@swimmingliu/autovpn 2.1.2 → 2.2.1

package/dist/config/profile.js

@@ -57,7 +57,11 @@ const OFFICIAL_SOURCE_KEYS = new Set(['leiting', 'heidong', 'mifeng', 'xuanfeng'
 const OBSOLETE_SOURCE_FIELDS = [
     'url', 'key', 'account', 'password', 'platform',
     'use_random_area', 'area_min', 'area_max',
-    'resume_from_iteration', 'failure_limit'
+    'resume_from_iteration', 'failure_limit',
+    // Internal: the extractor sets this when `backend_brand` redirects the data
+    // plane. It is derived state, so a hand-edited profile must not persist it —
+    // it would outlive the redirect that produced it.
+    'brand_override'
 ];
 function positiveInteger(value, fallback) {
     const parsed = Number(value);
@@ -95,6 +99,18 @@ export function normalizeOfficialSources(sources) {
             areas_per_round: Math.min(64, positiveInteger(config.areas_per_round, 8)),
             area_concurrency: Math.min(16, positiveInteger(config.area_concurrency, 4))
         };
+        // Only a known vendor can serve as a data plane; an unknown name would
+        // silently fall back to the row's own brand and produce the very node
+        // shortage the field exists to fix.
+        if (config.backend_brand !== undefined) {
+            const backend = normalizeBrand(String(config.backend_brand).trim());
+            if (backend && backend !== brand) {
+                normalized.backend_brand = backend;
+            }
+            else {
+                delete normalized.backend_brand;
+            }
+        }
         if (!wasCredential) {
             // A legacy URL row's caps describe a different operation; start the
             // cursor flow at the documented scheduled-run default instead. A floor

package/dist/pipeline/credential-source.js

@@ -9,6 +9,23 @@ import { BRANDS, brandFromSite, brandSite, normalizeBrand } from '../pool/brands
 import { FingerprintStore, resolveFingerprintCacheDir } from './brand-cache.js';
 import { resolveUserRuntimeRoot } from '../runtime/paths.js';
 import { redactText } from '../runtime/redaction.js';
+/**
+ * How many pooled accounts one source may try before it reports failure.
+ *
+ * A redirected row leases from a foreign vendor's list, and only a minority of
+ * those accounts exist on the backend: measured against the deployed pool, 2 of
+ * 40 黑洞 accounts log in on the 雷霆 backend. Each rejected attempt retires that
+ * account and leases the next by least-recent use, so the width decides whether
+ * the run ever reaches a usable credential. A row without a redirect keeps the
+ * tighter default.
+ */
+export function credentialAccountAttempts(source, brand) {
+    const backend = normalizeBrand(String(source.backend_brand ?? '').trim());
+    const redirected = Boolean(backend && brand && backend !== brand);
+    const fallback = redirected ? 24 : 3;
+    const parsed = Math.trunc(Number(source.account_retry_limit ?? fallback));
+    return Number.isFinite(parsed) && parsed >= 1 ? parsed : fallback;
+}
 /**
  * Each brand concatenates `getCommParams()` in its own order with its own
  * literal block. The layout can be overridden from the profile, and is picked
@@ -28,7 +45,9 @@ export function resolveBrandLayout(source) {
             return { afterPackage: explicit.startsWith('&') ? explicit : `&${explicit}` };
         }
     }
-    const brand = String(source.brand ?? '').trim();
+    // A redirected data plane speaks the backend's parameter order, not the
+    // storefront's: the backend decides which flag block it recognises.
+    const brand = String(source.brand_override ?? source.brand ?? '').trim();
     if (brand.includes('旋风') || /xuanfeng/i.test(brand)) {
         return { vipFirst: true, viewport: true };
     }
@@ -47,7 +66,7 @@ export function resolveBrandLayout(source) {
  * downloader uses a Chinese product name, so both are mapped. The official
  * host is the last resort when a profile uses a custom source name.
  */
-const BRAND_APK_PREFIXES = {
+export const BRAND_APK_PREFIXES = {
     雷霆: 'lt',
     旋风: 'xf',
     黑洞: 'hd',
@@ -490,6 +509,16 @@ function declaredSizeTooLarge(response) {
     const length = Number(raw);
     return Number.isFinite(length) && length > MAX_APK_BYTES;
 }
+/**
+ * Test seam: `defaultLoadApk` with the brand name spelled out.
+ *
+ * The archive prefix is chosen from this name, and a redirected row must pass
+ * its backend's name rather than the row's. Exported so a test can prove which
+ * name reaches the loader without standing up a whole extraction.
+ */
+export async function loadApkWithBrand(source, fetchImpl, timeoutMs, now, log, brandName, egress) {
+    return defaultLoadApk(source, fetchImpl, timeoutMs, now, log, brandName, egress);
+}
 async function defaultLoadApk(source, fetchImpl, timeoutMs, now, log, brandName = '', egress) {
     if (source.apk_path) {
         try {
@@ -805,7 +834,9 @@ export async function fetchCredentialSourceLinks(input, options = {}) {
     }
 }
 async function fetchCredentialSourceLinksWithTransport(input, options) {
-    const source = input.source;
+    // A copy: a redirected data plane rewrites the site and the layout marker,
+    // and the caller's config object must not carry that into later stages.
+    const source = { ...input.source };
     const platforms = resolveCredentialPlatforms(source);
     const policy = resolveRoundPolicy(source);
     const errors = [];
@@ -845,6 +876,29 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
     const brand = normalizeBrand(input.source_name)
         ?? brandFromSite(source.official_site)
         ?? normalizeBrand(credentialBrandKey(input.source_name, source));
+    // The account is always leased as the row's own brand; only the data plane
+    // can be redirected. See `backend_brand` for why 黑洞 needs this.
+    const backendBrand = normalizeBrand(String(source.backend_brand ?? '').trim()) ?? brand;
+    if (backendBrand && brand && backendBrand !== brand) {
+        const redirected = brandSite(backendBrand);
+        if (redirected) {
+            // A pinned `apk_path` / `apk_url` is the operator's explicit choice of
+            // build and stays as given: it may already be the backend's own APK, and
+            // discarding it turned a working pinned profile into "APK could not be
+            // located". Only the site moves.
+            if (!source.apk_path && !source.apk_url) {
+                source.official_site = redirected;
+            }
+            // The layout is picked from `brand` at every call site; carrying the row
+            // name through would keep sending the storefront's own flag block.
+            source.brand_override = backendBrand;
+        }
+        // Informational, not an error: the row is expected to work this way.
+        diagnostics.backend_brand = backendBrand;
+        event(options, 'log', {
+            message: `[extract][${input.source_name}] data plane ${brand} -> ${backendBrand}`
+        });
+    }
     let store = options.accountStore ?? null;
     let ownsStore = false;
     let leased = null;
@@ -879,13 +933,25 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
         });
         return { ...empty, failed_iterations: 1 };
     }
-    const memo = options.memo ?? createFingerprintMemo(options.fingerprintStore ?? null, credentialBrandKey(input.source_name, source));
+    // Keyed by the data plane, not the storefront: a redirected row downloads and
+    // inspects the backend's APK, so it must share that brand's cached entry.
+    //
+    // A caller-supplied memo cannot be trusted here. The orchestrator builds one
+    // per row name before the redirect exists, so `options.memo` for a `heidong`
+    // row is seeded from 黑洞's entry while every read and write below goes to the
+    // 雷霆 one. That pairing sends the 黑洞 APK's package and seeds to the 雷霆
+    // backend on a cached run, and it hides the 雷霆 entry the next run should
+    // reuse. A redirect therefore always gets a memo of its own key; the shared
+    // one is used only when the two brands agree.
+    const memoBrandKey = source.brand_override ?? credentialBrandKey(input.source_name, source);
+    const memo = source.brand_override
+        ? createFingerprintMemo(options.fingerprintStore ?? null, memoBrandKey)
+        : (options.memo ?? createFingerprintMemo(options.fingerprintStore ?? null, memoBrandKey));
     let linkQueue = Promise.resolve();
     // A non-numeric retry limit (a hand-edited `account_retry_limit = "three"`)
     // must not turn the attempt loop into zero passes, which reported the source
     // as successful with no links and no error.
-    const retryLimit = Math.trunc(Number(source.account_retry_limit ?? 3));
-    const attempts = explicitAccount && explicitPassword ? 1 : (Number.isFinite(retryLimit) && retryLimit >= 1 ? retryLimit : 3);
+    const attempts = explicitAccount && explicitPassword ? 1 : credentialAccountAttempts(source, brand);
     let results = [];
     let callbackFailure = null;
     // The dashboard reads per-source totals from one `extract_iteration` stream.
@@ -1006,13 +1072,35 @@ async function fetchCredentialSourceLinksWithTransport(input, options) {
                     if (lapsed) {
                         store.markExpired(leased.id, 'membership expired');
                     }
-                    else if (level !== undefined && level < 2 && !linked) {
+                    else if (level !== undefined && level < 2 && !linked && !source.brand_override) {
                         // A free-tier account (level 0/1) only ever produces placeholders.
                         // Retire it, but only when it actually produced nothing: a paid
                         // account misreported as level 1 must not lose its row.
+                        //
+                        // A redirected row is exempt: the level it reports is the *row*
+                        // brand's backend grading it, not the backend it now reads, so a
+                        // low level there says nothing about whether the account works.
+                        // Retiring on it would discard exactly the accounts the rotation
+                        // below is trying to find.
                         store.markInvalid(leased.id, 'no paid membership');
                     }
                 }
+                // A login is not proof the account is usable. On a backend that gates
+                // routes by membership, a free-tier account logs in fine and then sees
+                // every paid row disabled, so the vendor filter leaves nothing to ask.
+                // Publishing that as a finished source was the bug; rotate instead.
+                // The account itself is valid, so it is not retired — only skipped.
+                const producedRoutes = results.some((result) => result.diagnostics.route_count > 0);
+                const producedLinks = results.some((result) => result.links.length > 0);
+                if (!producedRoutes && !producedLinks && store && leased && attempt < attempts && brand) {
+                    const next = store.lease(brand);
+                    if (next) {
+                        leased = next;
+                        account = next.account;
+                        password = next.password;
+                        continue;
+                    }
+                }
                 break;
             }
             const membershipExpired = results.length > 0
@@ -1203,9 +1291,15 @@ async function runCredentialPlatform(input, options) {
     // These only change when the vendor publishes a new build, so a cached entry
     // is used first and the APK is inspected only when the cached seeds all stop
     // answering. That keeps a normal run to a handful of HTTP calls.
-    const brandKey = credentialBrandKey(input.source_name, source);
+    // Keyed by the data plane, not the storefront: a redirected row downloads and
+    // inspects the backend's APK, so it must share that brand's cached entry.
+    const brandKey = source.brand_override ?? credentialBrandKey(input.source_name, source);
     const store = options.fingerprintStore ?? null;
-    const memo = options.memo ?? createFingerprintMemo(store, brandKey);
+    // Same rule as the outer memo: a caller-supplied memo is keyed by the row
+    // name, so a redirected row must not read or write through it.
+    const memo = source.brand_override
+        ? createFingerprintMemo(store, brandKey)
+        : (options.memo ?? createFingerprintMemo(store, brandKey));
     // A fingerprint past its trust window is still used when its seeds answer,
     // but it is re-verified against the APK rather than trusted indefinitely: a
     // vendor can rotate the signing certificate while the old seeds still serve
@@ -1228,7 +1322,13 @@ async function runCredentialPlatform(input, options) {
         try {
             apkBytes = options.loadApk
                 ? await options.loadApk(source)
-                : await defaultLoadApk(source, fetchImpl, timeoutMs, now, log, input.source_name, egress);
+                : await defaultLoadApk(source, fetchImpl, timeoutMs, now, log, 
+                // The archive prefix names the *backend's* build (`_lt`, not `_hd`):
+                // a redirected row downloads from the backend's CDN, which publishes
+                // only the backend's own archives. Passing the row name here made
+                // every candidate `_hd<N>.apk` against a 雷霆 host, so all lookback
+                // slots missed and the run failed with "APK could not be located".
+                source.brand_override ?? input.source_name, egress);
         }
         catch (error) {
             errors.push(`apk: ${error instanceof Error ? error.message : String(error)}`);
@@ -1348,7 +1448,7 @@ async function runCredentialPlatform(input, options) {
             platform,
             timestampMs: ts,
             code: ''
-        }, resolveBrandLayout({ ...source, brand: input.source_name })), keys, timeoutMs, egress);
+        }, resolveBrandLayout({ ...source, brand: source.brand_override ?? input.source_name })), keys, timeoutMs, egress);
         substage('domain_discovery', resolved ? 'success' : 'failed');
         return resolved;
     }
@@ -1359,7 +1459,7 @@ async function runCredentialPlatform(input, options) {
         identity,
         device,
         platform,
-        layout: resolveBrandLayout({ ...source, brand: input.source_name }),
+        layout: resolveBrandLayout({ ...source, brand: source.brand_override ?? input.source_name }),
         token: '',
         // Before login the app's local KV has no `code`, so the request carries an
         // empty one; `&code=` only holds a value once the account has one.

package/dist/web/renderer/i18n.js

@@ -5,7 +5,7 @@ const ZH_MESSAGES = {
   locale: 'zh-CN',
   appTitle: 'AutoVPN',
   sidebarTitle: 'AutoVPN',
-  sidebarVersion: 'v.2.1.2',
+  sidebarVersion: 'v.2.2.1',
   brandSubtitle: '概览、运行、结果、订阅、日志、设置统一管理',
   languageLabel: '',
   saveButton: '保存配置',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swimmingliu/autovpn",
-  "version": "2.1.2",
+  "version": "2.2.1",
   "description": "npm wrapper for the AutoVPN headless CLI",
   "type": "module",
   "repository": {