zevairouter 1.0.154 → 1.0.155

package/src/mitm/cert/rootCA.js

@@ -1,173 +0,0 @@
-const path = require("path");
-const fs = require("fs");
-const forge = require("node-forge");
-const { MITM_DIR } = require("../paths");
-
-const ROOT_CA_KEY_PATH = path.join(MITM_DIR, "rootCA.key");
-const ROOT_CA_CERT_PATH = path.join(MITM_DIR, "rootCA.crt");
-
-/**
- * Check if cert file is expired or expiring within 30 days
- */
-function isCertExpired(certPath) {
-  try {
-    const cert = forge.pki.certificateFromPem(fs.readFileSync(certPath, "utf8"));
-    const expiryThreshold = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
-    return cert.validity.notAfter < expiryThreshold;
-  } catch {
-    return true; // treat unreadable cert as expired
-  }
-}
-
-/**
- * Generate Root CA certificate (only once, auto-regenerate if expired)
- * This Root CA will sign all dynamic leaf certificates
- */
-async function generateRootCA() {
-  const exists = fs.existsSync(ROOT_CA_KEY_PATH) && fs.existsSync(ROOT_CA_CERT_PATH);
-  if (exists && !isCertExpired(ROOT_CA_CERT_PATH)) {
-    console.log("✅ Root CA already exists");
-    return { key: ROOT_CA_KEY_PATH, cert: ROOT_CA_CERT_PATH };
-  }
-  if (exists) {
-    console.log("🔐 Root CA expired or expiring soon — regenerating...");
-    try { fs.unlinkSync(ROOT_CA_KEY_PATH); } catch { /* ignore */ }
-    try { fs.unlinkSync(ROOT_CA_CERT_PATH); } catch { /* ignore */ }
-  }
-
-  if (!fs.existsSync(MITM_DIR)) {
-    fs.mkdirSync(MITM_DIR, { recursive: true });
-  }
-
-  console.log("🔐 Generating Root CA certificate...");
-
-  // Generate RSA key pair
-  const keys = forge.pki.rsa.generateKeyPair(2048);
-
-  // Create Root CA certificate
-  const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = "01";
-  cert.validity.notBefore = new Date();
-  cert.validity.notAfter = new Date();
-  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 10);
-
-  const attrs = [
-    { name: "commonName", value: "ZevaiRouter MITM Root CA" },
-    { name: "organizationName", value: "ZevaiRouter" },
-    { name: "countryName", value: "US" }
-  ];
-
-  cert.setSubject(attrs);
-  cert.setIssuer(attrs); // Self-signed
-
-  cert.setExtensions([
-    {
-      name: "basicConstraints",
-      cA: true,
-      critical: true
-    },
-    {
-      name: "keyUsage",
-      keyCertSign: true,
-      cRLSign: true,
-      critical: true
-    },
-    {
-      name: "subjectKeyIdentifier"
-    }
-  ]);
-
-  // Self-sign the certificate
-  cert.sign(keys.privateKey, forge.md.sha256.create());
-
-  // Save to disk
-  const privateKeyPem = forge.pki.privateKeyToPem(keys.privateKey);
-  const certPem = forge.pki.certificateToPem(cert);
-
-  fs.writeFileSync(ROOT_CA_KEY_PATH, privateKeyPem);
-  fs.writeFileSync(ROOT_CA_CERT_PATH, certPem);
-
-  console.log("✅ Root CA generated successfully");
-  return { key: ROOT_CA_KEY_PATH, cert: ROOT_CA_CERT_PATH };
-}
-
-/**
- * Load Root CA from disk
- */
-function loadRootCA() {
-  if (!fs.existsSync(ROOT_CA_KEY_PATH) || !fs.existsSync(ROOT_CA_CERT_PATH)) {
-    throw new Error("Root CA not found. Generate it first.");
-  }
-
-  const keyPem = fs.readFileSync(ROOT_CA_KEY_PATH, "utf8");
-  const certPem = fs.readFileSync(ROOT_CA_CERT_PATH, "utf8");
-
-  return {
-    key: forge.pki.privateKeyFromPem(keyPem),
-    cert: forge.pki.certificateFromPem(certPem)
-  };
-}
-
-/**
- * Generate leaf certificate for a specific domain, signed by Root CA
- */
-function generateLeafCert(domain, rootCA) {
-  // Generate key pair for leaf cert
-  const keys = forge.pki.rsa.generateKeyPair(2048);
-
-  // Create leaf certificate
-  const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = Math.floor(Math.random() * 1000000).toString();
-  cert.validity.notBefore = new Date();
-  cert.validity.notAfter = new Date();
-  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1);
-
-  cert.setSubject([
-    { name: "commonName", value: domain }
-  ]);
-
-  cert.setIssuer(rootCA.cert.subject.attributes);
-
-  cert.setExtensions([
-    {
-      name: "basicConstraints",
-      cA: false
-    },
-    {
-      name: "keyUsage",
-      digitalSignature: true,
-      keyEncipherment: true
-    },
-    {
-      name: "extKeyUsage",
-      serverAuth: true,
-      clientAuth: true
-    },
-    {
-      name: "subjectAltName",
-      altNames: [
-        { type: 2, value: domain }, // DNS
-        { type: 2, value: `*.${domain}` } // Wildcard
-      ]
-    }
-  ]);
-
-  // Sign with Root CA
-  cert.sign(rootCA.key, forge.md.sha256.create());
-
-  return {
-    key: forge.pki.privateKeyToPem(keys.privateKey),
-    cert: forge.pki.certificateToPem(cert)
-  };
-}
-
-module.exports = {
-  generateRootCA,
-  loadRootCA,
-  generateLeafCert,
-  isCertExpired,
-  ROOT_CA_CERT_PATH,
-  ROOT_CA_KEY_PATH
-};

package/src/mitm/config.js

@@ -1,87 +0,0 @@
-// All intercepted domains + URL patterns per tool
-
-const fs = require("fs");
-
-const IS_DEV = process.env.NODE_ENV === "development";
-
-// Resolve lsof absolute path — packaged apps / sudo secure_path may strip /usr/sbin from PATH
-const LSOF_BIN = (() => {
-  if (process.platform === "win32") return null;
-  for (const p of ["/usr/sbin/lsof", "/usr/bin/lsof", "/sbin/lsof"]) {
-    try { fs.accessSync(p, fs.constants.X_OK); return p; } catch { /* try next */ }
-  }
-  return "lsof"; // last-resort fallback (depends on PATH)
-})();
-
-const TARGET_HOSTS = [
-  "daily-cloudcode-pa.googleapis.com",
-  "cloudcode-pa.googleapis.com",
-  "api.individual.githubcopilot.com",
-  "q.us-east-1.amazonaws.com",
-  "api2.cursor.sh",
-];
-
-const URL_PATTERNS = {
-  antigravity: [":generateContent", ":streamGenerateContent"],
-  copilot: ["/chat/completions", "/v1/messages", "/responses"],
-  kiro: ["/generateAssistantResponse"],
-  cursor: ["/BidiAppend", "/RunSSE", "/RunPoll", "/Run"],
-};
-
-// Synonym map: rawModel from request → canonical alias key in mitmAlias DB
-const MODEL_SYNONYMS = {
-  antigravity: {
-    "gemini-default": "gemini-3.5-flash-low",
-    "gemini-3.5-flash-high": "gemini-3-flash-agent",
-    "gemini-3.5-flash-medium": "gemini-3.5-flash-low",
-    "gemini-3.5-flash-extra-low": "gemini-3.5-flash-extra-low",
-    "gemini-3.1-pro-high": "gemini-pro-agent",
-    "gemini-3-pro-high": "gemini-pro-agent",
-    "gemini-3-pro-low": "gemini-3.1-pro-low",
-  },
-};
-
-// Pattern fallback: rawModel regex → canonical alias key (when exact + prefix match fail)
-// Order matters: more specific patterns first. Catches AG renamed variants (e.g. gemini-pro-agent)
-const MODEL_PATTERNS = {
-  antigravity: [
-    { match: /flash.*extra.*low|extra.*low.*flash|flash.*low|low.*flash/i, alias: "gemini-3.5-flash-extra-low" },
-    { match: /flash.*medium|medium.*flash/i,                       alias: "gemini-3.5-flash-low" },
-    { match: /flash.*agent|agent.*flash|flash/i,                   alias: "gemini-3-flash-agent" },
-    { match: /pro.*low|low.*pro/i,                                 alias: "gemini-3.1-pro-low" },
-    { match: /gemini.*pro|pro.*gemini/i,                           alias: "gemini-pro-agent" },
-    { match: /opus/i,                                              alias: "claude-opus-4-6-thinking" },
-    { match: /sonnet|claude/i,                                     alias: "claude-sonnet-4-6" },
-    { match: /gpt.*oss|oss/i,                                      alias: "gpt-oss-120b-medium" },
-  ],
-};
-
-// Models that must NEVER be re-routed — always passthrough to the real upstream, even when
-// the tool's other models are mapped. Antigravity's tab-autocomplete (`tab_jump_flash_lite_preview`,
-// `tab_flash_lite_preview`, requestType tab/tab_jump) is latency-critical inline completion; routing
-// it through ZevaiRouter to an external chat model makes typing laggy and burns provider quota per
-// keystroke. Without this guard the broad `flash` pattern in MODEL_PATTERNS hijacks them onto the
-// flash-agent slot. Verified via MITM dump capture of streamGenerateContent (see AI_JOURNAL).
-const MODEL_NO_MAP = {
-  antigravity: [/^tab[_-]/i],
-};
-
-// URL substrings whose request/response should NOT be dumped to file (telemetry, polling, empty)
-const LOG_BLACKLIST_URL_PARTS = [
-  "recordCodeAssistMetrics",
-  "recordTrajectoryAnalytics",
-  "fetchAdminControls",
-  "listExperiments",
-  "fetchUserInfo",
-];
-
-function getToolForHost(host) {
-  const h = (host || "").split(":")[0];
-  if (h === "api.individual.githubcopilot.com") return "copilot";
-  if (h === "daily-cloudcode-pa.googleapis.com" || h === "cloudcode-pa.googleapis.com") return "antigravity";
-  if (h === "q.us-east-1.amazonaws.com") return "kiro";
-  if (h === "api2.cursor.sh") return "cursor";
-  return null;
-}
-
-module.exports = { IS_DEV, LSOF_BIN, TARGET_HOSTS, URL_PATTERNS, MODEL_SYNONYMS, MODEL_PATTERNS, MODEL_NO_MAP, LOG_BLACKLIST_URL_PARTS, getToolForHost };

package/src/mitm/dbReader.js

@@ -1,22 +0,0 @@
-// CJS reader for MITM standalone process. Reads mitmAlias from JSON cache
-// at $DATA_DIR/mitm/aliases.json (synced by app from SQLite on startup + writes).
-// JSON-only: no SQLite native binding required in MITM bundle.
-const fs = require("fs");
-const path = require("path");
-const { DATA_DIR } = require("./paths");
-
-const CACHE_FILE = path.join(DATA_DIR, "mitm", "aliases.json");
-
-function readCache() {
-  try {
-    if (!fs.existsSync(CACHE_FILE)) return null;
-    return JSON.parse(fs.readFileSync(CACHE_FILE, "utf-8"));
-  } catch { return null; }
-}
-
-function getMitmAlias(toolName) {
-  const all = readCache();
-  return all?.[toolName] || null;
-}
-
-module.exports = { getMitmAlias };

package/src/mitm/dns/dnsConfig.js

@@ -1,266 +0,0 @@
-const { exec, spawn, execSync } = require("child_process");
-const fs = require("fs");
-const path = require("path");
-const os = require("os");
-const { log, err } = require("../logger");
-const { TOOL_HOSTS } = require("../../shared/constants/mitmToolHosts.js");
-const { runElevatedPowerShell, isAdmin } = require("../winElevated.js");
-
-/**
- * Atomic-ish write for Windows hosts file with rollback on failure.
- * Strategy: write `.new` sibling → rename current to `.bak` → rename `.new` to target.
- * If anything fails mid-way, restore from `.bak`. Same-volume renames are atomic on NTFS.
- */
-function atomicWriteHostsWin(target, originalContent, newContent) {
-  const tmpNew = `${target}.zevai.new`;
-  const tmpBak = `${target}.zevai.bak`;
-  try {
-    fs.writeFileSync(tmpNew, newContent, "utf8");
-    try { fs.unlinkSync(tmpBak); } catch { /* none */ }
-    fs.renameSync(target, tmpBak);
-    try {
-      fs.renameSync(tmpNew, target);
-    } catch (e) {
-      // Rollback: restore original
-      try { fs.renameSync(tmpBak, target); } catch { fs.writeFileSync(target, originalContent, "utf8"); }
-      throw e;
-    }
-    try { fs.unlinkSync(tmpBak); } catch { /* best effort */ }
-  } finally {
-    try { fs.unlinkSync(tmpNew); } catch { /* already moved or never created */ }
-  }
-}
-
-const IS_WIN = process.platform === "win32";
-const IS_MAC = process.platform === "darwin";
-const HOSTS_FILE = IS_WIN
-  ? path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts")
-  : "/etc/hosts";
-
-/** True when `sudo` exists (e.g. missing on minimal Docker images like Alpine). */
-function isSudoAvailable() {
-  if (IS_WIN) return false;
-  try {
-    execSync("command -v sudo", { stdio: "ignore", windowsHide: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function canRunSudoWithoutPassword() {
-  if (IS_WIN || !isSudoAvailable()) return true;
-  try {
-    execSync("sudo -n true", { stdio: "ignore", windowsHide: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function isSudoPasswordRequired() {
-  return !IS_WIN && isSudoAvailable() && !canRunSudoWithoutPassword();
-}
-
-/**
- * Execute command with sudo password via stdin (macOS/Linux only).
- * Without sudo in PATH (containers), runs via sh — same user, no elevation.
- */
-function execWithPassword(command, password) {
-  return new Promise((resolve, reject) => {
-    const useSudo = isSudoAvailable();
-    const child = useSudo
-      ? spawn("sudo", ["-S", "sh", "-c", command], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true })
-      : spawn("sh", ["-c", command], { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
-
-    let stdout = "";
-    let stderr = "";
-    child.stdout.on("data", (d) => { stdout += d; });
-    child.stderr.on("data", (d) => { stderr += d; });
-
-    child.on("close", (code) => {
-      if (code === 0) resolve(stdout);
-      else reject(new Error(stderr || `Exit code ${code}`));
-    });
-
-    if (useSudo) {
-      child.stdin.write(`${password}\n`);
-      child.stdin.end();
-    }
-  });
-}
-
-/**
- * Trim trailing blank lines/whitespace, ensure file ends with exactly one newline.
- */
-function normalizeHostsContent(content) {
-  const eol = IS_WIN ? "\r\n" : "\n";
-  return content.replace(/[\r\n\s]+$/g, "") + eol;
-}
-
-/**
- * Flush DNS cache (macOS/Linux)
- */
-async function flushDNS(sudoPassword) {
-  if (IS_WIN) return; // Windows flushes inline via ipconfig
-  if (IS_MAC) {
-    await execWithPassword("dscacheutil -flushcache && killall -HUP mDNSResponder", sudoPassword);
-  } else {
-    await execWithPassword("resolvectl flush-caches 2>/dev/null || true", sudoPassword);
-  }
-}
-
-/**
- * Check if DNS entry exists for a specific host
- */
-function checkDNSEntry(host = null) {
-  try {
-    const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
-    if (host) return hostsContent.includes(host);
-    // Legacy: check all antigravity hosts (backward compat)
-    return TOOL_HOSTS.antigravity.every(h => hostsContent.includes(h));
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Check DNS status per tool — returns { [tool]: boolean }
- */
-function checkAllDNSStatus() {
-  try {
-    const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
-    const result = {};
-    for (const [tool, hosts] of Object.entries(TOOL_HOSTS)) {
-      result[tool] = hosts.every(h => hostsContent.includes(h));
-    }
-    return result;
-  } catch {
-    return Object.fromEntries(Object.keys(TOOL_HOSTS).map(t => [t, false]));
-  }
-}
-
-/**
- * Add DNS entries for a specific tool
- */
-async function addDNSEntry(tool, sudoPassword) {
-  const hosts = TOOL_HOSTS[tool];
-  if (!hosts) throw new Error(`Unknown tool: ${tool}`);
-
-  const entriesToAdd = hosts.filter(h => !checkDNSEntry(h));
-  if (entriesToAdd.length === 0) {
-    log(`🌐 DNS ${tool}: already active`);
-    return;
-  }
-
-  try {
-    if (IS_WIN) {
-      // Read → trim → append → atomic write (Node-side, no CLI size limit)
-      const current = fs.readFileSync(HOSTS_FILE, "utf8");
-      const trimmed = current.replace(/[\r\n\s]+$/g, "");
-      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\r\n");
-      const next = `${trimmed}\r\n${toAppend}\r\n`;
-      atomicWriteHostsWin(HOSTS_FILE, current, next);
-      await runElevatedPowerShell("ipconfig /flushdns | Out-Null");
-    } else {
-      const current = fs.readFileSync(HOSTS_FILE, "utf8");
-      const trimmed = current.replace(/[\r\n\s]+$/g, "");
-      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\n");
-      const next = `${trimmed}\n${toAppend}\n`;
-      // Use tee via sudo to overwrite atomically — escape single quotes in content
-      const escaped = next.replace(/'/g, "'\\''");
-      await execWithPassword(`printf '%s' '${escaped}' | tee ${HOSTS_FILE} > /dev/null`, sudoPassword);
-      await flushDNS(sudoPassword);
-    }
-    log(`🌐 DNS ${tool}: ✅ added ${entriesToAdd.join(", ")}`);
-  } catch (error) {
-    const msg = error.message?.includes("incorrect password") ? "Wrong sudo password" : `Failed to add DNS entry: ${error.message}`;
-    throw new Error(msg);
-  }
-}
-
-/**
- * Remove DNS entries for a specific tool
- */
-async function removeDNSEntry(tool, sudoPassword) {
-  const hosts = TOOL_HOSTS[tool];
-  if (!hosts) throw new Error(`Unknown tool: ${tool}`);
-
-  const entriesToRemove = hosts.filter(h => checkDNSEntry(h));
-  if (entriesToRemove.length === 0) {
-    log(`🌐 DNS ${tool}: already inactive`);
-    return;
-  }
-
-  try {
-    if (IS_WIN) {
-      const current = fs.readFileSync(HOSTS_FILE, "utf8");
-      const filtered = current.split(/\r?\n/).filter(l => !entriesToRemove.some(h => l.includes(h))).join("\r\n");
-      const next = filtered.replace(/[\r\n\s]+$/g, "") + "\r\n";
-      atomicWriteHostsWin(HOSTS_FILE, current, next);
-      await runElevatedPowerShell("ipconfig /flushdns | Out-Null");
-    } else {
-      const current = fs.readFileSync(HOSTS_FILE, "utf8");
-      const filtered = current.split(/\r?\n/).filter(l => !entriesToRemove.some(h => l.includes(h))).join("\n");
-      const next = filtered.replace(/[\r\n\s]+$/g, "") + "\n";
-      const escaped = next.replace(/'/g, "'\\''");
-      await execWithPassword(`printf '%s' '${escaped}' | tee ${HOSTS_FILE} > /dev/null`, sudoPassword);
-      await flushDNS(sudoPassword);
-    }
-    log(`🌐 DNS ${tool}: ✅ removed ${entriesToRemove.join(", ")}`);
-  } catch (error) {
-    const msg = error.message?.includes("incorrect password") ? "Wrong sudo password" : `Failed to remove DNS entry: ${error.message}`;
-    throw new Error(msg);
-  }
-}
-
-/**
- * Remove ALL tool DNS entries (used when stopping server)
- */
-async function removeAllDNSEntries(sudoPassword) {
-  for (const tool of Object.keys(TOOL_HOSTS)) {
-    try {
-      await removeDNSEntry(tool, sudoPassword);
-    } catch (e) {
-      err(`DNS ${tool}: failed to remove — ${e.message}`);
-    }
-  }
-}
-
-/**
- * Sync removal of ALL tool DNS entries — for use during process shutdown
- * when async ops aren't safe. Assumes caller already has root/admin rights.
- */
-function removeAllDNSEntriesSync() {
-  try {
-    if (!fs.existsSync(HOSTS_FILE)) return;
-    const allHosts = Object.values(TOOL_HOSTS).flat();
-    const content = fs.readFileSync(HOSTS_FILE, "utf8");
-    const eol = IS_WIN ? "\r\n" : "\n";
-    const filtered = content.split(/\r?\n/).filter(l => !allHosts.some(h => l.includes(h))).join(eol);
-    const next = filtered.replace(/[\r\n\s]+$/g, "") + eol;
-    if (next === content) return;
-    fs.writeFileSync(HOSTS_FILE, next, "utf8");
-    if (IS_WIN) {
-      try { execSync("ipconfig /flushdns", { windowsHide: true, stdio: "ignore" }); } catch { /* ignore */ }
-    } else if (IS_MAC) {
-      try { execSync("dscacheutil -flushcache && killall -HUP mDNSResponder", { stdio: "ignore" }); } catch { /* ignore */ }
-    } else {
-      try { execSync("resolvectl flush-caches 2>/dev/null || true", { stdio: "ignore" }); } catch { /* ignore */ }
-    }
-  } catch { /* best effort during shutdown */ }
-}
-
-module.exports = {
-  TOOL_HOSTS,
-  addDNSEntry,
-  removeDNSEntry,
-  removeAllDNSEntries,
-  removeAllDNSEntriesSync,
-  execWithPassword,
-  isSudoAvailable,
-  canRunSudoWithoutPassword,
-  isSudoPasswordRequired,
-  checkDNSEntry,
-  checkAllDNSStatus,
-};

package/src/mitm/handlers/antigravity.js

@@ -1,33 +0,0 @@
-const { err, createResponseDumper } = require("../logger");
-const { IS_DEV } = require("../config");
-const { fetchRouter, pipeSSE } = require("./base");
-
-/**
- * Intercept Antigravity request — forward Gemini body as-is to /v1/chat/completions.
- * Router auto-detects format via body.userAgent==="antigravity" + body.request.contents,
- * runs antigravity→openai→provider→openai→antigravity translators internally.
- */
-async function intercept(req, res, bodyBuffer, mappedModel) {
-  const dumper = IS_DEV ? createResponseDumper(req, "intercept-antigravity") : null;
-  const isStream = req.url.includes(":streamGenerateContent");
-  try {
-    const body = JSON.parse(bodyBuffer.toString());
-    if (body.model) body.model = mappedModel;
-
-    const routerRes = await fetchRouter(body, "/v1/chat/completions", req.headers);
-    await pipeSSE(routerRes, res, dumper);
-  } catch (error) {
-    err(`[antigravity] ${error.message}`);
-    if (dumper) { dumper.writeChunk(`\n[ERROR] ${error.message}\n`); dumper.end(); }
-    // For stream endpoint, send SSE error chunk so SDK doesn't hang waiting
-    if (isStream) {
-      if (!res.headersSent) res.writeHead(200, { "Content-Type": "text/event-stream" });
-      res.end(`data: ${JSON.stringify({ error: { message: error.message } })}\r\n\r\n`);
-    } else {
-      if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: { message: error.message, type: "mitm_error" } }));
-    }
-  }
-}
-
-module.exports = { intercept };