green-tunnel 2.0.1 → 3.0.2

package/dist/core/proxy/plain-tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plain-tunnel.d.ts","sourceRoot":"","sources":["../../../src/core/proxy/plain-tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAIhC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,GAAG,CAAC,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACtC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,IAAI,CAAC,CAuBf"}

package/dist/core/proxy/plain-tunnel.js

@@ -0,0 +1,29 @@
+import { connect } from '../net/socket.js';
+import { createRequestRewriteStream } from '../http/rewriter.js';
+import { tunnel } from './pipe.js';
+/**
+ * Plain-HTTP proxying. No fragmentation happens here — there is no SNI to hide,
+ * and the Host header is in cleartext regardless. Its only job is to relay the
+ * stream while rewriting absolute-form request targets into origin-form.
+ */
+export async function openPlainTunnel(client, initial, target, ctx) {
+    const { settings, dns } = ctx;
+    const address = await dns.resolve(target.host);
+    const server = await connect({
+        host: address,
+        port: target.port,
+        timeoutMs: settings.connectTimeoutMs,
+        signal: ctx.signal,
+    });
+    ctx.onOpen({
+        id: ctx.nextTunnelId(),
+        kind: 'http',
+        host: target.host,
+        port: target.port,
+        startedAt: Date.now(),
+    });
+    // Put the bytes we already consumed back so the rewriter sees the full stream.
+    client.unshift(initial);
+    await tunnel(client, server, settings.idleTimeoutMs, createRequestRewriteStream());
+}
+//# sourceMappingURL=plain-tunnel.js.map

package/dist/core/proxy/plain-tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plain-tunnel.js","sourceRoot":"","sources":["../../../src/core/proxy/plain-tunnel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGnC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAkB,EAClB,OAAe,EACf,MAAsC,EACtC,GAAkB;IAElB,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;IAE9B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC3B,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,QAAQ,CAAC,gBAAgB;QACpC,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC;QACT,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE;QACtB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAExB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,aAAa,EAAE,0BAA0B,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/dist/core/system-proxy/darwin.d.ts

@@ -0,0 +1,32 @@
+import type { SystemProxySettings, SystemProxySnapshot } from '../types.js';
+import type { SystemProxyDriver } from './driver.js';
+/**
+ * macOS driver.
+ *
+ * v2 derived a single Wi-Fi service from the default route, so an Ethernet dock
+ * or a second interface was left unproxied — and it never recorded what it
+ * overwrote. This applies to every *enabled* service and restores each one.
+ *
+ * Two properties matter more than they look:
+ *
+ * 1. `apply` uses the snapshot's target list, never its own enumeration, so the
+ *    set of services we touch and the set we can restore are identical by
+ *    construction. See `SystemProxyDriver.apply`.
+ * 2. `restore` is all-or-as-much-as-possible: one service that refuses a write
+ *    must not abandon the rest. macOS happily lists VPN services (Tailscale,
+ *    Shadowrocket) that reject proxy writes, and v3.0's `for` loop threw on the
+ *    first one and left every later service proxied.
+ *
+ * Stranded HTTP proxies on macOS are unusually nasty: the OS publishes the
+ * *highest-ranked active* service's config to `State:/Network/Global/Proxies`,
+ * which is what every app reads. A leftover proxy on an unplugged dongle sits
+ * invisible until the dongle reappears, then silently captures all traffic —
+ * and System Settings shows Wi-Fi as clean, because the setting is elsewhere.
+ */
+export declare class DarwinSystemProxy implements SystemProxyDriver {
+    readonly platform: NodeJS.Platform;
+    snapshot(): Promise<SystemProxySnapshot>;
+    apply(settings: SystemProxySettings, snapshot: SystemProxySnapshot): Promise<void>;
+    restore(snapshot: SystemProxySnapshot): Promise<void>;
+}
+//# sourceMappingURL=darwin.d.ts.map

package/dist/core/system-proxy/darwin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin.d.ts","sourceRoot":"","sources":["../../../src/core/system-proxy/darwin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,mBAAmB,EACnB,mBAAmB,EAEpB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAQrD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,iBAAkB,YAAW,iBAAiB;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAY;IAExC,QAAQ,IAAI,OAAO,CAAC,mBAAmB,CAAC;IASxC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBlF,OAAO,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;CAoB5D"}

package/dist/core/system-proxy/darwin.js

@@ -0,0 +1,146 @@
+import { exec, settle, tryExec } from './exec.js';
+const NETWORKSETUP = '/usr/sbin/networksetup';
+/** `networksetup` spells "no bypass domains" as this single literal argument. */
+const EMPTY_BYPASS = 'Empty';
+/**
+ * macOS driver.
+ *
+ * v2 derived a single Wi-Fi service from the default route, so an Ethernet dock
+ * or a second interface was left unproxied — and it never recorded what it
+ * overwrote. This applies to every *enabled* service and restores each one.
+ *
+ * Two properties matter more than they look:
+ *
+ * 1. `apply` uses the snapshot's target list, never its own enumeration, so the
+ *    set of services we touch and the set we can restore are identical by
+ *    construction. See `SystemProxyDriver.apply`.
+ * 2. `restore` is all-or-as-much-as-possible: one service that refuses a write
+ *    must not abandon the rest. macOS happily lists VPN services (Tailscale,
+ *    Shadowrocket) that reject proxy writes, and v3.0's `for` loop threw on the
+ *    first one and left every later service proxied.
+ *
+ * Stranded HTTP proxies on macOS are unusually nasty: the OS publishes the
+ * *highest-ranked active* service's config to `State:/Network/Global/Proxies`,
+ * which is what every app reads. A leftover proxy on an unplugged dongle sits
+ * invisible until the dongle reappears, then silently captures all traffic —
+ * and System Settings shows Wi-Fi as clean, because the setting is elsewhere.
+ */
+export class DarwinSystemProxy {
+    platform = 'darwin';
+    async snapshot() {
+        const entries = [];
+        for (const service of await listEnabledServices()) {
+            const entry = await readService(service);
+            if (entry)
+                entries.push(entry);
+        }
+        return { platform: 'darwin', entries };
+    }
+    async apply(settings, snapshot) {
+        const port = String(settings.port);
+        for (const { target } of snapshot.entries) {
+            await exec(NETWORKSETUP, ['-setwebproxy', target, settings.host, port]);
+            await exec(NETWORKSETUP, ['-setsecurewebproxy', target, settings.host, port]);
+            // Always write the bypass list, even when empty: leaving the previous
+            // list in place while our proxy is active would route the user's old
+            // exceptions through us.
+            await exec(NETWORKSETUP, [
+                '-setproxybypassdomains',
+                target,
+                ...(settings.bypass.length > 0 ? settings.bypass : [EMPTY_BYPASS]),
+            ]);
+        }
+    }
+    async restore(snapshot) {
+        // Every entry gets an attempt; failures are collected and reported together
+        // so a single stubborn service cannot strand the others.
+        await settle(snapshot.entries.map((entry) => async () => {
+            await restoreEndpoint('-setwebproxy', '-setwebproxystate', entry.target, entry);
+            await restoreEndpoint('-setsecurewebproxy', '-setsecurewebproxystate', entry.target, entry.secure ?? entry);
+            await exec(NETWORKSETUP, [
+                '-setproxybypassdomains',
+                entry.target,
+                ...(entry.bypass && entry.bypass.length > 0 ? entry.bypass : [EMPTY_BYPASS]),
+            ]);
+        }));
+    }
+}
+/**
+ * Restoring an endpoint takes two writes, not one: `-setwebproxy` sets host and
+ * port *and* enables it, so a service that had a host recorded but was switched
+ * off must be re-disabled afterwards. Otherwise "restore" would turn on a proxy
+ * the user had deliberately unchecked.
+ */
+async function restoreEndpoint(setFlag, stateFlag, target, state) {
+    if (state.host.length > 0 && state.port > 0) {
+        await exec(NETWORKSETUP, [setFlag, target, state.host, String(state.port)]);
+        if (!state.enabled)
+            await exec(NETWORKSETUP, [stateFlag, target, 'off']);
+        return;
+    }
+    // There was no proxy here, so blank the host/port too rather than only
+    // unticking the box. macOS keeps the last value in the field, so skipping this
+    // leaves our address sitting in System Settings looking like a configured
+    // proxy — the exact thing a user checks when they suspect us.
+    //
+    // Best-effort: `state off` below is what actually guarantees correctness, so a
+    // service that rejects the empty form must not fail the restore.
+    await tryExec(NETWORKSETUP, [setFlag, target, '', '0']);
+    await exec(NETWORKSETUP, [stateFlag, target, 'off']);
+}
+/**
+ * `networksetup -listallnetworkservices` prints a header line, then one service
+ * per line. Disabled services are prefixed with `*`.
+ */
+async function listEnabledServices() {
+    const output = await exec(NETWORKSETUP, ['-listallnetworkservices']);
+    return output
+        .split('\n')
+        .slice(1)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.startsWith('*'));
+}
+async function readService(service) {
+    const web = await readEndpoint('-getwebproxy', service);
+    if (!web)
+        return undefined;
+    const secure = await readEndpoint('-getsecurewebproxy', service);
+    return {
+        target: service,
+        ...web,
+        ...(secure ? { secure } : {}),
+        bypass: await readBypassDomains(service),
+    };
+}
+async function readEndpoint(flag, service) {
+    const output = await tryExec(NETWORKSETUP, [flag, service]);
+    if (output === undefined)
+        return undefined;
+    const fields = new Map();
+    for (const line of output.split('\n')) {
+        const separator = line.indexOf(':');
+        if (separator > 0) {
+            fields.set(line.slice(0, separator).trim().toLowerCase(), line.slice(separator + 1).trim());
+        }
+    }
+    return {
+        enabled: fields.get('enabled')?.toLowerCase() === 'yes',
+        host: fields.get('server') ?? '',
+        port: Number.parseInt(fields.get('port') ?? '0', 10) || 0,
+    };
+}
+/**
+ * Either one domain per line, or the sentence "There aren't any bypass domains
+ * set on <service>." — which is prose, not a domain, and must not be restored
+ * as one.
+ */
+async function readBypassDomains(service) {
+    const output = await tryExec(NETWORKSETUP, ['-getproxybypassdomains', service]);
+    if (output === undefined)
+        return [];
+    return output
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.includes(' '));
+}
+//# sourceMappingURL=darwin.js.map

package/dist/core/system-proxy/darwin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"darwin.js","sourceRoot":"","sources":["../../../src/core/system-proxy/darwin.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAElD,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAE9C,iFAAiF;AACjF,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,iBAAiB;IACnB,QAAQ,GAAoB,QAAQ,CAAC;IAE9C,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAA+B,EAAE,CAAC;QAC/C,KAAK,MAAM,OAAO,IAAI,MAAM,mBAAmB,EAAE,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAA6B,EAAE,QAA6B;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,oBAAoB,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9E,sEAAsE;YACtE,qEAAqE;YACrE,yBAAyB;YACzB,MAAM,IAAI,CAAC,YAAY,EAAE;gBACvB,wBAAwB;gBACxB,MAAM;gBACN,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAA6B;QACzC,4EAA4E;QAC5E,yDAAyD;QACzD,MAAM,MAAM,CACV,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE;YACzC,MAAM,eAAe,CAAC,cAAc,EAAE,mBAAmB,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAChF,MAAM,eAAe,CACnB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,MAAM,IAAI,KAAK,CACtB,CAAC;YACF,MAAM,IAAI,CAAC,YAAY,EAAE;gBACvB,wBAAwB;gBACxB,KAAK,CAAC,MAAM;gBACZ,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;aAC7E,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;CACF;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,SAAiB,EACjB,MAAc,EACd,KAAyB;IAEzB,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,+EAA+E;IAC/E,0EAA0E;IAC1E,8DAA8D;IAC9D,EAAE;IACF,+EAA+E;IAC/E,iEAAiE;IACjE,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB;IAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAEjE,OAAO;QACL,MAAM,EAAE,OAAO;QACf,GAAG,GAAG;QACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,KAAK;QACvD,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAAC,OAAe;IAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/core/system-proxy/driver.d.ts

@@ -0,0 +1,21 @@
+import type { SystemProxySettings, SystemProxySnapshot } from '../types.js';
+/** One implementation per OS. */
+export interface SystemProxyDriver {
+    readonly platform: NodeJS.Platform;
+    /** Capture the current OS proxy configuration so it can be put back. */
+    snapshot(): Promise<SystemProxySnapshot>;
+    /**
+     * Point the OS at our proxy, touching **exactly** the targets in `snapshot`.
+     *
+     * Taking the target list from the snapshot rather than re-enumerating is the
+     * whole point of this signature. v3.0's macOS driver called
+     * `listAllNetworkServices()` separately in `snapshot()` and `apply()`, so any
+     * service that appeared in between — a USB-C ethernet dongle, an iPhone
+     * tether, a VPN connecting — was proxied with no snapshot entry to restore it
+     * from, and stayed pointed at a dead port permanently.
+     */
+    apply(settings: SystemProxySettings, snapshot: SystemProxySnapshot): Promise<void>;
+    /** Put back exactly what `snapshot()` recorded, for every entry it holds. */
+    restore(snapshot: SystemProxySnapshot): Promise<void>;
+}
+//# sourceMappingURL=driver.d.ts.map

package/dist/core/system-proxy/driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../src/core/system-proxy/driver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE5E,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;IACnC,wEAAwE;IACxE,QAAQ,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD"}

package/dist/core/system-proxy/driver.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=driver.js.map

package/dist/core/system-proxy/driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../../src/core/system-proxy/driver.ts"],"names":[],"mappings":""}

package/dist/core/system-proxy/exec.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Run a command with an argument array — never a shell string.
+ *
+ * v2 interpolated network-service names straight into `sh -c "..."`, which is
+ * both fragile (names contain spaces) and a command-injection hazard.
+ */
+export declare function exec(file: string, args: readonly string[]): Promise<string>;
+/** Same as `exec`, but resolves to `undefined` instead of throwing. */
+export declare function tryExec(file: string, args: readonly string[]): Promise<string | undefined>;
+/** Is `file` on PATH / runnable? */
+export declare function isAvailable(file: string, args?: readonly string[]): Promise<boolean>;
+/**
+ * Run every task even if some throw, then report the failures together.
+ *
+ * This is what makes teardown safe. A plain `for (…) await …` loop abandons
+ * everything after the first failure, and during *restore* that means leaving
+ * services pointed at a port that is about to disappear. Getting an error is
+ * fine; getting an error and silently skipping nine services is not.
+ */
+export declare function settle(tasks: Iterable<() => Promise<void>>): Promise<void>;
+//# sourceMappingURL=exec.d.ts.map

package/dist/core/system-proxy/exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../../src/core/system-proxy/exec.ts"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CASjF;AAED,uEAAuE;AACvE,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAMhG;AAED,oCAAoC;AACpC,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,SAAS,MAAM,EAAkB,oBAEtF;AAED;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhF"}

package/dist/core/system-proxy/exec.js

@@ -0,0 +1,62 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { SystemProxyError, toError } from '../errors.js';
+const run = promisify(execFile);
+/**
+ * Run a command with an argument array — never a shell string.
+ *
+ * v2 interpolated network-service names straight into `sh -c "..."`, which is
+ * both fragile (names contain spaces) and a command-injection hazard.
+ */
+export async function exec(file, args) {
+    try {
+        const { stdout } = await run(file, [...args], { windowsHide: true });
+        return stdout;
+    }
+    catch (cause) {
+        throw new SystemProxyError(`\`${file} ${args.join(' ')}\` failed: ${toError(cause).message}`, {
+            cause,
+        });
+    }
+}
+/** Same as `exec`, but resolves to `undefined` instead of throwing. */
+export async function tryExec(file, args) {
+    try {
+        return await exec(file, args);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Is `file` on PATH / runnable? */
+export async function isAvailable(file, args = ['--version']) {
+    return (await tryExec(file, args)) !== undefined;
+}
+/**
+ * Run every task even if some throw, then report the failures together.
+ *
+ * This is what makes teardown safe. A plain `for (…) await …` loop abandons
+ * everything after the first failure, and during *restore* that means leaving
+ * services pointed at a port that is about to disappear. Getting an error is
+ * fine; getting an error and silently skipping nine services is not.
+ */
+export async function settle(tasks) {
+    const failures = [];
+    for (const task of tasks) {
+        try {
+            await task();
+        }
+        catch (error) {
+            failures.push(toError(error));
+        }
+    }
+    const [first] = failures;
+    if (!first)
+        return;
+    if (failures.length === 1)
+        throw first;
+    throw new SystemProxyError(failures.map((failure) => failure.message).join('; '), {
+        cause: new AggregateError(failures),
+    });
+}
+//# sourceMappingURL=exec.js.map

package/dist/core/system-proxy/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/core/system-proxy/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAuB;IAC9D,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;YAC5F,KAAK;SACN,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,IAAuB;IACjE,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oCAAoC;AACpC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAA0B,CAAC,WAAW,CAAC;IACrF,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAoC;IAC/D,MAAM,QAAQ,GAAY,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,KAAK,CAAC;IACvC,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAChF,KAAK,EAAE,IAAI,cAAc,CAAC,QAAQ,CAAC;KACpC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/system-proxy/index.d.ts

@@ -0,0 +1,45 @@
+import type { SystemProxySettings, SystemProxySnapshot } from '../types.js';
+import type { SystemProxyDriver } from './driver.js';
+export type { SystemProxyDriver } from './driver.js';
+export { DarwinSystemProxy } from './darwin.js';
+export { LinuxSystemProxy } from './linux.js';
+export { WindowsSystemProxy } from './windows.js';
+export { defaultRecoveryPath } from './recovery.js';
+export declare const DEFAULT_BYPASS: readonly ["localhost", "127.0.0.1", "::1", "*.local"];
+export declare function isSystemProxySupported(): boolean;
+export declare function createSystemProxyDriver(): SystemProxyDriver;
+export interface SystemProxyOptions {
+    readonly driver?: SystemProxyDriver;
+    /**
+     * Where to persist the pending snapshot so a killed process can still be
+     * cleaned up. `null` disables persistence (used by tests).
+     */
+    readonly recoveryFile?: string | null;
+}
+/**
+ * Snapshot-and-restore wrapper around the platform drivers.
+ *
+ * The important property: `disable()` puts back exactly what was there before,
+ * rather than v2's "turn everything off" — which quietly wiped a corporate or
+ * developer proxy the user had configured.
+ */
+export declare class SystemProxy {
+    #private;
+    constructor(options?: SystemProxyOptions);
+    get active(): boolean;
+    enable(settings: SystemProxySettings): Promise<void>;
+    disable(): Promise<void>;
+}
+/**
+ * Undo a system proxy left behind by a run that never got to clean up — a
+ * `SIGKILL`, a force-quit, a panic, a pulled power cord.
+ *
+ * Call this at startup, before `enable()`. Returns the snapshot it restored, or
+ * `null` when there was nothing to recover.
+ *
+ * Without this, v3.0 had no path back at all: nothing recorded what had been
+ * changed, so a killed process left the machine pointed at a dead port with no
+ * way for any later run to know, or to fix it.
+ */
+export declare function recoverSystemProxy(options?: SystemProxyOptions): Promise<SystemProxySnapshot | null>;
+//# sourceMappingURL=index.d.ts.map

package/dist/core/system-proxy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/system-proxy/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,mBAAmB,EACnB,mBAAmB,EAEpB,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAUrD,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAEpF,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED,wBAAgB,uBAAuB,IAAI,iBAAiB,CAW3D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvC;AAED;;;;;;GAMG;AACH,qBAAa,WAAW;;gBAKV,OAAO,GAAE,kBAAuB;IAM5C,IAAI,MAAM,IAAI,OAAO,CAEpB;IAEK,MAAM,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBpD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAa/B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAmBrC"}

package/dist/core/system-proxy/index.js

@@ -0,0 +1,151 @@
+import { platform } from 'node:process';
+import { SystemProxyError, toError } from '../errors.js';
+import { DarwinSystemProxy } from './darwin.js';
+import { LinuxSystemProxy } from './linux.js';
+import { defaultRecoveryPath, readRecoveryFile, removeRecoveryFile, writeRecoveryFile, } from './recovery.js';
+import { WindowsSystemProxy } from './windows.js';
+export { DarwinSystemProxy } from './darwin.js';
+export { LinuxSystemProxy } from './linux.js';
+export { WindowsSystemProxy } from './windows.js';
+export { defaultRecoveryPath } from './recovery.js';
+export const DEFAULT_BYPASS = ['localhost', '127.0.0.1', '::1', '*.local'];
+export function isSystemProxySupported() {
+    return platform === 'darwin' || platform === 'linux' || platform === 'win32';
+}
+export function createSystemProxyDriver() {
+    switch (platform) {
+        case 'darwin':
+            return new DarwinSystemProxy();
+        case 'linux':
+            return new LinuxSystemProxy();
+        case 'win32':
+            return new WindowsSystemProxy();
+        default:
+            throw new SystemProxyError(`Setting the system proxy is not supported on ${platform}`);
+    }
+}
+/**
+ * Snapshot-and-restore wrapper around the platform drivers.
+ *
+ * The important property: `disable()` puts back exactly what was there before,
+ * rather than v2's "turn everything off" — which quietly wiped a corporate or
+ * developer proxy the user had configured.
+ */
+export class SystemProxy {
+    #driver;
+    #recoveryFile;
+    #snapshot = null;
+    constructor(options = {}) {
+        this.#driver = options.driver ?? createSystemProxyDriver();
+        this.#recoveryFile =
+            options.recoveryFile === undefined ? defaultRecoveryPath() : options.recoveryFile;
+    }
+    get active() {
+        return this.#snapshot !== null;
+    }
+    async enable(settings) {
+        if (this.#snapshot)
+            return;
+        // Snapshot first: if `apply` throws halfway we can still put things back.
+        // `disown` keeps us from mistaking our own leftovers for a user setting.
+        const snapshot = disown(await this.#driver.snapshot(), settings);
+        // Persist *before* touching the OS. If we are killed between here and
+        // `disable()`, the next run finds this file and undoes the damage.
+        if (this.#recoveryFile) {
+            await writeRecoveryFile(this.#recoveryFile, snapshot).catch(() => undefined);
+        }
+        this.#snapshot = snapshot;
+        try {
+            await this.#driver.apply(settings, snapshot);
+        }
+        catch (error) {
+            await this.#driver.restore(snapshot).catch(() => undefined);
+            this.#snapshot = null;
+            if (this.#recoveryFile)
+                await removeRecoveryFile(this.#recoveryFile).catch(() => undefined);
+            throw error;
+        }
+    }
+    async disable() {
+        const snapshot = this.#snapshot;
+        if (!snapshot)
+            return;
+        this.#snapshot = null;
+        await this.#driver.restore(snapshot);
+        // Drop the recovery file only once the OS is genuinely back. If `restore`
+        // threw above, the file survives on purpose: the machine is still (partly)
+        // pointed at us, and the next run must be able to finish the job. Clearing
+        // it unconditionally is how a stranded proxy becomes permanent.
+        if (this.#recoveryFile)
+            await removeRecoveryFile(this.#recoveryFile).catch(() => undefined);
+    }
+}
+/**
+ * Undo a system proxy left behind by a run that never got to clean up — a
+ * `SIGKILL`, a force-quit, a panic, a pulled power cord.
+ *
+ * Call this at startup, before `enable()`. Returns the snapshot it restored, or
+ * `null` when there was nothing to recover.
+ *
+ * Without this, v3.0 had no path back at all: nothing recorded what had been
+ * changed, so a killed process left the machine pointed at a dead port with no
+ * way for any later run to know, or to fix it.
+ */
+export async function recoverSystemProxy(options = {}) {
+    const path = options.recoveryFile === undefined ? defaultRecoveryPath() : options.recoveryFile;
+    if (!path)
+        return null;
+    const snapshot = await readRecoveryFile(path);
+    if (!snapshot)
+        return null;
+    const driver = options.driver ?? createSystemProxyDriver();
+    try {
+        await driver.restore(snapshot);
+    }
+    catch (error) {
+        throw new SystemProxyError(`Could not undo the system proxy left by a previous run: ${toError(error).message}`, { cause: error });
+    }
+    await removeRecoveryFile(path).catch(() => undefined);
+    return snapshot;
+}
+/**
+ * Rewrite any entry that is really *our own* leftover into "was off".
+ *
+ * Without this the damage is self-perpetuating: a run that fails to clean up
+ * leaves `127.0.0.1:<our port>` behind, the next run records that as the user's
+ * original proxy, and dutifully "restores" it on exit — forever. The recovery
+ * file is the primary defence; this is the backstop for when it is missing,
+ * stale, or was never written.
+ *
+ * A proxy pointing at loopback on the port we are about to bind cannot be a
+ * useful upstream — nothing else is listening there once we take the port.
+ */
+function disown(snapshot, settings) {
+    return {
+        ...snapshot,
+        entries: snapshot.entries.map((entry) => disownEntry(entry, settings)),
+    };
+}
+function disownEntry(entry, settings) {
+    const web = isOurs(entry, settings);
+    const secure = entry.secure ? isOurs(entry.secure, settings) : web;
+    if (!web && !secure)
+        return entry;
+    return {
+        ...entry,
+        ...(web ? OFF : { enabled: entry.enabled, host: entry.host, port: entry.port }),
+        ...(entry.secure ? { secure: secure ? OFF : entry.secure } : {}),
+        // If the proxy was ours, the bypass list we found next to it was ours too.
+        ...(web && secure ? { bypass: [] } : {}),
+    };
+}
+const OFF = { enabled: false, host: '', port: 0 };
+function isOurs(state, settings) {
+    if (state.port !== settings.port)
+        return false;
+    return state.host === settings.host || isLoopback(state.host);
+}
+function isLoopback(host) {
+    return host === 'localhost' || host === '::1' || host.startsWith('127.');
+}
+//# sourceMappingURL=index.js.map

package/dist/core/system-proxy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/system-proxy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAOzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,UAAU,sBAAsB;IACpC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACjC,KAAK,OAAO;YACV,OAAO,IAAI,gBAAgB,EAAE,CAAC;QAChC,KAAK,OAAO;YACV,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAClC;YACE,MAAM,IAAI,gBAAgB,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACb,OAAO,CAAoB;IAC3B,aAAa,CAAgB;IACtC,SAAS,GAA+B,IAAI,CAAC;IAE7C,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC3D,IAAI,CAAC,aAAa;YAChB,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IACtF,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAA6B;QACxC,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAE3B,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC;QAEjE,sEAAsE;QACtE,mEAAmE;QACnE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,iBAAiB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,IAAI,IAAI,CAAC,aAAa;gBAAE,MAAM,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QAEtB,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAErC,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,gEAAgE;QAChE,IAAI,IAAI,CAAC,aAAa;YAAE,MAAM,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/F,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CACxB,2DAA2D,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EACnF,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,MAAM,CAAC,QAA6B,EAAE,QAA6B;IAC1E,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,KAA+B,EAC/B,QAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAElC,OAAO;QACL,GAAG,KAAK;QACR,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/E,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,2EAA2E;QAC3E,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,GAAG,GAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEtE,SAAS,MAAM,CAAC,KAAyB,EAAE,QAA6B;IACtE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3E,CAAC"}

package/dist/core/system-proxy/linux.d.ts

@@ -0,0 +1,18 @@
+import type { SystemProxySettings, SystemProxySnapshot } from '../types.js';
+import type { SystemProxyDriver } from './driver.js';
+/**
+ * Linux driver, GNOME/GSettings flavour — which also covers Unity, Cinnamon,
+ * Budgie and anything else reading the same schema.
+ *
+ * Note this only affects applications that honour the desktop proxy settings.
+ * Terminal tools read `http_proxy`/`https_proxy`, which no process can set for
+ * another; the CLI prints them for you to export.
+ */
+export declare class LinuxSystemProxy implements SystemProxyDriver {
+    #private;
+    readonly platform: NodeJS.Platform;
+    snapshot(): Promise<SystemProxySnapshot>;
+    apply(settings: SystemProxySettings): Promise<void>;
+    restore(snapshot: SystemProxySnapshot): Promise<void>;
+}
+//# sourceMappingURL=linux.d.ts.map

package/dist/core/system-proxy/linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux.d.ts","sourceRoot":"","sources":["../../../src/core/system-proxy/linux.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAsB,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMrD;;;;;;;GAOG;AACH,qBAAa,gBAAiB,YAAW,iBAAiB;;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAW;IAEvC,QAAQ,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAqBxC,KAAK,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAanD,OAAO,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;CAkC5D"}