@astralyn/sash 0.1.0

package/dist/supervisor.js

@@ -0,0 +1,301 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { MihomoApi } from "./api.js";
+import { containsCoreVersionToken } from "./core-version.js";
+import { boundedLogTailSince, logTailCursor } from "./log-follow.js";
+import { buildSanitizedEnv, classifyProcessIdentity, clearPidRecord, isProcessAlive, killProcessGracefully, readPidRecord, withPrivateAppendLogFds, writePidRecord, } from "./process.js";
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function managedPathsMatch(a, b) {
+    const left = path.resolve(a);
+    const right = path.resolve(b);
+    return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+export class CoreSupervisor {
+    child = null;
+    pidRecordOwners = new WeakSet();
+    childStartedAt;
+    childGeneration = 0;
+    stopping = false;
+    layout;
+    getSettings;
+    spawnFn;
+    waitHealthyMs;
+    getExpectedVersion;
+    isAlive;
+    kill;
+    classifyIdentity;
+    onExitCallback;
+    constructor(opts) {
+        this.layout = opts.layout;
+        this.getSettings = opts.settings;
+        this.waitHealthyMs = opts.waitHealthyMs ?? 10_000;
+        const expectedVersion = opts.expectedVersion;
+        this.getExpectedVersion =
+            typeof expectedVersion === "function" ? expectedVersion : () => expectedVersion;
+        this.isAlive = opts.isAliveFn ?? isProcessAlive;
+        this.kill = opts.killFn ?? killProcessGracefully;
+        this.classifyIdentity = opts.classifyIdentityFn ?? classifyProcessIdentity;
+        this.onExitCallback = opts.onExit;
+        this.spawnFn = opts.spawnFn ?? this.defaultSpawn.bind(this);
+    }
+    ownedChildIdentity(child) {
+        if (this.child !== child)
+            return "mismatch";
+        if (child.exitCode !== null && child.exitCode !== undefined)
+            return "mismatch";
+        if (child.signalCode !== null && child.signalCode !== undefined)
+            return "mismatch";
+        return child.pid && this.isAlive(child.pid) ? "match" : "mismatch";
+    }
+    defaultSpawn(layout, _settings) {
+        fs.mkdirSync(layout.logsDir, { recursive: true });
+        fs.mkdirSync(layout.stateDir, { recursive: true });
+        return withPrivateAppendLogFds(layout.coreLogFile, layout.coreErrLogFile, ({ stdoutFd, stderrFd }) => spawn(layout.coreExe, ["-d", layout.root, "-f", layout.configFile], {
+            cwd: layout.root,
+            stdio: ["ignore", stdoutFd, stderrFd],
+            windowsHide: true,
+            env: buildSanitizedEnv(),
+        }));
+    }
+    clearOwnedPidRecord(child) {
+        if (this.pidRecordOwners.delete(child))
+            clearPidRecord(this.layout.pidFile);
+    }
+    async abortStart(child, pid, pidRecord) {
+        this.stopping = true;
+        const terminated = await this.kill(pid, {
+            timeoutMs: 3000,
+            verify: () => this.ownedChildIdentity(child),
+        });
+        if (terminated && this.child === child) {
+            this.child = null;
+            this.childStartedAt = undefined;
+            this.childGeneration++;
+            if (pidRecord === "owned")
+                this.clearOwnedPidRecord(child);
+        }
+        return terminated;
+    }
+    async probeTunActive(api) {
+        try {
+            return await api.getTunActive();
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async start() {
+        if (this.child && this.isAlive(this.child.pid ?? -1)) {
+            throw new Error(`Core is already running (PID=${this.child.pid})`);
+        }
+        if (!fs.existsSync(this.layout.coreExe)) {
+            throw new Error(`Core executable not found at ${this.layout.coreExe}`);
+        }
+        if (!fs.existsSync(this.layout.configFile)) {
+            throw new Error(`Core config not found at ${this.layout.configFile}`);
+        }
+        const expectedVersion = this.getExpectedVersion();
+        this.stopping = false;
+        const settings = this.getSettings();
+        const errLogCursor = logTailCursor(this.layout.coreErrLogFile);
+        const child = this.spawnFn(this.layout, settings);
+        let spawnError;
+        child.on("error", (err) => {
+            spawnError = err;
+        });
+        const pid = child.pid;
+        if (!pid) {
+            throw new Error("Failed to start core process (no PID returned)");
+        }
+        this.child = child;
+        this.childStartedAt = new Date().toISOString();
+        this.childGeneration++;
+        child.once("exit", (code, signal) => {
+            if (this.child !== child)
+                return;
+            const wasStopping = this.stopping;
+            this.child = null;
+            this.childStartedAt = undefined;
+            this.childGeneration++;
+            this.clearOwnedPidRecord(child);
+            if (!wasStopping) {
+                Promise.resolve(this.onExitCallback?.(code, signal)).catch(() => {
+                });
+            }
+        });
+        try {
+            writePidRecord(this.layout.pidFile, {
+                pid,
+                exe: this.layout.coreExe,
+                startedAt: this.childStartedAt,
+            });
+            this.pidRecordOwners.add(child);
+        }
+        catch (err) {
+            const terminated = await this.abortStart(child, pid, "uncertain");
+            const cleanup = terminated ? "" : `; process ${pid} could not be confirmed stopped`;
+            throw new Error(`Failed to persist Core PID ownership: ${err.message}${cleanup}`);
+        }
+        const api = new MihomoApi(settings.controller, settings.secret);
+        const deadline = Date.now() + this.waitHealthyMs;
+        let version;
+        let healthyProbes = 0;
+        while (Date.now() < deadline) {
+            if (spawnError) {
+                const terminated = await this.abortStart(child, pid, "owned");
+                const details = boundedLogTailSince(this.layout.coreErrLogFile, errLogCursor, {
+                    maxLines: 20,
+                });
+                const cleanup = terminated ? "" : `; process ${pid} could not be confirmed stopped`;
+                throw new Error(`Failed to start core: ${spawnError.message}${cleanup}${details ? `\n${details}` : ""}`);
+            }
+            if (!this.isAlive(pid)) {
+                this.clearOwnedPidRecord(child);
+                const details = boundedLogTailSince(this.layout.coreErrLogFile, errLogCursor, {
+                    maxLines: 20,
+                });
+                throw new Error(`Core exited during startup.${details ? `\nRecent errors:\n${details}` : ""}`);
+            }
+            try {
+                version = await api.version();
+                if (expectedVersion && !containsCoreVersionToken(version, expectedVersion)) {
+                    throw new Error(`Controller version ${version} does not match expected ${expectedVersion}`);
+                }
+                healthyProbes++;
+                if (healthyProbes >= 2 && this.isAlive(pid)) {
+                    const tunActive = await this.probeTunActive(api);
+                    if (this.isAlive(pid)) {
+                        return {
+                            pid,
+                            version,
+                            ...(tunActive !== undefined ? { tunActive } : {}),
+                        };
+                    }
+                }
+            }
+            catch {
+                healthyProbes = 0;
+            }
+            await sleep(250);
+        }
+        const terminated = await this.abortStart(child, pid, "owned");
+        const details = boundedLogTailSince(this.layout.coreErrLogFile, errLogCursor, {
+            maxLines: 20,
+        });
+        const cleanup = terminated
+            ? ""
+            : " The process could not be confirmed stopped; PID state was preserved.";
+        throw new Error(`Core started (PID=${pid}) but external-controller did not become healthy within ${this.waitHealthyMs}ms.${cleanup}${details ? `\nRecent errors:\n${details}` : ""}`);
+    }
+    async stop() {
+        const child = this.child;
+        if (!child?.pid || !this.isAlive(child.pid)) {
+            if (this.child)
+                this.childGeneration++;
+            this.child = null;
+            this.childStartedAt = undefined;
+            clearPidRecord(this.layout.pidFile);
+            return;
+        }
+        this.stopping = true;
+        const pid = child.pid;
+        const terminated = await this.kill(pid, {
+            timeoutMs: 8000,
+            verify: () => this.ownedChildIdentity(child),
+        });
+        if (!terminated) {
+            throw new Error(`Core process is still running after termination attempt (PID=${pid})`);
+        }
+        if (this.child === child) {
+            this.child = null;
+            this.childStartedAt = undefined;
+            this.childGeneration++;
+            this.clearOwnedPidRecord(child);
+        }
+    }
+    async restart() {
+        await this.stop();
+        return this.start();
+    }
+    ownedCoreSnapshot() {
+        const child = this.child;
+        if (!child?.pid || !this.isAlive(child.pid))
+            return undefined;
+        return { generation: this.childGeneration, pid: child.pid };
+    }
+    ownsCore(snapshot) {
+        const child = this.child;
+        return Boolean(child &&
+            child.pid === snapshot.pid &&
+            this.childGeneration === snapshot.generation &&
+            this.isAlive(snapshot.pid));
+    }
+    async status() {
+        const ownership = this.ownedCoreSnapshot();
+        if (!ownership)
+            return { running: false };
+        const settings = this.getSettings();
+        const api = new MihomoApi(settings.controller, settings.secret);
+        let healthy = false;
+        let version;
+        let tunActive;
+        try {
+            version = await api.version();
+            healthy = true;
+            if (!this.ownsCore(ownership))
+                return { running: false };
+            tunActive = await this.probeTunActive(api);
+        }
+        catch {
+            healthy = false;
+        }
+        if (!this.ownsCore(ownership))
+            return { running: false };
+        return {
+            running: true,
+            pid: ownership.pid,
+            startedAt: this.childStartedAt,
+            healthy,
+            version,
+            ...(tunActive !== undefined ? { tunActive } : {}),
+        };
+    }
+    isRunning() {
+        return Boolean(this.child && this.isAlive(this.child.pid ?? -1));
+    }
+    async cleanStaleCore() {
+        const record = readPidRecord(this.layout.pidFile);
+        if (!record) {
+            if (fs.existsSync(this.layout.pidFile)) {
+                throw new Error(`Core PID record is corrupt: ${this.layout.pidFile}`);
+            }
+            return;
+        }
+        if (!managedPathsMatch(record.exe, this.layout.coreExe)) {
+            throw new Error(`Core PID record executable does not match the managed path: ${record.exe}`);
+        }
+        if (!this.isAlive(record.pid)) {
+            clearPidRecord(this.layout.pidFile);
+            return;
+        }
+        const identity = this.classifyIdentity(record.pid, this.layout.coreExe);
+        if (identity === "mismatch") {
+            clearPidRecord(this.layout.pidFile);
+            return;
+        }
+        if (identity === "unknown") {
+            throw new Error(`Refusing to terminate stale Core PID ${record.pid}: process identity could not be verified`);
+        }
+        const terminated = await this.kill(record.pid, {
+            timeoutMs: 5000,
+            verify: () => this.classifyIdentity(record.pid, this.layout.coreExe),
+        });
+        if (!terminated) {
+            throw new Error(`Stale Core process is still running after termination attempt (PID=${record.pid})`);
+        }
+        clearPidRecord(this.layout.pidFile);
+    }
+}

package/dist/sysproxy/common.js

@@ -0,0 +1,99 @@
+import { errorMessage } from "../error-utils.js";
+import { isPlainObject } from "../json-shape.js";
+import { findExecutableOnPath, runSanitizedCommandAsync, windowsSystemExecutable, } from "../process.js";
+import { DEFAULT_BYPASS_LIST } from "./types.js";
+const MAX_PROXY_STRING_LENGTH = 4096;
+const MAX_SERVICE_NAME_LENGTH = 512;
+export { errorMessage, isPlainObject };
+export function parseProxyString(value, label, allowEmpty = true) {
+    if (typeof value !== "string") {
+        throw new Error(`Invalid system proxy snapshot: ${label} must be a string`);
+    }
+    if ((!allowEmpty && value.length === 0) || value.length > MAX_PROXY_STRING_LENGTH) {
+        throw new Error(`Invalid system proxy snapshot: ${label} has an invalid length`);
+    }
+    for (const character of value) {
+        const code = character.charCodeAt(0);
+        if (code < 0x20 || code === 0x7f) {
+            throw new Error(`Invalid system proxy snapshot: ${label} contains control characters`);
+        }
+    }
+    return value;
+}
+export function parseServiceName(value, label) {
+    const service = parseProxyString(value, label, false);
+    if (service.length > MAX_SERVICE_NAME_LENGTH) {
+        throw new Error(`Invalid system proxy snapshot: ${label} has an invalid length`);
+    }
+    return service;
+}
+export function parseSnapshotPort(value, label) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 65_535) {
+        throw new Error(`Invalid system proxy snapshot: ${label} must be an integer from 0 to 65535`);
+    }
+    return value;
+}
+export function parseProxyEnable(value) {
+    if (value === null)
+        return null;
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > 0xffff_ffff) {
+        throw new Error("Invalid system proxy snapshot: proxyEnable must be null or an unsigned 32-bit integer");
+    }
+    return value;
+}
+export function compareStrings(a, b) {
+    if (a < b)
+        return -1;
+    if (a > b)
+        return 1;
+    return 0;
+}
+export function isSystemProxySupported(platform = process.platform) {
+    if (platform === "win32" || platform === "darwin")
+        return true;
+    if (platform !== "linux")
+        return false;
+    return findExecutableOnPath("gsettings") !== undefined;
+}
+function resolveSystemProxyCommand(command) {
+    if (process.platform === "win32" && command.toLowerCase() === "reg.exe") {
+        return windowsSystemExecutable("reg.exe");
+    }
+    if (process.platform === "darwin" && command === "networksetup") {
+        return "/usr/sbin/networksetup";
+    }
+    if (process.platform === "linux" && command === "gsettings") {
+        const resolved = findExecutableOnPath(command);
+        if (!resolved)
+            throw new Error("gsettings is not available on this system");
+        return resolved;
+    }
+    return command;
+}
+export function runCmd(cmd, args, timeoutMs = 5000) {
+    return runSanitizedCommandAsync(resolveSystemProxyCommand(cmd), args, { timeoutMs });
+}
+export function normalizeEnableOptions(opts) {
+    if (!isPlainObject(opts)) {
+        throw new Error("System proxy options must be a plain object");
+    }
+    if (typeof opts.port !== "number" ||
+        !Number.isInteger(opts.port) ||
+        opts.port < 1 ||
+        opts.port > 65_535) {
+        throw new Error("System proxy port must be an integer from 1 to 65535");
+    }
+    const host = opts.host === undefined ? "127.0.0.1" : parseProxyString(opts.host, "host", false);
+    const rawBypass = opts.bypass ?? DEFAULT_BYPASS_LIST;
+    if (!Array.isArray(rawBypass)) {
+        throw new Error("System proxy bypass list must be an array of strings");
+    }
+    const bypass = rawBypass.map((entry, index) => parseProxyString(entry, `bypass[${index}]`, false));
+    if (bypass.join(";").length > MAX_PROXY_STRING_LENGTH) {
+        throw new Error("System proxy bypass list is too long");
+    }
+    return { host, port: opts.port, bypass };
+}
+export function formatHostPort(host, port) {
+    return host.includes(":") && !host.startsWith("[") ? `[${host}]:${port}` : `${host}:${port}`;
+}

package/dist/sysproxy/darwin.js

@@ -0,0 +1,287 @@
+import { compareStrings, errorMessage, formatHostPort, normalizeEnableOptions, parseProxyString, parseServiceName, runCmd, } from "./common.js";
+import { darwinSnapshot } from "./snapshot.js";
+import { SYSTEM_PROXY_SNAPSHOT_VERSION } from "./types.js";
+export function parseDarwinServices(output) {
+    return output
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.startsWith("*") && !line.startsWith("An asterisk"));
+}
+function getDarwinOutputValue(output, label) {
+    const prefix = `${label}:`;
+    const lowerCasePrefix = prefix.toLowerCase();
+    for (const line of output.split(/\r\n?|\n/)) {
+        if (line.slice(0, prefix.length).toLowerCase() === lowerCasePrefix) {
+            return line.slice(prefix.length).replace(/^[^\S\r\n]+|[^\S\r\n]+$/g, "");
+        }
+    }
+    return undefined;
+}
+function parseDarwinProxyOutput(output) {
+    const enabledText = getDarwinOutputValue(output, "Enabled")?.toLowerCase();
+    const server = getDarwinOutputValue(output, "Server");
+    const portText = getDarwinOutputValue(output, "Port");
+    const authenticatedText = getDarwinOutputValue(output, "Authenticated Proxy Enabled")?.toLowerCase();
+    let enabled;
+    if (enabledText === "yes")
+        enabled = true;
+    if (enabledText === "no")
+        enabled = false;
+    let port;
+    if (portText !== undefined && /^\d+$/.test(portText)) {
+        const parsed = Number.parseInt(portText, 10);
+        if (parsed >= 0 && parsed <= 65_535)
+            port = parsed;
+    }
+    let authenticated;
+    if (authenticatedText === "yes" || authenticatedText === "on" || authenticatedText === "1") {
+        authenticated = true;
+    }
+    if (authenticatedText === "no" || authenticatedText === "off" || authenticatedText === "0") {
+        authenticated = false;
+    }
+    return {
+        ...(enabled === undefined ? {} : { enabled }),
+        ...(server === undefined ? {} : { server }),
+        ...(port === undefined ? {} : { port }),
+        ...(authenticated === undefined ? {} : { authenticated }),
+    };
+}
+export function parseDarwinProxySetting(output) {
+    const parsed = parseDarwinProxyOutput(output);
+    if (parsed.enabled === undefined) {
+        throw new Error("Invalid macOS networksetup output: missing Enabled state");
+    }
+    if (parsed.server === undefined) {
+        throw new Error("Invalid macOS networksetup output: missing Server value");
+    }
+    if (parsed.port === undefined) {
+        throw new Error("Invalid macOS networksetup output: missing or invalid Port value");
+    }
+    if (parsed.authenticated === undefined) {
+        throw new Error("Invalid macOS networksetup output: missing authenticated proxy state");
+    }
+    return {
+        enabled: parsed.enabled,
+        server: parseProxyString(parsed.server, "macOS proxy server"),
+        port: parsed.port,
+        authenticated: parsed.authenticated,
+    };
+}
+export function parseDarwinAutoProxySetting(output) {
+    const enabledText = getDarwinOutputValue(output, "Enabled")?.toLowerCase();
+    const urlText = getDarwinOutputValue(output, "URL");
+    if (enabledText !== "yes" && enabledText !== "no") {
+        throw new Error("Invalid macOS networksetup output: missing automatic proxy state");
+    }
+    if (urlText === undefined) {
+        throw new Error("Invalid macOS networksetup output: missing automatic proxy URL");
+    }
+    return {
+        enabled: enabledText === "yes",
+        url: parseProxyString(urlText === "(null)" ? "" : urlText, "macOS automatic proxy URL"),
+    };
+}
+async function listDarwinServices(run) {
+    const services = parseDarwinServices(await run("networksetup", ["-listallnetworkservices"]));
+    const canonical = services.map((service, index) => parseServiceName(service, `network service ${index}`));
+    canonical.sort(compareStrings);
+    for (let index = 1; index < canonical.length; index++) {
+        if (canonical[index - 1] === canonical[index]) {
+            throw new Error("Invalid macOS networksetup output: duplicate network service name");
+        }
+    }
+    return canonical;
+}
+const DARWIN_PROXY_COMMANDS = [
+    {
+        kind: "web",
+        set: "-setwebproxy",
+        setState: "-setwebproxystate",
+        get: "-getwebproxy",
+    },
+    {
+        kind: "secureWeb",
+        set: "-setsecurewebproxy",
+        setState: "-setsecurewebproxystate",
+        get: "-getsecurewebproxy",
+    },
+    {
+        kind: "socks",
+        set: "-setsocksfirewallproxy",
+        setState: "-setsocksfirewallproxystate",
+        get: "-getsocksfirewallproxy",
+    },
+];
+export async function captureDarwinSnapshot(run = runCmd) {
+    const services = [];
+    for (const service of await listDarwinServices(run)) {
+        const settings = new Map();
+        for (const command of DARWIN_PROXY_COMMANDS) {
+            settings.set(command.kind, parseDarwinProxySetting(await run("networksetup", [command.get, service])));
+        }
+        const web = settings.get("web");
+        const secureWeb = settings.get("secureWeb");
+        const socks = settings.get("socks");
+        if (!web || !secureWeb || !socks) {
+            throw new Error("Failed to capture all macOS proxy protocols");
+        }
+        const auto = parseDarwinAutoProxySetting(await run("networksetup", ["-getautoproxyurl", service]));
+        services.push({ service, web, secureWeb, socks, auto });
+    }
+    return {
+        version: SYSTEM_PROXY_SNAPSHOT_VERSION,
+        platform: "darwin",
+        services,
+    };
+}
+function assertNoAuthenticatedDarwinProxy(snapshot) {
+    for (const service of snapshot.services) {
+        for (const command of DARWIN_PROXY_COMMANDS) {
+            if (service[command.kind].authenticated) {
+                throw new Error(`Cannot safely take over macOS proxy for ${JSON.stringify(service.service)}: ${command.kind} uses an authenticated proxy whose credentials cannot be restored`);
+            }
+        }
+    }
+}
+export async function applyDarwinSnapshot(value, run = runCmd) {
+    const snapshot = darwinSnapshot(value);
+    assertNoAuthenticatedDarwinProxy(snapshot);
+    const activeServices = await listDarwinServices(run);
+    const snapshotServices = snapshot.services.map((service) => service.service);
+    if (activeServices.length !== snapshotServices.length ||
+        activeServices.some((service, index) => service !== snapshotServices[index])) {
+        throw new Error("macOS network service collection changed; refusing to apply a stale proxy snapshot");
+    }
+    const failures = [];
+    for (const service of snapshot.services) {
+        for (const command of DARWIN_PROXY_COMMANDS) {
+            const setting = service[command.kind];
+            try {
+                await run("networksetup", [
+                    command.set,
+                    service.service,
+                    setting.server,
+                    String(setting.port),
+                ]);
+            }
+            catch (err) {
+                failures.push(`${JSON.stringify(service.service)} ${command.kind} server/port: ${errorMessage(err)}`);
+            }
+        }
+        if (service.auto.url) {
+            try {
+                await run("networksetup", ["-setautoproxyurl", service.service, service.auto.url]);
+            }
+            catch (err) {
+                failures.push(`${JSON.stringify(service.service)} automatic proxy URL: ${errorMessage(err)}`);
+            }
+        }
+        const stateOperations = [
+            ...DARWIN_PROXY_COMMANDS.map((command) => ({
+                label: command.kind,
+                command: command.setState,
+                enabled: service[command.kind].enabled,
+            })),
+            {
+                label: "automatic proxy",
+                command: "-setautoproxystate",
+                enabled: service.auto.enabled,
+            },
+        ];
+        for (const operation of [
+            ...stateOperations.filter((item) => !item.enabled),
+            ...stateOperations.filter((item) => item.enabled),
+        ]) {
+            try {
+                await run("networksetup", [
+                    operation.command,
+                    service.service,
+                    operation.enabled ? "on" : "off",
+                ]);
+            }
+            catch (err) {
+                failures.push(`${JSON.stringify(service.service)} ${operation.label} state: ${errorMessage(err)}`);
+            }
+        }
+    }
+    if (failures.length > 0) {
+        throw new Error(`Failed to apply macOS system proxy settings: ${failures.join("; ")}`);
+    }
+}
+export function createDarwinTarget(original, opts) {
+    const snapshot = darwinSnapshot(original);
+    assertNoAuthenticatedDarwinProxy(snapshot);
+    if (snapshot.services.length === 0) {
+        throw new Error("Cannot enable macOS system proxy: no active network services found");
+    }
+    const normalized = normalizeEnableOptions(opts);
+    const targetSetting = () => ({
+        enabled: true,
+        server: normalized.host,
+        port: normalized.port,
+        authenticated: false,
+    });
+    return {
+        version: SYSTEM_PROXY_SNAPSHOT_VERSION,
+        platform: "darwin",
+        services: snapshot.services.map((service) => ({
+            service: service.service,
+            web: targetSetting(),
+            secureWeb: targetSetting(),
+            socks: targetSetting(),
+            auto: { ...service.auto, enabled: false },
+        })),
+    };
+}
+export function darwinState(value) {
+    const snapshot = darwinSnapshot(value);
+    if (snapshot.services.length === 0) {
+        return { supported: true, enabled: false, details: "no active network services found" };
+    }
+    const enabledSettings = [];
+    const enabledAutoUrls = [];
+    for (const service of snapshot.services) {
+        for (const command of DARWIN_PROXY_COMMANDS) {
+            const setting = service[command.kind];
+            if (setting.enabled)
+                enabledSettings.push(setting);
+        }
+        if (service.auto.enabled)
+            enabledAutoUrls.push(service.auto.url);
+    }
+    if (enabledSettings.length === 0 && enabledAutoUrls.length === 0) {
+        return { supported: true, enabled: false };
+    }
+    if (enabledSettings.length === 0) {
+        const urls = new Set(enabledAutoUrls.filter(Boolean));
+        return {
+            supported: true,
+            enabled: true,
+            ...(urls.size === 1 ? { server: urls.values().next().value } : {}),
+            details: "automatic proxy configuration is enabled",
+        };
+    }
+    const endpoints = new Set();
+    let hasIncompleteEndpoint = false;
+    for (const setting of enabledSettings) {
+        if (!setting.server || setting.port === 0) {
+            hasIncompleteEndpoint = true;
+            continue;
+        }
+        endpoints.add(formatHostPort(setting.server, setting.port));
+    }
+    if (endpoints.size === 1 && !hasIncompleteEndpoint && enabledAutoUrls.length === 0) {
+        const server = endpoints.values().next().value;
+        return typeof server === "string"
+            ? { supported: true, enabled: true, server }
+            : { supported: true, enabled: true };
+    }
+    return {
+        supported: true,
+        enabled: true,
+        details: enabledAutoUrls.length > 0
+            ? "manual and automatic proxy settings are both active"
+            : "multiple or incomplete active proxy settings",
+    };
+}