Run any command after firewall verbatim, -- included

bpaf always consumes `--`, so `firewall cargo run -- --release` handed
--release to cargo and our --config flags to the program. The CLI is now clap
with one trailing COMMAND argument, which keeps `--`.

Every manager's environment is set on every run, and cargo's and gem's flags
are added when the command is cargo or gem, so `firewall sh -c '…'` is
screened too. Since every command now gets HTTPS_PROXY, HTTPS to hosts that
aren't registries is tunnelled; registry hosts are still refused.

core/src/aliasing/managers/pipenv.rs

@@ -9,8 +9,6 @@ pub static PIPENV: Manager = Manager {
         ("http_proxy", PROXY),
         ("https_proxy", PROXY),
         ("PIPENV_PYPI_MIRROR", PYPI_SIMPLE),
-        // pipenv installs through pip, which skips a plaintext index on a host it doesn't trust.
-        ("PIP_TRUSTED_HOST", "pypi.org files.pythonhosted.org"),
     ],
     args: &[],
 };

core/src/main.rs

@@ -25,13 +25,11 @@ fn options() -> Command {
         "Run a command through {program} to screen what it installs:\n  \
          {program} npm install left-pad\n\n\
          Alias it to screen every install without changing how you type:\n  \
-         {}\n\n\
+         alias npm='{program} npm'\n\n\
          Supported package managers: {}",
-        alias(&program),
         managers.join(", ")
     );
     Command::new("firewall")
-        .bin_name(&program)
         .about("Screens package downloads before they reach your machine")
         .after_help(footer)
         .arg_required_else_help(true)
@@ -93,32 +91,12 @@ fn print_setup(config: &FirewallConfig) {
     let base = config.local_url("");
     println!("Firewall listening on {base}\n");
     println!("Point your package managers at it:");
-    println!("  npm    {}", variable("npm_config_registry", &format!("{base}/npm/")));
-    println!("  pip    {}", variable("PIP_INDEX_URL", &format!("{base}/pypi/simple/")));
+    println!("  npm    npm_config_registry={base}/npm/");
+    println!("  pip    PIP_INDEX_URL={base}/pypi/simple/");
     println!("  cargo  [source.crates-io] replace-with = \"firewall\"");
     println!("         [source.firewall] registry = \"sparse+{base}/cargo/index/\"\n");
 }
 
-fn alias(program: &str) -> String {
-    if cfg!(windows) {
-        // Set-Alias cannot carry arguments, so a function stands in.
-        format!(
-            "PowerShell:  function npm {{ {program} npm @args }}\n  \
-             cmd:         doskey npm={program} npm $*"
-        )
-    } else {
-        format!("alias npm='{program} npm'")
-    }
-}
-
-fn variable(key: &str, value: &str) -> String {
-    if cfg!(windows) {
-        format!("$env:{key} = \"{value}\"")
-    } else {
-        format!("{key}={value}")
-    }
-}
-
 fn load() -> FirewallConfig {
     match FirewallConfig::load() {
         Ok(config) => config,
@@ -135,9 +113,7 @@ fn fail(kind: &'static str, message: &str) -> ! {
 
 fn program_name() -> String {
     let arg = std::env::args_os().next().unwrap_or_default();
-    // Without `.exe` on Windows, which is how it is typed.
-    let path = Path::new(&arg);
-    match if cfg!(windows) { path.file_stem() } else { path.file_name() } {
+    match Path::new(&arg).file_name() {
         Some(name) => name.to_string_lossy().into_owned(),
         None => "firewall".into(),
     }

core/src/os/macos/mod.rs

@@ -25,10 +25,10 @@ use std::sync::Arc;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::util::SubscriberInitExt;
 
-const BUNDLE_ID: &str = "com.usestrix.firewall";
+const BUNDLE_ID: &str = "ai.strix.firewall";
 const KEYCHAIN_SERVICE: &str = BUNDLE_ID;
 const KEYCHAIN_ACCOUNT: &str = "ca";
-/// Must match `macos/LaunchAgents/com.usestrix.firewall.env.plist`, which points npm at it.
+/// Must match `macos/LaunchAgents/ai.strix.firewall.env.plist`, which points npm at it.
 const CA_FILE: &str = "/Library/Application Support/Firewall/ca.pem";
 
 #[derive(Clone)]
@@ -113,7 +113,7 @@ fn handler(exec: Executor) -> Result<Handler, BoxError> {
 }
 
 /// stderr is invisible in a system extension, so events go to the unified log:
-/// `log stream --predicate 'subsystem == "com.usestrix.firewall"'`.
+/// `log stream --predicate 'subsystem == "ai.strix.firewall"'`.
 fn init(_config: Option<&TransparentProxyInitConfig>) -> bool {
     // A panic crossing the FFI boundary aborts, and its message would go to stderr.
     std::panic::set_hook(Box::new(|panic| tracing::error!("{panic}")));

core/src/os/macos/uninstall.rs

@@ -7,7 +7,7 @@ use std::io::ErrorKind;
 use tracing::info;
 
 /// Installed by the pkg.
-const ENV_AGENT: &str = "/Library/LaunchAgents/com.usestrix.firewall.env.plist";
+const ENV_AGENT: &str = "/Library/LaunchAgents/ai.strix.firewall.env.plist";
 
 /// Removes what only root can: the CA, its enclave key and exported copy, and the env
 /// agent. Trust settings need an authorization dialog, so the installer drops those itself.

macos/Installer/FirewallIDs.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 enum FirewallIDs {
-    static let appBundleID = "com.usestrix.firewall"
-    static let extensionBundleID = "com.usestrix.firewall.extension"
+    static let appBundleID = "ai.strix.firewall"
+    static let extensionBundleID = "ai.strix.firewall.extension"
     static let caCommonName = "Strix Firewall"
 }

macos/LaunchAgents/ai.strix.firewall.env.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>Label</key>
-	<string>com.usestrix.firewall.env</string>
+	<string>ai.strix.firewall.env</string>
 	<key>ProgramArguments</key>
 	<array>
 		<string>/bin/launchctl</string>

macos/build.sh

@@ -10,8 +10,8 @@ cd "$(dirname "$0")"
 : "${TEAM:?set TEAM in macos/.env}"
 export TEAM
 
-APP_ID=com.usestrix.firewall
-EXT_ID=com.usestrix.firewall.extension
+APP_ID=ai.strix.firewall
+EXT_ID=ai.strix.firewall.extension
 VERSION=0.1
 IDENTITY=${IDENTITY:-$(security find-identity -v -p codesigning | awk -F'"' '/Apple Development/ {print $2; exit}')}
 PROFILES="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
@@ -59,7 +59,7 @@ package() {
   rm -rf "$PKG_ROOT"
   mkdir -p "$PKG_ROOT/Applications" "$PKG_ROOT/Library/LaunchAgents"
   cp -R "$APP" "$PKG_ROOT/Applications/Firewall.app"
-  cp LaunchAgents/com.usestrix.firewall.env.plist "$PKG_ROOT/Library/LaunchAgents/"
+  cp LaunchAgents/ai.strix.firewall.env.plist "$PKG_ROOT/Library/LaunchAgents/"
 
   pkgbuild --analyze --root "$PKG_ROOT" build/components.plist >/dev/null
   plutil -replace 0.BundleIsRelocatable -bool NO build/components.plist

macos/pkg/postinstall

@@ -3,7 +3,7 @@
 user=$(stat -f %Su /dev/console)
 [ "$user" = root ] && exit 0
 uid=$(id -u "$user")
-agent=/Library/LaunchAgents/com.usestrix.firewall.env.plist
+agent=/Library/LaunchAgents/ai.strix.firewall.env.plist
 launchctl bootout "gui/$uid" "$agent" 2>/dev/null
 launchctl bootstrap "gui/$uid" "$agent"
 launchctl asuser "$uid" sudo -u "$user" open -a /Applications/Firewall.app --args --install

macos/project.yml

@@ -1,6 +1,6 @@
 name: Firewall
 options:
-  bundleIdPrefix: com.usestrix.firewall
+  bundleIdPrefix: ai.strix.firewall
   deploymentTarget: { macOS: "13.0" }
   createIntermediateGroups: true
 
@@ -33,8 +33,8 @@ targets:
     sources: [Extension]
     settings:
       base:
-        PRODUCT_BUNDLE_IDENTIFIER: com.usestrix.firewall.extension
-        PRODUCT_NAME: com.usestrix.firewall.extension
+        PRODUCT_BUNDLE_IDENTIFIER: ai.strix.firewall.extension
+        PRODUCT_NAME: ai.strix.firewall.extension
         PRODUCT_MODULE_NAME: Extension
         OTHER_LDFLAGS: [-lfirewall, -framework, NetworkExtension, -lz]
     info:
@@ -44,7 +44,7 @@ targets:
         CFBundleShortVersionString: "0.1"
         NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
         NetworkExtension:
-          NEMachServiceName: ${TEAM}.com.usestrix.firewall.extension
+          NEMachServiceName: ${TEAM}.ai.strix.firewall.extension
           NEProviderClasses:
             com.apple.networkextension.app-proxy: RamaAppleNetworkExtension.RamaTransparentProxyProvider
     entitlements:
@@ -52,13 +52,13 @@ targets:
       properties:
         # Xcode injects these from the profile; we sign by hand, and NE's IPC
         # check rejects a caller without them.
-        com.apple.application-identifier: ${TEAM}.com.usestrix.firewall.extension
+        com.apple.application-identifier: ${TEAM}.ai.strix.firewall.extension
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.networking.networkextension:
           - app-proxy-provider
         # NE requires NEMachServiceName to start with one of these.
         com.apple.security.application-groups:
-          - ${TEAM}.com.usestrix.firewall
+          - ${TEAM}.ai.strix.firewall
         com.apple.security.network.client: true
         com.apple.security.network.server: true
     dependencies:
@@ -96,7 +96,7 @@ targets:
         buildPhase: resources
     settings:
       base:
-        PRODUCT_BUNDLE_IDENTIFIER: com.usestrix.firewall
+        PRODUCT_BUNDLE_IDENTIFIER: ai.strix.firewall
     info:
       path: Installer/Info.plist
       properties:
@@ -107,7 +107,7 @@ targets:
     entitlements:
       path: Installer/Installer.entitlements
       properties:
-        com.apple.application-identifier: ${TEAM}.com.usestrix.firewall
+        com.apple.application-identifier: ${TEAM}.ai.strix.firewall
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.system-extension.install: true
         com.apple.developer.networking.networkextension: