@yina-npm/openrouterx 0.4.11 → 0.4.19

package/app/src/mitm/dns/dnsConfig.js

@@ -4,7 +4,32 @@ const path = require("path");
 const os = require("os");
 const { log, err } = require("../logger");
 const { TOOL_HOSTS } = require("../../shared/constants/mitmToolHosts");
-const { runElevatedPowerShell, quotePs, isAdmin } = require("../winElevated.js");
+const { runElevatedPowerShell, isAdmin } = require("../winElevated.js");
+
+/**
+ * Atomic-ish write for Windows hosts file with rollback on failure.
+ * Strategy: write `.new` sibling → rename current to `.bak` → rename `.new` to target.
+ * If anything fails mid-way, restore from `.bak`. Same-volume renames are atomic on NTFS.
+ */
+function atomicWriteHostsWin(target, originalContent, newContent) {
+  const tmpNew = `${target}.9router.new`;
+  const tmpBak = `${target}.9router.bak`;
+  try {
+    fs.writeFileSync(tmpNew, newContent, "utf8");
+    try { fs.unlinkSync(tmpBak); } catch { /* none */ }
+    fs.renameSync(target, tmpBak);
+    try {
+      fs.renameSync(tmpNew, target);
+    } catch (e) {
+      // Rollback: restore original
+      try { fs.renameSync(tmpBak, target); } catch { fs.writeFileSync(target, originalContent, "utf8"); }
+      throw e;
+    }
+    try { fs.unlinkSync(tmpBak); } catch { /* best effort */ }
+  } finally {
+    try { fs.unlinkSync(tmpNew); } catch { /* already moved or never created */ }
+  }
+}
 
 const IS_WIN = process.platform === "win32";
 const IS_MAC = process.platform === "darwin";
@@ -23,6 +48,20 @@ function isSudoAvailable() {
   }
 }
 
+function canRunSudoWithoutPassword() {
+  if (IS_WIN || !isSudoAvailable()) return true;
+  try {
+    execSync("sudo -n true", { stdio: "ignore", windowsHide: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isSudoPasswordRequired() {
+  return !IS_WIN && isSudoAvailable() && !canRunSudoWithoutPassword();
+}
+
 /**
  * Execute command with sudo password via stdin (macOS/Linux only).
  * Without sudo in PATH (containers), runs via sh — same user, no elevation.
@@ -51,6 +90,14 @@ function execWithPassword(command, password) {
   });
 }
 
+/**
+ * Trim trailing blank lines/whitespace, ensure file ends with exactly one newline.
+ */
+function normalizeHostsContent(content) {
+  const eol = IS_WIN ? "\r\n" : "\n";
+  return content.replace(/[\r\n\s]+$/g, "") + eol;
+}
+
 /**
  * Flush DNS cache (macOS/Linux)
  */
@@ -106,19 +153,23 @@ async function addDNSEntry(tool, sudoPassword) {
     return;
   }
 
-  const entries = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\n");
-
   try {
     if (IS_WIN) {
-      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("`r`n");
-      // Single elevated script: append to hosts + flush DNS (1 UAC popup, or zero if admin)
-      const script = `
-        Add-Content -LiteralPath ${quotePs(HOSTS_FILE)} -Value ${quotePs(toAppend)}
-        ipconfig /flushdns | Out-Null
-      `;
-      await runElevatedPowerShell(script);
+      // Read → trim → append → atomic write (Node-side, no CLI size limit)
+      const current = fs.readFileSync(HOSTS_FILE, "utf8");
+      const trimmed = current.replace(/[\r\n\s]+$/g, "");
+      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\r\n");
+      const next = `${trimmed}\r\n${toAppend}\r\n`;
+      atomicWriteHostsWin(HOSTS_FILE, current, next);
+      await runElevatedPowerShell("ipconfig /flushdns | Out-Null");
     } else {
-      await execWithPassword(`echo "${entries}" >> ${HOSTS_FILE}`, sudoPassword);
+      const current = fs.readFileSync(HOSTS_FILE, "utf8");
+      const trimmed = current.replace(/[\r\n\s]+$/g, "");
+      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\n");
+      const next = `${trimmed}\n${toAppend}\n`;
+      // Use tee via sudo to overwrite atomically — escape single quotes in content
+      const escaped = next.replace(/'/g, "'\\''");
+      await execWithPassword(`printf '%s' '${escaped}' | tee ${HOSTS_FILE} > /dev/null`, sudoPassword);
       await flushDNS(sudoPassword);
     }
     log(`🌐 DNS ${tool}: ✅ added ${entriesToAdd.join(", ")}`);
@@ -143,26 +194,17 @@ async function removeDNSEntry(tool, sudoPassword) {
 
   try {
     if (IS_WIN) {
-      // Build PowerShell list literal of hosts to strip
-      const hostsList = entriesToRemove.map(quotePs).join(",");
-      const script = `
-        $hosts = @(${hostsList})
-        $lines = Get-Content -LiteralPath ${quotePs(HOSTS_FILE)}
-        $filtered = $lines | Where-Object {
-          $line = $_
-          -not ($hosts | Where-Object { $line -match [regex]::Escape($_) })
-        }
-        Set-Content -LiteralPath ${quotePs(HOSTS_FILE)} -Value $filtered
-        ipconfig /flushdns | Out-Null
-      `;
-      await runElevatedPowerShell(script);
+      const current = fs.readFileSync(HOSTS_FILE, "utf8");
+      const filtered = current.split(/\r?\n/).filter(l => !entriesToRemove.some(h => l.includes(h))).join("\r\n");
+      const next = filtered.replace(/[\r\n\s]+$/g, "") + "\r\n";
+      atomicWriteHostsWin(HOSTS_FILE, current, next);
+      await runElevatedPowerShell("ipconfig /flushdns | Out-Null");
     } else {
-      for (const host of entriesToRemove) {
-        const sedCmd = IS_MAC
-          ? `sed -i '' '/${host}/d' ${HOSTS_FILE}`
-          : `sed -i '/${host}/d' ${HOSTS_FILE}`;
-        await execWithPassword(sedCmd, sudoPassword);
-      }
+      const current = fs.readFileSync(HOSTS_FILE, "utf8");
+      const filtered = current.split(/\r?\n/).filter(l => !entriesToRemove.some(h => l.includes(h))).join("\n");
+      const next = filtered.replace(/[\r\n\s]+$/g, "") + "\n";
+      const escaped = next.replace(/'/g, "'\\''");
+      await execWithPassword(`printf '%s' '${escaped}' | tee ${HOSTS_FILE} > /dev/null`, sudoPassword);
       await flushDNS(sudoPassword);
     }
     log(`🌐 DNS ${tool}: ✅ removed ${entriesToRemove.join(", ")}`);
@@ -196,8 +238,9 @@ function removeAllDNSEntriesSync() {
     const content = fs.readFileSync(HOSTS_FILE, "utf8");
     const eol = IS_WIN ? "\r\n" : "\n";
     const filtered = content.split(/\r?\n/).filter(l => !allHosts.some(h => l.includes(h))).join(eol);
-    if (filtered === content) return;
-    fs.writeFileSync(HOSTS_FILE, filtered, "utf8");
+    const next = filtered.replace(/[\r\n\s]+$/g, "") + eol;
+    if (next === content) return;
+    fs.writeFileSync(HOSTS_FILE, next, "utf8");
     if (IS_WIN) {
       try { execSync("ipconfig /flushdns", { windowsHide: true, stdio: "ignore" }); } catch { /* ignore */ }
     } else if (IS_MAC) {
@@ -216,6 +259,8 @@ module.exports = {
   removeAllDNSEntriesSync,
   execWithPassword,
   isSudoAvailable,
+  canRunSudoWithoutPassword,
+  isSudoPasswordRequired,
   checkDNSEntry,
   checkAllDNSStatus,
 };

package/app/src/mitm/manager.js

@@ -5,7 +5,8 @@ const os = require("os");
 const net = require("net");
 const https = require("https");
 const crypto = require("crypto");
-const { addDNSEntry, removeDNSEntry, removeAllDNSEntries, checkAllDNSStatus, TOOL_HOSTS, isSudoAvailable } = require("./dns/dnsConfig");
+const { addDNSEntry, removeDNSEntry, removeAllDNSEntries, removeAllDNSEntriesSync, checkAllDNSStatus, TOOL_HOSTS, isSudoAvailable, isSudoPasswordRequired } = require("./dns/dnsConfig");
+const { isAdmin } = require("./winElevated.js");
 
 const IS_WIN = process.platform === "win32";
 const IS_MAC = process.platform === "darwin";
@@ -108,9 +109,9 @@ function killProcess(pid, force = false, sudoPassword = null) {
   } else {
     const sig = force ? "SIGKILL" : "SIGTERM";
     const cmd = `pkill -${sig} -P ${pid} 2>/dev/null; kill -${sig} ${pid} 2>/dev/null`;
-    if (sudoPassword) {
+    if (sudoPassword || isSudoAvailable()) {
       const { execWithPassword } = require("./dns/dnsConfig");
-      execWithPassword(cmd, sudoPassword).catch(() => exec(cmd, { windowsHide: true }, () => { }));
+      execWithPassword(cmd, sudoPassword || "").catch(() => exec(cmd, { windowsHide: true }, () => { }));
     } else {
       exec(cmd, { windowsHide: true }, () => { });
     }
@@ -188,6 +189,55 @@ async function loadEncryptedPassword() {
   }
 }
 
+async function saveDnsToolState(tool, enabled) {
+  if (!_updateSettings || !_getSettings) return;
+  try {
+    const s = await _getSettings();
+    const next = { ...(s.dnsToolEnabled || {}), [tool]: enabled };
+    await _updateSettings({ dnsToolEnabled: next });
+  } catch (e) {
+    err(`Failed to save DNS state: ${e.message}`);
+  }
+}
+
+async function loadDnsToolState() {
+  if (!_getSettings) return {};
+  try {
+    const s = await _getSettings();
+    return s.dnsToolEnabled || {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Re-apply DNS for tools previously enabled — called on app startup after MITM running.
+ */
+async function restoreToolDNS(sudoPassword) {
+  const state = await loadDnsToolState();
+  const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();
+  for (const [tool, enabled] of Object.entries(state)) {
+    if (!enabled || !TOOL_HOSTS[tool]) continue;
+    try {
+      await addDNSEntry(tool, password);
+    } catch (e) {
+      err(`DNS ${tool}: restore failed — ${e.message}`);
+    }
+  }
+}
+
+/**
+ * Check if user has privilege to mutate hosts file.
+ * Win: needs admin. Mac/Linux: root OR cached/encrypted sudo password.
+ */
+async function hasDnsPrivilege() {
+  if (IS_WIN) return isAdmin();
+  if (isAdmin()) return true;
+  if (!isSudoPasswordRequired()) return true;
+  const pwd = getCachedPassword() || await loadEncryptedPassword();
+  return !!pwd;
+}
+
 function checkPort443Free() {
   return new Promise((resolve) => {
     const tester = net.createServer();
@@ -248,9 +298,9 @@ async function killLeftoverMitm(sudoPassword) {
   if (!IS_WIN && SERVER_PATH) {
     try {
       const escaped = SERVER_PATH.replace(/'/g, "'\\''");
-      if (sudoPassword) {
+      if (sudoPassword || isSudoAvailable()) {
         const { execWithPassword } = require("./dns/dnsConfig");
-        await execWithPassword(`pkill -SIGKILL -f "${escaped}" 2>/dev/null || true`, sudoPassword).catch(() => { });
+        await execWithPassword(`pkill -SIGKILL -f "${escaped}" 2>/dev/null || true`, sudoPassword || "").catch(() => { });
       } else {
         exec(`pkill -SIGKILL -f "${escaped}" 2>/dev/null || true`, { windowsHide: true }, () => { });
       }
@@ -363,7 +413,26 @@ async function scheduleMitmRestart(apiKey) {
 /**
  * Start MITM server only (cert + server, no DNS)
  */
-async function startServer(apiKey, sudoPassword) {
+async function killPort443Owner(owner, sudoPassword) {
+  if (!owner || !owner.pid) return;
+  if (IS_WIN) {
+    try {
+      execSync(`powershell -NonInteractive -WindowStyle Hidden -Command "Stop-Process -Id ${owner.pid} -Force -ErrorAction SilentlyContinue"`, { windowsHide: true });
+    } catch { /* best effort */ }
+  } else {
+    try {
+      const { execWithPassword } = require("./dns/dnsConfig");
+      if (sudoPassword || isSudoAvailable()) {
+        await execWithPassword(`kill -9 ${owner.pid}`, sudoPassword || "");
+      } else {
+        execSync(`kill -9 ${owner.pid}`, { windowsHide: true });
+      }
+    } catch { /* best effort */ }
+  }
+  await new Promise(r => setTimeout(r, 800));
+}
+
+async function startServer(apiKey, sudoPassword, forceKillPort443 = false) {
   if (!serverProcess || serverProcess.killed) {
     try {
       if (fs.existsSync(PID_FILE)) {
@@ -391,19 +460,19 @@ async function startServer(apiKey, sudoPassword) {
     const portStatus = await checkPort443Free();
     if (portStatus === "in-use" || portStatus === "no-permission") {
       const owner = await getPort443Owner(sudoPassword);
-      const ownerIsNode = owner && (owner.name === "node" || owner.name.includes("node"));
-      if (ownerIsNode) {
-        log(`Killing orphan node process on port 443 (PID ${owner.pid}, name=${owner.name})...`);
-        try {
-          const { execWithPassword } = require("./dns/dnsConfig");
-          await execWithPassword(`kill -9 ${owner.pid}`, sudoPassword);
-          await new Promise(r => setTimeout(r, 800));
-        } catch { /* best effort */ }
-      } else if (owner) {
+      if (owner) {
         const shortName = owner.name.includes("/")
           ? owner.name.split("/").filter(Boolean).pop()
           : owner.name;
-        throw new Error(`Port 443 is already in use by "${shortName}" (PID ${owner.pid}). Stop that process first.`);
+        if (forceKillPort443) {
+          log(`Killing process on port 443 (PID ${owner.pid}, name=${shortName})...`);
+          await killPort443Owner(owner, sudoPassword);
+        } else {
+          const e = new Error(`Port 443 is already in use by "${shortName}" (PID ${owner.pid}).`);
+          e.code = "PORT_443_BUSY";
+          e.portOwner = { pid: owner.pid, name: shortName };
+          throw e;
+        }
       }
     }
   }
@@ -434,7 +503,7 @@ async function startServer(apiKey, sudoPassword) {
     if (linuxNoSystemTrust) {
       log(`🔐 Cert: skipping system trust (no sudo). Install ${rootCACertPath} as a trusted CA on machines that use this proxy.`);
     } else {
-      if (!password && !IS_WIN) {
+      if (!password && isSudoPasswordRequired()) {
         throw new Error("Sudo password required to install Root CA certificate");
       }
       try {
@@ -452,12 +521,19 @@ async function startServer(apiKey, sudoPassword) {
   const mitmRouterBase = await resolveMitmRouterBaseUrl();
   log(`🚀 Starting server... (router: ${mitmRouterBase})`);
   if (IS_WIN) {
-    // Kill any process using port 443 before spawning
-    try {
-      const psKill = `$c = Get-NetTCPConnection -LocalPort 443 -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1; if ($c -and $c.OwningProcess -gt 4) { Stop-Process -Id $c.OwningProcess -Force -ErrorAction SilentlyContinue }`;
-      execSync(`powershell -NonInteractive -WindowStyle Hidden -Command "${psKill}"`, { windowsHide: true });
-      await new Promise(r => setTimeout(r, 500));
-    } catch { /* best effort */ }
+    // Check port 443 — ask user before killing
+    const winOwner = await getPort443Owner(sudoPassword);
+    if (winOwner) {
+      if (forceKillPort443) {
+        log(`Killing process on port 443 (PID ${winOwner.pid}, name=${winOwner.name})...`);
+        await killPort443Owner(winOwner, sudoPassword);
+      } else {
+        const e = new Error(`Port 443 is already in use by "${winOwner.name}" (PID ${winOwner.pid}).`);
+        e.code = "PORT_443_BUSY";
+        e.portOwner = { pid: winOwner.pid, name: winOwner.name };
+        throw e;
+      }
+    }
 
     // Spawn directly — process already has admin rights
     serverProcess = spawn(
@@ -603,7 +679,8 @@ async function stopServer(sudoPassword) {
         // Direct fs write — bypass PowerShell to avoid parser pitfalls
         const content = fs.readFileSync(hostsFile, "utf8");
         const filtered = content.split(/\r?\n/).filter(l => !allHosts.some(h => l.includes(h))).join("\r\n");
-        if (filtered !== content) fs.writeFileSync(hostsFile, filtered, "utf8");
+        const next = filtered.replace(/[\r\n\s]+$/g, "") + "\r\n";
+        if (next !== content) fs.writeFileSync(hostsFile, next, "utf8");
         try { require("child_process").execSync("ipconfig /flushdns", { windowsHide: true, stdio: "ignore" }); } catch { /* ignore */ }
         log("🌐 DNS: ✅ all tool hosts removed");
       } else {
@@ -638,10 +715,10 @@ async function stopServer(sudoPassword) {
 async function enableToolDNS(tool, sudoPassword) {
   const status = await getMitmStatus();
   if (!status.running) throw new Error("MITM server is not running. Start the server first.");
-  
-  // Use cached password if not provided
+
   const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();
   await addDNSEntry(tool, password);
+  await saveDnsToolState(tool, true);
   return { success: true };
 }
 
@@ -649,9 +726,9 @@ async function enableToolDNS(tool, sudoPassword) {
  * Disable DNS for a specific tool
  */
 async function disableToolDNS(tool, sudoPassword) {
-  // Use cached password if not provided
   const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();
   await removeDNSEntry(tool, password);
+  await saveDnsToolState(tool, false);
   return { success: true };
 }
 
@@ -667,7 +744,7 @@ async function trustCert(sudoPassword) {
     return;
   }
   const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();
-  if (!password && !IS_WIN) throw new Error("Sudo password required to trust certificate");
+  if (!password && isSudoPasswordRequired()) throw new Error("Sudo password required to trust certificate");
   await installCert(password, rootCACertPath);
   if (password) setCachedPassword(password);
 }
@@ -690,5 +767,9 @@ module.exports = {
   setCachedPassword,
   loadEncryptedPassword,
   clearEncryptedPassword,
+  isSudoPasswordRequired,
   initDbHooks,
+  restoreToolDNS,
+  hasDnsPrivilege,
+  removeAllDNSEntriesSync,
 };

package/app/src/mitm/server.js

@@ -12,9 +12,15 @@ const { getCertForDomain } = require("./cert/generate");
 const DB_FILE = path.join(DATA_DIR, "db.json");
 const LOCAL_PORT = 443;
 const IS_WIN = process.platform === "win32";
-const ENABLE_FILE_LOG = false;
+const ENABLE_FILE_LOG = true;
 const INTERNAL_REQUEST_HEADER = { name: "x-request-source", value: "local" };
 
+// Host rewrite for upstream forward: PROD cloudcode-pa is rate-limited (429),
+// daily-cloudcode-pa (dev endpoint) accepts same body+token. Same trick as open-sse.
+const HOST_REWRITE = {
+  "cloudcode-pa.googleapis.com": "daily-cloudcode-pa.googleapis.com",
+};
+
 // Load handlers — dev/ overrides handlers/ for private implementations
 function loadHandler(name) {
   try { return require(`./dev/${name}`); } catch {}
@@ -44,7 +50,6 @@ function sniCallback(servername, cb) {
       cert: `${certData.cert}\n${rootCAPem}`
     });
     certCache.set(servername, ctx);
-    log(`🔐 Cert generated: ${servername}`);
     cb(null, ctx);
   } catch (e) {
     err(`SNI error for ${servername}: ${e.message}`);
@@ -124,7 +129,8 @@ function getMappedModel(tool, model) {
  * Also tees full stream into a dump file when ENABLE_FILE_LOG is on.
  */
 async function passthrough(req, res, bodyBuffer, onResponse) {
-  const targetHost = (req.headers.host || TARGET_HOSTS[0]).split(":")[0];
+  const originalHost = (req.headers.host || TARGET_HOSTS[0]).split(":")[0];
+  const targetHost = HOST_REWRITE[originalHost] || originalHost;
   const targetIP = await resolveTargetIP(targetHost);
   const dumper = ENABLE_FILE_LOG ? createResponseDumper(req, "passthrough") : null;
 
@@ -195,18 +201,13 @@ const server = https.createServer(sslOptions, async (req, res) => {
     const isChat = patterns.some(p => req.url.includes(p));
     if (!isChat) return passthrough(req, res, bodyBuffer);
 
-    log(`🔍 [${tool}] url=${req.url} | bodyLen=${bodyBuffer.length}`);
-
     // Cursor uses binary proto — model extraction not possible at this layer.
     // Delegate directly to handler which decodes proto internally.
     if (tool === "cursor") {
-      log(`⚡ intercept | cursor | proto`);
       return handlers[tool].intercept(req, res, bodyBuffer, null, passthrough);
     }
 
     const model = extractModel(req.url, bodyBuffer);
-    log(`🔍 [${tool}] model="${model}"`);
-
     const mappedModel = getMappedModel(tool, model);
     const db = fs.existsSync(DB_FILE) ? JSON.parse(fs.readFileSync(DB_FILE, "utf-8")) : {};
     const aliasMappings = db.mitmAlias?.[tool] || {};

package/app/src/mitm/winElevated.js

@@ -7,13 +7,15 @@ const IS_WIN = process.platform === "win32";
  * Uses `net session` which only succeeds when elevated.
  */
 function isAdmin() {
-  if (!IS_WIN) return false;
-  try {
-    execSync("net session >nul 2>&1", { windowsHide: true, stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
+  if (IS_WIN) {
+    try {
+      execSync("net session >nul 2>&1", { windowsHide: true, stdio: "ignore" });
+      return true;
+    } catch {
+      return false;
+    }
   }
+  return typeof process.getuid === "function" && process.getuid() === 0;
 }
 
 /**

package/app/src/shared/constants/mitmToolHosts.js

@@ -7,6 +7,7 @@ const TOOL_HOSTS = {
   copilot: ["api.individual.githubcopilot.com"],
   kiro: ["q.us-east-1.amazonaws.com", "codewhisperer.us-east-1.amazonaws.com"],
   cursor: ["api2.cursor.sh"],
+  openrouter: ["openrouter.ai", "api.openrouter.ai"],
 };
 
 module.exports = { TOOL_HOSTS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yina-npm/openrouterx",
-  "version": "0.4.11",
+  "version": "0.4.19",
   "description": "openrouterX CLI - Start and manage 9Router server",
   "bin": {
     "openrouterX": "./cli.js"