zevairouter 1.0.185 → 1.0.186

package/cli/app/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Unreleased
 
+# v1.0.186 (2026-08-02)
+
+## Fixes
+- **PID files can no longer make the app kill an unrelated process**: stopping the MITM proxy, the tunnel, or the app during an update read a PID from a file and signalled it after only checking that *some* process held that PID. A crash leaves the PID file behind (the cleanup paths only run on a graceful stop) and operating systems recycle PIDs, so once the counter wrapped, those paths signalled whatever process had inherited the number — with `sudo kill -9` in the MITM and updater paths, which could reach a root-owned process. Every PID is now persisted together with a start-time token (`/proc/<pid>/stat` field 22 on Linux, `ps -o lstart=` on macOS, `Process.StartTime` on Windows), and nothing is signalled unless that token still matches the live process. PID files written by earlier versions carry no token and are accepted only when the live process's command line still matches the expected program. Force-kill escalation re-proves identity immediately before each signal, since the wait after `SIGTERM` is itself long enough for a PID to be recycled.
+- **MITM status no longer reports a stranger's process as the running proxy**: `startServer()` adopted any live PID found in `.mitm.pid` as "our" server and returned `running: true`, so after a crash and PID reuse the dashboard showed the proxy as up while nothing listened on port 443 — and the next stop signalled that unrelated process. Adoption now requires the same identity proof.
+
 # v1.0.185 (2026-08-02)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.185",
+  "version": "1.0.186",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"

package/cli/app/src/lib/process/pidIdentity.js

@@ -0,0 +1,237 @@
+// A pid on its own is not proof of identity. Pids are recycled, and the cleanup
+// that removes a pid file only runs on a graceful stop — a crash (SIGKILL, OOM,
+// panic) leaves the file behind. Once the pid counter wraps, that file names a
+// process which has nothing to do with us, and signalling it kills a bystander.
+// The MITM stop paths escalate to `sudo kill -9`, so the bystander can be a root
+// process.
+//
+// Every pid we persist is therefore stored together with a start-time token, and
+// every signal is gated on that token still matching the live process. The token
+// is the one identity fact about a process that a later pid reuse cannot forge:
+// Linux exposes it as field 22 of /proc/<pid>/stat, other Unixes as `ps -o
+// lstart=`, Windows as Process.StartTime.
+//
+// CommonJS on purpose: src/mitm/manager.js requires this, and the ESM callers
+// (appUpdater, tunnel/cloudflare/pid) import it through normal CJS interop.
+
+const fs = require("fs");
+const { execFileSync } = require("child_process");
+
+const IS_WIN = process.platform === "win32";
+const IS_LINUX = process.platform === "linux";
+const PROBE_TIMEOUT_MS = 5_000;
+
+function isValidPid(value) {
+  // 2^22 is the ceiling Linux allows for pid_max; anything past it is corruption.
+  return Number.isInteger(value) && value > 0 && value <= 4_194_304;
+}
+
+function runProbe(file, args) {
+  try {
+    return execFileSync(file, args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: PROBE_TIMEOUT_MS,
+      windowsHide: true,
+    });
+  } catch {
+    return null;
+  }
+}
+
+// Field 22 of /proc/<pid>/stat. The command name sits in parentheses and may
+// itself contain spaces or parentheses, so index from the last ") " rather than
+// splitting the whole line.
+function parseLinuxStartTime(output, expectedPid) {
+  if (typeof output !== "string" || /[\r\n]/.test(output.trim())) return null;
+  const value = output.trim();
+  const openParen = value.indexOf(" (");
+  const closeParen = value.lastIndexOf(") ");
+  if (openParen < 1 || closeParen <= openParen + 2) return null;
+  if (Number(value.slice(0, openParen)) !== expectedPid) return null;
+  const fields = value.slice(closeParen + 2).split(/\s+/);
+  const startTime = fields[19];
+  if (fields.length < 20 || !/^\d+$/.test(startTime)) return null;
+  return startTime;
+}
+
+// A stable, opaque "this exact process incarnation" string, or null when the
+// process is gone or unreadable. Callers must treat null as "cannot verify".
+function readProcessStartToken(pid) {
+  if (!isValidPid(pid)) return null;
+
+  if (IS_LINUX) {
+    let raw = null;
+    try {
+      raw = fs.readFileSync(`/proc/${pid}/stat`, "utf8");
+    } catch {
+      return null;
+    }
+    const startTime = parseLinuxStartTime(raw, pid);
+    return startTime ? `${pid}:${startTime}` : null;
+  }
+
+  if (IS_WIN) {
+    const out = runProbe("powershell", [
+      "-NonInteractive",
+      "-NoProfile",
+      "-Command",
+      `(Get-Process -Id ${pid} -ErrorAction Stop).StartTime.Ticks`,
+    ]);
+    const ticks = String(out || "").trim();
+    return /^\d+$/.test(ticks) ? `${pid}:${ticks}` : null;
+  }
+
+  // macOS and other Unixes: lstart is the process start wall-clock, stable for
+  // the life of the process. ps is readable for processes owned by other users,
+  // which matters because the MITM server runs as root.
+  const out = runProbe("ps", ["-o", "lstart=", "-p", String(pid)]);
+  const lines = String(out || "").split(/\r?\n/).filter((line) => line.trim());
+  if (lines.length !== 1) return null;
+  const started = lines[0].trim();
+  return started ? `${pid}:${started}` : null;
+}
+
+// Full command line of a live process, used only as the fallback identity proof
+// for legacy pid files that predate start tokens.
+function readProcessCommand(pid) {
+  if (!isValidPid(pid)) return null;
+
+  if (IS_WIN) {
+    const out = runProbe("powershell", [
+      "-NonInteractive",
+      "-NoProfile",
+      "-Command",
+      `(Get-CimInstance Win32_Process -Filter "ProcessId=${pid}").CommandLine`,
+    ]);
+    const command = String(out || "").trim();
+    return command || null;
+  }
+
+  const out = runProbe("ps", ["-o", "command=", "-p", String(pid)]);
+  const lines = String(out || "").split(/\r?\n/).filter((line) => line.trim());
+  if (lines.length !== 1) return null;
+  const command = lines[0].trim();
+  return command || null;
+}
+
+// EPERM/EACCES mean the process exists but is owned by another user — the MITM
+// server runs as root, so treating that as "dead" would orphan a live listener.
+function isProcessAlive(pid) {
+  if (!isValidPid(pid)) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM" || err.code === "EACCES";
+  }
+}
+
+function writePidFile(filePath, pid, { kind = "process" } = {}) {
+  const numericPid = Number(pid);
+  if (!isValidPid(numericPid)) return false;
+  const record = {
+    v: 1,
+    kind,
+    pid: numericPid,
+    // Captured now, while we know the process is the one we just spawned.
+    startToken: readProcessStartToken(numericPid),
+    platform: process.platform,
+    writtenAt: new Date().toISOString(),
+  };
+  try {
+    const tempPath = `${filePath}.${process.pid}.tmp`;
+    fs.writeFileSync(tempPath, JSON.stringify(record));
+    fs.renameSync(tempPath, filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// Accepts both the JSON record written above and the bare-integer files written
+// by older versions, so an in-place upgrade can still stop a running server.
+function readPidFile(filePath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath, "utf8").trim();
+  } catch {
+    return null;
+  }
+  if (!raw) return null;
+
+  if (/^\d+$/.test(raw)) {
+    const pid = Number(raw);
+    return isValidPid(pid) ? { pid, startToken: null, kind: null, legacy: true } : null;
+  }
+
+  try {
+    const parsed = JSON.parse(raw);
+    const pid = Number(parsed?.pid);
+    if (!isValidPid(pid)) return null;
+    return {
+      pid,
+      startToken: typeof parsed.startToken === "string" && parsed.startToken ? parsed.startToken : null,
+      kind: typeof parsed.kind === "string" ? parsed.kind : null,
+      legacy: false,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve a pid file to a pid that is safe to signal.
+ *
+ * Returns { pid, reason } where a non-null pid means identity was proven. Any
+ * other outcome returns pid null with a reason, and callers must not signal.
+ *
+ * @param {string} filePath pid file to read
+ * @param {RegExp} [options.commandPattern] identity proof for legacy pid files
+ */
+function resolveVerifiedPid(filePath, { commandPattern = null } = {}) {
+  const record = readPidFile(filePath);
+  if (!record) return { pid: null, reason: "no_pid_file" };
+  if (!isProcessAlive(record.pid)) return { pid: null, reason: "not_running", pidFileStale: true };
+
+  const liveToken = readProcessStartToken(record.pid);
+
+  if (record.startToken) {
+    if (!liveToken) return { pid: null, reason: "identity_unreadable" };
+    if (liveToken !== record.startToken) {
+      // Same pid number, different process incarnation: the pid was recycled.
+      return { pid: null, reason: "pid_recycled", pidFileStale: true };
+    }
+    return { pid: record.pid, reason: "verified_start_token" };
+  }
+
+  // Legacy file with no recorded token. The best available proof is that the
+  // live process still looks like the thing we were managing.
+  if (!commandPattern) return { pid: null, reason: "identity_unverifiable" };
+  const command = readProcessCommand(record.pid);
+  if (!command) return { pid: null, reason: "identity_unreadable" };
+  if (!commandPattern.test(command)) {
+    return { pid: null, reason: "command_mismatch", pidFileStale: true };
+  }
+  return { pid: record.pid, reason: "verified_command" };
+}
+
+function removePidFile(filePath) {
+  try {
+    fs.rmSync(filePath, { force: true });
+  } catch {
+    /* best effort */
+  }
+}
+
+module.exports = {
+  isValidPid,
+  isProcessAlive,
+  readProcessStartToken,
+  readProcessCommand,
+  writePidFile,
+  readPidFile,
+  resolveVerifiedPid,
+  removePidFile,
+  parseLinuxStartTime,
+};

package/cli/cli.js

@@ -51,6 +51,24 @@ function loadPkg() {
     return require("./package.json");
   }
 }
+
+// Pid-file identity verification. In the published package this module ships
+// under app/src/; in the repo it lives at ../src/. Returns null when neither
+// resolves, and callers must then refuse to signal — killing an unverified pid
+// is exactly the bug this module exists to prevent.
+let pidIdentityCache;
+function loadPidIdentity() {
+  if (pidIdentityCache !== undefined) return pidIdentityCache;
+  for (const candidate of ["./app/src/lib/process/pidIdentity", "../src/lib/process/pidIdentity"]) {
+    try {
+      pidIdentityCache = require(candidate);
+      return pidIdentityCache;
+    } catch { /* try next layout */ }
+  }
+  console.warn("⚠️  Pid verification module missing — skipping pid-file process cleanup to avoid killing an unrelated process.");
+  pidIdentityCache = null;
+  return pidIdentityCache;
+}
 const pkg = loadPkg();
 const args = process.argv.slice(2);
 
@@ -790,28 +808,33 @@ function getAppDataDir() {
     : path.join(os.homedir(), ".zevai");
 }
 
-// Kill PID from file (best-effort, removes file after)
-function killByPidFile(pidFile) {
+// Kill PID from file, but only once the pid is proven to still be the process we
+// started. A pid file outlives a crash and pids get recycled, so an unverified
+// pid here means SIGKILL lands on an unrelated process.
+function killByPidFile(pidFile, commandPattern = null) {
   try {
-    if (!fs.existsSync(pidFile)) return;
-    const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim(), 10);
-    if (!pid) return;
-    try {
-      if (process.platform === "win32") {
-        execSync(`taskkill /F /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 3000 });
-      } else {
-        process.kill(pid, "SIGKILL");
-      }
-    } catch { }
-    try { fs.unlinkSync(pidFile); } catch { }
+    const pidIdentity = loadPidIdentity();
+    if (!pidIdentity) return;
+    const { resolveVerifiedPid, removePidFile } = pidIdentity;
+    const { pid } = resolveVerifiedPid(pidFile, { commandPattern });
+    if (pid) {
+      try {
+        if (process.platform === "win32") {
+          execSync(`taskkill /F /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 3000 });
+        } else {
+          process.kill(pid, "SIGKILL");
+        }
+      } catch { }
+    }
+    removePidFile(pidFile);
   } catch { }
 }
 
 // Kill tunnel processes (cloudflared/tailscale) by their PID files
 function killTunnelByPidFile() {
   const tunnelDir = path.join(getAppDataDir(), "tunnel");
-  killByPidFile(path.join(tunnelDir, "cloudflared.pid"));
-  killByPidFile(path.join(tunnelDir, "tailscale.pid"));
+  killByPidFile(path.join(tunnelDir, "cloudflared.pid"), /cloudflared/i);
+  killByPidFile(path.join(tunnelDir, "tailscale.pid"), /tailscale/i);
 }
 
 // Kill cloudflared whose --url targets this app's port (covers stale PID file case)
@@ -969,30 +992,45 @@ function waitForExit(pid, timeoutMs) {
 function killProxyByPidFile() {
   try {
     const pidFile = path.join(getAppDataDir(), "mitm", ".mitm.pid");
-    if (!fs.existsSync(pidFile)) return;
-    const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim(), 10);
-    if (!pid) return;
+    const pidIdentity = loadPidIdentity();
+    if (!pidIdentity) return;
+    const { resolveVerifiedPid, removePidFile, readProcessStartToken } = pidIdentity;
+    // This escalates to `sudo kill -9`, so an unverified pid could kill an
+    // unrelated root-owned process after the pid was recycled.
+    const { pid } = resolveVerifiedPid(pidFile, {
+      commandPattern: /(mitm[\\/]server\.js|mitm[\\/]+server\b)/i,
+    });
+    if (!pid) {
+      removePidFile(pidFile);
+      return;
+    }
+
+    // Escalation waits seconds after SIGTERM — long enough for the process to
+    // exit and its pid to be handed to something else. Re-prove identity right
+    // before each force kill, the same way killVerifiedRouterOnPort does.
+    const startToken = readProcessStartToken(pid);
+    const stillSameProcess = () => readProcessStartToken(pid) === startToken;
 
     if (process.platform === "win32") {
       // Graceful first (lets server cleanup hosts), then force
       try { execSync(`taskkill /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 2000 }); } catch { }
-      if (!waitForExit(pid, 1500)) {
+      if (!waitForExit(pid, 1500) && stillSameProcess()) {
         try { execSync(`taskkill /F /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 3000 }); } catch { }
       }
       // Last-resort: PowerShell Stop-Process (sometimes succeeds where taskkill fails on admin processes)
-      if (!waitForExit(pid, 500)) {
+      if (!waitForExit(pid, 500) && stillSameProcess()) {
         try { execSync(`powershell -NonInteractive -WindowStyle Hidden -Command "Stop-Process -Id ${pid} -Force"`, { stdio: "ignore", windowsHide: true, timeout: 3000 }); } catch { }
       }
     } else {
       // SIGTERM via cached sudo token first
       try { execSync(`sudo -n kill -TERM ${pid} 2>/dev/null`, { stdio: "ignore", timeout: 2000 }); }
       catch { try { process.kill(pid, "SIGTERM"); } catch { } }
-      if (!waitForExit(pid, 1500)) {
+      if (!waitForExit(pid, 1500) && stillSameProcess()) {
         try { execSync(`sudo -n kill -9 ${pid} 2>/dev/null`, { stdio: "ignore", timeout: 2000 }); }
         catch { try { process.kill(pid, "SIGKILL"); } catch { } }
       }
     }
-    try { fs.unlinkSync(pidFile); } catch { }
+    removePidFile(pidFile);
   } catch { }
 }
 

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.185",
+  "version": "1.0.186",
   "private": true,
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.185",
+  "version": "1.0.186",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "cli/cli.js"