n9router 0.4.20 → 0.4.21

package/app/src/mitm/dns/dnsConfig.js

@@ -4,6 +4,7 @@ const path = require("path");
 const os = require("os");
 const { log, err } = require("../logger");
 const { TOOL_HOSTS } = require("../../shared/constants/mitmToolHosts");
+const { runElevatedPowerShell, quotePs } = require("../winElevated.js");
 
 const IS_WIN = process.platform === "win32";
 const IS_MAC = process.platform === "darwin";
@@ -269,11 +270,13 @@ async function addDNSEntry(tool, sudoPassword) {
   try {
     log(`🌐 DNS ${tool}: enabling (${entriesToAdd.join(", ")})`);
     if (IS_WIN) {
-      ensureWindowsDnsAccess(tool, "Enable Windows DNS override", entriesToAdd);
-      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\r\n") + "\r\n";
-      log(`🌐 DNS ${tool}: appending entries to ${HOSTS_FILE}`);
-      fs.appendFileSync(HOSTS_FILE, toAppend, "utf8");
-      flushWindowsDns();
+      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("`r`n");
+      // Single elevated script: append to hosts + flush DNS (1 UAC popup, or zero if admin)
+      const script = `
+        Add-Content -LiteralPath ${quotePs(HOSTS_FILE)} -Value ${quotePs(toAppend)}
+        ipconfig /flushdns | Out-Null
+      `;
+      await runElevatedPowerShell(script);
       verifyDnsEntriesPresent(tool, true);
     } else {
       await execWithPassword(`echo "${entries}" >> ${HOSTS_FILE}`, sudoPassword);
@@ -310,12 +313,19 @@ async function removeDNSEntry(tool, sudoPassword) {
   try {
     log(`🌐 DNS ${tool}: disabling (${entriesToRemove.join(", ")})`);
     if (IS_WIN) {
-      ensureWindowsDnsAccess(tool, "Disable Windows DNS override", entriesToRemove);
-      const content = fs.readFileSync(HOSTS_FILE, "utf8");
-      const filtered = content.split(/\r?\n/).filter(l => !entriesToRemove.some(h => l.includes(h))).join("\r\n");
-      log(`🌐 DNS ${tool}: rewriting ${HOSTS_FILE} without ${entriesToRemove.join(", ")}`);
-      fs.writeFileSync(HOSTS_FILE, filtered, "utf8");
-      flushWindowsDns();
+      // Build PowerShell list literal of hosts to strip
+      const hostsList = entriesToRemove.map(quotePs).join(",");
+      const script = `
+        $hosts = @(${hostsList})
+        $lines = Get-Content -LiteralPath ${quotePs(HOSTS_FILE)}
+        $filtered = $lines | Where-Object {
+          $line = $_
+          -not ($hosts | Where-Object { $line -match [regex]::Escape($_) })
+        }
+        Set-Content -LiteralPath ${quotePs(HOSTS_FILE)} -Value $filtered
+        ipconfig /flushdns | Out-Null
+      `;
+      await runElevatedPowerShell(script);
       verifyDnsEntriesPresent(tool, false);
     } else {
       for (const host of entriesToRemove) {
@@ -385,7 +395,6 @@ module.exports = {
   removeAllDNSEntriesSync,
   execWithPassword,
   isSudoAvailable,
-  executeElevatedPowerShell,
   checkDNSEntry,
   checkAllDNSStatus,
   buildWindowsAdminHint,

package/app/src/mitm/handlers/antigravity.js

@@ -1,10 +1,32 @@
-const { interceptWithMappedModel } = require("./interceptWithMappedModel");
+const { err, createResponseDumper } = require("../logger");
+const { fetchRouter, pipeSSE } = require("./base");
 
 /**
- * Intercept Antigravity (Gemini) request — replace model and forward to router
+ * Intercept Antigravity request — forward Gemini body as-is to /v1/chat/completions.
+ * Router auto-detects format via body.userAgent==="antigravity" + body.request.contents,
+ * runs antigravity→openai→provider→openai→antigravity translators internally.
  */
-async function intercept(req, res, bodyBuffer, mappedModel, options = {}) {
-  return interceptWithMappedModel(req, res, bodyBuffer, mappedModel, options);
+async function intercept(req, res, bodyBuffer, mappedModel) {
+  const dumper = createResponseDumper(req, "intercept-antigravity");
+  const isStream = req.url.includes(":streamGenerateContent");
+  try {
+    const body = JSON.parse(bodyBuffer.toString());
+    if (body.model) body.model = mappedModel;
+
+    const routerRes = await fetchRouter(body, "/v1/chat/completions", req.headers);
+    await pipeSSE(routerRes, res, dumper);
+  } catch (error) {
+    err(`[antigravity] ${error.message}`);
+    if (dumper) { dumper.writeChunk(`\n[ERROR] ${error.message}\n`); dumper.end(); }
+    // For stream endpoint, send SSE error chunk so SDK doesn't hang waiting
+    if (isStream) {
+      if (!res.headersSent) res.writeHead(200, { "Content-Type": "text/event-stream" });
+      res.end(`data: ${JSON.stringify({ error: { message: error.message } })}\r\n\r\n`);
+    } else {
+      if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: { message: error.message, type: "mitm_error" } }));
+    }
+  }
 }
 
 module.exports = { intercept };

package/app/src/mitm/handlers/base.js

@@ -32,22 +32,20 @@ async function fetchRouter(openaiBody, path = "/v1/chat/completions", clientHead
     body: JSON.stringify(openaiBody)
   });
 
-  if (!response.ok) {
-    const errText = await response.text().catch(() => "");
-    throw new Error(`[${response.status}]: ${errText}`);
-  }
-
+  // Forward response as-is (status + body). pipeSSE will propagate status.
   return response;
 }
 
 /**
- * Pipe SSE stream from router directly to client response
+ * Pipe SSE stream from router directly to client response.
+ * Optional dumper tees the stream into a debug file.
  */
 async function pipeSSE(routerRes, res, debugContext = null) {
   const ct = routerRes.headers.get("content-type") || "application/json";
+  const status = routerRes.status || 200;
   const resHeaders = { "Content-Type": ct, "Cache-Control": "no-cache", "Connection": "keep-alive" };
   if (ct.includes("text/event-stream")) resHeaders["X-Accel-Buffering"] = "no";
-  res.writeHead(200, resHeaders);
+  res.writeHead(status, resHeaders);
 
   if (!routerRes.body) {
     const bodyText = await routerRes.text().catch(() => "");

package/app/src/mitm/logger.js

@@ -1,3 +1,9 @@
+const fs = require("fs");
+const path = require("path");
+const zlib = require("zlib");
+const { DATA_DIR } = require("./paths");
+const { LOG_BLACKLIST_URL_PARTS } = require("./config");
+
 function time() {
   return new Date().toLocaleTimeString("en-US", { hour12: false });
 }
@@ -5,4 +11,86 @@ function time() {
 const log = (msg) => console.log(`[${time()}] [MITM] ${msg}`);
 const err = (msg) => console.error(`[${time()}] ❌ [MITM] ${msg}`);
 
-module.exports = { log, err };
+const DUMP_DIR = path.join(DATA_DIR, "logs", "mitm");
+if (!fs.existsSync(DUMP_DIR)) fs.mkdirSync(DUMP_DIR, { recursive: true });
+
+const EMPTY_BODY_RE = /^\s*(\{\s*\}|\[\s*\]|null)?\s*$/;
+
+function slugify(s, max = 80) {
+  return String(s).replace(/[^a-zA-Z0-9]/g, "_").substring(0, max);
+}
+
+function isBlacklisted(url) {
+  if (!url) return false;
+  return LOG_BLACKLIST_URL_PARTS.some(part => url.includes(part));
+}
+
+// Decode body buffer based on content-encoding header
+function decodeBody(buf, encoding) {
+  if (!buf || buf.length === 0) return buf;
+  try {
+    const enc = (encoding || "").toLowerCase();
+    if (enc.includes("gzip")) return zlib.gunzipSync(buf);
+    if (enc.includes("br")) return zlib.brotliDecompressSync(buf);
+    if (enc.includes("deflate")) return zlib.inflateSync(buf);
+  } catch { /* return raw on failure */ }
+  return buf;
+}
+
+// Save raw request: method + url + headers + body
+function dumpRequest(req, bodyBuffer, tag = "raw") {
+  if (isBlacklisted(req.url)) return null;
+  try {
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    const slug = slugify((req.headers.host || "") + req.url);
+    const file = path.join(DUMP_DIR, `${ts}_${tag}_${slug}.req.json`);
+    let parsed = null;
+    try { parsed = JSON.parse(bodyBuffer.toString()); } catch { /* not JSON */ }
+    fs.writeFileSync(file, JSON.stringify({
+      method: req.method,
+      url: req.url,
+      host: req.headers.host,
+      headers: req.headers,
+      body: parsed ?? bodyBuffer.toString("utf8")
+    }, null, 2));
+    return file;
+  } catch { return null; }
+}
+
+// Buffer-based response dumper — collects chunks then decodes + writes once on end()
+// Trade-off: holds response in RAM, but enables gzip/br decoding for readable output.
+function createResponseDumper(req, tag = "raw") {
+  if (isBlacklisted(req.url)) return null;
+  const ts = new Date().toISOString().replace(/[:.]/g, "-");
+  const slug = slugify((req.headers.host || "") + req.url);
+  const file = path.join(DUMP_DIR, `${ts}_${tag}_${slug}.res.txt`);
+  let status = 0;
+  let headers = {};
+  const chunks = [];
+  return {
+    writeHeader: (s, h) => { status = s; headers = h || {}; },
+    writeChunk: (chunk) => {
+      if (chunk == null) return;
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    },
+    end: () => {
+      try {
+        const raw = Buffer.concat(chunks);
+        const enc = headers["content-encoding"] || headers["Content-Encoding"];
+        const decoded = decodeBody(raw, enc);
+        const text = decoded.toString("utf8");
+        // Skip empty / trivially-empty bodies
+        if (EMPTY_BODY_RE.test(text)) return;
+        // Strip content-encoding since body is now decoded
+        const cleanHeaders = { ...headers };
+        delete cleanHeaders["content-encoding"];
+        delete cleanHeaders["Content-Encoding"];
+        const out = `STATUS: ${status}\nHEADERS: ${JSON.stringify(cleanHeaders, null, 2)}\n---BODY---\n${text}`;
+        fs.writeFileSync(file, out);
+      } catch { /* ignore */ }
+    },
+    file
+  };
+}
+
+module.exports = { log, err, dumpRequest, createResponseDumper };

package/app/src/mitm/manager.js

@@ -593,14 +593,31 @@ async function stopServer(sudoPassword) {
   serverPid = null;
 
   if (IS_WIN) {
-    // Process already has admin rights — edit hosts file directly
     const hostsFile = path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts");
     const allHosts = Object.values(TOOL_HOSTS).flat();
     try {
-      const hostsContent = fs.readFileSync(hostsFile, "utf8");
-      const filtered = hostsContent.split(/\r?\n/).filter(l => !allHosts.some(h => l.includes(h))).join("\r\n");
-      fs.writeFileSync(hostsFile, filtered, "utf8");
-      require("child_process").execSync("ipconfig /flushdns", { windowsHide: true });
+      const { isAdmin, runElevatedPowerShell, quotePs } = require("./winElevated.js");
+      if (isAdmin()) {
+        // Direct fs write — bypass PowerShell to avoid parser pitfalls
+        const content = fs.readFileSync(hostsFile, "utf8");
+        const filtered = content.split(/\r?\n/).filter(l => !allHosts.some(h => l.includes(h))).join("\r\n");
+        if (filtered !== content) fs.writeFileSync(hostsFile, filtered, "utf8");
+        try { require("child_process").execSync("ipconfig /flushdns", { windowsHide: true, stdio: "ignore" }); } catch { /* ignore */ }
+        log("🌐 DNS: ✅ all tool hosts removed");
+      } else {
+        const hostsList = allHosts.map(quotePs).join(",");
+        const script = `
+          $hosts = @(${hostsList})
+          $lines = Get-Content -LiteralPath ${quotePs(hostsFile)}
+          $filtered = $lines | Where-Object {
+            $line = $_
+            -not ($hosts | Where-Object { $line -match [regex]::Escape($_) })
+          }
+          Set-Content -LiteralPath ${quotePs(hostsFile)} -Value $filtered
+          ipconfig /flushdns | Out-Null
+        `;
+        await runElevatedPowerShell(script);
+      }
     } catch (e) { err(`Failed to clean hosts: ${e.message}`); }
   } else {
     await removeAllDNSEntries(sudoPassword);

package/app/src/mitm/mitmSettings.js

@@ -0,0 +1,104 @@
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const { DATA_DIR } = require("./paths");
+
+const DEFAULT_DB_FILE = path.join(DATA_DIR, "db.json");
+const DEFAULT_ANTIGRAVITY_IDE_VERSION = "1.23.2";
+const DEFAULT_SETTINGS_CACHE_TTL_MS = 1000;
+
+const settingsCache = new Map();
+
+function normalizeAntigravityIdeVersion(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  return trimmed || DEFAULT_ANTIGRAVITY_IDE_VERSION;
+}
+
+function getCacheEntry(dbFile) {
+  let entry = settingsCache.get(dbFile);
+  if (!entry) {
+    entry = {
+      checkedAt: 0,
+      mtimeMs: null,
+      settings: {},
+    };
+    settingsCache.set(dbFile, entry);
+  }
+  return entry;
+}
+
+function readSettingsFromDb(dbFile) {
+  const db = JSON.parse(fs.readFileSync(dbFile, "utf-8"));
+  const settings = db?.settings;
+  return settings && typeof settings === "object" && !Array.isArray(settings)
+    ? settings
+    : {};
+}
+
+function getMitmSettings(dbFile = DEFAULT_DB_FILE, options = {}) {
+  const ttlMs = options.ttlMs ?? DEFAULT_SETTINGS_CACHE_TTL_MS;
+  const now = Date.now();
+  const entry = getCacheEntry(dbFile);
+
+  if (ttlMs > 0 && entry.checkedAt && now - entry.checkedAt < ttlMs) {
+    return entry.settings;
+  }
+
+  entry.checkedAt = now;
+
+  try {
+    if (!fs.existsSync(dbFile)) {
+      entry.mtimeMs = null;
+      entry.settings = {};
+      return entry.settings;
+    }
+
+    const stat = fs.statSync(dbFile);
+    if (entry.mtimeMs === stat.mtimeMs) {
+      return entry.settings;
+    }
+
+    entry.mtimeMs = stat.mtimeMs;
+    entry.settings = readSettingsFromDb(dbFile);
+    return entry.settings;
+  } catch {
+    return entry.settings || {};
+  }
+}
+
+function getAntigravityIdeVersionSettings(dbFile = DEFAULT_DB_FILE) {
+  const settings = getMitmSettings(dbFile);
+  return {
+    enabled: settings.mitmAntigravityIdeVersionOverrideEnabled === true,
+    version: normalizeAntigravityIdeVersion(settings.mitmAntigravityIdeVersion),
+  };
+}
+
+function getAntigravityHostRewriteTarget(host, dbFile = DEFAULT_DB_FILE) {
+  const settings = getMitmSettings(dbFile);
+  const enabled = settings.mitmAntigravityHostRewriteEnabled !== false;
+  if (!enabled) return host;
+  if (host === "cloudcode-pa.googleapis.com") {
+    return "daily-cloudcode-pa.googleapis.com";
+  }
+  return host;
+}
+
+function resetMitmSettingsCache(dbFile = null) {
+  if (dbFile) {
+    settingsCache.delete(dbFile);
+    return;
+  }
+  settingsCache.clear();
+}
+
+module.exports = {
+  DEFAULT_ANTIGRAVITY_IDE_VERSION,
+  DEFAULT_DB_FILE,
+  getAntigravityHostRewriteTarget,
+  getAntigravityIdeVersionSettings,
+  getMitmSettings,
+  normalizeAntigravityIdeVersion,
+  resetMitmSettingsCache,
+};

package/app/src/mitm/modelMapping.js

@@ -3,7 +3,7 @@ const fs = require("fs");
 const MITM_ALIAS_RR_STATE_KEY = "mitmAliasRoundRobinState";
 
 const FORCED_PASSTHROUGH_MODELS = {
-  antigravity: new Set(["gemini-3.1-flash-lite","tab_flash_lite_preview","tab_jump_flash_lite_preview"]),
+  antigravity: new Set([]),
 };
 
 function readDb(dbFile) {

package/app/src/mitm/server.js

@@ -20,13 +20,14 @@ const { isTokenSwapEnabled, getAllActiveConnections, triggerRefreshIfNeeded,
         autoDisableAccountIfSonnetQuotaZero,
         markAccountUsed, getConnectionLabel, getTokenSwapAvailabilitySummary,
         getAntigravity503RetryCount } = require("./tokenPool");
-const { createAntigravityDebugContext, maskToken } = require("./antigravityDebugLog");
+const { createAntigravityDebugContext, extractBearerToken, maskToken } = require("./antigravityDebugLog");
 const { getCertForDomain } = require("./cert/generate");
 const { buildInputOnlyRequestDetail, createTokenSwapUsageObserver, generateDetailId } = require("./usageTracker");
 const { pushHealthEvent, getLastEventStatus, migrateToEmailKeys } = require("./healthStore");
 
 const { applyRtkCompression } = require("./rtkCompressor");
 const { applyAntigravityIdeVersionOverride } = require("./antigravityIdeVersion");
+const { getAntigravityHostRewriteTarget } = require("./mitmSettings");
 
 const DB_FILE = path.join(DATA_DIR, "db.json");
 const LOCAL_PORT = 443;
@@ -52,6 +53,7 @@ const TOOL_TO_PROVIDER = {
   // kiro: "kiro",         // future
 };
 
+
 // Load handlers — dev/ overrides handlers/ for private implementations
 function loadHandler(name) {
   try { return require(`./dev/${name}`); } catch {}
@@ -68,13 +70,17 @@ const handlers = {
 // ── SSL / SNI ─────────────────────────────────────────────────
 
 const certCache = new Map();
+let rootCAPem;
 
 function sniCallback(servername, cb) {
   try {
     if (certCache.has(servername)) return cb(null, certCache.get(servername));
     const certData = getCertForDomain(servername);
     if (!certData) return cb(new Error(`Failed to generate cert for ${servername}`));
-    const ctx = require("tls").createSecureContext({ key: certData.key, cert: certData.cert });
+    const ctx = require("tls").createSecureContext({
+      key: certData.key,
+      cert: `${certData.cert}\n${rootCAPem}`
+    });
     certCache.set(servername, ctx);
     log(`🔐 Cert generated: ${servername}`);
     cb(null, ctx);
@@ -86,11 +92,10 @@ function sniCallback(servername, cb) {
 
 let sslOptions;
 try {
-  sslOptions = {
-    key: fs.readFileSync(path.join(MITM_DIR, "rootCA.key")),
-    cert: fs.readFileSync(path.join(MITM_DIR, "rootCA.crt")),
-    SNICallback: sniCallback
-  };
+  const rootKey = fs.readFileSync(path.join(MITM_DIR, "rootCA.key"));
+  const rootCert = fs.readFileSync(path.join(MITM_DIR, "rootCA.crt"));
+  rootCAPem = rootCert.toString("utf8");
+  sslOptions = { key: rootKey, cert: rootCert, SNICallback: sniCallback };
 } catch (e) {
   err(`Root CA not found: ${e.message}`);
   process.exit(1);
@@ -140,15 +145,29 @@ function extractModel(url, body) {
  * so it's both forwarded to client AND passed to the callback for inspection.
  */
 async function passthrough(req, res, bodyBuffer, onResponse, debugContext = null) {
-  const targetHost = (req.headers.host || TARGET_HOSTS[0]).split(":")[0];
+  let targetHost = (req.headers.host || TARGET_HOSTS[0]).split(":")[0];
+  const rewrittenHost = getAntigravityHostRewriteTarget(targetHost, DB_FILE);
+  if (rewrittenHost !== targetHost) targetHost = rewrittenHost;
   const targetIP = await resolveTargetIP(targetHost);
+  const tool = getToolForHost(req.headers.host);
+  const versionOverride = tool === "antigravity"
+    ? applyAntigravityIdeVersionOverride(bodyBuffer, req.headers, DB_FILE, log)
+    : { bodyBuffer, headers: req.headers };
+  const bodyForForwarding = versionOverride.bodyBuffer;
+  const headersForForwarding = {
+    ...versionOverride.headers,
+    host: targetHost,
+  };
+  if (bodyForForwarding !== bodyBuffer) {
+    headersForForwarding["content-length"] = String(bodyForForwarding.length);
+  }
 
   const forwardReq = https.request({
     hostname: targetIP,
     port: 443,
     path: req.url,
     method: req.method,
-    headers: { ...req.headers, host: targetHost },
+    headers: headersForForwarding,
     servername: targetHost,
     rejectUnauthorized: false
   }, (forwardRes) => {
@@ -179,7 +198,7 @@ async function passthrough(req, res, bodyBuffer, onResponse, debugContext = null
     res.end("Bad Gateway");
   });
 
-  if (bodyBuffer.length > 0) forwardReq.write(bodyBuffer);
+  if (bodyForForwarding.length > 0) forwardReq.write(bodyForForwarding);
   forwardReq.end();
 }
 
@@ -188,7 +207,9 @@ async function passthrough(req, res, bodyBuffer, onResponse, debugContext = null
 // piping to client — enabling auto-retry on 429/503.
 
 async function tokenSwapForward(req, res, bodyBuffer, connections, model, strategy, provider, requestStartTime, debugContext = null) {
-  const targetHost = (req.headers.host || TARGET_HOSTS[0]).split(":")[0];
+  let targetHost = (req.headers.host || TARGET_HOSTS[0]).split(":")[0];
+  const rewrittenHost = getAntigravityHostRewriteTarget(targetHost, DB_FILE);
+  if (rewrittenHost !== targetHost) targetHost = rewrittenHost;
   const targetIP = await resolveTargetIP(targetHost);
   let lastRetryResponse = null;
 

package/app/src/mitm/winElevated.js

@@ -0,0 +1,79 @@
+const { exec, execSync } = require("child_process");
+
+const IS_WIN = process.platform === "win32";
+
+/**
+ * Detect if current Windows process has admin rights (no UAC popup needed).
+ * Uses `net session` which only succeeds when elevated.
+ */
+function isAdmin() {
+  if (!IS_WIN) return false;
+  try {
+    execSync("net session >nul 2>&1", { windowsHide: true, stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Quote a string safely for PowerShell single-quoted literal.
+ */
+function quotePs(value) {
+  return `'${String(value).replace(/'/g, "''")}'`;
+}
+
+/**
+ * Run PowerShell script — escalated via UAC popup if not already admin.
+ * Returns Promise resolving on exit code 0, rejecting otherwise.
+ *
+ * IMPORTANT: each call triggers ONE UAC popup. Batch multiple admin tasks
+ * into a single script string to minimize popups.
+ */
+function runElevatedPowerShell(script) {
+  if (!IS_WIN) return Promise.reject(new Error("Windows-only"));
+
+  const encoded = Buffer.from(script, "utf16le").toString("base64");
+
+  // If already admin, run directly — zero popup
+  if (isAdmin()) {
+    return new Promise((resolve, reject) => {
+      exec(
+        `powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encoded}`,
+        { windowsHide: true },
+        (error, stdout, stderr) => {
+          if (error) reject(new Error(stderr || error.message));
+          else resolve(stdout);
+        }
+      );
+    });
+  }
+
+  // Not admin — wrap with Start-Process -Verb RunAs (UAC popup)
+  const wrapper = `
+    $proc = Start-Process powershell -ArgumentList @(
+      '-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass',
+      '-WindowStyle','Hidden','-EncodedCommand','${encoded}'
+    ) -Verb RunAs -Wait -PassThru -WindowStyle Hidden;
+    if ($proc.ExitCode -ne 0) { throw "Elevated command exited with code $($proc.ExitCode)" }
+  `;
+
+  return new Promise((resolve, reject) => {
+    exec(
+      `powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command ${quotePs(wrapper)}`,
+      { windowsHide: true },
+      (error, stdout, stderr) => {
+        if (error) {
+          const msg = stderr || error.message;
+          if (msg.includes("canceled by the user") || msg.includes("operation was canceled")) {
+            reject(new Error("User canceled UAC prompt"));
+          } else {
+            reject(new Error(msg));
+          }
+        } else resolve(stdout);
+      }
+    );
+  });
+}
+
+module.exports = { isAdmin, runElevatedPowerShell, quotePs };

package/app/src/shared/constants/cliTools.js

@@ -14,7 +14,7 @@ export const MITM_TOOLS = {
     defaultModels: [
       { id: "gemini-3.1-pro-high", name: "Gemini 3.1 Pro High", alias: "gemini-3.1-pro-high" },
       { id: "gemini-3.1-pro-low", name: "Gemini 3.1 Pro Low", alias: "gemini-3.1-pro-low" },
-      { id: "gemini-3-flash", name: "Gemini 3 Flash", alias: "gemini-3-flash" },
+      { id: "gemini-3-flash", name: "Gemini 3 Flash / Default", alias: "gemini-3-flash" },
       { id: "claude-sonnet-4-6", name: "Claude Sonnet 4.6", alias: "claude-sonnet-4-6" },
       { id: "claude-opus-4-6-thinking", name: "Claude Opus 4.6 Thinking", alias: "claude-opus-4-6-thinking" },
       { id: "gpt-oss-120b-medium", name: "GPT OSS 120B Medium", alias: "gpt-oss-120b-medium" },