@twinsearth/dsh-2xray 0.2.6 → 0.2.8

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.2.8 — 2026-10-29
+
+### 修复
+
+- `cn-direct` 模式设置 `routing.domainStrategy: IPIfNonMatch`：未被 `geosite:cn` 命中的域名会解析为 IP 再匹配 `geoip:cn`，国内站点不再漏判。
+- `XRAY_LOCATION_ASSET` 显式传入 `run` 与 `run -test` 的 spawn 环境：服务启动器会清理环境，之前 geodata 路径可能丢失，导致 `geoip:cn`/`geosite:cn` 静默失效。
+- 启动与 `xray_validate_config` 前都先复制 `geoip.dat`/`geosite.dat` 到数据目录；缺失时日志明确告警。
+
+## 0.2.7 — 2026-10-29
+
+### 新增
+
+- **路由模式**：`global` / `cn-direct`（国内 IP、域名直连）/ `whitelist`（仅白名单走 2Xray）。
+- **黑白名单**：白名单默认 github.com、google.com、youtube.com、x.com、facebook.com；黑名单默认 deepseek.com、api.deepseek.com。黑名单优先，并并入 `noProxy`。
+- **内核安装脚本** `tools/install-xray-core.mjs`：官方 release + `.dgst` SHA2-256 校验 + 解压到数据目录。
+- 侧边栏「实时连接信息」默认展开日志。
+
+### 修复
+
+- macOS 自动发现补充 `~/Library/Application Support/v2rayN`、`/Applications` 等路径。
+- 路由验证 URL 改为保留域 `dsh-2xray-verify.invalid`，不再被 `noProxy: deepseek.com` 绕过（route-instance-mismatch 根因）。
+- 非 Windows 下入站端口 <1024 自动回落到 20808（避免把远端 556 当本地端口导致 EACCES）。
+
 ## 0.2.6 — 2026-10-29
 
 ### 内置浏览器支持

package/README.md

@@ -328,6 +328,24 @@ v0.2.0 提供两个入口，互不替代：
 | 状态一直 `degraded` + `route-install-failed` | 查日志里的模块解析诊断；必要时确认 DSH 安装目录结构 |
 | `xray_switch_node` 报 `unknown service ... RoutingService` | xray 版本早于 2024-09；升级二进制，或关闭 `control.enabled` 只用 `activeNode` |
 
+## 路由模式与黑白名单
+
+- `global`（默认）：全部流量走 2Xray。
+- `cn-direct`：`geoip:cn` / `geosite:cn` 直连，其余走代理。插件会从 xray 二进制旁复制 `geoip.dat`/`geosite.dat` 到数据目录，并设置 `XRAY_LOCATION_ASSET`。
+- `whitelist`：仅白名单域名走 2Xray，其余直连。
+
+黑名单优先于白名单与分流，并会同时加入 DSH 的 `noProxy`（xray 重启时也不受影响）。默认白名单：github.com、google.com、youtube.com、x.com、facebook.com；默认黑名单：deepseek.com、api.deepseek.com。
+
+## 内核安装（macOS / Linux）
+
+npm 包不内嵌五平台内核。未找到内核时：
+
+```bash
+node tools/install-xray-core.mjs 26.9.30
+```
+
+脚本下载官方 release 资产、校验 `.dgst` 的 SHA2-256、解压到 `~/.dsh/xray-proxy/bin/`。GitHub 不可达时设置 `DSH_XRAY_MIRROR` 指向镜像。macOS 也会自动搜索 `~/Library/Application Support/v2rayN/bin/xray/xray`。
+
 ## 内置浏览器（Chromium）
 
 DSH 内置浏览器走 Chromium 网络栈，不读 undici dispatcher，插件无法在运行时改它的代理。支持方式只有启动参数：

package/lib/assets.js

@@ -0,0 +1,42 @@
+import { copyFileSync, existsSync, mkdirSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+
+const FILES = ['geoip.dat', 'geosite.dat']
+
+/**
+ * `geoip:cn` / `geosite:cn` need data files next to the binary or in
+ * XRAY_LOCATION_ASSET. A borrowed v2rayN binary keeps them one directory up,
+ * so copy them into the managed data dir and point xray there.
+ */
+export function ensureXrayAssets({ binaryPath, dataDir, logger } = {}) {
+  if (!dataDir) return { dir: undefined, copied: [], missing: FILES }
+  try {
+    mkdirSync(dataDir, { recursive: true })
+  } catch (error) {
+    logger?.warn?.(`无法创建数据目录：${String(error)}`)
+    return { dir: dataDir, copied: [], missing: FILES }
+  }
+  const candidates = [dataDir, dirname(binaryPath ?? ''), dirname(dirname(binaryPath ?? ''))]
+  const copied = []
+  const missing = []
+  for (const name of FILES) {
+    const target = join(dataDir, name)
+    if (existsSync(target)) continue
+    const source = candidates.find((dir) => dir && existsSync(join(dir, name)))
+    if (!source) {
+      missing.push(name)
+      continue
+    }
+    try {
+      copyFileSync(join(source, name), target)
+      copied.push(name)
+    } catch (error) {
+      logger?.warn?.(`复制 ${name} 失败：${String(error)}`)
+      missing.push(name)
+    }
+  }
+  if (missing.length > 0) {
+    logger?.warn?.(`缺少 xray 数据文件 ${missing.join(', ')}；cn-direct / geosite 规则可能启动失败，可从 v2rayN 的 bin/ 目录复制到 ${dataDir}`)
+  }
+  return { dir: dataDir, copied, missing }
+}

package/lib/binary.js

@@ -117,6 +117,12 @@ export function defaultDiscoveryRoots() {
     local,
     home ? join(home, 'Desktop') : '',
     home ? join(home, 'Downloads') : '',
+    // macOS: v2rayN keeps its core under Application Support, not ~/bin.
+    home ? join(home, 'Library', 'Application Support') : '',
+    home ? join(home, '.local', 'bin') : '',
+    '/Applications',
+    '/opt/homebrew/bin',
+    '/usr/local/bin',
     'C:\\Program Files',
     'C:\\Program Files (x86)',
     'D:\\',

package/lib/client.js

@@ -176,7 +176,7 @@ window.__ModuleLoader__.load({
     }
 
     function RuntimeCard({ status, logs, setLogs }) {
-      const [showLogs, setShowLogs] = React.useState(false)
+      const [showLogs, setShowLogs] = React.useState(true)
       const inbound = status?.inbound
       const inboundLabel = inbound
         ? `${String(inbound.protocol).toUpperCase()}:${inbound.port}${inbound.socks ? ` · SOCKS5:${inbound.socks.port}` : ''}`
@@ -313,6 +313,9 @@ window.__ModuleLoader__.load({
       const [port, setPort] = React.useState(String(value.inbound?.port ?? 20808))
       const [enabled, setEnabled] = React.useState(value.enabled === true)
       const [takeover, setTakeover] = React.useState(value.takeover ?? 'auto')
+      const [routingMode, setRoutingMode] = React.useState(value.routing?.mode ?? 'global')
+      const [whitelist, setWhitelist] = React.useState((value.routing?.whitelist ?? []).join('\n'))
+      const [blacklist, setBlacklist] = React.useState((value.routing?.blacklist ?? []).join('\n'))
       const [message, setMessage] = React.useState('')
       const [kind, setKind] = React.useState('')
       const [busy, setBusy] = React.useState(false)
@@ -411,10 +414,18 @@ window.__ModuleLoader__.load({
       const save = async () => {
         setBusy(true)
         try {
+          const splitList = (text) =>
+            String(text)
+              .split(/[\n,]+/)
+              .map((entry) => entry.trim())
+              .filter(Boolean)
           const fields = [
             { path: ['shareLink'], value: shareLink.trim() },
             { path: ['enabled'], value: enabled },
             { path: ['takeover'], value: takeover },
+            { path: ['routing', 'mode'], value: routingMode },
+            { path: ['routing', 'whitelist'], value: splitList(whitelist) },
+            { path: ['routing', 'blacklist'], value: splitList(blacklist) },
           ]
           if (binaryPath.trim()) fields.push({ path: ['binary', 'path'], value: binaryPath.trim() })
           const numericPort = Number(port)
@@ -449,6 +460,29 @@ window.__ModuleLoader__.load({
           h('label', { style: { fontSize: 12.5, display: 'flex', alignItems: 'center', gap: 6, marginTop: 10 } }, 'takeover',
             h('select', { value: takeover, onChange: (event) => setTakeover(event.target.value), style: { padding: '4px 8px', borderRadius: 6, background: 'transparent', color: 'inherit' } },
               h('option', { value: 'auto' }, 'auto'), h('option', { value: 'force' }, 'force'), h('option', { value: 'off' }, 'off')))),
+        h(Field, { label: '路由模式' },
+          h('select', {
+            value: routingMode,
+            onChange: (event) => setRoutingMode(event.target.value),
+            style: { ...C.input, width: 'auto' },
+          },
+            h('option', { value: 'global' }, '全局：全部走 2Xray'),
+            h('option', { value: 'cn-direct' }, '国内直连：国内 IP/域名不走 VPN，国外走'),
+            h('option', { value: 'whitelist' }, '白名单：仅白名单走 2Xray'))),
+        h(Field, { label: '白名单（强制走 2Xray，每行一个域名）' },
+          h('textarea', {
+            style: { ...C.input, minHeight: 58, fontFamily: 'ui-monospace, Consolas, monospace' },
+            value: whitelist,
+            placeholder: 'github.com\ngoogle.com\nyoutube.com\nx.com\nfacebook.com',
+            onChange: (event) => setWhitelist(event.target.value),
+          })),
+        h(Field, { label: '黑名单（强制直连，每行一个域名，优先于白名单）' },
+          h('textarea', {
+            style: { ...C.input, minHeight: 58, fontFamily: 'ui-monospace, Consolas, monospace' },
+            value: blacklist,
+            placeholder: 'deepseek.com\napi.deepseek.com',
+            onChange: (event) => setBlacklist(event.target.value),
+          })),
         h(Field, { label: 'xray 可执行文件路径（留空自动查找）' },
           h('input', { style: { ...C.input, fontFamily: 'ui-monospace, Consolas, monospace' }, value: binaryPath, placeholder: '例如 D:\\v2rayN\\...\\bin\\xray\\xray.exe', onChange: (event) => setBinaryPath(event.target.value) })),
         h(Field, { label: '本地 HTTP 入站端口' },

package/lib/config.js

@@ -51,6 +51,9 @@ export const DEFAULT_CONFIG = {
   takeover: 'auto',
   noProxy: '',
   routing: {
+    mode: 'global',
+    whitelist: ['github.com', 'google.com', 'youtube.com', 'x.com', 'facebook.com'],
+    blacklist: ['deepseek.com', 'api.deepseek.com'],
     bypassDomains: ['localhost', 'local', 'lan', 'internal', 'corp', 'home.arpa'],
     blockAds: false,
     geositeCn: false,
@@ -139,6 +142,20 @@ function asStringList(value, fallback) {
   return clone(fallback)
 }
 
+/** Accept URLs as well as bare domains; routing rules only understand hosts. */
+function normalizeDomainList(entries) {
+  const result = []
+  for (const entry of entries) {
+    let text = String(entry ?? '').trim().toLowerCase()
+    if (!text) continue
+    text = text.replace(/^[a-z][a-z0-9+.-]*:\/\//, '').split('/')[0].split(':')[0]
+    text = text.replace(/^\*\./, '').replace(/\.$/, '')
+    if (!/^[a-z0-9.-]+$/.test(text) || !text.includes('.')) continue
+    if (!result.includes(text)) result.push(text)
+  }
+  return result
+}
+
 export function sanitizeTag(value) {
   return String(value ?? '')
     .trim()
@@ -316,6 +333,22 @@ export function normalizeConfig(raw) {
   merged.routing.bypassDomains = asStringList(merged.routing.bypassDomains, DEFAULT_CONFIG.routing.bypassDomains)
   merged.routing.blockAds = asBool(merged.routing.blockAds, false)
   merged.routing.geositeCn = asBool(merged.routing.geositeCn, false)
+  merged.routing.mode = asString(merged.routing.mode, 'global')
+  merged.routing.whitelist = normalizeDomainList(
+    asStringList(merged.routing.whitelist, DEFAULT_CONFIG.routing.whitelist),
+  )
+  merged.routing.blacklist = normalizeDomainList(
+    asStringList(merged.routing.blacklist, DEFAULT_CONFIG.routing.blacklist),
+  )
+  if (merged.routing.blacklist.length > 0) {
+    // Bypass the plugin at the dispatcher level too: a blacklisted host must
+    // work even when xray is restarting.
+    const existing = String(merged.noProxy ?? '')
+      .split(/[,\s]+/)
+      .map((entry) => entry.trim())
+      .filter(Boolean)
+    merged.noProxy = [...new Set([...existing, ...merged.routing.blacklist])].join(',')
+  }
 
   const control = merged.control
   control.enabled = asBool(control.enabled, false)
@@ -344,11 +377,22 @@ export function normalizeConfig(raw) {
   if (inbound.protocol !== 'http' && inbound.protocol !== 'socks') {
     errors.push({ field: 'inbound.protocol', message: 'inbound.protocol 只支持 http 或 socks' })
   }
+  if (!['global', 'cn-direct', 'whitelist'].includes(merged.routing.mode)) {
+    errors.push({ field: 'routing.mode', message: 'routing.mode 只支持 global、cn-direct、whitelist' })
+  }
+  if (merged.routing.mode === 'whitelist' && merged.routing.whitelist.length === 0) {
+    warnings.push('routing.mode=whitelist 但白名单为空：所有流量都会直连')
+  }
   if (!LOOPBACK_HOSTS.has(inbound.host)) {
     errors.push({ field: 'inbound.host', message: '入站必须绑定回环地址，127.0.0.1 / ::1 / localhost' })
   }
   if (!Number.isInteger(inbound.port) || inbound.port < 1 || inbound.port > 65535) {
     errors.push({ field: 'inbound.port', message: '入站端口必须是 1..65535 的整数' })
+  } else if (inbound.port < 1024 && process.platform !== 'win32') {
+    // A remote node port (e.g. 556) must never become the local listener:
+    // binding <1024 needs root on macOS/Linux and xray fails with EACCES.
+    warnings.push(`入站端口 ${inbound.port} 是特权端口，macOS/Linux 下无法绑定；已改用 ${DEFAULT_CONFIG.inbound.port}`)
+    inbound.port = DEFAULT_CONFIG.inbound.port
   }
   if (socks.enabled) {
     if (!LOOPBACK_HOSTS.has(socks.host)) {

package/lib/route.js

@@ -3,7 +3,11 @@ import { dirname, join } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
 const PROXY_PACKAGE = '@deepseek-ai/dsh-http-proxy'
-const PROBE_URL = 'https://api.deepseek.com/'
+// Route verification must not depend on the data plane it checks: a real
+// target such as api.deepseek.com can legitimately be listed in noProxy, which
+// would make a working install look unproxied. A reserved .invalid host is
+// never bypassed; proxyRouteFor only resolves the route, it never fetches.
+export const PROBE_URL = 'https://dsh-2xray-verify.invalid/'
 const DISPATCHER_SYMBOLS = [Symbol.for('undici.globalDispatcher.2'), Symbol.for('undici.globalDispatcher.1')]
 
 export class RouteError extends Error {

package/lib/schema.js

@@ -93,4 +93,18 @@ export const Config = Schema.object({
       .description('启用 gRPC 控制面（多节点切换与流量统计，需 xray 2024-09+）。')
       .volatile(),
   }),
+  routing: Schema.object({
+    mode: Schema.string()
+      .default('global')
+      .description('global：全部走代理；cn-direct：国内 IP/域名直连；whitelist：仅白名单走代理。')
+      .volatile(),
+    whitelist: Schema.array(Schema.string())
+      .default(['github.com', 'google.com', 'youtube.com', 'x.com', 'facebook.com'])
+      .description('强制走 2Xray 的域名（匹配子域名）。')
+      .volatile(),
+    blacklist: Schema.array(Schema.string())
+      .default(['deepseek.com', 'api.deepseek.com'])
+      .description('强制直连的域名（优先于白名单与分流）。')
+      .volatile(),
+  }),
 })

package/lib/supervisor.js

@@ -1,5 +1,6 @@
 import { join } from 'node:path'
 import { rmSync } from 'node:fs'
+import { ensureXrayAssets } from './assets.js'
 import { buildXrayConfig } from './xray-config.js'
 import { resolveBinary, probeVersion, tail } from './binary.js'
 import { httpProxyProbe, portIsFree, waitForPort } from './health.js'
@@ -222,6 +223,15 @@ export class Supervisor {
     this.#binary = binary
     if (signal.aborted) return
 
+    if (this.dataDir) {
+      const routing = this.config.routing ?? {}
+      if (routing.mode === 'cn-direct' || routing.geositeCn || routing.blockAds) {
+        const assets = ensureXrayAssets({ binaryPath: binary.path, dataDir: this.dataDir, logger: this.#logger })
+        process.env.XRAY_LOCATION_ASSET = this.dataDir
+        if (assets.copied.length > 0) this.#logger?.info?.(`已复制 xray 数据文件：${assets.copied.join(', ')}`)
+      }
+    }
+
     const version = await probeVersion({
       launcher: this.#launcher,
       binaryPath: binary.path,
@@ -269,7 +279,9 @@ export class Supervisor {
         argv: [binary.path, 'run', '-c', configPath],
         cwd: this.dataDir,
         graceMs: Math.max(500, lifecycle.stopGraceMs),
-        env: {},
+        // geodata is copied next to the managed config; without this env the
+        // scrubbed service environment makes geoip:cn/geosite:cn fail silently.
+        env: this.dataDir ? { XRAY_LOCATION_ASSET: this.dataDir } : {},
       })
     } catch (error) {
       this.#setState('failed', 'spawn-failed', String(error))
@@ -445,7 +457,7 @@ export class Supervisor {
         argv: [binaryPath, 'run', '-test', '-c', configPath],
         cwd: this.dataDir ?? process.cwd(),
         graceMs: 2000,
-        env: {},
+        env: this.dataDir ? { XRAY_LOCATION_ASSET: this.dataDir } : {},
       })
     } catch (error) {
       return { ok: false, detail: String(error) }
@@ -493,6 +505,11 @@ export class Supervisor {
       }
     }
 
+    const routing = this.config.routing ?? {}
+    if (routing.mode === 'cn-direct' || routing.geositeCn || routing.blockAds) {
+      ensureXrayAssets({ binaryPath: binary.path, dataDir: this.dataDir, logger: this.#logger })
+    }
+
     const built = buildXrayConfig(this.config)
     const text = JSON.stringify(built, null, 2)
     const file = join(this.dataDir, 'conf', `validate-${Date.now()}-${process.pid}.json`)

package/lib/xray-config.js

@@ -156,6 +156,19 @@ export function buildXrayConfig(config) {
   if (routing.blockAds) {
     rules.push({ type: 'field', domain: ['geosite:category-ads-all'], outboundTag: 'block' })
   }
+  const blacklist = dedupe(routing.blacklist ?? [])
+  if (blacklist.length > 0) {
+    // Highest priority: these hosts must stay direct even in whitelist mode.
+    rules.push({ type: 'field', domain: blacklist.map((entry) => `domain:${entry}`), outboundTag: 'direct' })
+  }
+
+  const whitelist = dedupe(routing.whitelist ?? []).filter((entry) => !blacklist.includes(entry))
+  const mode = routing.mode ?? 'global'
+  const proxyTarget = nodes.length > 1 ? { balancerTag: control.balancerTag } : { outboundTag: nodes[0].tag }
+  if (mode === 'whitelist' && whitelist.length > 0) {
+    rules.push({ type: 'field', domain: whitelist.map((entry) => `domain:${entry}`), ...proxyTarget })
+  }
+
   rules.push({ type: 'field', ip: PRIVATE_IP_RULES, outboundTag: 'direct' })
 
   const bypassDomains = dedupe(routing.bypassDomains)
@@ -166,9 +179,12 @@ export function buildXrayConfig(config) {
     rules.push({ type: 'field', domain: bypassDomains.map((entry) => `domain:${entry}`), outboundTag: 'direct' })
   }
 
-  if (routing.geositeCn) {
+  if (mode === 'cn-direct' || routing.geositeCn) {
     rules.push({ type: 'field', domain: ['geosite:cn'], outboundTag: 'direct' })
   }
+  if (mode === 'cn-direct') {
+    rules.push({ type: 'field', ip: ['geoip:cn'], outboundTag: 'direct' })
+  }
 
   const balancers = []
   if (nodes.length > 1) {
@@ -180,6 +196,11 @@ export function buildXrayConfig(config) {
       selector: nodes.map((node) => `^${escapeRegExp(node.tag)}$`),
       strategy: { type: 'random' },
     })
+  }
+  if (mode === 'whitelist') {
+    // Only the whitelist above goes through xray; everything else is direct.
+    rules.push({ type: 'field', network: 'tcp,udp', outboundTag: 'direct' })
+  } else if (nodes.length > 1) {
     rules.push({ type: 'field', network: 'tcp,udp', balancerTag: control.balancerTag })
   } else {
     rules.push({ type: 'field', network: 'tcp,udp', outboundTag: nodes[0].tag })
@@ -210,7 +231,9 @@ export function buildXrayConfig(config) {
     inbounds,
     outbounds,
     routing: {
-      domainStrategy: 'AsIs',
+      // cn-direct relies on resolving unmatched domains to match geoip:cn;
+      // global/whitelist stay AsIs so no extra DNS lookups are introduced.
+      domainStrategy: mode === 'cn-direct' ? 'IPIfNonMatch' : 'AsIs',
       rules,
       ...(balancers.length > 0 ? { balancers } : {}),
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/dsh-2xray",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "private": false,
   "description": "DSH-2Xray: supervises xray-core and routes DSH process-wide HTTP(S) traffic through its local inbound, with optional multi-node gRPC control plane",
   "type": "module",

package/test/assets.test.js

@@ -0,0 +1,35 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { ensureXrayAssets } from '../lib/assets.js'
+
+test('geodata next to a v2rayN binary is copied into the managed data dir', () => {
+  const root = mkdtempSync(join(tmpdir(), 'dsh-xray-assets-'))
+  try {
+    const bin = join(root, 'v2rayN-windows-64', 'bin')
+    const xrayDir = join(bin, 'xray')
+    mkdirSync(xrayDir, { recursive: true })
+    writeFileSync(join(bin, 'geoip.dat'), 'geoip')
+    writeFileSync(join(bin, 'geosite.dat'), 'geosite')
+    const dataDir = join(root, 'data')
+    const result = ensureXrayAssets({ binaryPath: join(xrayDir, 'xray.exe'), dataDir })
+    assert.deepEqual(result.copied.sort(), ['geoip.dat', 'geosite.dat'])
+    assert.equal(existsSync(join(dataDir, 'geoip.dat')), true)
+    assert.equal(existsSync(join(dataDir, 'geosite.dat')), true)
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
+
+test('missing geodata is reported rather than silently ignored', () => {
+  const root = mkdtempSync(join(tmpdir(), 'dsh-xray-assets-'))
+  try {
+    const result = ensureXrayAssets({ binaryPath: join(root, 'xray.exe'), dataDir: join(root, 'data') })
+    assert.deepEqual(result.copied, [])
+    assert.deepEqual(result.missing.sort(), ['geoip.dat', 'geosite.dat'])
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})

package/test/install-core.test.js

@@ -0,0 +1,22 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { assetName, parseDigest, sha256, dataBinDir } from '../tools/install-xray-core.mjs'
+
+test('asset names follow the official release naming per platform', () => {
+  assert.equal(assetName('win32', 'x64'), 'Xray-windows-64.zip')
+  assert.equal(assetName('darwin', 'arm64'), 'Xray-macos-arm64-v8a.zip')
+  assert.equal(assetName('darwin', 'x64'), 'Xray-macos-64.zip')
+  assert.equal(assetName('linux', 'x64'), 'Xray-linux-64.zip')
+  assert.throws(() => assetName('aix', 'ppc64'), /unsupported/)
+})
+
+test('the .dgst parser reads the SHA2-256 line', () => {
+  const digest = 'SHA2-256: ' + 'a'.repeat(64) + '\n'
+  assert.equal(parseDigest(digest), 'a'.repeat(64))
+  assert.throws(() => parseDigest('SHA1: abc'), /SHA2-256/)
+})
+
+test('sha256 hashes the downloaded bytes', () => {
+  assert.equal(sha256(Buffer.from('abc')).length, 64)
+  assert.equal(dataBinDir().endsWith('bin'), true)
+})

package/test/route.test.js

@@ -156,3 +156,11 @@ test('a socks inbound always takes the builtin path', async () => {
   assert.equal(snapshot.mode, 'builtin')
   await route.restore()
 })
+
+test('the policy verification host is reserved and cannot be in noProxy', async () => {
+  const { PROBE_URL } = await import('../lib/route.js')
+  const url = new URL(PROBE_URL)
+  assert.equal(url.hostname, 'dsh-2xray-verify.invalid')
+  assert.equal(url.hostname.endsWith('.invalid'), true)
+  assert.notEqual(url.hostname, 'api.deepseek.com')
+})

package/test/routing.test.js

@@ -0,0 +1,73 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { normalizeConfig } from '../lib/config.js'
+import { buildXrayConfig } from '../lib/xray-config.js'
+
+function base(root = {}) {
+  return normalizeConfig({
+    enabled: true,
+    server: {
+      address: 'example.com',
+      port: 443,
+      uuid: '11111111-2222-4333-8444-555555555555',
+      serverName: 'www.example.com',
+      password: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      shortId: 'ab12',
+    },
+    ...root,
+  })
+}
+
+function rulesOf(config) {
+  return buildXrayConfig(config).routing.rules
+}
+
+test('global mode keeps the proxy catch-all and private direct rule', () => {
+  const { config, errors } = base()
+  assert.deepEqual(errors, [])
+  const rules = rulesOf(config)
+  assert.equal(buildXrayConfig(config).routing.domainStrategy, 'AsIs')
+  assert.ok(rules.some((rule) => Array.isArray(rule.ip) && rule.ip.includes('10.0.0.0/8')))
+  const catchAll = rules[rules.length - 1]
+  assert.equal(catchAll.network, 'tcp,udp')
+  assert.equal(catchAll.outboundTag, 'proxy')
+})
+
+test('cn-direct adds geosite:cn and geoip:cn direct rules', () => {
+  const { config } = base({ routing: { mode: 'cn-direct' } })
+  const rules = rulesOf(config)
+  assert.equal(buildXrayConfig(config).routing.domainStrategy, 'IPIfNonMatch')
+  assert.ok(rules.some((rule) => rule.domain?.includes('geosite:cn')))
+  assert.ok(rules.some((rule) => rule.ip?.includes('geoip:cn')))
+  assert.equal(rules[rules.length - 1].outboundTag, 'proxy')
+})
+
+test('whitelist mode proxies only listed domains and defaults to direct', () => {
+  const { config } = base({ routing: { mode: 'whitelist', whitelist: ['github.com', 'youtube.com'] } })
+  const rules = rulesOf(config)
+  const proxyRule = rules.find((rule) => rule.domain?.includes('domain:github.com'))
+  assert.ok(proxyRule)
+  assert.equal(proxyRule.outboundTag, 'proxy')
+  const catchAll = rules[rules.length - 1]
+  assert.equal(catchAll.outboundTag, 'direct')
+})
+
+test('blacklisted domains go direct and are added to noProxy', () => {
+  const { config } = base({ routing: { blacklist: ['https://api.deepseek.com/anthropic'] } })
+  const rules = rulesOf(config)
+  assert.equal(rules[0].outboundTag, 'direct')
+  assert.ok(rules[0].domain.includes('domain:api.deepseek.com'))
+  assert.match(config.noProxy, /(^|,)api\.deepseek\.com(,|$)/)
+  assert.equal(config.routing.blacklist.includes('api.deepseek.com'), true)
+})
+
+test('whitelist wins over bypassDomains but loses to the blacklist', () => {
+  const { config } = base({
+    routing: { mode: 'whitelist', whitelist: ['github.com'], blacklist: ['github.com'], bypassDomains: ['github.com'] },
+  })
+  const rules = rulesOf(config)
+  const black = rules.findIndex((rule) => rule.domain?.includes('domain:github.com') && rule.outboundTag === 'direct')
+  const white = rules.findIndex((rule) => rule.domain?.includes('domain:github.com') && rule.outboundTag === 'proxy')
+  assert.ok(black >= 0)
+  assert.equal(white, -1)
+})

package/tools/install-xray-core.mjs

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+/**
+ * Install an official Xray-core binary into the plugin data directory.
+ *
+ * The npm package does not embed five platform cores (that is ~150 MB). Instead
+ * this one-shot installer downloads the official release asset for the current
+ * platform, verifies the published SHA2-256 digest, extracts it, and places the
+ * binary where the plugin already looks: <dataDir>/bin/xray(.exe).
+ *
+ * Usage:
+ *   node tools/install-xray-core.mjs [version]
+ *   XRAY_VERSION=26.9.30 node tools/install-xray-core.mjs
+ *   DSH_XRAY_MIRROR=https://mirror.example/Xray-core/releases/download node tools/install-xray-core.mjs
+ */
+import { createHash } from 'node:crypto'
+import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { homedir, tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const DEFAULT_VERSION = '26.9.30'
+
+export function assetName(platform = process.platform, arch = process.arch) {
+  if (platform === 'win32' && arch === 'x64') return 'Xray-windows-64.zip'
+  if (platform === 'win32' && arch === 'arm64') return 'Xray-windows-arm64-v8a.zip'
+  if (platform === 'darwin' && arch === 'arm64') return 'Xray-macos-arm64-v8a.zip'
+  if (platform === 'darwin' && arch === 'x64') return 'Xray-macos-64.zip'
+  if (platform === 'linux' && arch === 'x64') return 'Xray-linux-64.zip'
+  if (platform === 'linux' && arch === 'arm64') return 'Xray-linux-arm64-v8a.zip'
+  throw new Error(`unsupported platform: ${platform}/${arch}`)
+}
+
+export function parseDigest(text) {
+  const match = String(text).match(/SHA2-256:\s*([0-9a-f]{64})/i)
+  if (!match) throw new Error('release digest has no SHA2-256 value')
+  return match[1].toLowerCase()
+}
+
+export function sha256(buffer) {
+  return createHash('sha256').update(buffer).digest('hex')
+}
+
+export function dataBinDir() {
+  const home = homedir()
+  return join(home, '.dsh', 'xray-proxy', 'bin')
+}
+
+async function download(url) {
+  const response = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(180000) })
+  if (!response.ok) throw new Error(`${url} -> HTTP ${response.status}`)
+  return Buffer.from(await response.arrayBuffer())
+}
+
+function extract(zip, destination) {
+  const attempts =
+    process.platform === 'win32'
+      ? [['tar', ['-xf', zip, '-C', destination]], ['powershell', ['-NoProfile', '-Command', `Expand-Archive -LiteralPath '${zip}' -DestinationPath '${destination}' -Force`]]]
+      : [['unzip', ['-o', zip, '-d', destination]], ['tar', ['-xf', zip, '-C', destination]]]
+  let lastError
+  for (const [command, args] of attempts) {
+    const result = spawnSync(command, args, { stdio: 'ignore' })
+    if (result.status === 0) return
+    lastError = result.error ?? new Error(`${command} exited ${result.status}`)
+  }
+  throw lastError
+}
+
+function findBinary(dir, name) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join(dir, entry.name)
+    if (entry.isFile() && entry.name === name) return full
+    if (entry.isDirectory()) {
+      const nested = findBinary(full, name)
+      if (nested) return nested
+    }
+  }
+  return undefined
+}
+
+export async function main() {
+  const version = process.argv[2] || process.env.XRAY_VERSION || DEFAULT_VERSION
+  const asset = assetName()
+  const mirror = (process.env.DSH_XRAY_MIRROR || 'https://github.com/XTLS/Xray-core/releases/download').replace(/\/$/, '')
+  const url = `${mirror}/v${version.replace(/^v/, '')}/${asset}`
+  const targetDir = dataBinDir()
+  const targetName = process.platform === 'win32' ? 'xray.exe' : 'xray'
+  const target = join(targetDir, targetName)
+
+  if (existsSync(target)) {
+    console.log(`already present: ${target}`)
+    return target
+  }
+
+  console.log(`downloading ${url}`)
+  const zip = await download(url)
+  console.log(`verifying ${asset}.dgst`)
+  const digestText = (await download(`${url}.dgst`)).toString('utf8')
+  const expected = parseDigest(digestText)
+  const actual = sha256(zip)
+  if (expected !== actual) throw new Error(`digest mismatch: expected ${expected}, got ${actual}`)
+
+  const workspace = mkdtempSync(join(tmpdir(), 'dsh-xray-core-'))
+  try {
+    const archive = join(workspace, asset)
+    writeFileSync(archive, zip)
+    const extracted = join(workspace, 'out')
+    mkdirSync(extracted, { recursive: true })
+    extract(archive, extracted)
+    const binary = findBinary(extracted, targetName)
+    if (!binary) throw new Error(`no ${targetName} inside ${asset}`)
+    mkdirSync(targetDir, { recursive: true })
+    copyFileSync(binary, target)
+    if (process.platform !== 'win32') chmodSync(target, 0o755)
+    console.log(`installed ${target} (${Math.round(statSync(target).size / 1048576)} MB, v${version})`)
+    return target
+  } finally {
+    rmSync(workspace, { recursive: true, force: true })
+  }
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  main().catch((error) => {
+    console.error(`install failed: ${error.message ?? error}`)
+    console.error('If GitHub is unreachable, set DSH_XRAY_MIRROR to a mirror and retry.')
+    process.exitCode = 1
+  })
+}