kokorobox-native 0.9.0 → 0.11.0

package/README.md

@@ -43,8 +43,10 @@ The full TypeScript declarations are shipped in
 | Rules | `fileToStr` |
 | Platform | `getLaunchAtLogin`, `setLaunchAtLogin`, `getNetworkContext` |
 | macOS service | `getMacosManagedServiceStatus`, `registerMacosManagedService`, `unregisterMacosManagedService`, `reloadMacosManagedService`, `openMacosLoginItemsSettings` |
+| macOS application routing | `invokeMacosApplicationRouting` |
 | Core permissions | `getCorePrivilegeStatus`, `setCorePrivileges` |
-| Windows | `getCurrentUserSid`, `isRunningAsAdmin`, `runElevated`, `launchElevated`, `launchUnelevated`, `setupFirewallRules` |
+| Privileged operations | `runServiceLifecycleElevated`, `cleanupLegacyMacosService`, `stopMacosManagedService`, `repairManagedFilePermissions` |
+| Windows | `getCurrentUserSid`, `isRunningAsAdmin`, `relaunchCurrentApplicationWithPrivilege`, `setupFirewallRules` |
 
 `inspectApplication` validates the input for the current platform and resolves
 it to a routing identifier: an executable path on Windows and Linux, or a code
@@ -77,6 +79,11 @@ LaunchDaemon plist and use `SMAppService` directly. They return an explicit
 `requires-approval` state when an administrator must approve the daemon in
 System Settings.
 
+`invokeMacosApplicationRouting(request)` runs the bounded, versioned macOS
+application-routing control-plane protocol off the Node.js main thread. It
+controls the bundled System Extension and Network Extension; packet forwarding
+continues to run in the separate extension process.
+
 Core-file privilege APIs are supported on macOS and Linux. They accept only
 canonical, existing executables named `mihomo` or `mihomo-alpha`; callers cannot
 use them as a general privileged-command interface. See the repository's
@@ -95,10 +102,15 @@ Windows account, elevation, Firewall, and application-scan APIs report an
 `UNSUPPORTED_PLATFORM:` error on other operating systems instead of behaving as
 no-ops.
 
-`launchElevated(command, args)` and `launchUnelevated(command, args)` start a
-new Windows process without waiting for it. The first presents the standard UAC
-prompt; the second uses the interactive desktop shell token so an elevated app
-can restart at normal user integrity. They do not configure persistent
+`runServiceLifecycleElevated(options)` accepts only the KokoroBox Service
+`init`, `install`, `uninstall`, `start`, `stop`, and `restart` actions. macOS
+legacy-service cleanup, managed-service stopping, and managed-file permission
+repair are separate purpose-specific APIs.
+
+`relaunchCurrentApplicationWithPrivilege(args, elevated)` starts a new copy of
+the current Windows application without accepting an executable path. An
+elevated relaunch presents the standard UAC prompt; the unelevated path uses
+the interactive desktop shell token. It does not configure persistent
 elevation.
 
 ## Contributing

package/index.d.ts

@@ -14,6 +14,7 @@ export interface NativeCapabilities {
   networkContext: boolean;
   networkMonitor: boolean;
   macosServiceManagement: boolean;
+  macosApplicationRouting: boolean;
   coreFilePrivileges: boolean;
   serviceIdentity: boolean;
 }
@@ -195,6 +196,40 @@ export function registerMacosManagedService(plistName: string): MacOSManagedServ
 export function unregisterMacosManagedService(plistName: string): MacOSManagedServiceStatus;
 export function reloadMacosManagedService(plistName: string): MacOSManagedServiceStatus;
 export function openMacosLoginItemsSettings(): void;
+/** Invoke the versioned macOS Network/System Extension control-plane protocol. */
+export function invokeMacosApplicationRouting(request: string): Promise<string>;
+export type ServiceLifecycleAction =
+  | "init"
+  | "install"
+  | "uninstall"
+  | "start"
+  | "stop"
+  | "restart";
+export interface ServiceLifecycleOptions {
+  executablePath: string;
+  action: ServiceLifecycleAction;
+  publicKey?: string;
+  authorizedSid?: string;
+  authorizedUid?: number;
+}
+/** Run only a validated KokoroBox Service lifecycle action with elevation. */
+export function runServiceLifecycleElevated(options: ServiceLifecycleOptions): Promise<void>;
+/** Remove only the fixed pre-SMAppService KokoroBox LaunchDaemon files. */
+export function cleanupLegacyMacosService(): Promise<void>;
+/** Stop the fixed KokoroBox SMAppService daemon label. */
+export function stopMacosManagedService(): Promise<void>;
+/** Repair one file below a validated managed root for the requested Unix owner. */
+export function repairManagedFilePermissions(
+  target: string,
+  managedRoot: string,
+  uid: number,
+  gid: number,
+): Promise<void>;
+/** Relaunch the current Windows application at the requested privilege level. */
+export function relaunchCurrentApplicationWithPrivilege(
+  args: string[],
+  elevated: boolean,
+): void;
 /** Inspect only validated `mihomo` and `mihomo-alpha` executable paths. */
 export function getCorePrivilegeStatus(paths: string[]): CorePrivilegeStatus[];
 /** Grant or revoke the constrained Unix core-file privilege. */
@@ -210,7 +245,4 @@ export function scanWindowsApplications(
 ): Promise<ApplicationScanResult>;
 export function getCurrentUserSid(): string;
 export function isRunningAsAdmin(): boolean;
-export function runElevated(command: string, args?: string[]): number;
-export function launchElevated(command: string, args?: string[]): void;
-export function launchUnelevated(command: string, args?: string[]): void;
 export function setupFirewallRules(rules: FirewallRule[]): void;

package/index.js

@@ -110,15 +110,18 @@ export const registerMacosManagedService = nativeBinding.registerMacosManagedSer
 export const unregisterMacosManagedService = nativeBinding.unregisterMacosManagedService;
 export const reloadMacosManagedService = nativeBinding.reloadMacosManagedService;
 export const openMacosLoginItemsSettings = nativeBinding.openMacosLoginItemsSettings;
+export const invokeMacosApplicationRouting = nativeBinding.invokeMacosApplicationRouting;
+export const runServiceLifecycleElevated = nativeBinding.runServiceLifecycleElevated;
+export const cleanupLegacyMacosService = nativeBinding.cleanupLegacyMacosService;
+export const stopMacosManagedService = nativeBinding.stopMacosManagedService;
+export const repairManagedFilePermissions = nativeBinding.repairManagedFilePermissions;
+export const relaunchCurrentApplicationWithPrivilege = nativeBinding.relaunchCurrentApplicationWithPrivilege;
 export const getCorePrivilegeStatus = nativeBinding.getCorePrivilegeStatus;
 export const setCorePrivileges = nativeBinding.setCorePrivileges;
 export const inspectApplication = nativeBinding.inspectApplication;
 export const scanWindowsApplications = nativeBinding.scanWindowsApplications;
 export const getCurrentUserSid = nativeBinding.getCurrentUserSid;
 export const isRunningAsAdmin = nativeBinding.isRunningAsAdmin;
-export const runElevated = nativeBinding.runElevated;
-export const launchElevated = nativeBinding.launchElevated;
-export const launchUnelevated = nativeBinding.launchUnelevated;
 export const setupFirewallRules = nativeBinding.setupFirewallRules;
 export const ServiceIdentity = nativeBinding.ServiceIdentity;
 export const openServiceIdentity = nativeBinding.openServiceIdentity;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kokorobox-native",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "KokoroBox native bridge",
   "type": "module",
   "main": "index.js",
@@ -48,11 +48,11 @@
     "access": "public"
   },
   "optionalDependencies": {
-    "kokorobox-native-win32-x64-msvc": "0.9.0",
-    "kokorobox-native-win32-arm64-msvc": "0.9.0",
-    "kokorobox-native-darwin-x64": "0.9.0",
-    "kokorobox-native-darwin-arm64": "0.9.0",
-    "kokorobox-native-linux-x64-gnu": "0.9.0",
-    "kokorobox-native-linux-arm64-gnu": "0.9.0"
+    "kokorobox-native-win32-x64-msvc": "0.11.0",
+    "kokorobox-native-win32-arm64-msvc": "0.11.0",
+    "kokorobox-native-darwin-x64": "0.11.0",
+    "kokorobox-native-darwin-arm64": "0.11.0",
+    "kokorobox-native-linux-x64-gnu": "0.11.0",
+    "kokorobox-native-linux-arm64-gnu": "0.11.0"
   }
 }