cfpilot-scanner 0.3.0 → 0.4.0

package/dist/cli.js

@@ -95,6 +95,59 @@ var BUILTIN_IPV4_CIDRS = [
   "172.64.0.0/13",
   "131.0.72.0/22"
 ];
+var IPV4_CIDR_WEIGHTS = {
+  "104.16.0.0/13": 1,
+  // 实测 8/12
+  "104.24.0.0/14": 0.9,
+  // 实测 7/12
+  "103.21.244.0/22": 0.3,
+  "103.31.4.0/22": 0.3,
+  "190.93.240.0/20": 0.3,
+  "188.114.96.0/20": 0.3,
+  "141.101.64.0/18": 0.2,
+  "162.158.0.0/16": 0.2,
+  // 162.158.x.x：边缘节点，部分可用
+  // 162.159.x.x 是 Cloudflare 的管理 / API 网段，真机实测**多数**返回
+  // HTTP 403（反爬风控），但**并非全部**——用户实测 162.159.237.59 可用
+  // （2.8 MB/s），本地复测同样通过（SJC）。
+  //
+  // 因此**不能压到 0**（会错杀可用 IP），给一个很低的权重：
+  // 仍能采到少量候选，但不让大量 403 IP 占据阶段二额度。
+  //
+  // ⚠️ 教训：权重粒度为 /16，但实际可用性可能细到单个 IP。
+  // 实测样本只有 9 个就下「完全不可用」的结论过于草率。
+  "162.159.0.0/16": 0.05,
+  "172.64.0.0/13": 0.1,
+  // 实测 0/12 —— 不采样
+  "173.245.48.0/20": 0,
+  "103.22.200.0/22": 0,
+  "108.162.192.0/18": 0,
+  "197.234.240.0/22": 0,
+  "198.41.128.0/17": 0,
+  "131.0.72.0/22": 0
+};
+var DEFAULT_CIDR_WEIGHT = 0.2;
+function cidrWeight(cidr) {
+  const normalized = cidr.trim();
+  if (normalized in IPV4_CIDR_WEIGHTS) return IPV4_CIDR_WEIGHTS[normalized];
+  const parsed = parseCidr(normalized);
+  if (!parsed || parsed.family !== 4) return DEFAULT_CIDR_WEIGHT;
+  let bestPrefix = -1;
+  let bestWeight = DEFAULT_CIDR_WEIGHT;
+  for (const [tableCidr, weight] of Object.entries(IPV4_CIDR_WEIGHTS)) {
+    const tableParsed = parseCidr(tableCidr);
+    if (!tableParsed || tableParsed.family !== 4) continue;
+    if (tableParsed.prefix > parsed.prefix) continue;
+    const parsedNorm = parsed.base >> BigInt(32 - tableParsed.prefix);
+    const tableNorm = tableParsed.base >> BigInt(32 - tableParsed.prefix);
+    if (parsedNorm !== tableNorm) continue;
+    if (tableParsed.prefix > bestPrefix) {
+      bestPrefix = tableParsed.prefix;
+      bestWeight = weight;
+    }
+  }
+  return bestWeight;
+}
 var BUILTIN_IPV6_CIDRS = [
   "2400:cb00::/32",
   "2606:4700::/32",
@@ -143,7 +196,7 @@ function parseCidr(cidr) {
     const hostBits2 = 128 - prefix;
     const size2 = 1n << BigInt(hostBits2);
     const mask2 = hostBits2 === 0 ? 0n : (1n << BigInt(hostBits2)) - 1n;
-    return { family: 6, base: base & ~mask2, prefix, size: size2 };
+    return { family: 6, base: base & ~mask2, prefix, size: size2, cidr: cidr.trim() };
   }
   if (prefix < 0 || prefix > 32) return null;
   const value = ipv4ToBigInt(addr);
@@ -151,7 +204,7 @@ function parseCidr(cidr) {
   const hostBits = 32 - prefix;
   const size = 1n << BigInt(hostBits);
   const mask = hostBits === 0 ? 0n : (1n << BigInt(hostBits)) - 1n;
-  return { family: 4, base: value & ~mask, prefix, size };
+  return { family: 4, base: value & ~mask, prefix, size, cidr: cidr.trim() };
 }
 function ipv4ToBigInt(addr) {
   const parts = addr.split(".");
@@ -213,10 +266,41 @@ function bigIntToIpv6(value) {
   const tail = groups.slice(bestStart + bestLen).join(":");
   return `${head}::${tail}`;
 }
+function splitByWeight(cidr) {
+  if (cidr.family !== 4) return [cidr];
+  const out = [];
+  const stack = [{ c: cidr }];
+  while (stack.length > 0) {
+    const item = stack.pop();
+    const c = item.c;
+    const weight = item.known ?? cidrWeight(c.cidr);
+    if (c.prefix >= 32) {
+      out.push(c);
+      continue;
+    }
+    const half = 1n << BigInt(32 - c.prefix - 1);
+    const mk = (base) => {
+      const sub = { ...c, prefix: c.prefix + 1, size: half, base };
+      return { ...sub, cidr: `${bigIntToIpv4(base)}/${c.prefix + 1}` };
+    };
+    const left = mk(c.base);
+    const right = mk(c.base + half);
+    const lw = cidrWeight(left.cidr);
+    const rw = cidrWeight(right.cidr);
+    if (lw === rw) {
+      out.push(c);
+      continue;
+    }
+    stack.push({ c: left, known: lw }, { c: right, known: rw });
+  }
+  return out.sort((a, b) => a.base < b.base ? -1 : a.base > b.base ? 1 : 0);
+}
 function expandCidrs(cidrs, options = {}) {
   const sample = options.sample ?? 2e4;
   const random = makeRandom(options.seed ?? 24301);
-  const parsed = cidrs.map(parseCidr).filter((c) => c !== null);
+  const parsedRaw = cidrs.map(parseCidr).filter((c) => c !== null);
+  if (parsedRaw.length === 0) return [];
+  const parsed = parsedRaw.flatMap(splitByWeight);
   if (parsed.length === 0) return [];
   if (sample <= 0) {
     const all = [];
@@ -233,26 +317,48 @@ function expandCidrs(cidrs, options = {}) {
   for (const family of [4, 6]) {
     const group = parsed.filter((c) => c.family === family);
     if (group.length === 0) continue;
-    const familyTotal = group.reduce((sum, c) => sum + c.size, 0n);
-    if (familyTotal === 0n) continue;
     const hasOtherFamily = parsed.some((c) => c.family !== family);
     const familyBudget = Math.max(1, Math.round(hasOtherFamily ? sample / 2 : sample));
+    const effectiveSize = (c) => {
+      if (c.family !== 4) return c.size;
+      const weight = cidrWeight(c.cidr);
+      if (weight <= 0) return 0n;
+      const scaled = Number(c.size) * weight;
+      return scaled >= 1 ? BigInt(Math.floor(scaled)) : 0n;
+    };
+    const rawTotal = group.reduce((sum, c) => sum + effectiveSize(c), 0n);
+    const allZero = rawTotal === 0n;
+    let familyTotal = rawTotal;
+    let allocOf = effectiveSize;
+    if (allZero) {
+      familyTotal = group.reduce((sum, c) => sum + c.size, 0n);
+      allocOf = (c) => c.size;
+    }
+    if (familyTotal === 0n) continue;
+    const minForCidr = (c) => {
+      if (c.family !== 4) return minPerCidr;
+      const w = cidrWeight(c.cidr);
+      if (w >= 1) return minPerCidr;
+      return Math.max(1, Math.round(minPerCidr * w));
+    };
     const plans = group.map((cidr) => {
-      const ratio = Number(cidr.size * BigInt(familyBudget) / familyTotal);
-      const wanted = Math.max(minPerCidr, Math.min(2e4, ratio));
+      const ratio = Number(allocOf(cidr) * BigInt(familyBudget) / familyTotal);
+      const wanted = Math.max(minForCidr(cidr), Math.min(2e4, ratio));
       return { cidr, count: Math.min(Number(cidr.size), wanted) };
     });
-    let familySum = plans.reduce((sum, p) => sum + p.count, 0);
+    const usablePlans = allZero ? plans : plans.filter((p) => effectiveSize(p.cidr) > 0n);
+    let familySum = usablePlans.reduce((sum, p) => sum + p.count, 0);
     while (familySum > familyBudget) {
       let target = null;
-      for (const plan of plans) {
+      for (const plan of usablePlans) {
         if (plan.count > 1 && (!target || plan.count > target.count)) target = plan;
       }
       if (!target) break;
       target.count -= 1;
       familySum -= 1;
     }
-    for (const { cidr, count } of plans) {
+    for (const { cidr, count } of usablePlans) {
+      if (count <= 0) continue;
       if (count >= Number(cidr.size)) {
         for (let i = 0n; i < cidr.size; i++) {
           const value = cidr.base + i;
@@ -303,7 +409,7 @@ function readIpFile(text) {
 // src/candidates.ts
 var DEFAULT_CANDIDATE_SAMPLE = 2e4;
 var DEFAULT_CANDIDATE_SEED = 24301;
-var DEFAULT_BRIDGE_SAMPLE = 300;
+var DEFAULT_BRIDGE_SAMPLE = 6556;
 function normalizeCidrInput(cidr) {
   if (cidr === void 0) return [];
   const list = Array.isArray(cidr) ? cidr : [cidr];
@@ -670,6 +776,216 @@ function probeWs101(ip, port, host, timeoutMs = 3e3, path = "/__edge_probe") {
     });
   });
 }
+function encodeWsFrame(payload, opcode = 2) {
+  const mask = crypto.randomBytes(4);
+  const masked = Buffer.alloc(payload.length);
+  for (let i = 0; i < payload.length; i++) {
+    masked[i] = payload[i] ^ mask[i % 4];
+  }
+  let header;
+  if (payload.length < 126) {
+    header = Buffer.from([128 | opcode, 128 | payload.length]);
+  } else if (payload.length < 65536) {
+    header = Buffer.alloc(4);
+    header[0] = 128 | opcode;
+    header[1] = 254;
+    header.writeUInt16BE(payload.length, 2);
+  } else {
+    header = Buffer.alloc(10);
+    header[0] = 128 | opcode;
+    header[1] = 255;
+    header.writeBigUInt64BE(BigInt(payload.length), 2);
+  }
+  return Buffer.concat([header, mask, masked]);
+}
+function decodeWsFrame(buf) {
+  if (buf.length < 2) return null;
+  const opcode = buf[0] & 15;
+  const len7 = buf[1] & 127;
+  let offset;
+  let payloadLen;
+  if (len7 < 126) {
+    offset = 2;
+    payloadLen = len7;
+  } else if (len7 === 126) {
+    if (buf.length < 4) return null;
+    offset = 4;
+    payloadLen = buf.readUInt16BE(2);
+  } else {
+    if (buf.length < 10) return null;
+    offset = 10;
+    payloadLen = Number(buf.readBigUInt64BE(2));
+  }
+  if (buf.length < offset + payloadLen) return null;
+  const frame = {
+    opcode,
+    payload: Buffer.from(buf.subarray(offset, offset + payloadLen))
+  };
+  const rest = Buffer.from(buf.subarray(offset + payloadLen));
+  return { frame, rest };
+}
+function probeWsPing(ip, port, host, timeoutMs = 5e3, path = "/__edge_probe") {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    const key = crypto.randomBytes(16).toString("base64");
+    let settled = false;
+    let handshakeDone = false;
+    let buf = Buffer.alloc(0);
+    let receivedText = "";
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socket.destroy();
+      } catch {
+      }
+      resolve({ ...result, latencyMs: Date.now() - started });
+    };
+    const request = [
+      `GET ${path} HTTP/1.1`,
+      `Host: ${host}`,
+      `Upgrade: websocket`,
+      `Connection: Upgrade`,
+      `Sec-WebSocket-Key: ${key}`,
+      `Sec-WebSocket-Version: 13`,
+      `User-Agent: ${USER_AGENT}`,
+      "",
+      ""
+    ].join("\r\n");
+    const socket = tls2.connect(
+      {
+        host: ip,
+        port,
+        servername: host,
+        rejectUnauthorized: false,
+        ALPNProtocols: ["http/1.1"]
+      },
+      () => {
+        socket.write(request);
+      }
+    );
+    const timer = setTimeout(() => {
+      finish({
+        ok: false,
+        colo: "",
+        status: 0,
+        error: handshakeDone ? "PING \u8D85\u65F6\uFF08\u6570\u636E\u9762\u672A\u54CD\u5E94\uFF09" : "\u63E1\u624B\u8D85\u65F6",
+        pongVerified: handshakeDone ? false : void 0
+      });
+    }, timeoutMs);
+    socket.setTimeout(timeoutMs, () => {
+      finish({
+        ok: false,
+        colo: "",
+        status: 0,
+        error: handshakeDone ? "PING \u8D85\u65F6\uFF08\u6570\u636E\u9762\u672A\u54CD\u5E94\uFF09" : "\u8FDE\u63A5\u8D85\u65F6",
+        pongVerified: handshakeDone ? false : void 0
+      });
+    });
+    socket.on("error", (err) => {
+      finish({
+        ok: false,
+        colo: "",
+        status: 0,
+        error: err.message,
+        pongVerified: handshakeDone ? false : void 0
+      });
+    });
+    socket.on("data", (chunk) => {
+      buf = Buffer.concat([buf, chunk]);
+      if (!handshakeDone) {
+        const lineEnd = buf.indexOf("\r\n\r\n");
+        if (lineEnd < 0) {
+          if (buf.length > 8192) finish({ ok: false, colo: "", status: 0, error: "\u54CD\u5E94\u5934\u5F02\u5E38" });
+          return;
+        }
+        const head = buf.slice(0, lineEnd).toString("latin1");
+        const statusLine = head.split("\r\n")[0] ?? "";
+        const statusMatch = /^HTTP\/1\.[01]\s+(\d{3})/.exec(statusLine);
+        const status = statusMatch ? Number(statusMatch[1]) : 0;
+        const colo = extractColo(head);
+        buf = buf.subarray(lineEnd + 4);
+        if (status !== 101) {
+          finish({ ok: false, colo, status, error: `HTTP ${status}` });
+          return;
+        }
+        handshakeDone = true;
+        socket.write(encodeWsFrame(new TextEncoder().encode("PING"), 1));
+      }
+      for (; ; ) {
+        const decoded = decodeWsFrame(buf);
+        if (!decoded) break;
+        buf = decoded.rest;
+        const { opcode, payload } = decoded.frame;
+        if (opcode === 8) {
+          const code = payload.length >= 2 ? payload.readUInt16BE(0) : 1005;
+          finish({
+            ok: false,
+            colo: "",
+            status: 101,
+            error: `WS \u5173\u95ED\uFF08code ${code}\uFF09`,
+            pongVerified: false
+          });
+          return;
+        }
+        if (opcode === 1 || opcode === 2) {
+          receivedText += payload.toString("utf8");
+          try {
+            const parsed = JSON.parse(receivedText);
+            if (parsed.pong === true) {
+              finish({
+                ok: true,
+                colo: typeof parsed.colo === "string" ? parsed.colo.toUpperCase() : "",
+                status: 101,
+                pongVerified: true,
+                probeColo: typeof parsed.colo === "string" ? parsed.colo.toUpperCase() : void 0
+              });
+              return;
+            }
+          } catch {
+          }
+        }
+      }
+    });
+  });
+}
+function probeTlsHandshake(ip, port, host, timeoutMs = 4e3) {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socket.destroy();
+      } catch {
+      }
+      resolve({ ip, tlsMs: result.tlsMs ?? Date.now() - started, ...result });
+    };
+    const socket = tls2.connect(
+      {
+        host: ip,
+        port,
+        servername: host,
+        rejectUnauthorized: false,
+        ALPNProtocols: ["http/1.1"]
+      },
+      () => {
+        const alpn = socket.alpnProtocol;
+        if (alpn && alpn !== "http/1.1") {
+          finish({ error: `ALPN=${alpn}` });
+          return;
+        }
+        finish({ tlsMs: Date.now() - started, alpn: alpn || void 0 });
+      }
+    );
+    const timer = setTimeout(() => finish({ error: "TLS \u63E1\u624B\u8D85\u65F6" }), timeoutMs);
+    socket.setTimeout(timeoutMs, () => finish({ error: "TLS \u8FDE\u63A5\u8D85\u65F6" }));
+    socket.on("error", (err) => finish({ error: err.message }));
+  });
+}
 function measureDownload(ip, port, host, bytes, timeoutMs = 12e3, path = "/__edge_probe") {
   return new Promise((resolve) => {
     const started = Date.now();
@@ -995,6 +1311,8 @@ async function runScan(options) {
   const started = Date.now();
   const concurrency = options.concurrency ?? 300;
   const tcpTimeoutMs = options.tcpTimeoutMs ?? 1200;
+  const tlsConcurrency = options.tlsConcurrency ?? 64;
+  const tlsTimeoutMs = options.tlsTimeoutMs ?? 4e3;
   const maxLatencyMs = options.maxLatencyMs ?? 0;
   const probeLimit = options.probeLimit ?? 120;
   const probeConcurrency = options.probeConcurrency ?? 24;
@@ -1025,22 +1343,56 @@ async function runScan(options) {
   });
   const tcpOk = tcpResults.filter((r) => r.ok);
   const filtered = maxLatencyMs > 0 ? tcpOk.filter((r) => r.latency <= maxLatencyMs) : tcpOk;
-  const stage1 = filtered.sort((a, b) => a.latency - b.latency).slice(0, probeLimit);
-  report({ type: "stage", stage: 2, name: "WebSocket 101 \u771F\u8FDE\u63A5\u6821\u9A8C", total: stage1.length });
+  report({ type: "stage", stage: 1, name: "TLS \u63E1\u624B\u7B5B\u9009", total: filtered.length });
+  let tlsDone = 0;
+  const tlsResults = await pool(filtered, tlsConcurrency, async (item) => {
+    const probe = await probeTlsHandshake(item.ip, options.port, options.host, tlsTimeoutMs);
+    tlsDone++;
+    if (tlsDone % 200 === 0 || tlsDone === filtered.length) {
+      report({
+        type: "progress",
+        stage: 1,
+        done: tlsDone,
+        total: filtered.length,
+        message: `TLS \u63E1\u624B ${tlsDone}/${filtered.length}${probe.tlsMs > 0 ? ` ${probe.tlsMs}ms` : " \u2717"}`
+      });
+    }
+    return { ...item, tls: probe };
+  });
+  const tlsOk = tlsResults.filter((r) => r.tls.tlsMs > 0);
+  const stage1 = tlsOk.sort((a, b) => a.tls.tlsMs - b.tls.tlsMs || a.latency - b.latency).slice(0, probeLimit);
+  const strictProbe = options.verifyPayload !== false;
+  const strictProbePath = "/__edge_probe";
+  report({
+    type: "stage",
+    stage: 2,
+    name: strictProbe ? "WS 101 + \u54CD\u5E94\u4F53\u6821\u9A8C\uFF08\u63A2\u9488\u7AEF\u70B9\uFF09" : "WebSocket 101 \u6821\u9A8C",
+    total: stage1.length
+  });
   let probeDone = 0;
+  let verifiedCount = 0;
   const probeResults = await pool(stage1, probeConcurrency, async (item) => {
-    const result = await probeWs101(item.ip, options.port, options.host, probeTimeoutMs, options.wsPath ?? "/__edge_probe");
+    const probeFn = strictProbe ? probeWsPing : probeWs101;
+    const probePath = strictProbe ? strictProbePath : options.wsPath ?? "/__edge_probe";
+    const result = await probeFn(
+      item.ip,
+      options.port,
+      options.host,
+      probeTimeoutMs,
+      probePath
+    );
     probeDone++;
+    if (result.pongVerified) verifiedCount++;
     report({
       type: "progress",
       stage: 2,
       done: probeDone,
       total: stage1.length,
-      message: `101 \u6821\u9A8C ${probeDone}/${stage1.length}${result.ok ? ` \u2713 ${result.colo}` : ""}`
+      message: strictProbe ? `101+PING \u6821\u9A8C ${probeDone}/${stage1.length}${result.ok ? ` \u2713 ${result.colo}` : result.pongVerified === false ? " \u2717 \u65E0\u54CD\u5E94" : ""}` : `101 \u6821\u9A8C ${probeDone}/${stage1.length}${result.ok ? ` \u2713 ${result.colo}` : ""}`
     });
     return { ...item, probe: result };
   });
-  const wsOk = probeResults.filter((r) => r.probe.ok);
+  const wsOk = strictProbe ? probeResults.filter((r) => r.probe.ok && r.probe.pongVerified === true) : probeResults.filter((r) => r.probe.ok);
   const countryFilter = normalizeCountryFilter(options.countries ?? []);
   let wsFiltered = wsOk;
   let appliedCountries = [];
@@ -1066,7 +1418,7 @@ async function runScan(options) {
       });
     }
   }
-  const stage2 = wsFiltered.sort((a, b) => a.latency - b.latency).slice(0, speedLimit);
+  const stage2 = wsFiltered.sort((a, b) => a.tls.tlsMs - b.tls.tlsMs || a.latency - b.latency).slice(0, speedLimit);
   let speedResults;
   const speedMode = options.speedMode ?? "probe";
   if (options.skipSpeed) {
@@ -1126,8 +1478,11 @@ async function runScan(options) {
     port: options.port,
     colo: r.probe.colo || "UNK",
     latency: r.latency,
+    tlsMs: r.tls.tlsMs,
     speed: r.speed ? Number(r.speed.toFixed(2)) : 0
-  })).sort((a, b) => options.skipSpeed ? a.latency - b.latency : b.speed - a.speed || a.latency - b.latency).slice(0, top);
+  })).sort(
+    (a, b) => options.skipSpeed ? a.tlsMs - b.tlsMs || a.latency - b.latency : b.speed - a.speed || a.tlsMs - b.tlsMs || a.latency - b.latency
+  ).slice(0, top);
   for (const entry of entries) {
     report({ type: "result", entry });
   }
@@ -1136,7 +1491,9 @@ async function runScan(options) {
     stats: {
       candidates: candidates.length,
       tcpOk: tcpOk.length,
+      tlsOk: tlsOk.length,
       wsOk: wsOk.length,
+      verified: verifiedCount,
       speedOk: entries.length,
       elapsedMs: Date.now() - started,
       countries: appliedCountries,
@@ -1447,7 +1804,7 @@ async function handleRequest(req, res) {
 }
 
 // src/version.ts
-var VERSION = "0.2.0";
+var VERSION = "0.4.0";
 var NAME = "cfpilot-scanner";
 
 // src/cli.ts
@@ -1481,15 +1838,23 @@ scan \u9009\u9879:
   --speed-conns <n>      \u6D4B\u901F\u5E76\u53D1\u8FDE\u63A5\u6570\uFF0C\u9ED8\u8BA4 3
                          \u5355\u6761 TCP \u8FDE\u63A5\u53D7\u62E5\u585E\u7A97\u53E3\u9650\u5236\uFF0C\u591A\u8FDE\u63A5\u66F4\u63A5\u8FD1\u771F\u5B9E\u5E26\u5BBD
   --speed-duration <ms>  \u6D4B\u901F\u65F6\u957F\uFF0C\u9ED8\u8BA4 6000
+  --no-verify            \u9636\u6BB5\u4E8C\u53EA\u505A 101 \u63E1\u624B\uFF0C\u8DF3\u8FC7\u54CD\u5E94\u4F53\u6821\u9A8C
+                          \uFF08\u9ED8\u8BA4\u6821\u9A8C\uFF1A\u53D1 PING \u5E76\u9A8C\u8BC1\u6570\u636E\u9762\u56DE {"pong":true}\uFF09
   --no-speed             \u8DF3\u8FC7\u6D4B\u901F\uFF0C\u53EA\u6309\u5EF6\u8FDF\u6392\u5E8F
   --top <n>              \u8FD4\u56DE\u6761\u6570\uFF0C\u9ED8\u8BA4 15
-  --concurrency <n>      \u9636\u6BB5\u4E00\u5E76\u53D1\uFF0C\u9ED8\u8BA4 300
+  --concurrency <n>      \u9636\u6BB5\u4E00 TCP \u5E76\u53D1\uFF0C\u9ED8\u8BA4 300
+  --tls-concurrency <n>  \u9636\u6BB5\u4E00 TLS \u63E1\u624B\u5E76\u53D1\uFF0C\u9ED8\u8BA4 64
+                          TLS \u63E1\u624B\u662F CPU \u5BC6\u96C6\u578B\u64CD\u4F5C\uFF0C\u8FC7\u9AD8\u4F1A\u8BA9\u672C\u673A\u6210\u4E3A\u74F6\u9888
   --sample <n>           \u5019\u9009 IP \u91C7\u6837\u6570\uFF0C\u9ED8\u8BA4 20000
+                          \u5EFA\u8BAE 6556 \u8D77\uFF1A\u9636\u6BB5\u4E00\u6309 TLS \u63E1\u624B\u8017\u65F6\u7B5B\u9009\uFF0C\u800C\u63E1\u624B\u5FEB\u6162
+                          \u4E0E TCP \u5EF6\u8FDF\u51E0\u4E4E\u65E0\u5173\uFF08\u5B9E\u6D4B TCP 9ms \u7684 IP \u53EF\u80FD\u8981 3.5 \u79D2\uFF09\uFF0C
+                          \u91C7\u6837\u5C0F\u4E86\u6839\u672C\u78B0\u4E0D\u5230\u63E1\u624B\u5FEB\u7684 IP
   --countries <a,b>      \u56FD\u5BB6 / \u5730\u533A\u8FC7\u6EE4\uFF08\u53EF\u591A\u9009\uFF0C\u9017\u53F7\u5206\u9694\uFF0C\u5982 HK,JP,SG\uFF09
                          \u4E0D\u9009 = \u5168\u91CF\u3002\u673A\u623F\u6765\u81EA 101 \u63E1\u624B\u54CD\u5E94\uFF1B\u7B5B\u5B8C\u4E3A\u7A7A\u4F1A\u81EA\u52A8\u5FFD\u7565
   --cidr <a,b>           \u81EA\u5B9A\u4E49\u7F51\u6BB5\uFF08\u53EF\u91CD\u590D\uFF0C\u7528\u9017\u53F7\u5206\u9694\uFF09
   --ip-file <path>       \u4F7F\u7528\u672C\u5730 IP \u5217\u8868\u6587\u4EF6
-  --max-latency <ms>     \u9636\u6BB5\u4E00\u5EF6\u8FDF\u4E0A\u9650\uFF0C\u9ED8\u8BA4 0\uFF08\u4E0D\u9650\uFF09
+  --max-latency <ms>     \u9636\u6BB5\u4E00 TCP \u5EF6\u8FDF\u4E0A\u9650\uFF0C\u9ED8\u8BA4 0\uFF08\u4E0D\u9650\uFF09
+  --tls-timeout <ms>     \u9636\u6BB5\u4E00 TLS \u63E1\u624B\u8D85\u65F6\uFF0C\u9ED8\u8BA4 4000
   --probe-limit <n>      \u8FDB\u5165 101 \u6821\u9A8C\u7684\u5019\u9009\u6570\uFF0C\u9ED8\u8BA4 120
   --speed-limit <n>      \u8FDB\u5165\u6D4B\u901F\u7684\u5019\u9009\u6570\uFF0C\u9ED8\u8BA4 30
   --speed-bytes <n>      \u6D4B\u901F\u5B57\u8282\u6570\uFF0C\u9ED8\u8BA4 5242880
@@ -1630,15 +1995,16 @@ function printTable(entries) {
     process.stdout.write("\n\u6CA1\u6709\u901A\u8FC7\u5168\u90E8\u6821\u9A8C\u7684\u8282\u70B9\u3002\n");
     return;
   }
-  process.stdout.write("\n\u6392\u540D  \u5730\u5740                     \u673A\u623F   \u5EF6\u8FDF(ms)  \u4E0B\u884C(MB/s)\n");
-  process.stdout.write("\u2500".repeat(58) + "\n");
+  process.stdout.write("\n\u6392\u540D  \u5730\u5740                     \u673A\u623F   TLS(ms)  TCP(ms)  \u4E0B\u884C(MB/s)\n");
+  process.stdout.write("\u2500".repeat(66) + "\n");
   entries.forEach((entry, index) => {
     const rank = String(index + 1).padStart(2, " ");
     const address = `${entry.ip}:${entry.port}`.padEnd(24, " ");
     const colo = (entry.colo || "UNK").padEnd(6, " ");
+    const tls3 = String(entry.tlsMs).padStart(7, " ");
     const latency = String(entry.latency).padStart(7, " ");
     const speed = entry.speed.toFixed(1).padStart(9, " ");
-    process.stdout.write(`${rank}   ${address} ${colo} ${latency}  ${speed}
+    process.stdout.write(`${rank}   ${address} ${colo} ${tls3} ${latency}  ${speed}
 `);
   });
 }
@@ -1663,6 +2029,7 @@ async function commandScan(args) {
   const wsPath = normalizeWsPath(flagString(args, "path"), "/__edge_probe");
   const probePath = normalizeWsPath(flagString(args, "probe-path"), "/__edge_probe");
   const noSpeed = flagBool(args, "no-speed");
+  const verifyPayload = !flagBool(args, "no-verify");
   const countries = normalizeCountryFilter(flagList(args, "countries"));
   const callback = noCallback ? "" : flagString(args, "callback", token ? `https://${host}/api/v1/preferred-ips` : "");
   if (!quiet) {
@@ -1752,8 +2119,11 @@ ${NAME} v${VERSION}
     wsPath,
     probePath,
     skipSpeed,
+    verifyPayload,
     concurrency: flagNumber(args, "concurrency", 300),
     tcpTimeoutMs: flagNumber(args, "timeout", 1200),
+    tlsConcurrency: flagNumber(args, "tls-concurrency", 64),
+    tlsTimeoutMs: flagNumber(args, "tls-timeout", 4e3),
     maxLatencyMs: flagNumber(args, "max-latency", 0),
     probeLimit: flagNumber(args, "probe-limit", 120),
     probeTimeoutMs: flagNumber(args, "probe-timeout", 3e3),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cfpilot-scanner",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "CFPilot 优选器：用你自己的域名做 WebSocket 101 真连接校验，只保留真正可用的 Cloudflare IP；兼容任意 VLESS-WS 项目",
   "license": "MIT",
   "author": "CFPilot Contributors",
@@ -31,7 +31,7 @@
   "scripts": {
     "build": "node scripts/build.mjs",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "node ../../scripts/sync-version.mjs packages/scanner-cli && npm run build"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",