@twinsearth/dsh-2xray 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.3.1 — 2026-10-29
+
+### 修复
+
+- **入站端口护栏覆盖所有平台**：`inbound.port < 1024` 或与节点远端端口相同（如 556）时自动回落到 20808 并告警，避免把远端端口当本地监听。
+- **geodata 发现扩大**：当内核来自平台包、旁边没有 `geoip.dat`/`geosite.dat` 时，会扫描本机 v2rayN 安装目录并复制到数据目录，再设置 `XRAY_LOCATION_ASSET`。
+- **缺 geodata 不再 config-rejected**：cn-direct / geosite 规则缺数据文件时临时降级为 global，代理仍可用；状态新增 `routingFallback` 说明原因。
+
 ## 0.3.0 — 2026-10-29
 
 ### 更新中心

package/lib/assets.js

@@ -1,5 +1,6 @@
 import { copyFileSync, existsSync, mkdirSync } from 'node:fs'
 import { dirname, join } from 'node:path'
+import { defaultDiscoveryRoots, discoverXray } from './binary.js'
 
 const FILES = ['geoip.dat', 'geosite.dat']
 
@@ -8,7 +9,7 @@ const FILES = ['geoip.dat', 'geosite.dat']
  * XRAY_LOCATION_ASSET. A borrowed v2rayN binary keeps them one directory up,
  * so copy them into the managed data dir and point xray there.
  */
-export function ensureXrayAssets({ binaryPath, dataDir, logger } = {}) {
+export function ensureXrayAssets({ binaryPath, dataDir, logger, discoveryRoots } = {}) {
   if (!dataDir) return { dir: undefined, copied: [], missing: FILES }
   try {
     mkdirSync(dataDir, { recursive: true })
@@ -17,6 +18,18 @@ export function ensureXrayAssets({ binaryPath, dataDir, logger } = {}) {
     return { dir: dataDir, copied: [], missing: FILES }
   }
   const candidates = [dataDir, dirname(binaryPath ?? ''), dirname(dirname(binaryPath ?? ''))]
+  const missingBefore = FILES.some((name) => !existsSync(join(dataDir, name)))
+  if (missingBefore) {
+    // The resolved core may come from a package with no geodata. A local
+    // v2rayN install usually has geoip.dat/geosite.dat next to its binaries.
+    try {
+      for (const discovered of discoverXray({ roots: discoveryRoots ?? defaultDiscoveryRoots(), timeBudgetMs: 1500, max: 4 })) {
+        candidates.push(dirname(discovered), dirname(dirname(discovered)))
+      }
+    } catch {
+      // discovery is best-effort; the managed dir may already have the files
+    }
+  }
   const copied = []
   const missing = []
   for (const name of FILES) {

package/lib/config.js

@@ -392,11 +392,18 @@ export function normalizeConfig(raw) {
   }
   if (!Number.isInteger(inbound.port) || inbound.port < 1 || inbound.port > 65535) {
     errors.push({ field: 'inbound.port', message: '入站端口必须是 1..65535 的整数' })
-  } else if (inbound.port < 1024 && process.platform !== 'win32') {
+  } else {
     // A remote node port (e.g. 556) must never become the local listener:
-    // binding <1024 needs root on macOS/Linux and xray fails with EACCES.
-    warnings.push(`入站端口 ${inbound.port} 是特权端口，macOS/Linux 下无法绑定；已改用 ${DEFAULT_CONFIG.inbound.port}`)
-    inbound.port = DEFAULT_CONFIG.inbound.port
+    // <1024 needs root on macOS/Linux, and mirroring the server port makes the
+    // local proxy look like a second server. Always fall back to 20808.
+    if (inbound.port < 1024) {
+      warnings.push(`入站端口 ${inbound.port} 是特权端口；已改用 ${DEFAULT_CONFIG.inbound.port}`)
+      inbound.port = DEFAULT_CONFIG.inbound.port
+    }
+    if (nodes.some((node) => Number(node.port) === inbound.port)) {
+      warnings.push(`入站端口 ${inbound.port} 与节点远端端口相同；已改用 ${DEFAULT_CONFIG.inbound.port}`)
+      inbound.port = DEFAULT_CONFIG.inbound.port
+    }
   }
   if (socks.enabled) {
     if (!LOOPBACK_HOSTS.has(socks.host)) {

package/lib/supervisor.js

@@ -88,6 +88,7 @@ export class Supervisor {
   #control
   #activeNode
   #schemaLoaded = false
+  #routingFallback = null
   #now
 
   constructor({
@@ -223,12 +224,24 @@ export class Supervisor {
     this.#binary = binary
     if (signal.aborted) return
 
+    let effectiveConfig = this.config
+    this.#routingFallback = null
     if (this.dataDir) {
       const routing = this.config.routing ?? {}
       if (routing.mode === 'cn-direct' || routing.geositeCn || routing.blockAds) {
         const assets = ensureXrayAssets({ binaryPath: binary.path, dataDir: this.dataDir, logger: this.#logger })
         process.env.XRAY_LOCATION_ASSET = this.dataDir
         if (assets.copied.length > 0) this.#logger?.info?.(`已复制 xray 数据文件：${assets.copied.join(', ')}`)
+        if (assets.missing.length > 0) {
+          // Never let missing geodata turn into config-rejected: keep the
+          // tunnel usable with global routing and surface the degradation.
+          effectiveConfig = {
+            ...this.config,
+            routing: { ...routing, mode: 'global', geositeCn: false, blockAds: false },
+          }
+          this.#routingFallback = `缺少 ${assets.missing.join(', ')}，已临时降级为 global`
+          this.#logger?.warn?.(this.#routingFallback)
+        }
       }
     }
 
@@ -244,7 +257,7 @@ export class Supervisor {
     this.#version = version.version
     if (signal.aborted) return
 
-    const xrayConfig = buildXrayConfig(this.config)
+    const xrayConfig = buildXrayConfig(effectiveConfig)
     const text = JSON.stringify(xrayConfig, null, 2)
     this.#configHash = sha256(text)
     const configPath = join(this.dataDir, 'conf', 'xray-config.json')
@@ -505,12 +518,19 @@ export class Supervisor {
       }
     }
 
+    let effectiveConfig = this.config
     const routing = this.config.routing ?? {}
     if (routing.mode === 'cn-direct' || routing.geositeCn || routing.blockAds) {
-      ensureXrayAssets({ binaryPath: binary.path, dataDir: this.dataDir, logger: this.#logger })
+      const assets = ensureXrayAssets({ binaryPath: binary.path, dataDir: this.dataDir, logger: this.#logger })
+      if (assets.missing.length > 0) {
+        effectiveConfig = {
+          ...this.config,
+          routing: { ...routing, mode: 'global', geositeCn: false, blockAds: false },
+        }
+      }
     }
 
-    const built = buildXrayConfig(this.config)
+    const built = buildXrayConfig(effectiveConfig)
     const text = JSON.stringify(built, null, 2)
     const file = join(this.dataDir, 'conf', `validate-${Date.now()}-${process.pid}.json`)
     atomicWriteJson(file, built, 0o600)
@@ -711,6 +731,7 @@ export class Supervisor {
       enabled: this.config.enabled,
       takeover: this.config.takeover,
       settingsSchema: this.#schemaLoaded,
+      routingFallback: this.#routingFallback,
       nodes: this.config.nodes.map((node) => ({
         id: node.id,
         tag: node.tag,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twinsearth/dsh-2xray",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "private": false,
   "description": "DSH-2Xray: supervises xray-core and routes DSH process-wide HTTP(S) traffic through its local inbound, with optional multi-node gRPC control plane",
   "type": "module",

package/test/assets.test.js

@@ -26,7 +26,7 @@ test('geodata next to a v2rayN binary is copied into the managed data dir', () =
 test('missing geodata is reported rather than silently ignored', () => {
   const root = mkdtempSync(join(tmpdir(), 'dsh-xray-assets-'))
   try {
-    const result = ensureXrayAssets({ binaryPath: join(root, 'xray.exe'), dataDir: join(root, 'data') })
+    const result = ensureXrayAssets({ binaryPath: join(root, 'xray.exe'), dataDir: join(root, 'data'), discoveryRoots: [] })
     assert.deepEqual(result.copied, [])
     assert.deepEqual(result.missing.sort(), ['geoip.dat', 'geosite.dat'])
   } finally {

package/test/port-guard.test.js

@@ -0,0 +1,28 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { normalizeConfig } from '../lib/config.js'
+
+const base = (overrides = {}) => ({
+  enabled: true,
+  server: {
+    address: 'example.com',
+    port: 443,
+    uuid: '11111111-2222-4333-8444-555555555555',
+    serverName: 'www.example.com',
+    password: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+    shortId: 'ab12',
+  },
+  ...overrides,
+})
+
+test('a remote node port is never mirrored as the local inbound port', () => {
+  const { config, warnings } = normalizeConfig(base({ server: { address: 'example.com', port: 556, uuid: '11111111-2222-4333-8444-555555555555' }, inbound: { port: 556 } }))
+  assert.equal(config.inbound.port, 20808)
+  assert.ok(warnings.some((warning) => warning.includes('privileged') || warning.includes('特权')))
+})
+
+test('an inbound port equal to the node port falls back to 20808', () => {
+  const { config, warnings } = normalizeConfig(base({ server: { address: 'example.com', port: 8443, uuid: '11111111-2222-4333-8444-555555555555' }, inbound: { port: 8443 } }))
+  assert.equal(config.inbound.port, 20808)
+  assert.ok(warnings.some((warning) => warning.includes('remote') || warning.includes('远端')))
+})