Block AI Tools with PAC Files at the Browser Level

# Dynamic PAC file generator (PHP)
# Host at: http://wpad.corp.example.com/wpad.dat
# Fetches AI domains from the blocklist API, caches for 1 hour

<?php
header('Content-Type: application/x-ns-proxy-autoconfig');
header('Cache-Control: max-age=3600');

$cacheFile = '/tmp/ai-blocklist-cache.csv';
$cacheTTL  = 3600;

if (!file_exists($cacheFile) ||
    time() - filemtime($cacheFile) > $cacheTTL) {
    $ctx = stream_context_create(['http' => [
        'header' => 'X-API-Key: YOUR_API_KEY'
    ]]);
    $response = file_get_contents(
        'https://www.aitoolsblocklist.com/api/database/?action=download_database',
        false, $ctx
    );
    file_put_contents($cacheFile, $response);
} else {
    $response = file_get_contents($cacheFile);
}

// Extract the domain column from the CSV (domain,category,subcategory)
$lines   = array_slice(array_filter(explode("\n", trim($response))), 1);
$domains = array_map(fn($l) => explode(',', $l)[0], $lines);

// Build the dnsDomainIs() conditions
$conditions = [];
foreach ($domains as $d) {
    $d = trim(strtolower($d));
    if ($d) $conditions[] = 'dnsDomainIs(h,"'.$d.'")';
}

echo "function FindProxyForURL(url, host) {\n";
echo "  var h = host.toLowerCase();\n";
echo "  if (" . implode(" ||\n      ", $conditions) . ") {\n";
echo "    return \"PROXY block.internal.corp:8080\";\n";
echo "  }\n";
echo "  return \"DIRECT\";\n";
echo "}\n";
?>

# GPO Registry Settings for PAC File
# Path: User Configuration > Preferences > Windows Settings > Registry

# Enable automatic proxy configuration
Key:   HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Value: AutoConfigURL
Type:  REG_SZ
Data:  http://wpad.corp.example.com/wpad.dat

# Disable "Automatically detect settings" to prevent WPAD override
Key:   HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Value: DefaultConnectionSettings
# Byte 8 bit 4: 0 = disable auto-detect, 1 = enable

# --- Chrome-specific policy (if not using system settings) ---
# ADMX: Google Chrome > Proxy Settings
Key:   HKLM\Software\Policies\Google\Chrome
Value: ProxyPacUrl
Type:  REG_SZ
Data:  http://wpad.corp.example.com/wpad.dat

Key:   HKLM\Software\Policies\Google\Chrome
Value: ProxyMode
Type:  REG_SZ
Data:  pac_script

# --- Edge Chromium-specific policy ---
Key:   HKLM\Software\Policies\Microsoft\Edge
Value: ProxyPacUrl
Type:  REG_SZ
Data:  http://wpad.corp.example.com/wpad.dat

Key:   HKLM\Software\Policies\Microsoft\Edge
Value: ProxyMode
Type:  REG_SZ
Data:  pac_script

# --- PowerShell: Apply PAC URL to all users immediately ---
$pac = "http://wpad.corp.example.com/wpad.dat"
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
    -Name "AutoConfigURL" -Value $pac

# Verify the setting was applied
Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" `
    -Name "AutoConfigURL"

// High-performance PAC file with hash-set domain lookup
// Handles 40,000+ domains with O(1) lookup time

var BLOCKED = {
    "openai.com": 1,
    "chatgpt.com": 1,
    "anthropic.com": 1,
    "claude.ai": 1,
    "gemini.google.com": 1,
    "midjourney.com": 1,
    "stability.ai": 1,
    "perplexity.ai": 1,
    "cursor.sh": 1,
    "copilot.github.com": 1,
    "codeium.com": 1,
    "writesonic.com": 1,
    "jasper.ai": 1,
    "copy.ai": 1,
    "replit.com": 1,
    "huggingface.co": 1,
    "leonardo.ai": 1,
    "poe.com": 1
    // ... 40,000+ entries generated by API
};

function FindProxyForURL(url, host) {
    var h = host.toLowerCase();

    // Direct lookup
    if (BLOCKED[h]) {
        return "PROXY block.internal.corp:8080";
    }

    // Walk up domain hierarchy for subdomain matching
    // e.g., "api.openai.com" matches "openai.com"
    var parts = h.split(".");
    for (var i = 1; i < parts.length - 1; i++) {
        var parent = parts.slice(i).join(".");
        if (BLOCKED[parent]) {
            return "PROXY block.internal.corp:8080";
        }
    }

    return "DIRECT";
}