fix(tun): Windows single-label DNS via an NRPT catch-all (scutil equivalent)

Setting the WinTUN adapter DNS alone didn't cover single-label cluster names — Windows devolution + interface ordering skip it, so getaddrinfo("my-service") never reached the in-stack resolver ("Could not resolve host" in real apps, though the selftest's direct query passed). Install a catch-all NRPT rule (namespace ".") pointing all resolution at 198.18.<N>.53 via the DnsClient cmdlets, removed on teardown. The Windows counterpart of the macOS scutil repoint / Linux resolv.conf.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hhfrancois

cli/internal/tun/route_windows.go

@@ -5,6 +5,7 @@ package tun
 import (
 	"fmt"
 	"net/netip"
+	"os/exec"
 
 	"golang.org/x/sys/windows"
 	wgtun "golang.zx2c4.com/wireguard/tun"
@@ -47,10 +48,43 @@ func configure(dev any, _, cidr, dnsIP string, log logfn) ([]string, string, fun
 			log.f("tun[win]: set DNS: %v", e)
 		}
 	}
+	// Adapter DNS alone doesn't cover SINGLE-LABEL names (my-service): Windows
+	// devolution + interface ordering skip it, so getaddrinfo("my-service") never
+	// reaches our resolver ("Could not resolve host"). An NRPT catch-all rule points
+	// ALL name resolution at dnsIP — the Windows counterpart of the macOS scutil
+	// repoint. Our in-stack DNS answers cluster names with a fake IP and forwards the
+	// rest to the saved upstreams, so a machine-wide rule is safe.
+	if err := setSystemNRPT(dnsIP); err != nil {
+		log.f("tun[win]: NRPT repoint failed — single-label names may not resolve: %v", err)
+	} else {
+		log.f("tun[win]: system DNS repointed to %s (NRPT catch-all)", dnsIP)
+	}
 
 	cleanup := func() {
+		clearSystemNRPT(dnsIP)
 		_ = luid.FlushRoutes(v4)
 		_ = luid.FlushIPAddresses(v4)
 	}
 	return nil, "", cleanup, nil
 }
+
+// setSystemNRPT installs a catch-all Name Resolution Policy Table rule (namespace
+// ".") sending every DNS query to dnsIP. This is what makes single-label cluster
+// names resolve on Windows — the equivalent of scutil on macOS / resolv.conf on
+// Linux. Driven through the DnsClient cmdlets, which encode the DnsPolicyConfig
+// registry correctly (the same table WireGuard-Windows writes by hand), and flush
+// the resolver cache so a prior negative answer ("Could not resolve") doesn't stick.
+func setSystemNRPT(dnsIP string) error {
+	clearSystemNRPT(dnsIP) // drop a stale rule a crashed run may have left
+	return psRun("Add-DnsClientNrptRule -Namespace '.' -NameServers '" + dnsIP + "'; Clear-DnsClientCache")
+}
+
+// clearSystemNRPT removes the rule(s) pointing at dnsIP and flushes the cache. Keyed
+// on the server IP so it targets only ours, and tolerant of there being none.
+func clearSystemNRPT(dnsIP string) {
+	_ = psRun("Get-DnsClientNrptRule | Where-Object { $_.NameServers -contains '" + dnsIP + "' } | Remove-DnsClientNrptRule -Force; Clear-DnsClientCache")
+}
+
+func psRun(script string) error {
+	return exec.Command("powershell", "-NoProfile", "-NonInteractive", "-Command", script).Run()
+}