wyxrouter 0.4.71

package/src/mitm/dns/dnsConfig.js

@@ -0,0 +1,266 @@
+const { exec, spawn, execSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { log, err } = require("../logger");
+const { TOOL_HOSTS } = require("../../shared/constants/mitmToolHosts.js");
+const { runElevatedPowerShell, isAdmin } = require("../winElevated.js");
+
+/**
+ * Atomic-ish write for Windows hosts file with rollback on failure.
+ * Strategy: write `.new` sibling → rename current to `.bak` → rename `.new` to target.
+ * If anything fails mid-way, restore from `.bak`. Same-volume renames are atomic on NTFS.
+ */
+function atomicWriteHostsWin(target, originalContent, newContent) {
+  const tmpNew = `${target}.9router.new`;
+  const tmpBak = `${target}.9router.bak`;
+  try {
+    fs.writeFileSync(tmpNew, newContent, "utf8");
+    try { fs.unlinkSync(tmpBak); } catch { /* none */ }
+    fs.renameSync(target, tmpBak);
+    try {
+      fs.renameSync(tmpNew, target);
+    } catch (e) {
+      // Rollback: restore original
+      try { fs.renameSync(tmpBak, target); } catch { fs.writeFileSync(target, originalContent, "utf8"); }
+      throw e;
+    }
+    try { fs.unlinkSync(tmpBak); } catch { /* best effort */ }
+  } finally {
+    try { fs.unlinkSync(tmpNew); } catch { /* already moved or never created */ }
+  }
+}
+
+const IS_WIN = process.platform === "win32";
+const IS_MAC = process.platform === "darwin";
+const HOSTS_FILE = IS_WIN
+  ? path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts")
+  : "/etc/hosts";
+
+/** True when `sudo` exists (e.g. missing on minimal Docker images like Alpine). */
+function isSudoAvailable() {
+  if (IS_WIN) return false;
+  try {
+    execSync("command -v sudo", { stdio: "ignore", windowsHide: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function canRunSudoWithoutPassword() {
+  if (IS_WIN || !isSudoAvailable()) return true;
+  try {
+    execSync("sudo -n true", { stdio: "ignore", windowsHide: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isSudoPasswordRequired() {
+  return !IS_WIN && isSudoAvailable() && !canRunSudoWithoutPassword();
+}
+
+/**
+ * Execute command with sudo password via stdin (macOS/Linux only).
+ * Without sudo in PATH (containers), runs via sh — same user, no elevation.
+ */
+function execWithPassword(command, password) {
+  return new Promise((resolve, reject) => {
+    const useSudo = isSudoAvailable();
+    const child = useSudo
+      ? spawn("sudo", ["-S", "sh", "-c", command], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true })
+      : spawn("sh", ["-c", command], { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d) => { stdout += d; });
+    child.stderr.on("data", (d) => { stderr += d; });
+
+    child.on("close", (code) => {
+      if (code === 0) resolve(stdout);
+      else reject(new Error(stderr || `Exit code ${code}`));
+    });
+
+    if (useSudo) {
+      child.stdin.write(`${password}\n`);
+      child.stdin.end();
+    }
+  });
+}
+
+/**
+ * Trim trailing blank lines/whitespace, ensure file ends with exactly one newline.
+ */
+function normalizeHostsContent(content) {
+  const eol = IS_WIN ? "\r\n" : "\n";
+  return content.replace(/[\r\n\s]+$/g, "") + eol;
+}
+
+/**
+ * Flush DNS cache (macOS/Linux)
+ */
+async function flushDNS(sudoPassword) {
+  if (IS_WIN) return; // Windows flushes inline via ipconfig
+  if (IS_MAC) {
+    await execWithPassword("dscacheutil -flushcache && killall -HUP mDNSResponder", sudoPassword);
+  } else {
+    await execWithPassword("resolvectl flush-caches 2>/dev/null || true", sudoPassword);
+  }
+}
+
+/**
+ * Check if DNS entry exists for a specific host
+ */
+function checkDNSEntry(host = null) {
+  try {
+    const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
+    if (host) return hostsContent.includes(host);
+    // Legacy: check all antigravity hosts (backward compat)
+    return TOOL_HOSTS.antigravity.every(h => hostsContent.includes(h));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Check DNS status per tool — returns { [tool]: boolean }
+ */
+function checkAllDNSStatus() {
+  try {
+    const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
+    const result = {};
+    for (const [tool, hosts] of Object.entries(TOOL_HOSTS)) {
+      result[tool] = hosts.every(h => hostsContent.includes(h));
+    }
+    return result;
+  } catch {
+    return Object.fromEntries(Object.keys(TOOL_HOSTS).map(t => [t, false]));
+  }
+}
+
+/**
+ * Add DNS entries for a specific tool
+ */
+async function addDNSEntry(tool, sudoPassword) {
+  const hosts = TOOL_HOSTS[tool];
+  if (!hosts) throw new Error(`Unknown tool: ${tool}`);
+
+  const entriesToAdd = hosts.filter(h => !checkDNSEntry(h));
+  if (entriesToAdd.length === 0) {
+    log(`🌐 DNS ${tool}: already active`);
+    return;
+  }
+
+  try {
+    if (IS_WIN) {
+      // Read → trim → append → atomic write (Node-side, no CLI size limit)
+      const current = fs.readFileSync(HOSTS_FILE, "utf8");
+      const trimmed = current.replace(/[\r\n\s]+$/g, "");
+      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\r\n");
+      const next = `${trimmed}\r\n${toAppend}\r\n`;
+      atomicWriteHostsWin(HOSTS_FILE, current, next);
+      await runElevatedPowerShell("ipconfig /flushdns | Out-Null");
+    } else {
+      const current = fs.readFileSync(HOSTS_FILE, "utf8");
+      const trimmed = current.replace(/[\r\n\s]+$/g, "");
+      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\n");
+      const next = `${trimmed}\n${toAppend}\n`;
+      // Use tee via sudo to overwrite atomically — escape single quotes in content
+      const escaped = next.replace(/'/g, "'\\''");
+      await execWithPassword(`printf '%s' '${escaped}' | tee ${HOSTS_FILE} > /dev/null`, sudoPassword);
+      await flushDNS(sudoPassword);
+    }
+    log(`🌐 DNS ${tool}: ✅ added ${entriesToAdd.join(", ")}`);
+  } catch (error) {
+    const msg = error.message?.includes("incorrect password") ? "Wrong sudo password" : `Failed to add DNS entry: ${error.message}`;
+    throw new Error(msg);
+  }
+}
+
+/**
+ * Remove DNS entries for a specific tool
+ */
+async function removeDNSEntry(tool, sudoPassword) {
+  const hosts = TOOL_HOSTS[tool];
+  if (!hosts) throw new Error(`Unknown tool: ${tool}`);
+
+  const entriesToRemove = hosts.filter(h => checkDNSEntry(h));
+  if (entriesToRemove.length === 0) {
+    log(`🌐 DNS ${tool}: already inactive`);
+    return;
+  }
+
+  try {
+    if (IS_WIN) {
+      const current = fs.readFileSync(HOSTS_FILE, "utf8");
+      const filtered = current.split(/\r?\n/).filter(l => !entriesToRemove.some(h => l.includes(h))).join("\r\n");
+      const next = filtered.replace(/[\r\n\s]+$/g, "") + "\r\n";
+      atomicWriteHostsWin(HOSTS_FILE, current, next);
+      await runElevatedPowerShell("ipconfig /flushdns | Out-Null");
+    } else {
+      const current = fs.readFileSync(HOSTS_FILE, "utf8");
+      const filtered = current.split(/\r?\n/).filter(l => !entriesToRemove.some(h => l.includes(h))).join("\n");
+      const next = filtered.replace(/[\r\n\s]+$/g, "") + "\n";
+      const escaped = next.replace(/'/g, "'\\''");
+      await execWithPassword(`printf '%s' '${escaped}' | tee ${HOSTS_FILE} > /dev/null`, sudoPassword);
+      await flushDNS(sudoPassword);
+    }
+    log(`🌐 DNS ${tool}: ✅ removed ${entriesToRemove.join(", ")}`);
+  } catch (error) {
+    const msg = error.message?.includes("incorrect password") ? "Wrong sudo password" : `Failed to remove DNS entry: ${error.message}`;
+    throw new Error(msg);
+  }
+}
+
+/**
+ * Remove ALL tool DNS entries (used when stopping server)
+ */
+async function removeAllDNSEntries(sudoPassword) {
+  for (const tool of Object.keys(TOOL_HOSTS)) {
+    try {
+      await removeDNSEntry(tool, sudoPassword);
+    } catch (e) {
+      err(`DNS ${tool}: failed to remove — ${e.message}`);
+    }
+  }
+}
+
+/**
+ * Sync removal of ALL tool DNS entries — for use during process shutdown
+ * when async ops aren't safe. Assumes caller already has root/admin rights.
+ */
+function removeAllDNSEntriesSync() {
+  try {
+    if (!fs.existsSync(HOSTS_FILE)) return;
+    const allHosts = Object.values(TOOL_HOSTS).flat();
+    const content = fs.readFileSync(HOSTS_FILE, "utf8");
+    const eol = IS_WIN ? "\r\n" : "\n";
+    const filtered = content.split(/\r?\n/).filter(l => !allHosts.some(h => l.includes(h))).join(eol);
+    const next = filtered.replace(/[\r\n\s]+$/g, "") + eol;
+    if (next === content) return;
+    fs.writeFileSync(HOSTS_FILE, next, "utf8");
+    if (IS_WIN) {
+      try { execSync("ipconfig /flushdns", { windowsHide: true, stdio: "ignore" }); } catch { /* ignore */ }
+    } else if (IS_MAC) {
+      try { execSync("dscacheutil -flushcache && killall -HUP mDNSResponder", { stdio: "ignore" }); } catch { /* ignore */ }
+    } else {
+      try { execSync("resolvectl flush-caches 2>/dev/null || true", { stdio: "ignore" }); } catch { /* ignore */ }
+    }
+  } catch { /* best effort during shutdown */ }
+}
+
+module.exports = {
+  TOOL_HOSTS,
+  addDNSEntry,
+  removeDNSEntry,
+  removeAllDNSEntries,
+  removeAllDNSEntriesSync,
+  execWithPassword,
+  isSudoAvailable,
+  canRunSudoWithoutPassword,
+  isSudoPasswordRequired,
+  checkDNSEntry,
+  checkAllDNSStatus,
+};

package/src/mitm/handlers/antigravity.js

@@ -0,0 +1,33 @@
+const { err, createResponseDumper } = require("../logger");
+const { IS_DEV } = require("../config");
+const { fetchRouter, pipeSSE } = require("./base");
+
+/**
+ * Intercept Antigravity request — forward Gemini body as-is to /v1/chat/completions.
+ * Router auto-detects format via body.userAgent==="antigravity" + body.request.contents,
+ * runs antigravity→openai→provider→openai→antigravity translators internally.
+ */
+async function intercept(req, res, bodyBuffer, mappedModel) {
+  const dumper = IS_DEV ? createResponseDumper(req, "intercept-antigravity") : null;
+  const isStream = req.url.includes(":streamGenerateContent");
+  try {
+    const body = JSON.parse(bodyBuffer.toString());
+    if (body.model) body.model = mappedModel;
+
+    const routerRes = await fetchRouter(body, "/v1/chat/completions", req.headers);
+    await pipeSSE(routerRes, res, dumper);
+  } catch (error) {
+    err(`[antigravity] ${error.message}`);
+    if (dumper) { dumper.writeChunk(`\n[ERROR] ${error.message}\n`); dumper.end(); }
+    // For stream endpoint, send SSE error chunk so SDK doesn't hang waiting
+    if (isStream) {
+      if (!res.headersSent) res.writeHead(200, { "Content-Type": "text/event-stream" });
+      res.end(`data: ${JSON.stringify({ error: { message: error.message } })}\r\n\r\n`);
+    } else {
+      if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: { message: error.message, type: "mitm_error" } }));
+    }
+  }
+}
+
+module.exports = { intercept };

package/src/mitm/handlers/base.js

@@ -0,0 +1,226 @@
+const { log, err } = require("../logger");
+
+const DEFAULT_LOCAL_ROUTER = "http://localhost:20128";
+const ROUTER_BASE = String(process.env.MITM_ROUTER_BASE || DEFAULT_LOCAL_ROUTER)
+  .trim()
+  .replace(/\/+$/, "") || DEFAULT_LOCAL_ROUTER;
+const API_KEY = process.env.ROUTER_API_KEY;
+
+// Headers that must not be forwarded to 9Router
+const STRIP_HEADERS = new Set([
+  "host", "content-length", "connection", "transfer-encoding",
+  "content-type", "authorization"
+]);
+
+/**
+ * Send body to 9Router at the given path and return the fetch Response object.
+ * Optionally forwards client headers (stripped of hop-by-hop / overridden keys).
+ */
+async function fetchRouter(openaiBody, path = "/v1/chat/completions", clientHeaders = {}) {
+  const forwarded = {};
+  for (const [k, v] of Object.entries(clientHeaders)) {
+    if (!STRIP_HEADERS.has(k.toLowerCase())) forwarded[k] = v;
+  }
+
+  const response = await fetch(`${ROUTER_BASE}${path}`, {
+    method: "POST",
+    headers: {
+      ...forwarded,
+      "Content-Type": "application/json",
+      ...(API_KEY && { "Authorization": `Bearer ${API_KEY}` })
+    },
+    body: JSON.stringify(openaiBody)
+  });
+
+  // Forward response as-is (status + body). pipeSSE will propagate status.
+  return response;
+}
+
+/**
+ * Pipe SSE stream from router directly to client response.
+ * Optional dumper tees the stream into a debug file.
+ */
+async function pipeSSE(routerRes, res, dumper) {
+  const ct = routerRes.headers.get("content-type") || "application/json";
+  const status = routerRes.status || 200;
+  const resHeaders = { "Content-Type": ct, "Cache-Control": "no-cache", "Connection": "keep-alive" };
+  if (ct.includes("text/event-stream")) resHeaders["X-Accel-Buffering"] = "no";
+  res.writeHead(status, resHeaders);
+  if (dumper) dumper.writeHeader(routerRes.status, Object.fromEntries(routerRes.headers));
+
+  if (!routerRes.body) {
+    const text = await routerRes.text().catch(() => "");
+    if (dumper) { dumper.writeChunk(text); dumper.end(); }
+    res.end(text);
+    return;
+  }
+
+  const reader = routerRes.body.getReader();
+  const decoder = new TextDecoder();
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) { if (dumper) dumper.end(); res.end(); break; }
+    if (dumper) dumper.writeChunk(value);
+    res.write(decoder.decode(value, { stream: true }));
+  }
+}
+
+/**
+ * Pipe SSE stream from router, transforming each chunk through a user function.
+ * Reads SSE data: lines, parses JSON, calls transformFn(parsed, state),
+ * and writes returned SSE strings to the client response.
+ *
+ * @param {Response} routerRes - Fetch Response from 9Router
+ * @param {http.ServerResponse} res - Client response
+ * @param {Function} transformFn - (parsedChunk, state) => string|string[]|null
+ * @param {object} state - Mutable state object shared across chunks and flush
+ */
+async function pipeTransformedSSE(routerRes, res, transformFn, state) {
+  const ct = routerRes.headers.get("content-type") || "application/json";
+  const resHeaders = { "Content-Type": ct, "Cache-Control": "no-cache", "Connection": "keep-alive" };
+  if (ct.includes("text/event-stream")) resHeaders["X-Accel-Buffering"] = "no";
+  res.writeHead(200, resHeaders);
+
+  if (!routerRes.body) {
+    res.end(await routerRes.text().catch(() => ""));
+    return;
+  }
+
+  const reader = routerRes.body.getReader();
+  const decoder = new TextDecoder("utf-8", { fatal: false });
+  let buffer = "";
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+
+    buffer += decoder.decode(value, { stream: true });
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed || !trimmed.startsWith("data:")) continue;
+
+      const data = trimmed.slice(5).trim();
+      if (data === "[DONE]") continue;
+
+      if (process.env.DEBUG_MITM) {
+        log(`[SSE in] ${data.slice(0, 200)}`);
+      }
+
+      try {
+        const parsed = JSON.parse(data);
+        const result = transformFn(parsed, state);
+        if (result != null) {
+          const outputs = Array.isArray(result) ? result : [result];
+          for (const output of outputs) {
+            if (process.env.DEBUG_MITM) {
+              const len = output.length || output.byteLength || 0;
+              log(`[write binary frame] (${len}B) first 20B: ${Array.from(output.slice(0, 20)).join(',')}`);
+            }
+            res.write(Buffer.from(output));
+          }
+        }
+      } catch {
+        // Skip unparseable lines
+      }
+    }
+  }
+
+  // Flush: pass null to signal stream end
+  try {
+    const flushed = transformFn(null, state);
+    if (flushed != null) {
+      const outputs = Array.isArray(flushed) ? flushed : [flushed];
+      for (const output of outputs) {
+        res.write(output);
+      }
+    }
+  } catch { /* ignore flush errors */ }
+
+  res.end();
+}
+
+/**
+ * Pipe SSE stream from router, transforming each chunk through a user function,
+ * and writing binary EventStream frames to the client.
+ *
+ * Reads SSE data: lines, parses JSON, calls transformFn(parsed, state),
+ * and writes returned Uint8Array frames to the client response.
+ *
+ * @param {Response} routerRes - Fetch Response from 9Router
+ * @param {http.ServerResponse} res - Client response
+ * @param {Function} transformFn - (parsedChunk, state) => Uint8Array|Uint8Array[]|null
+ * @param {object} state - Mutable state object shared across chunks and flush
+ */
+async function pipeTransformedEventStream(routerRes, res, transformFn, state) {
+  const resHeaders = {
+    "Content-Type": "application/vnd.amazon.eventstream",
+    "Cache-Control": "no-cache",
+    "Connection": "keep-alive"
+  };
+  res.writeHead(200, resHeaders);
+
+  if (!routerRes.body) {
+    res.end(await routerRes.text().catch(() => ""));
+    return;
+  }
+
+  const reader = routerRes.body.getReader();
+  const decoder = new TextDecoder("utf-8", { fatal: false });
+  let buffer = "";
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+
+    buffer += decoder.decode(value, { stream: true });
+    const lines = buffer.split("\n");
+    buffer = lines.pop() || "";
+
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed || !trimmed.startsWith("data:")) continue;
+
+      const data = trimmed.slice(5).trim();
+      if (data === "[DONE]") continue;
+
+      if (process.env.DEBUG_MITM) {
+        log(`[SSE in] ${data.slice(0, 200)}`);
+      }
+
+      try {
+        const parsed = JSON.parse(data);
+        const result = transformFn(parsed, state);
+        if (result != null) {
+          const outputs = Array.isArray(result) ? result : [result];
+          for (const output of outputs) {
+            if (process.env.DEBUG_MITM) {
+              const len = output.length || output.byteLength || 0;
+              log(`[write binary frame] (${len}B) first 20B: ${Array.from(output.slice(0, 20)).join(',')}`);
+            }
+            res.write(Buffer.from(output));
+          }
+        }
+      } catch {
+        // Skip unparseable lines
+      }
+    }
+  }
+
+  // Flush: pass null to signal stream end
+  try {
+    const flushed = transformFn(null, state);
+    if (flushed != null) {
+      const outputs = Array.isArray(flushed) ? flushed : [flushed];
+      for (const output of outputs) {
+        res.write(output);
+      }
+    }
+  } catch { /* ignore flush errors */ }
+
+  res.end();
+}
+
+module.exports = { fetchRouter, pipeSSE, pipeTransformedSSE, pipeTransformedEventStream };

package/src/mitm/handlers/copilot.js

@@ -0,0 +1,35 @@
+const { err } = require("../logger");
+const { fetchRouter, pipeSSE } = require("./base");
+
+// Map Copilot endpoint → 9Router path
+const URL_MAP = {
+  "/chat/completions": "/v1/chat/completions",
+  "/v1/messages":      "/v1/messages",
+  "/responses":        "/v1/responses",
+};
+
+function resolveRouterPath(reqUrl) {
+  for (const [pattern, routerPath] of Object.entries(URL_MAP)) {
+    if (reqUrl.includes(pattern)) return routerPath;
+  }
+  return "/v1/chat/completions";
+}
+
+/**
+ * Intercept Copilot request — replace model and forward to matching 9Router endpoint
+ */
+async function intercept(req, res, bodyBuffer, mappedModel) {
+  try {
+    const body = JSON.parse(bodyBuffer.toString());
+    body.model = mappedModel;
+    const routerPath = resolveRouterPath(req.url);
+    const routerRes = await fetchRouter(body, routerPath, req.headers);
+    await pipeSSE(routerRes, res);
+  } catch (error) {
+    err(`[copilot] ${error.message}`);
+    if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: { message: error.message, type: "mitm_error" } }));
+  }
+}
+
+module.exports = { intercept };

package/src/mitm/handlers/cursor.js

@@ -0,0 +1,15 @@
+/**
+ * Cursor MITM handler — coming soon
+ * This feature is currently under development.
+ */
+async function intercept(req, res) {
+  res.writeHead(501, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({
+    error: {
+      message: "Cursor MITM support is coming soon.",
+      type: "not_implemented"
+    }
+  }));
+}
+
+module.exports = { intercept };