kokorobox-native 0.8.4 → 0.10.1

package/README.md

@@ -43,6 +43,7 @@ The full TypeScript declarations are shipped in
 | Rules | `fileToStr` |
 | Platform | `getLaunchAtLogin`, `setLaunchAtLogin`, `getNetworkContext` |
 | macOS service | `getMacosManagedServiceStatus`, `registerMacosManagedService`, `unregisterMacosManagedService`, `reloadMacosManagedService`, `openMacosLoginItemsSettings` |
+| macOS application routing | `invokeMacosApplicationRouting` |
 | Core permissions | `getCorePrivilegeStatus`, `setCorePrivileges` |
 | Windows | `getCurrentUserSid`, `isRunningAsAdmin`, `runElevated`, `launchElevated`, `launchUnelevated`, `setupFirewallRules` |
 
@@ -77,6 +78,11 @@ LaunchDaemon plist and use `SMAppService` directly. They return an explicit
 `requires-approval` state when an administrator must approve the daemon in
 System Settings.
 
+`invokeMacosApplicationRouting(request)` runs the bounded, versioned macOS
+application-routing control-plane protocol off the Node.js main thread. It
+controls the bundled System Extension and Network Extension; packet forwarding
+continues to run in the separate extension process.
+
 Core-file privilege APIs are supported on macOS and Linux. They accept only
 canonical, existing executables named `mihomo` or `mihomo-alpha`; callers cannot
 use them as a general privileged-command interface. See the repository's

package/index.d.ts

@@ -12,8 +12,11 @@ export interface NativeCapabilities {
   windowsFirewall: boolean;
   launchAtLogin: boolean;
   networkContext: boolean;
+  networkMonitor: boolean;
   macosServiceManagement: boolean;
+  macosApplicationRouting: boolean;
   coreFilePrivileges: boolean;
+  serviceIdentity: boolean;
 }
 
 export interface ExecutableSearchOptions {
@@ -57,6 +60,8 @@ export interface LaunchAtLoginStatus {
 
 /** Best-effort active-network state. Unavailable fields are omitted instead of guessed. */
 export interface NetworkContext {
+  /** Whether the operating system currently has a usable default route. */
+  online: boolean;
   defaultInterface?: string;
   /** Active network-service name. Currently populated on macOS and Linux. */
   defaultService?: string;
@@ -71,6 +76,42 @@ export interface CorePrivilegeStatus {
   granted: boolean;
 }
 
+export interface ServiceIdentityOptions {
+  /** OS credential namespace, for example `com.amamiyakokoro.KokoroBox`. */
+  service: string;
+  account: string;
+  /** Mode-0600 fallback used only when Linux Secret Service is unavailable. */
+  linuxFallbackPath?: string;
+}
+
+export interface LegacyServiceIdentity {
+  keyId?: string;
+  publicKey: string;
+  privateKey: string;
+}
+
+export interface ServiceIdentityInfo {
+  keyId: string;
+  publicKey: string;
+  backend:
+    | "windows-credential-manager"
+    | "macos-keychain"
+    | "linux-secret-service"
+    | "linux-protected-file";
+}
+
+/** Opaque native signer. Private key material is never exposed by this object. */
+export class ServiceIdentity {
+  getInfo(): ServiceIdentityInfo;
+  sign(data: string): string;
+}
+
+export function openServiceIdentity(
+  options: ServiceIdentityOptions,
+  legacy?: LegacyServiceIdentity,
+): Promise<ServiceIdentity>;
+export function deleteServiceIdentity(options: ServiceIdentityOptions): Promise<void>;
+
 export interface ApplicationInfo {
   executablePath: string;
   executableName: string;
@@ -144,12 +185,19 @@ export function setLaunchAtLogin(
   enabled: boolean,
 ): Promise<LaunchAtLoginStatus>;
 export function getNetworkContext(): Promise<NetworkContext>;
+/** Resolve when the native network snapshot changes, or `undefined` on timeout. */
+export function waitForNetworkContextChange(
+  previous: NetworkContext,
+  timeoutMs?: number,
+): Promise<NetworkContext | null>;
 /** Query a LaunchDaemon plist embedded in the calling macOS application. */
 export function getMacosManagedServiceStatus(plistName: string): MacOSManagedServiceStatus;
 export function registerMacosManagedService(plistName: string): MacOSManagedServiceStatus;
 export function unregisterMacosManagedService(plistName: string): MacOSManagedServiceStatus;
 export function reloadMacosManagedService(plistName: string): MacOSManagedServiceStatus;
 export function openMacosLoginItemsSettings(): void;
+/** Invoke the versioned macOS Network/System Extension control-plane protocol. */
+export function invokeMacosApplicationRouting(request: string): Promise<string>;
 /** Inspect only validated `mihomo` and `mihomo-alpha` executable paths. */
 export function getCorePrivilegeStatus(paths: string[]): CorePrivilegeStatus[];
 /** Grant or revoke the constrained Unix core-file privilege. */

package/index.js

@@ -104,11 +104,13 @@ export const findExecutables = nativeBinding.findExecutables;
 export const getLaunchAtLogin = nativeBinding.getLaunchAtLogin;
 export const setLaunchAtLogin = nativeBinding.setLaunchAtLogin;
 export const getNetworkContext = nativeBinding.getNetworkContext;
+export const waitForNetworkContextChange = nativeBinding.waitForNetworkContextChange;
 export const getMacosManagedServiceStatus = nativeBinding.getMacosManagedServiceStatus;
 export const registerMacosManagedService = nativeBinding.registerMacosManagedService;
 export const unregisterMacosManagedService = nativeBinding.unregisterMacosManagedService;
 export const reloadMacosManagedService = nativeBinding.reloadMacosManagedService;
 export const openMacosLoginItemsSettings = nativeBinding.openMacosLoginItemsSettings;
+export const invokeMacosApplicationRouting = nativeBinding.invokeMacosApplicationRouting;
 export const getCorePrivilegeStatus = nativeBinding.getCorePrivilegeStatus;
 export const setCorePrivileges = nativeBinding.setCorePrivileges;
 export const inspectApplication = nativeBinding.inspectApplication;
@@ -119,3 +121,6 @@ export const runElevated = nativeBinding.runElevated;
 export const launchElevated = nativeBinding.launchElevated;
 export const launchUnelevated = nativeBinding.launchUnelevated;
 export const setupFirewallRules = nativeBinding.setupFirewallRules;
+export const ServiceIdentity = nativeBinding.ServiceIdentity;
+export const openServiceIdentity = nativeBinding.openServiceIdentity;
+export const deleteServiceIdentity = nativeBinding.deleteServiceIdentity;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kokorobox-native",
-  "version": "0.8.4",
+  "version": "0.10.1",
   "description": "KokoroBox native bridge",
   "type": "module",
   "main": "index.js",
@@ -48,11 +48,11 @@
     "access": "public"
   },
   "optionalDependencies": {
-    "kokorobox-native-win32-x64-msvc": "0.8.4",
-    "kokorobox-native-win32-arm64-msvc": "0.8.4",
-    "kokorobox-native-darwin-x64": "0.8.4",
-    "kokorobox-native-darwin-arm64": "0.8.4",
-    "kokorobox-native-linux-x64-gnu": "0.8.4",
-    "kokorobox-native-linux-arm64-gnu": "0.8.4"
+    "kokorobox-native-win32-x64-msvc": "0.10.1",
+    "kokorobox-native-win32-arm64-msvc": "0.10.1",
+    "kokorobox-native-darwin-x64": "0.10.1",
+    "kokorobox-native-darwin-arm64": "0.10.1",
+    "kokorobox-native-linux-x64-gnu": "0.10.1",
+    "kokorobox-native-linux-arm64-gnu": "0.10.1"
   }
 }