@sunjiehao/zyhy-network 0.2.1 → 0.2.3

package/README.md

@@ -1,23 +1,22 @@
 # ZYHY-Network
 
-当前版本：`V0.2.1`
+当前版本：`V0.2.3`
 
-办公时不用再在「网线」和「公司 Wi-Fi」之间来回切。
+让 Mac 同时使用公司网线和 `ZYHY-Private` Wi-Fi：普通网络走网线，OA、邮箱等内网地址自动走 Wi-Fi。
 
-- 看网页、刷视频、走代理：用网线
-- 打开 OA、邮箱、iHR：自动走公司 Wi-Fi `ZYHY-Private`
+## 功能
 
-两个可以同时开着。
+- 仅在网线已连接且 Wi-Fi 为 `ZYHY-Private` 时启用分流
+- 监听 macOS 网络与系统代理变化并自动更新，不再每 5 秒轮询
+- 默认每 300 秒低频校验一次，可修改间隔或关闭
+- 支持 `zyhy-network refresh` 立即刷新 DNS、路由和分流配置
+- GitHub 与 npm 安装提供相同的 `zyhy-network` 命令
 
-## 你需要
+## 安装
 
-1. 一台 Mac
-2. 插上公司网线
-3. Wi-Fi 连上 **ZYHY-Private**（不要连别的公司 Wi-Fi）
+GitHub：
 
-## 怎么装
-
-打开「终端」，把下面三行粘贴进去，回车，输入开机密码：
+请按顺序逐行执行下面三条命令。安装完成后不需要再手动运行其他脚本。
 
 ```bash
 git clone https://github.com/lampardrodgers/ZYHY-Network.git
@@ -25,50 +24,34 @@ cd ZYHY-Network
 sudo ./install.sh
 ```
 
-装完后：
-
-1. 用 **新标签页** 打开 OA、邮箱（不要刷新刚才失败的那一页）
-2. 如果用的是 Chrome：设置 → 隐私和安全 → 安全 → 关掉「使用安全 DNS」
-
-能打开就行，不用再配域名。
-
-## 用的时候注意
-
-- 网线要插着，Wi-Fi 必须是 `ZYHY-Private`，分流才会开
-- 拔掉网线、或换成别的 Wi-Fi：全部按系统原来的方式上网，内网入口可能会打不开
-- 插回网线并连回 `ZYHY-Private`：等几秒会自动恢复
-
-后台会监听 macOS 的网络状态变化，只在有线网、公司 Wi-Fi、网关或 DNS
-等实际发生变化时更新分流配置。另有每 5 分钟一次的低频校验，用来补偿
-偶尔漏掉的系统事件和内网域名解析变化；配置内容没变时不会重写网络设置。
-
-GitHub 安装和 npm 安装提供完全相同的命令。需要立即重新解析内网 DNS
-并校验全部分流配置时：
-
-```bash
-zyhy-network refresh
-```
-
-## npm 命令行版本
+`sudo ./install.sh` 会安装并启动后台服务。之后，网线、Wi-Fi、IP、网关或
+DNS 发生变化时，程序会自动重新判断是否启用内网分流；网络状态没有变化时
+不会重复修改系统网络配置。
 
-也可以从 npm 安装：
+npm：
 
 ```bash
 npm install -g @sunjiehao/zyhy-network
 zyhy-network install
 ```
 
-无论使用哪种安装方式，需要修改系统配置时都会自动请求管理员权限。常用命令：
+需要修改系统配置时，命令会自动请求管理员权限。
+
+## 常用命令
 
 ```bash
-zyhy-network status
-zyhy-network refresh
-zyhy-network add '*.hq.cmcc'
-zyhy-network uninstall
+zyhy-network status                 # 查看状态
+zyhy-network refresh                # 强制刷新
+zyhy-network interval               # 查看定时校验设置
+zyhy-network interval 600           # 改为每 600 秒校验
+zyhy-network interval 0             # 关闭定时校验
+zyhy-network add '*.hq.cmcc'        # 添加域名后缀
+zyhy-network add 172.21.0.0/16      # 添加网段
+zyhy-network uninstall              # 卸载，保留配置
 ```
 
-## 不想用了
+## 注意
 
-```bash
-zyhy-network uninstall
-```
+- 网线和 `ZYHY-Private` Wi-Fi 需要同时连接；网络变化后会自动恢复分流
+- 系统代理工具重启或切换后，会自动恢复内网域名的代理绕过项
+- Chrome 若无法打开内网，请关闭“设置 → 隐私和安全 → 安全 → 使用安全 DNS”

package/bin/zyhy-network

@@ -16,6 +16,11 @@ case "$command" in
       exec /usr/bin/sudo "$TARGET" "$@"
     fi
     ;;
+  interval)
+    if [[ $# -gt 1 && $(id -u) -ne 0 ]]; then
+      exec /usr/bin/sudo "$TARGET" "$@"
+    fi
+    ;;
 esac
 
 exec "$TARGET" "$@"

package/bin/zyhy-network.js

@@ -29,11 +29,12 @@ const rootCommands = new Set([
   'remove',
   'uninstall'
 ]);
+const intervalNeedsRoot = command === 'interval' && args.length > 1;
 
 let executable = '/bin/bash';
 let commandArgs = [script, ...args];
 
-if (rootCommands.has(command) && process.getuid?.() !== 0) {
+if ((rootCommands.has(command) || intervalNeedsRoot) && process.getuid?.() !== 0) {
   executable = '/usr/bin/sudo';
   commandArgs = ['/bin/bash', script, ...args];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sunjiehao/zyhy-network",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "macOS Ethernet and ZYHY-Private Wi-Fi split routing CLI",
   "bin": {
     "zyhy-network": "bin/zyhy-network.js"

package/zyhy-private-split

@@ -17,7 +17,7 @@
 set -euo pipefail
 
 LABEL="com.zyhy.network.split"
-VERSION="0.2.1"
+VERSION="0.2.3"
 PLIST="/Library/LaunchDaemons/${LABEL}.plist"
 RECONCILE_LABEL="${LABEL}.reconcile"
 RECONCILE_PLIST="/Library/LaunchDaemons/${RECONCILE_LABEL}.plist"
@@ -87,6 +87,7 @@ save_config() {
 #   add hostname:  sudo zyhy-private-split add foo.hq.cmcc
 #   add suffix:    sudo zyhy-private-split add '*.hq.cmcc'
 #   add CIDR:      sudo zyhy-private-split add 172.21.0.0/16
+#   timed check:   sudo zyhy-private-split interval 300 (0 disables)
 
 WIFI_DOMAIN="${WIFI_DOMAIN}"
 DOMAINS="${DOMAINS}"
@@ -316,7 +317,8 @@ http_proxy_keys() {
   echo "State:/Network/Global/Proxies"
   while IFS= read -r key; do
     [[ -n "$key" ]] || continue
-    if echo "show ${key}" | scutil | grep -q 'HTTPEnable : 1'; then
+    if echo "show ${key}" | scutil \
+      | grep -Eq '(HTTPEnable|HTTPSEnable|SOCKSEnable|ProxyAutoConfigEnable) : 1'; then
       printf '%s\n' "$key"
     fi
   done < <(echo "list State:/Network/Service/.*/Proxies" | scutil | awk -F'= ' '/subKey/{print $2}')
@@ -335,12 +337,11 @@ read_proxy_exceptions() {
   '
 }
 
-write_proxy_exceptions() {
+write_proxy_exceptions_for_key() {
+  local key=$1
+  shift
   local items=$*
-  local key
-  [[ -n "$items" ]] || return 0
-  while IFS= read -r key; do
-    [[ -n "$key" ]] || continue
+  if [[ -n "$items" ]]; then
     scutil >/dev/null <<EOF
 open
 d.init
@@ -349,7 +350,16 @@ d.add ExceptionsList * ${items}
 set ${key}
 quit
 EOF
-  done < <(http_proxy_keys | awk 'NF && !seen[$0]++')
+  else
+    scutil >/dev/null <<EOF
+open
+d.init
+get ${key}
+d.remove ExceptionsList
+set ${key}
+quit
+EOF
+  fi
 }
 
 list_has() {
@@ -363,51 +373,69 @@ list_has() {
 }
 
 ensure_proxy_exceptions() {
-  local -a cur=() want=() merged=()
-  local x
-  while IFS= read -r x; do
-    [[ -n "$x" ]] && cur+=("$x")
-  done < <(read_proxy_exceptions "")
+  local -a want=()
+  local key x changed=0
   while IFS= read -r x; do
     [[ -n "$x" ]] && want+=("$x")
   done < <(wanted_proxy_exceptions | awk 'NF && !seen[$0]++')
-  if [[ ${#cur[@]} -gt 0 ]]; then
-    merged=("${cur[@]}")
-  fi
-  for x in "${want[@]}"; do
-    if [[ ${#cur[@]} -gt 0 ]] && list_has "$x" "${cur[@]}"; then
+
+  while IFS= read -r key; do
+    [[ -n "$key" ]] || continue
+    local -a cur=() merged=()
+    while IFS= read -r x; do
+      [[ -n "$x" ]] && cur+=("$x")
+    done < <(read_proxy_exceptions "$key")
+    if [[ ${#cur[@]} -gt 0 ]]; then
+      merged=("${cur[@]}")
+    fi
+    for x in "${want[@]}"; do
+      if [[ ${#cur[@]} -gt 0 ]] && list_has "$x" "${cur[@]}"; then
+        continue
+      fi
+      merged+=("$x")
+    done
+    if [[ ${#merged[@]} -eq ${#cur[@]} ]]; then
       continue
     fi
-    merged+=("$x")
-  done
-  if [[ ${#merged[@]} -eq ${#cur[@]} ]]; then
-    return 0
+    write_proxy_exceptions_for_key "$key" "${merged[@]}"
+    changed=1
+  done < <(http_proxy_keys | awk 'NF && !seen[$0]++')
+
+  if (( changed )); then
+    log "proxy bypass +${want[*]}"
   fi
-  write_proxy_exceptions "${merged[*]}"
-  log "proxy bypass +${want[*]}"
 }
 
 remove_proxy_exceptions() {
-  local -a cur=() keep=() want=()
-  local x
-  while IFS= read -r x; do
-    [[ -n "$x" ]] && cur+=("$x")
-  done < <(read_proxy_exceptions "")
-  [[ ${#cur[@]} -gt 0 ]] || return 0
+  local -a want=()
+  local key x changed=0
   while IFS= read -r x; do
     [[ -n "$x" ]] && want+=("$x")
   done < <(wanted_proxy_exceptions)
-  for x in "${cur[@]}"; do
-    if [[ ${#want[@]} -gt 0 ]] && list_has "$x" "${want[@]}"; then
+
+  while IFS= read -r key; do
+    [[ -n "$key" ]] || continue
+    local -a cur=() keep=()
+    while IFS= read -r x; do
+      [[ -n "$x" ]] && cur+=("$x")
+    done < <(read_proxy_exceptions "$key")
+    [[ ${#cur[@]} -gt 0 ]] || continue
+    for x in "${cur[@]}"; do
+      if [[ ${#want[@]} -gt 0 ]] && list_has "$x" "${want[@]}"; then
+        continue
+      fi
+      keep+=("$x")
+    done
+    if [[ ${#keep[@]} -eq ${#cur[@]} ]]; then
       continue
     fi
-    keep+=("$x")
-  done
-  if [[ ${#keep[@]} -eq ${#cur[@]} ]]; then
-    return 0
+    write_proxy_exceptions_for_key "$key" "${keep[@]}"
+    changed=1
+  done < <(http_proxy_keys | awk 'NF && !seen[$0]++')
+
+  if (( changed )); then
+    log "proxy bypass restored"
   fi
-  write_proxy_exceptions "${keep[*]}"
-  log "proxy bypass restored"
 }
 
 drop_state_entry() {
@@ -505,6 +533,10 @@ cmd_apply_locked() {
     return 0
   fi
 
+  # Proxy apps can replace ExceptionsList without changing IP, gateway, or DNS.
+  # Repair it before the network-input fast path so proxy-only events are enough.
+  ensure_proxy_exceptions
+
   local input_tmp
   input_tmp=$(mktemp)
   write_network_inputs "$input_tmp" "$eth" "$wifi" "$wifi_ip" "$wifi_gw" "$wifi_dns"
@@ -554,7 +586,6 @@ cmd_apply_locked() {
 
   write_resolvers "$wifi_dns"
   write_hosts_block "$hosts_body"
-  ensure_proxy_exceptions
 
   local tmp state_changed=0
   tmp=$(mktemp)
@@ -617,6 +648,41 @@ cmd_refresh() {
   echo "refreshed: routes, DNS, hosts, resolvers and proxy exceptions checked"
 }
 
+cmd_interval() {
+  load_config
+  local seconds=${1-}
+  if [[ -z "$seconds" ]]; then
+    if (( RECONCILE_INTERVAL == 0 )); then
+      echo "timed check: disabled (0 seconds)"
+    else
+      echo "timed check: every ${RECONCILE_INTERVAL} seconds"
+    fi
+    return
+  fi
+
+  require_root
+  [[ "$seconds" =~ ^[0-9]+$ ]] || {
+    echo "usage: $0 interval <seconds>; 0 disables timed checks" >&2
+    exit 2
+  }
+  RECONCILE_INTERVAL=$seconds
+  save_config
+
+  launchctl bootout "system/${RECONCILE_LABEL}" >/dev/null 2>&1 || true
+  if [[ -x "$INSTALL_BIN" && -f "$PLIST" ]]; then
+    write_install_plists "$INSTALL_BIN"
+    if (( RECONCILE_INTERVAL > 0 )); then
+      bootstrap_with_retry "$RECONCILE_PLIST"
+    fi
+  fi
+
+  if (( RECONCILE_INTERVAL == 0 )); then
+    echo "timed check disabled; network-change watching remains enabled"
+  else
+    echo "timed check interval: ${RECONCILE_INTERVAL} seconds"
+  fi
+}
+
 cmd_status() {
   load_config
   local wifi eth pair
@@ -657,7 +723,11 @@ cmd_status() {
     $0==e{on=0}
   ' /etc/hosts || true
   echo "watcher     : $(launchctl print "system/${LABEL}" >/dev/null 2>&1 && echo loaded || echo not-loaded)"
-  echo "reconcile   : $(launchctl print "system/${RECONCILE_LABEL}" >/dev/null 2>&1 && echo "loaded (${RECONCILE_INTERVAL}s)" || echo not-loaded)"
+  if (( RECONCILE_INTERVAL == 0 )); then
+    echo "reconcile   : disabled (0s)"
+  else
+    echo "reconcile   : $(launchctl print "system/${RECONCILE_LABEL}" >/dev/null 2>&1 && echo "loaded (${RECONCILE_INTERVAL}s)" || echo "not-loaded (${RECONCILE_INTERVAL}s)")"
+  fi
   echo "sys proxy   : $(scutil --proxy | awk '/HTTPEnable/{e=$3} /HTTPProxy/{p=$3} /HTTPPort/{n=$3} END{if(e==1) print p":"n; else print "off"}')"
   echo "proxy bypass:"
   read_proxy_exceptions | sed 's/^/  /' || true
@@ -756,8 +826,8 @@ start_network_event_stream() {
   exec 3>"$WATCH_COMMAND_FIFO"
   exec 4<"$WATCH_EVENT_FIFO"
   cat >&3 <<'EOF'
-n.add ^State:/Network/(Global/(IPv4|DNS)|Interface/.*/(IPv4|Link|AirPort)|Service/.*/(DHCP|DNS|IPv4))$ pattern
-n.add ^Setup:/Network/Service/.*/(DNS|IPv4)$ pattern
+n.add ^State:/Network/(Global/(IPv4|DNS|Proxies)|Interface/.*/(IPv4|Link|AirPort)|Service/.*/(DHCP|DNS|IPv4|Proxies))$ pattern
+n.add ^Setup:/Network/(Global/Proxies|Service/.*/(DNS|IPv4|Proxies))$ pattern
 n.watch
 EOF
 }
@@ -817,6 +887,12 @@ write_install_plists() {
 </plist>
 EOF
 
+  chmod 644 "$PLIST"
+  if (( RECONCILE_INTERVAL == 0 )); then
+    rm -f "$RECONCILE_PLIST"
+    return
+  fi
+
   cat >"$RECONCILE_PLIST" <<EOF
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -839,7 +915,7 @@ EOF
 </dict>
 </plist>
 EOF
-  chmod 644 "$PLIST" "$RECONCILE_PLIST"
+  chmod 644 "$RECONCILE_PLIST"
 }
 
 bootstrap_with_retry() {
@@ -880,7 +956,7 @@ cmd_install() {
   write_install_plists "$INSTALL_BIN"
   cmd_apply --force
   bootstrap_with_retry "$PLIST"
-  if ! bootstrap_with_retry "$RECONCILE_PLIST"; then
+  if (( RECONCILE_INTERVAL > 0 )) && ! bootstrap_with_retry "$RECONCILE_PLIST"; then
     launchctl bootout "system/${LABEL}" >/dev/null 2>&1 || true
     return 1
   fi
@@ -957,6 +1033,7 @@ usage: $0 <command>
   add <item>             add host, '*.suffix', or CIDR (needs sudo)
   remove <item>          remove one of the above (needs sudo)
   refresh                force DNS resolution and reconcile now (needs sudo)
+  interval [seconds]     show/set timed-check interval; 0 disables (set needs sudo)
   apply [--force]        apply now; --force also reconciles DNS (needs sudo)
   clear                  tear down routes (needs sudo)
   install                copy to /usr/local/sbin and load daemon (needs sudo)
@@ -972,6 +1049,7 @@ load_config
 case "$cmd" in
   apply) cmd_apply "${1-}" ;;
   refresh) cmd_refresh ;;
+  interval) cmd_interval "${1-}" ;;
   watch) cmd_watch ;;
   clear) cmd_clear ;;
   status) cmd_status ;;

package/zyhy-private-split.conf

@@ -5,6 +5,8 @@ DOMAINS="oa.hq.cmcc mail.cmhi.chinamobile.com"
 SUFFIXES="hq.cmcc cmhi.chinamobile.com"
 CIDRS="172.21.0.0/16 172.16.0.0/16"
 
-# 网络变化后等待接口稳定的秒数；另每 300 秒做一次只读为主的兜底校验。
+# 网络变化后等待接口稳定的秒数。
 EVENT_SETTLE_SECONDS="2"
+
+# 定时兜底校验间隔（秒）；设为 0 可关闭，网络变化事件监听不受影响。
 RECONCILE_INTERVAL="300"