@trim21/personal-pi-extensions 0.0.431 → 0.0.432

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.431",
+  "version": "0.0.432",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/core.ts

@@ -40,7 +40,7 @@ const bwrapConfigProperties = {
   networkAllowlist: Type.Array(
     Type.String({ description: "允许直连的域名 / IP / CIDR，可带 :port" }),
   ),
-  singBoxPath: Type.Optional(Type.String()),
+  mihomoPath: Type.Optional(Type.String()),
   slirp4netnsPath: Type.Optional(Type.String()),
   approvalRules: Type.Optional(
     Type.Array(
@@ -78,9 +78,9 @@ export interface ResolvedBwrap {
   /** 沙箱内隐藏的路径：以 / 结尾为目录（挂空 tmpfs），否则为文件（--ro-bind-try /dev/null）。 */
   denyPaths: string[];
   extraArgs: string[];
-  /** 允许直连的域名 / IP / IP:port 白名单（非空 = 启用 sing-box 网络过滤）。 */
+  /** 允许直连的域名 / IP / IP:port 白名单（非空 = 启用 mihomo 网络过滤）。 */
   networkAllowlist: string[];
-  singBoxPath?: string;
+  mihomoPath?: string;
   slirp4netnsPath?: string;
   /** 全权限执行的自动审批规则（allow/deny 命令模式）。 */
   approvalRules: ApprovalRule[];
@@ -104,7 +104,7 @@ export function resolveBwrap(config: BwrapConfig): ResolvedBwrap {
     denyPaths: config.denyPaths ?? [],
     extraArgs: config.extraArgs ?? [],
     networkAllowlist: config.networkAllowlist ?? [],
-    singBoxPath: config.singBoxPath,
+    mihomoPath: config.mihomoPath,
     slirp4netnsPath: config.slirp4netnsPath,
     approvalRules: config.approvalRules ?? [],
   };
@@ -147,7 +147,7 @@ function deepMerge(base: BwrapConfig, overrides: Partial<BwrapConfig>): BwrapCon
     denyPaths: overrides.denyPaths ?? base.denyPaths,
     extraArgs: overrides.extraArgs ?? base.extraArgs,
     networkAllowlist: overrides.networkAllowlist ?? base.networkAllowlist,
-    singBoxPath: overrides.singBoxPath ?? base.singBoxPath,
+    mihomoPath: overrides.mihomoPath ?? base.mihomoPath,
     slirp4netnsPath: overrides.slirp4netnsPath ?? base.slirp4netnsPath,
     approvalRules: [...(base.approvalRules ?? []), ...(overrides.approvalRules ?? [])],
   };
@@ -234,16 +234,16 @@ function findCommandInPath(name: string, hint: string): string {
   throw new Error(hint);
 }
 
-export function findSingBox(override?: string): string {
+export function findMihomo(override?: string): string {
   if (override) {
     if (!existsSync(override)) {
-      throw new Error(`sing-box not found at configured path: ${override}`);
+      throw new Error(`mihomo not found at configured path: ${override}`);
     }
     return override;
   }
   return findCommandInPath(
-    "sing-box",
-    "sing-box not found in PATH. Install it from https://sing-box.sagernet.org/",
+    "mihomo",
+    "mihomo not found in PATH. Install it from https://github.com/MetaCubeX/mihomo",
   );
 }
 
@@ -378,7 +378,7 @@ export async function createNetworkStack(
   return startNetworkStack({
     allowlist: resolved.networkAllowlist,
     dnsServers: await resolveDnsServers(),
-    singBoxPath: findSingBox(resolved.singBoxPath),
+    mihomoPath: findMihomo(resolved.mihomoPath),
     slirp4netnsPath: findSlirp4netns(resolved.slirp4netnsPath),
   });
 }

package/src/bwrap/holder.js

@@ -1,9 +1,10 @@
 import { spawn } from "node:child_process";
+import { dirname } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 const args = process.argv.slice(2);
 const configPath = args[0];
-const singBoxPath = args[1];
-if (!configPath || !singBoxPath) {
+const mihomoPath = args[1];
+if (!configPath || !mihomoPath) {
   process.exit(2);
 }
 function tap0Exists() {
@@ -22,12 +23,11 @@ async function waitFor(attempts, delayMs, predicate) {
 }
 async function main() {
   await waitFor(100, 100, tap0Exists);
-  const singbox = spawn(singBoxPath, ["run", "-c", configPath], {
-    env: { ...process.env, ENABLE_DEPRECATED_MISSING_DOMAIN_RESOLVER: "true" },
+  const mihomo = spawn(mihomoPath, ["-d", dirname(configPath), "-f", configPath], {
     stdio: ["ignore", "inherit", "inherit"]
   });
   const stop = () => {
-    singbox.kill("SIGTERM");
+    mihomo.kill("SIGTERM");
   };
   process.on("SIGTERM", () => {
     stop();
@@ -37,7 +37,7 @@ async function main() {
     stop();
     process.exit(0);
   });
-  await new Promise((resolve) => singbox.once("exit", () => resolve()));
+  await new Promise((resolve) => mihomo.once("exit", () => resolve()));
 }
 try {
   await main();

package/src/bwrap/holder.ts

@@ -1,12 +1,13 @@
 /* eslint-disable no-console, unicorn/no-process-exit -- 独立 CLI 脚本，由 unshare 直接执行 */
 import { spawn } from "node:child_process";
+import { dirname } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 
-// 用法：unshare -Urn node holder.ts <config> <singbox>
+// 用法：unshare -Urn node holder.ts <config> <mihomo>
 const args = process.argv.slice(2);
 const configPath = args[0];
-const singBoxPath = args[1];
-if (!configPath || !singBoxPath) {
+const mihomoPath = args[1];
+if (!configPath || !mihomoPath) {
   process.exit(2);
 }
 
@@ -34,14 +35,13 @@ async function main(): Promise<void> {
   // slirp4netns 由宿主侧 spawn，这里等它建好 tap0
   await waitFor(100, 100, tap0Exists);
 
-  // sing-box 日志透传到 holder 的 stdout/stderr，宿主侧监听 "sing-box started" 判定就绪
-  const singbox = spawn(singBoxPath, ["run", "-c", configPath], {
-    env: { ...process.env, ENABLE_DEPRECATED_MISSING_DOMAIN_RESOLVER: "true" },
+  // mihomo 日志透传到 holder 的 stdout/stderr，宿主侧监听 "Tun adapter listening" 判定就绪
+  const mihomo = spawn(mihomoPath, ["-d", dirname(configPath), "-f", configPath], {
     stdio: ["ignore", "inherit", "inherit"],
   });
 
   const stop = (): void => {
-    singbox.kill("SIGTERM");
+    mihomo.kill("SIGTERM");
   };
   process.on("SIGTERM", () => {
     stop();
@@ -52,7 +52,7 @@ async function main(): Promise<void> {
     process.exit(0);
   });
 
-  await new Promise<void>((resolve) => singbox.once("exit", () => resolve()));
+  await new Promise<void>((resolve) => mihomo.once("exit", () => resolve()));
 }
 
 try {

package/src/bwrap/mihomo-config.ts

@@ -0,0 +1,183 @@
+const FAKEIP_RANGE = "198.18.0.1/16";
+const TUN_MTU = 1500;
+
+export interface MihomoConfigOptions {
+  /** 允许直连的条目列表（域名 / IP / CIDR，可带 :port；空列表 = 默认拒绝一切出网）。 */
+  readonly allowlist: readonly string[];
+  /** 真实 DNS 服务器地址列表（IPv4，UDP 53），按顺序 fallback，至少一个。 */
+  readonly dnsServers: readonly string[];
+}
+
+interface AllowlistEntry {
+  readonly host: string;
+  readonly port?: number;
+}
+
+/** mihomo 配置以 JSON 序列化输出（JSON 是 YAML 子集，-f 加载无差别）。 */
+export interface MihomoConfig {
+  "mixed-port": 0;
+  mode: "rule";
+  "log-level": "info";
+  ipv6: false;
+  dns: {
+    enable: true;
+    ipv6: false;
+    "enhanced-mode": "fake-ip";
+    "fake-ip-range": string;
+    nameserver: string[];
+    "default-nameserver": string[];
+    "fake-ip-filter"?: string[];
+  };
+  tun: {
+    enable: true;
+    stack: "mixed";
+    mtu: number;
+    "auto-route": true;
+    "strict-route": true;
+    "auto-detect-interface": true;
+    "dns-hijack": string[];
+  };
+  rules: string[];
+}
+
+const IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}(?:\/\d{1,2})?$/;
+/** 合法 DNS 主机名（标签 1-63 字符，字母数字加连字符，不得以连字符开头/结尾）。 */
+const DOMAIN_PATTERN =
+  /^(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)*[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/;
+/** IP/CIDR 的字符集校验（IPv4/IPv6），防止非法字符进入规则。 */
+const IP_CHARS_PATTERN = /^[0-9a-fA-F:.]+(?:\/\d{1,3})?$/;
+
+function isIp(host: string): boolean {
+  return IPV4_PATTERN.test(host) || host.includes(":");
+}
+
+/** 单 IP 补掩码为 CIDR（IPv4 /32、IPv6 /128），带掩码原样返回。 */
+function toCidr(host: string): string {
+  if (host.includes("/")) return host;
+  return host.includes(":") ? `${host}/128` : `${host}/32`;
+}
+
+function parsePort(value: string): number {
+  const port = Number(value);
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+    throw new Error(`Invalid port "${value}"`);
+  }
+  return port;
+}
+
+/**
+ * 解析 allowlist 条目：域名 / IPv4 / CIDR，可带 :port；IPv6 必须用 [] 包裹
+ * （如 `[::1]:80`），裸 IPv6 会报错提示补方括号。
+ */
+function parseAllowlistEntry(entry: string): AllowlistEntry {
+  let host: string;
+  let port: number | undefined;
+  if (entry.startsWith("[")) {
+    const match = /^\[(.+)\](?::(\d+))?$/.exec(entry);
+    if (match?.[1] === undefined) throw new Error(`Invalid allowlist entry "${entry}"`);
+    host = match[1];
+    port = match[2] === undefined ? undefined : parsePort(match[2]);
+  } else {
+    const colon = entry.lastIndexOf(":");
+    if (colon === -1) {
+      if (entry.length === 0) throw new Error(`Invalid allowlist entry ""`);
+      host = entry;
+    } else {
+      const portPart = entry.slice(colon + 1);
+      if (!/^\d+$/.test(portPart)) throw new Error(`Invalid allowlist entry "${entry}"`);
+      host = entry.slice(0, colon);
+      if (host.length === 0) throw new Error(`Invalid allowlist entry "${entry}"`);
+      if (host.includes(":")) {
+        throw new Error(`IPv6 addresses must be wrapped in brackets, e.g. "[${host}]:${portPart}"`);
+      }
+      port = parsePort(portPart);
+    }
+  }
+  if (isIp(host)) {
+    if (!IP_CHARS_PATTERN.test(host)) throw new Error(`Invalid allowlist entry "${entry}"`);
+  } else if (!DOMAIN_PATTERN.test(host)) {
+    throw new Error(`Invalid allowlist entry "${entry}"`);
+  }
+  return { host, port };
+}
+
+/** IP 条目的 mihomo 规则（IPv6 用 IP-CIDR6；no-resolve 跳过反向解析）。 */
+function ipRule(host: string): string {
+  const cidr = toCidr(host);
+  const kind = cidr.includes(":") ? "IP-CIDR6" : "IP-CIDR";
+  return `${kind},${cidr},DIRECT,no-resolve`;
+}
+
+interface BuiltRules {
+  rules: string[];
+  fakeIpFilter: string[];
+}
+
+/**
+ * allowlist 条目 → mihomo 规则：
+ * - 域名（含 :port 条目里的域名）进 fake-ip-filter，真实解析避免 DIRECT 出站
+ *   拿到 fakeip 再进 TUN 形成环（loopback detector 会拒绝）；
+ * - 无端口条目直接匹配；带端口条目用 AND 组合（域名/IP + DST-PORT）精确放行；
+ * - 最后以 MATCH,REJECT 兜底实现 deny-by-default。
+ */
+function buildRules(allowlist: readonly string[]): BuiltRules {
+  const rules: string[] = [];
+  const fakeIpFilter: string[] = [];
+  for (const entry of allowlist) {
+    const { host, port } = parseAllowlistEntry(entry);
+    if (!isIp(host)) {
+      fakeIpFilter.push(`+.${host}`);
+      if (port === undefined) {
+        rules.push(`DOMAIN-SUFFIX,${host},DIRECT`);
+      } else {
+        rules.push(`AND,(DOMAIN-SUFFIX,${host},DIRECT),(DST-PORT,${port},DIRECT),DIRECT`);
+      }
+    } else if (port === undefined) {
+      rules.push(ipRule(host));
+    } else {
+      rules.push(`AND,(${ipRule(host)}),(DST-PORT,${port},DIRECT),DIRECT`);
+    }
+  }
+  rules.push("MATCH,REJECT");
+  return { rules, fakeIpFilter };
+}
+
+/**
+ * 生成 mihomo（Clash Meta）配置对象：TUN + fakeip + deny-by-default allowlist。
+ *
+ * - auto-detect-interface 让 mihomo 出站绑定 slirp4netns 的 tap0，否则它自己的
+ *   DNS 查询会被 auto_route 送回 TUN 形成环；
+ * - allowlist 域名走 fake-ip-filter 真实解析（见 buildRules 注释）。
+ */
+export function generateMihomoConfig(options: MihomoConfigOptions): MihomoConfig {
+  const { allowlist, dnsServers } = options;
+  if (dnsServers.length === 0) {
+    throw new Error("At least one DNS server is required");
+  }
+  const { rules, fakeIpFilter } = buildRules(allowlist);
+  return {
+    "mixed-port": 0,
+    mode: "rule",
+    "log-level": "info",
+    ipv6: false,
+    dns: {
+      enable: true,
+      ipv6: false,
+      "enhanced-mode": "fake-ip",
+      "fake-ip-range": FAKEIP_RANGE,
+      nameserver: [...dnsServers],
+      "default-nameserver": [...dnsServers],
+      ...(fakeIpFilter.length > 0 && { "fake-ip-filter": fakeIpFilter }),
+    },
+    tun: {
+      enable: true,
+      stack: "mixed",
+      mtu: TUN_MTU,
+      "auto-route": true,
+      "strict-route": true,
+      "auto-detect-interface": true,
+      "dns-hijack": ["any:53"],
+    },
+    rules,
+  };
+}

package/src/bwrap/network-stack.ts

@@ -4,14 +4,14 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { generateSingboxConfig } from "./singbox-config.js";
+import { generateMihomoConfig } from "./mihomo-config.js";
 
 export interface NetworkStackOptions {
   /** 允许直连的域名 / IP:port 列表（每次命令从配置重新读取）。 */
   readonly allowlist: readonly string[];
   /** 真实 DNS 服务器列表，按顺序 fallback。 */
   readonly dnsServers: readonly string[];
-  readonly singBoxPath: string;
+  readonly mihomoPath: string;
   readonly slirp4netnsPath: string;
 }
 
@@ -72,18 +72,18 @@ async function waitForNewUserns(pid: number, timeoutMs = 5000): Promise<void> {
   throw new Error("Timed out waiting for sandbox network namespace");
 }
 
-/** 监听 holder 的 stdout/stderr（sing-box 日志透传），以 "sing-box started" 作为就绪标志。 */
-function waitForSingboxStarted(holder: ChildProcess, timeoutMs = 20000): Promise<void> {
+/** 监听 holder 的 stdout/stderr（mihomo 日志透传），以 "Tun adapter listening" 作为就绪标志。 */
+function waitForMihomoStarted(holder: ChildProcess, timeoutMs = 20000): Promise<void> {
   return new Promise((resolve, reject) => {
     let settled = false;
     const timer = setTimeout(() => {
       if (settled) return;
       settled = true;
-      reject(new Error("Timed out waiting for sing-box to start"));
+      reject(new Error("Timed out waiting for mihomo to start"));
     }, timeoutMs);
     const onData = (data: Buffer): void => {
       if (settled) return;
-      if (data.toString().includes("sing-box started")) {
+      if (data.toString().includes("Tun adapter listening")) {
         settled = true;
         clearTimeout(timer);
         resolve();
@@ -95,7 +95,7 @@ function waitForSingboxStarted(holder: ChildProcess, timeoutMs = 20000): Promise
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      reject(new Error(`Sandbox holder exited before sing-box started (code ${code})`));
+      reject(new Error(`Sandbox holder exited before mihomo started (code ${code})`));
     });
   });
 }
@@ -132,22 +132,23 @@ const stackFinalizer = new FinalizationRegistry<NetworkStackState>((state) => {
 });
 
 /**
- * 启动网络栈：holder 进程持有 netns（内部跑 sing-box 的
+ * 启动网络栈：holder 进程持有 netns（内部跑 mihomo 的
  * TUN + fakeip + deny-by-default），slirp4netns 提供 egress。返回前
- * netns/sing-box/slirp4netns 均已就绪，命令通过 nsenter 进入该 netns 执行。
+ * netns/mihomo/slirp4netns 均已就绪，命令通过 nsenter 进入该 netns 执行。
  */
 export async function startNetworkStack(options: NetworkStackOptions): Promise<NetworkStack> {
-  const { allowlist, dnsServers, singBoxPath, slirp4netnsPath } = options;
+  const { allowlist, dnsServers, mihomoPath, slirp4netnsPath } = options;
   const directory = await mkdtemp(join(tmpdir(), "pi-netns-"));
-  const configPath = join(directory, "singbox.json");
-  await writeFile(configPath, generateSingboxConfig({ allowlist, dnsServers }));
+  const configPath = join(directory, "mihomo.json");
+  const config = generateMihomoConfig({ allowlist, dnsServers });
+  await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
 
-  const holder = spawn("unshare", ["-Urn", "--", "node", HOLDER_PATH, configPath, singBoxPath], {
+  const holder = spawn("unshare", ["-Urn", "--", "node", HOLDER_PATH, configPath, mihomoPath], {
     env: {
       HOME: process.env.HOME ?? "",
       PATH: `${process.env.PATH ?? ""}:${SBIN_PATH_SUFFIX}`,
     },
-    // sing-box 日志经 holder 透传到这里的 stdout/stderr，用于判定就绪
+    // mihomo 日志经 holder 透传到这里的 stdout/stderr，用于判定就绪
     stdio: ["ignore", "pipe", "pipe"],
   });
   if (holder.pid === undefined) {
@@ -168,7 +169,7 @@ export async function startNetworkStack(options: NetworkStackOptions): Promise<N
     { stdio: "ignore" },
   );
   const slirpPid = slirp.pid;
-  await waitForSingboxStarted(holder);
+  await waitForMihomoStarted(holder);
 
   const state: NetworkStackState = { holderPid, slirpPid, directory };
   const stack: NetworkStack = {

package/src/bwrap/singbox-config.ts

@@ -1,164 +0,0 @@
-const FAKEIP_RANGE = "198.18.0.0/15";
-const TUN_ADDRESS = "198.18.0.1/16";
-const EGRESS_INTERFACE = "tap0";
-
-export interface SingboxConfigOptions {
-  /** 允许直连的条目列表（域名 / IP / CIDR，可带 :port；空列表 = 默认拒绝一切出网）。 */
-  readonly allowlist: readonly string[];
-  /** 真实 DNS 服务器地址列表（IPv4，UDP 53），按顺序 fallback，至少一个。 */
-  readonly dnsServers: readonly string[];
-}
-
-interface AllowlistEntry {
-  readonly host: string;
-  readonly port?: number;
-}
-
-interface AllowlistRule {
-  readonly domain?: readonly string[];
-  readonly ip_cidr?: readonly string[];
-  readonly port?: readonly number[];
-  readonly outbound: "direct";
-}
-
-const IPV4_PATTERN = /^\d{1,3}(?:\.\d{1,3}){3}(?:\/\d{1,2})?$/;
-
-function isIp(host: string): boolean {
-  return IPV4_PATTERN.test(host) || host.includes(":");
-}
-
-/** 单 IP 补掩码为 CIDR（IPv4 /32、IPv6 /128），带掩码原样返回。 */
-function toCidr(host: string): string {
-  if (host.includes("/")) return host;
-  return host.includes(":") ? `${host}/128` : `${host}/32`;
-}
-
-function parsePort(value: string): number {
-  const port = Number(value);
-  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
-    throw new Error(`Invalid port "${value}"`);
-  }
-  return port;
-}
-
-/**
- * 解析 allowlist 条目：域名 / IPv4 / CIDR，可带 :port；IPv6 必须用 [] 包裹
- * （如 `[::1]:80`），裸 IPv6 会报错提示补方括号。
- */
-function parseAllowlistEntry(entry: string): AllowlistEntry {
-  if (entry.startsWith("[")) {
-    const match = /^\[(.+)\](?::(\d+))?$/.exec(entry);
-    if (match?.[1] === undefined) throw new Error(`Invalid allowlist entry "${entry}"`);
-    return { host: match[1], port: match[2] === undefined ? undefined : parsePort(match[2]) };
-  }
-  const colon = entry.lastIndexOf(":");
-  if (colon === -1) {
-    if (entry.length === 0) throw new Error(`Invalid allowlist entry ""`);
-    return { host: entry };
-  }
-  const portPart = entry.slice(colon + 1);
-  if (!/^\d+$/.test(portPart)) throw new Error(`Invalid allowlist entry "${entry}"`);
-  const host = entry.slice(0, colon);
-  if (host.length === 0) throw new Error(`Invalid allowlist entry "${entry}"`);
-  if (host.includes(":")) {
-    throw new Error(`IPv6 addresses must be wrapped in brackets, e.g. "[${host}]:${portPart}"`);
-  }
-  return { host, port: parsePort(portPart) };
-}
-
-function buildAllowlistRules(allowlist: readonly string[]): AllowlistRule[] {
-  const noPortDomains: string[] = [];
-  const noPortIps: string[] = [];
-  const byPort = new Map<number, { domains: string[]; ips: string[] }>();
-  for (const entry of allowlist) {
-    const { host, port } = parseAllowlistEntry(entry);
-    if (port === undefined) {
-      (isIp(host) ? noPortIps : noPortDomains).push(host);
-    } else {
-      const bucket = byPort.get(port) ?? { domains: [], ips: [] };
-      (isIp(host) ? bucket.ips : bucket.domains).push(host);
-      byPort.set(port, bucket);
-    }
-  }
-  const rules: AllowlistRule[] = [];
-  if (noPortDomains.length > 0) rules.push({ domain: noPortDomains, outbound: "direct" });
-  if (noPortIps.length > 0) {
-    rules.push({ ip_cidr: noPortIps.map((host) => toCidr(host)), outbound: "direct" });
-  }
-  for (const [port, bucket] of byPort) {
-    rules.push({
-      outbound: "direct",
-      port: [port],
-      ...(bucket.domains.length > 0 && { domain: bucket.domains }),
-      ...(bucket.ips.length > 0 && { ip_cidr: bucket.ips.map((host) => toCidr(host)) }),
-    });
-  }
-  return rules;
-}
-
-/**
- * 生成 sing-box 1.13 配置：TUN + fakeip + deny-by-default allowlist。
- *
- * - 出站绑定到 slirp4netns 的 tap0，避免 auto_route 把 sing-box 自身出站
- *   流量（尤其 DNS 解析）重新路由回 TUN 形成环。
- * - 真实解析不设 domain_resolver（它只接受单个 server 且绕过规则），而是
- *   用 DNS rules 的顺序 fallback 链：前 N-1 个 nameserver 带 ip_accept_any
- *   过滤（响应不合格时落到下一条），最后一个作为 dns.final 兜底。
- *   该用法在 1.13 已标记 deprecated，运行需设置
- *   ENABLE_DEPRECATED_MISSING_DOMAIN_RESOLVER=true。
- */
-export function generateSingboxConfig(options: SingboxConfigOptions): string {
-  const { allowlist, dnsServers } = options;
-  const lastServer = dnsServers.at(-1);
-  if (!lastServer) {
-    throw new Error("At least one DNS server is required");
-  }
-  const config = {
-    log: { level: "info", timestamp: false },
-    dns: {
-      servers: [
-        ...dnsServers.map((server, index) => ({
-          type: "udp",
-          tag: `remote-${index}`,
-          server,
-          server_port: 53,
-        })),
-        { type: "fakeip", tag: "fakeip", inet4_range: FAKEIP_RANGE },
-      ],
-      rules: [
-        { query_type: ["A", "AAAA"], server: "fakeip" },
-        ...dnsServers.slice(0, -1).map((_, index) => ({
-          server: `remote-${index}`,
-          ip_accept_any: true,
-        })),
-      ],
-      final: `remote-${dnsServers.length - 1}`,
-      strategy: "prefer_ipv4",
-      independent_cache: true,
-    },
-    inbounds: [
-      {
-        type: "tun",
-        tag: "tun-in",
-        stack: "gvisor",
-        address: [TUN_ADDRESS],
-        auto_route: true,
-        strict_route: true,
-      },
-    ],
-    outbounds: [
-      { type: "direct", tag: "direct" },
-      { type: "block", tag: "block" },
-    ],
-    route: {
-      default_interface: EGRESS_INTERFACE,
-      final: "block",
-      rules: [
-        { action: "sniff" },
-        { protocol: "dns", action: "hijack-dns" },
-        ...buildAllowlistRules(allowlist),
-      ],
-    },
-  };
-  return `${JSON.stringify(config, null, 2)}\n`;
-}