@yina-npm/openrouterx 0.4.80 → 0.5.9

package/app/src/mitm/cert/install.js

@@ -1,269 +0,0 @@
-const fs = require("fs");
-const crypto = require("crypto");
-const { exec } = require("child_process");
-const { execWithPassword, isSudoAvailable } = require("../dns/dnsConfig.js");
-const { runElevatedPowerShell, quotePs } = require("../winElevated.js");
-const { log, err } = require("../logger");
-
-const IS_WIN = process.platform === "win32";
-const IS_MAC = process.platform === "darwin";
-const LINUX_CERT_PATHS = [
-  // Debian / Ubuntu
-  { dir: "/usr/local/share/ca-certificates", cmd: "update-ca-certificates" },
-  // Arch Linux / CachyOS / Manjaro
-  { dir: "/etc/ca-certificates/trust-source/anchors", cmd: "update-ca-trust" },
-  // Fedora / RHEL / CentOS
-  { dir: "/etc/pki/ca-trust/source/anchors", cmd: "update-ca-trust" },
-  // openSUSE
-  { dir: "/etc/pki/trust/anchors", cmd: "update-ca-certificates" }
-];
-
-function getLinuxCertConfig() {
-  for (const config of LINUX_CERT_PATHS) {
-    if (fs.existsSync(config.dir)) {
-      return config;
-    }
-  }
-  // Fallback to Debian default if none exist
-  return LINUX_CERT_PATHS[0];
-}
-const ROOT_CA_CN = "9Router MITM Root CA";
-
-// Get SHA1 fingerprint from cert file using Node.js crypto
-function getCertFingerprint(certPath) {
-  const pem = fs.readFileSync(certPath, "utf-8");
-  const der = Buffer.from(pem.replace(/-----[^-]+-----/g, "").replace(/\s/g, ""), "base64");
-  return crypto.createHash("sha1").update(der).digest("hex").toUpperCase().match(/.{2}/g).join(":");
-}
-
-/**
- * Check if certificate is already installed in system store
- */
-async function checkCertInstalled(certPath) {
-  if (IS_WIN) return checkCertInstalledWindows(certPath);
-  if (IS_MAC) return checkCertInstalledMac(certPath);
-  return checkCertInstalledLinux();
-}
-
-function checkCertInstalledMac(certPath) {
-  return new Promise((resolve) => {
-    try {
-      const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
-      // Verify exact cert bytes match — same CN with different fingerprint = stale cert
-      exec(`security find-certificate -a -c "${ROOT_CA_CN}" -Z /Library/Keychains/System.keychain 2>/dev/null`, { windowsHide: true }, (error, stdout) => {
-        if (error || !stdout) return resolve(false);
-        const match = new RegExp(`SHA-1 hash:\\s*${fingerprint}`, "i").test(stdout);
-        if (!match) return resolve(false);
-        // Cert exists with matching fingerprint — confirm trust policy
-        exec(`security verify-cert -c "${certPath}" -p ssl -k /Library/Keychains/System.keychain 2>/dev/null`, { windowsHide: true }, (err2) => {
-          resolve(!err2);
-        });
-      });
-    } catch {
-      resolve(false);
-    }
-  });
-}
-
-function checkCertInstalledWindows(certPath) {
-  return new Promise((resolve) => {
-    // Check by SHA1 fingerprint — detects stale cert with same CN but different key
-    let fingerprint;
-    try {
-      fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
-    } catch {
-      return resolve(false);
-    }
-    exec(`certutil -store Root ${fingerprint}`, { windowsHide: true }, (error) => {
-      resolve(!error);
-    });
-  });
-}
-
-/**
- * Install SSL certificate to system trust store
- */
-async function installCert(sudoPassword, certPath) {
-  if (!fs.existsSync(certPath)) {
-    throw new Error(`Certificate file not found: ${certPath}`);
-  }
-
-  const isInstalled = await checkCertInstalled(certPath);
-  if (isInstalled) {
-    log("🔐 Cert: already trusted ✅");
-    return;
-  }
-
-  if (IS_WIN) {
-    await installCertWindows(certPath);
-  } else if (IS_MAC) {
-    await installCertMac(sudoPassword, certPath);
-  } else {
-    await installCertLinux(sudoPassword, certPath);
-  }
-}
-
-async function installCertMac(sudoPassword, certPath) {
-  // Remove all old certs with same name first to avoid duplicate/stale cert conflict
-  const deleteOld = `security delete-certificate -c "9Router MITM Root CA" /Library/Keychains/System.keychain 2>/dev/null || true`;
-  const install = `security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`;
-  try {
-    await execWithPassword(`${deleteOld} && ${install}`, sudoPassword);
-    log("🔐 Cert: ✅ installed to system keychain");
-  } catch (error) {
-    const msg = error.message?.includes("canceled") ? "User canceled authorization" : "Certificate install failed";
-    throw new Error(msg);
-  }
-}
-
-async function installCertWindows(certPath) {
-  // Auto-elevate via UAC popup if not admin (zero popup if already admin).
-  // Delete any stale cert with same CN before adding to avoid duplicates.
-  const script = `
-    certutil -delstore Root ${quotePs(ROOT_CA_CN)} 2>$null | Out-Null
-    $exit = & certutil -addstore Root ${quotePs(certPath)} 2>&1
-    if ($LASTEXITCODE -ne 0) { throw "certutil exit $LASTEXITCODE" }
-  `;
-  try {
-    await runElevatedPowerShell(script);
-    log("🔐 Cert: ✅ installed to Windows Root store");
-  } catch (e) {
-    throw new Error(`Failed to install certificate: ${e.message}`);
-  }
-}
-
-/**
- * Uninstall SSL certificate from system store
- */
-async function uninstallCert(sudoPassword, certPath) {
-  const isInstalled = await checkCertInstalled(certPath);
-  if (!isInstalled) {
-    log("🔐 Cert: not found in system store");
-    return;
-  }
-
-  if (IS_WIN) {
-    await uninstallCertWindows();
-  } else if (IS_MAC) {
-    await uninstallCertMac(sudoPassword, certPath);
-  } else {
-    await uninstallCertLinux(sudoPassword);
-  }
-}
-
-async function uninstallCertMac(sudoPassword, certPath) {
-  const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
-  const command = `security delete-certificate -Z "${fingerprint}" /Library/Keychains/System.keychain`;
-  try {
-    await execWithPassword(command, sudoPassword);
-    log("🔐 Cert: ✅ uninstalled from system keychain");
-  } catch (err) {
-    throw new Error("Failed to uninstall certificate");
-  }
-}
-
-async function uninstallCertWindows() {
-  // Auto-elevate via UAC popup if not admin
-  const script = `certutil -delstore Root ${quotePs(ROOT_CA_CN)}`;
-  try {
-    await runElevatedPowerShell(script);
-    log("🔐 Cert: ✅ uninstalled from Windows Root store");
-  } catch (e) {
-    throw new Error(`Failed to uninstall certificate: ${e.message}`);
-  }
-}
-
-function checkCertInstalledLinux() {
-  const config = getLinuxCertConfig();
-  const certFile = `${config.dir}/9router-root-ca.crt`;
-  return Promise.resolve(fs.existsSync(certFile));
-}
-
-async function updateNssDatabases(certPath, action = 'add') {
-  const certName = "9Router MITM Root CA";
-  
-  const script = `
-    if ! command -v certutil &> /dev/null; then
-      exit 0
-    fi
-    
-    DIRS="$HOME/.pki/nssdb $HOME/snap/chromium/current/.pki/nssdb"
-    
-    if [ -d "$HOME/.mozilla/firefox" ]; then
-      for profile in "$HOME"/.mozilla/firefox/*/; do
-        if [ -f "\${profile}cert9.db" ] || [ -f "\${profile}cert8.db" ]; then
-          DIRS="$DIRS $profile"
-        fi
-      done
-    fi
-
-    if [ -d "$HOME/snap/firefox/common/.mozilla/firefox" ]; then
-      for profile in "$HOME"/snap/firefox/common/.mozilla/firefox/*/; do
-        if [ -f "\${profile}cert9.db" ] || [ -f "\${profile}cert8.db" ]; then
-          DIRS="$DIRS $profile"
-        fi
-      done
-    fi
-
-    for db in $DIRS; do
-      if [ -d "$db" ]; then
-        if [ "${action}" = "add" ]; then
-          certutil -d sql:"$db" -A -t "C,," -n "${certName}" -i "${certPath}" 2>/dev/null || \\
-          certutil -d "$db" -A -t "C,," -n "${certName}" -i "${certPath}" 2>/dev/null || true
-        else
-          certutil -d sql:"$db" -D -n "${certName}" 2>/dev/null || \\
-          certutil -d "$db" -D -n "${certName}" 2>/dev/null || true
-        fi
-      fi
-    done
-  `;
-  
-  return new Promise((resolve) => {
-    exec(script, { shell: "/bin/bash" }, () => resolve());
-  });
-}
-
-async function installCertLinux(sudoPassword, certPath) {
-  if (!isSudoAvailable()) {
-    log(`🔐 Cert: cannot install to system store without sudo — trust this file on clients: ${certPath}`);
-    // Still try to update user NSS DBs even if no sudo!
-    await updateNssDatabases(certPath, 'add');
-    return;
-  }
-  
-  const config = getLinuxCertConfig();
-  const destFile = `${config.dir}/9router-root-ca.crt`;
-  
-  // Copy to the discovered directory and execute the specific update command
-  const cmd = `cp "${certPath}" "${destFile}" && (${config.cmd} 2>/dev/null || true)`;
-  
-  try {
-    await execWithPassword(cmd, sudoPassword);
-    await updateNssDatabases(certPath, 'add');
-    log(`🔐 Cert: ✅ installed to Linux trust store (${config.dir}) and user browser databases`);
-  } catch (error) {
-    throw new Error(`Certificate install failed: ${error.message}`);
-  }
-}
-
-async function uninstallCertLinux(sudoPassword) {
-  // Always try to uninstall from user DBs even without sudo
-  await updateNssDatabases(null, 'delete');
-
-  if (!isSudoAvailable()) {
-    return;
-  }
-  
-  const config = getLinuxCertConfig();
-  const destFile = `${config.dir}/9router-root-ca.crt`;
-  const cmd = `rm -f "${destFile}" && (${config.cmd} 2>/dev/null || true)`;
-  
-  try {
-    await execWithPassword(cmd, sudoPassword);
-    log("🔐 Cert: ✅ uninstalled from Linux trust store and user browser databases");
-  } catch (error) {
-    throw new Error("Failed to uninstall certificate");
-  }
-}
-
-module.exports = { installCert, uninstallCert, checkCertInstalled };

package/app/src/mitm/cert/rootCA.js

@@ -1,173 +0,0 @@
-const path = require("path");
-const fs = require("fs");
-const forge = require("node-forge");
-const { MITM_DIR } = require("../paths");
-
-const ROOT_CA_KEY_PATH = path.join(MITM_DIR, "rootCA.key");
-const ROOT_CA_CERT_PATH = path.join(MITM_DIR, "rootCA.crt");
-
-/**
- * Check if cert file is expired or expiring within 30 days
- */
-function isCertExpired(certPath) {
-  try {
-    const cert = forge.pki.certificateFromPem(fs.readFileSync(certPath, "utf8"));
-    const expiryThreshold = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
-    return cert.validity.notAfter < expiryThreshold;
-  } catch {
-    return true; // treat unreadable cert as expired
-  }
-}
-
-/**
- * Generate Root CA certificate (only once, auto-regenerate if expired)
- * This Root CA will sign all dynamic leaf certificates
- */
-async function generateRootCA() {
-  const exists = fs.existsSync(ROOT_CA_KEY_PATH) && fs.existsSync(ROOT_CA_CERT_PATH);
-  if (exists && !isCertExpired(ROOT_CA_CERT_PATH)) {
-    console.log("✅ Root CA already exists");
-    return { key: ROOT_CA_KEY_PATH, cert: ROOT_CA_CERT_PATH };
-  }
-  if (exists) {
-    console.log("🔐 Root CA expired or expiring soon — regenerating...");
-    try { fs.unlinkSync(ROOT_CA_KEY_PATH); } catch { /* ignore */ }
-    try { fs.unlinkSync(ROOT_CA_CERT_PATH); } catch { /* ignore */ }
-  }
-
-  if (!fs.existsSync(MITM_DIR)) {
-    fs.mkdirSync(MITM_DIR, { recursive: true });
-  }
-
-  console.log("🔐 Generating Root CA certificate...");
-
-  // Generate RSA key pair
-  const keys = forge.pki.rsa.generateKeyPair(2048);
-
-  // Create Root CA certificate
-  const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = "01";
-  cert.validity.notBefore = new Date();
-  cert.validity.notAfter = new Date();
-  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 10);
-
-  const attrs = [
-    { name: "commonName", value: "9Router MITM Root CA" },
-    { name: "organizationName", value: "9Router" },
-    { name: "countryName", value: "US" }
-  ];
-
-  cert.setSubject(attrs);
-  cert.setIssuer(attrs); // Self-signed
-
-  cert.setExtensions([
-    {
-      name: "basicConstraints",
-      cA: true,
-      critical: true
-    },
-    {
-      name: "keyUsage",
-      keyCertSign: true,
-      cRLSign: true,
-      critical: true
-    },
-    {
-      name: "subjectKeyIdentifier"
-    }
-  ]);
-
-  // Self-sign the certificate
-  cert.sign(keys.privateKey, forge.md.sha256.create());
-
-  // Save to disk
-  const privateKeyPem = forge.pki.privateKeyToPem(keys.privateKey);
-  const certPem = forge.pki.certificateToPem(cert);
-
-  fs.writeFileSync(ROOT_CA_KEY_PATH, privateKeyPem);
-  fs.writeFileSync(ROOT_CA_CERT_PATH, certPem);
-
-  console.log("✅ Root CA generated successfully");
-  return { key: ROOT_CA_KEY_PATH, cert: ROOT_CA_CERT_PATH };
-}
-
-/**
- * Load Root CA from disk
- */
-function loadRootCA() {
-  if (!fs.existsSync(ROOT_CA_KEY_PATH) || !fs.existsSync(ROOT_CA_CERT_PATH)) {
-    throw new Error("Root CA not found. Generate it first.");
-  }
-
-  const keyPem = fs.readFileSync(ROOT_CA_KEY_PATH, "utf8");
-  const certPem = fs.readFileSync(ROOT_CA_CERT_PATH, "utf8");
-
-  return {
-    key: forge.pki.privateKeyFromPem(keyPem),
-    cert: forge.pki.certificateFromPem(certPem)
-  };
-}
-
-/**
- * Generate leaf certificate for a specific domain, signed by Root CA
- */
-function generateLeafCert(domain, rootCA) {
-  // Generate key pair for leaf cert
-  const keys = forge.pki.rsa.generateKeyPair(2048);
-
-  // Create leaf certificate
-  const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = Math.floor(Math.random() * 1000000).toString();
-  cert.validity.notBefore = new Date();
-  cert.validity.notAfter = new Date();
-  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1);
-
-  cert.setSubject([
-    { name: "commonName", value: domain }
-  ]);
-
-  cert.setIssuer(rootCA.cert.subject.attributes);
-
-  cert.setExtensions([
-    {
-      name: "basicConstraints",
-      cA: false
-    },
-    {
-      name: "keyUsage",
-      digitalSignature: true,
-      keyEncipherment: true
-    },
-    {
-      name: "extKeyUsage",
-      serverAuth: true,
-      clientAuth: true
-    },
-    {
-      name: "subjectAltName",
-      altNames: [
-        { type: 2, value: domain }, // DNS
-        { type: 2, value: `*.${domain}` } // Wildcard
-      ]
-    }
-  ]);
-
-  // Sign with Root CA
-  cert.sign(rootCA.key, forge.md.sha256.create());
-
-  return {
-    key: forge.pki.privateKeyToPem(keys.privateKey),
-    cert: forge.pki.certificateToPem(cert)
-  };
-}
-
-module.exports = {
-  generateRootCA,
-  loadRootCA,
-  generateLeafCert,
-  isCertExpired,
-  ROOT_CA_CERT_PATH,
-  ROOT_CA_KEY_PATH
-};

package/app/src/mitm/config.js

@@ -1,89 +0,0 @@
-// All intercepted domains + URL patterns per tool
-
-const fs = require("fs");
-
-const IS_DEV = process.env.NODE_ENV === "development";
-
-// Resolve lsof absolute path — packaged apps / sudo secure_path may strip /usr/sbin from PATH
-const LSOF_BIN = (() => {
-  if (process.platform === "win32") return null;
-  for (const p of ["/usr/sbin/lsof", "/usr/bin/lsof", "/sbin/lsof"]) {
-    try { fs.accessSync(p, fs.constants.X_OK); return p; } catch { /* try next */ }
-  }
-  return "lsof"; // last-resort fallback (depends on PATH)
-})();
-
-const TARGET_HOSTS = [
-  "daily-cloudcode-pa.googleapis.com",
-  "cloudcode-pa.googleapis.com",
-  "api.individual.githubcopilot.com",
-  "q.us-east-1.amazonaws.com",
-  "codewhisperer.us-east-1.amazonaws.com",
-  "runtime.us-east-1.kiro.dev",
-  "api2.cursor.sh",
-];
-
-const URL_PATTERNS = {
-  antigravity: [":generateContent", ":streamGenerateContent"],
-  copilot: ["/chat/completions", "/v1/messages", "/responses"],
-  kiro: ["/generateAssistantResponse"],
-  cursor: ["/BidiAppend", "/RunSSE", "/RunPoll", "/Run"],
-};
-
-// Synonym map: rawModel from request → canonical alias key in mitmAlias DB
-const MODEL_SYNONYMS = {
-  antigravity: {
-    "gemini-default": "gemini-3.5-flash-low",
-    "gemini-3.5-flash-high": "gemini-3-flash-agent",
-    "gemini-3.5-flash-medium": "gemini-3.5-flash-low",
-    "gemini-3.5-flash-extra-low": "gemini-3.5-flash-extra-low",
-    "gemini-3.1-pro-high": "gemini-pro-agent",
-    "gemini-3-pro-high": "gemini-pro-agent",
-    "gemini-3-pro-low": "gemini-3.1-pro-low",
-  },
-};
-
-// Pattern fallback: rawModel regex → canonical alias key (when exact + prefix match fail)
-// Order matters: more specific patterns first. Catches AG renamed variants (e.g. gemini-pro-agent)
-const MODEL_PATTERNS = {
-  antigravity: [
-    { match: /flash.*extra.*low|extra.*low.*flash|flash.*low|low.*flash/i, alias: "gemini-3.5-flash-extra-low" },
-    { match: /flash.*medium|medium.*flash/i,                       alias: "gemini-3.5-flash-low" },
-    { match: /flash.*agent|agent.*flash|flash/i,                   alias: "gemini-3-flash-agent" },
-    { match: /pro.*low|low.*pro/i,                                 alias: "gemini-3.1-pro-low" },
-    { match: /gemini.*pro|pro.*gemini/i,                           alias: "gemini-pro-agent" },
-    { match: /opus/i,                                              alias: "claude-opus-4-6-thinking" },
-    { match: /sonnet|claude/i,                                     alias: "claude-sonnet-4-6" },
-    { match: /gpt.*oss|oss/i,                                      alias: "gpt-oss-120b-medium" },
-  ],
-};
-
-// Models that must NEVER be re-routed — always passthrough to the real upstream, even when
-// the tool's other models are mapped. Antigravity's tab-autocomplete (`tab_jump_flash_lite_preview`,
-// `tab_flash_lite_preview`, requestType tab/tab_jump) is latency-critical inline completion; routing
-// it through 9Router to an external chat model makes typing laggy and burns provider quota per
-// keystroke. Without this guard the broad `flash` pattern in MODEL_PATTERNS hijacks them onto the
-// flash-agent slot. Verified via MITM dump capture of streamGenerateContent (see AI_JOURNAL).
-const MODEL_NO_MAP = {
-  antigravity: [/^tab[_-]/i],
-};
-
-// URL substrings whose request/response should NOT be dumped to file (telemetry, polling, empty)
-const LOG_BLACKLIST_URL_PARTS = [
-  "recordCodeAssistMetrics",
-  "recordTrajectoryAnalytics",
-  "fetchAdminControls",
-  "listExperiments",
-  "fetchUserInfo",
-];
-
-function getToolForHost(host) {
-  const h = (host || "").split(":")[0];
-  if (h === "api.individual.githubcopilot.com") return "copilot";
-  if (h === "daily-cloudcode-pa.googleapis.com" || h === "cloudcode-pa.googleapis.com") return "antigravity";
-  if (h === "q.us-east-1.amazonaws.com" || h === "codewhisperer.us-east-1.amazonaws.com" || h === "runtime.us-east-1.kiro.dev") return "kiro";
-  if (h === "api2.cursor.sh") return "cursor";
-  return null;
-}
-
-module.exports = { IS_DEV, LSOF_BIN, TARGET_HOSTS, URL_PATTERNS, MODEL_SYNONYMS, MODEL_PATTERNS, MODEL_NO_MAP, LOG_BLACKLIST_URL_PARTS, getToolForHost };

package/app/src/mitm/dbReader.js

@@ -1,22 +0,0 @@
-// CJS reader for MITM standalone process. Reads mitmAlias from JSON cache
-// at $DATA_DIR/mitm/aliases.json (synced by app from SQLite on startup + writes).
-// JSON-only: no SQLite native binding required in MITM bundle.
-const fs = require("fs");
-const path = require("path");
-const { DATA_DIR } = require("./paths");
-
-const CACHE_FILE = path.join(DATA_DIR, "mitm", "aliases.json");
-
-function readCache() {
-  try {
-    if (!fs.existsSync(CACHE_FILE)) return null;
-    return JSON.parse(fs.readFileSync(CACHE_FILE, "utf-8"));
-  } catch { return null; }
-}
-
-function getMitmAlias(toolName) {
-  const all = readCache();
-  return all?.[toolName] || null;
-}
-
-module.exports = { getMitmAlias };