n9router 0.4.20 → 0.4.21

package/app/open-sse/executors/default.js

@@ -4,12 +4,17 @@ import { OAUTH_ENDPOINTS, buildKimiHeaders } from "../config/appConstants.js";
 import { buildClineHeaders } from "../../src/shared/utils/clineAuth.js";
 import { getCachedClaudeHeaders } from "../utils/claudeHeaderCache.js";
 import { proxyAwareFetch } from "../utils/proxyFetch.js";
+import { injectReasoningContent } from "../utils/reasoningContentInjector.js";
 
 export class DefaultExecutor extends BaseExecutor {
   constructor(provider) {
     super(provider, PROVIDERS[provider] || PROVIDERS.openai);
   }
 
+  transformRequest(model, body) {
+    return injectReasoningContent({ provider: this.provider, model, body });
+  }
+
   buildUrl(model, stream, urlIndex = 0, credentials = null) {
     if (this.provider?.startsWith?.("openai-compatible-")) {
       const baseUrl = credentials?.providerSpecificData?.baseUrl || "https://api.openai.com/v1";

package/app/open-sse/executors/opencode-go.js

@@ -1,15 +1,12 @@
 import { BaseExecutor } from "./base.js";
 import { PROVIDERS } from "../config/providers.js";
+import { injectReasoningContent } from "../utils/reasoningContentInjector.js";
 
 // Models that use /zen/go/v1/messages (Anthropic/Claude format + x-api-key auth)
 const CLAUDE_FORMAT_MODELS = new Set(["minimax-m2.5", "minimax-m2.7"]);
 
 const BASE = "https://opencode.ai/zen/go/v1";
 
-// Kimi (Moonshot) requires reasoning_content on assistant tool_call messages when thinking is on.
-// OpenAI-format clients don't send it -> upstream 400. Inject a non-empty placeholder.
-const KIMI_REASONING_PLACEHOLDER = " ";
-
 export class OpenCodeGoExecutor extends BaseExecutor {
   constructor() {
     super("opencode-go", PROVIDERS["opencode-go"]);
@@ -39,13 +36,6 @@ export class OpenCodeGoExecutor extends BaseExecutor {
   }
 
   transformRequest(model, body) {
-    if (!model?.startsWith?.("kimi-") || !body?.messages) return body;
-    const messages = body.messages.map(m => {
-      if (m?.role === "assistant" && Array.isArray(m.tool_calls) && !("reasoning_content" in m)) {
-        return { ...m, reasoning_content: KIMI_REASONING_PLACEHOLDER };
-      }
-      return m;
-    });
-    return { ...body, messages };
+    return injectReasoningContent({ provider: this.provider, model, body });
   }
 }

package/app/open-sse/handlers/embeddingsCore.js

@@ -7,6 +7,19 @@ import { refreshWithRetry } from "../services/tokenRefresh.js";
 // Google AI (Gemini) provider aliases / identifiers
 const GEMINI_PROVIDERS = new Set(["gemini", "google_ai_studio"]);
 
+// Static map: provider id → embeddings endpoint (OpenAI-compatible body format)
+const EMBEDDING_URLS = {
+  openai: "https://api.openai.com/v1/embeddings",
+  openrouter: "https://openrouter.ai/api/v1/embeddings",
+  mistral: "https://api.mistral.ai/v1/embeddings",
+  "voyage-ai": "https://api.voyageai.com/v1/embeddings",
+  fireworks: "https://api.fireworks.ai/inference/v1/embeddings",
+  together: "https://api.together.xyz/v1/embeddings",
+  nebius: "https://api.tokenfactory.nebius.com/v1/embeddings",
+  github: "https://models.github.ai/inference/embeddings",
+  nvidia: "https://integrate.api.nvidia.com/v1/embeddings",
+};
+
 /**
  * Check whether a provider targets the Google AI (Gemini) embeddings API.
  * @param {string} provider
@@ -77,22 +90,16 @@ function buildEmbeddingsUrl(provider, model, credentials, input) {
     return `https://generativelanguage.googleapis.com/v1beta/${modelPath}:embedContent?key=${encodeURIComponent(apiKey)}`;
   }
 
-  switch (provider) {
-    case "openai":
-      return "https://api.openai.com/v1/embeddings";
-    case "openrouter":
-      return "https://openrouter.ai/api/v1/embeddings";
-    default:
-      // openai-compatible & custom-embedding providers: use their baseUrl + /embeddings
-      if (provider?.startsWith?.("openai-compatible-") || provider?.startsWith?.("custom-embedding-")) {
-        const rawBaseUrl = credentials?.providerSpecificData?.baseUrl || "https://api.openai.com/v1";
-        // Defensive: strip trailing slash and accidental /embeddings to avoid double-append
-        const baseUrl = rawBaseUrl.replace(/\/$/, "").replace(/\/embeddings$/, "");
-        return `${baseUrl}/embeddings`;
-      }
-      // For other providers, attempt to use their base URL pattern with /embeddings path
-      return null;
+  if (EMBEDDING_URLS[provider]) return EMBEDDING_URLS[provider];
+
+  // openai-compatible & custom-embedding providers: use their baseUrl + /embeddings
+  if (provider?.startsWith?.("openai-compatible-") || provider?.startsWith?.("custom-embedding-")) {
+    const rawBaseUrl = credentials?.providerSpecificData?.baseUrl || "https://api.openai.com/v1";
+    // Defensive: strip trailing slash and accidental /embeddings to avoid double-append
+    const baseUrl = rawBaseUrl.replace(/\/$/, "").replace(/\/embeddings$/, "");
+    return `${baseUrl}/embeddings`;
   }
+  return null;
 }
 
 /**

package/app/open-sse/handlers/ttsCore.js

@@ -455,7 +455,209 @@ async function handleOpenAiTts({ model, input, credentials, responseFormat = "mp
   return createTtsResponse(base64, "mp3", responseFormat);
 }
 
-// ── TTS Provider Registry (DRY) ────────────────────────────────
+// ── Generic TTS Format Handlers (config-driven via ttsConfig.format) ──────
+// Parse `model` string as "modelId/voiceId" or "modelId" (modelId may contain slashes — match against known list)
+function parseModelVoice(model, defaultModel = "", defaultVoice = "", knownModels = []) {
+  if (!model) return { modelId: defaultModel, voiceId: defaultVoice };
+  // Find longest known model id that prefixes `model`
+  const known = knownModels.map((m) => m.id || m).filter(Boolean).sort((a, b) => b.length - a.length);
+  for (const id of known) {
+    if (model === id) return { modelId: id, voiceId: defaultVoice };
+    if (model.startsWith(`${id}/`)) return { modelId: id, voiceId: model.slice(id.length + 1) };
+  }
+  // Fallback: split on last "/" so "vendor/model/voice" → model="vendor/model", voice="voice"
+  const idx = model.lastIndexOf("/");
+  if (idx > 0) return { modelId: model.slice(0, idx), voiceId: model.slice(idx + 1) };
+  return { modelId: defaultModel || model, voiceId: defaultVoice || model };
+}
+
+// Convert upstream Response (binary audio) to { base64, format }
+async function responseToBase64(res, defaultFormat = "mp3") {
+  const buf = await res.arrayBuffer();
+  if (buf.byteLength < 100) throw new Error("Upstream returned empty audio");
+  const ctype = res.headers.get("content-type") || "";
+  let format = defaultFormat;
+  if (ctype.includes("wav")) format = "wav";
+  else if (ctype.includes("mpeg") || ctype.includes("mp3")) format = "mp3";
+  else if (ctype.includes("ogg")) format = "ogg";
+  return { base64: Buffer.from(buf).toString("base64"), format };
+}
+
+async function throwUpstreamError(res) {
+  const text = await res.text().catch(() => "");
+  let msg = `Upstream error (${res.status})`;
+  try {
+    const parsed = JSON.parse(text);
+    msg = parsed?.error?.message || parsed?.message || parsed?.detail?.message || (typeof parsed?.detail === "string" ? parsed.detail : null) || text || msg;
+  } catch { msg = text || msg; }
+  throw new Error(msg);
+}
+
+// Hyperbolic: POST { text } → { audio: base64 }
+async function ttsHyperbolic({ baseUrl, apiKey, text }) {
+  const res = await fetch(baseUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "Authorization": `Bearer ${apiKey}` },
+    body: JSON.stringify({ text }),
+  });
+  if (!res.ok) await throwUpstreamError(res);
+  const data = await res.json();
+  return { base64: data.audio, format: "mp3" };
+}
+
+// Deepgram: model via query, Token auth, returns binary
+async function ttsDeepgram({ baseUrl, apiKey, text, modelId }) {
+  const url = new URL(baseUrl);
+  url.searchParams.set("model", modelId || "aura-asteria-en");
+  const res = await fetch(url.toString(), {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "Authorization": `Token ${apiKey}` },
+    body: JSON.stringify({ text }),
+  });
+  if (!res.ok) await throwUpstreamError(res);
+  return responseToBase64(res, "mp3");
+}
+
+// Nvidia NIM: POST { input: { text }, voice, model } → binary
+async function ttsNvidia({ baseUrl, apiKey, text, modelId, voiceId }) {
+  const res = await fetch(baseUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "Authorization": `Bearer ${apiKey}` },
+    body: JSON.stringify({ input: { text }, voice: voiceId || "default", model: modelId }),
+  });
+  if (!res.ok) await throwUpstreamError(res);
+  return responseToBase64(res, "wav");
+}
+
+// HuggingFace: POST {baseUrl}/{modelId} { inputs: text } → binary
+async function ttsHuggingFace({ baseUrl, apiKey, text, modelId }) {
+  if (!modelId || modelId.includes("..")) throw new Error("Invalid HuggingFace model ID");
+  const res = await fetch(`${baseUrl}/${modelId}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "Authorization": `Bearer ${apiKey}` },
+    body: JSON.stringify({ inputs: text }),
+  });
+  if (!res.ok) await throwUpstreamError(res);
+  return responseToBase64(res, "wav");
+}
+
+// Inworld: POST { text, voiceId, modelId, audioConfig } → JSON { audioContent }
+async function ttsInworld({ baseUrl, apiKey, text, modelId, voiceId }) {
+  const res = await fetch(baseUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", "Authorization": `Basic ${apiKey}` },
+    body: JSON.stringify({
+      text,
+      voiceId: voiceId || "Alex",
+      modelId: modelId || "inworld-tts-1.5-mini",
+      audioConfig: { audioEncoding: "MP3" },
+    }),
+  });
+  if (!res.ok) await throwUpstreamError(res);
+  const data = await res.json();
+  if (!data.audioContent) throw new Error("Inworld TTS returned no audio");
+  return { base64: data.audioContent, format: "mp3" };
+}
+
+// Cartesia: POST { model_id, transcript, voice, output_format } → binary
+async function ttsCartesia({ baseUrl, apiKey, text, modelId, voiceId }) {
+  const res = await fetch(baseUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-API-Key": apiKey,
+      "Cartesia-Version": "2024-06-10",
+    },
+    body: JSON.stringify({
+      model_id: modelId || "sonic-2",
+      transcript: text,
+      ...(voiceId ? { voice: { mode: "id", id: voiceId } } : {}),
+      output_format: { container: "mp3", bit_rate: 128000, sample_rate: 44100 },
+    }),
+  });
+  if (!res.ok) await throwUpstreamError(res);
+  return responseToBase64(res, "mp3");
+}
+
+// PlayHT: token format "userId:apiKey", voice = s3 URL
+async function ttsPlayHt({ baseUrl, apiKey, text, modelId, voiceId }) {
+  const [userId, key] = (apiKey || ":").split(":");
+  const res = await fetch(baseUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Accept": "audio/mpeg",
+      "X-USER-ID": userId || "",
+      "Authorization": `Bearer ${key || apiKey}`,
+    },
+    body: JSON.stringify({
+      text,
+      voice: voiceId || "s3://voice-cloning-zero-shot/d9ff78ba-d016-47f6-b0ef-dd630f59414e/female-cs/manifest.json",
+      voice_engine: modelId || "PlayDialog",
+      output_format: "mp3",
+      speed: 1,
+    }),
+  });
+  if (!res.ok) await throwUpstreamError(res);
+  return responseToBase64(res, "mp3");
+}
+
+// Coqui (local, noAuth): POST { text, speaker_id } → WAV
+async function ttsCoqui({ baseUrl, text, voiceId }) {
+  const res = await fetch(baseUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ text, ...(voiceId ? { speaker_id: voiceId } : {}) }),
+  });
+  if (!res.ok) await throwUpstreamError(res);
+  return responseToBase64(res, "wav");
+}
+
+// Tortoise (local, noAuth): POST { text, voice } → binary
+async function ttsTortoise({ baseUrl, text, voiceId }) {
+  const res = await fetch(baseUrl, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ text, voice: voiceId || "random" }),
+  });
+  if (!res.ok) await throwUpstreamError(res);
+  return responseToBase64(res, "wav");
+}
+
+// OpenAI-compatible (qwen3-tts, openai-compat): POST { model, input, voice } → binary
+async function ttsOpenAiCompat({ baseUrl, apiKey, text, modelId, voiceId }) {
+  const headers = { "Content-Type": "application/json" };
+  if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
+  const res = await fetch(baseUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({
+      model: modelId,
+      input: text,
+      voice: voiceId || "alloy",
+      response_format: "mp3",
+      speed: 1.0,
+    }),
+  });
+  if (!res.ok) await throwUpstreamError(res);
+  return responseToBase64(res, "mp3");
+}
+
+// Format → handler dispatcher (DRY)
+const FORMAT_HANDLERS = {
+  hyperbolic:        ttsHyperbolic,
+  deepgram:          ttsDeepgram,
+  "nvidia-tts":      ttsNvidia,
+  "huggingface-tts": ttsHuggingFace,
+  inworld:           ttsInworld,
+  cartesia:          ttsCartesia,
+  playht:            ttsPlayHt,
+  coqui:             ttsCoqui,
+  tortoise:          ttsTortoise,
+  openai:            ttsOpenAiCompat,
+};
+
+// ── TTS Provider Registry (legacy noAuth + special providers) ──────────
 const TTS_PROVIDERS = {
   "google-tts": {
     synthesize: async (text, model) => {
@@ -480,15 +682,10 @@ const TTS_PROVIDERS = {
   },
   "elevenlabs": {
     synthesize: async (text, model, credentials) => {
-      if (!credentials?.apiKey) {
-        throw new Error("ElevenLabs API key required");
-      }
-      // model format: "voice_id" or "model_id/voice_id"
+      if (!credentials?.apiKey) throw new Error("ElevenLabs API key required");
       let modelId = "eleven_flash_v2_5";
       let voiceId = model;
-      if (model && model.includes("/")) {
-        [modelId, voiceId] = model.split("/");
-      }
+      if (model && model.includes("/")) [modelId, voiceId] = model.split("/");
       const base64 = await elevenlabsTts(text, voiceId, credentials.apiKey, modelId);
       return { base64, format: "mp3" };
     },
@@ -508,15 +705,24 @@ const TTS_PROVIDERS = {
   },
 };
 
+// ── Generic dispatcher: providers with ttsConfig.format ────────────────
+// Resolves to TTS_PROVIDERS first; falls back to ttsConfig.format dispatch.
+async function synthesizeViaConfig(provider, text, model, credentials) {
+  const { AI_PROVIDERS } = await import("@/shared/constants/providers");
+  const cfg = AI_PROVIDERS[provider]?.ttsConfig;
+  if (!cfg) return null;
+  const handler = FORMAT_HANDLERS[cfg.format];
+  if (!handler) return null;
+  const apiKey = credentials?.apiKey;
+  if (cfg.authType !== "none" && !apiKey) throw new Error(`${provider} API key required`);
+  const defaultModel = cfg.models?.[0]?.id || "";
+  const { modelId, voiceId } = parseModelVoice(model, defaultModel, "", cfg.models || []);
+  return handler({ baseUrl: cfg.baseUrl, apiKey, text, modelId, voiceId });
+}
+
 // ── Core handler ───────────────────────────────────────────────
 /**
  * Synthesize text to audio.
- * @param {object} options
- * @param {string} options.provider     - "google-tts" | "edge-tts" | "local-device" | "openai"
- * @param {string} options.model        - voice/lang id
- * @param {string} options.input        - text to synthesize
- * @param {object} [options.credentials] - required for openai
- * @param {string} [options.responseFormat] - "mp3" (default) | "json" (base64)
  * @returns {Promise<{success, response, status?, error?}>}
  */
 export async function handleTtsCore({ provider, model, input, credentials, responseFormat = "mp3" }) {
@@ -525,18 +731,20 @@ export async function handleTtsCore({ provider, model, input, credentials, respo
   }
 
   const ttsProvider = TTS_PROVIDERS[provider];
-  if (!ttsProvider) {
-    return createErrorResult(HTTP_STATUS.BAD_REQUEST, `Provider '${provider}' does not support TTS via this route.`);
-  }
 
   try {
-    const result = await ttsProvider.synthesize(input.trim(), model, credentials, responseFormat);
-    
-    // OpenAI returns full response object
-    if (result.success !== undefined) return result;
-    
-    // Other providers return { base64, format }
-    return createTtsResponse(result.base64, result.format, responseFormat);
+    // Legacy/special providers (google-tts, edge-tts, local-device, elevenlabs, openai, openrouter)
+    if (ttsProvider) {
+      const result = await ttsProvider.synthesize(input.trim(), model, credentials, responseFormat);
+      if (result.success !== undefined) return result;
+      return createTtsResponse(result.base64, result.format, responseFormat);
+    }
+
+    // Generic config-driven dispatcher (hyperbolic, deepgram, nvidia, huggingface, inworld, cartesia, playht, coqui, tortoise, qwen, ...)
+    const result = await synthesizeViaConfig(provider, input.trim(), model, credentials);
+    if (result) return createTtsResponse(result.base64, result.format, responseFormat);
+
+    return createErrorResult(HTTP_STATUS.BAD_REQUEST, `Provider '${provider}' does not support TTS via this route.`);
   } catch (err) {
     return createErrorResult(HTTP_STATUS.BAD_GATEWAY, err.message || "TTS synthesis failed");
   }

package/app/open-sse/utils/reasoningContentInjector.js

@@ -0,0 +1,37 @@
+// Some thinking-mode providers (DeepSeek, Kimi, ...) require reasoning_content
+// to be echoed back on assistant messages. Clients in OpenAI format don't send it,
+// so we inject a non-empty placeholder to satisfy upstream validation.
+
+const PLACEHOLDER = " ";
+
+// Provider-level rules: keyed by executor.provider
+const PROVIDER_RULES = {
+  deepseek: { scope: "all" }
+};
+
+// Model-level rules: matched by predicate against model id
+const MODEL_RULES = [
+  { match: m => m?.startsWith?.("kimi-"), scope: "toolCalls" },
+  { match: m => m?.startsWith?.("deepseek-"), scope: "all" }
+];
+
+function shouldInject(message, scope) {
+  if (message?.role !== "assistant" || "reasoning_content" in message) return false;
+  if (scope === "toolCalls") return Array.isArray(message.tool_calls);
+  return true;
+}
+
+function applyRule(body, rule) {
+  if (!rule || !body?.messages) return body;
+  const messages = body.messages.map(m =>
+    shouldInject(m, rule.scope) ? { ...m, reasoning_content: PLACEHOLDER } : m
+  );
+  return { ...body, messages };
+}
+
+export function injectReasoningContent({ provider, model, body }) {
+  const providerRule = PROVIDER_RULES[provider];
+  const modelRule = MODEL_RULES.find(r => r.match(model));
+  const rule = providerRule || modelRule;
+  return applyRule(body, rule);
+}

package/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n9router",
-  "version": "0.4.20",
+  "version": "0.4.21",
   "description": "Self-hosted AI routing gateway — local proxy for Claude, Gemini, OpenAI and 40+ providers",
   "keywords": [
     "ai",

package/app/src/mitm/antigravityIdeVersion.js

@@ -1,28 +1,13 @@
 "use strict";
 
-const fs = require("fs");
-
-const DEFAULT_ANTIGRAVITY_IDE_VERSION = "1.23.2";
-
-function normalizeAntigravityIdeVersion(value) {
-  const trimmed = typeof value === "string" ? value.trim() : "";
-  return trimmed || DEFAULT_ANTIGRAVITY_IDE_VERSION;
-}
+const {
+  DEFAULT_ANTIGRAVITY_IDE_VERSION,
+  getAntigravityIdeVersionSettings,
+  normalizeAntigravityIdeVersion,
+} = require("./mitmSettings");
 
 function loadAntigravityIdeVersionSettings(dbFile) {
-  try {
-    const db = JSON.parse(fs.readFileSync(dbFile, "utf-8"));
-    const settings = db?.settings || {};
-    return {
-      enabled: settings.mitmAntigravityIdeVersionOverrideEnabled === true,
-      version: normalizeAntigravityIdeVersion(settings.mitmAntigravityIdeVersion),
-    };
-  } catch {
-    return {
-      enabled: false,
-      version: DEFAULT_ANTIGRAVITY_IDE_VERSION,
-    };
-  }
+  return getAntigravityIdeVersionSettings(dbFile);
 }
 
 function shouldRewriteMetadata(metadata) {
@@ -56,7 +41,7 @@ function applyAntigravityIdeVersionOverride(bodyBuffer, headers, dbFile, log = (
     const parsed = JSON.parse(bodyBuffer.toString());
     if (!shouldRewriteMetadata(parsed?.metadata)) {
       if (userAgentChanged) {
-        log(`🛰️ [token-swap] Antigravity user-agent version override → ${settings.version}`);
+        log(`🛰️ [antigravity] user-agent version override → ${settings.version}`);
       }
       return { bodyBuffer, headers: nextHeaders, applied: userAgentChanged, version: settings.version };
     }
@@ -65,7 +50,7 @@ function applyAntigravityIdeVersionOverride(bodyBuffer, headers, dbFile, log = (
     parsed.metadata.ideVersion = settings.version;
 
     const nextBodyBuffer = Buffer.from(JSON.stringify(parsed));
-    log(`🛰️ [token-swap] Antigravity IDE version override: ${previousVersion || "unknown"} → ${settings.version}`);
+    log(`🛰️ [antigravity] IDE version override: ${previousVersion || "unknown"} → ${settings.version}`);
     return {
       bodyBuffer: nextBodyBuffer,
       headers: nextHeaders,
@@ -74,10 +59,10 @@ function applyAntigravityIdeVersionOverride(bodyBuffer, headers, dbFile, log = (
     };
   } catch (e) {
     if (userAgentChanged) {
-      log(`🛰️ [token-swap] Antigravity user-agent version override → ${settings.version}`);
+      log(`🛰️ [antigravity] user-agent version override → ${settings.version}`);
       return { bodyBuffer, headers: nextHeaders, applied: true, version: settings.version };
     }
-    log(`🛰️ [token-swap] Antigravity IDE version override skipped: ${e.message}`);
+    log(`🛰️ [antigravity] IDE version override skipped: ${e.message}`);
     return { bodyBuffer, headers: nextHeaders, applied: false, version: settings.version };
   }
 }

package/app/src/mitm/cert/install.js

@@ -2,11 +2,13 @@ const fs = require("fs");
 const crypto = require("crypto");
 const { exec, execFileSync } = require("child_process");
 const { execWithPassword, isSudoAvailable } = require("../dns/dnsConfig.js");
+const { runElevatedPowerShell, quotePs } = require("../winElevated.js");
 const { log, err } = require("../logger");
 
 const IS_WIN = process.platform === "win32";
 const IS_MAC = process.platform === "darwin";
 const LINUX_CERT_DIR = "/usr/local/share/ca-certificates";
+const ROOT_CA_CN = "9Router MITM Root CA";
 
 /** macOS Keychain CLI — always use absolute path (sudo/sh often has a minimal PATH). */
 const SECURITY = "/usr/bin/security";
@@ -86,20 +88,18 @@ function checkCertInstalledMac(certPath) {
 function checkCertInstalledWindows(certPath) {
   const cu = certutilExecutable();
   return new Promise((resolve) => {
-    // Consider trusted if installed in LocalMachine OR CurrentUser Root store.
-    exec(`${cu} -store Root "9Router MITM Root CA"`, { windowsHide: true }, (machineError) => {
+    // Check by SHA1 fingerprint — detects stale cert with same CN but different key.
+    // Also handle WSL where Node runs on Linux but browsers use Windows store.
+    let fingerprint;
+    try {
+      fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
+    } catch {
+      return resolve(false);
+    }
+    exec(`${cu} -store Root ${fingerprint}`, { windowsHide: true }, (machineError) => {
       if (!machineError) return resolve(true);
-      exec(`${cu} -user -store Root "9Router MITM Root CA"`, { windowsHide: true }, (userError) => {
-        if (!userError) return resolve(true);
-        const ps = [
-          "$m = Get-ChildItem -Path Cert:\\LocalMachine\\Root -ErrorAction SilentlyContinue | Where-Object { $_.Subject -like '*CN=9Router MITM Root CA*' } | Select-Object -First 1",
-          "$u = Get-ChildItem -Path Cert:\\CurrentUser\\Root -ErrorAction SilentlyContinue | Where-Object { $_.Subject -like '*CN=9Router MITM Root CA*' } | Select-Object -First 1",
-          "if ($m -or $u) { exit 0 } else { exit 1 }",
-        ].join("; ");
-        const psExe = isWSL() ? "/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe" : "powershell";
-        exec(`${psExe} -NoProfile -NonInteractive -Command "${ps}"`, { windowsHide: true }, (psError) => {
-          resolve(!psError);
-        });
+      exec(`${cu} -user -store Root ${fingerprint}`, { windowsHide: true }, (userError) => {
+        resolve(!userError);
       });
     });
   });
@@ -150,10 +150,27 @@ async function installCertMac(sudoPassword, certPath) {
 }
 
 async function installCertWindows(certPath) {
+  // On native Windows: auto-elevate via UAC popup (single popup, no admin probe).
+  if (IS_WIN) {
+    const script = `
+      certutil -delstore Root ${quotePs(ROOT_CA_CN)} 2>$null | Out-Null
+      $exit = & certutil -addstore Root ${quotePs(certPath)} 2>&1
+      if ($LASTEXITCODE -ne 0) { throw "certutil exit $LASTEXITCODE" }
+    `;
+    try {
+      await runElevatedPowerShell(script);
+      log("🔐 Cert: ✅ installed to Windows Root store");
+    } catch (e) {
+      throw new Error(`Failed to install certificate: ${e.message}`);
+    }
+    return;
+  }
+
+  // WSL fallback: Node runs on Linux, no UAC available. Use certutil.exe directly
+  // and fall back from LocalMachine to CurrentUser Root store.
   const cu = certutilExecutable();
   const winPath = pathForWindowsCertutil(certPath);
-  const psExe = isWSL() ? "/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe" : "powershell";
-  // Prefer LocalMachine Root (admin). Fallback to CurrentUser Root for non-admin sessions.
+  const psExe = "/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe";
   return new Promise((resolve, reject) => {
     exec(`${cu} -addstore Root "${winPath}"`, { windowsHide: true }, (machineError, _out, machineStderr) => {
       if (!machineError) {
@@ -210,12 +227,24 @@ async function uninstallCertMac(sudoPassword, certPath) {
 }
 
 async function uninstallCertWindows() {
+  // On native Windows: auto-elevate via UAC popup
+  if (IS_WIN) {
+    const script = `certutil -delstore Root ${quotePs(ROOT_CA_CN)}`;
+    try {
+      await runElevatedPowerShell(script);
+      log("🔐 Cert: ✅ uninstalled from Windows Root store");
+    } catch (e) {
+      throw new Error(`Failed to uninstall certificate: ${e.message}`);
+    }
+    return;
+  }
+
+  // WSL fallback: remove from both machine and user stores; "not found" is treated as success.
   const cu = certutilExecutable();
-  const psExe = isWSL() ? "/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe" : "powershell";
-  // Remove from both machine and user stores; "not found" is treated as success.
+  const psExe = "/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe";
   return new Promise((resolve, reject) => {
-    exec(`${cu} -delstore Root "9Router MITM Root CA"`, { windowsHide: true }, () => {
-      exec(`${cu} -user -delstore Root "9Router MITM Root CA"`, { windowsHide: true }, () => {
+    exec(`${cu} -delstore Root "${ROOT_CA_CN}"`, { windowsHide: true }, () => {
+      exec(`${cu} -user -delstore Root "${ROOT_CA_CN}"`, { windowsHide: true }, () => {
         const ps = [
           "$m = Get-ChildItem -Path Cert:\\LocalMachine\\Root -ErrorAction SilentlyContinue | Where-Object { $_.Subject -like '*CN=9Router MITM Root CA*' }",
           "$u = Get-ChildItem -Path Cert:\\CurrentUser\\Root -ErrorAction SilentlyContinue | Where-Object { $_.Subject -like '*CN=9Router MITM Root CA*' }",

package/app/src/mitm/config.js

@@ -9,12 +9,26 @@ const TARGET_HOSTS = [
 ];
 
 const URL_PATTERNS = {
-  antigravity: ["/v1internal:loadCodeAssist", ":generateContent", ":streamGenerateContent"],
+  antigravity: [":generateContent", ":streamGenerateContent"],
   copilot: ["/chat/completions", "/v1/messages", "/responses"],
   kiro: ["/generateAssistantResponse"],
   cursor: ["/BidiAppend", "/RunSSE", "/RunPoll", "/Run"],
 };
 
+// Synonym map: rawModel from request → canonical alias key in mitmAlias DB
+const MODEL_SYNONYMS = {
+  antigravity: { "gemini-default": "gemini-3-flash" },
+};
+
+// URL substrings whose request/response should NOT be dumped to file (telemetry, polling, empty)
+const LOG_BLACKLIST_URL_PARTS = [
+  "recordCodeAssistMetrics",
+  "recordTrajectoryAnalytics",
+  "fetchAdminControls",
+  "listExperiments",
+  "fetchUserInfo",
+];
+
 function getToolForHost(host) {
   const h = (host || "").split(":")[0];
   if (h === "api.individual.githubcopilot.com") return "copilot";
@@ -24,4 +38,4 @@ function getToolForHost(host) {
   return null;
 }
 
-module.exports = { TARGET_HOSTS, URL_PATTERNS, getToolForHost };
+module.exports = { TARGET_HOSTS, URL_PATTERNS, MODEL_SYNONYMS, LOG_BLACKLIST_URL_PARTS, getToolForHost };