []) {
+              if (!doomed.has(child)) { doomed.add(child); queue.push(child); }
             }
-          });
+          }
+          for (const pid of doomed) {
+            if (pid !== process.pid.toString()) pids.push(pid);
+          }
         } catch (e) {
           // No processes found or error - continue
         }
       } else {
-        // macOS/Linux: use ps to find all matching processes
+        // macOS/Linux. Identify our own processes by ancestry, never by name.
+        //
+        // Next renames its server process to a bare "next-server (v16.3.1)" -- no path,
+        // no project, nothing tying it to an app. Matching that string killed every
+        // Next server on the machine, so starting kRouter SIGKILLed a developer's
+        // unrelated dev server. The whitelist above it could not help: our own server
+        // matches by that string and nothing else, so the two are indistinguishable
+        // from the command line alone. Ancestry is the only thing that separates them.
         try {
-          const output = execSync('ps aux 2>/dev/null', {
+          const output = execSync('ps -Ao pid,ppid,command 2>/dev/null', {
             encoding: 'utf8',
             timeout: 5000
           });
-          const lines = output.split('\n');
-
-          lines.forEach(line => {
-            // Whitelist: real node process running krouter cli.js, or next-server.
-            // Avoids killing grep/strace/editors/cursor that incidentally match the name.
-            const cmd = line.toLowerCase();
-            const hasAppName = cmd.includes("krouter");
-            const hasAppPath = cmd.includes("cli.js") || cmd.includes("/krouter");
-            const isAppProcess =
-              (cmd.includes("node") && hasAppName && hasAppPath)
-              || cmd.includes("next-server");
-            if (isAppProcess) {
-              const parts = line.trim().split(/\s+/);
-              const pid = parts[1];
-              if (pid && !isNaN(pid) && pid !== process.pid.toString()) {
-                pids.push(pid);
-              }
+          const rows = output.split('\n').slice(1)
+            .map(l => l.trim().match(/^(\d+)\s+(\d+)\s+(.*)$/))
+            .filter(Boolean)
+            .map(m => ({ pid: m[1], ppid: m[2], cmd: m[3].toLowerCase() }));
+
+          // Roots: node processes whose *invoked script* is this CLI. Testing for
+          // "krouter" anywhere in the command line would promote any process that
+          // merely mentions the app -- a grep, an editor, a script taking the path as
+          // an argument -- into a root, and every descendant of a root is killed.
+          // Match the argv[1] path instead.
+          const isCliInvocation = (cmd) =>
+            /(^|[\s"'])[^\s"']*[\/\\]krouter[\/\\]cli\.js(\s|$|["'])/i.test(cmd) ||
+            /(^|[\s"'])[^\s"']*[\/\\]\.bin[\/\\]krouter(\s|$|["'])/i.test(cmd);
+          const roots = new Set(
+            rows.filter(r => r.cmd.includes("node") && isCliInvocation(r.cmd)).map(r => r.pid)
+          );
+
+          // Everything descended from a root, however deep. Next spawns its server as
+          // a child, so this reaches it without ever matching on "next-server".
+          const byParent = new Map();
+          for (const r of rows) {
+            if (!byParent.has(r.ppid)) byParent.set(r.ppid, []);
+            byParent.get(r.ppid).push(r.pid);
+          }
+          const doomed = new Set(roots);
+          const queue = [...roots];
+          while (queue.length) {
+            for (const child of byParent.get(queue.shift()) || []) {
+              if (!doomed.has(child)) { doomed.add(child); queue.push(child); }
             }
-          });
+          }
+
+          for (const pid of doomed) {
+            if (pid !== process.pid.toString()) pids.push(pid);
+          }
         } catch (e) {
           // No processes found or error - continue
         }
@@ -408,6 +446,42 @@ function killProxyByPidFile() {
   } catch { }
 }
 
+// Is this PID one of our own server processes?
+//
+// killProcessOnPort used to kill-9 whatever `lsof -ti:PORT` returned, with no check on
+// what it was. `krouter --port 3000` destroyed the user's own app on 3000 and
+// `--port 5432` took out their Postgres, silently and before anything was printed.
+//
+// An orphaned kRouter server is the hard case: its parent CLI is gone, so ancestry
+// cannot reach it, and Next has renamed it to a bare "next-server (vX)", so the command
+// line says nothing either. spawnServer pins cwd to standaloneDir, and that survives
+// both — it is the one durable marker of "this install's server".
+function isOwnServerPid(pid) {
+  try {
+    const mine = fs.realpathSync(standaloneDir);
+    if (process.platform === "linux") {
+      return fs.realpathSync(`/proc/${pid}/cwd`) === mine;
+    }
+    if (process.platform === "darwin") {
+      const out = execSync(`lsof -a -p ${pid} -d cwd -Fn 2>/dev/null`, {
+        encoding: "utf8", timeout: 3000, stdio: ["pipe", "pipe", "ignore"],
+      });
+      const line = out.split("\n").find((l) => l.startsWith("n"));
+      return !!line && fs.realpathSync(line.slice(1).trim()) === mine;
+    }
+    if (process.platform === "win32") {
+      // No cheap cwd read on Windows. Fall back to the executable path, which for our
+      // server points inside the package directory.
+      const out = execSync(
+        `powershell -NonInteractive -WindowStyle Hidden -Command "(Get-Process -Id ${pid} -ErrorAction SilentlyContinue).Path"`,
+        { encoding: "utf8", windowsHide: true, timeout: 4000 }
+      ).trim();
+      return !!out && out.toLowerCase().includes("krouter");
+    }
+  } catch { /* process gone, or no permission to inspect it — treat as not ours */ }
+  return false;
+}
+
 // Kill ALL processes listening on the given port. Returns true if any were killed.
 // Previous version: on Windows only killed the first PID from netstat, missing
 // parent/child pairs (next-server has a watcher + worker). Now sweeps all PIDs.
@@ -417,6 +491,7 @@ function killProcessOnPort(port) {
     try {
       const platform = process.platform;
       const pidsToKill = new Set();
+      const foreign = [];
 
       if (platform === "win32") {
         try {
@@ -428,7 +503,9 @@ function killProcessOnPort(port) {
           }).trim();
           output.split('\n').filter(l => l.includes('LISTENING')).forEach(line => {
             const pid = line.trim().split(/\s+/).pop();
-            if (pid && /^\d+$/.test(pid) && pid !== String(process.pid)) pidsToKill.add(pid);
+            if (!pid || !/^\d+$/.test(pid) || pid === String(process.pid)) return;
+            if (isOwnServerPid(pid)) pidsToKill.add(pid);
+            else foreign.push(pid);
           });
           for (const pid of pidsToKill) {
             try {
@@ -447,7 +524,11 @@ function killProcessOnPort(port) {
             stdio: ['pipe', 'pipe', 'ignore']
           }).trim();
           pidOutput.split('\n').filter(Boolean).forEach(pid => {
-            if (pid !== String(process.pid)) pidsToKill.add(pid);
+            if (pid === String(process.pid)) return;
+            // Only ever kill our own server. Anything else holding the port is the
+            // user's — say so and let them choose the port, rather than killing it.
+            if (isOwnServerPid(pid)) pidsToKill.add(pid);
+            else foreign.push(pid);
           });
           for (const pid of pidsToKill) {
             try {
@@ -460,6 +541,26 @@ function killProcessOnPort(port) {
         }
       }
 
+      // Something that is not ours is holding the port. Say so and name it, instead
+      // of failing to start with no explanation -- the caller only learns "port busy".
+      if (foreign.length) {
+        const described = foreign.map((pid) => {
+          try {
+            const name = platform === "win32"
+              ? execSync(`powershell -NonInteractive -WindowStyle Hidden -Command "(Get-Process -Id ${pid} -ErrorAction SilentlyContinue).ProcessName"`,
+                  { encoding: "utf8", windowsHide: true, timeout: 4000 }).trim()
+              : execSync(`ps -p ${pid} -o comm= 2>/dev/null`, { encoding: "utf8", timeout: 3000 }).trim();
+            return name ? `${name} (pid ${pid})` : `pid ${pid}`;
+          } catch { return `pid ${pid}`; }
+        });
+        console.error(`\n⚠️  Port ${port} is held by ${described.join(", ")} — not kRouter.`);
+        console.error(`   Refusing to kill it. Start kRouter on another port, e.g. --port ${port + 1}.\n`);
+        // Exit rather than fall through: we deliberately did not free the port, so
+        // every subsequent bind attempt fails. The retry path treats EADDRINUSE as
+        // transient and would spin here forever.
+        process.exit(1);
+      }
+
       // Wait for kernel to release the socket (Windows is slow here, give it 1s).
       // Then verify the port is actually free — if not, surface the result so
       // the caller can decide whether to retry or fail-fast.
@@ -648,6 +749,10 @@ function startServer(latestVersion) {
     const lanIp = getLanIp();
     if (lanIp) {
       console.log(`\x1b[33m⚠ Network-exposed: reachable at http://${lanIp}:${port} (bound 0.0.0.0). Use --host 127.0.0.1 for local-only.\x1b[0m`);
+      // Remote callers already need an API key for /v1/* and a login for the
+      // dashboard, so the exposure is bounded. Say so, rather than leaving the
+      // reader to guess whether their provider quota is reachable.
+      console.log(`\x1b[33m  Remote callers still need an API key for /v1/* and a login for the dashboard.\x1b[0m`);
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sifxprime/krouter",
-  "version": "0.5.145",
+  "version": "0.5.147",
   "description": "kRouter (Kodelyth Router) CLI — Kodelyth AI Infrastructure",
   "homepage": "https://github.com/sifxprime/krouter",
   "repository": {

package/src/cli/tray/tray.ps1

@@ -48,26 +48,50 @@ function Set-Tooltip($text) {
   $script:notifyIcon.Text = $text
 }
 
-# Background reader thread polls stdin via timer on UI thread
+# stdin is polled from a System.Windows.Forms.Timer, whose Tick runs on the very
+# thread Application::Run() pumps. The previous loop guarded on [Console]::In.Peek(),
+# which does not return -1 on an open-but-idle pipe -- it blocks until the next byte
+# arrives. So the first tick after the startup burst never returned, the message pump
+# stopped, and the tray icon appeared but ignored every click: no menu, no Quit.
+#
+# [Console]::In is a SyncTextReader whose ReadLineAsync() is synchronous too, so it
+# cannot be used either. Read the raw handle through our own StreamReader and poll a
+# genuinely async task, so the Tick handler always returns immediately.
+$script:stdin   = New-Object System.IO.StreamReader([Console]::OpenStandardInput(), [System.Text.Encoding]::UTF8)
+$script:pending = $null
+
 $script:timer = New-Object System.Windows.Forms.Timer
 $script:timer.Interval = 100
 $script:timer.Add_Tick({
   try {
-    while ([Console]::In.Peek() -ne -1) {
-      $line = [Console]::In.ReadLine()
-      if ([string]::IsNullOrWhiteSpace($line)) { continue }
-      $cmd = $line | ConvertFrom-Json
-      switch ($cmd.action) {
-        "add-item"    { Add-MenuItem $cmd.index $cmd.title $cmd.enabled }
-        "update-item" { Update-MenuItem $cmd.index $cmd.title $cmd.enabled }
-        "set-tooltip" { Set-Tooltip $cmd.text }
-        "ready"       { Write-Event @{ type = "ready" } }
-        "kill"        {
-          $script:notifyIcon.Visible = $false
-          $script:notifyIcon.Dispose()
-          [System.Windows.Forms.Application]::Exit()
+    if ($null -eq $script:pending) { $script:pending = $script:stdin.ReadLineAsync() }
+    while ($script:pending.IsCompleted) {
+      $line = $script:pending.Result
+      $script:pending = $null
+      if ($null -eq $line) {
+        # EOF: the Node parent is gone. Exit instead of lingering as a dead icon the
+        # user can only clear through Task Manager.
+        $script:notifyIcon.Visible = $false
+        $script:notifyIcon.Dispose()
+        [System.Windows.Forms.Application]::Exit()
+        return
+      }
+      if (-not [string]::IsNullOrWhiteSpace($line)) {
+        $cmd = $line | ConvertFrom-Json
+        switch ($cmd.action) {
+          "add-item"    { Add-MenuItem $cmd.index $cmd.title $cmd.enabled }
+          "update-item" { Update-MenuItem $cmd.index $cmd.title $cmd.enabled }
+          "set-tooltip" { Set-Tooltip $cmd.text }
+          "ready"       { Write-Event @{ type = "ready" } }
+          "kill"        {
+            $script:notifyIcon.Visible = $false
+            $script:notifyIcon.Dispose()
+            [System.Windows.Forms.Application]::Exit()
+            return
+          }
         }
       }
+      $script:pending = $script:stdin.ReadLineAsync()
     }
   } catch {
     Write-Event @{ type = "error"; message = $_.Exception.Message }

package/src/cli/utils/input.js

@@ -157,7 +157,19 @@ async function selectMenu(title, items, defaultIndex = 0, subtitle = "", headerC
       if (key.name === "down") return move(1);
       if (key.name === "return") { cleanup(); resolve(selectedIndex); return; }
       if (key.name === "escape") { cleanup(); resolve(-1); return; }
-      if (key.ctrl && key.name === "c") { cleanup(); process.exit(0); }
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        // Raw mode clears termios ISIG, so Ctrl-C arrives here as an ordinary
+        // keypress rather than as SIGINT. Exiting straight from here skipped
+        // cli.js's SIGINT handler -- the only thing that kills the detached server
+        // child, the privileged MITM process and any tunnel -- so quitting from the
+        // menu left all three running with no UI left to stop them. Restore cooked
+        // mode and re-raise the signal so that handler actually runs.
+        try { process.stdin.setRawMode(false); } catch {}
+        rawPrimed = false;
+        process.kill(process.pid, "SIGINT");
+        return;
+      }
     };
 
     process.stdin.on("keypress", onKeypress);