@xcanwin/manyoyo 8.4.0 → 8.5.1

package/lib/egress-sidecar-main.js

@@ -0,0 +1,112 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { createEgressProxy } = require('./egress-proxy');
+const { createRecorder } = require('./egress-denied');
+
+// 过滤代理 sidecar 容器里的入口（宿主机把这几个文件只读挂进来，见 egress-sidecar.js）。
+// 数据目录（只读）：clients.json（来源 IP → 容器 id + 策略，宿主机在每次下发规则时原子替换）、upstream.txt（可选，上游代理）；
+// 拒绝记录目录（读写）：<容器 id>.jsonl。
+const CLIENTS_FILE = 'clients.json';
+const UPSTREAM_FILE = 'upstream.txt';
+const RELOAD_CHECK_MS = 500;
+
+function loadClients(file) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        const clients = parsed && typeof parsed.clients === 'object' && parsed.clients ? parsed.clients : {};
+        return new Map(Object.entries(clients));
+    } catch (e) {
+        return new Map(); // 读不到 / 损坏：谁都不认识，全部 403（失败即关闭）
+    }
+}
+
+/**
+ * @param {object} options
+ * @param {string} options.dataDir
+ * @param {string} options.deniedDir
+ * @param {number} options.port
+ * @param {string} [options.host]
+ * @param {(host: string) => Promise<string[]>} [options.lookup]
+ */
+async function start(options) {
+    const clientsFile = path.join(options.dataDir, CLIENTS_FILE);
+    // 上游代理：upstream.txt 变了就热更新（CLI 与 serve 的环境可能不同，不能为此重建容器）
+    const upstreamFile = path.join(options.dataDir, UPSTREAM_FILE);
+    let upstream = '';
+    let upstreamSig = '';
+    let upstreamCheckedAt = 0;
+    const getUpstream = () => {
+        const nowMs = Date.now();
+        if (nowMs - upstreamCheckedAt < RELOAD_CHECK_MS) return upstream;
+        upstreamCheckedAt = nowMs;
+        try {
+            const stat = fs.statSync(upstreamFile);
+            const sig = `${stat.mtimeMs}:${stat.size}:${stat.ino}`;
+            if (sig !== upstreamSig) {
+                upstreamSig = sig;
+                upstream = fs.readFileSync(upstreamFile, 'utf-8').trim();
+            }
+        } catch (e) {
+            upstreamSig = '';
+            upstream = '';
+        }
+        return upstream;
+    };
+
+    let clients = loadClients(clientsFile);
+    let signature = '';
+    let checkedAt = 0;
+    const refresh = () => {
+        const nowMs = Date.now();
+        if (nowMs - checkedAt < RELOAD_CHECK_MS) return;
+        checkedAt = nowMs;
+        try {
+            const stat = fs.statSync(clientsFile);
+            const next = `${stat.mtimeMs}:${stat.size}:${stat.ino}`;
+            if (next !== signature) {
+                signature = next;
+                clients = loadClients(clientsFile);
+            }
+        } catch (e) {
+            signature = '';
+            clients = new Map();
+        }
+    };
+
+    const recorder = createRecorder({ dir: options.deniedDir });
+    const proxy = createEgressProxy({
+        upstream: getUpstream,
+        lookup: options.lookup,
+        getClient: ip => {
+            refresh();
+            const entry = clients.get(ip);
+            return entry ? { ...entry } : null;
+        },
+        onDenied: event => recorder.record(event)
+    });
+    const port = await proxy.start({ host: options.host || '0.0.0.0', port: options.port });
+    return {
+        port,
+        stop: async () => { recorder.stop(); await proxy.stop(); }
+    };
+}
+
+if (require.main === module) {
+    start({
+        dataDir: process.env.EGRESS_DATA_DIR || '/data',
+        deniedDir: process.env.EGRESS_DENIED_DIR || '/denied',
+        port: Number(process.env.EGRESS_PORT) || 3128
+    }).then(server => {
+        process.stdout.write(`egress-proxy ready ${server.port}\n`);
+        const shutdown = () => server.stop().finally(() => process.exit(0));
+        process.on('SIGTERM', shutdown);
+        process.on('SIGINT', shutdown);
+    }).catch(error => {
+        process.stderr.write(`egress-proxy failed: ${error.message}\n`);
+        process.exit(1);
+    });
+}
+
+module.exports = { start, CLIENTS_FILE, UPSTREAM_FILE };

package/lib/egress-sidecar.js

@@ -0,0 +1,276 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const net = require('net');
+const os = require('os');
+const path = require('path');
+const { writeConfigFileSecure } = require('./secure-file');
+
+// 域名白名单的强制执行点：manyoyo 网络里的一个专用小容器（sidecar），里面用镜像自带的 node 跑 egress-proxy。
+// - 容器按“来源 IP”识别：宿主机在每次下发规则时把「容器 IP → 容器 id + 策略」写进 clients.json（只读挂入），
+//   认不出的来源一律 403；宿主机上不监听任何端口，同机其他用户无法占用或冒充。
+// - 固定 IP（--ip）：重启后不变，容器的代理地址与 nft 规则才能稳定。
+// - sidecar 只读挂入程序文件和数据目录，只有拒绝记录目录可写；丢掉全部能力。
+const SIDECAR_PORT = 3128;
+const APP_FILES = ['egress-sidecar-main.js', 'egress-proxy.js', 'egress-denied.js', 'network-policy.js', 'container-id.js'];
+const READY_TIMEOUT_MS = 15000;
+
+function egressDir(homeDir) {
+    return path.join(homeDir, '.manyoyo', 'egress');
+}
+
+function egressPaths(homeDir) {
+    const dir = egressDir(homeDir);
+    return { dir, app: path.join(dir, 'app'), data: path.join(dir, 'data'), denied: path.join(dir, 'denied') };
+}
+
+function homeHash(homeDir) {
+    return crypto.createHash('sha256').update(path.resolve(homeDir)).digest('hex').slice(0, 8);
+}
+
+function sidecarName(homeDir) {
+    return `manyoyo-egress-${homeHash(homeDir)}`;
+}
+
+// 任何 HOME 的过滤代理 sidecar 名字：容器列表（网页 / ls）里要排除，它不是用户的会话容器
+function isSidecarName(name) {
+    return /^manyoyo-egress-[0-9a-f]{8}$/.test(String(name || ''));
+}
+
+function ensureDir(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.chmodSync(dir, 0o700); // 只限制宿主机其他用户；容器里的 root（rootless 下就是宿主机用户，rootful 下是真 root）不受影响
+}
+
+function writeAtomic(file, text, mode) {
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, text, { mode });
+    fs.chmodSync(tmp, mode);
+    fs.renameSync(tmp, file);
+}
+
+function ipv4ToInt(ip) {
+    return ip.split('.').reduce((acc, part) => ((acc << 8) | Number(part)) >>> 0, 0);
+}
+
+function intToIpv4(value) {
+    return [24, 16, 8, 0].map(shift => (value >>> shift) & 255).join('.');
+}
+
+/**
+ * 在 manyoyo 网络网段里选 sidecar 的固定地址：网段内偏移 250（/24 即 .250），不同 HOME 的实例在
+ * 250 往下的几个地址里按 HOME 哈希错开；真的撞上了由 `run --ip` 报“地址已占用”，不会随机换。
+ */
+function chooseSidecarIp(subnet, homeDir) {
+    const m = /^(\d+\.\d+\.\d+\.\d+)\/(\d+)$/.exec(String(subnet || ''));
+    if (!m || !net.isIPv4(m[1])) throw new Error(`无法确定 manyoyo 网络的网段: ${subnet}`);
+    const prefix = Number(m[2]);
+    if (prefix < 8 || prefix > 29) throw new Error(`manyoyo 网络网段不适合放过滤代理: ${subnet}`);
+    const size = 2 ** (32 - prefix);
+    const base = (ipv4ToInt(m[1]) & ((0xffffffff << (32 - prefix)) >>> 0)) >>> 0;
+    const slot = parseInt(homeHash(homeDir), 16) % 5;
+    const offset = size > 256 ? 250 - slot : Math.max(2, size - 6 - slot);
+    return intToIpv4((base + offset) >>> 0);
+}
+
+// docker：IPAM.Config[].Subnet；podman 4/5：subnets[].subnet；返回第一个 IPv4 网段
+function subnetOfNetwork(inspectJson) {
+    const parsed = Array.isArray(inspectJson) ? inspectJson[0] : inspectJson;
+    const candidates = [];
+    ((parsed && parsed.IPAM && parsed.IPAM.Config) || []).forEach(c => candidates.push(c.Subnet));
+    ((parsed && (parsed.subnets || parsed.Subnets)) || []).forEach(c => candidates.push(c.subnet || c.Subnet));
+    return candidates.find(s => /^\d+\.\d+\.\d+\.\d+\/\d+$/.test(String(s || ''))) || '';
+}
+
+// 上游代理在宿主机上的地址对 sidecar 容器可能不通：环回地址改写成容器看到的宿主机别名
+function containerSideUpstream(upstream, hostAlias) {
+    if (!upstream) return '';
+    try {
+        const url = new URL(upstream);
+        if (url.protocol !== 'http:') return '';
+        if (/^(localhost|127\.\d+\.\d+\.\d+|\[?::1\]?)$/i.test(url.hostname)) url.hostname = hostAlias;
+        return url.toString().replace(/\/$/, '');
+    } catch (e) {
+        return '';
+    }
+}
+
+// 固定 MAC（同 docker 的 02:42:<IP 四字节> 规则）：重启后 MAC 变了，别的容器里缓存的 ARP 要等一分钟才失效，期间出网不通
+function macForIp(ip) {
+    return `02:42:${ip.split('.').map(part => Number(part).toString(16).padStart(2, '0')).join(':')}`;
+}
+
+function appFileContents() {
+    return APP_FILES.map(name => [name, fs.readFileSync(path.join(__dirname, name), 'utf-8')]);
+}
+
+/**
+ * @param {object} options
+ * @param {(args: string[], opts?: object) => Promise<string>} options.run 运行时命令（容器运行时 CLI）
+ * @param {string} options.command 运行时命令名（docker / podman，用来判断宿主机别名）
+ * @param {string} options.homeDir
+ * @param {() => string} options.imageRef 当前镜像
+ * @param {string} options.networkName manyoyo 网络名
+ * @param {() => Promise<void>} options.ensureNetwork
+ * @param {() => string} [options.getUpstream] 上游代理（宿主机视角）
+ */
+function createSidecarManager(options) {
+    const { run, homeDir, networkName } = options;
+    const getUpstream = options.getUpstream || (() => '');
+    const isDocker = /docker/i.test(path.basename(String(options.command || '')));
+    const hostAlias = isDocker ? 'host.docker.internal' : 'host.containers.internal';
+    const name = sidecarName(homeDir);
+    const hash = homeHash(homeDir);
+    let inflight = null;
+    let lastClients = '';
+
+    async function inspectSidecar() {
+        try {
+            const out = await run(['inspect', '--format', '{{json .}}', name]);
+            const line = out.split('\n').map(l => l.trim()).filter(Boolean)[0];
+            return line ? JSON.parse(line) : null;
+        } catch (e) {
+            if (/no such|not found|no container|does not exist/i.test(String(e.message))) return null;
+            throw e;
+        }
+    }
+
+    function ipOf(info) {
+        const networks = (info.NetworkSettings && info.NetworkSettings.Networks) || {};
+        return (networks[networkName] && networks[networkName].IPAddress) || '';
+    }
+
+    function runningOf(info) {
+        return Boolean(info.State && (info.State.Running === true || info.State.Status === 'running'));
+    }
+
+    function prepareFiles(upstream) {
+        const p = egressPaths(homeDir);
+        ensureDir(path.join(homeDir, '.manyoyo'));
+        ensureDir(p.dir);
+        [p.app, p.data, p.denied].forEach(ensureDir);
+        const contents = appFileContents();
+        contents.forEach(([file, text]) => {
+            const target = path.join(p.app, file);
+            if (!fs.existsSync(target) || fs.readFileSync(target, 'utf-8') !== text) writeAtomic(target, text, 0o644);
+        });
+        const upstreamFile = path.join(p.data, 'upstream.txt');
+        if (upstream) writeConfigFileSecure(upstreamFile, `${upstream}\n`);
+        else fs.rmSync(upstreamFile, { force: true });
+        const rev = crypto.createHash('sha256');
+        contents.forEach(([file, text]) => rev.update(`${file}\0${text}\0`));
+        return { p, rev: rev.digest('hex').slice(0, 16) };
+    }
+
+    // 就绪 = 在 sidecar 里真的连得上代理端口（不能看日志：重启后日志里还留着上一次的“ready”）
+    async function waitReady() {
+        const deadline = Date.now() + READY_TIMEOUT_MS;
+        const probe = `require('net').connect(${SIDECAR_PORT},'127.0.0.1').on('connect',()=>process.exit(0)).on('error',()=>process.exit(1))`;
+        while (Date.now() < deadline) {
+            const info = await inspectSidecar();
+            if (!info || !runningOf(info)) break;
+            try {
+                await run(['exec', name, 'node', '-e', probe], { timeout: 5000 });
+                return;
+            } catch (e) { /* 还没起来 */ }
+            await new Promise(resolve => setTimeout(resolve, 150));
+        }
+        let tail = '';
+        try { tail = await run(['logs', '--tail', '5', name]); } catch (e) { /* 取不到就算了 */ }
+        throw new Error(`域名白名单代理没有起来${tail ? `: ${String(tail).trim().split('\n').slice(-2).join(' ')}` : ''}`);
+    }
+
+    async function doEnsure() {
+        await options.ensureNetwork();
+        const subnet = subnetOfNetwork(JSON.parse((await run(['network', 'inspect', networkName, '--format', '{{json .}}'])).trim().split('\n')[0] || 'null'));
+        const ip = chooseSidecarIp(subnet, homeDir);
+        const upstream = containerSideUpstream(getUpstream(), hostAlias);
+        const { p, rev } = prepareFiles(upstream);
+        let info = await inspectSidecar();
+        const labels = (info && info.Config && info.Config.Labels) || {};
+        const matches = info && labels['manyoyo.egress.rev'] === rev && labels['manyoyo.home'] === hash;
+        if (matches && runningOf(info) && ipOf(info) === ip) return { name, ip, port: SIDECAR_PORT };
+        if (matches && !runningOf(info)) {
+            try {
+                await run(['start', name]);
+                info = await inspectSidecar();
+                if (info && runningOf(info) && ipOf(info) === ip) {
+                    await waitReady();
+                    return { name, ip, port: SIDECAR_PORT };
+                }
+            } catch (e) { /* 起不来就重建 */ }
+        }
+        if (info) await run(['rm', '-f', name]);
+        const args = [
+            'run', '-d', '--name', name,
+            '--network', networkName, '--ip', ip, '--mac-address', macForIp(ip),
+            // 宿主机上这几个目录属于普通用户且是 0700：rootful 运行时里的 root 不带 DAC_OVERRIDE 就进不去（rootless 下 root 就是该用户，不受影响）
+            '--user', 'root', '--cap-drop', 'ALL', '--cap-add', 'DAC_OVERRIDE', '--security-opt', 'no-new-privileges',
+            '--read-only', '--tmpfs', '/tmp', '--pids-limit', '256', '--memory', '256m',
+            '--pull=never',
+            '--label', 'manyoyo.role=egress', '--label', `manyoyo.home=${hash}`, '--label', `manyoyo.egress.rev=${rev}`,
+            '--volume', `${p.app}:/app:ro`, '--volume', `${p.data}:/data:ro`, '--volume', `${p.denied}:/denied`,
+            '--env', `EGRESS_PORT=${SIDECAR_PORT}`
+        ];
+        if (isDocker) args.push('--add-host', 'host.docker.internal:host-gateway');
+        args.push('--entrypoint', 'node', options.imageRef(), '/app/egress-sidecar-main.js');
+        try {
+            await run(args, { timeout: 60000 });
+        } catch (e) {
+            const message = String(e.message);
+            // 另一个进程（CLI / serve）刚好同时建好了它：直接用现成的
+            if (/name .*(already in use|is already used)|already in use by container|name is already/i.test(message)) {
+                const other = await inspectSidecar();
+                if (other && runningOf(other) && ipOf(other) === ip) {
+                    await waitReady();
+                    return { name, ip, port: SIDECAR_PORT };
+                }
+            }
+            throw new Error(/address already in use|ip.*(used|allocated)|in use/i.test(message) && !/name/i.test(message)
+                ? `域名白名单代理需要的地址 ${ip} 已被占用（${networkName} 网络里有别的容器用了它）`
+                : `域名白名单代理启动失败: ${message}`);
+        }
+        await waitReady();
+        return { name, ip, port: SIDECAR_PORT };
+    }
+
+    /** 保证 sidecar 在运行，返回 {name, ip, port}；多处同时调用合并成一次。 */
+    function ensure() {
+        if (!inflight) inflight = doEnsure().finally(() => { inflight = null; });
+        return inflight;
+    }
+
+    /** 只读检查：sidecar 现在是否在运行且地址正确（ensureReady 的快速路径用）。 */
+    async function isHealthy() {
+        const info = await inspectSidecar();
+        return Boolean(info && runningOf(info));
+    }
+
+    /** 写入「来源 IP → 容器 id + 策略」；内容没变就不写（避免无谓刷新）。 */
+    function writeClients(clients) {
+        const p = egressPaths(homeDir);
+        ensureDir(p.dir);
+        ensureDir(p.data);
+        const text = `${JSON.stringify({ clients }, null, 2)}\n`;
+        if (text === lastClients && fs.existsSync(path.join(p.data, 'clients.json'))) return;
+        writeAtomic(path.join(p.data, 'clients.json'), text, 0o644);
+        lastClients = text;
+    }
+
+    return { name, ensure, isHealthy, writeClients, paths: () => egressPaths(homeDir), isSidecarName: n => n === name };
+}
+
+module.exports = {
+    SIDECAR_PORT,
+    APP_FILES,
+    egressDir,
+    egressPaths,
+    sidecarName,
+    isSidecarName,
+    chooseSidecarIp,
+    macForIp,
+    subnetOfNetwork,
+    containerSideUpstream,
+    createSidecarManager
+};

package/lib/json5-text-edit.js

@@ -232,7 +232,7 @@ function applyTextReplacements(text, replacements) {
 }
 
 function formatPropertyKey(key) {
-    return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
+    return JSON.stringify(key);
 }
 
 // 某个位置所在行的缩进
@@ -246,8 +246,7 @@ function reindent(valueText, indent) {
     return String(valueText).replace(/\n/g, `\n${indent}`);
 }
 
-// 永远只在对象的 '{' 后面插入，不管这个对象原来是空的还是已经有属性——
-// 不用去判断"是不是最后一个属性、要不要补逗号"，语法上总是安全的
+// 永远只在对象的 '{' 后面插入；对象原来已有属性才补逗号，空对象里插入第一个属性不留尾逗号
 function insertObjectProperty(text, objectStartIndex, key, valueText) {
     const objectIndent = lineIndentAt(text, objectStartIndex);
     const childIndent = `${objectIndent}    `;
@@ -256,8 +255,9 @@ function insertObjectProperty(text, objectStartIndex, key, valueText) {
     const lineEnd = text.indexOf('\n', objectStartIndex + 1);
     const tailIsTrivia = lineEnd !== -1 && /^\s*(\/\/.*)?$/.test(text.slice(objectStartIndex + 1, lineEnd));
     // 空对象且 } 紧跟在同一行：闭合的 } 另起一行；} 已在后面的行上就不再补，避免多出空行
-    const closesRightAfter = !tailIsTrivia && text[skipTrivia(text, objectStartIndex + 1)] === '}';
-    const insertion = `${prefix}${reindent(valueText, childIndent)},${closesRightAfter ? `\n${objectIndent}` : ''}`;
+    const nextChar = text[skipTrivia(text, objectStartIndex + 1)];
+    const closesRightAfter = !tailIsTrivia && nextChar === '}';
+    const insertion = `${prefix}${reindent(valueText, childIndent)}${nextChar === '}' ? '' : ','}${closesRightAfter ? `\n${objectIndent}` : ''}`;
     const insertPos = tailIsTrivia ? lineEnd : objectStartIndex + 1;
     const nextText = `${text.slice(0, insertPos)}${insertion}${text.slice(insertPos)}`;
     return { text: nextText, valueStart: insertPos + prefix.length };

package/lib/net-proxy.js

@@ -0,0 +1,183 @@
+'use strict';
+
+// 访问 GitHub 的请求读取代理：环境变量（https_proxy 等）或 macOS 系统代理。
+// Node 内置 fetch 不读代理变量，所以这里按请求构造带代理的 fetch，绝不修改全局（serve 进程里还有访问本机/容器的请求）。
+
+const http = require('http');
+const https = require('https');
+const { Readable } = require('stream');
+const { spawnSync } = require('child_process');
+
+const MAX_REDIRECTS = 5;
+const IDLE_TIMEOUT_MS = 60000;
+
+function pick(env, names) {
+    for (const name of names) {
+        const value = String(env[name] || env[name.toUpperCase()] || '').trim();
+        if (value) return value;
+    }
+    return '';
+}
+
+// 去掉账号密码，只留 scheme://host:port，用于打印
+function displayProxy(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.protocol}//${parsed.host}`;
+    } catch (error) {
+        return '';
+    }
+}
+
+function normalizeProxyUrl(value) {
+    return /^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value : `http://${value}`;
+}
+
+/**
+ * 解析 macOS `scutil --proxy` 的输出。返回 { url, noProxy } 或 { unsupported } 或 null。
+ * 只认 HTTPS 代理（没有就退到 HTTP 代理）；PAC / 自动代理不解析。
+ */
+function parseScutilProxy(text) {
+    const values = {};
+    const exceptions = [];
+    let inExceptions = false;
+    for (const rawLine of String(text || '').split('\n')) {
+        const line = rawLine.trim();
+        if (/^ExceptionsList\s*:/.test(line)) { inExceptions = true; continue; }
+        if (inExceptions) {
+            const item = line.match(/^\d+\s*:\s*(.+)$/);
+            if (item) { exceptions.push(item[1].trim()); continue; }
+            inExceptions = false;
+        }
+        const pair = line.match(/^(\w+)\s*:\s*(.+)$/);
+        if (pair) values[pair[1]] = pair[2].trim();
+    }
+    const noProxy = exceptions.map(item => item.replace(/^\*\./, '.')).join(',');
+    for (const prefix of ['HTTPS', 'HTTP']) {
+        if (values[`${prefix}Enable`] === '1' && values[`${prefix}Proxy`] && /^\d+$/.test(values[`${prefix}Port`] || '')) {
+            return { url: `http://${values[`${prefix}Proxy`]}:${values[`${prefix}Port`]}`, noProxy };
+        }
+    }
+    if (values.ProxyAutoConfigEnable === '1' || values.SOCKSEnable === '1') return { unsupported: true };
+    return null;
+}
+
+function readScutilProxy() {
+    const result = spawnSync('/usr/sbin/scutil', ['--proxy'], { encoding: 'utf-8', timeout: 3000 });
+    return result.status === 0 ? result.stdout : '';
+}
+
+/**
+ * 找出当前该用的代理。优先级：环境变量 > macOS 系统代理 > 无。
+ * 返回 { proxyEnv, source: 'env'|'system'|null, display, notice }；notice 是需要告诉用户的一句话（如暂不支持 socks）。
+ */
+function resolveProxy({ env = process.env, platform = process.platform, readSystemProxy = readScutilProxy } = {}) {
+    const noProxy = pick(env, ['no_proxy']);
+    const candidates = [pick(env, ['https_proxy']), pick(env, ['http_proxy']), pick(env, ['all_proxy'])].filter(Boolean);
+    let notice = '';
+    for (const candidate of candidates) {
+        const url = normalizeProxyUrl(candidate);
+        if (/^socks/i.test(url)) {
+            notice = '暂不支持 socks 代理，请改用 http 代理端口。';
+            continue;
+        }
+        if (!/^https?:\/\//i.test(url) || !displayProxy(url)) continue;
+        return { proxyEnv: { HTTPS_PROXY: url, HTTP_PROXY: url, ...(noProxy ? { NO_PROXY: noProxy } : {}) }, source: 'env', display: displayProxy(url), notice };
+    }
+    if (platform === 'darwin') {
+        let parsed = null;
+        try {
+            parsed = parseScutilProxy(readSystemProxy());
+        } catch (error) {
+            parsed = null;
+        }
+        if (parsed && parsed.url) {
+            const merged = [noProxy, parsed.noProxy].filter(Boolean).join(',');
+            return { proxyEnv: { HTTPS_PROXY: parsed.url, HTTP_PROXY: parsed.url, ...(merged ? { NO_PROXY: merged } : {}) }, source: 'system', display: displayProxy(parsed.url), notice };
+        }
+        if (parsed && parsed.unsupported) notice = '系统代理用了自动配置或 socks，暂不支持，请在终端设置 https_proxy 指向 http 代理端口。';
+    }
+    return { proxyEnv: null, source: null, display: '', notice };
+}
+
+// Agent 的 proxyEnv 选项：Node 22.21+ / 24.5+ 才有
+function supportsProxyEnv(version = process.versions.node) {
+    const [major, minor] = String(version).split('.').map(Number);
+    if (major >= 25) return true;
+    if (major === 24) return minor >= 5;
+    if (major === 22) return minor >= 21;
+    return false;
+}
+
+function requestOnce(url, options, agents) {
+    const target = new URL(url);
+    const client = target.protocol === 'http:' ? http : https;
+    const agent = target.protocol === 'http:' ? agents.http : agents.https;
+    return new Promise((resolve, reject) => {
+        const req = client.request(target, { method: options.method || 'GET', headers: options.headers || {}, agent, signal: options.signal }, resolve);
+        // 连接或下载中途卡住（代理停止转发等）时不能永远挂着：空闲超过 60 秒按超时处理
+        req.setTimeout(IDLE_TIMEOUT_MS, () => req.destroy(Object.assign(new Error('空闲超时'), { code: 'ETIMEDOUT' })));
+        req.on('error', reject);
+        req.end();
+    });
+}
+
+/**
+ * 带代理的最小 fetch 兼容实现（status / ok / headers.get / json / text / body）。
+ * 手动跟随最多 5 次重定向，每一跳都由 Agent 按 NO_PROXY 重新判断是否走代理；HTTPS 目标走 CONNECT 隧道，证书照常校验。
+ */
+function createProxyFetch(proxyEnv, agentOptions = {}) {
+    const agents = {
+        http: new http.Agent({ proxyEnv, keepAlive: false }),
+        https: new https.Agent({ proxyEnv, keepAlive: false, ...agentOptions })
+    };
+    return async function proxyFetch(url, options = {}) {
+        let current = String(url);
+        for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
+            const res = await requestOnce(current, options, agents);
+            const location = res.headers.location;
+            if (res.statusCode >= 300 && res.statusCode < 400 && location && options.redirect !== 'manual') {
+                res.resume();
+                const next = new URL(location, current);
+                // 跨站跳转不带凭据类请求头
+                if (next.host !== new URL(current).host && options.headers) {
+                    options = { ...options, headers: Object.fromEntries(Object.entries(options.headers).filter(([key]) => !/^(authorization|cookie)$/i.test(key))) };
+                }
+                current = next.toString();
+                continue;
+            }
+            const headers = { get: name => { const value = res.headers[String(name).toLowerCase()]; return Array.isArray(value) ? value.join(', ') : value === undefined ? null : value; } };
+            const readText = async () => {
+                const chunks = [];
+                for await (const chunk of res) chunks.push(chunk);
+                return Buffer.concat(chunks).toString('utf-8');
+            };
+            return {
+                status: res.statusCode,
+                ok: res.statusCode >= 200 && res.statusCode < 300,
+                headers,
+                url: current,
+                body: Readable.toWeb(res),
+                text: readText,
+                json: async () => JSON.parse(await readText())
+            };
+        }
+        throw Object.assign(new Error('重定向次数过多'), { cause: { code: 'TOO_MANY_REDIRECTS' } });
+    };
+}
+
+/**
+ * 访问 GitHub 用的 fetch：有可用代理时返回带代理的版本，否则返回内置 fetch。
+ * 返回 { fetch, proxy, notice }；notice 是要打印给用户的提示（使用了哪个代理 / 为什么没用）。
+ */
+function getGithubFetch({ env = process.env, platform = process.platform, readSystemProxy, nodeVersion = process.versions.node, baseFetch = globalThis.fetch } = {}) {
+    const proxy = resolveProxy({ env, platform, readSystemProxy });
+    if (!proxy.proxyEnv) return { fetch: baseFetch, proxy, notice: proxy.notice };
+    if (!supportsProxyEnv(nodeVersion)) {
+        return { fetch: baseFetch, proxy, notice: '当前 Node 版本不支持代理，请升级到 Node 22.21+ 或 24+。' };
+    }
+    const label = proxy.source === 'system' ? '使用系统代理' : '使用代理';
+    return { fetch: createProxyFetch(proxy.proxyEnv), proxy, notice: `${label}: ${proxy.display}` };
+}
+
+module.exports = { resolveProxy, parseScutilProxy, displayProxy, supportsProxyEnv, createProxyFetch, getGithubFetch };

package/lib/network-policy.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const net = require('net');
-const { isValidId } = require('./container-state');
+const { isValidId } = require('./container-id');
 
 // 容器网络策略：校验（唯一入口）+ 生成 nft 规则文本。
 // nft 文本只由校验过的结构化数据生成：IP/CIDR 经 net.isIP + 前缀整数、端口是 1-65535 的整数、域名不进规则
@@ -196,6 +196,7 @@ function cidrList(cidrs, family) {
  * @param {string[]} [endpoints.dns]
  * @param {{ip:string, ports:string, proto?:string}[]} [endpoints.allow] manyoyo 必需端点、上游代理、过滤代理、Playwright、镜像、host 端口、出站 peer
  * @param {{ip:string, ports:string, proto?:string}[]} [endpoints.peerIn] 允许进来的 peer
+ * @param {{daddr:string, saddr:string}[]} [endpoints.antiSpoof] 发往 daddr 的包来源必须是 saddr（过滤代理按来源 IP 认容器）
  * @param {{subnet:string, gateway:string}|null} [endpoints.bridge]
  * @returns {string} 整份 nft 脚本（先删后建，一次 nft -f 原子替换）；open 预设只删表
  */
@@ -204,6 +205,9 @@ function buildNftRuleset(policy, endpoints = {}) {
     if (policy.preset === 'open') return `${lines.join('\n')}\n`;
 
     const out = ['    oif lo accept', '    ct state established,related accept'];
+    (endpoints.antiSpoof || []).forEach(item => {
+        out.push(`    ${addrExpr('daddr', item.daddr, 'antiSpoof')} ${addrExpr('saddr', item.saddr, 'antiSpoof').replace(' saddr ', ' saddr != ')} drop`);
+    });
     // 用户 deny 排在所有放行规则之前，才能真正“禁止”
     if (policy.preset !== 'open') policy.deny.forEach(rule => out.push(`    ${addrExpr('daddr', rule.cidr, 'deny')} reject`));
     (endpoints.dns || []).forEach(ip => {

package/lib/plugin/playwright.js

@@ -612,7 +612,7 @@ class PlaywrightPlugin {
     async startChrome() {
         const { port } = this.config;
         const candidates = this.devtoolsCandidates();
-        const enableHint = '请在 Chrome 地址栏进入 chrome://inspect/#remote-debugging，勾选“Allow remote debugging”（Chrome 没开就先打开它），然后重试。\n'
+        const enableHint = '请在 Chrome 地址栏进入：\nchrome://inspect/#remote-debugging\n勾选“Allow remote debugging”（Chrome 没开就先打开它），然后重试。\n'
             + '（自定义用户目录时，用 plugins.playwright.devtoolsActivePortPath 指定 DevToolsActivePort 文件。）';
         const target = findDevToolsActivePort(candidates);
         if (!target) {
@@ -821,7 +821,9 @@ class PlaywrightPlugin {
         if (!result.ok) {
             if (mode === 'chrome') {
                 this.err('[up] chrome 失败: 连不上 Chrome 的调试接口。');
-                this.err('请确认已在 chrome://inspect/#remote-debugging 开启远程调试，并在 Chrome 弹出的“要允许远程调试吗？”里点“允许”（60 秒内），然后重试。');
+                this.err('请确认已在 Chrome 地址栏进入：');
+                this.err('chrome://inspect/#remote-debugging');
+                this.err('开启远程调试，并在 Chrome 弹出的“要允许远程调试吗？”里点“允许”（60 秒内），然后重试。');
             } else {
                 this.err(`[up] ${mode} 失败: 浏览器服务已启动，但打不开页面（${result.error}）。`);
                 this.err(tailText(this.logPath(), 10));