Forward plain-HTTP upstreams as asked

The wrapper's forward proxy upgraded every request to HTTPS and rewrote
links in index responses. Only an HTTPS registry is downgraded to reach
us, so only that should be upgraded back and rewritten; anything else
now goes out exactly as the client sent it, port included.

core/Cargo.lock

@@ -45,56 +45,6 @@ dependencies = [
  "alloc-no-stdlib",
 ]
 
-[[package]]
-name = "anstream"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
-[[package]]
-name = "anstyle-parse"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
-dependencies = [
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "3.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
-dependencies = [
- "anstyle",
- "once_cell_polyfill",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "anyhow"
 version = "1.0.104"
@@ -260,6 +210,12 @@ dependencies = [
  "cfg_aliases",
 ]
 
+[[package]]
+name = "bpaf"
+version = "0.9.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597e81e56404b7a3e26ef7b449f82a4b7a661ae76c3cac692b42d6bad06a0fbe"
+
 [[package]]
 name = "brotli"
 version = "8.0.4"
@@ -357,33 +313,6 @@ dependencies = [
  "libloading",
 ]
 
-[[package]]
-name = "clap"
-version = "4.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
-dependencies = [
- "clap_builder",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
-dependencies = [
- "anstream",
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"
-
 [[package]]
 name = "cmake"
 version = "0.1.58"
@@ -393,12 +322,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "colorchoice"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
-
 [[package]]
 name = "combine"
 version = "4.6.8"
@@ -1177,12 +1100,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "is_terminal_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
-
 [[package]]
 name = "itertools"
 version = "0.13.0"
@@ -1645,12 +1562,6 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
-[[package]]
-name = "once_cell_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
-
 [[package]]
 name = "openssl-macros"
 version = "0.1.1"
@@ -3093,7 +3004,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 name = "strix-firewall"
 version = "0.1.0"
 dependencies = [
- "clap",
+ "bpaf",
  "core-foundation",
  "directories",
  "percent-encoding",
@@ -3113,12 +3024,6 @@ dependencies = [
  "which",
 ]
 
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -3528,12 +3433,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
-[[package]]
-name = "utf8parse"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-
 [[package]]
 name = "uuid"
 version = "1.26.1"

core/Cargo.toml

@@ -53,7 +53,7 @@ name = "managers"
 path = "tests/managers.rs"
 
 [dependencies]
-clap = "4.6.6"
+bpaf = "0.9.28"
 directories = "6.0.0"
 percent-encoding = "2.3.2"
 rama = { version = "0.4.0", features = ["boring", "http-full", "ring", "rustls"] }

core/src/aliasing/forward.rs

@@ -1,20 +1,15 @@
 use crate::http::{blocked, https_url, text};
 use crate::{policies, telemetry};
 use crate::{Firewall, FirewallConfig};
-use rama::dns::client::DnsConnectorLayer;
 use rama::http::body::util::BodyExt;
 use rama::http::client::EasyHttpWebClient;
 use rama::http::header::CONTENT_LENGTH;
 use rama::http::layer::decompression::DecompressionLayer;
 use rama::http::layer::remove_header::{RemoveRequestHeaderLayer, RemoveResponseHeaderLayer};
-use rama::http::layer::upgrade::{EagerHttpProxyConnector, UpgradeLayer};
 use rama::http::server::HttpServer;
 use rama::http::{Body, Method, Request, Response};
-use rama::matcher::match_fn;
-use rama::net::proxy::IoForwardService;
 use rama::rt::Executor;
 use rama::service::service_fn;
-use rama::tcp::client::service::TcpConnector;
 use rama::tcp::server::TcpListener;
 use rama::{Layer, Service};
 use std::convert::Infallible;
@@ -36,26 +31,8 @@ pub fn spawn(port: u16, config: FirewallConfig) -> std::io::Result<u16> {
                 Ok(listener) => listener,
                 Err(e) => return error!(error = %e, "forward proxy could not take over the socket"),
             };
-            // Tunnels skip screening, so a registry's CONNECT falls through to `handle`, which refuses it.
-            let hosts = firewall.hosts();
-            let tunnel = UpgradeLayer::new(
-                exec.clone(),
-                match_fn(move |req: &Request| {
-                    let host = req.uri().host().map(|host| host.to_str());
-                    req.method() == Method::CONNECT
-                        && host.is_some_and(|host| !hosts.contains(&host.as_ref()))
-                }),
-                EagerHttpProxyConnector::new(
-                    DnsConnectorLayer::new().into_layer(TcpConnector::new()),
-                    IoForwardService::default(),
-                ),
-            );
             let server = HttpServer::auto(exec).service(
-                (
-                    RemoveResponseHeaderLayer::hop_by_hop(),
-                    RemoveRequestHeaderLayer::hop_by_hop(),
-                    tunnel,
-                )
+                (RemoveResponseHeaderLayer::hop_by_hop(), RemoveRequestHeaderLayer::hop_by_hop())
                     .into_layer(service_fn(move |req: Request| {
                         let firewall = Arc::clone(&firewall);
                         async move { handle(req, &firewall).await }
@@ -89,12 +66,16 @@ async fn handle(req: Request, firewall: &Firewall) -> Result<Response, Infallibl
     }
 
     info!(method = %req.method(), %url, "forwarding");
-    let index = firewall.is_index_url(&url);
+    // Only an HTTPS registry was downgraded to reach us, so only it is upgraded back and rewritten.
+    let tls = firewall.is_https_url(&url);
+    let index = tls && firewall.is_index_url(&url);
     let (mut parts, body) = req.into_parts();
-    let Ok(uri) = url.parse() else {
-        return Ok(text(400, "firewall: expected an absolute URL\n"));
-    };
-    parts.uri = uri;
+    if tls {
+        let Ok(uri) = url.parse() else {
+            return Ok(text(400, "firewall: expected an absolute URL\n"));
+        };
+        parts.uri = uri;
+    }
 
     let client = DecompressionLayer::new().into_layer(EasyHttpWebClient::default());
     let response = match client.serve(Request::from_parts(parts, body)).await {

core/src/aliasing/managers/mod.rs

@@ -41,10 +41,8 @@ pub struct Manager {
 pub static MANAGERS: &[&Manager] =
     &[&NPM, &PIP, &PIP3, &CARGO, &GO, &GEM, &UV, &PDM, &PIPENV, &PNPM, &BUN];
 
-/// Every manager's variables, so whichever the command starts is pointed at the firewall.
-pub fn variables(proxy: &str) -> Vec<(String, String)> {
-    let env = MANAGERS.iter().flat_map(|manager| manager.env);
-    env.map(|(key, value)| (key.to_string(), expand(value, proxy))).collect()
+pub fn variables(proxy: &str, manager: &Manager) -> Vec<(String, String)> {
+    manager.env.iter().map(|(key, value)| (key.to_string(), expand(value, proxy))).collect()
 }
 
 pub fn arguments(proxy: &str, manager: &Manager, typed: &[String]) -> Vec<String> {

core/src/aliasing/managers/pipenv.rs

@@ -9,8 +9,6 @@ pub static PIPENV: Manager = Manager {
         ("http_proxy", PROXY),
         ("https_proxy", PROXY),
         ("PIPENV_PYPI_MIRROR", PYPI_SIMPLE),
-        // pipenv installs through pip, which skips a plaintext index on a host it doesn't trust.
-        ("PIP_TRUSTED_HOST", "pypi.org files.pythonhosted.org"),
     ],
     args: &[],
 };

core/src/aliasing/mod.rs

@@ -9,37 +9,30 @@ use std::path::{Path, PathBuf};
 use std::process::Command;
 
 pub struct Invocation {
-    pub program: String,
+    pub manager: &'static Manager,
     pub args: Vec<String>,
 }
 
 impl Invocation {
-    pub fn new(program: String, args: Vec<String>) -> Self {
-        Invocation { program, args }
-    }
-
-    /// What the program is run with: the typed arguments plus any its manager needs.
-    pub fn arguments(&self, proxy: &str) -> Vec<String> {
-        let mut args = self.args.clone();
-        let Some(manager) = MANAGERS.iter().find(|manager| manager.command == self.program) else {
-            return args;
-        };
-        let ours = managers::arguments(proxy, manager, &args);
-        // Anything after `--` belongs to another program, so ours go before it.
-        let at = args.iter().position(|arg| arg == "--").unwrap_or(args.len());
-        args.splice(at..at, ours);
-        args
+    pub fn new(manager: &'static Manager, args: Vec<String>) -> Self {
+        Invocation { manager, args }
     }
 }
 
 pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::Result<i32> {
     let proxy = crate::local_url(port, "");
-    let mut command = Command::new(resolve(&invocation.program)?);
-    command.args(invocation.arguments(&proxy));
+    let mut args = invocation.args.clone();
+    let ours = managers::arguments(&proxy, invocation.manager, &args);
+    // Anything after `--` belongs to another program, so ours go before it.
+    let at = args.iter().position(|arg| arg == "--").unwrap_or(args.len());
+    args.splice(at..at, ours);
+
+    let mut command = Command::new(resolve(invocation.manager.command)?);
+    command.args(args);
     if let Some(dir) = dir {
         command.current_dir(dir);
     }
-    for (key, value) in managers::variables(&proxy) {
+    for (key, value) in managers::variables(&proxy, invocation.manager) {
         command.env(key, value);
     }
     Ok(command.status()?.code().unwrap_or(1))

core/src/firewall.rs

@@ -50,6 +50,11 @@ impl Firewall {
         hosts
     }
 
+    pub fn is_https_url(&self, url: &str) -> bool {
+        let host = host_of(url);
+        self.config.registries.iter().any(|r| r.upstream.starts_with("https://") && r.host() == host)
+    }
+
     pub fn is_index_url(&self, url: &str) -> bool {
         self.config.registries.iter().any(|r| r.index && r.host() == host_of(url))
     }

core/src/main.rs

@@ -1,52 +1,64 @@
-use clap::{Arg, Command};
-use firewall::aliasing::{self, Invocation, MANAGERS};
+use bpaf::{any, choice, pure, OptionParser, Parser};
+use firewall::aliasing::{self, Invocation, Manager, MANAGERS};
 use firewall::{config, proxy, telemetry, FirewallConfig};
 use std::io::ErrorKind;
 use std::path::Path;
 use std::process::exit;
 use tracing::{error, info};
 
-fn main() {
-    let matches = options().get_matches();
-    if matches.subcommand_matches("serve").is_some() {
-        firewall::init_logging("info");
-        serve()
-    }
-    let mut command = matches.get_many::<String>("COMMAND").unwrap().cloned();
-    let program = command.next().unwrap();
-    firewall::init_logging("warn");
-    run(Invocation::new(program, command.collect()))
+enum SubCommand {
+    Serve,
+    Run(Invocation),
 }
 
-fn options() -> Command {
+fn main() {
+    match options().run() {
+        SubCommand::Serve => {
+            firewall::init_logging("info");
+            serve()
+        }
+        SubCommand::Run(invocation) => {
+            firewall::init_logging("warn");
+            run(invocation)
+        }
+    }
+}
+
+fn options() -> OptionParser<SubCommand> {
     let program = program_name();
-    let managers: Vec<_> = MANAGERS.iter().map(|manager| manager.command).collect();
     let footer = format!(
-        "Run a command through {program} to screen what it installs:\n  \
-         {program} npm install left-pad\n\n\
-         Alias it to screen every install without changing how you type:\n  \
-         {}\n\n\
-         Supported package managers: {}",
-        alias(&program),
-        managers.join(", ")
+        "Run a package manager through {program} to screen what it installs:\n   \
+         {program} npm install left-pad\n \n \
+         Alias it to screen every install without changing how you type:\n   \
+         alias npm='{program} npm'"
     );
-    Command::new("firewall")
-        .bin_name(&program)
-        .about("Screens package downloads before they reach your machine")
-        .after_help(footer)
-        .arg_required_else_help(true)
-        .args_conflicts_with_subcommands(true)
-        .subcommand(
-            Command::new("serve")
-                .about("Serve a local registry for package managers configured to use it"),
-        )
-        .arg(
-            Arg::new("COMMAND")
-                .help("A command to run with its package downloads screened")
-                .num_args(1..)
-                .trailing_var_arg(true)
-                .allow_hyphen_values(true),
-        )
+    let serve = pure(())
+        .map(|()| SubCommand::Serve)
+        .to_options()
+        .descr("Serve a local registry for package managers configured to use it")
+        .command("serve");
+
+    let mut commands: Vec<_> = MANAGERS
+        .iter()
+        .map(|manager| package(manager, &program).boxed())
+        .collect();
+    commands.push(serve.boxed());
+    choice(commands)
+        .to_options()
+        .descr("Screens package downloads before they reach your machine")
+        .footer(Box::leak(footer.into_boxed_str()) as &str)
+        .fallback_to_usage()
+}
+
+fn package(manager: &'static Manager, program: &str) -> impl Parser<SubCommand> {
+    let name = manager.command;
+    let descr = format!("Run {name} with downloads screened: {program} {name} ARGS...");
+    any::<String, String, _>("ARGS", Some)
+        .many()
+        .map(move |args| SubCommand::Run(Invocation::new(manager, args)))
+        .to_options()
+        .descr(Box::leak(descr.into_boxed_str()) as &str)
+        .command(name)
 }
 
 fn serve() -> ! {
@@ -70,7 +82,7 @@ fn serve() -> ! {
 }
 
 fn run(invocation: Invocation) -> ! {
-    let command = &invocation.program;
+    let command = invocation.manager.command;
     let port = match aliasing::spawn(0, load()) {
         Ok(port) => port,
         Err(e) => fail("spawn", &format!("could not start the firewall: {e}")),
@@ -93,32 +105,12 @@ fn print_setup(config: &FirewallConfig) {
     let base = config.local_url("");
     println!("Firewall listening on {base}\n");
     println!("Point your package managers at it:");
-    println!("  npm    {}", variable("npm_config_registry", &format!("{base}/npm/")));
-    println!("  pip    {}", variable("PIP_INDEX_URL", &format!("{base}/pypi/simple/")));
+    println!("  npm    npm_config_registry={base}/npm/");
+    println!("  pip    PIP_INDEX_URL={base}/pypi/simple/");
     println!("  cargo  [source.crates-io] replace-with = \"firewall\"");
     println!("         [source.firewall] registry = \"sparse+{base}/cargo/index/\"\n");
 }
 
-fn alias(program: &str) -> String {
-    if cfg!(windows) {
-        // Set-Alias cannot carry arguments, so a function stands in.
-        format!(
-            "PowerShell:  function npm {{ {program} npm @args }}\n  \
-             cmd:         doskey npm={program} npm $*"
-        )
-    } else {
-        format!("alias npm='{program} npm'")
-    }
-}
-
-fn variable(key: &str, value: &str) -> String {
-    if cfg!(windows) {
-        format!("$env:{key} = \"{value}\"")
-    } else {
-        format!("{key}={value}")
-    }
-}
-
 fn load() -> FirewallConfig {
     match FirewallConfig::load() {
         Ok(config) => config,
@@ -135,9 +127,7 @@ fn fail(kind: &'static str, message: &str) -> ! {
 
 fn program_name() -> String {
     let arg = std::env::args_os().next().unwrap_or_default();
-    // Without `.exe` on Windows, which is how it is typed.
-    let path = Path::new(&arg);
-    match if cfg!(windows) { path.file_stem() } else { path.file_name() } {
+    match Path::new(&arg).file_name() {
         Some(name) => name.to_string_lossy().into_owned(),
         None => "firewall".into(),
     }

core/src/os/macos/mod.rs

@@ -25,10 +25,10 @@ use std::sync::Arc;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::util::SubscriberInitExt;
 
-const BUNDLE_ID: &str = "com.usestrix.firewall";
+const BUNDLE_ID: &str = "ai.strix.firewall";
 const KEYCHAIN_SERVICE: &str = BUNDLE_ID;
 const KEYCHAIN_ACCOUNT: &str = "ca";
-/// Must match `macos/LaunchAgents/com.usestrix.firewall.env.plist`, which points npm at it.
+/// Must match `macos/LaunchAgents/ai.strix.firewall.env.plist`, which points npm at it.
 const CA_FILE: &str = "/Library/Application Support/Firewall/ca.pem";
 
 #[derive(Clone)]
@@ -113,7 +113,7 @@ fn handler(exec: Executor) -> Result<Handler, BoxError> {
 }
 
 /// stderr is invisible in a system extension, so events go to the unified log:
-/// `log stream --predicate 'subsystem == "com.usestrix.firewall"'`.
+/// `log stream --predicate 'subsystem == "ai.strix.firewall"'`.
 fn init(_config: Option<&TransparentProxyInitConfig>) -> bool {
     // A panic crossing the FFI boundary aborts, and its message would go to stderr.
     std::panic::set_hook(Box::new(|panic| tracing::error!("{panic}")));

core/src/os/macos/uninstall.rs

@@ -7,7 +7,7 @@ use std::io::ErrorKind;
 use tracing::info;
 
 /// Installed by the pkg.
-const ENV_AGENT: &str = "/Library/LaunchAgents/com.usestrix.firewall.env.plist";
+const ENV_AGENT: &str = "/Library/LaunchAgents/ai.strix.firewall.env.plist";
 
 /// Removes what only root can: the CA, its enclave key and exported copy, and the env
 /// agent. Trust settings need an authorization dialog, so the installer drops those itself.

core/tests/forward.rs

@@ -1,7 +1,9 @@
 use firewall::aliasing::forward::downgrade;
 use firewall::http::https_url;
-use firewall::Firewall;
+use firewall::{aliasing, Firewall, FirewallConfig};
 use rama::http::{Body, Request};
+use std::io::{Read, Write};
+use std::net::{TcpListener, TcpStream};
 
 fn request(target: &str, host: Option<&str>) -> Request {
     let mut builder = Request::builder().method("GET").uri(target);
@@ -35,6 +37,25 @@ fn requests_always_go_out_over_tls() {
     assert_eq!(https_url(&request("/six", None)), None);
 }
 
+#[test]
+fn a_plain_http_upstream_is_not_upgraded() {
+    let upstream = TcpListener::bind("127.0.0.1:0").expect("bind");
+    let addr = upstream.local_addr().expect("address");
+    std::thread::spawn(move || {
+        let (mut stream, _) = upstream.accept().expect("accept");
+        let _ = stream.read(&mut [0; 4096]);
+        let _ = stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok");
+    });
+
+    let port = aliasing::spawn(0, FirewallConfig::default()).expect("spawn");
+    let mut proxy = TcpStream::connect(("127.0.0.1", port)).expect("connect");
+    let request = format!("GET http://{addr}/x HTTP/1.1\r\nHost: {addr}\r\nConnection: close\r\n\r\n");
+    proxy.write_all(request.as_bytes()).expect("write");
+    let mut response = String::new();
+    proxy.read_to_string(&mut response).expect("read");
+    assert!(response.starts_with("HTTP/1.1 200") && response.ends_with("ok"), "{response}");
+}
+
 #[tokio::test]
 async fn downgrade_touches_known_hosts_in_text_only() {
     let text = b"https://pypi.org/x https://example.com/y".to_vec();

core/tests/managers.rs

@@ -1,19 +1,10 @@
 use firewall::aliasing::managers::*;
-use firewall::aliasing::Invocation;
 use firewall::Firewall;
 
-#[test]
-fn arguments_after_a_double_dash_reach_the_program() {
-    let typed = ["run", "--", "--release"].map(String::from).to_vec();
-    let args = Invocation::new("cargo".into(), typed).arguments("http://127.0.0.1:9000");
-    assert_eq!(args.first().map(String::as_str), Some("run"));
-    assert_eq!(args[args.len() - 2..], ["--", "--release"]);
-}
-
 #[test]
 fn recipes_expand_into_the_environment() {
     let var = |name: &str, value: &str| (name.to_string(), value.to_string());
-    let npm = variables("http://127.0.0.1:9000");
+    let npm = variables("http://127.0.0.1:9000", &NPM);
     assert!(npm.contains(&var("npm_config_proxy", "http://127.0.0.1:9000")));
     assert!(npm.contains(&var("npm_config_registry", "http://registry.npmjs.org/")));
     let gem = arguments("http://127.0.0.1:9000", &GEM, &["install".to_string()]);
@@ -21,17 +12,6 @@ fn recipes_expand_into_the_environment() {
     assert!(arguments("http://127.0.0.1:9000", &GEM, &["sources".to_string()]).is_empty());
 }
 
-#[test]
-fn no_two_managers_set_a_variable_differently() {
-    let mut seen = std::collections::HashMap::new();
-    for manager in MANAGERS {
-        for (key, value) in manager.env {
-            let first = *seen.entry(key).or_insert(value);
-            assert_eq!(first, value, "{} sets {key} differently", manager.command);
-        }
-    }
-}
-
 #[tokio::test]
 async fn every_overridden_registry_is_known() {
     let hosts = Firewall::default().hosts();

core/tests/proxy-test/probe.rs

@@ -36,7 +36,7 @@ pub fn all(port: u16) -> Vec<(&'static str, Outcome)> {
 fn run(probe: &Probe, port: u16) -> Outcome {
     let args = probe.args.iter().map(|arg| arg.to_string()).collect();
     let dir = probe.setup.and_then(|prepare| prepare());
-    match aliasing::run(port, &Invocation::new(probe.manager.command.into(), args), dir.as_deref()) {
+    match aliasing::run(port, &Invocation::new(probe.manager, args), dir.as_deref()) {
         Ok(0) => Outcome::Ok,
         Ok(_) => Outcome::Failed,
         Err(e) if e.kind() == std::io::ErrorKind::NotFound => Outcome::Absent,

macos/Installer/FirewallIDs.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 enum FirewallIDs {
-    static let appBundleID = "com.usestrix.firewall"
-    static let extensionBundleID = "com.usestrix.firewall.extension"
+    static let appBundleID = "ai.strix.firewall"
+    static let extensionBundleID = "ai.strix.firewall.extension"
     static let caCommonName = "Strix Firewall"
 }

macos/LaunchAgents/ai.strix.firewall.env.plist

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>Label</key>
-	<string>com.usestrix.firewall.env</string>
+	<string>ai.strix.firewall.env</string>
 	<key>ProgramArguments</key>
 	<array>
 		<string>/bin/launchctl</string>

macos/build.sh

@@ -10,8 +10,8 @@ cd "$(dirname "$0")"
 : "${TEAM:?set TEAM in macos/.env}"
 export TEAM
 
-APP_ID=com.usestrix.firewall
-EXT_ID=com.usestrix.firewall.extension
+APP_ID=ai.strix.firewall
+EXT_ID=ai.strix.firewall.extension
 VERSION=0.1
 IDENTITY=${IDENTITY:-$(security find-identity -v -p codesigning | awk -F'"' '/Apple Development/ {print $2; exit}')}
 PROFILES="$HOME/Library/Developer/Xcode/UserData/Provisioning Profiles"
@@ -59,7 +59,7 @@ package() {
   rm -rf "$PKG_ROOT"
   mkdir -p "$PKG_ROOT/Applications" "$PKG_ROOT/Library/LaunchAgents"
   cp -R "$APP" "$PKG_ROOT/Applications/Firewall.app"
-  cp LaunchAgents/com.usestrix.firewall.env.plist "$PKG_ROOT/Library/LaunchAgents/"
+  cp LaunchAgents/ai.strix.firewall.env.plist "$PKG_ROOT/Library/LaunchAgents/"
 
   pkgbuild --analyze --root "$PKG_ROOT" build/components.plist >/dev/null
   plutil -replace 0.BundleIsRelocatable -bool NO build/components.plist

macos/pkg/postinstall

@@ -3,7 +3,7 @@
 user=$(stat -f %Su /dev/console)
 [ "$user" = root ] && exit 0
 uid=$(id -u "$user")
-agent=/Library/LaunchAgents/com.usestrix.firewall.env.plist
+agent=/Library/LaunchAgents/ai.strix.firewall.env.plist
 launchctl bootout "gui/$uid" "$agent" 2>/dev/null
 launchctl bootstrap "gui/$uid" "$agent"
 launchctl asuser "$uid" sudo -u "$user" open -a /Applications/Firewall.app --args --install

macos/project.yml

@@ -1,6 +1,6 @@
 name: Firewall
 options:
-  bundleIdPrefix: com.usestrix.firewall
+  bundleIdPrefix: ai.strix.firewall
   deploymentTarget: { macOS: "13.0" }
   createIntermediateGroups: true
 
@@ -33,8 +33,8 @@ targets:
     sources: [Extension]
     settings:
       base:
-        PRODUCT_BUNDLE_IDENTIFIER: com.usestrix.firewall.extension
-        PRODUCT_NAME: com.usestrix.firewall.extension
+        PRODUCT_BUNDLE_IDENTIFIER: ai.strix.firewall.extension
+        PRODUCT_NAME: ai.strix.firewall.extension
         PRODUCT_MODULE_NAME: Extension
         OTHER_LDFLAGS: [-lfirewall, -framework, NetworkExtension, -lz]
     info:
@@ -44,7 +44,7 @@ targets:
         CFBundleShortVersionString: "0.1"
         NSSystemExtensionUsageDescription: Firewall uses a network extension to screen package downloads before they install.
         NetworkExtension:
-          NEMachServiceName: ${TEAM}.com.usestrix.firewall.extension
+          NEMachServiceName: ${TEAM}.ai.strix.firewall.extension
           NEProviderClasses:
             com.apple.networkextension.app-proxy: RamaAppleNetworkExtension.RamaTransparentProxyProvider
     entitlements:
@@ -52,13 +52,13 @@ targets:
       properties:
         # Xcode injects these from the profile; we sign by hand, and NE's IPC
         # check rejects a caller without them.
-        com.apple.application-identifier: ${TEAM}.com.usestrix.firewall.extension
+        com.apple.application-identifier: ${TEAM}.ai.strix.firewall.extension
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.networking.networkextension:
           - app-proxy-provider
         # NE requires NEMachServiceName to start with one of these.
         com.apple.security.application-groups:
-          - ${TEAM}.com.usestrix.firewall
+          - ${TEAM}.ai.strix.firewall
         com.apple.security.network.client: true
         com.apple.security.network.server: true
     dependencies:
@@ -96,7 +96,7 @@ targets:
         buildPhase: resources
     settings:
       base:
-        PRODUCT_BUNDLE_IDENTIFIER: com.usestrix.firewall
+        PRODUCT_BUNDLE_IDENTIFIER: ai.strix.firewall
     info:
       path: Installer/Info.plist
       properties:
@@ -107,7 +107,7 @@ targets:
     entitlements:
       path: Installer/Installer.entitlements
       properties:
-        com.apple.application-identifier: ${TEAM}.com.usestrix.firewall
+        com.apple.application-identifier: ${TEAM}.ai.strix.firewall
         com.apple.developer.team-identifier: ${TEAM}
         com.apple.developer.system-extension.install: true
         com.apple.developer.networking.networkextension: