proxy daemon

Cargo.toml

@@ -37,11 +37,14 @@ missing_panics_doc = "allow"
 [workspace.dependencies]
 wizard-core = { path = "crates/wizard-core" }
 wizard-proxy = { path = "crates/wizard-proxy" }
+wizard-proxy-daemon = { path = "crates/wizard-proxy-daemon" }
 wizard-settings = { path = "crates/wizard-settings" }
+wizard-system-proxy = { path = "crates/wizard-system-proxy" }
 
 anyhow = "1.0.104"
 chrono = { version = "0.4.45", default-features = false, features = ["serde", "clock"] }
 dirs = "6"
+file-rotate = "0.8.0"
 jsonc-parser = { version = "0.34.0", features = ["cst", "serde_json"] }
 libc = "0.2.189"
 base64 = "0.22.1"
@@ -52,8 +55,15 @@ http-body-util = "0.1.5"
 hyper = "1.11.1"
 hyper-util = "0.1.20"
 minisign-verify = "0.2.5"
+block2 = "0.6.2"
+objc2 = "0.6.4"
+objc2-service-management = { version = "0.3.2", default-features = false, features = ["std", "SMAppService", "objc2", "objc2-foundation", "block2"] }
 objc2-app-kit = { version = "0.3.2", default-features = false, features = ["std", "NSRunningApplication"] }
 objc2-foundation = { version = "0.3.2", default-features = false, features = ["std", "NSProcessInfo", "NSString", "NSArray"] }
+objc2-core-foundation = { version = "0.3.2", default-features = false, features = ["std", "CFArray", "CFDictionary", "CFNumber", "CFString"] }
+objc2-security = { version = "0.3.2", default-features = false, features = ["std", "Authorization"] }
+objc2-system-configuration = { version = "0.3.2", default-features = false, features = ["std", "SCNetworkConfiguration", "SCPreferences", "SCSchemaDefinitions", "objc2-security"] }
+windows = "0.61.3"
 plist = "1.10.1"
 regex = "1.13.1"
 reqwest = { version = "0.13.5", default-features = false, features = ["rustls-no-provider"] }
@@ -70,6 +80,7 @@ tauri-plugin-log = "2.8.0"
 tauri-plugin-single-instance = "2.4.0"
 tauri-plugin-updater = { version = "2.11.0", default-features = false, features = ["rustls-tls"] }
 tempfile = "3.27.0"
+windows-sys = "0.61.2"
 url = "2.5.7"
 uuid = { version = "1.26.0", features = ["v4"] }
 toml_edit = "0.25.15"

crates/wizard-cli/Cargo.toml

@@ -17,4 +17,6 @@ clap = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
 tokio.workspace = true
 wizard-core.workspace = true
+wizard-proxy-daemon.workspace = true
+wizard-proxy.workspace = true
 wizard-settings.workspace = true

crates/wizard-cli/src/main.rs

@@ -11,7 +11,7 @@ use wizard_core::hub;
 #[derive(Parser)]
 #[command(
     version,
-    about = "CoreInfra Wizard backend CLI. Close the GUI before changing settings.",
+    about = "CoreInfra Wizard backend CLI. Close the GUI before running.",
     disable_help_subcommand = true
 )]
 struct Cli {
@@ -41,6 +41,12 @@ enum Command {
 }
 
 fn main() -> ExitCode {
+    if let Some(arg1) = std::env::args_os().nth(1)
+        && arg1 == "--proxy"
+    {
+        return wizard_proxy_daemon::main();
+    }
+
     let cli = Cli::parse();
     if let Err(error) = run(cli) {
         eprintln!("wizard-cli: {error:#}");

crates/wizard-gui/Cargo.toml

@@ -34,10 +34,9 @@ tauri-plugin-updater.workspace = true
 tokio.workspace = true
 wizard-core.workspace = true
 wizard-proxy.workspace = true
+wizard-proxy-daemon.workspace = true
 wizard-settings.workspace = true
-
-[target.'cfg(unix)'.dependencies]
-libc.workspace = true
+wizard-system-proxy.workspace = true
 
 [target.'cfg(any(target_os = "macos", target_os = "windows"))'.dependencies]
 tauri = { workspace = true, features = ["tray-icon"] }

crates/wizard-gui/ai.coreinfra.wizard.proxy.plist

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>ai.coreinfra.wizard.proxy</string>
+    <key>BundleProgram</key>
+    <string>Contents/MacOS/wizard</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>wizard</string>
+        <string>--proxy</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <dict>
+        <key>SuccessfulExit</key>
+        <false/>
+    </dict>
+</dict>
+</plist>

crates/wizard-gui/src/agents.rs

@@ -191,16 +191,17 @@ pub(crate) async fn apply_agent_plan(
 
     let proxy_app = app.clone();
     let result = tauri::async_runtime::spawn_blocking(move || {
-        // Sync even when the setting is unchanged: «Применить» restarts a stopped listener.
-        // Also sync after a failed save: tray or autostart can fail after the setting is saved.
+        // Sync even when the setting is unchanged: «Применить» starts a stopped daemon.
+        // Reload checks both slots; unchanged tokens preserve active connections.
+        // Even if saving fails, synchronize with the settings actually on disk.
         plan.apply_with_proxies(
             |token| {
                 tauri::async_runtime::block_on(async {
                     let saved = settings::update_state(&proxy_app, move |settings| {
                         settings.claude_proxy_enabled = token;
                     })
                     .await;
-                    let synced = proxy::sync_one(&proxy_app, proxy::App::ClaudeDesktop).await;
+                    let synced = proxy::sync(&proxy_app).await;
                     saved.and(synced)
                 })
             },
@@ -210,7 +211,7 @@ pub(crate) async fn apply_agent_plan(
                         settings.codex_proxy_enabled = token;
                     })
                     .await;
-                    let synced = proxy::sync_one(&proxy_app, proxy::App::ChatGpt).await;
+                    let synced = proxy::sync(&proxy_app).await;
                     saved.and(synced)
                 })
             },

crates/wizard-gui/src/lib.rs

@@ -17,6 +17,7 @@ mod logs;
 mod proxy;
 mod revision_signal;
 mod settings;
+mod system_proxy;
 #[cfg(any(target_os = "macos", target_os = "windows"))]
 mod tray;
 mod updater;
@@ -72,7 +73,9 @@ pub fn run_application() -> Result<()> {
         .plugin(tauri_plugin_updater::Builder::new().build())
         .manage(Arc::new(claude_desktop_install::InstallManager::default()))
         .manage(proxy::ProxyState::default())
-        .manage(revision_signal::RevisionSignal::new(proxy::Proxy::default()))
+        .manage(revision_signal::RevisionSignal::new(
+            system_proxy::State::default(),
+        ))
         .manage(Arc::new(revision_signal::RevisionSignal::new(
             updater::UpdateState::Checking,
         )))
@@ -87,6 +90,7 @@ pub fn run_application() -> Result<()> {
             hub_tokens::HubTokensManager::initialize(app.handle())?;
             #[cfg(any(target_os = "macos", target_os = "windows"))]
             let tray_enabled = {
+                app.manage(tray::TrayState::default());
                 let preferences = settings::get_state(app.handle())?.application;
                 autostart::initialize(app.handle())?;
                 let autostart = autostart::set_enabled(app.handle(), preferences.autostart_enabled);
@@ -99,12 +103,15 @@ pub fn run_application() -> Result<()> {
             #[cfg(target_os = "linux")]
             let tray_enabled = false;
 
-            #[cfg(unix)]
-            proxy::raise_open_file_limit();
-            if let Err(error) = tauri::async_runtime::block_on(proxy::sync(app.handle())) {
+            if let Err(error) = tauri::async_runtime::block_on(async {
+                wizard_proxy_daemon::create_daemon().await?;
+                proxy::sync(app.handle()).await
+            }) {
                 log::error!("proxy startup failed: {error:#}");
             }
+            proxy::start_observer(app.handle());
 
+            system_proxy::start(app.handle());
             if !minimized || !tray_enabled {
                 request_main_window(app.handle());
             }
@@ -117,6 +124,8 @@ pub fn run_application() -> Result<()> {
             claude_desktop_install::check_claude_desktop_release,
             claude_desktop_install::download_claude_desktop_release,
             claude_desktop_install::install_claude_desktop_release,
+            system_proxy::get_system_proxy_state,
+            system_proxy::set_system_proxy,
             settings::get_application_settings,
             settings::set_application_setting,
             logs::open_logs,
@@ -154,26 +163,37 @@ pub fn run_application() -> Result<()> {
         #[cfg(target_os = "macos")]
         tauri::RunEvent::Reopen { .. } => request_main_window(app),
         tauri::RunEvent::Exit => {
-            if let Err(error) = tauri::async_runtime::block_on(proxy::stop(app)) {
-                log::error!("proxy shutdown failed: {error:#}");
-            }
+            system_proxy::stop(app);
+            proxy::stop_observer(app);
         }
         _ => {}
     });
     Ok(())
 }
 
 fn request_main_window(app: &tauri::AppHandle) {
+    request_window(app, false);
+}
+
+#[cfg_attr(
+    not(any(target_os = "macos", target_os = "windows")),
+    expect(dead_code)
+)]
+fn request_settings_window(app: &tauri::AppHandle) {
+    request_window(app, true);
+}
+
+fn request_window(app: &tauri::AppHandle, show_settings: bool) {
     let app = app.clone();
     // WebView2 creation must not block a synchronous event callback on Windows.
     tauri::async_runtime::spawn_blocking(move || {
-        if let Err(error) = open_main_window(&app) {
+        if let Err(error) = open_main_window(&app, show_settings) {
             log::error!("failed to open main window: {error:#}");
         }
     });
 }
 
-fn open_main_window(app: &tauri::AppHandle) -> Result<()> {
+fn open_main_window(app: &tauri::AppHandle, show_settings: bool) -> Result<()> {
     let _guard = MAIN_WINDOW_LOCK
         .lock()
         .map_err(|_| anyhow!("main window lock poisoned"))?;
@@ -184,9 +204,20 @@ fn open_main_window(app: &tauri::AppHandle) -> Result<()> {
         .iter()
         .find(|window| window.label == MAIN_WINDOW_NAME)
         .context("main window configuration not found")?;
-    let window = match app.get_webview_window(MAIN_WINDOW_NAME) {
-        Some(window) => window,
-        None => WebviewWindowBuilder::from_config(app, config)?.build()?,
+    let window = if let Some(window) = app.get_webview_window(MAIN_WINDOW_NAME) {
+        if show_settings {
+            // Static trusted-local navigation, never interpolate command data.
+            window.eval("window.location.hash = '/settings';")?;
+        }
+        window
+    } else {
+        let mut builder = WebviewWindowBuilder::from_config(app, config)?;
+        if show_settings {
+            // Runs before React reads the initial hash, including on a newly
+            // recreated WebView. No event can be lost before UI subscription.
+            builder = builder.initialization_script("window.location.hash = '/settings';");
+        }
+        builder.build()?
     };
 
     window.set_title(&format!("{} v{}", config.title, app.package_info().version))?;