fix(mitm): add Linux cert install and skip sudo password when root by NekoMonci12 · Pull Request #1999 · diegosouzapw/OmniRoute

NekoMonci12 · 2026-05-06T13:18:17Z

Summary

Add Linux certificate management via update-ca-certificates for Docker support. Skip sudo password validation when running as root, matching the existing cli-tools route behavior.

Turbopack resolveAlias (@/mitm/manager → manager.stub.ts) was designed
for build-time safety but Next.js applies aliases to ALL imports
including dynamic ones. This caused await import("@/mitm/manager") at
runtime to load the stub, which silently returned fake {running: true}
without spawning the MITM proxy. The UI showed "MITM proxy started"
but nothing was actually running.

Fix introduces a two-path design:

@/mitm/manager → stub (build-time, safe for Turbopack)
@/mitm/manager.runtime → real manager (runtime, bypasses alias)

Route handlers now dynamic-import from manager.runtime, which
re-exports from ./manager and does NOT match the alias pattern.

Additional fixes:

Make stub throw explicit errors at runtime so misconfiguration is
immediately visible instead of silently faking success
Add server.cjs to outputFileTracingIncludes (NFT trace) and Dockerfile
COPY so the MITM server binary exists in standalone/Docker output

Related Issues

Closes #
Related to #

Validation

npm run lint
npm run test:unit
npm run test:coverage
Coverage is still >= 60% for statements, lines, functions, and branches
SonarQube PR analysis is green or any remaining issues are explicitly documented below

Tests Added Or Updated

List every changed or added automated test file.
If no production code changed, state that here.

Coverage Notes

If this PR changes src/, open-sse/, electron/, or bin/, explain which tests cover the change.
If coverage moved down in any touched file, explain why and what follow-up task will recover it.

Reviewer Notes

Call out any risky areas, migrations, feature flags, or manual validation that reviewers should know about.

Add Linux certificate management via update-ca-certificates for Docker support. Skip sudo password validation when running as root, matching the existing cli-tools route behavior.

gemini-code-assist

Code Review

This pull request introduces Linux support for MITM certificate management and allows root users on non-Windows platforms to bypass the sudo password requirement. The review feedback suggests optimizing the Linux certificate installation process by combining multiple sudo commands into a single shell execution to reduce password prompts. Additionally, it recommends refining error handling to be platform-appropriate, avoiding the aggressive --fresh flag during certificate updates to prevent side effects, and ensuring original error messages are preserved for better debugging.

gemini-code-assist · 2026-05-06T13:24:33Z

+    await execFileWithPassword("sudo", ["-S", "mkdir", "-p", LINUX_CA_DIR], sudoPassword);
+    await execFileWithPassword("sudo", ["-S", "cp", certPath, LINUX_CERT_DEST], sudoPassword);
+    await execFileWithPassword("sudo", ["-S", "update-ca-certificates"], sudoPassword);


Executing multiple sequential sudo commands is inefficient and will result in multiple password prompts if the user is not running as root and sudo is configured to require a password for each invocation. It is better to combine these into a single command string executed via sh -c to ensure only one authorization is needed.

Suggested change

await execFileWithPassword("sudo", ["-S", "mkdir", "-p", LINUX_CA_DIR], sudoPassword);

await execFileWithPassword("sudo", ["-S", "cp", certPath, LINUX_CERT_DEST], sudoPassword);

await execFileWithPassword("sudo", ["-S", "update-ca-certificates"], sudoPassword);

const command = `mkdir -p "${LINUX_CA_DIR}" && cp "${certPath}" "${LINUX_CERT_DEST}" && update-ca-certificates`;

await execFileWithPassword("sudo", ["-S", "sh", "-c", command], sudoPassword);

gemini-code-assist · 2026-05-06T13:24:33Z

+    const msg = message.includes("canceled")
+      ? "User canceled authorization"
+      : "Certificate install failed";


The check for the string "canceled" in the error message is specific to macOS security tools and is unlikely to be triggered by standard Linux sudo or system commands. On Linux, failures are more likely to be due to incorrect passwords or permission issues. Consider refining the error handling to be platform-appropriate or more generic.

gemini-code-assist · 2026-05-06T13:24:33Z

+    if (fs.existsSync(LINUX_CERT_DEST)) {
+      await execFileWithPassword("sudo", ["-S", "rm", "-f", LINUX_CERT_DEST], sudoPassword);
+    }
+    await execFileWithPassword("sudo", ["-S", "update-ca-certificates", "--fresh"], sudoPassword);


The --fresh flag for update-ca-certificates is quite aggressive as it re-generates all symlinks in /etc/ssl/certs and removes any that are broken. While it ensures the removed certificate is fully purged, it may have unintended side effects on other manually managed certificates in the system store. A standard update-ca-certificates call is usually sufficient after deleting the source file.

Suggested change

await execFileWithPassword("sudo", ["-S", "update-ca-certificates", "--fresh"], sudoPassword);

await execFileWithPassword("sudo", ["-S", "update-ca-certificates"], sudoPassword);

gemini-code-assist · 2026-05-06T13:24:33Z

+    }
+    await execFileWithPassword("sudo", ["-S", "update-ca-certificates", "--fresh"], sudoPassword);
+  } catch (err) {
+    throw new Error("Failed to uninstall certificate");


The actual error message is being swallowed here, which makes debugging difficult if the uninstallation fails. It is better to include the original error message in the thrown Error.

Suggested change

throw new Error("Failed to uninstall certificate");

throw new Error(`Failed to uninstall certificate: ${getErrorMessage(err)}`);

Turbopack resolveAlias (@/mitm/manager → manager.stub.ts) was designed for build-time safety but Next.js applies aliases to ALL imports — including dynamic ones. This caused await import("@/mitm/manager") at runtime to load the stub, which silently returned fake {running: true} without spawning the MITM proxy. The UI showed "MITM proxy started" but nothing was actually running. Fix introduces a two-path design: - @/mitm/manager → stub (build-time, safe for Turbopack) - @/mitm/manager.runtime → real manager (runtime, bypasses alias) Route handlers now dynamic-import from manager.runtime, which re-exports from ./manager and does NOT match the alias pattern. Additional fixes: - Make stub throw explicit errors at runtime so misconfiguration is immediately visible instead of silently faking success - Add server.cjs to outputFileTracingIncludes (NFT trace) and Dockerfile COPY so the MITM server binary exists in standalone/Docker output

diegosouzapw · 2026-05-07T11:49:33Z

Thank you @NekoMonci12 for your contribution! This has been reviewed and is now merged into release/v3.8.0 for the upcoming release. Amazing work!

fix(mitm): add Linux cert install and skip sudo password when root

1064b85

Add Linux certificate management via update-ca-certificates for Docker support. Skip sudo password validation when running as root, matching the existing cli-tools route behavior.

NekoMonci12 requested a review from diegosouzapw as a code owner May 6, 2026 13:18

gemini-code-assist Bot reviewed May 6, 2026

View reviewed changes

NekoMonci12 marked this pull request as draft May 6, 2026 13:39

NekoMonci12 force-pushed the main branch from 6570cdd to c5dded8 Compare May 7, 2026 03:38

NekoMonci12 marked this pull request as ready for review May 7, 2026 03:38

diegosouzapw changed the base branch from main to release/v3.8.0 May 7, 2026 11:24

diegosouzapw merged commit 72d0e1f into diegosouzapw:release/v3.8.0 May 7, 2026
67 of 123 checks passed

This was referenced May 10, 2026

[Feature] Show more detail about quota #1951

Closed

[BUG] MITM Proxy: Certificate install failed #2020

Closed

Release v3.8.0 #2111

Merged

flyingmongoose mentioned this pull request May 10, 2026

Feat/dynamic linux cert paths #2134

Merged

5 tasks

This was referenced May 14, 2026

Release v3.8.0 #2248

Merged

Release v3.8.0 — next development cycle #2323

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(mitm): add Linux cert install and skip sudo password when root#1999

fix(mitm): add Linux cert install and skip sudo password when root#1999
diegosouzapw merged 2 commits into
diegosouzapw:release/v3.8.0from
NekoMonci12:main

NekoMonci12 commented May 6, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 6, 2026

Uh oh!

gemini-code-assist Bot May 6, 2026

Uh oh!

gemini-code-assist Bot May 6, 2026

Uh oh!

gemini-code-assist Bot May 6, 2026

Uh oh!

diegosouzapw commented May 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	await execFileWithPassword("sudo", ["-S", "update-ca-certificates", "--fresh"], sudoPassword);
	await execFileWithPassword("sudo", ["-S", "update-ca-certificates"], sudoPassword);

	throw new Error("Failed to uninstall certificate");
	throw new Error(`Failed to uninstall certificate: ${getErrorMessage(err)}`);

Conversation

NekoMonci12 commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issues

Validation

Tests Added Or Updated

Coverage Notes

Reviewer Notes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 6, 2026

Choose a reason for hiding this comment

Uh oh!

diegosouzapw commented May 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

NekoMonci12 commented May 6, 2026 •

edited

Loading