[official-burak]

Summary

• Windows MITM DNS provisioning and Repair no longer take the POSIX sudo -S path on a Linux-built artifact.
• Platform checks in the DNS/sudo helpers now read os.platform() at call time, matching fix(startup): preserve Windows Tailscale Funnel code paths in published builds #10293 / Windows: cliproxy always fetches Linux binary + missing .exe on install/spawn; combos PATCH endpoint broken (405 + missing {id}); oauth status --output table crashes #11236, so Turbopack cannot fold process.platform to the build host and prune the PowerShell branch.

Related Issues

• Closes bug(mitm): DNS provisioning uses Linux sudo -S on Windows, breaks on Windows 11's built-in sudo.exe #11430
• Related to fix(startup): preserve Windows Tailscale Funnel code paths in published builds #10293, Windows: cliproxy always fetches Linux binary + missing .exe on install/spawn; combos PATCH endpoint broken (405 + missing {id}); oauth status --output table crashes #11236

Changelog

On Windows 11 with native sudo.exe enabled, Agent Bridge MITM start and Repair logged unexpected argument '-S' and never wrote hosts entries. The published bundle is built on Linux; a module-load const IS_WIN = process.platform === "win32" was folded to false, so addDNSEntries / removeDNSEntries spawned POSIX sudo -S. Windows 11's sudo CLI rejects that flag.

This routes Windows through elevated PowerShell again, keeps POSIX sudo -S on Linux/macOS, and stops the sudo-availability probe from treating Windows sudo.exe as Unix sudo.

Description

src/mitm/dns/dnsConfig.ts had the same foldable pattern already fixed for Tailscale and cliproxy:

const IS_WIN = process.platform === "win32";

After a Linux next build, the Windows hosts-file branch is dead code in dist. provisionDnsEntries() and repairMitm() then call sudo -S tee -a /etc/hosts. On Windows 11 that binary is Microsoft sudo, which errors on -S.

Changes:

• dnsConfig.ts: isWin32() / hostsFilePath() via os.platform() at call time.
• systemCommands.ts: isSudoAvailable() returns false on win32 via os.platform(), so execFileWithPassword cannot spawn native sudo.exe with POSIX -S.
• sudoGate.ts: skip the sudo-password gate on win32 via the same runtime read (UAC still handles elevation).

POSIX behavior is unchanged: sudo -S tee / sudo -S node -e still write /etc/hosts when not on Windows.

Validation

• Change type: other (MITM DNS / Windows elevation)
• Focused tests from the golden path for this area, plus a new anti-fold guard

node --import tsx/esm --import ./open-sse/utils/setupPolyfill.ts --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit \
  tests/unit/mitm-dns-win32-sudo-fold-11430.test.ts \
  tests/unit/dns-config-generic.test.ts \
  tests/unit/mitm-systemCommands-no-sudo.test.ts \
  tests/unit/mitm-sudo-gate-822.test.ts

Result: 34/34 pass (8 new in mitm-dns-win32-sudo-fold-11430.test.ts).

Fail-then-pass: the new source guard fails if const IS_WIN = process.platform === "win32" is restored; with os.platform() it passes. The behavioral test mocks os.platform() to win32 and asserts runElevatedPowerShell (Add-Content) with zero POSIX sudo spawns.

Also ran locally: prettier on the touched files, eslint on the touched files (clean), check-docs-sync, check:any-budget:t11, check-tracked-artifacts.

Tests Added Or Updated

• tests/unit/mitm-dns-win32-sudo-fold-11430.test.ts (new)
• tests/unit/dns-config-generic.test.ts (Hard Rule deps: bump qs from 6.14.1 to 6.14.2 #13 source assertions follow hostsFilePath())

Coverage Notes

src/mitm/dns/dnsConfig.ts, src/mitm/systemCommands.ts, and src/mitm/sudoGate.ts are covered by the new fold guard and the win32 os.platform() mocks above. Existing sudo-strip and sudo-gate tests still pass.

Reviewer Notes

Same class of bug as #10293 / #11236 (Linux-build fold of process.platform). I did not change src/mitm/cert/install.ts; it still has module-load IS_WIN / IS_MAC and can fold the same way for cert trust. Happy to follow up if you want that in this PR.

Local husky lint-staged ESLint reports unused bulk suppressions when linting only the staged files (base-red #11449). CI already uses --pass-on-unpruned-suppressions for that. This diff does not touch eslint-suppressions.json.