- Refines the overall structure of the CLI tools and MITM server functionalities.

- Add buildQwenBaseUrl function to construct URLs for Qwen resources.
- Update buildProviderUrl to support Qwen model requests.
- Enhance token refresh logic to include provider-specific data for Qwen.
- Refactor CLI Tools page to exclude MITM tools and streamline model retrieval.
- Introduce new components for MITM server management.
- Update API routes to handle Qwen-specific resource URLs and improve error handling.

src/mitm/cert/generate.js

@@ -2,10 +2,18 @@ const path = require("path");
 const fs = require("fs");
 const { MITM_DIR } = require("../paths");
 
-const TARGET_HOST = "daily-cloudcode-pa.googleapis.com";
+// Wildcard domains — covers all subdomains without needing cert update per tool
+const WILDCARD_DOMAINS = [
+  "*.googleapis.com",
+  "*.githubcopilot.com",
+  "*.individual.githubcopilot.com",
+  "*.business.githubcopilot.com"
+];
 
 /**
- * Generate self-signed SSL certificate using selfsigned (pure JS, no openssl needed)
+ * Generate self-signed SSL certificate with wildcard SAN.
+ * Covers all current and future MITM tool domains automatically.
+ * Uses selfsigned (pure JS, no openssl needed).
  */
 async function generateCert() {
   const certDir = MITM_DIR;
@@ -22,7 +30,7 @@ async function generateCert() {
   }
 
   const selfsigned = require("selfsigned");
-  const attrs = [{ name: "commonName", value: TARGET_HOST }];
+  const attrs = [{ name: "commonName", value: "9router-mitm" }];
   const notAfter = new Date();
   notAfter.setFullYear(notAfter.getFullYear() + 1);
   const pems = await selfsigned.generate(attrs, {
@@ -30,14 +38,17 @@ async function generateCert() {
     algorithm: "sha256",
     notAfterDate: notAfter,
     extensions: [
-      { name: "subjectAltName", altNames: [{ type: 2, value: TARGET_HOST }] }
+      {
+        name: "subjectAltName",
+        altNames: WILDCARD_DOMAINS.map(domain => ({ type: 2, value: domain }))
+      }
     ]
   });
 
   fs.writeFileSync(keyPath, pems.private);
   fs.writeFileSync(certPath, pems.cert);
 
-  console.log(`✅ Generated SSL certificate for ${TARGET_HOST}`);
+  console.log(`✅ Generated wildcard SSL certificate: ${WILDCARD_DOMAINS.join(", ")}`);
   return { key: keyPath, cert: certPath };
 }
 

src/mitm/cert/install.js

@@ -26,10 +26,14 @@ async function checkCertInstalled(certPath) {
 function checkCertInstalledMac(certPath) {
   return new Promise((resolve) => {
     try {
-      // security outputs fingerprint without colons (e.g. "078B6B5F..."), strip them before grep
       const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
-      exec(`security find-certificate -a -Z /Library/Keychains/System.keychain | grep -i "${fingerprint}"`, (error, stdout) => {
-        resolve(!error && !!stdout?.trim());
+      // security verify-cert returns 0 only if cert is trusted by system policy
+      exec(`security verify-cert -c "${certPath}" -p ssl -k /Library/Keychains/System.keychain 2>/dev/null`, (error) => {
+        if (!error) return resolve(true);
+        // Fallback: check if fingerprint appears in System keychain with trust
+        exec(`security dump-trust-settings -d 2>/dev/null | grep -i "${fingerprint}"`, (err2, stdout2) => {
+          resolve(!err2 && !!stdout2?.trim());
+        });
       });
     } catch {
       resolve(false);