polaris-vpn 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-06-28
+
+### Added
+- Companion `polaris-server` dynamic HTTP/TLS forwarding proxy on port 8443.
+- local DNS-over-HTTPS (DoH) resolver command namespace (`polaris dns start/stop/status`) on port 5354.
+- TLS tunnel client option (`polaris start --mode tls`).
+- Auto-reconnect with exponential backoff & keepalive monitoring.
+- Desktop alerts/notifications via `node-notifier`.
+- Refactored codebase to highly modular MVC structure with centralized configurations and daemon manager.
+- Static runner scripts to ensure full compatibility with global NPM installation permissions.
+
 ## [0.1.0] - 2026-06-27
 
 ### Added

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "polaris-vpn",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Your True North in Digital Privacy. A self-hosted VPN CLI.",
   "type": "module",
   "bin": {
-    "polaris": "src/cli.js"
+    "polaris": "src/cli.js",
+    "polaris-server": "src/server/server.js"
   },
   "files": [
     "src",
@@ -35,7 +36,9 @@
     "cli-table3": "^0.6.5",
     "commander": "^15.0.0",
     "conf": "^15.1.0",
+    "dns2": "^3.0.0",
     "node-fetch": "^3.3.2",
+    "node-notifier": "^10.0.1",
     "ora": "^9.4.1",
     "socks-proxy-agent": "^10.1.0"
   }

package/src/cli.js

@@ -3,7 +3,7 @@ import { Command } from 'commander';
 import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import path from 'path';
-import { printBanner, printError } from './ui/display.js';
+import { printBanner, printError } from './utils/display.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -22,9 +22,10 @@ const willPrintJson = () => process.argv.includes('--json');
 
 program
   .command('start')
-  .description('Start the encrypted SSH tunnel')
-  .option('-s, --server <user@host>', 'SSH server to connect to')
+  .description('Start the encrypted SSH or TLS tunnel')
+  .option('-s, --server <user@host>', 'SSH/TLS server to connect to')
   .option('-p, --port <number>', 'Local SOCKS5 port to bind', '1080')
+  .option('-m, --mode <type>', 'Tunnel mode: ssh, tls or auto', 'auto')
   .action(async (options, cmd) => {
     if (!cmd.optsWithGlobals().json) printBanner();
     try {
@@ -121,6 +122,52 @@ program
     }
   });
 
+const dnsCmd = program.command('dns').description('Manage local DNS-over-HTTPS resolver');
+
+dnsCmd
+  .command('start')
+  .description('Start the local DoH resolver')
+  .option('-p, --port <number>', 'Local port to bind', '5354')
+  .option('-u, --upstream <provider>', 'Upstream DoH provider (cloudflare, google, or custom URL)', 'cloudflare')
+  .action(async (options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const { dnsStart } = await import('./commands/dns.js');
+      await dnsStart(cmd.optsWithGlobals());
+    } catch (err) {
+      if (!cmd.optsWithGlobals().json) printError('Command failed', err);
+      process.exit(1);
+    }
+  });
+
+dnsCmd
+  .command('stop')
+  .description('Stop the local DoH resolver')
+  .action(async (options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const { dnsStop } = await import('./commands/dns.js');
+      await dnsStop(cmd.optsWithGlobals());
+    } catch (err) {
+      if (!cmd.optsWithGlobals().json) printError('Command failed', err);
+      process.exit(1);
+    }
+  });
+
+dnsCmd
+  .command('status')
+  .description('Show local DoH resolver status')
+  .action(async (options, cmd) => {
+    if (!cmd.optsWithGlobals().json) printBanner();
+    try {
+      const { dnsStatus } = await import('./commands/dns.js');
+      await dnsStatus(cmd.optsWithGlobals());
+    } catch (err) {
+      if (!cmd.optsWithGlobals().json) printError('Command failed', err);
+      process.exit(1);
+    }
+  });
+
 program.parseAsync(process.argv).catch(err => {
   if (!willPrintJson()) printError('Fatal error', err);
   process.exit(1);

package/src/commands/check.js

@@ -1,11 +1,13 @@
 import chalk from 'chalk';
-import { getTunnelInfo } from '../tunnel/ssh.js';
-import { getPublicIp, getProxiedIp, checkDns, checkIpv6Leak } from '../net/ip.js';
-import { createTable, createSpinner, printError } from '../ui/display.js';
+import { getActiveTunnel } from '../core/tunnel-service.js';
+import { getDnsStatus } from '../core/dns-service.js';
+import { getPublicIp, getProxiedIp, checkDns, checkIpv6Leak } from '../net/ip-check.js';
+import { createTable, createSpinner, printError } from '../utils/display.js';
 
 export default async (options) => {
   const isJson = options.json;
-  const info = getTunnelInfo();
+  const info = getActiveTunnel();
+  const dnsStatus = getDnsStatus();
   
   if (!isJson) {
     console.log(chalk.cyan.bold('\nRunning Privacy Check...\n'));
@@ -22,7 +24,7 @@ export default async (options) => {
       try {
         const tunnelIp = await getProxiedIp(info.port);
         results.ip = true;
-        details.ip = `Tunnel active: ${tunnelIp}`;
+        details.ip = `Tunnel active (${(info.mode || 'ssh').toUpperCase()}): ${tunnelIp}`;
       } catch (e) {
         results.ip = false;
         details.ip = `Tunnel process running but proxy failed: ${e.message}`;
@@ -40,15 +42,14 @@ export default async (options) => {
       results.dns = false;
       details.dns = 'DNS resolution failed';
     } else {
-      // In a real full VPN this would check if it's our VPN's DNS.
-      // Since this is just a SOCKS5 proxy, system DNS is usually used.
-      // We flag it as warning/fail if it's likely an ISP DNS, but for MVP
-      // we'll just check if we can resolve and list the servers used.
-      const servers = dnsResult.servers.join(', ');
-      // SOCKS5 doesn't automatically tunnel DNS for all OS commands, 
-      // but browsers can be configured to use SOCKS5 for DNS.
-      results.dns = true; 
-      details.dns = `Using system DNS: ${servers}`;
+      if (dnsStatus) {
+        results.dns = true;
+        details.dns = `DoH Resolver Active: 127.0.0.1:${dnsStatus.port} (Upstream: ${dnsStatus.upstream})`;
+      } else {
+        const servers = dnsResult.servers.join(', ');
+        results.dns = false; 
+        details.dns = `Using system/ISP DNS: ${servers} (Potential DNS Leak)`;
+      }
     }
 
     // 3. IPv6 Leak Check
@@ -65,7 +66,12 @@ export default async (options) => {
     if (spinner) spinner.stop();
 
     if (isJson) {
-      console.log(JSON.stringify({ results, details }));
+      console.log(JSON.stringify({
+        results,
+        details,
+        tunnelMode: info ? (info.mode || 'ssh') : 'none',
+        dnsResolver: dnsStatus ? 'doh' : 'system'
+      }));
     } else {
       const table = createTable(['Check', 'Status', 'Details']);
       
@@ -73,9 +79,9 @@ export default async (options) => {
       
       table.push(
         ['IP Address', formatResult(results.ip), details.ip],
-        // If dns is "pass" but we know it's a SOCKS proxy, it's actually a warning that DNS isn't tunneled OS-wide
-        ['DNS Leak', results.dns ? chalk.yellow('⚠ WARN') : formatResult(results.dns), details.dns],
-        ['IPv6 Leak', formatResult(results.ipv6), details.ipv6]
+        ['DNS Leak', dnsStatus ? chalk.green('✓ PASS') : chalk.yellow('⚠ WARN'), details.dns],
+        ['IPv6 Leak', formatResult(results.ipv6), details.ipv6],
+        ['WebRTC Leak', chalk.cyan('ⓘ INFO'), 'WebRTC can bypass proxies. Check browserleaks.com/webrtc']
       );
       
       console.log(table.toString());
@@ -85,7 +91,9 @@ export default async (options) => {
         console.log(chalk.yellow('Note: Your traffic is currently exposed. Run "polaris start" to connect.'));
       } else {
         console.log(chalk.cyan('Note: SOCKS5 proxies only tunnel apps configured to use them (like your browser).'));
-        console.log(chalk.cyan('      System-wide DNS leaks are expected until v0.5 (WireGuard).'));
+        if (!dnsStatus) {
+          console.log(chalk.yellow('      Run "polaris dns start" to prevent DNS queries from leaking to your ISP.'));
+        }
       }
       console.log();
     }

package/src/commands/dns.js

@@ -0,0 +1,85 @@
+import chalk from 'chalk';
+import { printError, printSuccess, printInfo, printWarning } from '../utils/display.js';
+import { startDnsResolver, stopDnsResolver, getDnsStatus } from '../core/dns-service.js';
+
+export const dnsStart = async (options) => {
+  const port = parseInt(options.port || '5354', 10);
+  const upstreamMap = {
+    'cloudflare': 'https://cloudflare-dns.com/dns-query',
+    'google': 'https://dns.google/resolve'
+  };
+  
+  const provider = options.upstream || 'cloudflare';
+  const upstream = upstreamMap[provider.toLowerCase()] || provider;
+  const isJson = options.json;
+
+  try {
+    const res = startDnsResolver(port, upstream);
+    if (isJson) {
+      console.log(JSON.stringify({ success: true, ...res }));
+    } else {
+      printSuccess(`DNS-over-HTTPS resolver started on 127.0.0.1:${port}`);
+      printInfo(`Forwarding to: ${upstream}`);
+    }
+  } catch (err) {
+    if (isJson) {
+      console.log(JSON.stringify({ error: err.message }));
+    } else {
+      printError('Failed to start DNS resolver', err);
+    }
+    process.exitCode = 1;
+  }
+};
+
+export const dnsStop = async (options) => {
+  const isJson = options.json;
+
+  try {
+    const res = stopDnsResolver();
+    if (!res) {
+      if (isJson) {
+        console.log(JSON.stringify({ error: 'DNS resolver is not running' }));
+      } else {
+        printWarning('DNS resolver is not running.');
+      }
+      return;
+    }
+    
+    if (isJson) {
+      console.log(JSON.stringify({ success: true }));
+    } else {
+      printSuccess('DNS-over-HTTPS resolver stopped.');
+    }
+  } catch (err) {
+    if (isJson) {
+      console.log(JSON.stringify({ error: err.message }));
+    } else {
+      printError('Failed to stop DNS resolver', err);
+    }
+    process.exitCode = 1;
+  }
+};
+
+export const dnsStatus = async (options) => {
+  const isJson = options.json;
+  const status = getDnsStatus();
+
+  if (!status) {
+    if (isJson) {
+      console.log(JSON.stringify({ running: false }));
+    } else {
+      console.log(`${chalk.red('✗')} DNS Resolver: ${chalk.red('Stopped')}`);
+    }
+    return;
+  }
+
+  if (isJson) {
+    console.log(JSON.stringify({ running: true, ...status }));
+  } else {
+    console.log(`${chalk.green('✓')} DNS Resolver: ${chalk.green('Running')}`);
+    console.log(`  ${chalk.dim('PID     :')} ${status.pid}`);
+    console.log(`  ${chalk.dim('Port    :')} ${status.port}`);
+    console.log(`  ${chalk.dim('Upstream:')} ${status.upstream}`);
+    console.log(`  ${chalk.dim('Uptime  :')} ${Math.floor((Date.now() - new Date(status.startTime)) / 1000)}s`);
+  }
+};

package/src/commands/servers.js

@@ -1,8 +1,6 @@
-import Conf from 'conf';
-import { printSuccess, printError, printInfo, createTable } from '../ui/display.js';
 import chalk from 'chalk';
-
-const config = new Conf({ projectName: 'polaris' });
+import { printSuccess, printError, printInfo, createTable } from '../utils/display.js';
+import { addProfile, getProfiles, setActiveProfile } from '../core/profile-service.js';
 
 export const addServer = async (alias, options) => {
   const isJson = options.json;
@@ -18,31 +16,30 @@ export const addServer = async (alias, options) => {
     return;
   }
   
-  const profiles = config.get('servers', {});
-  profiles[alias] = server;
-  config.set('servers', profiles);
-  
-  // Auto-set as active if it's the first one
-  if (!config.get('activeServer')) {
-    config.set('activeServer', alias);
-  }
-  
-  if (isJson) {
-    console.log(JSON.stringify({ success: true, alias, server }));
-  } else {
-    printSuccess(`Saved profile '${alias}' -> ${server}`);
+  try {
+    const res = addProfile(alias, server);
+    if (isJson) {
+      console.log(JSON.stringify({ success: true, ...res }));
+    } else {
+      printSuccess(`Saved profile '${alias}' -> ${server}`);
+    }
+  } catch (err) {
+    if (isJson) {
+      console.log(JSON.stringify({ error: err.message }));
+    } else {
+      printError('Failed to add profile', err);
+    }
+    process.exitCode = 1;
   }
 };
 
 export const listServers = async (options) => {
   const isJson = options.json;
-  const profiles = config.get('servers', {});
-  const activeAlias = config.get('activeServer');
-  
+  const { profiles, active } = getProfiles();
   const aliases = Object.keys(profiles);
   
   if (isJson) {
-    console.log(JSON.stringify({ servers: profiles, active: activeAlias }));
+    console.log(JSON.stringify({ servers: profiles, active }));
     return;
   }
   
@@ -54,7 +51,7 @@ export const listServers = async (options) => {
   const table = createTable(['Alias', 'Server', 'Active']);
   
   for (const alias of aliases) {
-    const isActive = alias === activeAlias;
+    const isActive = alias === active;
     table.push([
       isActive ? chalk.green.bold(alias) : alias,
       profiles[alias],
@@ -67,23 +64,20 @@ export const listServers = async (options) => {
 
 export const useServer = async (alias, options) => {
   const isJson = options.json;
-  const profiles = config.get('servers', {});
   
-  if (!profiles[alias]) {
+  try {
+    const res = setActiveProfile(alias);
+    if (isJson) {
+      console.log(JSON.stringify({ success: true, active: alias, server: res.server }));
+    } else {
+      printSuccess(`Set '${alias}' as the active profile.`);
+    }
+  } catch (err) {
     if (isJson) {
-      console.log(JSON.stringify({ error: `Profile '${alias}' not found` }));
+      console.log(JSON.stringify({ error: err.message }));
     } else {
-      printError(`Profile '${alias}' not found. Run "polaris list" to see saved profiles.`);
+      printError(err.message);
     }
     process.exitCode = 1;
-    return;
-  }
-  
-  config.set('activeServer', alias);
-  
-  if (isJson) {
-    console.log(JSON.stringify({ success: true, active: alias, server: profiles[alias] }));
-  } else {
-    printSuccess(`Set '${alias}' as the active profile.`);
   }
 };

package/src/commands/start.js

@@ -1,22 +1,43 @@
 import chalk from 'chalk';
-import Conf from 'conf';
-import { printError, printSuccess, printInfo, createSpinner, printWarning } from '../ui/display.js';
-import { getPublicIp, getProxiedIp } from '../net/ip.js';
-import { spawnSSH, waitForSocks, saveTunnelInfo, getTunnelInfo } from '../tunnel/ssh.js';
+import tls from 'tls';
+import { printError, printSuccess, createSpinner } from '../utils/display.js';
+import { getPublicIp, getProxiedIp } from '../net/ip-check.js';
+import { getProfiles } from '../core/profile-service.js';
+import { getActiveTunnel, startTunnel } from '../core/tunnel-service.js';
 
-const config = new Conf({ projectName: 'polaris' });
+const detectTlsServer = (host, port = 8443) => {
+  return new Promise((resolve) => {
+    const socket = tls.connect({
+      host,
+      port,
+      rejectUnauthorized: false,
+      timeout: 3000
+    }, () => {
+      socket.destroy();
+      resolve(true);
+    });
+    
+    socket.on('error', () => {
+      resolve(false);
+    });
+    
+    socket.on('timeout', () => {
+      socket.destroy();
+      resolve(false);
+    });
+  });
+};
 
 export default async (options) => {
   const isJson = options.json;
   let server = options.server;
   const port = parseInt(options.port || '1080', 10);
+  const requestedMode = options.mode || 'auto';
 
   if (!server) {
-    // Try to load default from profile if not provided
-    const profiles = config.get('servers', {});
-    const activeAlias = config.get('activeServer');
-    if (activeAlias && profiles[activeAlias]) {
-      server = profiles[activeAlias];
+    const { profiles, active } = getProfiles();
+    if (active && profiles[active]) {
+      server = profiles[active];
     } else {
       if (isJson) {
         console.log(JSON.stringify({ error: 'No server specified' }));
@@ -29,7 +50,7 @@ export default async (options) => {
   }
 
   // Check if already running
-  const info = getTunnelInfo();
+  const info = getActiveTunnel();
   if (info) {
     if (isJson) {
       console.log(JSON.stringify({ error: 'Tunnel already running', pid: info.pid }));
@@ -47,18 +68,33 @@ export default async (options) => {
     oldIp = await getPublicIp();
     if (!isJson) {
       spinner.succeed(`Current IP: ${chalk.cyan(oldIp)}`);
-      spinner.text = 'Starting SSH SOCKS5 tunnel...';
-      spinner.start();
     }
-    
-    const pid = spawnSSH(server, port);
-    saveTunnelInfo(pid, server, port);
-    
+
+    const hostPart = server.includes('@') ? server.split('@')[1] : server;
+    let actualMode = requestedMode;
+
+    if (requestedMode === 'auto') {
+      if (!isJson) {
+        spinner.text = 'Checking server for TLS support...';
+        spinner.start();
+      }
+      const hasTls = await detectTlsServer(hostPart, 8443);
+      if (hasTls) {
+        actualMode = 'tls';
+      } else {
+        actualMode = 'ssh';
+        if (!isJson) {
+          spinner.info('TLS server not detected. Falling back to SSH mode...');
+        }
+      }
+    }
+
     if (!isJson) {
-      spinner.text = 'Waiting for proxy to become ready...';
+      spinner.text = `Starting ${actualMode.toUpperCase()} tunnel...`;
+      spinner.start();
     }
-    
-    await waitForSocks(port);
+
+    const res = await startTunnel(server, port, actualMode);
     
     if (!isJson) {
       spinner.text = 'Verifying IP through proxy...';
@@ -68,7 +104,7 @@ export default async (options) => {
     
     if (!isJson) {
       spinner.stop();
-      printSuccess(`Tunnel established successfully to ${server}`);
+      printSuccess(`Tunnel established successfully to ${server} (${actualMode.toUpperCase()} mode)`);
       console.log(`\n  ${chalk.dim('Old IP:')} ${chalk.red(oldIp)}`);
       console.log(`  ${chalk.dim('New IP:')} ${chalk.green(newIp)}`);
       console.log(`  ${chalk.dim('Proxy :')} ${chalk.cyan(`socks5://127.0.0.1:${port}`)}`);
@@ -76,7 +112,7 @@ export default async (options) => {
       console.log(chalk.dim('\nTunnel is running in the background. Leave this terminal or close it, it will stay alive.'));
       console.log(chalk.dim('Run "polaris status" to check, or "polaris stop" to end.'));
     } else {
-      console.log(JSON.stringify({ success: true, oldIp, newIp, proxy: `socks5://127.0.0.1:${port}`, pid }));
+      console.log(JSON.stringify({ success: true, oldIp, newIp, proxy: `socks5://127.0.0.1:${port}`, pid: res.pid, mode: actualMode }));
     }
 
   } catch (err) {

package/src/commands/status.js

@@ -1,11 +1,11 @@
-import { getTunnelInfo } from '../tunnel/ssh.js';
-import { getProxiedIp, getPublicIp } from '../net/ip.js';
-import { createTable, createSpinner, printError } from '../ui/display.js';
+import { getActiveTunnel } from '../core/tunnel-service.js';
+import { getProxiedIp } from '../net/ip-check.js';
+import { createTable, createSpinner, printError } from '../utils/display.js';
 import chalk from 'chalk';
 
 export default async (options) => {
   const isJson = options.json;
-  const info = getTunnelInfo();
+  const info = getActiveTunnel();
   
   if (!info) {
     if (isJson) {
@@ -30,6 +30,7 @@ export default async (options) => {
         server: info.server,
         port: info.port,
         pid: info.pid,
+        mode: info.mode || 'ssh',
         ip: currentIp,
         uptimeMs
       }));
@@ -41,6 +42,7 @@ export default async (options) => {
       
       table.push(
         ['Status', chalk.green('Connected')],
+        ['Mode', (info.mode || 'ssh').toUpperCase()],
         ['Server', info.server],
         ['Proxy', `socks5://127.0.0.1:${info.port}`],
         ['Current IP', chalk.cyan(currentIp)],

package/src/commands/stop.js

@@ -1,21 +1,20 @@
-import { stopTunnel, getTunnelInfo } from '../tunnel/ssh.js';
-import { printSuccess, printInfo, printError } from '../ui/display.js';
+import { stopActiveTunnel } from '../core/tunnel-service.js';
+import { printSuccess, printInfo, printError } from '../utils/display.js';
 
 export default async (options) => {
   const isJson = options.json;
-  const info = getTunnelInfo();
-  
-  if (!info) {
-    if (isJson) {
-      console.log(JSON.stringify({ success: true, message: 'No active tunnel found.' }));
-    } else {
-      printInfo('No active tunnel found.');
-    }
-    return;
-  }
   
   try {
-    stopTunnel();
+    const info = stopActiveTunnel();
+    if (!info) {
+      if (isJson) {
+        console.log(JSON.stringify({ success: true, message: 'No active tunnel found.' }));
+      } else {
+        printInfo('No active tunnel found.');
+      }
+      return;
+    }
+    
     if (isJson) {
       console.log(JSON.stringify({ success: true, message: 'Tunnel stopped successfully.' }));
     } else {

package/src/core/dns-service.js

@@ -0,0 +1,46 @@
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { spawnDaemon, loadDaemonState, clearDaemonState, killPid, saveDaemonState } from '../utils/daemon.js';
+import { DNS_PID_FILE, DNS_CONFIG_FILE, ensureDir } from '../utils/config.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+export const getDnsStatus = () => {
+  return loadDaemonState(DNS_PID_FILE, DNS_CONFIG_FILE);
+};
+
+export const startDnsResolver = (port = 5354, upstream = 'https://cloudflare-dns.com/dns-query') => {
+  const active = getDnsStatus();
+  if (active) {
+    throw new Error(`DNS resolver is already running (PID: ${active.pid})`);
+  }
+
+  ensureDir();
+  
+  // Point to static runner relative to this file
+  const serverScript = path.resolve(__dirname, '..', 'net', 'dns-runner.js');
+
+  const pid = spawnDaemon(serverScript, [], {
+    POLARIS_DNS_PORT: String(port),
+    POLARIS_DNS_UPSTREAM: upstream
+  });
+
+  saveDaemonState(DNS_PID_FILE, DNS_CONFIG_FILE, {
+    pid,
+    port,
+    upstream,
+    startTime: new Date().toISOString()
+  });
+
+  return { pid, port, upstream };
+};
+
+export const stopDnsResolver = () => {
+  const active = getDnsStatus();
+  if (active) {
+    killPid(active.pid);
+  }
+  clearDaemonState(DNS_PID_FILE, DNS_CONFIG_FILE);
+  return active;
+};

package/src/core/profile-service.js

@@ -0,0 +1,30 @@
+import { store } from '../utils/config.js';
+
+export const addProfile = (alias, server) => {
+  if (!server) {
+    throw new Error('Server address is required');
+  }
+  const profiles = store.get('servers', {});
+  profiles[alias] = server;
+  store.set('servers', profiles);
+  
+  if (!store.get('activeServer')) {
+    store.set('activeServer', alias);
+  }
+  return { alias, server };
+};
+
+export const getProfiles = () => {
+  const profiles = store.get('servers', {});
+  const active = store.get('activeServer');
+  return { profiles, active };
+};
+
+export const setActiveProfile = (alias) => {
+  const profiles = store.get('servers', {});
+  if (!profiles[alias]) {
+    throw new Error(`Profile '${alias}' not found`);
+  }
+  store.set('activeServer', alias);
+  return { alias, server: profiles[alias] };
+};

package/src/core/tunnel-service.js

@@ -0,0 +1,39 @@
+import { spawnSSH, waitForSocks } from '../tunnel/ssh.js';
+import { startTlsBackground } from '../tunnel/tls.js';
+import { loadDaemonState, clearDaemonState, killPid, saveDaemonState } from '../utils/daemon.js';
+import { TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE, ensureDir } from '../utils/config.js';
+
+export const getActiveTunnel = () => {
+  return loadDaemonState(TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE);
+};
+
+export const stopActiveTunnel = () => {
+  const info = getActiveTunnel();
+  if (info) {
+    killPid(info.pid);
+  }
+  clearDaemonState(TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE);
+  return info;
+};
+
+export const startTunnel = async (server, port, mode = 'ssh') => {
+  const hostPart = server.includes('@') ? server.split('@')[1] : server;
+  ensureDir();
+
+  let pid;
+  if (mode === 'tls') {
+    pid = startTlsBackground(port, hostPart, 8443);
+  } else {
+    pid = spawnSSH(server, port);
+    saveDaemonState(TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE, {
+      pid,
+      server,
+      port,
+      mode: 'ssh',
+      startTime: new Date().toISOString()
+    });
+  }
+
+  await waitForSocks(port);
+  return { pid, server, port, mode };
+};

package/src/net/dns-resolver.js

@@ -0,0 +1,72 @@
+import dns2 from 'dns2';
+import fetch from 'node-fetch';
+
+export const resolveViaDoh = async (name, typeNum, upstreamUrl) => {
+  const typeMap = {
+    1: 'A',
+    28: 'AAAA',
+    15: 'MX',
+    16: 'TXT',
+    5: 'CNAME',
+    2: 'NS',
+    6: 'SOA',
+    12: 'PTR'
+  };
+  const typeName = typeMap[typeNum] || 'A';
+  
+  const url = `${upstreamUrl}?name=${encodeURIComponent(name)}&type=${typeName}`;
+  const response = await fetch(url, {
+    headers: { 'accept': 'application/dns-json' }
+  });
+  
+  if (!response.ok) {
+    throw new Error(`Upstream returned ${response.status}`);
+  }
+  
+  return await response.json();
+};
+
+export const startDnsServerInstance = (port = 5354, upstream = 'https://cloudflare-dns.com/dns-query') => {
+  const { Packet } = dns2;
+
+  const server = dns2.createServer({
+    udp: true,
+    handle: async (request, send) => {
+      const response = Packet.createResponseFromRequest(request);
+      
+      for (const question of request.questions) {
+        try {
+          const dohRes = await resolveViaDoh(question.name, question.type, upstream);
+          if (dohRes.Answer) {
+            for (const ans of dohRes.Answer) {
+              response.answers.push({
+                name: ans.name,
+                type: ans.type,
+                class: Packet.CLASS.IN,
+                ttl: ans.TTL || 300,
+                address: ans.data
+              });
+            }
+          }
+        } catch (err) {
+          // Ignore resolution failure on single record
+        }
+      }
+      
+      send(response);
+    }
+  });
+
+  server.listen({ udp: port }).then(() => {
+    console.log(`Polaris DNS-over-HTTPS local resolver listening on 127.0.0.1:${port}`);
+    console.log(`Using upstream: ${upstream}`);
+  }).catch((err) => {
+    console.error('DNS server failed to start:', err);
+  });
+
+  server.on('error', (err) => {
+    console.error('DNS server error:', err);
+  });
+  
+  return server;
+};

package/src/net/dns-runner.js

@@ -0,0 +1,6 @@
+import { startDnsServerInstance } from './dns-resolver.js';
+
+const port = parseInt(process.env.POLARIS_DNS_PORT || '5354', 10);
+const upstream = process.env.POLARIS_DNS_UPSTREAM || 'https://cloudflare-dns.com/dns-query';
+
+startDnsServerInstance(port, upstream);

package/src/net/{ip.js → ip-check.js}

@@ -20,7 +20,6 @@ export const getProxiedIp = async (port) => {
   return data.ip;
 };
 
-// Simple DNS leak check by resolving via system dns
 export const checkDns = async () => {
   try {
     const servers = dns.getServers();
@@ -31,7 +30,6 @@ export const checkDns = async () => {
   }
 };
 
-// Returns IPv6 address if leaked, null otherwise
 export const checkIpv6Leak = async () => {
   try {
     const controller = new AbortController();
@@ -45,6 +43,6 @@ export const checkIpv6Leak = async () => {
     }
     return null;
   } catch (err) {
-    return null; // Timeout or network error typically means IPv6 is disabled/unreachable
+    return null;
   }
 };

package/src/server/server.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+import tls from 'tls';
+import net from 'net';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { execSync } from 'child_process';
+
+const CONFIG_DIR = path.join(os.homedir(), '.config', 'polaris-server');
+const KEY_FILE = path.join(CONFIG_DIR, 'server.key');
+const CERT_FILE = path.join(CONFIG_DIR, 'server.crt');
+
+const ensureConfigDir = () => {
+  if (!fs.existsSync(CONFIG_DIR)) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+  }
+};
+
+const generateCerts = () => {
+  ensureConfigDir();
+  if (fs.existsSync(KEY_FILE) && fs.existsSync(CERT_FILE)) {
+    return;
+  }
+  console.log('Generating self-signed TLS certificates...');
+  try {
+    execSync(
+      `openssl req -x509 -newkey rsa:2048 -nodes -sha256 -keyout "${KEY_FILE}" -out "${CERT_FILE}" -days 365 -subj "/CN=polaris"`,
+      { stdio: 'ignore' }
+    );
+    console.log('Certificates generated successfully.');
+  } catch (err) {
+    console.error('Failed to generate TLS certificates using openssl CLI:', err.message);
+    process.exit(1);
+  }
+};
+
+const startServer = (port = 8443) => {
+  generateCerts();
+
+  const options = {
+    key: fs.readFileSync(KEY_FILE),
+    cert: fs.readFileSync(CERT_FILE),
+    minVersion: 'TLSv1.3'
+  };
+
+  const server = tls.createServer(options, (cleartextStream) => {
+    let buffer = '';
+    
+    const onData = (chunk) => {
+      buffer += chunk.toString('utf8');
+      const lineEnd = buffer.indexOf('\n');
+      if (lineEnd !== -1) {
+        const line = buffer.substring(0, lineEnd).trim();
+        buffer = buffer.substring(lineEnd + 1);
+        
+        cleartextStream.removeListener('data', onData);
+        
+        const match = line.match(/^CONNECT\s+(.+):(\d+)$/);
+        if (!match) {
+          cleartextStream.write('ERR Invalid command\n');
+          cleartextStream.end();
+          return;
+        }
+        
+        const host = match[1];
+        const targetPort = parseInt(match[2], 10);
+        
+        const targetSocket = net.connect(targetPort, host, () => {
+          cleartextStream.write('OK\n');
+          if (buffer.length > 0) {
+            targetSocket.write(buffer);
+          }
+          cleartextStream.pipe(targetSocket);
+          targetSocket.pipe(cleartextStream);
+        });
+        
+        targetSocket.on('error', (err) => {
+          try {
+            cleartextStream.write(`ERR ${err.message}\n`);
+            cleartextStream.end();
+          } catch (e) {}
+        });
+        
+        cleartextStream.on('error', () => {
+          targetSocket.destroy();
+        });
+      }
+    };
+    
+    cleartextStream.on('data', onData);
+  });
+
+  server.listen(port, () => {
+    console.log(`Polaris TLS Server listening on port ${port}`);
+  });
+  
+  server.on('error', (err) => {
+    console.error('Server error:', err);
+  });
+};
+
+const args = process.argv.slice(2);
+const portOptIdx = args.indexOf('--port');
+let port = 8443;
+if (portOptIdx !== -1 && args[portOptIdx + 1]) {
+  port = parseInt(args[portOptIdx + 1], 10);
+}
+
+startServer(port);

package/src/tunnel/ssh.js

@@ -1,27 +1,7 @@
 import { spawn } from 'child_process';
 import net from 'net';
-import fs from 'fs';
-import path from 'path';
-import os from 'os';
-
-const CONFIG_DIR = path.join(os.homedir(), '.config', 'polaris');
-const PID_FILE = path.join(CONFIG_DIR, 'tunnel.pid');
-const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
-
-const ensureDir = () => {
-  if (!fs.existsSync(CONFIG_DIR)) {
-    fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  }
-};
 
 export const spawnSSH = (server, port) => {
-  // We want to run SSH as a detached child process so it survives terminal close.
-  // -D port: Dynamic SOCKS5 forwarding
-  // -N: Do not execute a remote command
-  // -o StrictHostKeyChecking=no: Don't prompt for host key verification
-  // -o ServerAliveInterval=30: Keep connection alive
-  // -o ExitOnForwardFailure=yes: Exit if port forwarding fails
-  
   const args = [
     '-D', String(port),
     '-N',
@@ -33,15 +13,13 @@ export const spawnSSH = (server, port) => {
 
   const child = spawn('ssh', args, {
     detached: true,
-    stdio: 'ignore' // We don't want to capture stdio, keep it completely detached
+    stdio: 'ignore'
   });
 
-  child.unref(); // Allow the parent process to exit independently
-
+  child.unref();
   return child.pid;
 };
 
-// Poll the local port until it accepts connections
 export const waitForSocks = async (port, timeoutMs = 30000) => {
   const start = Date.now();
   
@@ -49,7 +27,6 @@ export const waitForSocks = async (port, timeoutMs = 30000) => {
     try {
       await new Promise((resolve, reject) => {
         const socket = new net.Socket();
-        
         socket.setTimeout(1000);
         
         socket.on('connect', () => {
@@ -69,66 +46,11 @@ export const waitForSocks = async (port, timeoutMs = 30000) => {
         
         socket.connect(port, '127.0.0.1');
       });
-      return true; // Connection successful
+      return true;
     } catch (err) {
-      // Wait 500ms before retrying
       await new Promise(r => setTimeout(r, 500));
     }
   }
   
   throw new Error(`Timed out waiting for SOCKS5 proxy on port ${port} to become ready`);
 };
-
-export const saveTunnelInfo = (pid, server, port) => {
-  ensureDir();
-  fs.writeFileSync(PID_FILE, String(pid), 'utf-8');
-  
-  const config = {
-    server,
-    port,
-    startTime: new Date().toISOString()
-  };
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), 'utf-8');
-};
-
-export const getTunnelInfo = () => {
-  if (!fs.existsSync(PID_FILE) || !fs.existsSync(CONFIG_FILE)) {
-    return null;
-  }
-  
-  try {
-    const pid = parseInt(fs.readFileSync(PID_FILE, 'utf-8').trim(), 10);
-    const config = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf-8'));
-    
-    // Check if process actually exists
-    try {
-      process.kill(pid, 0); // test signal 0 to check if alive
-    } catch (e) {
-      if (e.code === 'ESRCH') {
-        // Process doesn't exist, tunnel is dead, cleanup
-        clearTunnelInfo();
-        return null;
-      }
-    }
-    
-    return { pid, ...config };
-  } catch (err) {
-    return null;
-  }
-};
-
-export const stopTunnel = () => {
-  const info = getTunnelInfo();
-  if (info) {
-    try {
-      process.kill(info.pid, 'SIGTERM');
-    } catch (e) {
-      // Ignore errors if process already dead
-    }
-  }
-  clearTunnelInfo();
-};
-
-export const clearTunnelInfo = () => {
-  if (fs.existsSync(PID_FILE)) fs.unlinkSync(PID_FILE);
-};

package/src/tunnel/tls-runner.js

@@ -0,0 +1,85 @@
+import { createSocksToTlsProxy } from './tls.js';
+import tls from 'tls';
+import notifier from 'node-notifier';
+
+const localPort = parseInt(process.env.POLARIS_LOCAL_PORT || '1080', 10);
+const remoteServer = process.env.POLARIS_REMOTE_SERVER;
+const remotePort = parseInt(process.env.POLARIS_REMOTE_PORT || '8443', 10);
+
+let proxyServer = createSocksToTlsProxy(localPort, remoteServer, remotePort);
+
+// Keepalive pings & Auto-reconnect
+const checkConnection = async () => {
+  return new Promise((resolve) => {
+    const socket = tls.connect({
+      host: remoteServer,
+      port: remotePort,
+      rejectUnauthorized: false,
+      timeout: 5000
+    }, () => {
+      socket.destroy();
+      resolve(true);
+    });
+
+    socket.on('error', () => {
+      socket.destroy();
+      resolve(false);
+    });
+
+    socket.on('timeout', () => {
+      socket.destroy();
+      resolve(false);
+    });
+  });
+};
+
+const reconnect = async (attempt = 1) => {
+  if (attempt > 5) {
+    notifier.notify({
+      title: 'Polaris VPN',
+      message: 'Failed to reconnect after 5 attempts. Tunnel stopped.'
+    });
+    process.exit(1);
+  }
+  
+  notifier.notify({
+    title: 'Polaris VPN',
+    message: `Connection lost. Reconnecting (attempt ${attempt}/5)...`
+  });
+
+  try {
+    proxyServer.close();
+  } catch (e) {}
+
+  // Wait with exponential backoff
+  await new Promise(r => setTimeout(r, Math.pow(2, attempt) * 1000));
+
+  try {
+    proxyServer = createSocksToTlsProxy(localPort, remoteServer, remotePort);
+    const alive = await checkConnection();
+    if (alive) {
+      notifier.notify({
+        title: 'Polaris VPN',
+        message: 'Reconnected successfully.'
+      });
+      startInterval();
+    } else {
+      reconnect(attempt + 1);
+    }
+  } catch (err) {
+    reconnect(attempt + 1);
+  }
+};
+
+let intervalId;
+const startInterval = () => {
+  intervalId = setInterval(async () => {
+    const isAlive = await checkConnection();
+    if (!isAlive) {
+      clearInterval(intervalId);
+      reconnect();
+    }
+  }, 30000);
+};
+
+startInterval();

package/src/tunnel/tls.js

@@ -0,0 +1,131 @@
+import net from 'net';
+import tls from 'tls';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { spawnDaemon, saveDaemonState } from '../utils/daemon.js';
+import { TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE, ensureDir } from '../utils/config.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// SOCKS5 to TLS proxy server instance logic
+export const createSocksToTlsProxy = (localPort, remoteServer, remotePort = 8443) => {
+  const server = net.createServer((clientSocket) => {
+    let stage = 0; // 0: Greeting, 1: Request, 2: Connected
+
+    clientSocket.on('data', (data) => {
+      if (stage === 0) {
+        if (data[0] !== 0x05) {
+          clientSocket.destroy();
+          return;
+        }
+        clientSocket.write(Buffer.from([0x05, 0x00]));
+        stage = 1;
+      } else if (stage === 1) {
+        if (data[0] !== 0x05 || data[1] !== 0x01) {
+          clientSocket.write(Buffer.from([0x05, 0x07, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
+          clientSocket.destroy();
+          return;
+        }
+
+        const atyp = data[3];
+        let host = '';
+        let offset = 4;
+
+        if (atyp === 0x01) {
+          host = `${data[4]}.${data[5]}.${data[6]}.${data[7]}`;
+          offset = 8;
+        } else if (atyp === 0x03) {
+          const len = data[4];
+          host = data.toString('utf8', 5, 5 + len);
+          offset = 5 + len;
+        } else if (atyp === 0x04) {
+          host = data.slice(4, 20).toString('hex');
+          offset = 20;
+        } else {
+          clientSocket.write(Buffer.from([0x05, 0x08, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
+          clientSocket.destroy();
+          return;
+        }
+
+        const port = data.readUInt16BE(offset);
+
+        // Connect to remote TLS server
+        const tlsSocket = tls.connect({
+          host: remoteServer,
+          port: remotePort,
+          rejectUnauthorized: false,
+          minVersion: 'TLSv1.3'
+        }, () => {
+          tlsSocket.write(`CONNECT ${host}:${port}\n`);
+        });
+
+        let responseBuffer = '';
+        const onTlsData = (chunk) => {
+          responseBuffer += chunk.toString('utf8');
+          const lineEnd = responseBuffer.indexOf('\n');
+          if (lineEnd !== -1) {
+            const line = responseBuffer.substring(0, lineEnd).trim();
+            tlsSocket.removeListener('data', onTlsData);
+
+            if (line === 'OK') {
+              clientSocket.write(Buffer.from([0x05, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
+              stage = 2;
+              
+              const rest = responseBuffer.substring(lineEnd + 1);
+              if (rest.length > 0) {
+                clientSocket.write(Buffer.from(rest, 'utf8'));
+              }
+              
+              clientSocket.pipe(tlsSocket);
+              tlsSocket.pipe(clientSocket);
+            } else {
+              clientSocket.write(Buffer.from([0x05, 0x05, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
+              clientSocket.destroy();
+              tlsSocket.destroy();
+            }
+          }
+        };
+
+        tlsSocket.on('data', onTlsData);
+
+        tlsSocket.on('error', () => {
+          try {
+            clientSocket.write(Buffer.from([0x05, 0x01, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
+            clientSocket.destroy();
+          } catch (e) {}
+        });
+
+        clientSocket.on('error', () => {
+          tlsSocket.destroy();
+        });
+      }
+    });
+  });
+
+  server.listen(localPort, '127.0.0.1');
+  return server;
+};
+
+// Spawn background proxy with keepalive/reconnect checks
+export const startTlsBackground = (localPort, remoteServer, remotePort = 8443) => {
+  ensureDir();
+  
+  const runnerScript = path.join(__dirname, 'tls-runner.js');
+
+  const pid = spawnDaemon(runnerScript, [], {
+    POLARIS_LOCAL_PORT: String(localPort),
+    POLARIS_REMOTE_SERVER: remoteServer,
+    POLARIS_REMOTE_PORT: String(remotePort)
+  });
+
+  saveDaemonState(TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE, {
+    pid,
+    server: remoteServer,
+    port: localPort,
+    mode: 'tls',
+    startTime: new Date().toISOString()
+  });
+
+  return pid;
+};

package/src/utils/config.js

@@ -0,0 +1,18 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import Conf from 'conf';
+
+export const CONFIG_DIR = path.join(os.homedir(), '.config', 'polaris');
+export const TUNNEL_PID_FILE = path.join(CONFIG_DIR, 'tunnel.pid');
+export const TUNNEL_CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+export const DNS_PID_FILE = path.join(CONFIG_DIR, 'dns.pid');
+export const DNS_CONFIG_FILE = path.join(CONFIG_DIR, 'dns.json');
+
+export const ensureDir = (dir = CONFIG_DIR) => {
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+};
+
+export const store = new Conf({ projectName: 'polaris' });

package/src/utils/daemon.js

@@ -0,0 +1,68 @@
+import fs from 'fs';
+import { spawn } from 'child_process';
+
+export const isPidAlive = (pid) => {
+  if (!pid) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return false;
+  }
+};
+
+export const killPid = (pid, signal = 'SIGTERM') => {
+  if (!pid) return;
+  try {
+    process.kill(pid, signal);
+  } catch (e) {
+    // Ignore if already dead
+  }
+};
+
+export const spawnDaemon = (scriptPath, args = [], env = {}) => {
+  const child = spawn('node', [scriptPath, ...args], {
+    detached: true,
+    stdio: 'ignore',
+    env: {
+      ...process.env,
+      ...env
+    }
+  });
+  child.unref();
+  return child.pid;
+};
+
+export const saveDaemonState = (pidFile, configFile, data) => {
+  fs.writeFileSync(pidFile, String(data.pid), 'utf-8');
+  fs.writeFileSync(configFile, JSON.stringify(data, null, 2), 'utf-8');
+};
+
+export const loadDaemonState = (pidFile, configFile) => {
+  if (!fs.existsSync(pidFile) || !fs.existsSync(configFile)) {
+    return null;
+  }
+
+  try {
+    const pid = parseInt(fs.readFileSync(pidFile, 'utf-8').trim(), 10);
+    const config = JSON.parse(fs.readFileSync(configFile, 'utf-8'));
+
+    if (!isPidAlive(pid)) {
+      clearDaemonState(pidFile, configFile);
+      return null;
+    }
+
+    return { pid, ...config };
+  } catch (err) {
+    return null;
+  }
+};
+
+export const clearDaemonState = (pidFile, configFile) => {
+  try {
+    if (fs.existsSync(pidFile)) fs.unlinkSync(pidFile);
+  } catch (e) {}
+  try {
+    if (fs.existsSync(configFile)) fs.unlinkSync(configFile);
+  } catch (e) {}
+};