super-dns 1.0.0

package/CLAUDE.md

@@ -0,0 +1,79 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Overview
+
+Super DNS is a local DNS proxy server for macOS that prevents DNS hijacking by routing specific domains through Alibaba Cloud's DoH (DNS over HTTPS). It automatically configures macOS's `/etc/resolver/` mechanism for per-domain DNS routing.
+
+## Commands
+
+```bash
+# Start the DNS server
+node index.js
+# or
+npm start
+
+# Test DNS resolution (must specify server and port explicitly)
+dig @127.0.0.1 -p 15353 perf.qzz.io A +short
+dig @127.0.0.1 -p 15353 perf.qzz.io AAAA +short
+
+# Verify macOS system resolver is configured
+scutil --dns | grep -A 5 "qzz.io"
+cat /etc/resolver/qzz.io
+
+# Test with system resolver (works for ping, curl, browsers)
+ping perf.qzz.io
+curl -k https://perf.qzz.io:8443/
+
+# Graceful shutdown (auto-cleans resolver files)
+# Press Ctrl+C or: kill -TERM <PID>
+```
+
+## Architecture
+
+**Single-file design**: Everything is in `index.js` (~500 lines), organized into logical sections:
+- Configuration and domain loading (lines 1-90)
+- macOS resolver setup/cleanup using `osascript` (lines 90-150)
+- DNS caching with TTL (lines 150-180)
+- DoH querying to Alibaba Cloud (lines 180-210)
+- Hand-rolled DNS packet parsing/building (lines 210-380)
+- UDP server and request handling (lines 380-440)
+- Graceful shutdown (lines 440-500)
+
+**Key design decisions**:
+- Zero dependencies - pure Node.js implementation
+- Uses `osascript` for sudo operations (macOS GUI password prompt instead of terminal)
+- Resolver setup runs in a child process via `fork()` to avoid blocking DNS server
+- Resolver files are `chown`'d to current user during setup so cleanup doesn't require sudo
+- Hand-rolled DNS protocol implementation (no external DNS library)
+
+**Configuration file**: `~/.config/super-dns/domains`
+- One domain per line, supports `#` comments
+- Wildcard syntax: `*.qzz.io` matches `qzz.io` and all subdomains
+- Exact match: `example.com` matches only that domain
+
+**Environment variables**:
+- `PORT` (default: 15353) - DNS server port
+- `HOST` (default: 127.0.0.1) - bind address
+- `DOH_BASE` (default: https://dns.alidns.com/resolve) - DoH endpoint
+- `CACHE_TTL` (default: 300000) - cache duration in ms
+
+## Important Notes
+
+**macOS `/etc/resolver/` behavior**:
+- Only affects system resolvers: browsers, ping, curl, Node.js, Python
+- Does NOT affect: `dig`, `nslookup` (they read from network preferences directly)
+- To test with `dig`, must explicitly specify: `dig @127.0.0.1 -p 15353 <domain>`
+- To make `dig` use local DNS by default, create `~/.digrc` with `server 127.0.0.1\nport 15353`
+
+**Port selection**: Default port is 15353 (not 5353) because 5353 is often occupied by mDNS services (Chrome, adb).
+
+**Resolver cleanup**: On SIGTERM/SIGINT, the server deletes `/etc/resolver/` files. This uses `fs.unlinkSync()` first (files are owned by current user), falling back to `sudoExec()` if needed.
+
+**SSL certificate trust**: If accessing HTTPS services with self-signed or mismatched certificates, trust the cert system-wide:
+```bash
+echo | openssl s_client -connect <IP>:<PORT> -servername <domain> 2>/dev/null | openssl x509 -outform PEM > /tmp/cert.pem
+security add-trusted-cert -d -r trustRoot -k ~/Library/Keychains/login.keychain-db /tmp/cert.pem
+```
+Then clear Chrome HSTS cache at `chrome://net-internals/#hsts`.

package/README.md

@@ -0,0 +1,99 @@
+# Super DNS
+
+本地 DNS 代理服务器，通过阿里云 DoH (DNS over HTTPS) 解析域名，防止 DNS 劫持。
+
+## 特性
+
+- 🛡️ 通过阿里云 DoH 解析，防 DNS 劫持
+- 🎯 支持通配符配置（如 `*.qzz.io` 接管整个域）
+- ⚡ 5 分钟本地缓存，减少重复查询
+- 🍎 macOS 独立解析器自动配置/清理
+- 📦 零依赖，纯 Node.js 实现
+
+## 快速开始
+
+```bash
+# 本地开发测试
+npm start
+# 或
+node index.js
+```
+
+首次启动会自动创建配置文件 `~/.config/super-dns/domains`，并弹出密码框配置 macOS 独立解析器。
+
+## 生产环境部署
+
+使用 pm2 + npx 实现进程守护和自动重启：
+
+```bash
+# 1. 发布到 npm（首次）
+npm publish
+
+# 2. 用 pm2 启动
+pm2 start npx --name super-dns -- super-dns
+
+# 3. 保存进程列表
+pm2 save
+
+# 4. 设置开机自启（按提示执行输出的命令）
+pm2 startup
+```
+
+或者全局安装后启动：
+
+```bash
+# 全局安装
+npm install -g super-dns
+
+# pm2 启动
+pm2 start super-dns --name super-dns
+pm2 save
+pm2 startup
+```
+
+**常用 pm2 命令：**
+
+```bash
+pm2 logs super-dns    # 查看日志
+pm2 status            # 查看状态
+pm2 restart super-dns # 重启服务
+pm2 stop super-dns    # 停止服务
+pm2 delete super-dns  # 删除服务
+```
+
+## 配置域名
+
+编辑 `~/.config/super-dns/domains`，每行一个域名：
+
+```
+# 通配符：接管 qzz.io 及所有子域名
+*.qzz.io
+
+# 精确匹配：只接管这一个域名
+example.com
+```
+
+支持 `#` 开头的注释行。
+
+## 环境变量
+
+| 变量 | 默认值 | 说明 |
+|------|--------|------|
+| `PORT` | `15353` | DNS 服务监听端口 |
+| `HOST` | `127.0.0.1` | DNS 服务监听地址 |
+| `DOH_BASE` | `https://dns.alidns.com/resolve` | DoH 服务地址 |
+| `CACHE_TTL` | `300000` | 缓存时间（毫秒），默认 5 分钟 |
+
+## 工作原理
+
+1. 启动 UDP DNS 服务监听在 `127.0.0.1:15353`
+2. 自动在 `/etc/resolver/` 下创建 macOS 独立解析器配置
+3. 收到 DNS 请求后，检查域名是否在管理列表中
+4. 命中的域名通过阿里云 DoH 查询真实 IP 并返回
+5. 退出时自动清理 `/etc/resolver/` 配置
+
+## 退出清理
+
+- `Ctrl+C` (SIGINT) 或 `kill` (SIGTERM) 触发优雅退出
+- 自动删除 `/etc/resolver/` 下的配置文件
+- 可能需要输入一次密码（osascript 弹窗）

package/index.js

@@ -0,0 +1,513 @@
+#!/usr/bin/env node
+const dgram = require('dgram');
+const https = require('https');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { execSync } = require('child_process');
+
+// ============================================================
+// 配置
+// ============================================================
+const PORT = parseInt(process.env.PORT || '15353', 10);
+const HOST = process.env.HOST || '127.0.0.1';
+const DOH_BASE = process.env.DOH_BASE || 'https://dns.alidns.com/resolve';
+const CACHE_TTL_MS = parseInt(process.env.CACHE_TTL || '300000', 10); // 5 min
+const CONFIG_DIR = path.join(os.homedir(), '.config', 'super-dns');
+const DOMAINS_FILE = path.join(CONFIG_DIR, 'domains');
+
+// ============================================================
+// 域名列表加载
+// ============================================================
+function loadDomains(file) {
+  // 自动创建配置文件
+  if (!fs.existsSync(file)) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, '# Super DNS 域名配置\n# 每行一个域名，支持通配符\n# 例: *.qzz.io 表示接管 qzz.io 及其所有子域名\n# 例: aaa.qzz.io 表示只接管这一个域名\n\n*.qzz.io\n', 'utf-8');
+    console.log(`[*] 已自动创建配置文件: ${file}`);
+  }
+
+  const lines = fs.readFileSync(file, 'utf-8')
+    .split('\n')
+    .map(l => l.trim().toLowerCase())
+    .filter(l => l && !l.startsWith('#'));
+
+  if (lines.length === 0) {
+    console.error(`[!] 配置文件为空: ${file}`);
+    console.error('[!] 请添加至少一个域名，例如:');
+    console.error('    *.qzz.io');
+    process.exit(1);
+  }
+
+  // 解析域名规则
+  const rules = lines.map(line => {
+    if (line.startsWith('*.')) {
+      // 通配符: *.qzz.io → 匹配 qzz.io 及所有子域
+      const base = line.slice(2);
+      return { type: 'wildcard', base, raw: line };
+    }
+    return { type: 'exact', domain: line, raw: line };
+  });
+
+  console.log(`[*] 已加载 ${rules.length} 条规则:`);
+  rules.forEach(r => console.log(`    - ${r.raw}`));
+  return rules;
+}
+
+const domainRules = loadDomains(DOMAINS_FILE);
+
+// 从规则中提取需要配置 resolver 的域名
+function getResolverDomains() {
+  const domains = new Set();
+  for (const rule of domainRules) {
+    if (rule.type === 'wildcard') {
+      domains.add(rule.base); // *.qzz.io → resolver 文件用 qzz.io
+    } else {
+      // 精确域名，提取二级域作为 resolver 文件名
+      // 比如 aaa.qzz.io → resolver 文件用 qzz.io
+      const parts = rule.domain.split('.');
+      if (parts.length >= 2) {
+        domains.add(parts.slice(-2).join('.'));
+      } else {
+        domains.add(rule.domain);
+      }
+    }
+  }
+  return [...domains];
+}
+
+// ============================================================
+// macOS Resolver 自动配置
+// ============================================================
+const RESOLVER_DIR = '/etc/resolver';
+let resolverConfigured = false;
+
+function sudoExec(command) {
+  // 直接用 osascript 弹窗执行（管理员权限），避免 sudo 需要终端的问题
+  const escaped = command.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+  execSync(
+    `osascript -e 'do shell script "${escaped}" with administrator privileges'`,
+    { stdio: 'pipe', timeout: 120000 }
+  );
+}
+
+// ============================================================
+// 缓存
+// ============================================================
+const cache = new Map();
+
+function cacheKey(name, type) {
+  return `${name}|${type}`;
+}
+
+function cacheGet(name, type) {
+  const key = cacheKey(name, type);
+  const entry = cache.get(key);
+  if (!entry) return null;
+  if (Date.now() - entry.ts > CACHE_TTL_MS) {
+    cache.delete(key);
+    return null;
+  }
+  return entry.data;
+}
+
+function cacheSet(name, type, data) {
+  cache.set(cacheKey(name, type), { data, ts: Date.now() });
+}
+
+// ============================================================
+// DoH 查询 (阿里云公共 DNS)
+// ============================================================
+function dohQuery(name, type) {
+  return new Promise((resolve, reject) => {
+    const qtype = type === 28 ? 'AAAA' : 'A';
+    const url = `${DOH_BASE}?name=${encodeURIComponent(name)}&type=${qtype}`;
+    const req = https.get(url, { timeout: 3000 }, (res) => {
+      let body = '';
+      res.on('data', chunk => body += chunk);
+      res.on('end', () => {
+        try {
+          const json = JSON.parse(body);
+          const answers = (json.Answer || []).filter(a => a.type === (type === 28 ? 28 : 1));
+          const ips = answers.map(a => a.data);
+          resolve(ips);
+        } catch (e) {
+          reject(new Error(`DoH JSON 解析失败: ${e.message}`));
+        }
+      });
+    });
+    req.on('error', reject);
+    req.on('timeout', () => { req.destroy(); reject(new Error('DoH 超时')); });
+  });
+}
+
+// ============================================================
+// DNS 报文解析
+// ============================================================
+
+/**
+ * 从 DNS 报文的 offset 处读取一个域名（支持压缩指针）
+ */
+function readName(buf, offset) {
+  const parts = [];
+  let jumped = false;
+  let nextOffset = offset;
+  let safety = 0;
+
+  while (safety++ < 64) {
+    if (offset >= buf.length) break;
+    const len = buf[offset];
+
+    if (len === 0) {
+      if (!jumped) nextOffset = offset + 1;
+      break;
+    }
+
+    if ((len & 0xc0) === 0xc0) {
+      if (offset + 1 >= buf.length) break;
+      const ptr = ((len & 0x3f) << 8) | buf[offset + 1];
+      if (!jumped) nextOffset = offset + 2;
+      jumped = true;
+      offset = ptr;
+      continue;
+    }
+
+    offset += 1;
+    if (offset + len > buf.length) break;
+    parts.push(buf.slice(offset, offset + len).toString('ascii'));
+    offset += len;
+    if (!jumped) nextOffset = offset;
+  }
+
+  return { name: parts.join('.'), nextOffset };
+}
+
+function parseRequest(buf) {
+  if (buf.length < 12) return null;
+
+  const id = buf.readUInt16BE(0);
+  const flags = buf.readUInt16BE(2);
+  const qdCount = buf.readUInt16BE(4);
+
+  if (qdCount < 1) return null;
+
+  const { name, nextOffset } = readName(buf, 12);
+  if (nextOffset + 4 > buf.length) return null;
+
+  const qtype = buf.readUInt16BE(nextOffset);
+  const qclass = buf.readUInt16BE(nextOffset + 2);
+
+  return {
+    id,
+    flags,
+    name: name.toLowerCase(),
+    qtype,
+    qclass,
+    questionRaw: buf.slice(12, nextOffset + 4)
+  };
+}
+
+// ============================================================
+// DNS 报文构造
+// ============================================================
+
+function encodeName(name) {
+  const labels = name.split('.');
+  const bufs = labels.map(label => {
+    const b = Buffer.from(label, 'ascii');
+    return Buffer.concat([Buffer.from([b.length]), b]);
+  });
+  bufs.push(Buffer.from([0]));
+  return Buffer.concat(bufs);
+}
+
+function uint16(v) {
+  const b = Buffer.alloc(2);
+  b.writeUInt16BE(v, 0);
+  return b;
+}
+
+function uint32(v) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32BE(v, 0);
+  return b;
+}
+
+function ipv6ToBuffer(ip) {
+  try {
+    const expanded = expandIPv6(ip);
+    const parts = expanded.split(':').map(p => parseInt(p, 16));
+    if (parts.length !== 8) return null;
+    const buf = Buffer.alloc(16);
+    parts.forEach((p, i) => buf.writeUInt16BE(p, i * 2));
+    return buf;
+  } catch {
+    return null;
+  }
+}
+
+function expandIPv6(ip) {
+  if (ip.includes('::')) {
+    const [left, right] = ip.split('::');
+    const l = left ? left.split(':') : [];
+    const r = right ? right.split(':') : [];
+    const fill = Array(8 - l.length - r.length).fill('0');
+    return [...l, ...fill, ...r].join(':');
+  }
+  return ip;
+}
+
+function buildResponse(req, ips) {
+  const id = Buffer.alloc(2);
+  id.writeUInt16BE(req.id, 0);
+
+  const flags = Buffer.alloc(2);
+  flags.writeUInt16BE(0x8180, 0);
+
+  const qdCount = Buffer.from([0, 1, 0, ips.length, 0, 0, 0, 0]);
+  const question = req.questionRaw;
+  const answers = [];
+  const encodedName = encodeName(req.name);
+
+  for (const ip of ips) {
+    if (req.qtype === 1) {
+      const parts = ip.split('.').map(Number);
+      if (parts.length !== 4 || parts.some(p => isNaN(p))) continue;
+      answers.push(Buffer.concat([
+        encodedName, uint16(1), uint16(1), uint32(300), uint16(4), Buffer.from(parts)
+      ]));
+    } else if (req.qtype === 28) {
+      const rdata = ipv6ToBuffer(ip);
+      if (!rdata) continue;
+      answers.push(Buffer.concat([
+        encodedName, uint16(28), uint16(1), uint32(300), uint16(16), rdata
+      ]));
+    }
+  }
+
+  if (answers.length === 0) {
+    qdCount[2] = 0; qdCount[3] = 0;
+  }
+
+  return Buffer.concat([id, flags, qdCount, question, ...answers]);
+}
+
+function buildNxDomain(req) {
+  const id = Buffer.alloc(2);
+  id.writeUInt16BE(req.id, 0);
+  const flags = Buffer.alloc(2);
+  flags.writeUInt16BE(0x8183, 0);
+  const counts = Buffer.from([0, 1, 0, 0, 0, 0, 0, 0]);
+  return Buffer.concat([id, flags, counts, req.questionRaw]);
+}
+
+// ============================================================
+// 域名匹配（支持通配符）
+// ============================================================
+function isManaged(name) {
+  const clean = name.endsWith('.') ? name.slice(0, -1) : name;
+  for (const rule of domainRules) {
+    if (rule.type === 'wildcard') {
+      // *.qzz.io → 匹配 qzz.io 本身及其所有子域
+      if (clean === rule.base || clean.endsWith('.' + rule.base)) return true;
+    } else {
+      // 精确匹配
+      if (clean === rule.domain) return true;
+    }
+  }
+  return false;
+}
+
+// ============================================================
+// 主服务
+// ============================================================
+const server = dgram.createSocket('udp4');
+
+server.on('message', async (msg, rinfo) => {
+  const req = parseRequest(msg);
+  if (!req) {
+    console.log(`[!] 无法解析来自 ${rinfo.address}:${rinfo.port} 的请求`);
+    return;
+  }
+
+  const cleanName = req.name.endsWith('.') ? req.name.slice(0, -1) : req.name;
+  const typeStr = req.qtype === 1 ? 'A' : req.qtype === 28 ? 'AAAA' : `TYPE${req.qtype}`;
+  console.log(`[>] ${cleanName} ${typeStr} from ${rinfo.address}:${rinfo.port}`);
+
+  if (!isManaged(req.name)) {
+    console.log(`[x] 不在管理列表中，返回 NXDOMAIN`);
+    server.send(buildNxDomain(req), rinfo.port, rinfo.address);
+    return;
+  }
+
+  if (req.qtype !== 1 && req.qtype !== 28) {
+    console.log(`[x] 不支持的查询类型 ${typeStr}，返回空回答`);
+    server.send(buildResponse(req, []), rinfo.port, rinfo.address);
+    return;
+  }
+
+  const cached = cacheGet(cleanName, req.qtype);
+  if (cached) {
+    console.log(`[c] 缓存命中: ${cached.join(', ')}`);
+    server.send(buildResponse(req, cached), rinfo.port, rinfo.address);
+    return;
+  }
+
+  try {
+    const ips = await dohQuery(cleanName, req.qtype);
+    if (ips.length > 0) {
+      cacheSet(cleanName, req.qtype, ips);
+      console.log(`[✓] 解析成功: ${ips.join(', ')}`);
+    } else {
+      console.log(`[!] DoH 无记录`);
+    }
+    server.send(buildResponse(req, ips), rinfo.port, rinfo.address);
+  } catch (e) {
+    console.error(`[!] DoH 查询失败: ${e.message}`);
+    const stale = cache.get(cacheKey(cleanName, req.qtype));
+    if (stale) {
+      console.log(`[!] 使用过期缓存: ${stale.data.join(', ')}`);
+      server.send(buildResponse(req, stale.data), rinfo.port, rinfo.address);
+    } else {
+      server.send(buildResponse(req, []), rinfo.port, rinfo.address);
+    }
+  }
+});
+
+server.on('error', (err) => {
+  console.error(`[!] 服务器错误: ${err.message}`);
+  process.exit(1);
+});
+
+const resolverDomains = getResolverDomains();
+
+server.on('listening', () => {
+  const addr = server.address();
+  console.log('');
+  console.log('╔══════════════════════════════════════════════╗');
+  console.log('║           Super DNS 本地代理服务             ║');
+  console.log('╚══════════════════════════════════════════════╝');
+  console.log(`[*] 监听: ${addr.address}:${addr.port} (UDP)`);
+  console.log(`[*] DoH:  ${DOH_BASE}`);
+  console.log(`[*] 缓存: ${CACHE_TTL_MS / 1000}s`);
+  console.log(`[*] 配置: ${DOMAINS_FILE}`);
+  console.log('');
+  console.log('[*] 正在配置 macOS 独立解析器（可能需要输入密码）...');
+
+  // 用子进程配置 macOS resolver，避免阻塞 DNS 服务
+  // osascript 弹密码框期间 DNS 仍可正常响应
+  // 关键：chown 把 resolver 文件归属当前用户，退出时 rm 不需要 sudo
+  const currentUser = os.userInfo().username;
+  const setupScript = `
+    const fs = require('fs');
+    const { execSync } = require('child_process');
+    const resolverDomains = ${JSON.stringify(resolverDomains)};
+    const host = '${addr.address}';
+    const port = ${addr.port};
+    const RESOLVER_DIR = '${RESOLVER_DIR}';
+    const pid = ${process.pid};
+    const currentUser = '${currentUser}';
+
+    function sudoExec(cmd) {
+      const escaped = cmd.replace(/\\\\/g, '\\\\\\\\').replace(/"/g, '\\\\"');
+      execSync(
+        \`osascript -e 'do shell script "\${escaped}" with administrator privileges'\`,
+        { stdio: 'pipe', timeout: 120000 }
+      );
+    }
+
+    try {
+      const commands = ['mkdir -p ' + RESOLVER_DIR];
+      for (const domain of resolverDomains) {
+        const tmpFile = '/tmp/super-dns-' + domain + '-' + pid;
+        const resolverFile = RESOLVER_DIR + '/' + domain;
+        fs.writeFileSync(tmpFile, '# Auto-generated by super-dns (PID ' + pid + ')\\nnameserver ' + host + '\\nport ' + port + '\\n');
+        commands.push('mv ' + tmpFile + ' ' + resolverFile);
+        commands.push('chmod 644 ' + resolverFile);
+        commands.push('chown ' + currentUser + ' ' + resolverFile);
+      }
+      sudoExec(commands.join(' && '));
+      for (const domain of resolverDomains) {
+        process.send({ type: 'setup-ok', domain });
+      }
+      process.send({ type: 'setup-done' });
+    } catch (e) {
+      process.send({ type: 'setup-fail', error: e.message });
+    }
+  `;
+
+  const setupChild = require('child_process').fork(`-e`, [setupScript], {
+    silent: true,
+    detached: false
+  });
+
+  setupChild.on('message', (msg) => {
+    if (msg.type === 'setup-ok') {
+      console.log(`    ✓ ${RESOLVER_DIR}/${msg.domain} → ${addr.address}:${addr.port}`);
+    } else if (msg.type === 'setup-done') {
+      resolverConfigured = true;
+      console.log('[*] macOS 解析器配置完成');
+      console.log('');
+    } else if (msg.type === 'setup-fail') {
+      console.error(`[!] 配置 macOS 解析器失败: ${msg.error}`);
+      console.error('[!] 请手动执行:');
+      for (const domain of resolverDomains) {
+        console.error(`    sudo mkdir -p ${RESOLVER_DIR}`);
+        console.error(`    echo "nameserver ${addr.address}\\nport ${addr.port}" | sudo tee ${RESOLVER_DIR}/${domain}`);
+      }
+    }
+  });
+
+  setupChild.on('exit', (code) => {
+    if (code !== 0 && code !== null) {
+      console.error(`[!] resolver 配置子进程异常退出 (code=${code})`);
+    }
+  });
+});
+
+// ============================================================
+// 优雅退出
+// ============================================================
+let shuttingDown = false;
+
+function shutdown(signal) {
+  if (shuttingDown) return;
+  shuttingDown = true;
+
+  console.log(`\n[*] 收到 ${signal}，正在关闭...`);
+
+  // 关闭 DNS 服务器
+  server.close(() => {
+    console.log('[*] DNS 服务已关闭');
+  });
+
+  if (resolverConfigured) {
+    console.log('[*] 正在清理 macOS 独立解析器...');
+    for (const domain of resolverDomains) {
+      const resolverFile = `${RESOLVER_DIR}/${domain}`;
+      try {
+        // 文件已 chown 为当前用户，直接 rm 即可，无需 sudo
+        fs.unlinkSync(resolverFile);
+        console.log(`    ✓ 已删除 ${resolverFile}`);
+      } catch (e) {
+        // 如果直接删不了（比如权限被改回去），用 osascript
+        try {
+          sudoExec(`rm -f ${resolverFile}`);
+          console.log(`    ✓ 已删除 ${resolverFile} (sudo)`);
+        } catch (e2) {
+          console.error(`    ✗ 删除 ${resolverFile} 失败: ${e.message}`);
+          console.error(`    请手动执行: sudo rm ${resolverFile}`);
+        }
+      }
+    }
+  }
+
+  console.log('[*] 已关闭');
+  process.exit(0);
+}
+
+process.on('SIGINT', () => shutdown('SIGINT'));
+process.on('SIGTERM', () => shutdown('SIGTERM'));
+
+// 启动
+server.bind(PORT, HOST);

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "super-dns",
+  "version": "1.0.0",
+  "description": "真实 dns，防劫持用的",
+  "homepage": "https://github.com/jayli/super-dns#readme",
+  "bugs": {
+    "url": "https://github.com/jayli/super-dns/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jayli/super-dns.git"
+  },
+  "license": "ISC",
+  "author": "",
+  "type": "commonjs",
+  "main": "index.js",
+  "bin": {
+    "super-dns": "index.js"
+  },
+  "scripts": {
+    "start": "node index.js",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  }
+}