@swimmingliu/autovpn 2.0.3 → 2.1.0

package/dist/pipeline/http-transport.js

@@ -0,0 +1,232 @@
+import net from 'node:net';
+import tls from 'node:tls';
+/**
+ * Shared helpers for the hand-rolled HTTP transports in the pipeline.
+ *
+ * These transports talk to a local mihomo mixed port with raw sockets so the
+ * per-node measurement path never goes through the crawl proxy (see
+ * speedtest.ts / availability.ts). Everything here is deliberately small and
+ * side-effect free so it can be unit-tested without a live proxy.
+ */
+/** Head sections larger than this are treated as a non-HTTP response. */
+export const HTTP_HEAD_LIMIT_BYTES = 64 * 1024;
+/** Line-oriented rendering of an HTTP response head, safe to put in an Error. */
+export function httpStatusLine(head) {
+    const text = typeof head === 'string' ? head : head.toString('latin1');
+    const line = text.split('\r\n')[0] ?? '';
+    return line.length > 160 ? `${line.slice(0, 160)}...` : line;
+}
+/**
+ * Parse the status code out of an HTTP response head.
+ *
+ * Returns null instead of throwing: callers invoke this from socket 'data'
+ * listeners, where a throw would be an uncaught exception that takes down the
+ * whole process. A captive portal / block page body simply yields null and the
+ * caller fails that one link.
+ */
+export function safeParseHttpStatus(head) {
+    const match = /^HTTP\/\d(?:\.\d)?\s+(\d+)(?:\s|$)/i.exec(httpStatusLine(head));
+    if (!match) {
+        return null;
+    }
+    const status = Number(match[1]);
+    return Number.isInteger(status) ? status : null;
+}
+/** Split a buffered HTTP response into its head and any already-received body bytes. */
+export function splitHttpResponseHead(buffer) {
+    const marker = buffer.indexOf('\r\n\r\n');
+    if (marker < 0) {
+        return undefined;
+    }
+    return {
+        head: buffer.subarray(0, marker),
+        body: buffer.subarray(marker + 4)
+    };
+}
+function decodeUserInfo(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+/**
+ * Normalize a proxy URL for the raw-socket transports.
+ *
+ * The old call sites used `proxy.port || 80` regardless of scheme and dropped
+ * userinfo entirely. Default the port from the scheme, forward Basic
+ * credentials, and reject schemes this transport cannot speak.
+ */
+export function parseProxyEndpoint(proxyUrl) {
+    let proxy;
+    try {
+        if (proxyUrl instanceof URL) {
+            proxy = proxyUrl;
+        }
+        else {
+            const raw = String(proxyUrl);
+            proxy = new URL(raw.includes('://') ? raw : `http://${raw}`);
+        }
+    }
+    catch (error) {
+        throw new Error(`invalid proxy URL: ${String(proxyUrl)}`, { cause: error });
+    }
+    const protocol = proxy.protocol.toLowerCase();
+    if (protocol !== 'http:' && protocol !== 'https:') {
+        throw new Error(`unsupported proxy protocol: ${proxy.protocol}`);
+    }
+    const port = Number(proxy.port || (protocol === 'https:' ? 443 : 80));
+    const user = decodeUserInfo(proxy.username);
+    const secret = decodeUserInfo(proxy.password);
+    const authorization = user || secret
+        ? `Basic ${Buffer.from(`${user}:${secret}`, 'utf8').toString('base64')}`
+        : '';
+    return { protocol, hostname: proxy.hostname, port, authorization };
+}
+function connectSocket(host, port, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const socket = net.createConnection({ host, port });
+        let settled = false;
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket.destroy();
+            reject(error);
+        };
+        const timer = setTimeout(() => {
+            fail(new Error(`proxy connection timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        socket.once('connect', () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket.off('error', fail);
+            // Keep a permanent sink: the caller attaches its request-scoped listener
+            // a moment later, and an error in that gap must not be uncaught.
+            socket.on('error', () => { });
+            resolve(socket);
+        });
+        socket.once('error', fail);
+    });
+}
+function secureProxySocket(socket, hostname, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const secureSocket = tls.connect({
+            socket,
+            servername: net.isIP(hostname) ? undefined : hostname
+        });
+        let settled = false;
+        const cleanup = () => {
+            secureSocket.off('secureConnect', onSecureConnect);
+            secureSocket.off('error', onError);
+        };
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            cleanup();
+            secureSocket.destroy();
+            socket.destroy();
+            reject(error);
+        };
+        const onSecureConnect = () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            cleanup();
+            resolve(secureSocket);
+        };
+        const onError = (error) => {
+            fail(error);
+        };
+        const timer = setTimeout(() => {
+            fail(new Error(`proxy TLS handshake timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        secureSocket.once('secureConnect', onSecureConnect);
+        secureSocket.once('error', onError);
+    });
+}
+/**
+ * Open the transport socket to the proxy, performing TLS first for https:// proxies.
+ * The returned socket is owned by the caller and must be destroyed on every
+ * terminal branch of the request it serves.
+ */
+export async function connectProxySocket(endpoint, timeoutMs) {
+    const socket = await connectSocket(endpoint.hostname, endpoint.port, timeoutMs);
+    if (endpoint.protocol === 'http:') {
+        return socket;
+    }
+    try {
+        return await secureProxySocket(socket, endpoint.hostname, timeoutMs);
+    }
+    catch (error) {
+        socket.destroy();
+        throw error;
+    }
+}
+/**
+ * Bounded byte ring used to retain a short diagnostic tail from a child
+ * process. Reading the pipe is mandatory (an unread 64 KB pipe stalls the
+ * child), but retaining all of it would grow without bound on a chatty runtime.
+ */
+export function createBoundedLogRing(maxBytes = 8192) {
+    const limit = Math.max(1, Math.trunc(maxBytes));
+    let parts = [];
+    let total = 0;
+    const trimFront = (excess) => {
+        while (excess > 0 && parts.length > 0) {
+            const first = parts[0];
+            if (first.byteLength <= excess) {
+                parts.shift();
+                total -= first.byteLength;
+                excess -= first.byteLength;
+            }
+            else {
+                parts[0] = first.subarray(excess);
+                total -= excess;
+                excess = 0;
+            }
+        }
+    };
+    const compact = () => {
+        if (parts.length > 64) {
+            const merged = Buffer.concat(parts, total);
+            parts = [merged];
+        }
+    };
+    return {
+        append(chunk) {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk), 'utf8');
+            if (buffer.byteLength === 0) {
+                return;
+            }
+            if (buffer.byteLength >= limit) {
+                parts = [buffer.subarray(buffer.byteLength - limit)];
+                total = limit;
+                return;
+            }
+            parts.push(buffer);
+            total += buffer.byteLength;
+            if (total > limit) {
+                trimFront(total - limit);
+            }
+            compact();
+        },
+        text() {
+            return Buffer.concat(parts, total).toString('utf8');
+        },
+        bytes() {
+            return total;
+        },
+        clear() {
+            parts = [];
+            total = 0;
+        }
+    };
+}

package/dist/pipeline/orchestrator.js

@@ -2,7 +2,7 @@ import { copyFile, mkdir, readFile, writeFile } from 'node:fs/promises';
 import fs from 'node:fs';
 import path from 'node:path';
 import { parse } from '@iarna/toml';
-import { normalizeOfficialSources } from '../config/profile.js';
+import { normalizeOfficialSources, networkEnv } from '../config/profile.js';
 import { mergeProjectEnv } from '../runtime/env.js';
 import { resolveArtifactsRoot, resolveProfilePath, resolveUserRuntimeRoot } from '../runtime/paths.js';
 import { redactText } from '../runtime/redaction.js';
@@ -167,8 +167,30 @@ function errorMessage(error) {
     }
     return redactText(String(error));
 }
-function defaultRuntimeStageEnv(env) {
-    return { ...env };
+function defaultRuntimeStageEnv(env, projectRoot) {
+    const merged = { ...env };
+    if (!projectRoot)
+        return merged;
+    // The profile's [network] section is the GUI's egress setting. Apply it as a
+    // default only: an operator who exported VPN_AUTOMATION_PROXY_MODE (or the
+    // legacy boolean) on the command line keeps that choice.
+    if (merged.VPN_AUTOMATION_PROXY_MODE !== undefined || merged.VPN_AUTOMATION_USE_UPSTREAM_PROXY !== undefined) {
+        return merged;
+    }
+    try {
+        const profilePath = resolveProfilePath(projectRoot, env);
+        if (fs.existsSync(profilePath)) {
+            const raw = asProfile(parse(fs.readFileSync(profilePath, 'utf8')));
+            const defaults = networkEnv(raw.network);
+            merged.VPN_AUTOMATION_PROXY_MODE = defaults.VPN_AUTOMATION_PROXY_MODE;
+            merged.VPN_AUTOMATION_UPSTREAM_PROXY = defaults.VPN_AUTOMATION_UPSTREAM_PROXY;
+        }
+    }
+    catch {
+        // A missing or malformed profile must not fail env construction; the
+        // pipeline's own resolver falls back to the proxy default.
+    }
+    return merged;
 }
 function createCountryLookup(context) {
     if (context.stages?.countryLookup)
@@ -406,7 +428,7 @@ async function writeWorkerArtifacts(artifactDir, profile, renderedSource, artifa
 export async function runNodePipeline(options, context = {}) {
     const projectRoot = path.resolve(options.projectRoot);
     const env = mergeProjectEnv(projectRoot, { ...process.env, ...(context.env ?? {}) });
-    const runtimeStageEnv = defaultRuntimeStageEnv(env);
+    const runtimeStageEnv = defaultRuntimeStageEnv(env, projectRoot);
     const artifactDir = await uniqueArtifactDir(resolveArtifactsRoot(projectRoot, env), formatTimestamp((context.now ?? (() => new Date()))()));
     const runStore = RunStore.open(path.join(artifactDir, 'run.db'));
     try {
@@ -640,8 +662,12 @@ export async function runNodePipeline(options, context = {}) {
                 if (sourceFailed) {
                     emit('log', { message: `[extract] ${result.source_name} produced no links: ${sourceErrors.join('; ')}` });
                 }
+                // Report rounds actually run, not the cap: an early-stopped 1000-round
+                // source must not read as 1000/1000. `rounds` is the per-platform figure,
+                // which shares the cap's units; fall back to the cap for adapters that
+                // do not report it.
                 runStore.recordSourceProgress(sourceName, {
-                    processed: result.requested_iterations,
+                    processed: Math.max(0, Math.min(result.rounds ?? result.requested_iterations, result.requested_iterations)),
                     total: result.requested_iterations,
                     status: sourceFailed ? 'failed' : 'success',
                     ...(sourceFailed ? { error: sourceErrors.join('; ') } : {})
@@ -877,7 +903,7 @@ export async function retryNodePipelineStage(options, context = {}) {
     }
     const stage = normalizeRetryStage(options.stage);
     const env = mergeProjectEnv(projectRoot, { ...process.env, ...(context.env ?? {}) });
-    const runtimeStageEnv = defaultRuntimeStageEnv(env);
+    const runtimeStageEnv = defaultRuntimeStageEnv(env, projectRoot);
     const profile = await readProfile(projectRoot, env);
     const retryArtifactDir = await uniqueArtifactDir(resolveArtifactsRoot(projectRoot, env), formatTimestamp((context.now ?? (() => new Date()))()));
     const retryContext = {
@@ -1303,7 +1329,7 @@ export async function resumeNodePipeline(options, context = {}) {
     const eventLog = options.eventLog ?? String(sessionPayload.event_log ?? path.join(sessionDir, 'events.jsonl'));
     const humanLog = options.humanLog ?? String(sessionPayload.human_log ?? path.join(sessionDir, 'human.log'));
     const env = mergeProjectEnv(projectRoot, { ...process.env, ...(context.env ?? {}) });
-    const runtimeStageEnv = defaultRuntimeStageEnv(env);
+    const runtimeStageEnv = defaultRuntimeStageEnv(env, projectRoot);
     const profile = await readProfile(projectRoot, env);
     const report = await readJson(path.join(artifactDir, 'pipeline_report.json'), {});
     const summary = pipelineSummaryFromReport(artifactDir, report);
@@ -1452,7 +1478,7 @@ export async function resumeNodePipeline(options, context = {}) {
                                 emit('log', { message: `[extract] ${result.source_name} produced no links: ${resumeErrors.join('; ')}` });
                             }
                             runStore.recordSourceProgress(sourceName, {
-                                processed: result.requested_iterations,
+                                processed: Math.max(0, Math.min(result.rounds ?? result.requested_iterations, result.requested_iterations)),
                                 total: result.requested_iterations,
                                 status: resumeFailed ? 'failed' : 'success',
                                 ...(resumeFailed ? { error: resumeErrors.join('; ') } : {})

package/dist/pipeline/proxy-runtime.js

@@ -3,6 +3,7 @@ import { mkdtemp, rm, stat, writeFile } from 'node:fs/promises';
 import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
+import { createBoundedLogRing } from './http-transport.js';
 export const PROXY_ENV_KEYS = [
     'HTTP_PROXY',
     'HTTPS_PROXY',
@@ -14,6 +15,7 @@ export const PROXY_ENV_KEYS = [
     'no_proxy'
 ];
 const MIHOMO_DELAY_TIMEOUT_MAX_MS = 30_000;
+const MIHOMO_LOG_RING_BYTES = 8 * 1024;
 const reservedAutomaticPorts = new Set();
 function padBase64(encoded) {
     return encoded + '='.repeat((4 - (encoded.length % 4)) % 4);
@@ -307,6 +309,14 @@ export async function openMihomoRuntime(link, options = {}) {
     let tempDir = '';
     let configPath = '';
     let child;
+    // stdout/stderr must be drained: an unread 64 KB pipe buffer blocks the child
+    // and the controller would never answer. Keep only a bounded tail.
+    const logRing = createBoundedLogRing(MIHOMO_LOG_RING_BYTES);
+    const recentLog = () => logRing.text();
+    const logTailSuffix = () => {
+        const tail = recentLog().trim();
+        return tail ? ` (runtime output: ${tail})` : '';
+    };
     try {
         const config = buildMihomoRuntimeConfig(payload, { mixedPort, controllerPort });
         tempDir = await mkdtemp(path.join(os.tmpdir(), 'autovpn-mihomo-'));
@@ -317,6 +327,19 @@ export async function openMihomoRuntime(link, options = {}) {
             stdio: ['ignore', 'pipe', 'pipe'],
             env: stripProxyEnv(options.env ?? process.env)
         });
+        const appendChunk = (chunk) => {
+            if (Buffer.isBuffer(chunk)) {
+                logRing.append(chunk);
+            }
+            else if (typeof chunk === 'string') {
+                logRing.append(chunk);
+            }
+        };
+        child.stdout?.on('data', appendChunk);
+        child.stderr?.on('data', appendChunk);
+        // A closed pipe (child already gone) must never surface as an uncaught error.
+        child.stdout?.on('error', () => { });
+        child.stderr?.on('error', () => { });
     }
     catch (error) {
         try {
@@ -334,6 +357,10 @@ export async function openMihomoRuntime(link, options = {}) {
         rejectStartupError = reject;
     });
     const onStartupError = (error) => {
+        const tail = logTailSuffix();
+        if (tail && !error.message.includes('runtime output:')) {
+            error.message = `${error.message}${tail}`;
+        }
         rejectStartupError?.(error);
     };
     child.once('error', onStartupError);
@@ -342,7 +369,7 @@ export async function openMihomoRuntime(link, options = {}) {
         rejectStartupExit = reject;
     });
     const onStartupExit = (code, signal) => {
-        const error = new Error(`mihomo exited during startup with code ${code ?? 'unknown'}${signal ? ` signal ${signal}` : ''}`);
+        const error = new Error(`mihomo exited during startup with code ${code ?? 'unknown'}${signal ? ` signal ${signal}` : ''}${logTailSuffix()}`);
         error.code = 'AUTOVPN_INTERNAL_TIMEOUT';
         rejectStartupExit?.(error);
     };
@@ -375,10 +402,15 @@ export async function openMihomoRuntime(link, options = {}) {
         child.off('error', onStartupError);
         child.off('exit', onStartupExit);
         child.on('error', () => { });
+        // Attach the runtime's own output so a silent controller is diagnosable.
+        const tail = logTailSuffix();
+        if (tail && error instanceof Error && !error.message.includes('runtime output:')) {
+            error.message = `${error.message}${tail}`;
+        }
         await close();
         if (error instanceof Error
             && error.name !== 'AbortError'
-            && /^proxy port \d+ did not open in time$/.test(error.message)) {
+            && /^proxy port \d+ did not open in time/.test(error.message)) {
             error.code = 'AUTOVPN_INTERNAL_TIMEOUT';
         }
         throw error;
@@ -392,6 +424,7 @@ export async function openMihomoRuntime(link, options = {}) {
         configPath,
         controllerUrl,
         proxyName,
+        recentLog,
         close
     };
 }