@sunjiehao/zyhy-network 0.2.1

package/README.md

@@ -0,0 +1,74 @@
+# ZYHY-Network
+
+当前版本：`V0.2.1`
+
+办公时不用再在「网线」和「公司 Wi-Fi」之间来回切。
+
+- 看网页、刷视频、走代理：用网线
+- 打开 OA、邮箱、iHR：自动走公司 Wi-Fi `ZYHY-Private`
+
+两个可以同时开着。
+
+## 你需要
+
+1. 一台 Mac
+2. 插上公司网线
+3. Wi-Fi 连上 **ZYHY-Private**（不要连别的公司 Wi-Fi）
+
+## 怎么装
+
+打开「终端」，把下面三行粘贴进去，回车，输入开机密码：
+
+```bash
+git clone https://github.com/lampardrodgers/ZYHY-Network.git
+cd ZYHY-Network
+sudo ./install.sh
+```
+
+装完后：
+
+1. 用 **新标签页** 打开 OA、邮箱（不要刷新刚才失败的那一页）
+2. 如果用的是 Chrome：设置 → 隐私和安全 → 安全 → 关掉「使用安全 DNS」
+
+能打开就行，不用再配域名。
+
+## 用的时候注意
+
+- 网线要插着，Wi-Fi 必须是 `ZYHY-Private`，分流才会开
+- 拔掉网线、或换成别的 Wi-Fi：全部按系统原来的方式上网，内网入口可能会打不开
+- 插回网线并连回 `ZYHY-Private`：等几秒会自动恢复
+
+后台会监听 macOS 的网络状态变化，只在有线网、公司 Wi-Fi、网关或 DNS
+等实际发生变化时更新分流配置。另有每 5 分钟一次的低频校验，用来补偿
+偶尔漏掉的系统事件和内网域名解析变化；配置内容没变时不会重写网络设置。
+
+GitHub 安装和 npm 安装提供完全相同的命令。需要立即重新解析内网 DNS
+并校验全部分流配置时：
+
+```bash
+zyhy-network refresh
+```
+
+## npm 命令行版本
+
+也可以从 npm 安装：
+
+```bash
+npm install -g @sunjiehao/zyhy-network
+zyhy-network install
+```
+
+无论使用哪种安装方式，需要修改系统配置时都会自动请求管理员权限。常用命令：
+
+```bash
+zyhy-network status
+zyhy-network refresh
+zyhy-network add '*.hq.cmcc'
+zyhy-network uninstall
+```
+
+## 不想用了
+
+```bash
+zyhy-network uninstall
+```

package/bin/zyhy-network

@@ -0,0 +1,21 @@
+#!/bin/bash
+# zyhy-network managed GitHub-install wrapper
+set -euo pipefail
+
+TARGET="/usr/local/sbin/zyhy-private-split"
+
+if [[ ! -x "$TARGET" ]]; then
+  echo "zyhy-network is not installed; run sudo ./install.sh first" >&2
+  exit 1
+fi
+
+command=${1:-status}
+case "$command" in
+  add|apply|clear|install|refresh|remove|uninstall)
+    if [[ $(id -u) -ne 0 ]]; then
+      exec /usr/bin/sudo "$TARGET" "$@"
+    fi
+    ;;
+esac
+
+exec "$TARGET" "$@"

package/bin/zyhy-network.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+
+'use strict';
+
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const packageJson = require('../package.json');
+
+const args = process.argv.slice(2);
+
+if (args.length === 1 && (args[0] === '--version' || args[0] === '-v')) {
+  console.log(packageJson.version);
+  process.exit(0);
+}
+
+if (process.platform !== 'darwin') {
+  console.error('zyhy-network only supports macOS.');
+  process.exit(1);
+}
+
+const script = path.join(__dirname, '..', 'zyhy-private-split');
+const command = args[0] || 'status';
+const rootCommands = new Set([
+  'add',
+  'apply',
+  'clear',
+  'install',
+  'refresh',
+  'remove',
+  'uninstall'
+]);
+
+let executable = '/bin/bash';
+let commandArgs = [script, ...args];
+
+if (rootCommands.has(command) && process.getuid?.() !== 0) {
+  executable = '/usr/bin/sudo';
+  commandArgs = ['/bin/bash', script, ...args];
+}
+
+const result = spawnSync(executable, commandArgs, { stdio: 'inherit' });
+
+if (result.error) {
+  console.error(`failed to run zyhy-network: ${result.error.message}`);
+  process.exit(1);
+}
+
+if (result.signal) {
+  if (result.signal === 'SIGPIPE') {
+    process.exit(0);
+  }
+  console.error(`zyhy-network stopped by signal ${result.signal}`);
+  process.exit(1);
+}
+
+process.exit(result.status ?? 1);

package/install.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# 开箱安装：拷配置并启用分流。需要 sudo。
+set -euo pipefail
+if [[ $(id -u) -ne 0 ]]; then
+  echo "请用: sudo $0" >&2
+  exit 1
+fi
+cd "$(dirname "$0")"
+chmod 755 zyhy-private-split bin/zyhy-network
+mkdir -p /usr/local/bin /usr/local/etc /usr/local/sbin
+cp zyhy-private-split.conf /usr/local/etc/zyhy-private-split.conf
+./zyhy-private-split install
+if [[ -e /usr/local/bin/zyhy-network ]] && \
+   ! grep -q '^# zyhy-network managed GitHub-install wrapper$' /usr/local/bin/zyhy-network 2>/dev/null; then
+  echo "保留已有的 /usr/local/bin/zyhy-network（它不是本项目安装的文件）。" >&2
+else
+  cp bin/zyhy-network /usr/local/bin/zyhy-network
+  chmod 755 /usr/local/bin/zyhy-network
+fi
+echo
+echo "装好了。新开浏览器标签访问 OA / 邮箱即可。"
+echo "查看状态: zyhy-network status"

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@sunjiehao/zyhy-network",
+  "version": "0.2.1",
+  "description": "macOS Ethernet and ZYHY-Private Wi-Fi split routing CLI",
+  "bin": {
+    "zyhy-network": "bin/zyhy-network.js"
+  },
+  "files": [
+    "bin/",
+    "zyhy-private-split",
+    "zyhy-private-split.conf",
+    "install.sh",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "bash -n zyhy-private-split install.sh bin/zyhy-network && node --check bin/zyhy-network.js",
+    "prepack": "npm test"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lampardrodgers/ZYHY-Network.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bugs": {
+    "url": "https://github.com/lampardrodgers/ZYHY-Network/issues"
+  },
+  "homepage": "https://github.com/lampardrodgers/ZYHY-Network#readme",
+  "keywords": [
+    "macos",
+    "network",
+    "split-routing",
+    "launchd"
+  ],
+  "author": "sunjiehao (lampardrodgers)",
+  "license": "UNLICENSED",
+  "os": [
+    "darwin"
+  ],
+  "engines": {
+    "node": ">=18"
+  }
+}

package/zyhy-private-split

@@ -0,0 +1,987 @@
+#!/bin/bash
+# Split-route intranet via Wi-Fi only when Ethernet is up AND Wi-Fi DHCP
+# domain is ZYHY-Private. Otherwise keep system order (Ethernet first,
+# Wi-Fi if the cable is unplugged). Does not edit Shadowrocket.
+#
+#   sudo zyhy-private-split install
+#   sudo zyhy-private-split add oa.hq.cmcc
+#   sudo zyhy-private-split add '*.hq.cmcc'          # whole suffix
+#   sudo zyhy-private-split add 172.21.0.0/16        # whole CIDR
+#   sudo zyhy-private-split remove oa.hq.cmcc
+#   sudo zyhy-private-split refresh
+#        zyhy-private-split list
+#        zyhy-private-split status
+#        zyhy-private-split bundle ~/Desktop/zyhy-private-split.tgz
+#   sudo zyhy-private-split uninstall
+
+set -euo pipefail
+
+LABEL="com.zyhy.network.split"
+VERSION="0.2.1"
+PLIST="/Library/LaunchDaemons/${LABEL}.plist"
+RECONCILE_LABEL="${LABEL}.reconcile"
+RECONCILE_PLIST="/Library/LaunchDaemons/${RECONCILE_LABEL}.plist"
+LEGACY_LABELS="com.misakamikoto.zyhy-private-split"
+INSTALL_BIN="/usr/local/sbin/zyhy-private-split"
+INSTALL_CLI="/usr/local/bin/zyhy-network"
+CONF="/usr/local/etc/zyhy-private-split.conf"
+STATE_DIR="/var/run/zyhy-private-split"
+STATE_FILE="${STATE_DIR}/applied"
+INPUT_STATE_FILE="${STATE_DIR}/network-inputs"
+RESOLVED_STATE_FILE="${STATE_DIR}/resolved-hosts"
+RESOLVER_LIST="${STATE_DIR}/resolvers"
+LOCK_DIR="/var/run/zyhy-private-split.apply.lock"
+WATCH_DIR="/var/run/zyhy-private-split-watch"
+WATCH_COMMAND_FIFO="${WATCH_DIR}/commands"
+WATCH_EVENT_FIFO="${WATCH_DIR}/events"
+HOSTS_BEGIN="# BEGIN zyhy-private-split"
+HOSTS_END="# END zyhy-private-split"
+
+# Defaults (overridden by $CONF).
+WIFI_DOMAIN="ZYHY-Private"
+DOMAINS="oa.hq.cmcc mail.cmhi.chinamobile.com"
+SUFFIXES="hq.cmcc cmhi.chinamobile.com"
+CIDRS="172.21.0.0/16 172.16.0.0/16"
+RECONCILE_INTERVAL="300"
+EVENT_SETTLE_SECONDS="2"
+
+FILES_CHANGED=0
+WATCH_CHILD_PID=""
+
+log() { printf '%s %s\n' "$(date '+%F %T')" "$*" >&2; }
+
+require_root() {
+  if [[ $(id -u) -ne 0 ]]; then
+    echo "need root: sudo $0 $*" >&2
+    exit 1
+  fi
+}
+
+normalize_words() {
+  echo "$*" | tr ' \t' '\n' | sed '/^$/d' | awk '!seen[$0]++'
+}
+
+load_config() {
+  if [[ -f "$CONF" ]]; then
+    # shellcheck disable=SC1090
+    . "$CONF"
+  fi
+  DOMAINS=$(normalize_words ${DOMAINS-} | tr '\n' ' ')
+  SUFFIXES=$(normalize_words ${SUFFIXES-} | tr '\n' ' ')
+  CIDRS=$(normalize_words ${CIDRS-} | tr '\n' ' ')
+  WIFI_DOMAIN=${WIFI_DOMAIN:-ZYHY-Private}
+  RECONCILE_INTERVAL=${RECONCILE_INTERVAL:-300}
+  EVENT_SETTLE_SECONDS=${EVENT_SETTLE_SECONDS:-2}
+  [[ "$RECONCILE_INTERVAL" =~ ^[0-9]+$ ]] || RECONCILE_INTERVAL=300
+  [[ "$EVENT_SETTLE_SECONDS" =~ ^[0-9]+$ ]] || EVENT_SETTLE_SECONDS=2
+  DOMAINS=${DOMAINS% }
+  SUFFIXES=${SUFFIXES% }
+  CIDRS=${CIDRS% }
+}
+
+save_config() {
+  mkdir -p "$(dirname "$CONF")"
+  cat >"$CONF" <<EOF
+# zyhy-private-split config
+# After editing: sudo zyhy-private-split apply
+#   add hostname:  sudo zyhy-private-split add foo.hq.cmcc
+#   add suffix:    sudo zyhy-private-split add '*.hq.cmcc'
+#   add CIDR:      sudo zyhy-private-split add 172.21.0.0/16
+
+WIFI_DOMAIN="${WIFI_DOMAIN}"
+DOMAINS="${DOMAINS}"
+SUFFIXES="${SUFFIXES}"
+CIDRS="${CIDRS}"
+RECONCILE_INTERVAL="${RECONCILE_INTERVAL}"
+EVENT_SETTLE_SECONDS="${EVENT_SETTLE_SECONDS}"
+EOF
+  chmod 644 "$CONF"
+}
+
+words_has() {
+  local needle=$1
+  shift
+  printf '%s\n' $* | grep -qxF "$needle"
+}
+
+add_word() {
+  local cur=$1 word=$2
+  if [[ -z "$cur" ]]; then
+    echo "$word"
+    return
+  fi
+  if printf '%s\n' $cur | grep -qxF "$word"; then
+    echo "$cur"
+    return
+  fi
+  echo "$cur $word"
+}
+
+remove_word() {
+  local cur=$1 word=$2
+  printf '%s\n' $cur | grep -vxF "$word" | tr '\n' ' ' | sed 's/[[:space:]]*$//'
+}
+
+wifi_device() {
+  networksetup -listallhardwareports | awk '
+    /^Hardware Port: Wi-Fi/{getline; if ($1=="Device:") {print $2; exit}}
+  '
+}
+
+ethernet_devices() {
+  networksetup -listallhardwareports | awk '
+    /^Hardware Port: / {
+      port=$0
+      sub(/^Hardware Port: /,"",port)
+      getline
+      if ($1=="Device:") dev=$2
+      if (port=="Ethernet" || port ~ /^USB /) print dev
+    }
+  '
+}
+
+iface_active_ipv4() {
+  local ifc=$1
+  ifconfig "$ifc" 2>/dev/null | awk '
+    /status: active/{up=1}
+    $1=="inet"{ip=$2}
+    END{exit !(up && ip!="")}
+  '
+}
+
+wifi_is_private() {
+  local ifc=$1 domain
+  domain=$(ipconfig getoption "$ifc" domain_name 2>/dev/null || true)
+  [[ "$domain" == "$WIFI_DOMAIN" ]]
+}
+
+wired_up() {
+  local d
+  for d in $(ethernet_devices); do
+    if iface_active_ipv4 "$d"; then
+      echo "$d"
+      return 0
+    fi
+  done
+  return 1
+}
+
+split_should_run() {
+  local wifi eth
+  wifi=$(wifi_device)
+  [[ -n "$wifi" ]] || return 1
+  iface_active_ipv4 "$wifi" || return 1
+  wifi_is_private "$wifi" || return 1
+  eth=$(wired_up) || return 1
+  echo "$eth $wifi"
+}
+
+add_host_v4() {
+  local ip=$1 gw=$2
+  if route -n get -host "$ip" 2>/dev/null | grep -q "gateway: ${gw}$"; then
+    return 0
+  fi
+  route -n delete -host "$ip" >/dev/null 2>&1 || true
+  route -n add -host "$ip" "$gw" >/dev/null
+}
+
+del_host_v4() {
+  route -n delete -host "$1" >/dev/null 2>&1 || true
+}
+
+add_net_v4() {
+  local cidr=$1 gw=$2
+  if route -n get -net "$cidr" 2>/dev/null | grep -q "gateway: ${gw}$"; then
+    return 0
+  fi
+  route -n delete -net "$cidr" >/dev/null 2>&1 || true
+  route -n add -net "$cidr" "$gw" >/dev/null
+}
+
+del_net_v4() {
+  route -n delete -net "$1" >/dev/null 2>&1 || true
+}
+
+del_reject_v6() {
+  route -n delete -inet6 -host "$1" >/dev/null 2>&1 || true
+}
+
+strip_hosts_block() {
+  awk -v b="$HOSTS_BEGIN" -v e="$HOSTS_END" '
+    $0==b {skip=1; next}
+    $0==e {skip=0; next}
+    skip==0 {print}
+  ' /etc/hosts
+}
+
+write_hosts_block() {
+  local body=$1 tmp
+  tmp=$(mktemp)
+  {
+    strip_hosts_block
+    if [[ -n "$body" ]]; then
+      printf '%s\n%s%s\n' "$HOSTS_BEGIN" "$body" "$HOSTS_END"
+    fi
+  } >"$tmp"
+  if cmp -s "$tmp" /etc/hosts; then
+    rm -f "$tmp"
+    return 0
+  fi
+  cat "$tmp" >/etc/hosts
+  rm -f "$tmp"
+  FILES_CHANGED=1
+}
+
+resolver_names() {
+  printf '%s\n' $DOMAINS $SUFFIXES | sed '/^$/d' | awk 'NF && !seen[$0]++'
+}
+
+clear_resolvers() {
+  local name
+  while IFS= read -r name; do
+    [[ -n "$name" ]] || continue
+    if [[ -e "/etc/resolver/${name}" ]]; then
+      rm -f "/etc/resolver/${name}"
+      FILES_CHANGED=1
+    fi
+  done < <(
+    {
+      [[ -f "$RESOLVER_LIST" ]] && cat "$RESOLVER_LIST"
+      resolver_names
+    } | awk 'NF && !seen[$0]++'
+  )
+}
+
+write_resolvers() {
+  local dns=$1 name old_name desired_list resolver_tmp
+  mkdir -p /etc/resolver
+  desired_list=$(mktemp)
+  resolver_names >"$desired_list"
+
+  if [[ -f "$RESOLVER_LIST" ]]; then
+    while IFS= read -r old_name; do
+      [[ -n "$old_name" ]] || continue
+      if ! grep -qxF "$old_name" "$desired_list" && [[ -e "/etc/resolver/${old_name}" ]]; then
+        rm -f "/etc/resolver/${old_name}"
+        FILES_CHANGED=1
+      fi
+    done <"$RESOLVER_LIST"
+  fi
+
+  while IFS= read -r name; do
+    [[ -n "$name" ]] || continue
+    resolver_tmp=$(mktemp)
+    cat >"$resolver_tmp" <<EOF
+nameserver ${dns}
+timeout 2
+EOF
+    if ! cmp -s "$resolver_tmp" "/etc/resolver/${name}"; then
+      cat "$resolver_tmp" >"/etc/resolver/${name}"
+      FILES_CHANGED=1
+    fi
+    rm -f "$resolver_tmp"
+  done <"$desired_list"
+
+  if ! cmp -s "$desired_list" "$RESOLVER_LIST"; then
+    mv "$desired_list" "$RESOLVER_LIST"
+  else
+    rm -f "$desired_list"
+  fi
+}
+
+flush_dns() {
+  dscacheutil -flushcache >/dev/null 2>&1 || true
+  killall -HUP mDNSResponder >/dev/null 2>&1 || true
+}
+
+resolve_via_wifi() {
+  local wifi_ip=$1 dns=$2 name=$3
+  dig -b "$wifi_ip" @"$dns" +short +time=2 +tries=1 "$name" A \
+    | awk '/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/{print}' \
+    | sort -u
+}
+
+wanted_proxy_exceptions() {
+  local d s
+  for d in $DOMAINS; do
+    printf '%s\n' "$d" "*.${d}"
+  done
+  for s in $SUFFIXES; do
+    printf '%s\n' "$s" "*.${s}"
+  done
+}
+
+http_proxy_keys() {
+  local key
+  echo "State:/Network/Global/Proxies"
+  while IFS= read -r key; do
+    [[ -n "$key" ]] || continue
+    if echo "show ${key}" | scutil | grep -q 'HTTPEnable : 1'; then
+      printf '%s\n' "$key"
+    fi
+  done < <(echo "list State:/Network/Service/.*/Proxies" | scutil | awk -F'= ' '/subKey/{print $2}')
+}
+
+read_proxy_exceptions() {
+  local key=${1-}
+  [[ -n "$key" ]] || key=$(http_proxy_keys | awk 'NR==2{print; exit} END{if(NR==1) print}')
+  echo "show ${key}" | scutil | awk '
+    /ExceptionsList[[:space:]]*:/ {inlist=1; next}
+    inlist && /}/ {exit}
+    inlist && /: / {
+      sub(/^[^:]+:[[:space:]]*/, "")
+      if ($0 != "") print
+    }
+  '
+}
+
+write_proxy_exceptions() {
+  local items=$*
+  local key
+  [[ -n "$items" ]] || return 0
+  while IFS= read -r key; do
+    [[ -n "$key" ]] || continue
+    scutil >/dev/null <<EOF
+open
+d.init
+get ${key}
+d.add ExceptionsList * ${items}
+set ${key}
+quit
+EOF
+  done < <(http_proxy_keys | awk 'NF && !seen[$0]++')
+}
+
+list_has() {
+  local needle=$1
+  shift
+  local y
+  for y in "$@"; do
+    [[ "$y" == "$needle" ]] && return 0
+  done
+  return 1
+}
+
+ensure_proxy_exceptions() {
+  local -a cur=() want=() merged=()
+  local x
+  while IFS= read -r x; do
+    [[ -n "$x" ]] && cur+=("$x")
+  done < <(read_proxy_exceptions "")
+  while IFS= read -r x; do
+    [[ -n "$x" ]] && want+=("$x")
+  done < <(wanted_proxy_exceptions | awk 'NF && !seen[$0]++')
+  if [[ ${#cur[@]} -gt 0 ]]; then
+    merged=("${cur[@]}")
+  fi
+  for x in "${want[@]}"; do
+    if [[ ${#cur[@]} -gt 0 ]] && list_has "$x" "${cur[@]}"; then
+      continue
+    fi
+    merged+=("$x")
+  done
+  if [[ ${#merged[@]} -eq ${#cur[@]} ]]; then
+    return 0
+  fi
+  write_proxy_exceptions "${merged[*]}"
+  log "proxy bypass +${want[*]}"
+}
+
+remove_proxy_exceptions() {
+  local -a cur=() keep=() want=()
+  local x
+  while IFS= read -r x; do
+    [[ -n "$x" ]] && cur+=("$x")
+  done < <(read_proxy_exceptions "")
+  [[ ${#cur[@]} -gt 0 ]] || return 0
+  while IFS= read -r x; do
+    [[ -n "$x" ]] && want+=("$x")
+  done < <(wanted_proxy_exceptions)
+  for x in "${cur[@]}"; do
+    if [[ ${#want[@]} -gt 0 ]] && list_has "$x" "${want[@]}"; then
+      continue
+    fi
+    keep+=("$x")
+  done
+  if [[ ${#keep[@]} -eq ${#cur[@]} ]]; then
+    return 0
+  fi
+  write_proxy_exceptions "${keep[*]}"
+  log "proxy bypass restored"
+}
+
+drop_state_entry() {
+  local kind=$1 target=$2
+  case "$kind" in
+    v6) del_reject_v6 "$target" ;;
+    net) del_net_v4 "$target" ;;
+    *) del_host_v4 "$target" ;;
+  esac
+}
+
+clear_applied() {
+  local kind ip
+  if [[ -f "$STATE_FILE" ]]; then
+    while read -r kind ip; do
+      [[ -n "$kind" ]] || continue
+      if [[ -z "$ip" ]]; then
+        ip=$kind
+        kind=v4
+      fi
+      drop_state_entry "$kind" "$ip"
+    done <"$STATE_FILE"
+  fi
+  write_hosts_block ""
+  clear_resolvers
+  remove_proxy_exceptions
+  rm -rf "$STATE_DIR"
+  flush_dns
+}
+
+cmd_clear() {
+  require_root
+  load_config
+  clear_applied
+  log "cleared split routes"
+}
+
+write_network_inputs() {
+  local dest=$1 eth=$2 wifi=$3 wifi_ip=$4 wifi_gw=$5 wifi_dns=$6
+  {
+    printf 'ethernet=%s\n' "$eth"
+    printf 'ethernet_ip=%s\n' "$(ipconfig getifaddr "$eth" 2>/dev/null || true)"
+    printf 'wifi=%s\n' "$wifi"
+    printf 'wifi_ip=%s\n' "$wifi_ip"
+    printf 'wifi_gateway=%s\n' "$wifi_gw"
+    printf 'wifi_dns=%s\n' "$wifi_dns"
+    printf 'wifi_domain=%s\n' "$(ipconfig getoption "$wifi" domain_name 2>/dev/null || true)"
+    printf 'domains=%s\n' "$DOMAINS"
+    printf 'suffixes=%s\n' "$SUFFIXES"
+    printf 'cidrs=%s\n' "$CIDRS"
+  } >"$dest"
+}
+
+acquire_apply_lock() {
+  local old_pid=""
+  if mkdir "$LOCK_DIR" 2>/dev/null; then
+    printf '%s\n' "$$" >"${LOCK_DIR}/pid"
+    return 0
+  fi
+  [[ -r "${LOCK_DIR}/pid" ]] && old_pid=$(<"${LOCK_DIR}/pid")
+  if [[ "$old_pid" =~ ^[0-9]+$ ]] && kill -0 "$old_pid" 2>/dev/null; then
+    return 1
+  fi
+  rm -f "${LOCK_DIR}/pid"
+  rmdir "$LOCK_DIR" 2>/dev/null || return 1
+  mkdir "$LOCK_DIR"
+  printf '%s\n' "$$" >"${LOCK_DIR}/pid"
+}
+
+release_apply_lock() {
+  rm -f "${LOCK_DIR}/pid"
+  rmdir "$LOCK_DIR" 2>/dev/null || true
+}
+
+cmd_apply_locked() {
+  local force=${1-}
+  load_config
+  mkdir -p "$STATE_DIR"
+  FILES_CHANGED=0
+  local pair eth wifi wifi_ip wifi_gw wifi_dns
+  if ! pair=$(split_should_run); then
+    if [[ -f "$STATE_FILE" ]]; then
+      log "condition not met; tearing down"
+      clear_applied
+    fi
+    return 0
+  fi
+  eth=${pair%% *}
+  wifi=${pair##* }
+  wifi_ip=$(ipconfig getifaddr "$wifi")
+  wifi_gw=$(ipconfig getoption "$wifi" router)
+  wifi_dns=$(ipconfig getoption "$wifi" domain_name_server | awk '{print $1}')
+  if [[ -z "$wifi_ip" || -z "$wifi_gw" || -z "$wifi_dns" ]]; then
+    log "wifi details incomplete; skip"
+    return 0
+  fi
+
+  local input_tmp
+  input_tmp=$(mktemp)
+  write_network_inputs "$input_tmp" "$eth" "$wifi" "$wifi_ip" "$wifi_gw" "$wifi_dns"
+  if [[ "$force" != "--force" && -f "$STATE_FILE" && -f "$INPUT_STATE_FILE" ]] \
+    && cmp -s "$input_tmp" "$INPUT_STATE_FILE"; then
+    rm -f "$input_tmp"
+    return 0
+  fi
+
+  local -a lines=()
+  local hosts_body="" d ip first cidr resolved resolved_tmp previous
+  resolved_tmp=$(mktemp)
+  add_host_v4 "$wifi_dns" "$wifi_gw"
+  lines+=("v4 $wifi_dns")
+
+  for cidr in $CIDRS; do
+    add_net_v4 "$cidr" "$wifi_gw"
+    lines+=("net $cidr")
+  done
+
+  for d in $DOMAINS; do
+    first=""
+    resolved=$(resolve_via_wifi "$wifi_ip" "$wifi_dns" "$d" || true)
+    if [[ -z "$resolved" ]]; then
+      previous=""
+      if [[ -f "$RESOLVED_STATE_FILE" ]]; then
+        previous=$(awk -v domain="$d" '$1==domain {print $2}' "$RESOLVED_STATE_FILE")
+      fi
+      if [[ -z "$previous" ]]; then
+        log "WARN: no A record for $d via $wifi_dns"
+        continue
+      fi
+      log "WARN: no A record for $d via $wifi_dns; keeping previous result"
+      resolved=$previous
+    fi
+    while read -r ip; do
+      [[ -n "$ip" ]] || continue
+      printf '%s %s\n' "$d" "$ip" >>"$resolved_tmp"
+      add_host_v4 "$ip" "$wifi_gw"
+      lines+=("v4 $ip")
+      if [[ -z "$first" ]]; then
+        first=$ip
+        hosts_body+="${ip} ${d}"$'\n'
+      fi
+    done <<<"$resolved"
+  done
+
+  write_resolvers "$wifi_dns"
+  write_hosts_block "$hosts_body"
+  ensure_proxy_exceptions
+
+  local tmp state_changed=0
+  tmp=$(mktemp)
+  printf '%s\n' "${lines[@]}" | awk 'NF && !seen[$0]++' | sort >"$tmp"
+  if [[ -f "$STATE_FILE" ]]; then
+    while read -r kind ip; do
+      [[ -n "$kind" ]] || continue
+      if [[ -z "$ip" ]]; then
+        ip=$kind
+        kind=v4
+      fi
+      if grep -qx "$kind $ip" "$tmp"; then
+        continue
+      fi
+      drop_state_entry "$kind" "$ip"
+    done <"$STATE_FILE"
+  fi
+  if [[ -f "$STATE_FILE" ]] && cmp -s "$tmp" "$STATE_FILE"; then
+    rm -f "$tmp"
+  else
+    mv "$tmp" "$STATE_FILE"
+    state_changed=1
+  fi
+
+  if ! cmp -s "$input_tmp" "$INPUT_STATE_FILE"; then
+    mv "$input_tmp" "$INPUT_STATE_FILE"
+  else
+    rm -f "$input_tmp"
+  fi
+  if ! cmp -s "$resolved_tmp" "$RESOLVED_STATE_FILE"; then
+    mv "$resolved_tmp" "$RESOLVED_STATE_FILE"
+  else
+    rm -f "$resolved_tmp"
+  fi
+
+  chmod 755 "$STATE_DIR" 2>/dev/null || true
+  chmod 644 "$STATE_FILE" "$INPUT_STATE_FILE" "$RESOLVED_STATE_FILE" "$RESOLVER_LIST" 2>/dev/null || true
+  if [[ "$FILES_CHANGED" -eq 1 ]]; then
+    flush_dns
+  fi
+  if [[ "$state_changed" -eq 1 || "$FILES_CHANGED" -eq 1 ]]; then
+    log "applied via ${wifi} gw=${wifi_gw} dns=${wifi_dns} (wired ${eth}): $(tr '\n' ' ' <"$STATE_FILE")"
+  fi
+}
+
+cmd_apply() {
+  require_root
+  if ! acquire_apply_lock; then
+    return 0
+  fi
+  local rc=0
+  cmd_apply_locked "${1-}" || rc=$?
+  release_apply_lock
+  return "$rc"
+}
+
+cmd_refresh() {
+  require_root
+  cmd_apply --force
+  echo "refreshed: routes, DNS, hosts, resolvers and proxy exceptions checked"
+}
+
+cmd_status() {
+  load_config
+  local wifi eth pair
+  wifi=$(wifi_device)
+  echo "wifi device : ${wifi:-none}"
+  if [[ -n "$wifi" ]]; then
+    echo "wifi ip     : $(ipconfig getifaddr "$wifi" 2>/dev/null || echo none)"
+    echo "wifi domain : $(ipconfig getoption "$wifi" domain_name 2>/dev/null || echo none)"
+    echo "wifi dns    : $(ipconfig getoption "$wifi" domain_name_server 2>/dev/null || echo none)"
+    echo "wifi gw     : $(ipconfig getoption "$wifi" router 2>/dev/null || echo none)"
+  fi
+  echo "wired ifaces: $(ethernet_devices | tr '\n' ' ')"
+  if eth=$(wired_up); then
+    echo "wired up    : $eth $(ipconfig getifaddr "$eth")"
+  else
+    echo "wired up    : no"
+  fi
+  if pair=$(split_should_run); then
+    echo "split cond  : YES ($pair)"
+  else
+    echo "split cond  : no"
+  fi
+  echo "config      : $CONF"
+  echo "domains     : ${DOMAINS:-<none>}"
+  echo "suffixes    : ${SUFFIXES:-<none>}"
+  echo "cidrs       : ${CIDRS:-<none>}"
+  echo "state file  : $( [[ -f $STATE_FILE ]] && echo present || echo absent )"
+  if [[ -r "$STATE_FILE" ]]; then
+    echo "routed:"
+    sed 's/^/  /' "$STATE_FILE"
+  elif [[ -f "$STATE_FILE" ]]; then
+    echo "routed: (not readable without root)"
+  fi
+  echo "hosts block :"
+  awk -v b="$HOSTS_BEGIN" -v e="$HOSTS_END" '
+    $0==b{on=1}
+    on{print "  "$0}
+    $0==e{on=0}
+  ' /etc/hosts || true
+  echo "watcher     : $(launchctl print "system/${LABEL}" >/dev/null 2>&1 && echo loaded || echo not-loaded)"
+  echo "reconcile   : $(launchctl print "system/${RECONCILE_LABEL}" >/dev/null 2>&1 && echo "loaded (${RECONCILE_INTERVAL}s)" || echo not-loaded)"
+  echo "sys proxy   : $(scutil --proxy | awk '/HTTPEnable/{e=$3} /HTTPProxy/{p=$3} /HTTPPort/{n=$3} END{if(e==1) print p":"n; else print "off"}')"
+  echo "proxy bypass:"
+  read_proxy_exceptions | sed 's/^/  /' || true
+  local d
+  for d in $DOMAINS; do
+    echo "resolve $d:"
+    dscacheutil -q host -a name "$d" 2>/dev/null | sed 's/^/  /' || true
+  done
+}
+
+cmd_list() {
+  load_config
+  echo "config   : $CONF"
+  echo "domains  :"
+  printf '%s\n' $DOMAINS | sed 's/^/  /'
+  echo "suffixes :"
+  printf '%s\n' $SUFFIXES | sed 's/^/  /'
+  echo "cidrs    :"
+  printf '%s\n' $CIDRS | sed 's/^/  /'
+}
+
+classify_item() {
+  local item=$1
+  case "$item" in
+    */*) echo cidr ;;
+    \*.*) echo suffix ;;
+    *) echo domain ;;
+  esac
+}
+
+normalize_item() {
+  local kind=$1 item=$2
+  case "$kind" in
+    suffix) echo "${item#\*.}" ;;
+    *) echo "$item" ;;
+  esac
+}
+
+cmd_add() {
+  require_root
+  load_config
+  local item=${1-} kind
+  [[ -n "$item" ]] || { echo "usage: $0 add <host|*.suffix|cidr>" >&2; exit 2; }
+  kind=$(classify_item "$item")
+  item=$(normalize_item "$kind" "$item")
+  case "$kind" in
+    cidr) DOMAINS="$DOMAINS"; CIDRS=$(add_word "$CIDRS" "$item") ;;
+    suffix) SUFFIXES=$(add_word "$SUFFIXES" "$item") ;;
+    domain) DOMAINS=$(add_word "$DOMAINS" "$item") ;;
+  esac
+  save_config
+  log "added $kind $item"
+  cmd_apply
+}
+
+cmd_remove() {
+  require_root
+  load_config
+  local item=${1-} kind
+  [[ -n "$item" ]] || { echo "usage: $0 remove <host|*.suffix|cidr>" >&2; exit 2; }
+  kind=$(classify_item "$item")
+  item=$(normalize_item "$kind" "$item")
+  case "$kind" in
+    cidr) CIDRS=$(remove_word "$CIDRS" "$item") ;;
+    suffix) SUFFIXES=$(remove_word "$SUFFIXES" "$item") ;;
+    domain) DOMAINS=$(remove_word "$DOMAINS" "$item") ;;
+  esac
+  save_config
+  log "removed $kind $item"
+  cmd_apply
+}
+
+close_network_event_stream() {
+  { exec 3>&-; } 2>/dev/null || true
+  { exec 4<&-; } 2>/dev/null || true
+  if [[ "$WATCH_CHILD_PID" =~ ^[0-9]+$ ]]; then
+    kill "$WATCH_CHILD_PID" >/dev/null 2>&1 || true
+    wait "$WATCH_CHILD_PID" 2>/dev/null || true
+  fi
+  WATCH_CHILD_PID=""
+  rm -f "$WATCH_COMMAND_FIFO" "$WATCH_EVENT_FIFO"
+  rmdir "$WATCH_DIR" 2>/dev/null || true
+}
+
+stop_watch() {
+  close_network_event_stream
+  exit 0
+}
+
+start_network_event_stream() {
+  mkdir -p "$WATCH_DIR"
+  rm -f "$WATCH_COMMAND_FIFO" "$WATCH_EVENT_FIFO"
+  mkfifo "$WATCH_COMMAND_FIFO" "$WATCH_EVENT_FIFO"
+  /usr/sbin/scutil <"$WATCH_COMMAND_FIFO" >"$WATCH_EVENT_FIFO" 2>/dev/null &
+  WATCH_CHILD_PID=$!
+  exec 3>"$WATCH_COMMAND_FIFO"
+  exec 4<"$WATCH_EVENT_FIFO"
+  cat >&3 <<'EOF'
+n.add ^State:/Network/(Global/(IPv4|DNS)|Interface/.*/(IPv4|Link|AirPort)|Service/.*/(DHCP|DNS|IPv4))$ pattern
+n.add ^Setup:/Network/Service/.*/(DNS|IPv4)$ pattern
+n.watch
+EOF
+}
+
+cmd_watch() {
+  require_root
+  trap stop_watch INT TERM
+  log "network watcher started"
+  cmd_apply --force
+  local line now last_apply=0
+  while :; do
+    start_network_event_stream
+    while IFS= read -r line <&4; do
+      case "$line" in
+        *"changedKey ["*) ;;
+        *) continue ;;
+      esac
+      now=$(date +%s)
+      if (( now - last_apply <= EVENT_SETTLE_SECONDS )); then
+        continue
+      fi
+      sleep "$EVENT_SETTLE_SECONDS"
+      cmd_apply
+      last_apply=$(date +%s)
+    done
+    close_network_event_stream
+    log "WARN: network event stream stopped; retrying"
+    sleep 5
+  done
+}
+
+write_install_plists() {
+  local bin=$1
+  cat >"$PLIST" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${bin}</string>
+    <string>watch</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>10</integer>
+  <key>StandardOutPath</key>
+  <string>/var/log/zyhy-private-split.log</string>
+  <key>StandardErrorPath</key>
+  <string>/var/log/zyhy-private-split.log</string>
+</dict>
+</plist>
+EOF
+
+  cat >"$RECONCILE_PLIST" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${RECONCILE_LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${bin}</string>
+    <string>apply</string>
+    <string>--force</string>
+  </array>
+  <key>StartInterval</key>
+  <integer>${RECONCILE_INTERVAL}</integer>
+  <key>StandardOutPath</key>
+  <string>/var/log/zyhy-private-split.log</string>
+  <key>StandardErrorPath</key>
+  <string>/var/log/zyhy-private-split.log</string>
+</dict>
+</plist>
+EOF
+  chmod 644 "$PLIST" "$RECONCILE_PLIST"
+}
+
+bootstrap_with_retry() {
+  local plist=$1 attempt=1 output=""
+  while (( attempt <= 5 )); do
+    if output=$(launchctl bootstrap system "$plist" 2>&1); then
+      return 0
+    fi
+    if (( attempt == 5 )); then
+      echo "$output" >&2
+      return 1
+    fi
+    log "WARN: launchd bootstrap retry ${attempt}/5 for $(basename "$plist")"
+    sleep 1
+    attempt=$((attempt + 1))
+  done
+}
+
+cmd_install() {
+  require_root
+  local self legacy_label
+  self=$(cd "$(dirname "$0")" && pwd)/$(basename "$0")
+  launchctl bootout "system/${LABEL}" >/dev/null 2>&1 || true
+  launchctl bootout "system/${RECONCILE_LABEL}" >/dev/null 2>&1 || true
+  for legacy_label in $LEGACY_LABELS; do
+    launchctl bootout "system/${legacy_label}" >/dev/null 2>&1 || true
+  done
+  mkdir -p /usr/local/sbin /usr/local/etc
+  if [[ "$self" != "$INSTALL_BIN" ]]; then
+    cp "$self" "$INSTALL_BIN"
+  fi
+  chmod 755 "$INSTALL_BIN"
+  load_config
+  save_config
+  for legacy_label in $LEGACY_LABELS; do
+    rm -f "/Library/LaunchDaemons/${legacy_label}.plist"
+  done
+  write_install_plists "$INSTALL_BIN"
+  cmd_apply --force
+  bootstrap_with_retry "$PLIST"
+  if ! bootstrap_with_retry "$RECONCILE_PLIST"; then
+    launchctl bootout "system/${LABEL}" >/dev/null 2>&1 || true
+    return 1
+  fi
+  log "installed ${INSTALL_BIN} + ${CONF}"
+}
+
+cmd_uninstall() {
+  require_root
+  load_config
+  launchctl bootout "system/${LABEL}" >/dev/null 2>&1 || true
+  launchctl bootout "system/${RECONCILE_LABEL}" >/dev/null 2>&1 || true
+  local legacy_label
+  for legacy_label in $LEGACY_LABELS; do
+    launchctl bootout "system/${legacy_label}" >/dev/null 2>&1 || true
+    rm -f "/Library/LaunchDaemons/${legacy_label}.plist"
+  done
+  rm -f "$PLIST" "$RECONCILE_PLIST"
+  if [[ -f "$INSTALL_CLI" ]] && \
+     grep -q '^# zyhy-network managed GitHub-install wrapper$' "$INSTALL_CLI" 2>/dev/null; then
+    rm -f "$INSTALL_CLI"
+  fi
+  clear_applied
+  log "uninstalled (config kept at ${CONF})"
+}
+
+cmd_bundle() {
+  load_config
+  local dest=${1-} tmp
+  if [[ -z "$dest" ]]; then
+    dest="$HOME/Downloads/zyhy-private-split.tgz"
+  fi
+  tmp=$(mktemp -d)
+  mkdir -p "$tmp/zyhy-private-split"
+  local src
+  src=$(cd "$(dirname "$0")" && pwd)/$(basename "$0")
+  cp "$src" "$tmp/zyhy-private-split/zyhy-private-split"
+  chmod 755 "$tmp/zyhy-private-split/zyhy-private-split"
+  if [[ -f "$CONF" ]]; then
+    cp "$CONF" "$tmp/zyhy-private-split/zyhy-private-split.conf"
+  else
+    cat >"$tmp/zyhy-private-split/zyhy-private-split.conf" <<EOF
+WIFI_DOMAIN="${WIFI_DOMAIN}"
+DOMAINS="${DOMAINS}"
+SUFFIXES="${SUFFIXES}"
+CIDRS="${CIDRS}"
+EVENT_SETTLE_SECONDS="${EVENT_SETTLE_SECONDS}"
+RECONCILE_INTERVAL="${RECONCILE_INTERVAL}"
+EOF
+  fi
+  cat >"$tmp/zyhy-private-split/INSTALL.txt" <<'EOF'
+macOS only. Target machine also needs Ethernet + Wi-Fi ZYHY-Private.
+
+  chmod 755 zyhy-private-split
+  sudo mkdir -p /usr/local/etc
+  sudo cp zyhy-private-split.conf /usr/local/etc/zyhy-private-split.conf
+  sudo ./zyhy-private-split install
+
+Then:
+  zyhy-private-split status
+  sudo zyhy-private-split add '*.hq.cmcc'
+  sudo zyhy-private-split add 172.21.0.0/16
+EOF
+  tar -C "$tmp" -czf "$dest" zyhy-private-split
+  rm -rf "$tmp"
+  echo "bundle: $dest"
+}
+
+usage() {
+  cat <<EOF
+usage: $0 <command>
+
+  status                 show split state
+  list                   show domains / suffixes / CIDRs
+  add <item>             add host, '*.suffix', or CIDR (needs sudo)
+  remove <item>          remove one of the above (needs sudo)
+  refresh                force DNS resolution and reconcile now (needs sudo)
+  apply [--force]        apply now; --force also reconciles DNS (needs sudo)
+  clear                  tear down routes (needs sudo)
+  install                copy to /usr/local/sbin and load daemon (needs sudo)
+  uninstall              remove daemon and routes; keep config (needs sudo)
+  bundle [path.tgz]      pack script+config for another Mac
+EOF
+  exit 2
+}
+
+cmd=${1:-status}
+shift || true
+load_config
+case "$cmd" in
+  apply) cmd_apply "${1-}" ;;
+  refresh) cmd_refresh ;;
+  watch) cmd_watch ;;
+  clear) cmd_clear ;;
+  status) cmd_status ;;
+  list) cmd_list ;;
+  add) cmd_add "${1-}" ;;
+  remove) cmd_remove "${1-}" ;;
+  install) cmd_install ;;
+  uninstall) cmd_uninstall ;;
+  bundle) cmd_bundle "${1-}" ;;
+  help|-h|--help) usage ;;
+  -v|--version) echo "$VERSION" ;;
+  *) usage ;;
+esac

package/zyhy-private-split.conf

@@ -0,0 +1,10 @@
+# 这台已验证可用的配置，安装脚本会原样拷到 /usr/local/etc/
+
+WIFI_DOMAIN="ZYHY-Private"
+DOMAINS="oa.hq.cmcc mail.cmhi.chinamobile.com"
+SUFFIXES="hq.cmcc cmhi.chinamobile.com"
+CIDRS="172.21.0.0/16 172.16.0.0/16"
+
+# 网络变化后等待接口稳定的秒数；另每 300 秒做一次只读为主的兜底校验。
+EVENT_SETTLE_SECONDS="2"
+RECONCILE_INTERVAL="300"