feat(desktop): relaunch elevated when starting TUN unprivileged

A proxy-only/system/pac launch runs without root/UAC, so if the user switches to
tun and starts it, the tun bring-up would just fail. Detect that at start
(`is_privileged` is false) and relaunch elevated via the existing whole-process
model — pkexec on Linux, UAC on Windows. On success the elevated copy takes over;
only a declined/failed prompt falls through to a clear "TUN mode needs
administrator rights" failure the UI surfaces.

Author: loss-and-quick

src-tauri/src/desktop/elevate.rs

@@ -37,6 +37,29 @@ const PASS_ENV: &[&str] = &[
     "KASUMI_SKIP_ELEVATION",
 ];
 
+/// Whether the process already has the privileges the tun data-path needs (root on
+/// Linux, admin on Windows), or elevation was explicitly waived. Drives the
+/// relaunch-into-tun decision: a `false` here on a tun start means we must re-exec.
+#[cfg(target_os = "linux")]
+pub fn is_privileged() -> bool {
+    let root = unsafe { libc::geteuid() == 0 };
+    root || std::env::var_os("KASUMI_SKIP_ELEVATION").is_some()
+}
+
+/// See the Linux variant.
+#[cfg(target_os = "windows")]
+pub fn is_privileged() -> bool {
+    use windows_sys::Win32::UI::Shell::IsUserAnAdmin;
+    let admin = unsafe { IsUserAnAdmin() != 0 };
+    admin || std::env::var_os("KASUMI_SKIP_ELEVATION").is_some()
+}
+
+/// Other desktops (macOS) have no elevation path yet; treat as privileged.
+#[cfg(not(any(target_os = "linux", target_os = "windows")))]
+pub fn is_privileged() -> bool {
+    true
+}
+
 /// Re-exec the process as root if it isn't already. Returns on the elevated side
 /// (or when no elevator is available — the data-path then fails loudly at start,
 /// which the UI surfaces). Must run before any GTK/Tauri init.

src-tauri/src/desktop/linux/platform.rs

@@ -270,6 +270,14 @@ impl Platform for DesktopPlatform {
         // Only `tun` mode brings up a tun device + routing; the other modes run the
         // core with just its local socks/http inbound.
         let tun = mode == ProxyMode::Tun;
+        // Tun needs root. If the process started unprivileged (a proxy-only/system/pac
+        // launch) and the user switched to tun, relaunch elevated now — this prompts
+        // pkexec and, on success, never returns (the elevated copy takes over). We only
+        // reach the line below if elevation was declined/unavailable.
+        if tun && !crate::desktop::elevate::is_privileged() {
+            crate::desktop::elevate::ensure_elevated();
+            return self.fail("TUN mode needs administrator rights").await;
+        }
         let result = if engine == CoreEngine::SingBox {
             self.start_singbox(tun).await
         } else {

src-tauri/src/desktop/windows/platform.rs

@@ -255,6 +255,14 @@ impl Platform for DesktopPlatform {
         // Only `tun` mode brings up a wintun device + routing; the other modes run
         // the core with just its local socks/http inbound.
         let tun = mode == ProxyMode::Tun;
+        // Tun needs admin. If the process started unprivileged (a proxy-only/system/pac
+        // launch) and the user switched to tun, relaunch elevated now — this prompts
+        // UAC and, on success, never returns (the elevated copy takes over). We only
+        // reach the line below if elevation was declined/unavailable.
+        if tun && !crate::desktop::elevate::is_privileged() {
+            crate::desktop::elevate::ensure_elevated();
+            return self.fail("TUN mode needs administrator rights").await;
+        }
         let result = if engine == CoreEngine::SingBox {
             self.start_singbox(tun).await
         } else {