@astralyn/sash 0.1.0

package/dist/mihomo-config.js

@@ -0,0 +1,334 @@
+import { isIP } from "node:net";
+import YAML from "yaml";
+import { ERROR_BODY_LIMIT, fetchWithRetry } from "./http.js";
+export function buildDefaultConfig() {
+    return {
+        mode: "rule",
+        "log-level": "info",
+        ipv6: true,
+        proxies: [],
+        "proxy-groups": [{ name: "PROXY", type: "select", proxies: ["DIRECT"] }],
+        rules: ["MATCH,PROXY"],
+    };
+}
+export function isValidMihomoConfig(doc) {
+    if (typeof doc !== "object" || doc === null || Array.isArray(doc))
+        return false;
+    const rec = doc;
+    return (("proxies" in rec && Array.isArray(rec.proxies)) ||
+        ("proxy-providers" in rec &&
+            typeof rec["proxy-providers"] === "object" &&
+            rec["proxy-providers"] !== null &&
+            !Array.isArray(rec["proxy-providers"])) ||
+        ("rules" in rec && Array.isArray(rec.rules)));
+}
+function firstHeader(value) {
+    if (Array.isArray(value))
+        return value[0];
+    return value;
+}
+export function parseSubscriptionUserinfo(header) {
+    if (!header)
+        return undefined;
+    const nums = {};
+    const knownKeys = new Set(["upload", "download", "total", "expire"]);
+    for (const pair of header.split(";")) {
+        const [k, v] = pair.split("=", 2);
+        const key = k?.trim() ?? "";
+        if (!knownKeys.has(key))
+            continue;
+        const n = Number(v?.trim());
+        if (Number.isFinite(n) && n >= 0)
+            nums[key] = n;
+    }
+    if (nums.upload === undefined || nums.download === undefined || nums.total === undefined) {
+        return undefined;
+    }
+    return {
+        upload: nums.upload,
+        download: nums.download,
+        total: nums.total,
+        ...(nums.expire !== undefined && nums.expire > 0 ? { expire: nums.expire } : {}),
+    };
+}
+export function parseContentDispositionFilename(header) {
+    if (!header)
+        return undefined;
+    const ext = header.match(/filename\*\s*=\s*(?:UTF-8|utf-8)''([^;]+)/);
+    if (ext?.[1]) {
+        try {
+            const decoded = sanitizeFilename(decodeURIComponent(ext[1].trim()));
+            if (decoded)
+                return stripYamlExt(decoded);
+        }
+        catch {
+        }
+    }
+    const plain = header.match(/filename\s*=\s*"?([^";]+)"?/);
+    const value = plain?.[1] ? sanitizeFilename(plain[1]) : undefined;
+    return value ? stripYamlExt(value) : undefined;
+}
+const C0_OR_DEL = new RegExp(`[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}]`, "g");
+function sanitizeFilename(name) {
+    return name.replace(C0_OR_DEL, "").trim();
+}
+function stripYamlExt(name) {
+    return name.replace(/\.(ya?ml)$/i, "");
+}
+function parseIntervalHours(header) {
+    if (!header)
+        return undefined;
+    const n = Number(header.trim());
+    return Number.isFinite(n) && n > 0 ? Math.floor(n) : undefined;
+}
+export function parseSafeHttpUrl(value) {
+    if (!value?.trim())
+        return undefined;
+    try {
+        const parsed = new URL(value.trim());
+        return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.href : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export const PROFILE_DOWNLOAD_SIZE_LIMIT = 8 * 1024 * 1024;
+const MAX_SUBSCRIPTION_REDIRECTS = 5;
+const PROFILE_FETCH_DEADLINE_MS = 30_000;
+function isRestrictedIpv4Address(parts) {
+    const [a = 0, b = 0, c = 0] = parts;
+    return (a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 0 && (c === 0 || c === 2)) ||
+        (a === 192 && b === 88 && c === 99) ||
+        (a === 192 && b === 168) ||
+        (a === 198 && (b === 18 || b === 19)) ||
+        (a === 198 && b === 51 && c === 100) ||
+        (a === 203 && b === 0 && c === 113) ||
+        a >= 224);
+}
+function parseIpv6Bytes(host) {
+    const pieces = host.toLowerCase().split("::");
+    if (pieces.length > 2)
+        return undefined;
+    const parseSide = (side) => {
+        if (!side)
+            return [];
+        const words = [];
+        for (const token of side.split(":")) {
+            if (token.includes(".")) {
+                const ipv4 = token.split(".").map(Number);
+                if (ipv4.length !== 4 ||
+                    ipv4.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+                    return undefined;
+                }
+                words.push(((ipv4[0] ?? 0) << 8) | (ipv4[1] ?? 0));
+                words.push(((ipv4[2] ?? 0) << 8) | (ipv4[3] ?? 0));
+                continue;
+            }
+            if (!/^[0-9a-f]{1,4}$/.test(token))
+                return undefined;
+            words.push(Number.parseInt(token, 16));
+        }
+        return words;
+    };
+    const left = parseSide(pieces[0] ?? "");
+    const right = parseSide(pieces[1] ?? "");
+    if (!left || !right)
+        return undefined;
+    const omitted = 8 - left.length - right.length;
+    if ((pieces.length === 1 && omitted !== 0) || (pieces.length === 2 && omitted < 1)) {
+        return undefined;
+    }
+    const words = [...left, ...Array.from({ length: omitted }, () => 0), ...right];
+    if (words.length !== 8)
+        return undefined;
+    const bytes = new Uint8Array(16);
+    for (let index = 0; index < words.length; index++) {
+        const word = words[index] ?? 0;
+        bytes[index * 2] = word >> 8;
+        bytes[index * 2 + 1] = word & 0xff;
+    }
+    return bytes;
+}
+function isRestrictedIpv6Address(host) {
+    const bytes = parseIpv6Bytes(host);
+    if (!bytes)
+        return true;
+    const allZero = bytes.every((byte) => byte === 0);
+    const loopback = bytes.slice(0, 15).every((byte) => byte === 0) && bytes[15] === 1;
+    if (allZero || loopback)
+        return true;
+    const compatiblePrefix = bytes.slice(0, 12).every((byte) => byte === 0);
+    const mappedPrefix = bytes.slice(0, 10).every((byte) => byte === 0) && bytes[10] === 0xff && bytes[11] === 0xff;
+    const translatedPrefix = bytes.slice(0, 8).every((byte) => byte === 0) &&
+        bytes[8] === 0xff &&
+        bytes[9] === 0xff &&
+        bytes[10] === 0 &&
+        bytes[11] === 0;
+    const wellKnownNat64Prefix = bytes[0] === 0 &&
+        bytes[1] === 0x64 &&
+        bytes[2] === 0xff &&
+        bytes[3] === 0x9b &&
+        bytes.slice(4, 12).every((byte) => byte === 0);
+    if (compatiblePrefix || mappedPrefix || translatedPrefix || wellKnownNat64Prefix) {
+        return isRestrictedIpv4Address(Array.from(bytes.slice(12)));
+    }
+    if (bytes[0] === 0x20 && bytes[1] === 0x02) {
+        return isRestrictedIpv4Address(Array.from(bytes.slice(2, 6)));
+    }
+    if (((bytes[0] ?? 0) & 0xfe) === 0xfc)
+        return true;
+    if (bytes[0] === 0xfe && ((bytes[1] ?? 0) & 0xc0) >= 0x80)
+        return true;
+    if (bytes[0] === 0xff)
+        return true;
+    if (bytes[0] === 0x01 && bytes.slice(1, 8).every((byte) => byte === 0))
+        return true;
+    if (bytes[0] === 0x20 && bytes[1] === 0x01 && bytes[2] === 0x0d && bytes[3] === 0xb8) {
+        return true;
+    }
+    return false;
+}
+function isRestrictedSubscriptionHost(hostname) {
+    const host = hostname
+        .toLowerCase()
+        .replace(/^\[|\]$/g, "")
+        .replace(/\.$/, "");
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return true;
+    if (isIP(host) === 4) {
+        return isRestrictedIpv4Address(host.split(".").map(Number));
+    }
+    if (isIP(host) === 6)
+        return isRestrictedIpv6Address(host);
+    return false;
+}
+export function resolveSubscriptionRedirect(initial, current, location) {
+    const target = new URL(location, current);
+    if (target.protocol !== "http:" && target.protocol !== "https:") {
+        throw new Error(`Refusing subscription redirect to non-http(s) URL: ${target.href}`);
+    }
+    if (current.protocol === "https:" && target.protocol === "http:") {
+        throw new Error(`Refusing HTTPS-to-HTTP subscription redirect: ${target.href}`);
+    }
+    const initialRestricted = isRestrictedSubscriptionHost(initial.hostname);
+    const targetRestricted = isRestrictedSubscriptionHost(target.hostname);
+    if (initialRestricted && target.origin !== initial.origin) {
+        throw new Error(`Refusing subscription redirect away from restricted origin: ${target.href}`);
+    }
+    if (!initialRestricted && targetRestricted) {
+        throw new Error(`Refusing subscription redirect to restricted host: ${target.hostname}`);
+    }
+    return target;
+}
+export async function fetchSubscriptionProfile(url) {
+    let initial;
+    try {
+        initial = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid subscription URL: ${url}`);
+    }
+    if (initial.protocol !== "https:" && initial.protocol !== "http:") {
+        throw new Error(`Subscription URL must be http(s): ${url}`);
+    }
+    const deadlineAt = Date.now() + PROFILE_FETCH_DEADLINE_MS;
+    let current = initial;
+    let res;
+    for (let redirects = 0;; redirects += 1) {
+        const remainingDeadlineMs = deadlineAt - Date.now();
+        if (remainingDeadlineMs <= 0) {
+            throw new Error(`Subscription fetch deadline exceeded after ${PROFILE_FETCH_DEADLINE_MS}ms`);
+        }
+        res = await fetchWithRetry(current.href, {
+            attempts: 3,
+            deadlineMs: remainingDeadlineMs,
+            manualRedirect: true,
+            headers: { "user-agent": "clash.meta; mihomo; sash" },
+        });
+        if (res.statusCode < 300 || res.statusCode >= 400)
+            break;
+        const locationHeader = firstHeader(res.headers.location);
+        await res.discard();
+        if (!locationHeader)
+            throw new Error(`Subscription fetch failed: HTTP ${res.statusCode}`);
+        if (redirects >= MAX_SUBSCRIPTION_REDIRECTS) {
+            throw new Error(`Too many subscription redirects (>${MAX_SUBSCRIPTION_REDIRECTS})`);
+        }
+        current = resolveSubscriptionRedirect(initial, current, locationHeader);
+    }
+    if (res.statusCode !== 200) {
+        await res.text(ERROR_BODY_LIMIT);
+        throw new Error(`Subscription fetch failed: HTTP ${res.statusCode}`);
+    }
+    const text = await res.text(PROFILE_DOWNLOAD_SIZE_LIMIT);
+    let doc;
+    try {
+        doc = YAML.parse(text);
+    }
+    catch (err) {
+        throw new Error(`Subscription is not valid YAML (Clash/mihomo format required): ${err.message}`);
+    }
+    if (!isValidMihomoConfig(doc)) {
+        throw new Error("Subscription content is not a Clash/mihomo config (missing proxies/rules). " +
+            "Convert non-Clash subscriptions with a subconverter first.");
+    }
+    return {
+        doc,
+        yamlText: text,
+        name: parseContentDispositionFilename(firstHeader(res.headers["content-disposition"])),
+        subInfo: parseSubscriptionUserinfo(firstHeader(res.headers["subscription-userinfo"])),
+        homePage: parseSafeHttpUrl(firstHeader(res.headers["profile-web-page-url"])),
+        intervalHours: parseIntervalHours(firstHeader(res.headers["profile-update-interval"])),
+    };
+}
+const MANAGED_KEYS = new Set([
+    "mixed-port",
+    "port",
+    "socks-port",
+    "redir-port",
+    "tproxy-port",
+    "authentication",
+    "external-controller",
+    "external-controller-tls",
+    "external-ui",
+    "external-ui-url",
+    "external-ui-name",
+    "secret",
+    "tun",
+    "allow-lan",
+]);
+export function stripManagedKeys(base) {
+    return Object.fromEntries(Object.entries(base).filter(([key]) => !MANAGED_KEYS.has(key)));
+}
+export function overlayManagedKeys(base, settings) {
+    const out = stripManagedKeys(base);
+    out["mixed-port"] = settings.mixedPort;
+    out["allow-lan"] = settings.allowLan;
+    out["external-controller"] = settings.controller;
+    out.secret = settings.secret;
+    if (settings.tun) {
+        out.tun = {
+            enable: true,
+            stack: "mixed",
+            "auto-route": true,
+            "auto-detect-interface": true,
+            "dns-hijack": ["any:53"],
+        };
+    }
+    return out;
+}
+export function renderConfig(base, settings, source) {
+    const merged = overlayManagedKeys(base, settings);
+    const proxies = merged.proxies;
+    return {
+        yaml: YAML.stringify(merged, { indent: 2 }),
+        proxyCount: Array.isArray(proxies) ? proxies.length : 0,
+        source,
+    };
+}

package/dist/node-version-guard.js

@@ -0,0 +1,8 @@
+const REQUIRED_NODE_MAJOR = 24;
+const major = Number.parseInt(process.versions.node.split(".")[0] ?? "0", 10);
+if (Number.isNaN(major) || major < REQUIRED_NODE_MAJOR) {
+    console.error(`Sash requires Node.js ${REQUIRED_NODE_MAJOR} or newer (found ${process.versions.node}).`);
+    console.error("Please upgrade Node.js: https://nodejs.org/");
+    process.exit(1);
+}
+export {};

package/dist/offline-mutation.js

@@ -0,0 +1,58 @@
+import fs from "node:fs";
+import { assertCoreInstallationConsistent } from "./core.js";
+import { recoverCoreInstallTransaction } from "./core-install-transaction.js";
+import { recoverCoordinatedCoreUpdate } from "./core-update-coordination.js";
+import { evaluateDaemon } from "./daemon-lifecycle.js";
+import { readManagedStateTransactionStatus, recoverManagedStateTransaction, } from "./managed-state-transaction.js";
+import { isProcessAlive, readPidRecord } from "./process.js";
+import { migrateProfileState } from "./profile-migration.js";
+import { reconcileOrphanedRuntime } from "./runtime-recovery.js";
+import { loadSettings } from "./settings.js";
+import { withStateLock } from "./state-lock.js";
+export async function runOfflineMutation(ctx, purpose, action, options = {}) {
+    return withStateLock(ctx.layout.mutationLockFile, { purpose, timeoutMs: 30_000 }, async () => {
+        ctx.settings = loadSettings(ctx.layout);
+        const daemon = await evaluateDaemon(ctx.layout, ctx.settings);
+        if (daemon.kind !== "stopped") {
+            const owner = daemon.pid ? ` (PID=${daemon.pid})` : "";
+            throw new Error(`sashd owns the data directory${owner} but is not accepting this operation; stop or recover it before retrying`);
+        }
+        const reconciliation = options.reconcileRuntime;
+        if (!reconciliation) {
+            const core = readPidRecord(ctx.layout.pidFile);
+            if (!core && fs.existsSync(ctx.layout.pidFile)) {
+                throw new Error(`Core PID record is corrupt: ${ctx.layout.pidFile}; reconcile it before modifying state`);
+            }
+            if (core && isProcessAlive(core.pid)) {
+                throw new Error(`Core PID ${core.pid} is still alive without sashd; run \`sash stop\` to reconcile it before modifying state`);
+            }
+        }
+        recoverCoreInstallTransaction(ctx.layout);
+        if (reconciliation) {
+            const managed = readManagedStateTransactionStatus(ctx.layout);
+            if (managed?.coordination !== "core-update") {
+                recoverManagedStateTransaction(ctx.layout);
+            }
+            ctx.settings = loadSettings(ctx.layout);
+            await reconcileOrphanedRuntime({
+                layout: ctx.layout,
+                settings: ctx.settings,
+                ...(reconciliation.legacyDaemon ? { legacyDaemon: reconciliation.legacyDaemon } : {}),
+                ...(reconciliation.verifyControllerVacant
+                    ? { verifyControllerVacant: reconciliation.verifyControllerVacant }
+                    : {}),
+            }, reconciliation.deps);
+        }
+        else {
+            recoverCoordinatedCoreUpdate(ctx.layout);
+            if (options.allowInconsistentCore !== "force-update") {
+                assertCoreInstallationConsistent(ctx.layout);
+            }
+        }
+        ctx.settings = loadSettings(ctx.layout);
+        if (options.migrateProfiles) {
+            await migrateProfileState(ctx.settings, ctx.layout);
+        }
+        return action();
+    });
+}

package/dist/paths.js

@@ -0,0 +1,57 @@
+import os from "node:os";
+import path from "node:path";
+function envPathOr(fallback, value) {
+    const trimmed = value?.trim();
+    return trimmed && path.isAbsolute(trimmed) ? trimmed : fallback;
+}
+export function sashRoot() {
+    const override = process.env.SASH_HOME?.trim();
+    if (override) {
+        if (!path.isAbsolute(override)) {
+            throw new Error(`SASH_HOME must be an absolute path, got: ${override}`);
+        }
+        return override;
+    }
+    if (process.platform === "win32") {
+        const base = envPathOr(path.join(os.homedir(), "AppData", "Local"), process.env.LOCALAPPDATA);
+        return path.join(base, "Sash");
+    }
+    if (process.platform === "darwin") {
+        return path.join(os.homedir(), "Library", "Application Support", "Sash");
+    }
+    const xdgData = envPathOr(path.join(os.homedir(), ".local", "share"), process.env.XDG_DATA_HOME);
+    return path.join(xdgData, "sash");
+}
+export function sashLayout(root = sashRoot()) {
+    const exeName = process.platform === "win32" ? "mihomo.exe" : "mihomo";
+    return {
+        root,
+        binDir: path.join(root, "bin"),
+        coreExe: path.join(root, "bin", exeName),
+        configFile: path.join(root, "config.yaml"),
+        settingsFile: path.join(root, "sash.json"),
+        profilesDir: path.join(root, "profiles"),
+        profilesIndexFile: path.join(root, "profiles", "index.json"),
+        uiDir: path.join(root, "ui"),
+        stateDir: path.join(root, "state"),
+        pidFile: path.join(root, "state", "sash.pid"),
+        daemonPidFile: path.join(root, "state", "sashd.pid"),
+        daemonLeaseFile: path.join(root, "state", "sashd.lock"),
+        daemonStartLockFile: path.join(root, "state", "sashd-start.lock"),
+        runtimeOperationLockFile: path.join(root, "state", "runtime.lock"),
+        mutationLockFile: path.join(root, "state", "mutation.lock"),
+        settingsLockFile: path.join(root, "state", "settings.lock"),
+        systemProxyStateFile: path.join(root, "state", "system-proxy.json"),
+        managedStateTransactionFile: path.join(root, "state", "managed-state-transaction.json"),
+        installFile: path.join(root, "state", "install.json"),
+        coreInstallTransactionFile: path.join(root, "state", "core-install-transaction.json"),
+        coreUpdateTransactionFile: path.join(root, "state", "core-update-transaction.json"),
+        logsDir: path.join(root, "logs"),
+        coreLogFile: path.join(root, "logs", "mihomo.log"),
+        coreErrLogFile: path.join(root, "logs", "mihomo.err.log"),
+        sashLogFile: path.join(root, "logs", "sash.log"),
+        daemonLogFile: path.join(root, "logs", "sashd.log"),
+        daemonErrLogFile: path.join(root, "logs", "sashd.err.log"),
+        tempDir: path.join(root, "temp"),
+    };
+}