@xcanwin/manyoyo 8.4.0 → 8.5.0

package/lib/egress-proxy.js

@@ -1,17 +1,16 @@
 'use strict';
 
-const crypto = require('crypto');
 const dns = require('dns').promises;
 const http = require('http');
 const net = require('net');
 const { domainAllowed, PRIVATE_V4, PRIVATE_V6 } = require('./network-policy');
-const { isValidId } = require('./container-state');
 
-// 域名白名单的强制执行点：serve 进程内的 HTTP(S) 过滤代理。
-// 开启 allowlist 的容器防火墙只放行到这个代理，直连被挡；这里按域名放行 CONNECT / 普通 HTTP，
+// 域名白名单的强制执行点：运行在 manyoyo 网络里专用 sidecar 容器中的 HTTP(S) 过滤代理（见 egress-sidecar.js）。
+// 开启 allowlist 的容器防火墙只放行到这个代理，直连被挡；这里按连接的来源 IP 认出是哪个容器（getClient），
+// 认不出的来源一律 403；按域名放行 CONNECT / 普通 HTTP，
 // 并且解析出的 IP 属于私有 / 环回 / 链路本地段一律拒绝（防借代理打宿主机 loopback 与 DNS 重绑定），
-// 除非该容器的 egress.rules 显式放行该 IP:端口。监听 0.0.0.0（容器只能经宿主机 LAN IP 访问宿主机），靠凭据挡局域网。
-const REALM = 'manyoyo';
+// 除非该容器的 egress.rules 显式放行该 IP:端口。
+// 被拒绝时统一回 403（带 Proxy-Status，不带任何能暴露代理身份的内容），并通过 onDenied 记录。
 const CONNECT_TIMEOUT_MS = 15000;
 const IDLE_TIMEOUT_MS = 10 * 60 * 1000;
 const MAX_TUNNELS_PER_CONTAINER = 256;
@@ -65,21 +64,6 @@ function ruleCovers(rule, ip, port) {
     return list.check(ip, family === 4 ? 'ipv4' : 'ipv6');
 }
 
-function parseBasicAuth(header) {
-    const m = /^Basic\s+([A-Za-z0-9+/=]+)$/.exec(String(header || '').trim());
-    if (!m) return null;
-    const decoded = Buffer.from(m[1], 'base64').toString('utf-8');
-    const i = decoded.indexOf(':');
-    if (i < 0) return null;
-    return { id: decoded.slice(0, i), token: decoded.slice(i + 1) };
-}
-
-function tokenEquals(a, b) {
-    const x = Buffer.from(String(a));
-    const y = Buffer.from(String(b));
-    return x.length === y.length && crypto.timingSafeEqual(x, y);
-}
-
 function parseTarget(text) {
     const m = /^(?:\[([0-9a-fA-F:.]+)\]|([^:/\s]+)):(\d{1,5})$/.exec(text);
     if (!m) return null;
@@ -90,40 +74,53 @@ function parseTarget(text) {
 
 /**
  * @param {object} options
- * @param {(id: string) => string|null} options.getToken 容器的代理 token（没有返回 null）
- * @param {(id: string) => {preset: string, domains: string[], rules: object[]}|null} options.getPolicy
+ * @param {(ip: string) => {id: string, preset: string, domains: string[], rules: object[]}|null} options.getClient 按来源 IP 认容器（认不出返回 null）
+ * @param {(event: {id: string, host: string, port: number, reason: string}) => void} [options.onDenied] 拒绝记录
  * @param {string} [options.upstream] 上游 HTTP 代理 URL（串联）
  * @param {(host: string) => Promise<string[]>} [options.lookup] 测试替身
  */
 function createEgressProxy(options) {
-    const getToken = options.getToken;
-    const getPolicy = options.getPolicy;
+    const getClient = options.getClient;
+    const onDenied = options.onDenied || (() => {});
     const lookup = options.lookup || (async host => (await dns.lookup(host, { all: true })).map(r => r.address));
-    let upstream = null;
-    if (options.upstream) {
-        try {
-            const url = new URL(options.upstream);
-            if (url.protocol === 'http:') {
-                upstream = { host: url.hostname.replace(/^\[|\]$/g, ''), port: Number(url.port) || 80, auth: url.username ? `Basic ${Buffer.from(`${decodeURIComponent(url.username)}:${decodeURIComponent(url.password)}`).toString('base64')}` : '' };
+    // upstream 可以是字符串或返回字符串的函数（sidecar 里按文件改动热更新）；解析结果按字符串缓存
+    let parsedFor = null;
+    let parsedUpstream = null;
+    function currentUpstream() {
+        const text = typeof options.upstream === 'function' ? options.upstream() : options.upstream;
+        if (text !== parsedFor) {
+            parsedFor = text;
+            parsedUpstream = null;
+            if (text) {
+                try {
+                    const url = new URL(text);
+                    if (url.protocol === 'http:') {
+                        parsedUpstream = { host: url.hostname.replace(/^\[|\]$/g, ''), port: Number(url.port) || 80, auth: url.username ? `Basic ${Buffer.from(`${decodeURIComponent(url.username)}:${decodeURIComponent(url.password)}`).toString('base64')}` : '' };
+                    }
+                } catch (e) { /* 无效上游当作没有 */ }
             }
-        } catch (e) { /* 无效上游当作没有 */ }
+        }
+        return parsedUpstream;
     }
     const tunnels = new Map();
     const sockets = new Set(); // CONNECT 劫持出来的 socket 不在 http.Server 的跟踪里，stop 时要自己关
     let server = null;
 
-    function authenticate(req) {
-        const cred = parseBasicAuth(req.headers['proxy-authorization']);
-        if (!cred || !isValidId(cred.id)) return null;
-        const token = getToken(cred.id);
-        if (!token || !tokenEquals(token, cred.token)) return null;
-        return cred.id;
+    function normalizeSource(address) {
+        const text = String(address || '');
+        return /^::ffff:\d+\.\d+\.\d+\.\d+$/i.test(text) ? text.slice(7) : text;
+    }
+
+    // 按来源 IP 认容器：返回 {id, policy}，认不出返回 null
+    function identify(socket) {
+        let client = null;
+        try { client = getClient(normalizeSource(socket.remoteAddress)); } catch (e) { client = null; }
+        return client && client.id ? { id: client.id, policy: client } : null;
     }
 
     // 返回 {ok:true, ip?} 或 {ok:false, status, message}
-    async function authorize(id, host, port) {
-        const policy = getPolicy(id);
-        if (!policy || policy.preset !== 'allowlist') return { ok: false, status: 403, message: 'policy' };
+    async function authorize(policy, host, port, upstream) {
+        if (!policy || policy.preset !== 'allowlist') return { ok: false, status: 403, message: 'domain' };
         const isIp = net.isIP(host) !== 0;
         const explicit = (ip, p) => (policy.rules || []).some(rule => ruleCovers(rule, ip, p));
         if (isIp) {
@@ -153,11 +150,21 @@ function createEgressProxy(options) {
         return { ok: true, ip: usable[0] };
     }
 
+    // Proxy-Status（RFC 9209）只带通用错误类型；拒绝一律 403，正文只有 Forbidden
+    function statusHeader(message) {
+        return message === 'address' ? 'proxy; error=destination_ip_prohibited' : 'proxy; error=http_request_denied';
+    }
+
     function reject(res, status, message) {
-        const headers = { 'Content-Type': 'text/plain; charset=utf-8', Connection: 'close' };
-        if (status === 407) headers['Proxy-Authenticate'] = `Basic realm="${REALM}"`;
+        const body = { 400: 'Bad Request', 403: 'Forbidden', 429: 'Too Many Requests' }[status] || 'Bad Gateway';
+        const headers = { 'Content-Type': 'text/plain; charset=utf-8', 'Content-Length': Buffer.byteLength(body), Connection: 'close' };
+        if (status === 403) headers['Proxy-Status'] = statusHeader(message);
         res.writeHead(status, headers);
-        res.end(`manyoyo egress proxy: ${message}\n`);
+        res.end(body);
+    }
+
+    function deny(client, host, port, reason) {
+        try { onDenied({ id: client ? client.id : '', host, port, reason }); } catch (e) { /* 记录失败不影响拒绝 */ }
     }
 
     function acquire(id) {
@@ -172,8 +179,8 @@ function createEgressProxy(options) {
         if (n <= 0) tunnels.delete(id); else tunnels.set(id, n);
     }
 
-    function rawReject(socket, status, text) {
-        const extra = status === 407 ? `Proxy-Authenticate: Basic realm="${REALM}"\r\n` : '';
+    function rawReject(socket, status, text, message) {
+        const extra = status === 403 ? `Proxy-Status: ${statusHeader(message)}\r\n` : '';
         socket.end(`HTTP/1.1 ${status} ${text}\r\n${extra}Connection: close\r\nContent-Length: 0\r\n\r\n`);
     }
 
@@ -186,12 +193,17 @@ function createEgressProxy(options) {
     async function onConnect(req, clientSocket, head) {
         track(clientSocket);
         clientSocket.on('error', () => {});
-        const id = authenticate(req);
-        if (!id) return rawReject(clientSocket, 407, 'Proxy Authentication Required');
+        const client = identify(clientSocket);
         const target = parseTarget(String(req.url || ''));
+        if (!client) return rawReject(clientSocket, 403, 'Forbidden', 'domain');
         if (!target) return rawReject(clientSocket, 400, 'Bad Request');
-        const verdict = await authorize(id, target.host, target.port);
-        if (!verdict.ok) return rawReject(clientSocket, verdict.status, verdict.status === 403 ? 'Forbidden' : 'Bad Gateway');
+        const id = client.id;
+        const upstream = currentUpstream();
+        const verdict = await authorize(client.policy, target.host, target.port, upstream);
+        if (!verdict.ok) {
+            if (verdict.status === 403) deny(client, target.host, target.port, verdict.message);
+            return rawReject(clientSocket, verdict.status, verdict.status === 403 ? 'Forbidden' : 'Bad Gateway', verdict.message);
+        }
         if (!acquire(id)) return rawReject(clientSocket, 429, 'Too Many Requests');
         let released = false;
         const done = () => { if (!released) { released = true; release(id); } };
@@ -239,17 +251,22 @@ function createEgressProxy(options) {
 
     // 普通 HTTP 代理（绝对 URI 请求）
     async function onRequest(req, res) {
-        const id = authenticate(req);
-        if (!id) return reject(res, 407, 'proxy authentication required');
+        const client = identify(req.socket);
+        if (!client) return reject(res, 403, 'domain');
+        const id = client.id;
         let url;
-        try { url = new URL(req.url); } catch (e) { return reject(res, 400, 'absolute URI required'); }
-        if (url.protocol !== 'http:') return reject(res, 400, 'only http: URIs');
+        try { url = new URL(req.url); } catch (e) { return reject(res, 400, 'bad request'); }
+        if (url.protocol !== 'http:') return reject(res, 400, 'bad request');
         const port = Number(url.port) || 80;
         const host = url.hostname.replace(/^\[|\]$/g, '').toLowerCase().replace(/\.$/, '');
-        const verdict = await authorize(id, host, port);
-        if (!verdict.ok) return reject(res, verdict.status, verdict.status === 403 ? 'forbidden by policy' : 'bad gateway');
-        if (!acquire(id)) return reject(res, 429, 'too many connections');
-        const headers = { ...req.headers };
+        const upstream = currentUpstream();
+        const verdict = await authorize(client.policy, host, port, upstream);
+        if (!verdict.ok) {
+            if (verdict.status === 403) deny(client, host, port, verdict.message);
+            return reject(res, verdict.status, verdict.message);
+        }
+        if (!acquire(id)) return reject(res, 429, 'limit');
+        const headers = { ...req.headers, host: url.host }; // 放行判断看的是 URL 里的主机，Host 头必须与它一致（RFC 9112）
         delete headers['proxy-authorization'];
         delete headers['proxy-connection'];
         const outbound = upstream
@@ -263,14 +280,14 @@ function createEgressProxy(options) {
             proxyRes.pipe(res);
         });
         proxyReq.on('timeout', () => proxyReq.destroy());
-        proxyReq.on('error', () => { if (!res.headersSent) reject(res, 502, 'bad gateway'); else res.destroy(); });
+        proxyReq.on('error', () => { if (!res.headersSent) reject(res, 502, 'upstream'); else res.destroy(); });
         res.on('close', () => { done(); proxyReq.destroy(); });
         req.pipe(proxyReq);
     }
 
     function start(listen) {
         return new Promise((resolve, fail) => {
-            server = http.createServer((req, res) => { onRequest(req, res).catch(() => { try { reject(res, 500, 'error'); } catch (e) { /* 连接已断 */ } }); });
+            server = http.createServer((req, res) => { onRequest(req, res).catch(() => { try { reject(res, 500, 'upstream'); } catch (e) { /* 连接已断 */ } }); });
             server.on('connect', (req, socket, head) => { onConnect(req, socket, head).catch(() => socket.destroy()); });
             server.headersTimeout = 20000;
             server.on('clientError', (err, socket) => socket.destroy());
@@ -295,4 +312,4 @@ function createEgressProxy(options) {
     return { start, stop, authorize, isListening: () => Boolean(server && server.listening) };
 }
 
-module.exports = { createEgressProxy, isRestrictedAddress, ruleCovers, parseBasicAuth, parseTarget, REALM };
+module.exports = { createEgressProxy, isRestrictedAddress, ruleCovers, parseTarget };

package/lib/egress-sidecar-main.js

@@ -0,0 +1,112 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { createEgressProxy } = require('./egress-proxy');
+const { createRecorder } = require('./egress-denied');
+
+// 过滤代理 sidecar 容器里的入口（宿主机把这几个文件只读挂进来，见 egress-sidecar.js）。
+// 数据目录（只读）：clients.json（来源 IP → 容器 id + 策略，宿主机在每次下发规则时原子替换）、upstream.txt（可选，上游代理）；
+// 拒绝记录目录（读写）：<容器 id>.jsonl。
+const CLIENTS_FILE = 'clients.json';
+const UPSTREAM_FILE = 'upstream.txt';
+const RELOAD_CHECK_MS = 500;
+
+function loadClients(file) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        const clients = parsed && typeof parsed.clients === 'object' && parsed.clients ? parsed.clients : {};
+        return new Map(Object.entries(clients));
+    } catch (e) {
+        return new Map(); // 读不到 / 损坏：谁都不认识，全部 403（失败即关闭）
+    }
+}
+
+/**
+ * @param {object} options
+ * @param {string} options.dataDir
+ * @param {string} options.deniedDir
+ * @param {number} options.port
+ * @param {string} [options.host]
+ * @param {(host: string) => Promise<string[]>} [options.lookup]
+ */
+async function start(options) {
+    const clientsFile = path.join(options.dataDir, CLIENTS_FILE);
+    // 上游代理：upstream.txt 变了就热更新（CLI 与 serve 的环境可能不同，不能为此重建容器）
+    const upstreamFile = path.join(options.dataDir, UPSTREAM_FILE);
+    let upstream = '';
+    let upstreamSig = '';
+    let upstreamCheckedAt = 0;
+    const getUpstream = () => {
+        const nowMs = Date.now();
+        if (nowMs - upstreamCheckedAt < RELOAD_CHECK_MS) return upstream;
+        upstreamCheckedAt = nowMs;
+        try {
+            const stat = fs.statSync(upstreamFile);
+            const sig = `${stat.mtimeMs}:${stat.size}:${stat.ino}`;
+            if (sig !== upstreamSig) {
+                upstreamSig = sig;
+                upstream = fs.readFileSync(upstreamFile, 'utf-8').trim();
+            }
+        } catch (e) {
+            upstreamSig = '';
+            upstream = '';
+        }
+        return upstream;
+    };
+
+    let clients = loadClients(clientsFile);
+    let signature = '';
+    let checkedAt = 0;
+    const refresh = () => {
+        const nowMs = Date.now();
+        if (nowMs - checkedAt < RELOAD_CHECK_MS) return;
+        checkedAt = nowMs;
+        try {
+            const stat = fs.statSync(clientsFile);
+            const next = `${stat.mtimeMs}:${stat.size}:${stat.ino}`;
+            if (next !== signature) {
+                signature = next;
+                clients = loadClients(clientsFile);
+            }
+        } catch (e) {
+            signature = '';
+            clients = new Map();
+        }
+    };
+
+    const recorder = createRecorder({ dir: options.deniedDir });
+    const proxy = createEgressProxy({
+        upstream: getUpstream,
+        lookup: options.lookup,
+        getClient: ip => {
+            refresh();
+            const entry = clients.get(ip);
+            return entry ? { ...entry } : null;
+        },
+        onDenied: event => recorder.record(event)
+    });
+    const port = await proxy.start({ host: options.host || '0.0.0.0', port: options.port });
+    return {
+        port,
+        stop: async () => { recorder.stop(); await proxy.stop(); }
+    };
+}
+
+if (require.main === module) {
+    start({
+        dataDir: process.env.EGRESS_DATA_DIR || '/data',
+        deniedDir: process.env.EGRESS_DENIED_DIR || '/denied',
+        port: Number(process.env.EGRESS_PORT) || 3128
+    }).then(server => {
+        process.stdout.write(`egress-proxy ready ${server.port}\n`);
+        const shutdown = () => server.stop().finally(() => process.exit(0));
+        process.on('SIGTERM', shutdown);
+        process.on('SIGINT', shutdown);
+    }).catch(error => {
+        process.stderr.write(`egress-proxy failed: ${error.message}\n`);
+        process.exit(1);
+    });
+}
+
+module.exports = { start, CLIENTS_FILE, UPSTREAM_FILE };

package/lib/egress-sidecar.js

@@ -0,0 +1,276 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const net = require('net');
+const os = require('os');
+const path = require('path');
+const { writeConfigFileSecure } = require('./secure-file');
+
+// 域名白名单的强制执行点：manyoyo 网络里的一个专用小容器（sidecar），里面用镜像自带的 node 跑 egress-proxy。
+// - 容器按“来源 IP”识别：宿主机在每次下发规则时把「容器 IP → 容器 id + 策略」写进 clients.json（只读挂入），
+//   认不出的来源一律 403；宿主机上不监听任何端口，同机其他用户无法占用或冒充。
+// - 固定 IP（--ip）：重启后不变，容器的代理地址与 nft 规则才能稳定。
+// - sidecar 只读挂入程序文件和数据目录，只有拒绝记录目录可写；丢掉全部能力。
+const SIDECAR_PORT = 3128;
+const APP_FILES = ['egress-sidecar-main.js', 'egress-proxy.js', 'egress-denied.js', 'network-policy.js', 'container-id.js'];
+const READY_TIMEOUT_MS = 15000;
+
+function egressDir(homeDir) {
+    return path.join(homeDir, '.manyoyo', 'egress');
+}
+
+function egressPaths(homeDir) {
+    const dir = egressDir(homeDir);
+    return { dir, app: path.join(dir, 'app'), data: path.join(dir, 'data'), denied: path.join(dir, 'denied') };
+}
+
+function homeHash(homeDir) {
+    return crypto.createHash('sha256').update(path.resolve(homeDir)).digest('hex').slice(0, 8);
+}
+
+function sidecarName(homeDir) {
+    return `manyoyo-egress-${homeHash(homeDir)}`;
+}
+
+// 任何 HOME 的过滤代理 sidecar 名字：容器列表（网页 / ls）里要排除，它不是用户的会话容器
+function isSidecarName(name) {
+    return /^manyoyo-egress-[0-9a-f]{8}$/.test(String(name || ''));
+}
+
+function ensureDir(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.chmodSync(dir, 0o700); // 只限制宿主机其他用户；容器里的 root（rootless 下就是宿主机用户，rootful 下是真 root）不受影响
+}
+
+function writeAtomic(file, text, mode) {
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, text, { mode });
+    fs.chmodSync(tmp, mode);
+    fs.renameSync(tmp, file);
+}
+
+function ipv4ToInt(ip) {
+    return ip.split('.').reduce((acc, part) => ((acc << 8) | Number(part)) >>> 0, 0);
+}
+
+function intToIpv4(value) {
+    return [24, 16, 8, 0].map(shift => (value >>> shift) & 255).join('.');
+}
+
+/**
+ * 在 manyoyo 网络网段里选 sidecar 的固定地址：网段内偏移 250（/24 即 .250），不同 HOME 的实例在
+ * 250 往下的几个地址里按 HOME 哈希错开；真的撞上了由 `run --ip` 报“地址已占用”，不会随机换。
+ */
+function chooseSidecarIp(subnet, homeDir) {
+    const m = /^(\d+\.\d+\.\d+\.\d+)\/(\d+)$/.exec(String(subnet || ''));
+    if (!m || !net.isIPv4(m[1])) throw new Error(`无法确定 manyoyo 网络的网段: ${subnet}`);
+    const prefix = Number(m[2]);
+    if (prefix < 8 || prefix > 29) throw new Error(`manyoyo 网络网段不适合放过滤代理: ${subnet}`);
+    const size = 2 ** (32 - prefix);
+    const base = (ipv4ToInt(m[1]) & ((0xffffffff << (32 - prefix)) >>> 0)) >>> 0;
+    const slot = parseInt(homeHash(homeDir), 16) % 5;
+    const offset = size > 256 ? 250 - slot : Math.max(2, size - 6 - slot);
+    return intToIpv4((base + offset) >>> 0);
+}
+
+// docker：IPAM.Config[].Subnet；podman 4/5：subnets[].subnet；返回第一个 IPv4 网段
+function subnetOfNetwork(inspectJson) {
+    const parsed = Array.isArray(inspectJson) ? inspectJson[0] : inspectJson;
+    const candidates = [];
+    ((parsed && parsed.IPAM && parsed.IPAM.Config) || []).forEach(c => candidates.push(c.Subnet));
+    ((parsed && (parsed.subnets || parsed.Subnets)) || []).forEach(c => candidates.push(c.subnet || c.Subnet));
+    return candidates.find(s => /^\d+\.\d+\.\d+\.\d+\/\d+$/.test(String(s || ''))) || '';
+}
+
+// 上游代理在宿主机上的地址对 sidecar 容器可能不通：环回地址改写成容器看到的宿主机别名
+function containerSideUpstream(upstream, hostAlias) {
+    if (!upstream) return '';
+    try {
+        const url = new URL(upstream);
+        if (url.protocol !== 'http:') return '';
+        if (/^(localhost|127\.\d+\.\d+\.\d+|\[?::1\]?)$/i.test(url.hostname)) url.hostname = hostAlias;
+        return url.toString().replace(/\/$/, '');
+    } catch (e) {
+        return '';
+    }
+}
+
+// 固定 MAC（同 docker 的 02:42:<IP 四字节> 规则）：重启后 MAC 变了，别的容器里缓存的 ARP 要等一分钟才失效，期间出网不通
+function macForIp(ip) {
+    return `02:42:${ip.split('.').map(part => Number(part).toString(16).padStart(2, '0')).join(':')}`;
+}
+
+function appFileContents() {
+    return APP_FILES.map(name => [name, fs.readFileSync(path.join(__dirname, name), 'utf-8')]);
+}
+
+/**
+ * @param {object} options
+ * @param {(args: string[], opts?: object) => Promise<string>} options.run 运行时命令（容器运行时 CLI）
+ * @param {string} options.command 运行时命令名（docker / podman，用来判断宿主机别名）
+ * @param {string} options.homeDir
+ * @param {() => string} options.imageRef 当前镜像
+ * @param {string} options.networkName manyoyo 网络名
+ * @param {() => Promise<void>} options.ensureNetwork
+ * @param {() => string} [options.getUpstream] 上游代理（宿主机视角）
+ */
+function createSidecarManager(options) {
+    const { run, homeDir, networkName } = options;
+    const getUpstream = options.getUpstream || (() => '');
+    const isDocker = /docker/i.test(path.basename(String(options.command || '')));
+    const hostAlias = isDocker ? 'host.docker.internal' : 'host.containers.internal';
+    const name = sidecarName(homeDir);
+    const hash = homeHash(homeDir);
+    let inflight = null;
+    let lastClients = '';
+
+    async function inspectSidecar() {
+        try {
+            const out = await run(['inspect', '--format', '{{json .}}', name]);
+            const line = out.split('\n').map(l => l.trim()).filter(Boolean)[0];
+            return line ? JSON.parse(line) : null;
+        } catch (e) {
+            if (/no such|not found|no container|does not exist/i.test(String(e.message))) return null;
+            throw e;
+        }
+    }
+
+    function ipOf(info) {
+        const networks = (info.NetworkSettings && info.NetworkSettings.Networks) || {};
+        return (networks[networkName] && networks[networkName].IPAddress) || '';
+    }
+
+    function runningOf(info) {
+        return Boolean(info.State && (info.State.Running === true || info.State.Status === 'running'));
+    }
+
+    function prepareFiles(upstream) {
+        const p = egressPaths(homeDir);
+        ensureDir(path.join(homeDir, '.manyoyo'));
+        ensureDir(p.dir);
+        [p.app, p.data, p.denied].forEach(ensureDir);
+        const contents = appFileContents();
+        contents.forEach(([file, text]) => {
+            const target = path.join(p.app, file);
+            if (!fs.existsSync(target) || fs.readFileSync(target, 'utf-8') !== text) writeAtomic(target, text, 0o644);
+        });
+        const upstreamFile = path.join(p.data, 'upstream.txt');
+        if (upstream) writeConfigFileSecure(upstreamFile, `${upstream}\n`);
+        else fs.rmSync(upstreamFile, { force: true });
+        const rev = crypto.createHash('sha256');
+        contents.forEach(([file, text]) => rev.update(`${file}\0${text}\0`));
+        return { p, rev: rev.digest('hex').slice(0, 16) };
+    }
+
+    // 就绪 = 在 sidecar 里真的连得上代理端口（不能看日志：重启后日志里还留着上一次的“ready”）
+    async function waitReady() {
+        const deadline = Date.now() + READY_TIMEOUT_MS;
+        const probe = `require('net').connect(${SIDECAR_PORT},'127.0.0.1').on('connect',()=>process.exit(0)).on('error',()=>process.exit(1))`;
+        while (Date.now() < deadline) {
+            const info = await inspectSidecar();
+            if (!info || !runningOf(info)) break;
+            try {
+                await run(['exec', name, 'node', '-e', probe], { timeout: 5000 });
+                return;
+            } catch (e) { /* 还没起来 */ }
+            await new Promise(resolve => setTimeout(resolve, 150));
+        }
+        let tail = '';
+        try { tail = await run(['logs', '--tail', '5', name]); } catch (e) { /* 取不到就算了 */ }
+        throw new Error(`域名白名单代理没有起来${tail ? `: ${String(tail).trim().split('\n').slice(-2).join(' ')}` : ''}`);
+    }
+
+    async function doEnsure() {
+        await options.ensureNetwork();
+        const subnet = subnetOfNetwork(JSON.parse((await run(['network', 'inspect', networkName, '--format', '{{json .}}'])).trim().split('\n')[0] || 'null'));
+        const ip = chooseSidecarIp(subnet, homeDir);
+        const upstream = containerSideUpstream(getUpstream(), hostAlias);
+        const { p, rev } = prepareFiles(upstream);
+        let info = await inspectSidecar();
+        const labels = (info && info.Config && info.Config.Labels) || {};
+        const matches = info && labels['manyoyo.egress.rev'] === rev && labels['manyoyo.home'] === hash;
+        if (matches && runningOf(info) && ipOf(info) === ip) return { name, ip, port: SIDECAR_PORT };
+        if (matches && !runningOf(info)) {
+            try {
+                await run(['start', name]);
+                info = await inspectSidecar();
+                if (info && runningOf(info) && ipOf(info) === ip) {
+                    await waitReady();
+                    return { name, ip, port: SIDECAR_PORT };
+                }
+            } catch (e) { /* 起不来就重建 */ }
+        }
+        if (info) await run(['rm', '-f', name]);
+        const args = [
+            'run', '-d', '--name', name,
+            '--network', networkName, '--ip', ip, '--mac-address', macForIp(ip),
+            // 宿主机上这几个目录属于普通用户且是 0700：rootful 运行时里的 root 不带 DAC_OVERRIDE 就进不去（rootless 下 root 就是该用户，不受影响）
+            '--user', 'root', '--cap-drop', 'ALL', '--cap-add', 'DAC_OVERRIDE', '--security-opt', 'no-new-privileges',
+            '--read-only', '--tmpfs', '/tmp', '--pids-limit', '256', '--memory', '256m',
+            '--pull=never',
+            '--label', 'manyoyo.role=egress', '--label', `manyoyo.home=${hash}`, '--label', `manyoyo.egress.rev=${rev}`,
+            '--volume', `${p.app}:/app:ro`, '--volume', `${p.data}:/data:ro`, '--volume', `${p.denied}:/denied`,
+            '--env', `EGRESS_PORT=${SIDECAR_PORT}`
+        ];
+        if (isDocker) args.push('--add-host', 'host.docker.internal:host-gateway');
+        args.push('--entrypoint', 'node', options.imageRef(), '/app/egress-sidecar-main.js');
+        try {
+            await run(args, { timeout: 60000 });
+        } catch (e) {
+            const message = String(e.message);
+            // 另一个进程（CLI / serve）刚好同时建好了它：直接用现成的
+            if (/name .*(already in use|is already used)|already in use by container|name is already/i.test(message)) {
+                const other = await inspectSidecar();
+                if (other && runningOf(other) && ipOf(other) === ip) {
+                    await waitReady();
+                    return { name, ip, port: SIDECAR_PORT };
+                }
+            }
+            throw new Error(/address already in use|ip.*(used|allocated)|in use/i.test(message) && !/name/i.test(message)
+                ? `域名白名单代理需要的地址 ${ip} 已被占用（${networkName} 网络里有别的容器用了它）`
+                : `域名白名单代理启动失败: ${message}`);
+        }
+        await waitReady();
+        return { name, ip, port: SIDECAR_PORT };
+    }
+
+    /** 保证 sidecar 在运行，返回 {name, ip, port}；多处同时调用合并成一次。 */
+    function ensure() {
+        if (!inflight) inflight = doEnsure().finally(() => { inflight = null; });
+        return inflight;
+    }
+
+    /** 只读检查：sidecar 现在是否在运行且地址正确（ensureReady 的快速路径用）。 */
+    async function isHealthy() {
+        const info = await inspectSidecar();
+        return Boolean(info && runningOf(info));
+    }
+
+    /** 写入「来源 IP → 容器 id + 策略」；内容没变就不写（避免无谓刷新）。 */
+    function writeClients(clients) {
+        const p = egressPaths(homeDir);
+        ensureDir(p.dir);
+        ensureDir(p.data);
+        const text = `${JSON.stringify({ clients }, null, 2)}\n`;
+        if (text === lastClients && fs.existsSync(path.join(p.data, 'clients.json'))) return;
+        writeAtomic(path.join(p.data, 'clients.json'), text, 0o644);
+        lastClients = text;
+    }
+
+    return { name, ensure, isHealthy, writeClients, paths: () => egressPaths(homeDir), isSidecarName: n => n === name };
+}
+
+module.exports = {
+    SIDECAR_PORT,
+    APP_FILES,
+    egressDir,
+    egressPaths,
+    sidecarName,
+    isSidecarName,
+    chooseSidecarIp,
+    macForIp,
+    subnetOfNetwork,
+    containerSideUpstream,
+    createSidecarManager
+};

package/lib/json5-text-edit.js

@@ -232,7 +232,7 @@ function applyTextReplacements(text, replacements) {
 }
 
 function formatPropertyKey(key) {
-    return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
+    return JSON.stringify(key);
 }
 
 // 某个位置所在行的缩进
@@ -246,8 +246,7 @@ function reindent(valueText, indent) {
     return String(valueText).replace(/\n/g, `\n${indent}`);
 }
 
-// 永远只在对象的 '{' 后面插入，不管这个对象原来是空的还是已经有属性——
-// 不用去判断"是不是最后一个属性、要不要补逗号"，语法上总是安全的
+// 永远只在对象的 '{' 后面插入；对象原来已有属性才补逗号，空对象里插入第一个属性不留尾逗号
 function insertObjectProperty(text, objectStartIndex, key, valueText) {
     const objectIndent = lineIndentAt(text, objectStartIndex);
     const childIndent = `${objectIndent}    `;
@@ -256,8 +255,9 @@ function insertObjectProperty(text, objectStartIndex, key, valueText) {
     const lineEnd = text.indexOf('\n', objectStartIndex + 1);
     const tailIsTrivia = lineEnd !== -1 && /^\s*(\/\/.*)?$/.test(text.slice(objectStartIndex + 1, lineEnd));
     // 空对象且 } 紧跟在同一行：闭合的 } 另起一行；} 已在后面的行上就不再补，避免多出空行
-    const closesRightAfter = !tailIsTrivia && text[skipTrivia(text, objectStartIndex + 1)] === '}';
-    const insertion = `${prefix}${reindent(valueText, childIndent)},${closesRightAfter ? `\n${objectIndent}` : ''}`;
+    const nextChar = text[skipTrivia(text, objectStartIndex + 1)];
+    const closesRightAfter = !tailIsTrivia && nextChar === '}';
+    const insertion = `${prefix}${reindent(valueText, childIndent)}${nextChar === '}' ? '' : ','}${closesRightAfter ? `\n${objectIndent}` : ''}`;
     const insertPos = tailIsTrivia ? lineEnd : objectStartIndex + 1;
     const nextText = `${text.slice(0, insertPos)}${insertion}${text.slice(insertPos)}`;
     return { text: nextText, valueStart: insertPos + prefix.length };