switchboard-router 0.5.21 → 0.6.0

package/cli.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 
-const { spawn, exec, execSync } = require("child_process");
+const { spawn, execSync } = require("child_process");
 const path = require("path");
 const fs = require("fs");
 const https = require("https");
 const os = require("os");
+const { openBrowser: openBrowserWithoutShell } = require("./src/shared/openBrowser");
 
 // Native spinner - no external dependency
 function createSpinner(text) {
@@ -45,8 +46,15 @@ function createSpinner(text) {
 const pkg = require("./package.json");
 const { ensureSqliteRuntime, buildEnvWithRuntime } = require("./hooks/sqliteRuntime");
 const { ensureTrayRuntime } = require("./hooks/trayRuntime");
+const { pinDataDir, getDataDir } = require("./src/shared/dataDir");
+const { disableMitm } = require("./src/shared/disableMitm");
 const args = process.argv.slice(2);
 
+// Resolve the data directory ONCE, before anything can create cache dirs inside
+// a candidate, and export it so the spawned server and the CLI's token client
+// cannot disagree about where the database and cli-secret live.
+pinDataDir();
+
 // Self-heal SQLite runtime deps (sql.js + better-sqlite3) into ~/.switchboard/runtime
 // so the server can resolve them via NODE_PATH. Best-effort — sql.js is required,
 // better-sqlite3 is optional. Logs to stderr only on failure.
@@ -83,12 +91,6 @@ function getDisplayHost() {
   return host;
 }
 const MAX_PORT_ATTEMPTS = 10;
-// Identifiers for killAllAppProcesses — bin + package name only
-const PROCESS_IDENTIFIERS = [
-  "switchboard",
-  "switchboard-router",
-];
-
 // Parse arguments
 let port = DEFAULT_PORT;
 let host = DEFAULT_HOST;
@@ -134,8 +136,9 @@ Options:
   }
 }
 
-// Auto-relaunch after update: detached process has no TTY → fallback to tray
-if (skipUpdate && !trayMode && !process.stdin.isTTY) {
+// A detached or piped CLI cannot answer the interactive menu. Keep it in the
+// long-lived tray lifecycle even when it was launched without lifecycle flags.
+if ((!process.stdin.isTTY || !process.stdout.isTTY) && !trayMode) {
   trayMode = true;
   process.env.TRAY_MODE = "1";
 }
@@ -154,11 +157,65 @@ function compareVersions(a, b) {
   return 0;
 }
 
-// Get app data dir (matches app/src/lib/dataDir.js convention)
-function getAppDataDir() {
-  return process.platform === "win32"
-    ? path.join(process.env.APPDATA || "", "switchboard")
-    : path.join(os.homedir(), ".switchboard");
+// PID/runtime state lives in the SAME directory the server writes to. Hardcoding
+// `.switchboard` here would look for `.mitm.pid` in the wrong place under legacy
+// adoption or an explicit DATA_DIR, leaving a privileged MITM process alive on
+// port 443. pinDataDir() ran at startup, so this is the resolved value.
+const getAppDataDir = getDataDir;
+const getProcessStateFile = () => path.join(getAppDataDir(), "runtime", "owned-processes.json");
+
+function readOwnedProcessState() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(getProcessStateFile(), "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch { return {}; }
+}
+
+function writeOwnedProcessState(serverPid) {
+  try {
+    const file = getProcessStateFile();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({
+      cliPid: process.pid,
+      cliPath: __filename,
+      serverPid,
+      serverPath,
+      writtenAt: Date.now(),
+    }), { mode: 0o600 });
+  } catch { /* best effort */ }
+}
+
+function clearOwnedProcessState() {
+  try {
+    const state = readOwnedProcessState();
+    if (Number(state.cliPid) === process.pid) fs.unlinkSync(getProcessStateFile());
+  } catch { /* best effort */ }
+}
+
+function processMatchesRecordedPath(pid, expectedPath) {
+  if (!expectedPath) return false;
+  try {
+    const command = process.platform === "win32"
+      ? execSync(`powershell -NonInteractive -NoProfile -Command "(Get-CimInstance Win32_Process -Filter 'ProcessId = ${Number(pid)}').CommandLine"`, { encoding: "utf8", windowsHide: true, timeout: 3000 })
+      : execSync(`ps -p ${Number(pid)} -o command=`, { encoding: "utf8", timeout: 3000 });
+    return command.includes(expectedPath);
+  } catch {
+    // If identity cannot be verified, fail closed rather than risking a PID
+    // reuse killing an unrelated process.
+    return false;
+  }
+}
+
+function readOwnedAppPids() {
+  const state = readOwnedProcessState();
+  return [
+    [state.serverPid, state.serverPath],
+    [state.cliPid, state.cliPath],
+  ]
+    .filter(([, expectedPath]) => typeof expectedPath === "string" && expectedPath.length > 0)
+    .map(([pid, expectedPath]) => [Number(pid), expectedPath])
+    .filter(([pid, expectedPath]) => Number.isInteger(pid) && pid > 1 && pid !== process.pid && processMatchesRecordedPath(pid, expectedPath))
+    .map(([pid]) => pid);
 }
 
 // Kill PID from file (best-effort, removes file after)
@@ -185,37 +242,7 @@ function killTunnelByPidFile() {
   killByPidFile(path.join(tunnelDir, "tailscale.pid"));
 }
 
-// Kill cloudflared whose --url targets this app's port (covers stale PID file case)
-function killCloudflaredByAppPort(appPort) {
-  if (!appPort) return [];
-  const portMatchers = [`localhost:${appPort}`, `127.0.0.1:${appPort}`];
-  const pids = [];
-  try {
-    if (process.platform === "win32") {
-      const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"cloudflared.exe\\"' | Select-Object ProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation"`;
-      const output = execSync(psCmd, { encoding: "utf8", windowsHide: true, timeout: 5000 });
-      const lines = output.split("\n").slice(1).filter(l => l.trim());
-      lines.forEach(line => {
-        if (portMatchers.some(m => line.includes(m))) {
-          const match = line.match(/^"(\d+)"/);
-          if (match && match[1]) pids.push(match[1]);
-        }
-      });
-    } else {
-      const output = execSync("ps -eo pid,command 2>/dev/null", { encoding: "utf8", timeout: 5000 });
-      output.split("\n").forEach(line => {
-        if (line.includes("cloudflared") && portMatchers.some(m => line.includes(m))) {
-          const parts = line.trim().split(/\s+/);
-          const pid = parts[0];
-          if (pid && !isNaN(pid)) pids.push(pid);
-        }
-      });
-    }
-  } catch { }
-  return pids;
-}
-
-// Kill all switchboard processes
+// Kill only processes previously recorded by this launcher.
 function killAllAppProcesses(appPort) {
   return new Promise((resolve) => {
     try {
@@ -225,83 +252,36 @@ function killAllAppProcesses(appPort) {
       killTunnelByPidFile();
 
       const platform = process.platform;
-      let pids = [];
-
-      // Catch stale PID files: kill cloudflared bound to this app's port
-      pids.push(...killCloudflaredByAppPort(appPort));
-
-      if (platform === "win32") {
-        // Windows: use WMI to get full CommandLine (tasklist /V doesn't include it)
-        try {
-          const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "Get-WmiObject Win32_Process -Filter 'Name=\\"node.exe\\"' | Select-Object ProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation"`;
-          const output = execSync(psCmd, {
-            encoding: "utf8",
-            windowsHide: true,
-            timeout: 5000
-          });
-          const lines = output.split("\n").slice(1).filter(l => l.trim());
-          lines.forEach(line => {
-            // Whitelist: real node process running switchboard/cli.js, or next-server.
-            // Avoids killing editors/grep/strace/cursor that just have "switchboard" in cmdline.
-            const cmd = line.toLowerCase();
-            const isAppProcess =
-              (cmd.includes("node") && cmd.includes("switchboard") && (cmd.includes("cli.js") || cmd.includes("\\switchboard") || cmd.includes("/switchboard")))
-              || cmd.includes("next-server");
-            if (isAppProcess) {
-              const match = line.match(/^"(\d+)"/);
-              if (match && match[1] && match[1] !== process.pid.toString()) {
-                pids.push(match[1]);
-              }
-            }
-          });
-        } catch (e) {
-          // No processes found or error - continue
-        }
-      } else {
-        // macOS/Linux: use ps to find all matching processes
-        try {
-          const output = execSync('ps aux 2>/dev/null', {
-            encoding: 'utf8',
-            timeout: 5000
-          });
-          const lines = output.split('\n');
-
-          lines.forEach(line => {
-            // Whitelist: real node process running switchboard/cli.js, or next-server.
-            // Avoids killing grep/strace/editors/cursor that incidentally match "switchboard".
-            const cmd = line.toLowerCase();
-            const isAppProcess =
-              (cmd.includes("node") && cmd.includes("switchboard") && (cmd.includes("cli.js") || cmd.includes("/switchboard")))
-              || cmd.includes("next-server");
-            if (isAppProcess) {
-              const parts = line.trim().split(/\s+/);
-              const pid = parts[1];
-              if (pid && !isNaN(pid) && pid !== process.pid.toString()) {
-                pids.push(pid);
-              }
-            }
-          });
-        } catch (e) {
-          // No processes found or error - continue
-        }
-      }
+      const pids = readOwnedAppPids();
 
-      // Kill all found processes
+      // Gracefully stop owned processes, then force only survivors.
       if (pids.length > 0) {
-        pids.forEach(pid => {
+        const uniquePids = [...new Set(pids.map(Number))];
+        uniquePids.forEach(pid => {
           try {
             if (platform === "win32") {
-              execSync(`taskkill /F /PID ${pid} 2>nul`, { stdio: 'ignore', shell: true, windowsHide: true, timeout: 3000 });
+              execSync(`taskkill /T /PID ${pid} 2>nul`, { stdio: 'ignore', shell: true, windowsHide: true, timeout: 3000 });
             } else {
-              execSync(`kill -9 ${pid} 2>/dev/null`, { stdio: 'ignore', timeout: 3000 });
+              process.kill(pid, "SIGTERM");
             }
           } catch (err) {
             // Process already dead or can't kill - continue
           }
         });
-
-        // Wait for processes to fully terminate
-        setTimeout(() => resolve(), 1000);
+        setTimeout(() => {
+          uniquePids.forEach((pid) => {
+            try {
+              process.kill(pid, 0);
+              if (platform === "win32") {
+                execSync(`taskkill /F /T /PID ${pid} 2>nul`, { stdio: "ignore", shell: true, windowsHide: true, timeout: 3000 });
+              } else {
+                process.kill(pid, "SIGKILL");
+              }
+            } catch { /* already stopped */ }
+          });
+          try { fs.unlinkSync(getProcessStateFile()); } catch { }
+          resolve();
+        }, 2000);
       } else {
         resolve();
       }
@@ -359,51 +339,69 @@ function killProxyByPidFile() {
   } catch { }
 }
 
-// Kill any process on specific port
+function findListeningPids(port) {
+  const numericPort = Number(port);
+  if (!Number.isInteger(numericPort) || numericPort <= 0) return [];
+
+  try {
+    if (process.platform === "win32") {
+      const output = execSync(`netstat -ano | findstr :${numericPort}`, {
+        encoding: "utf8",
+        shell: true,
+        windowsHide: true,
+        timeout: 5000,
+      });
+      return output.split("\n")
+        .filter((line) => line.includes("LISTENING"))
+        .filter((line) => line.trim().split(/\s+/).some((field) => field.endsWith(`:${numericPort}`)))
+        .map((line) => Number(line.trim().split(/\s+/).pop()))
+        .filter((pid) => Number.isInteger(pid) && pid > 1);
+    }
+
+    const output = execSync(`lsof -tiTCP:${numericPort} -sTCP:LISTEN`, {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "ignore"],
+    });
+    return output.split(/\s+/)
+      .map(Number)
+      .filter((pid) => Number.isInteger(pid) && pid > 1);
+  } catch {
+    return [];
+  }
+}
+
+// Never kill an arbitrary listener that happens to share the app port. The
+// launcher may only signal PIDs recorded in its ownership state file.
 function killProcessOnPort(port) {
-  return new Promise((resolve) => {
-    try {
-      const platform = process.platform;
-      let pid;
+  const ownedPids = new Set(readOwnedAppPids());
+  const pids = findListeningPids(port).filter((pid) => ownedPids.has(pid));
+  if (pids.length === 0) return Promise.resolve();
 
-      if (platform === "win32") {
-        try {
-          const output = execSync(`netstat -ano | findstr :${port}`, {
-            encoding: 'utf8',
-            shell: true,
-            windowsHide: true,
-            timeout: 5000
-          }).trim();
-          const lines = output.split('\n').filter(l => l.includes('LISTENING'));
-          if (lines.length > 0) {
-            pid = lines[0].trim().split(/\s+/).pop();
-            execSync(`taskkill /F /PID ${pid} 2>nul`, { stdio: 'ignore', shell: true, windowsHide: true, timeout: 3000 });
-          }
-        } catch (e) {
-          // Port is free or error
+  return new Promise((resolve) => {
+    const platform = process.platform;
+    pids.forEach((pid) => {
+      try {
+        if (platform === "win32") {
+          execSync(`taskkill /T /PID ${pid}`, { stdio: "ignore", shell: true, windowsHide: true, timeout: 3000 });
+        } else {
+          process.kill(pid, "SIGTERM");
         }
-      } else {
-        // macOS/Linux
+      } catch { /* already dead or inaccessible */ }
+    });
+
+    setTimeout(() => {
+      pids.forEach((pid) => {
         try {
-          const pidOutput = execSync(`lsof -ti:${port}`, {
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'ignore']
-          }).trim();
-          if (pidOutput) {
-            pid = pidOutput.split('\n')[0];
-            execSync(`kill -9 ${pid} 2>/dev/null`, { stdio: 'ignore', timeout: 3000 });
+          process.kill(pid, 0);
+          if (platform === "win32") {
+            execSync(`taskkill /F /T /PID ${pid}`, { stdio: "ignore", shell: true, windowsHide: true, timeout: 3000 });
+          } else {
+            process.kill(pid, "SIGKILL");
           }
-        } catch (e) {
-          // Port is free or error
-        }
-      }
-
-      // Wait for port to be released
-      setTimeout(() => resolve(), 500);
-    } catch (err) {
-      // Silent fail - continue anyway
+        } catch { /* already stopped */ }
+      });
       resolve();
-    }
+    }, 500);
   });
 }
 
@@ -469,7 +467,7 @@ function checkForUpdate() {
           const ver = latest.version;
           // Reject name collisions: require a router/gateway-looking description
           const desc = String(latest.description || "").toLowerCase();
-          const looksOurs = /switchboard|9router|routing|router|gateway|model/.test(desc);
+          const looksOurs = /switchboard|routing|router|gateway|model/.test(desc);
           if (ver && looksOurs && compareVersions(ver, pkg.version) > 0) {
             done(ver);
           } else {
@@ -488,21 +486,10 @@ function checkForUpdate() {
 
 // Open browser
 function openBrowser(url) {
-  const platform = process.platform;
-  let cmd;
-
-  if (platform === "darwin") {
-    cmd = `open "${url}"`;
-  } else if (platform === "win32") {
-    cmd = `start "" "${url}"`;
-  } else {
-    cmd = `xdg-open "${url}"`;
-  }
-
-  exec(cmd, { windowsHide: true }, (err) => {
-    if (err) {
+  openBrowserWithoutShell(url, {
+    onError: () => {
       console.log(`Open browser manually: ${url}`);
-    }
+    },
   });
 }
 
@@ -606,6 +593,7 @@ function startServer(latestVersion) {
         HOSTNAME: host
       }
     });
+    if (child.pid) writeOwnedProcessState(child.pid);
     if (!showLog && child.stderr) {
       child.stderr.on("data", (data) => {
         const lines = data.toString().split("\n").filter(Boolean);
@@ -618,7 +606,7 @@ function startServer(latestVersion) {
 
   let server = spawnServer();
 
-  // Cleanup function - force kill server process
+  // Cleanup function - graceful SIGTERM → wait → SIGKILL
   let isCleaningUp = false;
   function cleanup() {
     if (isCleaningUp) return;
@@ -633,12 +621,16 @@ function startServer(latestVersion) {
       killProxyByPidFile();
       // Kill cloudflared/tailscale via PID file (only this app's tunnel)
       killTunnelByPidFile();
-      // Kill server process directly
+      // Graceful shutdown: SIGTERM first so server can flush DB, then SIGKILL
       if (server.pid) {
-        process.kill(server.pid, "SIGKILL");
+        try { process.kill(server.pid, "SIGTERM"); } catch { }
+        if (!waitForExit(server.pid, 2000)) {
+          try { process.kill(server.pid, "SIGKILL"); } catch { }
+        }
+        // Also try to kill process group
+        try { process.kill(-server.pid, "SIGKILL"); } catch { }
       }
-      // Also try to kill process group
-      process.kill(-server.pid, "SIGKILL");
+      clearOwnedProcessState();
     } catch (e) { }
   }
 
@@ -798,7 +790,8 @@ function startServer(latestVersion) {
   function attachServerEvents() {
     server.on("error", (err) => {
       console.error("Failed to start server:", err.message);
-      if (!isShuttingDown) tryRestart();
+      if (err?.code === "EADDRINUSE") stopForPortConflict();
+      else if (!isShuttingDown) tryRestart();
       else { cleanup(); process.exit(1); }
     });
 
@@ -807,25 +800,57 @@ function startServer(latestVersion) {
         process.exit(code || 0);
         return;
       }
+      if (isPortConflict()) {
+        stopForPortConflict();
+        return;
+      }
       tryRestart(code);
     });
   }
 
+  let mitmResetDone = false;
+
+  function isPortConflict() {
+    return crashLog.some((line) => /EADDRINUSE|address already in use|listen .*already in use/i.test(line));
+  }
+
+  function stopForPortConflict() {
+    if (isShuttingDown) return;
+    isShuttingDown = true;
+    console.error(`\n❌ Port ${port} is already in use. Stop the other listener or choose a different port.`);
+    cleanup();
+    process.exit(1);
+  }
+
   function tryRestart(code) {
+    if (isPortConflict()) {
+      stopForPortConflict();
+      return;
+    }
     const aliveMs = Date.now() - serverStartTime;
     // Reset counter if last run was stable
     if (aliveMs >= RESTART_RESET_MS) restartCount = 0;
 
     if (restartCount >= MAX_RESTARTS) {
-      console.error(`\n⚠️  Server crashed ${MAX_RESTARTS} times. Disabling MIT and restarting...`);
-      try {
-        const dbPath = path.join(os.homedir(), process.platform === "win32" ? path.join("AppData", "Roaming", "switchboard", "db.json") : path.join(".switchboard", "db.json"));
-        if (fs.existsSync(dbPath)) {
-          const db = JSON.parse(fs.readFileSync(dbPath, "utf-8"));
-          if (db.settings) db.settings.mitmEnabled = false;
-          fs.writeFileSync(dbPath, JSON.stringify(db, null, 2));
+      // Already tried MITM reset and still crashing — exit non-zero
+      if (mitmResetDone) {
+        console.error(`\n❌ Server still crashing after MITM reset. Giving up.`);
+        console.error(`   Data directory: ${getAppDataDir()}`);
+        if (crashLog.length) {
+          console.error("\n--- Server crash log ---");
+          crashLog.forEach(l => console.error(l));
+          console.error("--- End crash log ---\n");
         }
-      } catch { /* best effort */ }
+        cleanup();
+        process.exit(1);
+      }
+      console.error(`\n⚠️  Server crashed ${MAX_RESTARTS} times. Disabling MIT and restarting...`);
+      if (!disableMitm()) {
+        console.error("❌ Could not disable MIT in the database — refusing to restart into the same crash.");
+        console.error(`   Data directory: ${getAppDataDir()}`);
+        process.exit(1);
+      }
+      mitmResetDone = true;
       restartCount = 0;
       server = spawnServer();
       attachServerEvents();

package/hooks/sqliteRuntime.js

@@ -3,18 +3,12 @@
 // sql.js is bundled in bin/app already; node:sqlite / bun:sqlite are built-in.
 const { execSync, spawnSync } = require("child_process");
 const fs = require("fs");
-const os = require("os");
 const path = require("path");
 
 const BETTER_SQLITE3_VERSION = "12.6.2";
 const SQL_JS_VERSION = "1.14.1";
 
-function getDataDir() {
-  if (process.env.DATA_DIR) return process.env.DATA_DIR;
-  return process.platform === "win32"
-    ? path.join(process.env.APPDATA || os.homedir(), "switchboard")
-    : path.join(os.homedir(), ".switchboard");
-}
+const { getDataDir } = require("../src/shared/dataDir");
 
 function getRuntimeDir() {
   return path.join(getDataDir(), "runtime");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard-router",
-  "version": "0.5.21",
+  "version": "0.6.0",
   "description": "Switchboard CLI — local AI routing gateway (install: npm i -g switchboard-router; run: switchboard)",
   "bin": {
     "switchboard": "./cli.js"
@@ -24,7 +24,7 @@
   "scripts": {
     "dev": "nodemon -I --watch cli.js --watch src --watch hooks --ext js,json cli.js",
     "build": "node scripts/build-cli.js",
-    "pack:cli": "npm run build && npm pack --pack-destination ../..",
+    "pack:cli": "npm run build && npm pack --pack-destination ..",
     "publish:cli": "npm run build && npm publish",
     "postinstall": "node hooks/postinstall.js",
     "prepublishOnly": "npm run build"

package/src/cli/api/client.js

@@ -3,7 +3,6 @@ const https = require("https");
 const crypto = require("crypto");
 const fs = require("node:fs");
 const path = require("node:path");
-const os = require("node:os");
 const { machineIdSync } = require("node-machine-id");
 
 // Default configuration
@@ -13,17 +12,10 @@ const DEFAULT_CONFIG = {
   protocol: "http:",
 };
 
-const CLI_TOKEN_HEADER = "x-9r-cli-token";
-const CLI_TOKEN_SALT = "9r-cli-auth";
-const APP_NAME = "switchboard";
+const CLI_TOKEN_HEADER = "x-switchboard-cli-token";
+const CLI_TOKEN_SALT = "switchboard-cli-auth";
 
-function getDataDir() {
-  if (process.env.DATA_DIR) return process.env.DATA_DIR;
-  if (process.platform === "win32") {
-    return path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), APP_NAME);
-  }
-  return path.join(os.homedir(), `.${APP_NAME}`);
-}
+const { getDataDir } = require("../../shared/dataDir");
 
 const MACHINE_ID_FILE = path.join(getDataDir(), "machine-id");
 const AUTH_DIR = path.join(getDataDir(), "auth");
@@ -410,14 +402,6 @@ async function updateSettings(data) {
   return makeRequest("PATCH", "/api/settings", data);
 }
 
-/**
- * Reset dashboard password to default (clears stored hash server-side)
- * @returns {Promise<Object>} { success }
- */
-async function resetPassword() {
-  return makeRequest("POST", "/api/auth/reset-password");
-}
-
 // ============================================================================
 // MODELS API
 // ============================================================================
@@ -537,7 +521,6 @@ module.exports = {
   // Settings
   getSettings,
   updateSettings,
-  resetPassword,
   
   // Tunnel
   getTunnelStatus,