wyxrouter 0.4.71

package/src/mitm/cert/install.js

@@ -0,0 +1,269 @@
+const fs = require("fs");
+const crypto = require("crypto");
+const { exec } = require("child_process");
+const { execWithPassword, isSudoAvailable } = require("../dns/dnsConfig.js");
+const { runElevatedPowerShell, quotePs } = require("../winElevated.js");
+const { log, err } = require("../logger");
+
+const IS_WIN = process.platform === "win32";
+const IS_MAC = process.platform === "darwin";
+const LINUX_CERT_PATHS = [
+  // Debian / Ubuntu
+  { dir: "/usr/local/share/ca-certificates", cmd: "update-ca-certificates" },
+  // Arch Linux / CachyOS / Manjaro
+  { dir: "/etc/ca-certificates/trust-source/anchors", cmd: "update-ca-trust" },
+  // Fedora / RHEL / CentOS
+  { dir: "/etc/pki/ca-trust/source/anchors", cmd: "update-ca-trust" },
+  // openSUSE
+  { dir: "/etc/pki/trust/anchors", cmd: "update-ca-certificates" }
+];
+
+function getLinuxCertConfig() {
+  for (const config of LINUX_CERT_PATHS) {
+    if (fs.existsSync(config.dir)) {
+      return config;
+    }
+  }
+  // Fallback to Debian default if none exist
+  return LINUX_CERT_PATHS[0];
+}
+const ROOT_CA_CN = "9Router MITM Root CA";
+
+// Get SHA1 fingerprint from cert file using Node.js crypto
+function getCertFingerprint(certPath) {
+  const pem = fs.readFileSync(certPath, "utf-8");
+  const der = Buffer.from(pem.replace(/-----[^-]+-----/g, "").replace(/\s/g, ""), "base64");
+  return crypto.createHash("sha1").update(der).digest("hex").toUpperCase().match(/.{2}/g).join(":");
+}
+
+/**
+ * Check if certificate is already installed in system store
+ */
+async function checkCertInstalled(certPath) {
+  if (IS_WIN) return checkCertInstalledWindows(certPath);
+  if (IS_MAC) return checkCertInstalledMac(certPath);
+  return checkCertInstalledLinux();
+}
+
+function checkCertInstalledMac(certPath) {
+  return new Promise((resolve) => {
+    try {
+      const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
+      // Verify exact cert bytes match — same CN with different fingerprint = stale cert
+      exec(`security find-certificate -a -c "${ROOT_CA_CN}" -Z /Library/Keychains/System.keychain 2>/dev/null`, { windowsHide: true }, (error, stdout) => {
+        if (error || !stdout) return resolve(false);
+        const match = new RegExp(`SHA-1 hash:\\s*${fingerprint}`, "i").test(stdout);
+        if (!match) return resolve(false);
+        // Cert exists with matching fingerprint — confirm trust policy
+        exec(`security verify-cert -c "${certPath}" -p ssl -k /Library/Keychains/System.keychain 2>/dev/null`, { windowsHide: true }, (err2) => {
+          resolve(!err2);
+        });
+      });
+    } catch {
+      resolve(false);
+    }
+  });
+}
+
+function checkCertInstalledWindows(certPath) {
+  return new Promise((resolve) => {
+    // Check by SHA1 fingerprint — detects stale cert with same CN but different key
+    let fingerprint;
+    try {
+      fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
+    } catch {
+      return resolve(false);
+    }
+    exec(`certutil -store Root ${fingerprint}`, { windowsHide: true }, (error) => {
+      resolve(!error);
+    });
+  });
+}
+
+/**
+ * Install SSL certificate to system trust store
+ */
+async function installCert(sudoPassword, certPath) {
+  if (!fs.existsSync(certPath)) {
+    throw new Error(`Certificate file not found: ${certPath}`);
+  }
+
+  const isInstalled = await checkCertInstalled(certPath);
+  if (isInstalled) {
+    log("🔐 Cert: already trusted ✅");
+    return;
+  }
+
+  if (IS_WIN) {
+    await installCertWindows(certPath);
+  } else if (IS_MAC) {
+    await installCertMac(sudoPassword, certPath);
+  } else {
+    await installCertLinux(sudoPassword, certPath);
+  }
+}
+
+async function installCertMac(sudoPassword, certPath) {
+  // Remove all old certs with same name first to avoid duplicate/stale cert conflict
+  const deleteOld = `security delete-certificate -c "9Router MITM Root CA" /Library/Keychains/System.keychain 2>/dev/null || true`;
+  const install = `security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`;
+  try {
+    await execWithPassword(`${deleteOld} && ${install}`, sudoPassword);
+    log("🔐 Cert: ✅ installed to system keychain");
+  } catch (error) {
+    const msg = error.message?.includes("canceled") ? "User canceled authorization" : "Certificate install failed";
+    throw new Error(msg);
+  }
+}
+
+async function installCertWindows(certPath) {
+  // Auto-elevate via UAC popup if not admin (zero popup if already admin).
+  // Delete any stale cert with same CN before adding to avoid duplicates.
+  const script = `
+    certutil -delstore Root ${quotePs(ROOT_CA_CN)} 2>$null | Out-Null
+    $exit = & certutil -addstore Root ${quotePs(certPath)} 2>&1
+    if ($LASTEXITCODE -ne 0) { throw "certutil exit $LASTEXITCODE" }
+  `;
+  try {
+    await runElevatedPowerShell(script);
+    log("🔐 Cert: ✅ installed to Windows Root store");
+  } catch (e) {
+    throw new Error(`Failed to install certificate: ${e.message}`);
+  }
+}
+
+/**
+ * Uninstall SSL certificate from system store
+ */
+async function uninstallCert(sudoPassword, certPath) {
+  const isInstalled = await checkCertInstalled(certPath);
+  if (!isInstalled) {
+    log("🔐 Cert: not found in system store");
+    return;
+  }
+
+  if (IS_WIN) {
+    await uninstallCertWindows();
+  } else if (IS_MAC) {
+    await uninstallCertMac(sudoPassword, certPath);
+  } else {
+    await uninstallCertLinux(sudoPassword);
+  }
+}
+
+async function uninstallCertMac(sudoPassword, certPath) {
+  const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
+  const command = `security delete-certificate -Z "${fingerprint}" /Library/Keychains/System.keychain`;
+  try {
+    await execWithPassword(command, sudoPassword);
+    log("🔐 Cert: ✅ uninstalled from system keychain");
+  } catch (err) {
+    throw new Error("Failed to uninstall certificate");
+  }
+}
+
+async function uninstallCertWindows() {
+  // Auto-elevate via UAC popup if not admin
+  const script = `certutil -delstore Root ${quotePs(ROOT_CA_CN)}`;
+  try {
+    await runElevatedPowerShell(script);
+    log("🔐 Cert: ✅ uninstalled from Windows Root store");
+  } catch (e) {
+    throw new Error(`Failed to uninstall certificate: ${e.message}`);
+  }
+}
+
+function checkCertInstalledLinux() {
+  const config = getLinuxCertConfig();
+  const certFile = `${config.dir}/9router-root-ca.crt`;
+  return Promise.resolve(fs.existsSync(certFile));
+}
+
+async function updateNssDatabases(certPath, action = 'add') {
+  const certName = "9Router MITM Root CA";
+  
+  const script = `
+    if ! command -v certutil &> /dev/null; then
+      exit 0
+    fi
+    
+    DIRS="$HOME/.pki/nssdb $HOME/snap/chromium/current/.pki/nssdb"
+    
+    if [ -d "$HOME/.mozilla/firefox" ]; then
+      for profile in "$HOME"/.mozilla/firefox/*/; do
+        if [ -f "\${profile}cert9.db" ] || [ -f "\${profile}cert8.db" ]; then
+          DIRS="$DIRS $profile"
+        fi
+      done
+    fi
+
+    if [ -d "$HOME/snap/firefox/common/.mozilla/firefox" ]; then
+      for profile in "$HOME"/snap/firefox/common/.mozilla/firefox/*/; do
+        if [ -f "\${profile}cert9.db" ] || [ -f "\${profile}cert8.db" ]; then
+          DIRS="$DIRS $profile"
+        fi
+      done
+    fi
+
+    for db in $DIRS; do
+      if [ -d "$db" ]; then
+        if [ "${action}" = "add" ]; then
+          certutil -d sql:"$db" -A -t "C,," -n "${certName}" -i "${certPath}" 2>/dev/null || \\
+          certutil -d "$db" -A -t "C,," -n "${certName}" -i "${certPath}" 2>/dev/null || true
+        else
+          certutil -d sql:"$db" -D -n "${certName}" 2>/dev/null || \\
+          certutil -d "$db" -D -n "${certName}" 2>/dev/null || true
+        fi
+      fi
+    done
+  `;
+  
+  return new Promise((resolve) => {
+    exec(script, { shell: "/bin/bash" }, () => resolve());
+  });
+}
+
+async function installCertLinux(sudoPassword, certPath) {
+  if (!isSudoAvailable()) {
+    log(`🔐 Cert: cannot install to system store without sudo — trust this file on clients: ${certPath}`);
+    // Still try to update user NSS DBs even if no sudo!
+    await updateNssDatabases(certPath, 'add');
+    return;
+  }
+  
+  const config = getLinuxCertConfig();
+  const destFile = `${config.dir}/9router-root-ca.crt`;
+  
+  // Copy to the discovered directory and execute the specific update command
+  const cmd = `cp "${certPath}" "${destFile}" && (${config.cmd} 2>/dev/null || true)`;
+  
+  try {
+    await execWithPassword(cmd, sudoPassword);
+    await updateNssDatabases(certPath, 'add');
+    log(`🔐 Cert: ✅ installed to Linux trust store (${config.dir}) and user browser databases`);
+  } catch (error) {
+    throw new Error(`Certificate install failed: ${error.message}`);
+  }
+}
+
+async function uninstallCertLinux(sudoPassword) {
+  // Always try to uninstall from user DBs even without sudo
+  await updateNssDatabases(null, 'delete');
+
+  if (!isSudoAvailable()) {
+    return;
+  }
+  
+  const config = getLinuxCertConfig();
+  const destFile = `${config.dir}/9router-root-ca.crt`;
+  const cmd = `rm -f "${destFile}" && (${config.cmd} 2>/dev/null || true)`;
+  
+  try {
+    await execWithPassword(cmd, sudoPassword);
+    log("🔐 Cert: ✅ uninstalled from Linux trust store and user browser databases");
+  } catch (error) {
+    throw new Error("Failed to uninstall certificate");
+  }
+}
+
+module.exports = { installCert, uninstallCert, checkCertInstalled };

package/src/mitm/cert/rootCA.js

@@ -0,0 +1,173 @@
+const path = require("path");
+const fs = require("fs");
+const forge = require("node-forge");
+const { MITM_DIR } = require("../paths");
+
+const ROOT_CA_KEY_PATH = path.join(MITM_DIR, "rootCA.key");
+const ROOT_CA_CERT_PATH = path.join(MITM_DIR, "rootCA.crt");
+
+/**
+ * Check if cert file is expired or expiring within 30 days
+ */
+function isCertExpired(certPath) {
+  try {
+    const cert = forge.pki.certificateFromPem(fs.readFileSync(certPath, "utf8"));
+    const expiryThreshold = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+    return cert.validity.notAfter < expiryThreshold;
+  } catch {
+    return true; // treat unreadable cert as expired
+  }
+}
+
+/**
+ * Generate Root CA certificate (only once, auto-regenerate if expired)
+ * This Root CA will sign all dynamic leaf certificates
+ */
+async function generateRootCA() {
+  const exists = fs.existsSync(ROOT_CA_KEY_PATH) && fs.existsSync(ROOT_CA_CERT_PATH);
+  if (exists && !isCertExpired(ROOT_CA_CERT_PATH)) {
+    console.log("✅ Root CA already exists");
+    return { key: ROOT_CA_KEY_PATH, cert: ROOT_CA_CERT_PATH };
+  }
+  if (exists) {
+    console.log("🔐 Root CA expired or expiring soon — regenerating...");
+    try { fs.unlinkSync(ROOT_CA_KEY_PATH); } catch { /* ignore */ }
+    try { fs.unlinkSync(ROOT_CA_CERT_PATH); } catch { /* ignore */ }
+  }
+
+  if (!fs.existsSync(MITM_DIR)) {
+    fs.mkdirSync(MITM_DIR, { recursive: true });
+  }
+
+  console.log("🔐 Generating Root CA certificate...");
+
+  // Generate RSA key pair
+  const keys = forge.pki.rsa.generateKeyPair(2048);
+
+  // Create Root CA certificate
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = "01";
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = new Date();
+  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 10);
+
+  const attrs = [
+    { name: "commonName", value: "9Router MITM Root CA" },
+    { name: "organizationName", value: "9Router" },
+    { name: "countryName", value: "US" }
+  ];
+
+  cert.setSubject(attrs);
+  cert.setIssuer(attrs); // Self-signed
+
+  cert.setExtensions([
+    {
+      name: "basicConstraints",
+      cA: true,
+      critical: true
+    },
+    {
+      name: "keyUsage",
+      keyCertSign: true,
+      cRLSign: true,
+      critical: true
+    },
+    {
+      name: "subjectKeyIdentifier"
+    }
+  ]);
+
+  // Self-sign the certificate
+  cert.sign(keys.privateKey, forge.md.sha256.create());
+
+  // Save to disk
+  const privateKeyPem = forge.pki.privateKeyToPem(keys.privateKey);
+  const certPem = forge.pki.certificateToPem(cert);
+
+  fs.writeFileSync(ROOT_CA_KEY_PATH, privateKeyPem);
+  fs.writeFileSync(ROOT_CA_CERT_PATH, certPem);
+
+  console.log("✅ Root CA generated successfully");
+  return { key: ROOT_CA_KEY_PATH, cert: ROOT_CA_CERT_PATH };
+}
+
+/**
+ * Load Root CA from disk
+ */
+function loadRootCA() {
+  if (!fs.existsSync(ROOT_CA_KEY_PATH) || !fs.existsSync(ROOT_CA_CERT_PATH)) {
+    throw new Error("Root CA not found. Generate it first.");
+  }
+
+  const keyPem = fs.readFileSync(ROOT_CA_KEY_PATH, "utf8");
+  const certPem = fs.readFileSync(ROOT_CA_CERT_PATH, "utf8");
+
+  return {
+    key: forge.pki.privateKeyFromPem(keyPem),
+    cert: forge.pki.certificateFromPem(certPem)
+  };
+}
+
+/**
+ * Generate leaf certificate for a specific domain, signed by Root CA
+ */
+function generateLeafCert(domain, rootCA) {
+  // Generate key pair for leaf cert
+  const keys = forge.pki.rsa.generateKeyPair(2048);
+
+  // Create leaf certificate
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = Math.floor(Math.random() * 1000000).toString();
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = new Date();
+  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1);
+
+  cert.setSubject([
+    { name: "commonName", value: domain }
+  ]);
+
+  cert.setIssuer(rootCA.cert.subject.attributes);
+
+  cert.setExtensions([
+    {
+      name: "basicConstraints",
+      cA: false
+    },
+    {
+      name: "keyUsage",
+      digitalSignature: true,
+      keyEncipherment: true
+    },
+    {
+      name: "extKeyUsage",
+      serverAuth: true,
+      clientAuth: true
+    },
+    {
+      name: "subjectAltName",
+      altNames: [
+        { type: 2, value: domain }, // DNS
+        { type: 2, value: `*.${domain}` } // Wildcard
+      ]
+    }
+  ]);
+
+  // Sign with Root CA
+  cert.sign(rootCA.key, forge.md.sha256.create());
+
+  return {
+    key: forge.pki.privateKeyToPem(keys.privateKey),
+    cert: forge.pki.certificateToPem(cert)
+  };
+}
+
+module.exports = {
+  generateRootCA,
+  loadRootCA,
+  generateLeafCert,
+  isCertExpired,
+  ROOT_CA_CERT_PATH,
+  ROOT_CA_KEY_PATH
+};

package/src/mitm/config.js

@@ -0,0 +1,87 @@
+// All intercepted domains + URL patterns per tool
+
+const fs = require("fs");
+
+const IS_DEV = process.env.NODE_ENV === "development";
+
+// Resolve lsof absolute path — packaged apps / sudo secure_path may strip /usr/sbin from PATH
+const LSOF_BIN = (() => {
+  if (process.platform === "win32") return null;
+  for (const p of ["/usr/sbin/lsof", "/usr/bin/lsof", "/sbin/lsof"]) {
+    try { fs.accessSync(p, fs.constants.X_OK); return p; } catch { /* try next */ }
+  }
+  return "lsof"; // last-resort fallback (depends on PATH)
+})();
+
+const TARGET_HOSTS = [
+  "daily-cloudcode-pa.googleapis.com",
+  "cloudcode-pa.googleapis.com",
+  "api.individual.githubcopilot.com",
+  "q.us-east-1.amazonaws.com",
+  "api2.cursor.sh",
+];
+
+const URL_PATTERNS = {
+  antigravity: [":generateContent", ":streamGenerateContent"],
+  copilot: ["/chat/completions", "/v1/messages", "/responses"],
+  kiro: ["/generateAssistantResponse"],
+  cursor: ["/BidiAppend", "/RunSSE", "/RunPoll", "/Run"],
+};
+
+// Synonym map: rawModel from request → canonical alias key in mitmAlias DB
+const MODEL_SYNONYMS = {
+  antigravity: {
+    "gemini-default": "gemini-3.5-flash-low",
+    "gemini-3.5-flash-high": "gemini-3-flash-agent",
+    "gemini-3.5-flash-medium": "gemini-3.5-flash-low",
+    "gemini-3.5-flash-extra-low": "gemini-3.5-flash-extra-low",
+    "gemini-3.1-pro-high": "gemini-pro-agent",
+    "gemini-3-pro-high": "gemini-pro-agent",
+    "gemini-3-pro-low": "gemini-3.1-pro-low",
+  },
+};
+
+// Pattern fallback: rawModel regex → canonical alias key (when exact + prefix match fail)
+// Order matters: more specific patterns first. Catches AG renamed variants (e.g. gemini-pro-agent)
+const MODEL_PATTERNS = {
+  antigravity: [
+    { match: /flash.*extra.*low|extra.*low.*flash|flash.*low|low.*flash/i, alias: "gemini-3.5-flash-extra-low" },
+    { match: /flash.*medium|medium.*flash/i,                       alias: "gemini-3.5-flash-low" },
+    { match: /flash.*agent|agent.*flash|flash/i,                   alias: "gemini-3-flash-agent" },
+    { match: /pro.*low|low.*pro/i,                                 alias: "gemini-3.1-pro-low" },
+    { match: /gemini.*pro|pro.*gemini/i,                           alias: "gemini-pro-agent" },
+    { match: /opus/i,                                              alias: "claude-opus-4-6-thinking" },
+    { match: /sonnet|claude/i,                                     alias: "claude-sonnet-4-6" },
+    { match: /gpt.*oss|oss/i,                                      alias: "gpt-oss-120b-medium" },
+  ],
+};
+
+// Models that must NEVER be re-routed — always passthrough to the real upstream, even when
+// the tool's other models are mapped. Antigravity's tab-autocomplete (`tab_jump_flash_lite_preview`,
+// `tab_flash_lite_preview`, requestType tab/tab_jump) is latency-critical inline completion; routing
+// it through 9Router to an external chat model makes typing laggy and burns provider quota per
+// keystroke. Without this guard the broad `flash` pattern in MODEL_PATTERNS hijacks them onto the
+// flash-agent slot. Verified via MITM dump capture of streamGenerateContent (see AI_JOURNAL).
+const MODEL_NO_MAP = {
+  antigravity: [/^tab[_-]/i],
+};
+
+// URL substrings whose request/response should NOT be dumped to file (telemetry, polling, empty)
+const LOG_BLACKLIST_URL_PARTS = [
+  "recordCodeAssistMetrics",
+  "recordTrajectoryAnalytics",
+  "fetchAdminControls",
+  "listExperiments",
+  "fetchUserInfo",
+];
+
+function getToolForHost(host) {
+  const h = (host || "").split(":")[0];
+  if (h === "api.individual.githubcopilot.com") return "copilot";
+  if (h === "daily-cloudcode-pa.googleapis.com" || h === "cloudcode-pa.googleapis.com") return "antigravity";
+  if (h === "q.us-east-1.amazonaws.com") return "kiro";
+  if (h === "api2.cursor.sh") return "cursor";
+  return null;
+}
+
+module.exports = { IS_DEV, LSOF_BIN, TARGET_HOSTS, URL_PATTERNS, MODEL_SYNONYMS, MODEL_PATTERNS, MODEL_NO_MAP, LOG_BLACKLIST_URL_PARTS, getToolForHost };

package/src/mitm/dbReader.js

@@ -0,0 +1,22 @@
+// CJS reader for MITM standalone process. Reads mitmAlias from JSON cache
+// at $DATA_DIR/mitm/aliases.json (synced by app from SQLite on startup + writes).
+// JSON-only: no SQLite native binding required in MITM bundle.
+const fs = require("fs");
+const path = require("path");
+const { DATA_DIR } = require("./paths");
+
+const CACHE_FILE = path.join(DATA_DIR, "mitm", "aliases.json");
+
+function readCache() {
+  try {
+    if (!fs.existsSync(CACHE_FILE)) return null;
+    return JSON.parse(fs.readFileSync(CACHE_FILE, "utf-8"));
+  } catch { return null; }
+}
+
+function getMitmAlias(toolName) {
+  const all = readCache();
+  return all?.[toolName] || null;
+}
+
+module.exports = { getMitmAlias };