cfpilot-scanner 0.2.0 → 0.4.0

package/dist/cli.js

@@ -1,4 +1,10 @@
 #!/usr/bin/env node
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 
 // src/cli.ts
 import { readFileSync } from "node:fs";
@@ -89,6 +95,59 @@ var BUILTIN_IPV4_CIDRS = [
   "172.64.0.0/13",
   "131.0.72.0/22"
 ];
+var IPV4_CIDR_WEIGHTS = {
+  "104.16.0.0/13": 1,
+  // 实测 8/12
+  "104.24.0.0/14": 0.9,
+  // 实测 7/12
+  "103.21.244.0/22": 0.3,
+  "103.31.4.0/22": 0.3,
+  "190.93.240.0/20": 0.3,
+  "188.114.96.0/20": 0.3,
+  "141.101.64.0/18": 0.2,
+  "162.158.0.0/16": 0.2,
+  // 162.158.x.x：边缘节点，部分可用
+  // 162.159.x.x 是 Cloudflare 的管理 / API 网段，真机实测**多数**返回
+  // HTTP 403（反爬风控），但**并非全部**——用户实测 162.159.237.59 可用
+  // （2.8 MB/s），本地复测同样通过（SJC）。
+  //
+  // 因此**不能压到 0**（会错杀可用 IP），给一个很低的权重：
+  // 仍能采到少量候选，但不让大量 403 IP 占据阶段二额度。
+  //
+  // ⚠️ 教训：权重粒度为 /16，但实际可用性可能细到单个 IP。
+  // 实测样本只有 9 个就下「完全不可用」的结论过于草率。
+  "162.159.0.0/16": 0.05,
+  "172.64.0.0/13": 0.1,
+  // 实测 0/12 —— 不采样
+  "173.245.48.0/20": 0,
+  "103.22.200.0/22": 0,
+  "108.162.192.0/18": 0,
+  "197.234.240.0/22": 0,
+  "198.41.128.0/17": 0,
+  "131.0.72.0/22": 0
+};
+var DEFAULT_CIDR_WEIGHT = 0.2;
+function cidrWeight(cidr) {
+  const normalized = cidr.trim();
+  if (normalized in IPV4_CIDR_WEIGHTS) return IPV4_CIDR_WEIGHTS[normalized];
+  const parsed = parseCidr(normalized);
+  if (!parsed || parsed.family !== 4) return DEFAULT_CIDR_WEIGHT;
+  let bestPrefix = -1;
+  let bestWeight = DEFAULT_CIDR_WEIGHT;
+  for (const [tableCidr, weight] of Object.entries(IPV4_CIDR_WEIGHTS)) {
+    const tableParsed = parseCidr(tableCidr);
+    if (!tableParsed || tableParsed.family !== 4) continue;
+    if (tableParsed.prefix > parsed.prefix) continue;
+    const parsedNorm = parsed.base >> BigInt(32 - tableParsed.prefix);
+    const tableNorm = tableParsed.base >> BigInt(32 - tableParsed.prefix);
+    if (parsedNorm !== tableNorm) continue;
+    if (tableParsed.prefix > bestPrefix) {
+      bestPrefix = tableParsed.prefix;
+      bestWeight = weight;
+    }
+  }
+  return bestWeight;
+}
 var BUILTIN_IPV6_CIDRS = [
   "2400:cb00::/32",
   "2606:4700::/32",
@@ -137,7 +196,7 @@ function parseCidr(cidr) {
     const hostBits2 = 128 - prefix;
     const size2 = 1n << BigInt(hostBits2);
     const mask2 = hostBits2 === 0 ? 0n : (1n << BigInt(hostBits2)) - 1n;
-    return { family: 6, base: base & ~mask2, prefix, size: size2 };
+    return { family: 6, base: base & ~mask2, prefix, size: size2, cidr: cidr.trim() };
   }
   if (prefix < 0 || prefix > 32) return null;
   const value = ipv4ToBigInt(addr);
@@ -145,7 +204,7 @@ function parseCidr(cidr) {
   const hostBits = 32 - prefix;
   const size = 1n << BigInt(hostBits);
   const mask = hostBits === 0 ? 0n : (1n << BigInt(hostBits)) - 1n;
-  return { family: 4, base: value & ~mask, prefix, size };
+  return { family: 4, base: value & ~mask, prefix, size, cidr: cidr.trim() };
 }
 function ipv4ToBigInt(addr) {
   const parts = addr.split(".");
@@ -207,30 +266,114 @@ function bigIntToIpv6(value) {
   const tail = groups.slice(bestStart + bestLen).join(":");
   return `${head}::${tail}`;
 }
+function splitByWeight(cidr) {
+  if (cidr.family !== 4) return [cidr];
+  const out = [];
+  const stack = [{ c: cidr }];
+  while (stack.length > 0) {
+    const item = stack.pop();
+    const c = item.c;
+    const weight = item.known ?? cidrWeight(c.cidr);
+    if (c.prefix >= 32) {
+      out.push(c);
+      continue;
+    }
+    const half = 1n << BigInt(32 - c.prefix - 1);
+    const mk = (base) => {
+      const sub = { ...c, prefix: c.prefix + 1, size: half, base };
+      return { ...sub, cidr: `${bigIntToIpv4(base)}/${c.prefix + 1}` };
+    };
+    const left = mk(c.base);
+    const right = mk(c.base + half);
+    const lw = cidrWeight(left.cidr);
+    const rw = cidrWeight(right.cidr);
+    if (lw === rw) {
+      out.push(c);
+      continue;
+    }
+    stack.push({ c: left, known: lw }, { c: right, known: rw });
+  }
+  return out.sort((a, b) => a.base < b.base ? -1 : a.base > b.base ? 1 : 0);
+}
 function expandCidrs(cidrs, options = {}) {
   const sample = options.sample ?? 2e4;
   const random = makeRandom(options.seed ?? 24301);
-  const parsed = cidrs.map(parseCidr).filter((c) => c !== null);
+  const parsedRaw = cidrs.map(parseCidr).filter((c) => c !== null);
+  if (parsedRaw.length === 0) return [];
+  const parsed = parsedRaw.flatMap(splitByWeight);
   if (parsed.length === 0) return [];
-  const totalSize = parsed.reduce((sum, c) => sum + c.size, 0n);
-  const out = [];
-  for (const cidr of parsed) {
-    if (sample <= 0 || cidr.size <= 2000n) {
+  if (sample <= 0) {
+    const all = [];
+    for (const cidr of parsed) {
       for (let i = 0n; i < cidr.size; i++) {
         const value = cidr.base + i;
-        out.push(cidr.family === 4 ? bigIntToIpv4(value) : bigIntToIpv6(value));
+        all.push(cidr.family === 4 ? bigIntToIpv4(value) : bigIntToIpv6(value));
       }
-      continue;
     }
-    const ratio = Number(totalSize === 0n ? 1n : cidr.size * BigInt(sample) / totalSize);
-    const count = Math.max(64, Math.min(2e4, ratio));
-    const step = Number(cidr.size / BigInt(count));
-    const offset = Math.floor(random() * step);
-    for (let i = 0; i < count; i++) {
-      const offsetValue = BigInt(offset + Math.floor(i * step));
-      if (offsetValue >= cidr.size) break;
-      const value = cidr.base + offsetValue;
-      out.push(cidr.family === 4 ? bigIntToIpv4(value) : bigIntToIpv6(value));
+    return all;
+  }
+  const minPerCidr = sample <= 1e3 ? 1 : 64;
+  const out = [];
+  for (const family of [4, 6]) {
+    const group = parsed.filter((c) => c.family === family);
+    if (group.length === 0) continue;
+    const hasOtherFamily = parsed.some((c) => c.family !== family);
+    const familyBudget = Math.max(1, Math.round(hasOtherFamily ? sample / 2 : sample));
+    const effectiveSize = (c) => {
+      if (c.family !== 4) return c.size;
+      const weight = cidrWeight(c.cidr);
+      if (weight <= 0) return 0n;
+      const scaled = Number(c.size) * weight;
+      return scaled >= 1 ? BigInt(Math.floor(scaled)) : 0n;
+    };
+    const rawTotal = group.reduce((sum, c) => sum + effectiveSize(c), 0n);
+    const allZero = rawTotal === 0n;
+    let familyTotal = rawTotal;
+    let allocOf = effectiveSize;
+    if (allZero) {
+      familyTotal = group.reduce((sum, c) => sum + c.size, 0n);
+      allocOf = (c) => c.size;
+    }
+    if (familyTotal === 0n) continue;
+    const minForCidr = (c) => {
+      if (c.family !== 4) return minPerCidr;
+      const w = cidrWeight(c.cidr);
+      if (w >= 1) return minPerCidr;
+      return Math.max(1, Math.round(minPerCidr * w));
+    };
+    const plans = group.map((cidr) => {
+      const ratio = Number(allocOf(cidr) * BigInt(familyBudget) / familyTotal);
+      const wanted = Math.max(minForCidr(cidr), Math.min(2e4, ratio));
+      return { cidr, count: Math.min(Number(cidr.size), wanted) };
+    });
+    const usablePlans = allZero ? plans : plans.filter((p) => effectiveSize(p.cidr) > 0n);
+    let familySum = usablePlans.reduce((sum, p) => sum + p.count, 0);
+    while (familySum > familyBudget) {
+      let target = null;
+      for (const plan of usablePlans) {
+        if (plan.count > 1 && (!target || plan.count > target.count)) target = plan;
+      }
+      if (!target) break;
+      target.count -= 1;
+      familySum -= 1;
+    }
+    for (const { cidr, count } of usablePlans) {
+      if (count <= 0) continue;
+      if (count >= Number(cidr.size)) {
+        for (let i = 0n; i < cidr.size; i++) {
+          const value = cidr.base + i;
+          out.push(family === 4 ? bigIntToIpv4(value) : bigIntToIpv6(value));
+        }
+        continue;
+      }
+      const step = Math.floor(Number(cidr.size) / count);
+      const offset = Math.floor(random() * step);
+      for (let i = 0; i < count; i++) {
+        const offsetValue = BigInt(offset + Math.floor(i * step));
+        if (offsetValue >= cidr.size) break;
+        const value = cidr.base + offsetValue;
+        out.push(family === 4 ? bigIntToIpv4(value) : bigIntToIpv6(value));
+      }
     }
   }
   return out;
@@ -266,7 +409,7 @@ function readIpFile(text) {
 // src/candidates.ts
 var DEFAULT_CANDIDATE_SAMPLE = 2e4;
 var DEFAULT_CANDIDATE_SEED = 24301;
-var DEFAULT_BRIDGE_SAMPLE = 300;
+var DEFAULT_BRIDGE_SAMPLE = 6556;
 function normalizeCidrInput(cidr) {
   if (cidr === void 0) return [];
   const list = Array.isArray(cidr) ? cidr : [cidr];
@@ -326,11 +469,239 @@ function normalizeCandidateList(input) {
   return out;
 }
 
-// src/scan.ts
+// src/net-env.ts
 import * as net from "node:net";
+import { execFile } from "node:child_process";
+var PROXY_PORTS = [
+  { port: 7890, name: "Clash / Mihomo\uFF08HTTP\uFF09" },
+  { port: 7891, name: "Clash / Mihomo\uFF08SOCKS\uFF09" },
+  { port: 7897, name: "Clash Verge" },
+  { port: 1080, name: "\u901A\u7528 SOCKS" },
+  { port: 10808, name: "v2rayN\uFF08SOCKS\uFF09" },
+  { port: 10809, name: "v2rayN\uFF08HTTP\uFF09" },
+  { port: 2080, name: "Nekoray / sing-box" },
+  { port: 2081, name: "Nekoray / sing-box" },
+  { port: 8889, name: "Surge" },
+  { port: 6152, name: "Surge\uFF08HTTP\uFF09" }
+];
+function isPortListening(port, timeoutMs = 400) {
+  return new Promise((resolve) => {
+    const socket = new net.Socket();
+    let settled = false;
+    const done = (open) => {
+      if (settled) return;
+      settled = true;
+      try {
+        socket.destroy();
+      } catch {
+      }
+      resolve(open);
+    };
+    socket.setTimeout(timeoutMs, () => done(false));
+    socket.once("connect", () => done(true));
+    socket.once("error", () => done(false));
+    try {
+      socket.connect(port, "127.0.0.1");
+    } catch {
+      done(false);
+    }
+  });
+}
+async function readSystemProxy() {
+  if (process.platform !== "win32") return "";
+  const query = (key) => new Promise((resolve) => {
+    execFile(
+      "reg",
+      ["query", "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", "/v", key],
+      { timeout: 3e3, windowsHide: true },
+      (err, stdout) => resolve(err ? "" : String(stdout))
+    );
+  });
+  try {
+    const enabled = await query("ProxyEnable");
+    if (!/ProxyEnable\s+REG_DWORD\s+0x1/i.test(enabled)) return "";
+    const server = await query("ProxyServer");
+    const m = /ProxyServer\s+REG_SZ\s+(\S+)/i.exec(server);
+    return m ? m[1] : "(\u5DF2\u542F\u7528\uFF0C\u4F46\u672A\u8BFB\u5230\u5730\u5740)";
+  } catch {
+    return "";
+  }
+}
+function isFakeIp(ip) {
+  const parts = ip.split(".").map(Number);
+  const [a, b] = parts;
+  return a === 198 && (b === 18 || b === 19);
+}
+async function detectProxyInterference(host) {
+  const findings = [];
+  const listening = [];
+  await Promise.all(
+    PROXY_PORTS.map(async ({ port, name }) => {
+      if (await isPortListening(port)) listening.push(`${name} \u2192 127.0.0.1:${port}`);
+    })
+  );
+  if (listening.length > 0) {
+    findings.push({
+      message: "\u672C\u673A\u6709\u4EE3\u7406\u7A0B\u5E8F\u5728\u76D1\u542C\uFF1A\n     " + listening.join("\n     "),
+      advice: "\u5173\u95ED\u8FD9\u4E9B\u4EE3\u7406\u7A0B\u5E8F\uFF0C\u6216\u5728\u5176\u4E2D\u628A\u672C\u7A0B\u5E8F\u52A0\u5165\u76F4\u8FDE/\u7ED5\u8FC7\u540D\u5355"
+    });
+  }
+  const sysProxy = await readSystemProxy();
+  if (sysProxy) {
+    findings.push({
+      message: `\u7CFB\u7EDF\u4EE3\u7406\u5DF2\u542F\u7528\uFF1A${sysProxy}`,
+      advice: "\u5728\u300C\u8BBE\u7F6E \u2192 \u7F51\u7EDC\u548C Internet \u2192 \u4EE3\u7406\u300D\u4E2D\u5173\u95ED\u7CFB\u7EDF\u4EE3\u7406"
+    });
+  }
+  const probeHost = host?.trim() || "www.cloudflare.com";
+  try {
+    const { resolve4 } = await import("node:dns/promises");
+    const ips = await resolve4(probeHost).catch(() => []);
+    const fake = ips.find((ip) => isFakeIp(ip));
+    if (fake) {
+      findings.push({
+        message: `DNS \u628A ${probeHost} \u89E3\u6790\u5230 ${fake}\uFF08198.18/15 \u4FDD\u7559\u6BB5\uFF09\uFF0CTUN / fake-ip \u6B63\u5728\u751F\u6548`,
+        advice: "\u5173\u95ED\u4EE3\u7406\u5DE5\u5177\u7684 TUN \u6A21\u5F0F\u4E0E fake-ip DNS"
+      });
+    }
+  } catch {
+  }
+  return { clean: findings.length === 0, findings };
+}
+function isMsysPollutedPath(value) {
+  const looksWindows = /^[A-Za-z]:[\\/]/.test(value) || value.includes("\\");
+  const hasMsysHint = /node_modules|bash-win32|@dsh-ops|msys/i.test(value);
+  return looksWindows || hasMsysHint;
+}
 
-// src/true-probe.ts
+// src/speed-url.ts
 import * as tls from "node:tls";
+var SPEED_URL_PRESETS = [
+  { url: "speed.cloudflare.com/__down?bytes=104857600", label: "Cloudflare \u5B98\u65B9" },
+  { url: "cf.090227.xyz/__down?bytes=104857600", label: "CM \u63D0\u4F9B" }
+];
+var DEFAULT_SPEED_URL = SPEED_URL_PRESETS[0].url;
+function parseSpeedUrl(raw, fallbackScheme = "https") {
+  const value = (raw ?? "").trim();
+  if (!value) throw new Error("\u6D4B\u901F\u5730\u5740\u4E3A\u7A7A");
+  const schemeMatch = /^([a-z][a-z0-9+.-]*):\/\//i.exec(value);
+  if (schemeMatch) {
+    const scheme2 = schemeMatch[1].toLowerCase();
+    if (scheme2 !== "http" && scheme2 !== "https") {
+      throw new Error(`\u4E0D\u652F\u6301\u7684\u6D4B\u901F\u5730\u5740\u534F\u8BAE\uFF1A${scheme2}\uFF08\u53EA\u652F\u6301 http / https\uFF09`);
+    }
+  }
+  let normalized = value;
+  if (normalized.startsWith("//")) {
+    normalized = `${fallbackScheme}:${normalized}`;
+  } else if (!/^https?:\/\//i.test(normalized)) {
+    normalized = `${fallbackScheme}://${normalized}`;
+  }
+  let parsed;
+  try {
+    parsed = new URL(normalized);
+  } catch {
+    throw new Error(`\u6D4B\u901F\u5730\u5740\u65E0\u6CD5\u89E3\u6790\uFF1A${value}`);
+  }
+  const scheme = parsed.protocol.replace(":", "").toLowerCase();
+  if (scheme !== "http" && scheme !== "https") {
+    throw new Error(`\u4E0D\u652F\u6301\u7684\u6D4B\u901F\u5730\u5740\u534F\u8BAE\uFF1A${scheme}`);
+  }
+  if (!parsed.hostname) throw new Error(`\u6D4B\u901F\u5730\u5740\u7F3A\u5C11\u57DF\u540D\uFF1A${value}`);
+  return {
+    raw: value,
+    scheme,
+    host: parsed.hostname,
+    path: `${parsed.pathname}${parsed.search}` || "/"
+  };
+}
+function schemeForPort(port) {
+  return port === 443 || port === 2053 || port === 2083 || port === 2087 || port === 2096 || port === 8443 ? "https" : "http";
+}
+function checkSpeedUrlAvailable(parsed, timeoutMs = 6e3) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let received = "";
+    const finish = (available, status, error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socket.destroy();
+      } catch {
+      }
+      resolve({ available, status, error });
+    };
+    const path = parsed.path.includes("bytes=") ? parsed.path.replace(/bytes=\d+/, "bytes=1024") : parsed.path;
+    const request = [
+      `GET ${path} HTTP/1.1`,
+      `Host: ${parsed.host}`,
+      `User-Agent: ${USER_AGENT_FOR_CHECK}`,
+      "Accept: */*",
+      "Connection: close",
+      "",
+      ""
+    ].join("\r\n");
+    const connectOptions = {
+      host: parsed.host,
+      port: parsed.scheme === "https" ? 443 : 80,
+      servername: parsed.host,
+      rejectUnauthorized: false
+    };
+    const socket = parsed.scheme === "https" ? tls.connect(connectOptions, () => socket.write(request)) : (
+      // http 明文：用 net 连接
+      (() => {
+        const net3 = __require("node:net");
+        const s = net3.connect({ host: parsed.host, port: 80 }, () => s.write(request));
+        return s;
+      })()
+    );
+    const timer = setTimeout(() => finish(false, 0, "\u9884\u68C0\u8D85\u65F6"), timeoutMs);
+    socket.setTimeout(timeoutMs, () => finish(false, 0, "\u9884\u68C0\u8D85\u65F6"));
+    socket.on("error", (err) => finish(false, 0, err.message));
+    socket.on("data", (chunk) => {
+      received += chunk.toString("utf8");
+      const m = /^HTTP\/1\.[01]\s+(\d{3})/.exec(received);
+      if (m) {
+        const status = Number(m[1]);
+        finish(status === 200 || status === 206, status);
+      }
+    });
+  });
+}
+var USER_AGENT_FOR_CHECK = "CFPilot-Scanner/1.0 (+https://github.com/xmwengxing/CFPilot)";
+async function pickAvailableSpeedUrl(candidates, log) {
+  const list = candidates.length > 0 ? candidates : [DEFAULT_SPEED_URL];
+  for (const candidate of list) {
+    let parsed;
+    try {
+      parsed = parseSpeedUrl(candidate, "https");
+    } catch {
+      continue;
+    }
+    const result = await checkSpeedUrlAvailable(parsed);
+    if (result.available) {
+      log?.(`\u6D4B\u901F\u5730\u5740\u53EF\u7528\uFF1A${candidate}`);
+      return candidate;
+    }
+    log?.(`\u6D4B\u901F\u5730\u5740\u4E0D\u53EF\u7528\uFF08${result.error ?? "HTTP " + result.status}\uFF09\uFF1A${candidate}`);
+  }
+  log?.(`\u6240\u6709\u6D4B\u901F\u5730\u5740\u90FD\u4E0D\u53EF\u7528\uFF0C\u56DE\u9000\u5230\u9ED8\u8BA4\uFF1A${DEFAULT_SPEED_URL}`);
+  return DEFAULT_SPEED_URL;
+}
+function withBytes(parsed, bytes) {
+  if (/bytes=\d+/.test(parsed.path)) {
+    return parsed.path.replace(/bytes=\d+/, `bytes=${bytes}`);
+  }
+  const sep = parsed.path.includes("?") ? "&" : "?";
+  return `${parsed.path}${sep}bytes=${bytes}`;
+}
+
+// src/scan.ts
+import * as net2 from "node:net";
+
+// src/true-probe.ts
+import * as tls2 from "node:tls";
 import * as crypto from "node:crypto";
 var USER_AGENT = "CFPilot-Scanner/1.0 (+https://github.com/xmwengxing/CFPilot)";
 function extractColo(text) {
@@ -364,7 +735,7 @@ function probeWs101(ip, port, host, timeoutMs = 3e3, path = "/__edge_probe") {
       "",
       ""
     ].join("\r\n");
-    const socket = tls.connect(
+    const socket = tls2.connect(
       {
         host: ip,
         port,
@@ -405,6 +776,216 @@ function probeWs101(ip, port, host, timeoutMs = 3e3, path = "/__edge_probe") {
     });
   });
 }
+function encodeWsFrame(payload, opcode = 2) {
+  const mask = crypto.randomBytes(4);
+  const masked = Buffer.alloc(payload.length);
+  for (let i = 0; i < payload.length; i++) {
+    masked[i] = payload[i] ^ mask[i % 4];
+  }
+  let header;
+  if (payload.length < 126) {
+    header = Buffer.from([128 | opcode, 128 | payload.length]);
+  } else if (payload.length < 65536) {
+    header = Buffer.alloc(4);
+    header[0] = 128 | opcode;
+    header[1] = 254;
+    header.writeUInt16BE(payload.length, 2);
+  } else {
+    header = Buffer.alloc(10);
+    header[0] = 128 | opcode;
+    header[1] = 255;
+    header.writeBigUInt64BE(BigInt(payload.length), 2);
+  }
+  return Buffer.concat([header, mask, masked]);
+}
+function decodeWsFrame(buf) {
+  if (buf.length < 2) return null;
+  const opcode = buf[0] & 15;
+  const len7 = buf[1] & 127;
+  let offset;
+  let payloadLen;
+  if (len7 < 126) {
+    offset = 2;
+    payloadLen = len7;
+  } else if (len7 === 126) {
+    if (buf.length < 4) return null;
+    offset = 4;
+    payloadLen = buf.readUInt16BE(2);
+  } else {
+    if (buf.length < 10) return null;
+    offset = 10;
+    payloadLen = Number(buf.readBigUInt64BE(2));
+  }
+  if (buf.length < offset + payloadLen) return null;
+  const frame = {
+    opcode,
+    payload: Buffer.from(buf.subarray(offset, offset + payloadLen))
+  };
+  const rest = Buffer.from(buf.subarray(offset + payloadLen));
+  return { frame, rest };
+}
+function probeWsPing(ip, port, host, timeoutMs = 5e3, path = "/__edge_probe") {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    const key = crypto.randomBytes(16).toString("base64");
+    let settled = false;
+    let handshakeDone = false;
+    let buf = Buffer.alloc(0);
+    let receivedText = "";
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socket.destroy();
+      } catch {
+      }
+      resolve({ ...result, latencyMs: Date.now() - started });
+    };
+    const request = [
+      `GET ${path} HTTP/1.1`,
+      `Host: ${host}`,
+      `Upgrade: websocket`,
+      `Connection: Upgrade`,
+      `Sec-WebSocket-Key: ${key}`,
+      `Sec-WebSocket-Version: 13`,
+      `User-Agent: ${USER_AGENT}`,
+      "",
+      ""
+    ].join("\r\n");
+    const socket = tls2.connect(
+      {
+        host: ip,
+        port,
+        servername: host,
+        rejectUnauthorized: false,
+        ALPNProtocols: ["http/1.1"]
+      },
+      () => {
+        socket.write(request);
+      }
+    );
+    const timer = setTimeout(() => {
+      finish({
+        ok: false,
+        colo: "",
+        status: 0,
+        error: handshakeDone ? "PING \u8D85\u65F6\uFF08\u6570\u636E\u9762\u672A\u54CD\u5E94\uFF09" : "\u63E1\u624B\u8D85\u65F6",
+        pongVerified: handshakeDone ? false : void 0
+      });
+    }, timeoutMs);
+    socket.setTimeout(timeoutMs, () => {
+      finish({
+        ok: false,
+        colo: "",
+        status: 0,
+        error: handshakeDone ? "PING \u8D85\u65F6\uFF08\u6570\u636E\u9762\u672A\u54CD\u5E94\uFF09" : "\u8FDE\u63A5\u8D85\u65F6",
+        pongVerified: handshakeDone ? false : void 0
+      });
+    });
+    socket.on("error", (err) => {
+      finish({
+        ok: false,
+        colo: "",
+        status: 0,
+        error: err.message,
+        pongVerified: handshakeDone ? false : void 0
+      });
+    });
+    socket.on("data", (chunk) => {
+      buf = Buffer.concat([buf, chunk]);
+      if (!handshakeDone) {
+        const lineEnd = buf.indexOf("\r\n\r\n");
+        if (lineEnd < 0) {
+          if (buf.length > 8192) finish({ ok: false, colo: "", status: 0, error: "\u54CD\u5E94\u5934\u5F02\u5E38" });
+          return;
+        }
+        const head = buf.slice(0, lineEnd).toString("latin1");
+        const statusLine = head.split("\r\n")[0] ?? "";
+        const statusMatch = /^HTTP\/1\.[01]\s+(\d{3})/.exec(statusLine);
+        const status = statusMatch ? Number(statusMatch[1]) : 0;
+        const colo = extractColo(head);
+        buf = buf.subarray(lineEnd + 4);
+        if (status !== 101) {
+          finish({ ok: false, colo, status, error: `HTTP ${status}` });
+          return;
+        }
+        handshakeDone = true;
+        socket.write(encodeWsFrame(new TextEncoder().encode("PING"), 1));
+      }
+      for (; ; ) {
+        const decoded = decodeWsFrame(buf);
+        if (!decoded) break;
+        buf = decoded.rest;
+        const { opcode, payload } = decoded.frame;
+        if (opcode === 8) {
+          const code = payload.length >= 2 ? payload.readUInt16BE(0) : 1005;
+          finish({
+            ok: false,
+            colo: "",
+            status: 101,
+            error: `WS \u5173\u95ED\uFF08code ${code}\uFF09`,
+            pongVerified: false
+          });
+          return;
+        }
+        if (opcode === 1 || opcode === 2) {
+          receivedText += payload.toString("utf8");
+          try {
+            const parsed = JSON.parse(receivedText);
+            if (parsed.pong === true) {
+              finish({
+                ok: true,
+                colo: typeof parsed.colo === "string" ? parsed.colo.toUpperCase() : "",
+                status: 101,
+                pongVerified: true,
+                probeColo: typeof parsed.colo === "string" ? parsed.colo.toUpperCase() : void 0
+              });
+              return;
+            }
+          } catch {
+          }
+        }
+      }
+    });
+  });
+}
+function probeTlsHandshake(ip, port, host, timeoutMs = 4e3) {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socket.destroy();
+      } catch {
+      }
+      resolve({ ip, tlsMs: result.tlsMs ?? Date.now() - started, ...result });
+    };
+    const socket = tls2.connect(
+      {
+        host: ip,
+        port,
+        servername: host,
+        rejectUnauthorized: false,
+        ALPNProtocols: ["http/1.1"]
+      },
+      () => {
+        const alpn = socket.alpnProtocol;
+        if (alpn && alpn !== "http/1.1") {
+          finish({ error: `ALPN=${alpn}` });
+          return;
+        }
+        finish({ tlsMs: Date.now() - started, alpn: alpn || void 0 });
+      }
+    );
+    const timer = setTimeout(() => finish({ error: "TLS \u63E1\u624B\u8D85\u65F6" }), timeoutMs);
+    socket.setTimeout(timeoutMs, () => finish({ error: "TLS \u8FDE\u63A5\u8D85\u65F6" }));
+    socket.on("error", (err) => finish({ error: err.message }));
+  });
+}
 function measureDownload(ip, port, host, bytes, timeoutMs = 12e3, path = "/__edge_probe") {
   return new Promise((resolve) => {
     const started = Date.now();
@@ -430,7 +1011,7 @@ function measureDownload(ip, port, host, bytes, timeoutMs = 12e3, path = "/__edg
       "",
       ""
     ].join("\r\n");
-    const socket = tls.connect(
+    const socket = tls2.connect(
       {
         host: ip,
         port,
@@ -489,13 +1070,215 @@ function measureDownload(ip, port, host, bytes, timeoutMs = 12e3, path = "/__edg
     socket.on("close", settle);
   });
 }
+function measureThroughput(options) {
+  const {
+    ip,
+    port,
+    sniHost,
+    path,
+    requestHost = sniHost,
+    durationMs = 6e3,
+    warmupMs = 1e3,
+    windowMs = 400,
+    connections = 3,
+    timeoutMs = 2e4
+  } = options;
+  const connCount = Math.max(1, Math.min(8, connections));
+  return new Promise((resolve) => {
+    const started = Date.now();
+    let settled = false;
+    let totalBytes = 0;
+    let windowBytes = 0;
+    let windowStart = started;
+    let peak = 0;
+    let openedCount = 0;
+    let lastError = "";
+    const sockets = [];
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearInterval(ticker);
+      clearTimeout(timer);
+      for (const s of sockets) {
+        try {
+          s.destroy();
+        } catch {
+        }
+      }
+      const elapsedNow = Date.now() - started;
+      if (elapsedNow >= warmupMs) {
+        const dt = (Date.now() - windowStart) / 1e3;
+        if (dt > 0) {
+          const speed = windowBytes / dt / 1024 / 1024;
+          if (speed > peak) peak = speed;
+        }
+      }
+      const elapsed = Math.max(1e-3, (Date.now() - started) / 1e3);
+      resolve({
+        ok: totalBytes > 0,
+        bytes: totalBytes,
+        ms: Date.now() - started,
+        peakMBps: Number(peak.toFixed(2)),
+        avgMBps: Number((totalBytes / 1024 / 1024 / elapsed).toFixed(2)),
+        connections: openedCount,
+        error: totalBytes > 0 ? void 0 : lastError || "\u672A\u6536\u5230\u6570\u636E"
+      });
+    };
+    const request = [
+      `GET ${path} HTTP/1.1`,
+      `Host: ${requestHost}`,
+      `User-Agent: ${USER_AGENT}`,
+      "Accept: */*",
+      "Accept-Encoding: identity",
+      "Connection: close",
+      "",
+      ""
+    ].join("\r\n");
+    const openOne = () => {
+      let headerDone = false;
+      let headerBuffer = "";
+      const socket = tls2.connect(
+        {
+          host: ip,
+          port,
+          servername: sniHost,
+          rejectUnauthorized: false,
+          ALPNProtocols: ["http/1.1"]
+        },
+        () => {
+          openedCount++;
+          socket.write(request);
+        }
+      );
+      sockets.push(socket);
+      socket.setTimeout(timeoutMs, () => {
+        try {
+          socket.destroy();
+        } catch {
+        }
+      });
+      socket.on("error", (err) => {
+        lastError = err.message;
+      });
+      socket.on("data", (chunk) => {
+        if (!headerDone) {
+          headerBuffer += chunk.toString("latin1");
+          const idx = headerBuffer.indexOf("\r\n\r\n");
+          if (idx < 0) {
+            if (headerBuffer.length > 8192) {
+              lastError = "\u54CD\u5E94\u5934\u5F02\u5E38";
+              socket.destroy();
+            }
+            return;
+          }
+          const head = headerBuffer.slice(0, idx);
+          const status = /^HTTP\/1\.[01]\s+(\d{3})/.exec(head)?.[1];
+          if (status !== "200") {
+            lastError = `HTTP ${status ?? "?"}`;
+            socket.destroy();
+            return;
+          }
+          headerDone = true;
+          const body = Buffer.from(headerBuffer, "latin1").subarray(idx + 4);
+          totalBytes += body.byteLength;
+          windowBytes += body.byteLength;
+          headerBuffer = "";
+        } else {
+          totalBytes += chunk.byteLength;
+          windowBytes += chunk.byteLength;
+        }
+        if (Date.now() - started > durationMs) finish();
+      });
+      socket.on("end", () => {
+        if (sockets.every((s) => s.destroyed || s.readableEnded)) finish();
+      });
+      socket.on("close", () => {
+        if (sockets.every((s) => s.destroyed)) finish();
+      });
+    };
+    const ticker = setInterval(() => {
+      const now = Date.now();
+      const dt = (now - windowStart) / 1e3;
+      if (dt <= 0) return;
+      const bytes = windowBytes;
+      windowBytes = 0;
+      windowStart = now;
+      if (now - started < warmupMs) return;
+      const speed = bytes / dt / 1024 / 1024;
+      if (speed > peak) peak = speed;
+    }, windowMs);
+    const timer = setTimeout(finish, durationMs + 4e3);
+    for (let i = 0; i < connCount; i++) {
+      setTimeout(openOne, i * 60);
+    }
+  });
+}
+
+// src/countries.ts
+var COUNTRY_COLOS = {
+  HK: ["HKG"],
+  TW: ["TPE", "KHH"],
+  JP: ["NRT", "KIX", "CTS", "FUK"],
+  KR: ["ICN", "PUS"],
+  SG: ["SIN"],
+  MY: ["KUL"],
+  TH: ["BKK"],
+  VN: ["SGN", "HAN"],
+  ID: ["CGK", "DPS"],
+  PH: ["MNL"],
+  IN: ["BOM", "MAA", "DEL"],
+  AU: ["SYD", "MEL", "BNE", "PER"],
+  NZ: ["AKL"],
+  US: ["LAX", "SJC", "SEA", "ORD", "DFW", "IAD", "EWR", "ATL", "MIA", "DEN", "PHX", "BOS"],
+  CA: ["YYZ", "YVR", "YYC"],
+  GB: ["LHR", "MAN"],
+  DE: ["FRA", "MUC", "BER"],
+  FR: ["CDG", "MRS"],
+  NL: ["AMS"],
+  IT: ["MXP", "FCO"],
+  ES: ["MAD", "BCN"],
+  SE: ["ARN"],
+  CH: ["ZRH"],
+  AT: ["VIE"],
+  PL: ["WAW"],
+  RU: ["DME", "SVO"],
+  TR: ["IST"],
+  AE: ["DXB"],
+  IL: ["TLV"],
+  ZA: ["JNB"],
+  BR: ["GRU", "GIG"],
+  AR: ["EZE"],
+  CL: ["SCL"],
+  MX: ["MEX"]
+};
+var coloToCountry = /* @__PURE__ */ new Map();
+for (const [country, colos] of Object.entries(COUNTRY_COLOS)) {
+  for (const colo of colos) coloToCountry.set(colo, country);
+}
+function countryOfColo(colo) {
+  return coloToCountry.get(colo.toUpperCase()) ?? "";
+}
+function isKnownCountry(code) {
+  return Object.prototype.hasOwnProperty.call(COUNTRY_COLOS, code.toUpperCase());
+}
+var SUPPORTED_COUNTRIES = Object.keys(COUNTRY_COLOS);
+function normalizeCountryFilter(input) {
+  if (!Array.isArray(input)) return [];
+  const out = [];
+  for (const raw of input) {
+    const code = String(raw ?? "").trim().toUpperCase();
+    if (!code || out.includes(code)) continue;
+    if (isKnownCountry(code)) out.push(code);
+  }
+  return out;
+}
 
 // src/scan.ts
 async function tcpPing(ip, port, timeoutMs) {
   return new Promise((resolve) => {
     const started = Date.now();
     let settled = false;
-    const socket = new net.Socket();
+    const socket = new net2.Socket();
     const done = (ok) => {
       if (settled) return;
       settled = true;
@@ -528,6 +1311,8 @@ async function runScan(options) {
   const started = Date.now();
   const concurrency = options.concurrency ?? 300;
   const tcpTimeoutMs = options.tcpTimeoutMs ?? 1200;
+  const tlsConcurrency = options.tlsConcurrency ?? 64;
+  const tlsTimeoutMs = options.tlsTimeoutMs ?? 4e3;
   const maxLatencyMs = options.maxLatencyMs ?? 0;
   const probeLimit = options.probeLimit ?? 120;
   const probeConcurrency = options.probeConcurrency ?? 24;
@@ -558,29 +1343,115 @@ async function runScan(options) {
   });
   const tcpOk = tcpResults.filter((r) => r.ok);
   const filtered = maxLatencyMs > 0 ? tcpOk.filter((r) => r.latency <= maxLatencyMs) : tcpOk;
-  const stage1 = filtered.sort((a, b) => a.latency - b.latency).slice(0, probeLimit);
-  report({ type: "stage", stage: 2, name: "WebSocket 101 \u771F\u8FDE\u63A5\u6821\u9A8C", total: stage1.length });
+  report({ type: "stage", stage: 1, name: "TLS \u63E1\u624B\u7B5B\u9009", total: filtered.length });
+  let tlsDone = 0;
+  const tlsResults = await pool(filtered, tlsConcurrency, async (item) => {
+    const probe = await probeTlsHandshake(item.ip, options.port, options.host, tlsTimeoutMs);
+    tlsDone++;
+    if (tlsDone % 200 === 0 || tlsDone === filtered.length) {
+      report({
+        type: "progress",
+        stage: 1,
+        done: tlsDone,
+        total: filtered.length,
+        message: `TLS \u63E1\u624B ${tlsDone}/${filtered.length}${probe.tlsMs > 0 ? ` ${probe.tlsMs}ms` : " \u2717"}`
+      });
+    }
+    return { ...item, tls: probe };
+  });
+  const tlsOk = tlsResults.filter((r) => r.tls.tlsMs > 0);
+  const stage1 = tlsOk.sort((a, b) => a.tls.tlsMs - b.tls.tlsMs || a.latency - b.latency).slice(0, probeLimit);
+  const strictProbe = options.verifyPayload !== false;
+  const strictProbePath = "/__edge_probe";
+  report({
+    type: "stage",
+    stage: 2,
+    name: strictProbe ? "WS 101 + \u54CD\u5E94\u4F53\u6821\u9A8C\uFF08\u63A2\u9488\u7AEF\u70B9\uFF09" : "WebSocket 101 \u6821\u9A8C",
+    total: stage1.length
+  });
   let probeDone = 0;
+  let verifiedCount = 0;
   const probeResults = await pool(stage1, probeConcurrency, async (item) => {
-    const result = await probeWs101(item.ip, options.port, options.host, probeTimeoutMs, options.wsPath ?? "/__edge_probe");
+    const probeFn = strictProbe ? probeWsPing : probeWs101;
+    const probePath = strictProbe ? strictProbePath : options.wsPath ?? "/__edge_probe";
+    const result = await probeFn(
+      item.ip,
+      options.port,
+      options.host,
+      probeTimeoutMs,
+      probePath
+    );
     probeDone++;
+    if (result.pongVerified) verifiedCount++;
     report({
       type: "progress",
       stage: 2,
       done: probeDone,
       total: stage1.length,
-      message: `101 \u6821\u9A8C ${probeDone}/${stage1.length}${result.ok ? ` \u2713 ${result.colo}` : ""}`
+      message: strictProbe ? `101+PING \u6821\u9A8C ${probeDone}/${stage1.length}${result.ok ? ` \u2713 ${result.colo}` : result.pongVerified === false ? " \u2717 \u65E0\u54CD\u5E94" : ""}` : `101 \u6821\u9A8C ${probeDone}/${stage1.length}${result.ok ? ` \u2713 ${result.colo}` : ""}`
     });
     return { ...item, probe: result };
   });
-  const wsOk = probeResults.filter((r) => r.probe.ok);
-  const stage2 = wsOk.sort((a, b) => a.latency - b.latency).slice(0, speedLimit);
+  const wsOk = strictProbe ? probeResults.filter((r) => r.probe.ok && r.probe.pongVerified === true) : probeResults.filter((r) => r.probe.ok);
+  const countryFilter = normalizeCountryFilter(options.countries ?? []);
+  let wsFiltered = wsOk;
+  let appliedCountries = [];
+  if (countryFilter.length > 0 && wsOk.length > 0) {
+    const matched = wsOk.filter((r) => countryFilter.includes(countryOfColo(r.probe.colo || "")));
+    if (matched.length > 0) {
+      wsFiltered = matched;
+      appliedCountries = countryFilter;
+      report({
+        type: "progress",
+        stage: 2,
+        done: wsOk.length,
+        total: wsOk.length,
+        message: `\u56FD\u5BB6\u7B5B\u9009 ${countryFilter.join("/")}\uFF1A\u4FDD\u7559 ${matched.length}/${wsOk.length}\uFF0C\u8FDB\u5165\u6D4B\u901F`
+      });
+    } else {
+      report({
+        type: "progress",
+        stage: 2,
+        done: wsOk.length,
+        total: wsOk.length,
+        message: `\u56FD\u5BB6\u7B5B\u9009 ${countryFilter.join("/")} \u540E\u65E0\u5019\u9009\uFF0C\u5DF2\u5FFD\u7565\uFF08\u91C7\u6837\u592A\u5C0F\uFF1F\u8C03\u5230 500~1000 \u518D\u8BD5\uFF09`
+      });
+    }
+  }
+  const stage2 = wsFiltered.sort((a, b) => a.tls.tlsMs - b.tls.tlsMs || a.latency - b.latency).slice(0, speedLimit);
   let speedResults;
+  const speedMode = options.speedMode ?? "probe";
   if (options.skipSpeed) {
     report({ type: "stage", stage: 3, name: "\u8DF3\u8FC7\u6D4B\u901F\uFF08\u6309\u5EF6\u8FDF\u6392\u5E8F\uFF09", total: stage2.length });
     speedResults = stage2.map((r) => ({ ...r }));
+  } else if (speedMode === "url") {
+    report({ type: "stage", stage: 3, name: "\u771F\u5B9E\u4E0B\u884C\u901F\u5EA6\u6D4B\u8BD5\uFF08\u516C\u5F00\u6D4B\u901F\u5730\u5740\uFF09", total: stage2.length });
+    const parsedUrl = parseSpeedUrl(options.speedUrl ?? DEFAULT_SPEED_URL, schemeForPort(options.port));
+    const requestPath = withBytes(parsedUrl, options.speedBytes ?? 104857600);
+    let speedDone = 0;
+    speedResults = await pool(stage2, speedConcurrency, async (item) => {
+      const result = await measureThroughput({
+        ip: item.ip,
+        port: options.port,
+        sniHost: parsedUrl.host,
+        requestHost: parsedUrl.host,
+        path: requestPath,
+        connections: options.speedConnections ?? 3,
+        durationMs: options.speedDurationMs ?? 6e3,
+        timeoutMs: options.speedTimeoutMs ?? 2e4
+      });
+      speedDone++;
+      report({
+        type: "progress",
+        stage: 3,
+        done: speedDone,
+        total: stage2.length,
+        message: `\u6D4B\u901F ${speedDone}/${stage2.length} ${result.peakMBps.toFixed(1)} MB/s`
+      });
+      return { ...item, speed: result.ok ? result.peakMBps : 0 };
+    });
   } else {
-    report({ type: "stage", stage: 3, name: "\u771F\u5B9E\u4E0B\u884C\u901F\u5EA6\u6D4B\u8BD5", total: stage2.length });
+    report({ type: "stage", stage: 3, name: "\u771F\u5B9E\u4E0B\u884C\u901F\u5EA6\u6D4B\u8BD5\uFF08\u9879\u76EE\u63A2\u9488\u7AEF\u70B9\uFF09", total: stage2.length });
     let speedDone = 0;
     speedResults = await pool(stage2, speedConcurrency, async (item) => {
       const result = await measureDownload(
@@ -599,16 +1470,19 @@ async function runScan(options) {
         total: stage2.length,
         message: `\u6D4B\u901F ${speedDone}/${stage2.length} ${result.speedMBps.toFixed(1)} MB/s`
       });
-      return { ...item, download: result };
+      return { ...item, speed: result.ok ? result.speedMBps : 0 };
     });
   }
-  const entries = speedResults.filter((r) => options.skipSpeed ? true : Boolean(r.download && r.download.ok && r.download.speedMBps > 0)).map((r) => ({
+  const entries = speedResults.filter((r) => options.skipSpeed ? true : Boolean(r.speed && r.speed > 0)).map((r) => ({
     ip: r.ip,
     port: options.port,
     colo: r.probe.colo || "UNK",
     latency: r.latency,
-    speed: r.download ? Number(r.download.speedMBps.toFixed(2)) : 0
-  })).sort((a, b) => options.skipSpeed ? a.latency - b.latency : b.speed - a.speed || a.latency - b.latency).slice(0, top);
+    tlsMs: r.tls.tlsMs,
+    speed: r.speed ? Number(r.speed.toFixed(2)) : 0
+  })).sort(
+    (a, b) => options.skipSpeed ? a.tlsMs - b.tlsMs || a.latency - b.latency : b.speed - a.speed || a.tlsMs - b.tlsMs || a.latency - b.latency
+  ).slice(0, top);
   for (const entry of entries) {
     report({ type: "result", entry });
   }
@@ -617,9 +1491,13 @@ async function runScan(options) {
     stats: {
       candidates: candidates.length,
       tcpOk: tcpOk.length,
+      tlsOk: tlsOk.length,
       wsOk: wsOk.length,
+      verified: verifiedCount,
       speedOk: entries.length,
-      elapsedMs: Date.now() - started
+      elapsedMs: Date.now() - started,
+      countries: appliedCountries,
+      wsFiltered: wsFiltered.length
     }
   };
   report({ type: "done", count: entries.length });
@@ -857,6 +1735,8 @@ async function handleRequest(req, res) {
           host: body.host.trim(),
           port: body.port ?? 443,
           candidates: plan.candidates,
+          // 国家过滤（可多选）：不传 = 全量；无效代码在 normalizeCountryFilter 里被丢弃
+          countries: Array.isArray(body.countries) ? body.countries : void 0,
           top: body.top ?? 15,
           onProgress: (event) => broadcast(job, event)
         });
@@ -924,7 +1804,7 @@ async function handleRequest(req, res) {
 }
 
 // src/version.ts
-var VERSION = "0.2.0";
+var VERSION = "0.4.0";
 var NAME = "cfpilot-scanner";
 
 // src/cli.ts
@@ -948,14 +1828,33 @@ scan \u9009\u9879:
   --no-callback          \u53EA\u6253\u5370\u7ED3\u679C\uFF0C\u4E0D\u56DE\u586B
   --path <path>          \u9636\u6BB5\u4E8C\u6821\u9A8C\u7684 WebSocket \u8DEF\u5F84\uFF0C\u9ED8\u8BA4 /__edge_probe
                          \uFF08\u5BF9\u63A5\u5176\u5B83\u9879\u76EE\u65F6\u586B\u5B83\u81EA\u5DF1\u7684 WS \u8DEF\u5F84\uFF0C\u4F8B\u5982 /vless \u6216 /<uuid>\uFF09
-  --probe-path <path>    \u9636\u6BB5\u4E09\u6D4B\u901F\u8DEF\u5F84\uFF0C\u9ED8\u8BA4 /__edge_probe
-  --no-speed             \u8DF3\u8FC7\u6D4B\u901F\uFF0C\u53EA\u6309\u5EF6\u8FDF\u6392\u5E8F\uFF08\u76EE\u6807\u6CA1\u6709 CFPilot \u63A2\u9488\u65F6\u7528\uFF09
+  --probe-path <path>    probe \u6A21\u5F0F\u7684\u6D4B\u901F\u8DEF\u5F84\uFF0C\u9ED8\u8BA4 /__edge_probe
+  --speed-mode <mode>    \u6D4B\u901F\u65B9\u5F0F\uFF1Aauto\uFF08\u9ED8\u8BA4\uFF09/ probe / url
+                         auto  = \u76EE\u6807\u6709\u63A2\u9488\u7AEF\u70B9\u5C31\u7528\u5B83\uFF0C\u5426\u5219\u81EA\u52A8\u6539\u7528\u516C\u5F00\u6D4B\u901F\u5730\u5740
+                         probe = \u53EA\u7528\u76EE\u6807\u9879\u76EE\u7684\u63A2\u9488\u7AEF\u70B9\uFF08\u6700\u5FE0\u5B9E\uFF0C\u8981\u6C42\u5BF9\u65B9\u6709\u8BE5\u7AEF\u70B9\uFF09
+                         url   = \u53EA\u7528\u516C\u5F00\u6D4B\u901F\u5730\u5740\uFF08\u4EFB\u4F55\u9879\u76EE\u90FD\u80FD\u6D4B\uFF09
+  --speed-url <url>      \u516C\u5F00\u6D4B\u901F\u5730\u5740\uFF0C\u9ED8\u8BA4 ${DEFAULT_SPEED_URL}
+                         \u53EF\u6362\u6210\u4EFB\u610F\u8FD4\u56DE\u5927\u6587\u4EF6\u7684\u5730\u5740
+  --speed-conns <n>      \u6D4B\u901F\u5E76\u53D1\u8FDE\u63A5\u6570\uFF0C\u9ED8\u8BA4 3
+                         \u5355\u6761 TCP \u8FDE\u63A5\u53D7\u62E5\u585E\u7A97\u53E3\u9650\u5236\uFF0C\u591A\u8FDE\u63A5\u66F4\u63A5\u8FD1\u771F\u5B9E\u5E26\u5BBD
+  --speed-duration <ms>  \u6D4B\u901F\u65F6\u957F\uFF0C\u9ED8\u8BA4 6000
+  --no-verify            \u9636\u6BB5\u4E8C\u53EA\u505A 101 \u63E1\u624B\uFF0C\u8DF3\u8FC7\u54CD\u5E94\u4F53\u6821\u9A8C
+                          \uFF08\u9ED8\u8BA4\u6821\u9A8C\uFF1A\u53D1 PING \u5E76\u9A8C\u8BC1\u6570\u636E\u9762\u56DE {"pong":true}\uFF09
+  --no-speed             \u8DF3\u8FC7\u6D4B\u901F\uFF0C\u53EA\u6309\u5EF6\u8FDF\u6392\u5E8F
   --top <n>              \u8FD4\u56DE\u6761\u6570\uFF0C\u9ED8\u8BA4 15
-  --concurrency <n>      \u9636\u6BB5\u4E00\u5E76\u53D1\uFF0C\u9ED8\u8BA4 300
+  --concurrency <n>      \u9636\u6BB5\u4E00 TCP \u5E76\u53D1\uFF0C\u9ED8\u8BA4 300
+  --tls-concurrency <n>  \u9636\u6BB5\u4E00 TLS \u63E1\u624B\u5E76\u53D1\uFF0C\u9ED8\u8BA4 64
+                          TLS \u63E1\u624B\u662F CPU \u5BC6\u96C6\u578B\u64CD\u4F5C\uFF0C\u8FC7\u9AD8\u4F1A\u8BA9\u672C\u673A\u6210\u4E3A\u74F6\u9888
   --sample <n>           \u5019\u9009 IP \u91C7\u6837\u6570\uFF0C\u9ED8\u8BA4 20000
+                          \u5EFA\u8BAE 6556 \u8D77\uFF1A\u9636\u6BB5\u4E00\u6309 TLS \u63E1\u624B\u8017\u65F6\u7B5B\u9009\uFF0C\u800C\u63E1\u624B\u5FEB\u6162
+                          \u4E0E TCP \u5EF6\u8FDF\u51E0\u4E4E\u65E0\u5173\uFF08\u5B9E\u6D4B TCP 9ms \u7684 IP \u53EF\u80FD\u8981 3.5 \u79D2\uFF09\uFF0C
+                          \u91C7\u6837\u5C0F\u4E86\u6839\u672C\u78B0\u4E0D\u5230\u63E1\u624B\u5FEB\u7684 IP
+  --countries <a,b>      \u56FD\u5BB6 / \u5730\u533A\u8FC7\u6EE4\uFF08\u53EF\u591A\u9009\uFF0C\u9017\u53F7\u5206\u9694\uFF0C\u5982 HK,JP,SG\uFF09
+                         \u4E0D\u9009 = \u5168\u91CF\u3002\u673A\u623F\u6765\u81EA 101 \u63E1\u624B\u54CD\u5E94\uFF1B\u7B5B\u5B8C\u4E3A\u7A7A\u4F1A\u81EA\u52A8\u5FFD\u7565
   --cidr <a,b>           \u81EA\u5B9A\u4E49\u7F51\u6BB5\uFF08\u53EF\u91CD\u590D\uFF0C\u7528\u9017\u53F7\u5206\u9694\uFF09
   --ip-file <path>       \u4F7F\u7528\u672C\u5730 IP \u5217\u8868\u6587\u4EF6
-  --max-latency <ms>     \u9636\u6BB5\u4E00\u5EF6\u8FDF\u4E0A\u9650\uFF0C\u9ED8\u8BA4 0\uFF08\u4E0D\u9650\uFF09
+  --max-latency <ms>     \u9636\u6BB5\u4E00 TCP \u5EF6\u8FDF\u4E0A\u9650\uFF0C\u9ED8\u8BA4 0\uFF08\u4E0D\u9650\uFF09
+  --tls-timeout <ms>     \u9636\u6BB5\u4E00 TLS \u63E1\u624B\u8D85\u65F6\uFF0C\u9ED8\u8BA4 4000
   --probe-limit <n>      \u8FDB\u5165 101 \u6821\u9A8C\u7684\u5019\u9009\u6570\uFF0C\u9ED8\u8BA4 120
   --speed-limit <n>      \u8FDB\u5165\u6D4B\u901F\u7684\u5019\u9009\u6570\uFF0C\u9ED8\u8BA4 30
   --speed-bytes <n>      \u6D4B\u901F\u5B57\u8282\u6570\uFF0C\u9ED8\u8BA4 5242880
@@ -972,6 +1871,35 @@ serve \u9009\u9879:
   ${NAME} scan --host cfpilot.example.com --token abc123
   ${NAME} serve
 `;
+function normalizeWsPath(raw, fallback) {
+  const value = (raw ?? fallback).trim();
+  if (!value) return fallback;
+  if (isMsysPollutedPath(value)) {
+    process.stderr.write(
+      `
+\u2717 --path \u88AB MSYS\uFF08Git-Bash\uFF09\u8F6C\u6362\u6210\u4E86 Windows \u8DEF\u5F84\uFF1A
+   \u6536\u5230\u7684\u662F\uFF1A${value}
+
+  \u8FD9\u662F Git-Bash \u7684\u81EA\u52A8\u8DEF\u5F84\u8F6C\u6362\u884C\u4E3A\uFF0C\u4E0D\u662F\u672C\u5DE5\u5177\u7684\u95EE\u9898\u3002
+  \u4E09\u79CD\u7ED5\u5F00\u65B9\u5F0F\uFF0C\u4EFB\u9009\u5176\u4E00\uFF1A
+    1. \u7528\u7B49\u53F7\u5199\u6CD5\uFF1A      --path=/vless
+    2. \u52A0\u73AF\u5883\u53D8\u91CF\uFF1A      MSYS_NO_PATHCONV=1 cfpilot-scanner scan ...
+    3. \u6362\u7528 PowerShell / CMD \u6267\u884C
+`
+    );
+    process.exit(1);
+  }
+  if (!value.startsWith("/")) {
+    process.stderr.write(
+      `
+\u2717 --path \u5FC5\u987B\u4EE5 / \u5F00\u5934\uFF0C\u6536\u5230\u7684\u662F\uFF1A\u300C${value}\u300D
+  \u4F8B\u5982\uFF1A--path /vless \u6216 --path /\uFF08\u76EE\u6807\u9879\u76EE\u7528\u6839\u8DEF\u5F84\u65F6\uFF09
+`
+    );
+    process.exit(1);
+  }
+  return value;
+}
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   const command = args.command && !args.command.startsWith("-") ? args.command : "";
@@ -1067,15 +1995,16 @@ function printTable(entries) {
     process.stdout.write("\n\u6CA1\u6709\u901A\u8FC7\u5168\u90E8\u6821\u9A8C\u7684\u8282\u70B9\u3002\n");
     return;
   }
-  process.stdout.write("\n\u6392\u540D  \u5730\u5740                     \u673A\u623F   \u5EF6\u8FDF(ms)  \u4E0B\u884C(MB/s)\n");
-  process.stdout.write("\u2500".repeat(58) + "\n");
+  process.stdout.write("\n\u6392\u540D  \u5730\u5740                     \u673A\u623F   TLS(ms)  TCP(ms)  \u4E0B\u884C(MB/s)\n");
+  process.stdout.write("\u2500".repeat(66) + "\n");
   entries.forEach((entry, index) => {
     const rank = String(index + 1).padStart(2, " ");
     const address = `${entry.ip}:${entry.port}`.padEnd(24, " ");
     const colo = (entry.colo || "UNK").padEnd(6, " ");
+    const tls3 = String(entry.tlsMs).padStart(7, " ");
     const latency = String(entry.latency).padStart(7, " ");
     const speed = entry.speed.toFixed(1).padStart(9, " ");
-    process.stdout.write(`${rank}   ${address} ${colo} ${latency}  ${speed}
+    process.stdout.write(`${rank}   ${address} ${colo} ${tls3} ${latency}  ${speed}
 `);
   });
 }
@@ -1097,9 +2026,11 @@ async function commandScan(args) {
   const top = flagNumber(args, "top", 15);
   const token = flagString(args, "token");
   const noCallback = flagBool(args, "no-callback");
-  const wsPath = flagString(args, "path", "/__edge_probe");
-  const probePath = flagString(args, "probe-path", "/__edge_probe");
+  const wsPath = normalizeWsPath(flagString(args, "path"), "/__edge_probe");
+  const probePath = normalizeWsPath(flagString(args, "probe-path"), "/__edge_probe");
   const noSpeed = flagBool(args, "no-speed");
+  const verifyPayload = !flagBool(args, "no-verify");
+  const countries = normalizeCountryFilter(flagList(args, "countries"));
   const callback = noCallback ? "" : flagString(args, "callback", token ? `https://${host}/api/v1/preferred-ips` : "");
   if (!quiet) {
     process.stdout.write(`
@@ -1107,8 +2038,31 @@ ${NAME} v${VERSION}
 `);
     process.stdout.write(`\u76EE\u6807\u57DF\u540D\uFF1A${host}:${port}\uFF08\u5C06\u4F5C\u4E3A TLS SNI \u4E0E HTTP Host\uFF09
 `);
-    process.stdout.write("\u6B63\u5728\u51C6\u5907 Cloudflare \u7F51\u6BB5\u2026\n");
+    process.stdout.write(`WS \u8DEF\u5F84\uFF1A${wsPath}
+`);
+    if (countries.length > 0) {
+      process.stdout.write(`\u56FD\u5BB6\u7B5B\u9009\uFF1A${countries.join(" / ")}\uFF08\u4E0D\u586B\u5219\u5168\u91CF\uFF09
+`);
+    }
+  }
+  if (!quiet) {
+    const env = await detectProxyInterference(host);
+    if (!env.clean) {
+      process.stdout.write("\n\u26A0\uFE0F  \u68C0\u6D4B\u5230\u53EF\u80FD\u5E72\u6270\u4F18\u9009\u7684\u56E0\u7D20\uFF1A\n");
+      for (const f of env.findings) {
+        process.stdout.write(`   ${f.message}
+`);
+        process.stdout.write(`   \u2192 ${f.advice}
+`);
+      }
+      process.stdout.write("\n   \u4F18\u9009\u6D4B\u7684\u662F\u300C\u672C\u673A\u76F4\u8FDE\u8BE5 IP\u300D\u7684\u771F\u5B9E\u8D28\u91CF\u3002\n");
+      process.stdout.write("   \u6D41\u91CF\u88AB\u4EE3\u7406\u63A5\u7BA1\u65F6\uFF0C\u7ED3\u679C\u770B\u8D77\u6765\u6B63\u5E38\uFF0C\u4F46\u6240\u6709 IP \u6210\u7EE9\u8D8B\u4E8E\u4E00\u81F4\uFF0C\n");
+      process.stdout.write("   \u5BFC\u5165\u5BA2\u6237\u7AEF\u540E\u5927\u91CF -1\uFF08\u56E0\u4E3A\u4ECE\u672A\u771F\u6B63\u76F4\u8FDE\u9A8C\u8BC1\u8FC7\uFF09\u3002\n");
+      process.stdout.write("   \u2192 \u5EFA\u8BAE\u5173\u95ED\u4EE3\u7406\u5DE5\u5177\uFF08\u542B TUN \u6A21\u5F0F\u4E0E\u7CFB\u7EDF\u4EE3\u7406\uFF09\u540E\u91CD\u8DD1\u3002\n");
+      process.stdout.write("   \u2192 \u6216\u628A\u672C\u7A0B\u5E8F\u4E0E\u5F85\u6D4B IP \u6BB5\u8BBE\u4E3A\u76F4\u8FDE\u3002\n\n");
+    }
   }
+  if (!quiet) process.stdout.write("\u6B63\u5728\u51C6\u5907 Cloudflare \u7F51\u6BB5\u2026\n");
   const candidates = await resolveCandidatesFromArgs(args);
   if (candidates.length === 0) {
     process.stderr.write("\u5019\u9009 IP \u4E3A\u7A7A\uFF0C\u8BF7\u68C0\u67E5 --ip-file / --cidr \u53C2\u6570\n");
@@ -1117,38 +2071,69 @@ ${NAME} v${VERSION}
   if (!quiet) process.stdout.write(`\u5019\u9009 IP\uFF1A${candidates.length} \u4E2A
 `);
   let skipSpeed = noSpeed;
+  let speedMode = "probe";
+  let speedUrl = flagString(args, "speed-url", DEFAULT_SPEED_URL);
   if (!skipSpeed) {
-    try {
-      const probe = await fetch(`https://${host}${probePath}?bytes=1024`, {
-        method: "GET",
-        signal: AbortSignal.timeout(8e3)
-      });
-      if (!probe.headers.get("x-probe-bytes")) {
-        skipSpeed = true;
+    const forcedMode = flagString(args, "speed-mode");
+    if (forcedMode === "url") {
+      speedMode = "url";
+      if (!quiet) process.stdout.write(`\u6D4B\u901F\u65B9\u5F0F\uFF1A\u516C\u5F00\u6D4B\u901F\u5730\u5740\uFF08${speedUrl}\uFF09
+`);
+    } else if (forcedMode === "probe") {
+      speedMode = "probe";
+    } else {
+      let hasProbe = false;
+      try {
+        const probe = await fetch(`https://${host}${probePath}?bytes=1024`, {
+          method: "GET",
+          signal: AbortSignal.timeout(8e3)
+        });
+        hasProbe = Boolean(probe.headers.get("x-probe-bytes"));
+      } catch {
+        hasProbe = false;
+      }
+      if (hasProbe) {
+        speedMode = "probe";
+        if (!quiet) process.stdout.write("\u6D4B\u901F\u65B9\u5F0F\uFF1A\u9879\u76EE\u63A2\u9488\u7AEF\u70B9\uFF08\u6700\u5FE0\u5B9E\uFF09\n");
+      } else {
+        speedMode = "url";
         if (!quiet) {
-          process.stdout.write("\n\u63D0\u793A\uFF1A" + probePath + " \u4E0D\u662F CFPilot \u63A2\u9488\u7AEF\u70B9\uFF0C\u5DF2\u8DF3\u8FC7\u6D4B\u901F\uFF08\u53EA\u6309\u5EF6\u8FDF\u6392\u5E8F\uFF09\n");
-          process.stdout.write("      \u5982\u9700\u6D4B\u901F\uFF0C\u8BF7\u7528 --probe-path \u6307\u5B9A\u76EE\u6807\u9879\u76EE\u7684\u6D4B\u901F\u8DEF\u5F84\n");
+          process.stdout.write(`
+\u63D0\u793A\uFF1A${probePath} \u4E0D\u662F CFPilot \u63A2\u9488\u7AEF\u70B9\uFF0C\u6539\u7528\u516C\u5F00\u6D4B\u901F\u5730\u5740\u6D4B\u901F
+`);
+          process.stdout.write("      \uFF08\u4ECD\u4F1A\u5148\u505A 101 \u6821\u9A8C\uFF0C\u56E0\u6B64\u4E0D\u4F1A\u9009\u51FA\u8FDE\u4E0D\u4E0A\u7684 IP\uFF09\n");
         }
+        speedUrl = await pickAvailableSpeedUrl(
+          [speedUrl, ...SPEED_URL_PRESETS.map((p) => p.url)],
+          quiet ? void 0 : (m) => process.stdout.write(`      ${m}
+`)
+        );
       }
-    } catch {
-      skipSpeed = true;
     }
   }
   const summary = await runScan({
     host,
     port,
     candidates,
+    countries,
     wsPath,
     probePath,
     skipSpeed,
+    verifyPayload,
     concurrency: flagNumber(args, "concurrency", 300),
     tcpTimeoutMs: flagNumber(args, "timeout", 1200),
+    tlsConcurrency: flagNumber(args, "tls-concurrency", 64),
+    tlsTimeoutMs: flagNumber(args, "tls-timeout", 4e3),
     maxLatencyMs: flagNumber(args, "max-latency", 0),
     probeLimit: flagNumber(args, "probe-limit", 120),
     probeTimeoutMs: flagNumber(args, "probe-timeout", 3e3),
     speedLimit: flagNumber(args, "speed-limit", 30),
     speedTimeoutMs: flagNumber(args, "speed-timeout", 12e3),
     speedBytes: flagNumber(args, "speed-bytes", 5 * 1024 * 1024),
+    speedMode,
+    speedUrl,
+    speedConnections: flagNumber(args, "speed-conns", 3),
+    speedDurationMs: flagNumber(args, "speed-duration", 6e3),
     top,
     onProgress: (event) => printProgress(event, quiet)
   });