@swimmingliu/autovpn 1.6.4 → 1.6.6

package/README.md

@@ -72,7 +72,7 @@ Current Node backend notes:
 - Add `--skip-deploy --skip-verify` when you want an offline Node pipeline check.
 - Plain Node foreground deploy/verify runs use Node for Wrangler deploy, primary blocked-project fallback, share-project sync/fallback, custom-domain binding, custom-domain DNS upsert, and verify.
 - Deploy and verify can be rolled back with `AUTOVPN_STAGE_BACKEND_DEPLOY=python` and `AUTOVPN_STAGE_BACKEND_VERIFY=python`.
-- `AUTOVPN_NO_PYTHON=1` disables implicit Python backend resolution and default Python runtime stage fallback. Use it as a v3 readiness gate. Empty offline runs now complete in Node, and Node has direct HTTP speedtest and availability runtimes. Node also has opt-in Mihomo-backed paths: set `AUTOVPN_SPEEDTEST_RUNTIME=mihomo` for controller delay probing and candidate downloads through the local Mihomo proxy, and set `AUTOVPN_AVAILABILITY_RUNTIME=mihomo` to check provider availability through the same per-node proxy runtime.
+- `AUTOVPN_NO_PYTHON=1` disables implicit Python backend resolution and default Python runtime stage fallback. Use it as a v3 readiness gate. Empty offline runs now complete in Node. Speedtest and availability use the per-node Mihomo runtime by default so candidate measurements and provider checks traverse each candidate node. Set `AUTOVPN_SPEEDTEST_RUNTIME=direct` or `AUTOVPN_AVAILABILITY_RUNTIME=direct` only for direct-host diagnostic checks.
 - Project `.env` is loaded before resolving profile and artifact paths. Explicit process environment values still win over `.env`.
 - `autovpn serve` is Node-native and exposes the browser UI plus `/api/health`,
   `/api/state`, `/api/runs`, `/api/runs/current/stop`, and `/api/events`.

package/dist/doctor/checks.js

@@ -5,6 +5,7 @@ import { spawnSync } from 'node:child_process';
 import { parse } from '@iarna/toml';
 import { profileSummary } from '../config/profile.js';
 import { resolveArtifactsRoot, resolveProfilePath } from '../runtime/paths.js';
+import { resolveShareWorkerTemplatePath, resolveWorkerTemplatePath } from '../runtime/templates.js';
 import { normalizeManagedToolCommandForSpawn, resolveManagedNpmTool } from '../runtime/managed-tools.js';
 const JAVASCRIPT_OBFUSCATOR_VERSION = '5.4.3';
 const WRANGLER_VERSION = '4.106.0';
@@ -201,13 +202,27 @@ export async function runDoctor(projectRoot, argv, env = process.env, options =
     const configuredSources = sourceValues.filter((source) => source.enabled && source.url === 'set' && source.key === 'set');
     const nodeToolChecks = await checkNodeTools(projectRoot, env, options);
     const cloudflareChecks = await checkCloudflare(summary, deploy, env, projectRoot, options);
+    let workerTemplatePath = '';
+    let shareWorkerTemplatePath = '';
+    try {
+        workerTemplatePath = resolveWorkerTemplatePath(projectRoot);
+    }
+    catch {
+        workerTemplatePath = '';
+    }
+    try {
+        shareWorkerTemplatePath = resolveShareWorkerTemplatePath(projectRoot, env);
+    }
+    catch {
+        shareWorkerTemplatePath = '';
+    }
     const checks = [
         check('node_version', 'pass', `Node ${process.versions.node}`, { required: '>=20' }),
         check('project_root', 'pass', 'Project root resolved', { path: projectRoot }),
         check('profile_path', pathWritable(profilePath) ? 'pass' : 'fail', pathWritable(profilePath) ? 'Profile is readable and writable' : 'Profile path is not writable', { profile_path: profilePath, exists: fs.existsSync(profilePath) }),
         check('artifacts_root', pathWritable(artifactsRoot) ? 'pass' : 'fail', pathWritable(artifactsRoot) ? 'Artifacts root is writable' : 'Artifacts root is not writable', { path: artifactsRoot }),
-        check('worker_template', fs.existsSync(path.join(projectRoot, 'templates', 'vmess_node.js')) ? 'pass' : 'fail', fs.existsSync(path.join(projectRoot, 'templates', 'vmess_node.js')) ? 'Worker template exists' : 'Worker template is missing', { path: path.join(projectRoot, 'templates', 'vmess_node.js') }),
-        check('share_worker_template', fs.existsSync(path.join(projectRoot, 'templates', 'share-worker', 'vpn.js')) ? 'pass' : 'warn', fs.existsSync(path.join(projectRoot, 'templates', 'share-worker', 'vpn.js')) ? 'Share worker template exists' : 'Share worker template is missing', { path: path.join(projectRoot, 'templates', 'share-worker', 'vpn.js') }),
+        check('worker_template', workerTemplatePath ? 'pass' : 'fail', workerTemplatePath ? 'Worker template exists' : 'Worker template is missing', { path: workerTemplatePath || path.join(projectRoot, 'templates', 'vmess_node.js') }),
+        check('share_worker_template', shareWorkerTemplatePath ? 'pass' : 'warn', shareWorkerTemplatePath ? 'Share worker template exists' : 'Share worker template is missing', { path: shareWorkerTemplatePath || path.join(projectRoot, 'templates', 'share-worker', 'vpn.js') }),
         configuredSources.length
             ? check('sources', 'pass', 'At least one enabled source is configured', { configured_count: configuredSources.length })
             : check('sources', 'warn', 'No enabled source has both URL and key configured', { configured_count: 0, key_state: 'missing' }),

package/dist/pipeline/availability.js

@@ -17,6 +17,9 @@ const CHALLENGE_PHRASES = [
     'verify you are human',
     'enable javascript and cookies'
 ];
+const GEMINI_REGION_MARKERS = [',2,1,200,"', ',2,1,200,\\"'];
+const CLAUDE_BLOCKED_CODES = new Set(['AF', 'BY', 'CN', 'CU', 'HK', 'IR', 'KP', 'MO', 'RU', 'SY']);
+const GEMINI_BLOCKED_CODES = new Set(['CHN', 'RUS', 'BLR', 'CUB', 'IRN', 'PRK', 'SYR', 'HKG', 'MAC']);
 const PYTHON_AVAILABILITY_HELPER = `
 import json
 import sys
@@ -75,6 +78,30 @@ function hostnameFor(url) {
         return '';
     }
 }
+function targetKey(target) {
+    return target.name.trim().toLowerCase().replaceAll('-', '_').replaceAll(' ', '_');
+}
+function extractTraceLocation(body) {
+    for (const line of body.split(/\r?\n/)) {
+        if (line.startsWith('loc=')) {
+            return line.slice(4).trim().toUpperCase();
+        }
+    }
+    return '';
+}
+function extractGeminiCountryCode(body) {
+    for (const marker of GEMINI_REGION_MARKERS) {
+        const index = body.indexOf(marker);
+        if (index < 0) {
+            continue;
+        }
+        const code = body.slice(index + marker.length, index + marker.length + 3);
+        if (/^[A-Z]{3}$/.test(code)) {
+            return code;
+        }
+    }
+    return '';
+}
 export function normalizeProviderTargets(targets) {
     if (targets == null) {
         return PROVIDER_TARGETS.map((target) => ({ ...target, allowed_hosts: [...target.allowed_hosts], negative_phrases: [...target.negative_phrases] }));
@@ -126,6 +153,83 @@ export function evaluateProviderResponse(target, response) {
             matched_phrase: ''
         };
     }
+    const key = targetKey(target);
+    if (key === 'chatgpt_ios') {
+        const body = response.body.toLowerCase();
+        if (body.includes('you may be connected to a disallowed isp')) {
+            return {
+                provider: target.name,
+                passed: false,
+                reason: 'disallowed_isp',
+                status_code: statusCode,
+                final_url: finalUrl,
+                matched_phrase: ''
+            };
+        }
+        if (body.includes('request is not allowed. please try again later.')) {
+            return {
+                provider: target.name,
+                passed: true,
+                reason: 'ok',
+                status_code: statusCode,
+                final_url: finalUrl,
+                matched_phrase: ''
+            };
+        }
+        if (body.includes('sorry, you have been blocked')) {
+            return {
+                provider: target.name,
+                passed: false,
+                reason: 'blocked',
+                status_code: statusCode,
+                final_url: finalUrl,
+                matched_phrase: ''
+            };
+        }
+        return {
+            provider: target.name,
+            passed: false,
+            reason: 'unlock_failed',
+            status_code: statusCode,
+            final_url: finalUrl,
+            matched_phrase: ''
+        };
+    }
+    if (key === 'chatgpt' || key === 'chatgpt_web') {
+        const unsupported = response.body.toLowerCase().includes('unsupported_country');
+        return {
+            provider: target.name,
+            passed: !unsupported,
+            reason: unsupported ? 'unsupported_region' : 'ok',
+            status_code: statusCode,
+            final_url: finalUrl,
+            matched_phrase: unsupported ? 'unsupported_country' : ''
+        };
+    }
+    if (key === 'claude') {
+        const countryCode = extractTraceLocation(response.body);
+        const blocked = CLAUDE_BLOCKED_CODES.has(countryCode);
+        return {
+            provider: target.name,
+            passed: Boolean(countryCode) && !blocked,
+            reason: !countryCode ? 'unlock_failed' : blocked ? 'unsupported_region' : 'ok',
+            status_code: statusCode,
+            final_url: finalUrl,
+            matched_phrase: countryCode
+        };
+    }
+    if (key === 'gemini') {
+        const countryCode = extractGeminiCountryCode(response.body);
+        const blocked = GEMINI_BLOCKED_CODES.has(countryCode);
+        return {
+            provider: target.name,
+            passed: Boolean(countryCode) && !blocked,
+            reason: !countryCode ? 'unlock_failed' : blocked ? 'unsupported_region' : 'ok',
+            status_code: statusCode,
+            final_url: finalUrl,
+            matched_phrase: countryCode
+        };
+    }
     if (statusCode >= 400) {
         return {
             provider: target.name,
@@ -594,7 +698,8 @@ async function checkBatchInNode(input, options) {
         return [];
     }
     const targets = normalizeProviderTargets(input.targets);
-    const useMihomoRuntime = String((options.env ?? process.env).AUTOVPN_AVAILABILITY_RUNTIME ?? '').trim().toLowerCase() === 'mihomo';
+    const requestedRuntime = String((options.env ?? process.env).AUTOVPN_AVAILABILITY_RUNTIME ?? '').trim().toLowerCase();
+    const useMihomoRuntime = requestedRuntime !== 'direct';
     const checkLinkAvailability = options.checkLinkAvailability ?? ((speedResult, config) => (useMihomoRuntime
         ? checkLinkAvailabilityMihomo(speedResult, config, {
             ...options,

package/dist/pipeline/deploy.js

@@ -1,7 +1,8 @@
 import path from 'node:path';
 import { spawn as defaultSpawn } from 'node:child_process';
-import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { mergeProjectEnv } from '../runtime/env.js';
+import { resolveShareWorkerTemplatePath } from '../runtime/templates.js';
 import { normalizeManagedToolCommandForSpawn, resolveManagedNpmTool } from '../runtime/managed-tools.js';
 const PYTHON_DEPLOY_HELPER = `
 import json
@@ -47,6 +48,7 @@ json.dump(result, sys.stdout, ensure_ascii=False)
 sys.stdout.write("\\n")
 `;
 const PAGES_PRODUCTION_BRANCH = 'main';
+const CLOUDFLARE_API_MAX_ATTEMPTS = 3;
 const FALLBACK_SUFFIX_PATTERN = /^(?<prefix>.+)-(?<suffix>\d+)$/;
 const CLOUDFLARE_API_BASE_URL = 'https://api.cloudflare.com/client/v4';
 const NETWORK_ERROR_MARKERS = [
@@ -354,51 +356,11 @@ function buildShareProjectUpdatePayload(sourceProject, runtimeEnv, options) {
         deployment_configs: rewriteShareProjectSubValue(clonedConfigs, options)
     };
 }
-async function fileExists(candidate) {
-    try {
-        await access(candidate);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function expandHomePath(candidate) {
-    if (candidate === '~') {
-        return process.env.HOME || candidate;
-    }
-    if (candidate.startsWith('~/')) {
-        return process.env.HOME ? path.join(process.env.HOME, candidate.slice(2)) : candidate;
-    }
-    return candidate;
-}
-async function resolveShareProjectWorkerSourcePath(projectRoot, env) {
-    const candidates = [
-        clean(env.VPN_AUTOMATION_SHARE_WORKER_PATH),
-        path.join(projectRoot, 'electron', 'runtime', 'share-worker', 'vpn.js'),
-        path.join(projectRoot, 'templates', 'share-worker', 'vpn.js'),
-        path.join(path.dirname(projectRoot), 'cloudflarevpn', 'edgetunnel', 'vpn.js')
-    ].filter(Boolean).map((candidate) => path.resolve(expandHomePath(candidate)));
-    const seen = new Set();
-    const uniqueCandidates = candidates.filter((candidate) => {
-        if (seen.has(candidate)) {
-            return false;
-        }
-        seen.add(candidate);
-        return true;
-    });
-    for (const candidate of uniqueCandidates) {
-        if (await fileExists(candidate)) {
-            return candidate;
-        }
-    }
-    throw new Error(`share worker source not found; tried: ${uniqueCandidates.join(', ')}`);
-}
 function buildShareProjectBundleDir(projectRoot) {
     return path.join(projectRoot, 'electron', 'runtime', 'share-worker', 'share_pages_bundle');
 }
 async function stageShareProjectWorkerBundle(projectRoot, env) {
-    const sourcePath = await resolveShareProjectWorkerSourcePath(projectRoot, env);
+    const sourcePath = resolveShareWorkerTemplatePath(projectRoot, env);
     const bundleDir = buildShareProjectBundleDir(projectRoot);
     const workerEntry = path.join(bundleDir, '_worker.js');
     await mkdir(bundleDir, { recursive: true });
@@ -508,12 +470,30 @@ export class CloudflareHttpClient {
         this.headers = cloudflareHeaders(credentials);
         this.fetchImpl = options.fetch ?? fetch;
     }
+    async fetchWithTransientRetries(input, options, timeoutMs) {
+        for (let attempt = 1; attempt <= CLOUDFLARE_API_MAX_ATTEMPTS; attempt += 1) {
+            try {
+                return await this.fetchImpl(input, {
+                    ...options,
+                    signal: options.signal ?? AbortSignal.timeout(timeoutMs)
+                });
+            }
+            catch (error) {
+                const transientFailure = error instanceof TypeError
+                    || (error instanceof Error && error.name === 'TimeoutError');
+                const retryable = transientFailure && !options.signal?.aborted;
+                if (!retryable || attempt === CLOUDFLARE_API_MAX_ATTEMPTS) {
+                    throw error;
+                }
+            }
+        }
+        throw new Error('Cloudflare request failed');
+    }
     async apiRequest(pathname, options = {}) {
-        const response = await this.fetchImpl(`${CLOUDFLARE_API_BASE_URL}${pathname}`, {
+        const response = await this.fetchWithTransientRetries(`${CLOUDFLARE_API_BASE_URL}${pathname}`, {
             ...options,
-            headers: { ...this.headers, ...options.headers },
-            signal: options.signal ?? AbortSignal.timeout(20_000)
-        });
+            headers: { ...this.headers, ...options.headers }
+        }, 20_000);
         if (!response.ok) {
             const body = await responseBodyText(response);
             throw new Error(`Cloudflare API request failed (${response.status}): ${body || response.statusText}`);
@@ -665,10 +645,7 @@ export class CloudflareHttpClient {
         return this.apiRequest(`/accounts/${accountId}/pages/projects/${projectName}`, { method: 'DELETE' });
     }
     async verifyUrl(url, expectedFragment = '') {
-        const response = await this.fetchImpl(url, {
-            method: 'GET',
-            signal: AbortSignal.timeout(30_000)
-        });
+        const response = await this.fetchWithTransientRetries(url, { method: 'GET' }, 30_000);
         if (!response.ok) {
             const body = await responseBodyText(response);
             throw new Error(`URL verification failed (${response.status}): ${body || response.statusText}`);

package/dist/pipeline/orchestrator.js

@@ -5,6 +5,7 @@ import { parse } from '@iarna/toml';
 import { mergeProjectEnv } from '../runtime/env.js';
 import { resolveArtifactsRoot, resolveProfilePath } from '../runtime/paths.js';
 import { redactText } from '../runtime/redaction.js';
+import { resolveWorkerTemplatePath } from '../runtime/templates.js';
 import { fetchSourceLinksWithBackend } from './extract.js';
 import { canonicalVmessKey, dedupeVmessLinksWithBackend, parseVmessLink } from './dedupe.js';
 import { normalizeSpeedTestConfig, probeSpeedtestLinksInNode, selectSpeedtestCandidates, speedtestLinksWithBackend, testSpeedtestLinkInNode } from './speedtest.js';
@@ -650,7 +651,7 @@ export async function runNodePipeline(options, context = {}) {
         await writeLines(artifactDir, 'vpn_node_emoji.txt', postprocessed.links);
         await setStage('postprocess', 'success');
         await setStage('render', 'running');
-        const template = await readFile(path.join(projectRoot, 'templates', 'vmess_node.js'), 'utf8');
+        const template = await readFile(resolveWorkerTemplatePath(projectRoot), 'utf8');
         const rendered = await renderMainDataWithBackend({ template, links: postprocessed.links }, { cwd: projectRoot, env });
         await setStage('render', 'success');
         await setStage('obfuscate', 'running');
@@ -819,6 +820,8 @@ export async function retryNodePipelineStage(options, context = {}) {
                 await writeReport();
                 throw new Error('No links passed availability');
             }
+            const availableLinkSet = new Set(availableLinks);
+            availabilityResults = availabilityResults.filter((result) => availableLinkSet.has(result.link));
             await setStage('availability', 'success');
         }
         else if (isStageAtOrAfter(stage, 'postprocess')) {
@@ -861,7 +864,7 @@ export async function retryNodePipelineStage(options, context = {}) {
                 throw new Error('No postprocess output available to retry render');
             }
             await setStage('render', 'running');
-            const template = await readFile(path.join(projectRoot, 'templates', 'vmess_node.js'), 'utf8');
+            const template = await readFile(resolveWorkerTemplatePath(projectRoot), 'utf8');
             const rendered = await renderMainDataWithBackend({ template, links: finalLinks }, { cwd: projectRoot, env });
             await writeFile(path.join(retryArtifactDir, 'vmess_node.js'), rendered.rendered_source, 'utf8');
             await setStage('render', 'success');
@@ -1185,7 +1188,7 @@ export async function resumeNodePipeline(options, context = {}) {
         }
         await setStage('postprocess', 'success');
         await setStage('render', 'running');
-        const template = await readFile(path.join(projectRoot, 'templates', 'vmess_node.js'), 'utf8');
+        const template = await readFile(resolveWorkerTemplatePath(projectRoot), 'utf8');
         const rendered = await renderMainDataWithBackend({ template, links: postprocessed.links }, { cwd: projectRoot, env });
         await writeFile(path.join(artifactDir, 'vmess_node.js'), rendered.rendered_source, 'utf8');
         await setStage('render', 'success');

package/dist/runtime/templates.js

@@ -0,0 +1,37 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const packagedWorkerTemplatePath = fileURLToPath(new URL('../templates/vmess_node.js', import.meta.url));
+const packagedShareWorkerTemplatePath = fileURLToPath(new URL('../templates/share-worker/vpn.js', import.meta.url));
+function expandHomePath(candidate, env) {
+    if (candidate === '~') {
+        return env.HOME || candidate;
+    }
+    if (candidate.startsWith('~/')) {
+        return env.HOME ? path.join(env.HOME, candidate.slice(2)) : candidate;
+    }
+    return candidate;
+}
+function firstExistingPath(candidates, message) {
+    const uniqueCandidates = [...new Set(candidates.filter(Boolean).map((candidate) => path.resolve(candidate)))];
+    const resolved = uniqueCandidates.find((candidate) => fs.existsSync(candidate));
+    if (resolved) {
+        return resolved;
+    }
+    throw new Error(`${message}; checked: ${uniqueCandidates.join(', ')}`);
+}
+export function resolveWorkerTemplatePath(projectRoot) {
+    return firstExistingPath([
+        path.join(projectRoot, 'templates', 'vmess_node.js'),
+        packagedWorkerTemplatePath
+    ], 'Worker template is missing');
+}
+export function resolveShareWorkerTemplatePath(projectRoot, env = process.env) {
+    return firstExistingPath([
+        expandHomePath(String(env.VPN_AUTOMATION_SHARE_WORKER_PATH ?? '').trim(), env),
+        path.join(projectRoot, 'electron', 'runtime', 'share-worker', 'vpn.js'),
+        path.join(projectRoot, 'templates', 'share-worker', 'vpn.js'),
+        packagedShareWorkerTemplatePath,
+        path.join(path.dirname(projectRoot), 'cloudflarevpn', 'edgetunnel', 'vpn.js')
+    ], 'Share Worker template is missing');
+}