@swimmingliu/autovpn 1.4.0

package/dist/pipeline/extract.js

@@ -0,0 +1,259 @@
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { spawn as defaultSpawn } from 'node:child_process';
+import { mergeProjectEnv } from '../runtime/env.js';
+const PYTHON_EXTRACT_HELPER = `
+import json
+import sys
+from vpn_automation.config.models import SourceConfig
+from vpn_automation.pipeline.extract import fetch_source_links
+
+payload = json.load(sys.stdin)
+result = fetch_source_links(payload["source_name"], SourceConfig(**payload["source"]))
+json.dump(
+    {
+        "source_name": result.source_name,
+        "requested_iterations": result.requested_iterations,
+        "successful_iterations": result.successful_iterations,
+        "failed_iterations": result.failed_iterations,
+        "links": result.links,
+    },
+    sys.stdout,
+    ensure_ascii=False,
+)
+sys.stdout.write("\\n")
+`;
+function defaultRandomInt(start, end) {
+    return Math.floor(Math.random() * (end - start + 1)) + start;
+}
+export function buildRuntimeSourceUrl(source, iteration = 0, options = {}) {
+    const url = new URL(source.url);
+    if (source.use_random_area && iteration > 0) {
+        let areaMin = Number(source.area_min ?? 0);
+        let areaMax = Number(source.area_max ?? 100);
+        if (areaMin > areaMax) {
+            [areaMin, areaMax] = [areaMax, areaMin];
+        }
+        url.searchParams.set('area', String((options.randomInt ?? defaultRandomInt)(areaMin, areaMax)));
+    }
+    if (url.searchParams.has('t')) {
+        url.searchParams.set('t', (options.timeNow ?? (() => Date.now() / 1000))().toFixed(6));
+    }
+    return url.toString();
+}
+export function decryptPayload(cipherText, key) {
+    const keyBuffer = Buffer.from(key, 'utf8');
+    const decipher = crypto.createDecipheriv('aes-128-cbc', keyBuffer, keyBuffer);
+    decipher.setAutoPadding(false);
+    const plain = Buffer.concat([decipher.update(Buffer.from(cipherText, 'base64')), decipher.final()]);
+    return plain.toString('utf8').replace(/\0+$/g, '');
+}
+export function transformNodeId(original) {
+    return String(original).split('-').map((part) => {
+        const chunks = [];
+        for (let index = 0; index < part.length; index += 4) {
+            const chunk = part.slice(index, index + 4);
+            if (chunk) {
+                chunks.push(`${chunk.slice(2)}${chunk.slice(0, 2)}`);
+            }
+        }
+        return chunks.join('');
+    }).join('-');
+}
+function generateVmessLink(payload) {
+    const json = JSON.stringify(payload);
+    const encoded = Buffer.from(json, 'utf8').toString('base64').replaceAll('+', '-').replaceAll('/', '_');
+    return `vmess://${encoded}`;
+}
+function payloadFromOutboundConfig(psName, jsonText) {
+    const config = JSON.parse(jsonText);
+    const outbound = (config.outbounds ?? []).find((item) => item.protocol === 'vmess');
+    const vnext = outbound.settings.vnext[0];
+    const user = vnext.users[0];
+    const streamSettings = outbound.streamSettings ?? {};
+    const wsSettings = streamSettings.wsSettings ?? {};
+    const headers = wsSettings.headers ?? {};
+    const host = wsSettings.host || headers.Host || vnext.address;
+    const psValue = typeof config.ps === 'string' ? config.ps.trim() : (config.ps ?? psName);
+    return {
+        v: 2,
+        ps: psValue,
+        add: vnext.address,
+        port: String(vnext.port),
+        id: transformNodeId(user.id),
+        aid: String(user.alterId ?? 0),
+        scy: user.security ?? 'auto',
+        net: streamSettings.network ?? 'ws',
+        type: 'dtls',
+        host,
+        path: wsSettings.path ?? '',
+        tls: streamSettings.security ?? '',
+        sni: streamSettings.tlsSettings?.serverName ?? ''
+    };
+}
+export function extractLinksFromPlaintext(sourceName, plaintext) {
+    const cleaned = String(plaintext).trim();
+    if (!cleaned) {
+        return [];
+    }
+    if (cleaned.startsWith('vmess://')) {
+        return [cleaned];
+    }
+    const parts = cleaned.split('|');
+    if (parts.length < 2) {
+        return [];
+    }
+    const psName = parts[0].trim() || sourceName;
+    const jsonText = parts[1].trim();
+    return [generateVmessLink(payloadFromOutboundConfig(psName, jsonText))];
+}
+export function selectPipelineStageBackend(stage, env = process.env) {
+    const stageKey = `AUTOVPN_STAGE_BACKEND_${stage.toUpperCase()}`;
+    const stageOverride = String(env[stageKey] ?? '').trim().toLowerCase();
+    const pipelineOverride = String(env.AUTOVPN_PIPELINE_BACKEND ?? '').trim().toLowerCase();
+    const selected = stageOverride || pipelineOverride || 'node';
+    return selected === 'python' ? 'python' : 'node';
+}
+async function defaultResolvePythonCli(env) {
+    // @ts-expect-error Phase 1 runner remains plain ESM JavaScript.
+    const runner = await import('../../lib/runner.mjs');
+    return runner.resolveOrInstallPythonCli({ env });
+}
+function pythonCommandFor(resolved) {
+    const command = resolved.command;
+    const name = path.basename(command).toLowerCase();
+    if (['autovpn', 'autovpn.exe'].includes(name)) {
+        const executable = process.platform === 'win32' ? 'python.exe' : 'python';
+        return path.join(path.dirname(command), executable);
+    }
+    return process.platform === 'win32' ? 'python.exe' : 'python3';
+}
+function numberOrDefault(value, fallback) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : fallback;
+}
+async function fetchWithTimeout(fetchImpl, url, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetchImpl(url, { signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function fetchSourceLinksInNode(input, options) {
+    const source = input.source;
+    const maxIterations = Math.max(0, Math.trunc(numberOrDefault(source.max_iterations, 0)));
+    const minIterations = Math.max(0, Math.trunc(numberOrDefault(source.min_iterations, 0)));
+    const plateauLimit = Math.max(1, Math.trunc(numberOrDefault(source.plateau_limit, 1)));
+    const failureLimit = Math.max(1, Math.trunc(numberOrDefault(source.failure_limit, 1)));
+    const maxRuntimeSeconds = Math.max(0, numberOrDefault(source.max_runtime_seconds, 0));
+    const startIteration = Math.max(1, Math.trunc(numberOrDefault(source.resume_from_iteration, 1)));
+    const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+    if (!fetchImpl) {
+        throw new Error('Node extract backend requires fetch support');
+    }
+    if (!String(source.url ?? '').trim() || !String(source.key ?? '').trim()) {
+        return {
+            source_name: input.source_name,
+            requested_iterations: maxIterations,
+            successful_iterations: 0,
+            failed_iterations: 0,
+            links: []
+        };
+    }
+    const links = [];
+    const seen = new Set();
+    let plateau = 0;
+    let successes = 0;
+    let failures = 0;
+    const startedAt = Date.now();
+    for (let iteration = startIteration - 1; iteration < maxIterations; iteration += 1) {
+        const attempt = iteration + 1;
+        if (maxRuntimeSeconds > 0 && attempt > minIterations && (Date.now() - startedAt) / 1000 >= maxRuntimeSeconds) {
+            break;
+        }
+        try {
+            const url = buildRuntimeSourceUrl(source, iteration);
+            const response = await fetchWithTimeout(fetchImpl, url, 20_000);
+            if (response.ok === false || Number(response.status ?? 200) >= 400) {
+                throw new Error(`HTTP ${Number(response.status ?? 0)}`);
+            }
+            const plaintext = decryptPayload((await response.text()).trim(), source.key);
+            const extracted = extractLinksFromPlaintext(input.source_name, plaintext);
+            successes += 1;
+            failures = 0;
+            let newItems = 0;
+            for (const link of extracted) {
+                if (seen.has(link)) {
+                    continue;
+                }
+                seen.add(link);
+                links.push(link);
+                newItems += 1;
+            }
+            plateau = newItems === 0 ? plateau + 1 : 0;
+            if (plateau >= plateauLimit && attempt >= minIterations) {
+                break;
+            }
+        }
+        catch (error) {
+            failures += 1;
+            if (failures >= failureLimit && attempt >= minIterations) {
+                break;
+            }
+            if (attempt >= maxIterations) {
+                throw new Error(`Node extract request failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    return {
+        source_name: input.source_name,
+        requested_iterations: maxIterations,
+        successful_iterations: successes,
+        failed_iterations: failures,
+        links
+    };
+}
+async function extractWithPython(input, options) {
+    const env = mergeProjectEnv(options.cwd ?? process.cwd(), options.env ?? process.env);
+    const resolved = options.resolvePythonCli ? await options.resolvePythonCli() : await defaultResolvePythonCli(env);
+    const child = (options.spawn ?? defaultSpawn)(pythonCommandFor(resolved), ['-c', PYTHON_EXTRACT_HELPER], {
+        cwd: options.cwd ?? process.cwd(),
+        env,
+        stdio: ['pipe', 'pipe', 'pipe']
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => {
+        stdout += String(chunk);
+    });
+    child.stderr?.on('data', (chunk) => {
+        stderr += String(chunk);
+    });
+    const completion = new Promise((resolve, reject) => {
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code !== 0) {
+                reject(new Error(`Python extract backend failed with exit code ${code}: ${stderr.trim()}`));
+                return;
+            }
+            try {
+                resolve(JSON.parse(stdout));
+            }
+            catch (error) {
+                reject(new Error(`Python extract backend returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`));
+            }
+        });
+    });
+    child.stdin?.write(JSON.stringify(input));
+    child.stdin?.end();
+    return completion;
+}
+export async function fetchSourceLinksWithBackend(input, options = {}) {
+    if (selectPipelineStageBackend('extract', options.env ?? process.env) === 'python') {
+        return options.pythonExtract ? options.pythonExtract(input) : extractWithPython(input, options);
+    }
+    return options.fetchSourceLinks ? options.fetchSourceLinks(input) : fetchSourceLinksInNode(input, options);
+}

package/dist/pipeline/obfuscate.js

@@ -0,0 +1,203 @@
+import path from 'node:path';
+import { spawn as defaultSpawn } from 'node:child_process';
+import { mergeProjectEnv } from '../runtime/env.js';
+const DEFAULT_WORKER_BUILD_CONFIG = {
+    environment_name: 'production',
+    entry_filename: '_worker.js',
+    bundle_subdir: 'pages_bundle',
+    modules_subdir: 'modules',
+    manifest_filename: 'manifest.json',
+    variable_prefix: 'sg',
+    comment_template: 'subscription worker: returns encoded payload on secret match, random bytes otherwise',
+    random_noise_min_length: 24,
+    random_noise_max_length: 96,
+    enable_keyword_fragmentation: true,
+    enable_identifier_randomization: true,
+    emit_sidecar_modules: true
+};
+const PYTHON_OBFUSCATE_HELPER = `
+import json
+import sys
+from vpn_automation.config.models import WorkerBuildConfig
+from vpn_automation.pipeline.worker_build import build_worker_artifacts
+
+payload = json.load(sys.stdin)
+config = WorkerBuildConfig(**(payload.get("config") or {}))
+artifacts = build_worker_artifacts(payload["rendered_source"], config, payload["secret_query"])
+json.dump(
+    {
+        "transformed_source": artifacts.transformed_source,
+        "modules": artifacts.modules,
+        "manifest": artifacts.manifest,
+    },
+    sys.stdout,
+    ensure_ascii=False,
+)
+sys.stdout.write("\\n")
+`;
+function jsonStringLiteral(value) {
+    return JSON.stringify(value);
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+export function resolveWorkerBuildConfig(config = {}) {
+    return {
+        ...DEFAULT_WORKER_BUILD_CONFIG,
+        ...Object.fromEntries(Object.entries(config).filter(([, value]) => value !== undefined))
+    };
+}
+export function stableIdentifierPrefix(prefix) {
+    const normalized = String(prefix || 'sg').replace(/[^a-zA-Z0-9_]+/g, '_').replace(/^_+|_+$/g, '');
+    if (!normalized) {
+        return 'sg';
+    }
+    if (/^\d/.test(normalized)) {
+        return `sg_${normalized}`;
+    }
+    return normalized;
+}
+function splitLiteral(value) {
+    if (value.includes('_')) {
+        const separator = value.indexOf('_');
+        const head = value.slice(0, separator);
+        const tail = value.slice(separator + 1);
+        return [head.slice(0, 3), head.slice(3), `_${tail}`].filter((part) => part.length > 0);
+    }
+    if (value.length > 8) {
+        return [value.slice(0, 4), value.slice(4, 8), value.slice(8)].filter((part) => part.length > 0);
+    }
+    if (value.length > 4) {
+        return [value.slice(0, 4), value.slice(4)].filter((part) => part.length > 0);
+    }
+    return [value];
+}
+export function fragmentLiteral(value, enabled) {
+    if (!enabled) {
+        return jsonStringLiteral(value);
+    }
+    const quoted = splitLiteral(value).map((part) => jsonStringLiteral(part).replaceAll('"', "'")).join(', ');
+    return `[${quoted}].join('')`;
+}
+function formatComment(template, environmentName) {
+    return template
+        .replaceAll('{{', '\u0000OPEN_BRACE\u0000')
+        .replaceAll('}}', '\u0000CLOSE_BRACE\u0000')
+        .replaceAll('{environment_name}', environmentName)
+        .replaceAll('\u0000OPEN_BRACE\u0000', '{')
+        .replaceAll('\u0000CLOSE_BRACE\u0000', '}');
+}
+function buildTransformedSource(renderedSource, config, secretKey, secretValue) {
+    let source = renderedSource;
+    if (config.enable_identifier_randomization) {
+        const prefix = stableIdentifierPrefix(config.variable_prefix);
+        const replacements = {
+            secretToken: `${prefix}_secret_token`,
+            responsePayload: `${prefix}_response_payload`,
+            randomBytes: `${prefix}_random_bytes`,
+            error: `${prefix}_error`
+        };
+        for (const [oldName, newName] of Object.entries(replacements)) {
+            source = source.replace(new RegExp(`\\b${escapeRegExp(oldName)}\\b`, 'g'), newName);
+        }
+    }
+    source = source.replace(`searchParams.get("${secretKey}")`, `searchParams.get(${fragmentLiteral(secretKey, config.enable_keyword_fragmentation)})`);
+    source = source.replace(`=== "${secretValue}"`, `=== ${fragmentLiteral(secretValue, config.enable_keyword_fragmentation)}`);
+    return `// ${formatComment(config.comment_template, config.environment_name)}\n${source}`;
+}
+function extractMainData(renderedSource) {
+    const match = renderedSource.match(/const (?:MainData|SUBSCRIPTION_PAYLOAD) = `(?<payload>[\s\S]*?)`;/);
+    return match?.groups?.payload ?? '';
+}
+export function buildWorkerArtifacts(renderedSource, configInput = {}, secretQuery) {
+    const config = resolveWorkerBuildConfig(configInput);
+    const separator = secretQuery.indexOf('=');
+    if (separator === -1) {
+        throw new Error('secret_query must contain a key=value pair');
+    }
+    const secretKey = secretQuery.slice(0, separator);
+    const secretValue = secretQuery.slice(separator + 1);
+    const transformedSource = buildTransformedSource(renderedSource, config, secretKey, secretValue);
+    const modulesSubdir = config.modules_subdir.replace(/^\/+|\/+$/g, '') || 'modules';
+    const modules = {
+        [`${modulesSubdir}/runtime.js`]: `export const workerSource = ${jsonStringLiteral(transformedSource)};\n`,
+        [`${modulesSubdir}/guard.js`]: (`export const secretParam = ${fragmentLiteral(secretKey, config.enable_keyword_fragmentation)};\n` +
+            `export const secretValue = ${fragmentLiteral(secretValue, config.enable_keyword_fragmentation)};\n`),
+        [`${modulesSubdir}/noise.js`]: `export const noiseLengthRange = [${config.random_noise_min_length}, ${config.random_noise_max_length}];\n`,
+        [`${modulesSubdir}/payload.js`]: `export const mainData = ${jsonStringLiteral(extractMainData(renderedSource))};\n`
+    };
+    return {
+        transformed_source: transformedSource,
+        modules,
+        manifest: {
+            environment_name: config.environment_name,
+            entry_filename: config.entry_filename,
+            modules: Object.keys(modules).sort(),
+            variable_prefix: config.variable_prefix,
+            enable_keyword_fragmentation: config.enable_keyword_fragmentation,
+            enable_identifier_randomization: config.enable_identifier_randomization
+        }
+    };
+}
+export function selectPipelineStageBackend(stage, env = process.env) {
+    const stageKey = `AUTOVPN_STAGE_BACKEND_${stage.toUpperCase()}`;
+    const stageOverride = String(env[stageKey] ?? '').trim().toLowerCase();
+    const pipelineOverride = String(env.AUTOVPN_PIPELINE_BACKEND ?? '').trim().toLowerCase();
+    const selected = stageOverride || pipelineOverride || 'node';
+    return selected === 'python' ? 'python' : 'node';
+}
+async function defaultResolvePythonCli(env) {
+    // @ts-expect-error Phase 1 runner remains plain ESM JavaScript.
+    const runner = await import('../../lib/runner.mjs');
+    return runner.resolveOrInstallPythonCli({ env });
+}
+function pythonCommandFor(resolved) {
+    const command = resolved.command;
+    const name = path.basename(command).toLowerCase();
+    if (['autovpn', 'autovpn.exe'].includes(name)) {
+        const executable = process.platform === 'win32' ? 'python.exe' : 'python';
+        return path.join(path.dirname(command), executable);
+    }
+    return process.platform === 'win32' ? 'python.exe' : 'python3';
+}
+async function obfuscateWithPython(input, options) {
+    const env = mergeProjectEnv(options.cwd ?? process.cwd(), options.env ?? process.env);
+    const resolved = options.resolvePythonCli ? await options.resolvePythonCli() : await defaultResolvePythonCli(env);
+    const child = (options.spawn ?? defaultSpawn)(pythonCommandFor(resolved), ['-c', PYTHON_OBFUSCATE_HELPER], {
+        cwd: options.cwd ?? process.cwd(),
+        env,
+        stdio: ['pipe', 'pipe', 'pipe']
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => {
+        stdout += String(chunk);
+    });
+    child.stderr?.on('data', (chunk) => {
+        stderr += String(chunk);
+    });
+    const completion = new Promise((resolve, reject) => {
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code !== 0) {
+                reject(new Error(`Python obfuscate backend failed with exit code ${code}: ${stderr.trim()}`));
+                return;
+            }
+            try {
+                resolve(JSON.parse(stdout));
+            }
+            catch (error) {
+                reject(new Error(`Python obfuscate backend returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`));
+            }
+        });
+    });
+    child.stdin?.write(JSON.stringify(input));
+    child.stdin?.end();
+    return completion;
+}
+export async function buildWorkerArtifactsWithBackend(input, options = {}) {
+    if (selectPipelineStageBackend('obfuscate', options.env ?? process.env) === 'python') {
+        return options.pythonObfuscate ? options.pythonObfuscate(input) : obfuscateWithPython(input, options);
+    }
+    return buildWorkerArtifacts(input.rendered_source, input.config, input.secret_query);
+}