cfpilot-scanner 0.3.0 → 0.4.1

package/dist/cli.js

@@ -95,6 +95,59 @@ var BUILTIN_IPV4_CIDRS = [
   "172.64.0.0/13",
   "131.0.72.0/22"
 ];
+var IPV4_CIDR_WEIGHTS = {
+  "104.16.0.0/13": 1,
+  // 实测 8/12
+  "104.24.0.0/14": 0.9,
+  // 实测 7/12
+  "103.21.244.0/22": 0.3,
+  "103.31.4.0/22": 0.3,
+  "190.93.240.0/20": 0.3,
+  "188.114.96.0/20": 0.3,
+  "141.101.64.0/18": 0.2,
+  "162.158.0.0/16": 0.2,
+  // 162.158.x.x：边缘节点，部分可用
+  // 162.159.x.x 是 Cloudflare 的管理 / API 网段，真机实测**多数**返回
+  // HTTP 403（反爬风控），但**并非全部**——用户实测 162.159.237.59 可用
+  // （2.8 MB/s），本地复测同样通过（SJC）。
+  //
+  // 因此**不能压到 0**（会错杀可用 IP），给一个很低的权重：
+  // 仍能采到少量候选，但不让大量 403 IP 占据阶段二额度。
+  //
+  // ⚠️ 教训：权重粒度为 /16，但实际可用性可能细到单个 IP。
+  // 实测样本只有 9 个就下「完全不可用」的结论过于草率。
+  "162.159.0.0/16": 0.05,
+  "172.64.0.0/13": 0.1,
+  // 实测 0/12 —— 不采样
+  "173.245.48.0/20": 0,
+  "103.22.200.0/22": 0,
+  "108.162.192.0/18": 0,
+  "197.234.240.0/22": 0,
+  "198.41.128.0/17": 0,
+  "131.0.72.0/22": 0
+};
+var DEFAULT_CIDR_WEIGHT = 0.2;
+function cidrWeight(cidr) {
+  const normalized = cidr.trim();
+  if (normalized in IPV4_CIDR_WEIGHTS) return IPV4_CIDR_WEIGHTS[normalized];
+  const parsed = parseCidr(normalized);
+  if (!parsed || parsed.family !== 4) return DEFAULT_CIDR_WEIGHT;
+  let bestPrefix = -1;
+  let bestWeight = DEFAULT_CIDR_WEIGHT;
+  for (const [tableCidr, weight] of Object.entries(IPV4_CIDR_WEIGHTS)) {
+    const tableParsed = parseCidr(tableCidr);
+    if (!tableParsed || tableParsed.family !== 4) continue;
+    if (tableParsed.prefix > parsed.prefix) continue;
+    const parsedNorm = parsed.base >> BigInt(32 - tableParsed.prefix);
+    const tableNorm = tableParsed.base >> BigInt(32 - tableParsed.prefix);
+    if (parsedNorm !== tableNorm) continue;
+    if (tableParsed.prefix > bestPrefix) {
+      bestPrefix = tableParsed.prefix;
+      bestWeight = weight;
+    }
+  }
+  return bestWeight;
+}
 var BUILTIN_IPV6_CIDRS = [
   "2400:cb00::/32",
   "2606:4700::/32",
@@ -143,7 +196,7 @@ function parseCidr(cidr) {
     const hostBits2 = 128 - prefix;
     const size2 = 1n << BigInt(hostBits2);
     const mask2 = hostBits2 === 0 ? 0n : (1n << BigInt(hostBits2)) - 1n;
-    return { family: 6, base: base & ~mask2, prefix, size: size2 };
+    return { family: 6, base: base & ~mask2, prefix, size: size2, cidr: cidr.trim() };
   }
   if (prefix < 0 || prefix > 32) return null;
   const value = ipv4ToBigInt(addr);
@@ -151,7 +204,7 @@ function parseCidr(cidr) {
   const hostBits = 32 - prefix;
   const size = 1n << BigInt(hostBits);
   const mask = hostBits === 0 ? 0n : (1n << BigInt(hostBits)) - 1n;
-  return { family: 4, base: value & ~mask, prefix, size };
+  return { family: 4, base: value & ~mask, prefix, size, cidr: cidr.trim() };
 }
 function ipv4ToBigInt(addr) {
   const parts = addr.split(".");
@@ -213,10 +266,41 @@ function bigIntToIpv6(value) {
   const tail = groups.slice(bestStart + bestLen).join(":");
   return `${head}::${tail}`;
 }
+function splitByWeight(cidr) {
+  if (cidr.family !== 4) return [cidr];
+  const out = [];
+  const stack = [{ c: cidr }];
+  while (stack.length > 0) {
+    const item = stack.pop();
+    const c = item.c;
+    const weight = item.known ?? cidrWeight(c.cidr);
+    if (c.prefix >= 32) {
+      out.push(c);
+      continue;
+    }
+    const half = 1n << BigInt(32 - c.prefix - 1);
+    const mk = (base) => {
+      const sub = { ...c, prefix: c.prefix + 1, size: half, base };
+      return { ...sub, cidr: `${bigIntToIpv4(base)}/${c.prefix + 1}` };
+    };
+    const left = mk(c.base);
+    const right = mk(c.base + half);
+    const lw = cidrWeight(left.cidr);
+    const rw = cidrWeight(right.cidr);
+    if (lw === rw) {
+      out.push(c);
+      continue;
+    }
+    stack.push({ c: left, known: lw }, { c: right, known: rw });
+  }
+  return out.sort((a, b) => a.base < b.base ? -1 : a.base > b.base ? 1 : 0);
+}
 function expandCidrs(cidrs, options = {}) {
   const sample = options.sample ?? 2e4;
   const random = makeRandom(options.seed ?? 24301);
-  const parsed = cidrs.map(parseCidr).filter((c) => c !== null);
+  const parsedRaw = cidrs.map(parseCidr).filter((c) => c !== null);
+  if (parsedRaw.length === 0) return [];
+  const parsed = parsedRaw.flatMap(splitByWeight);
   if (parsed.length === 0) return [];
   if (sample <= 0) {
     const all = [];
@@ -233,26 +317,48 @@ function expandCidrs(cidrs, options = {}) {
   for (const family of [4, 6]) {
     const group = parsed.filter((c) => c.family === family);
     if (group.length === 0) continue;
-    const familyTotal = group.reduce((sum, c) => sum + c.size, 0n);
-    if (familyTotal === 0n) continue;
     const hasOtherFamily = parsed.some((c) => c.family !== family);
     const familyBudget = Math.max(1, Math.round(hasOtherFamily ? sample / 2 : sample));
+    const effectiveSize = (c) => {
+      if (c.family !== 4) return c.size;
+      const weight = cidrWeight(c.cidr);
+      if (weight <= 0) return 0n;
+      const scaled = Number(c.size) * weight;
+      return scaled >= 1 ? BigInt(Math.floor(scaled)) : 0n;
+    };
+    const rawTotal = group.reduce((sum, c) => sum + effectiveSize(c), 0n);
+    const allZero = rawTotal === 0n;
+    let familyTotal = rawTotal;
+    let allocOf = effectiveSize;
+    if (allZero) {
+      familyTotal = group.reduce((sum, c) => sum + c.size, 0n);
+      allocOf = (c) => c.size;
+    }
+    if (familyTotal === 0n) continue;
+    const minForCidr = (c) => {
+      if (c.family !== 4) return minPerCidr;
+      const w = cidrWeight(c.cidr);
+      if (w >= 1) return minPerCidr;
+      return Math.max(1, Math.round(minPerCidr * w));
+    };
     const plans = group.map((cidr) => {
-      const ratio = Number(cidr.size * BigInt(familyBudget) / familyTotal);
-      const wanted = Math.max(minPerCidr, Math.min(2e4, ratio));
+      const ratio = Number(allocOf(cidr) * BigInt(familyBudget) / familyTotal);
+      const wanted = Math.max(minForCidr(cidr), Math.min(2e4, ratio));
       return { cidr, count: Math.min(Number(cidr.size), wanted) };
     });
-    let familySum = plans.reduce((sum, p) => sum + p.count, 0);
+    const usablePlans = allZero ? plans : plans.filter((p) => effectiveSize(p.cidr) > 0n);
+    let familySum = usablePlans.reduce((sum, p) => sum + p.count, 0);
     while (familySum > familyBudget) {
       let target = null;
-      for (const plan of plans) {
+      for (const plan of usablePlans) {
         if (plan.count > 1 && (!target || plan.count > target.count)) target = plan;
       }
       if (!target) break;
       target.count -= 1;
       familySum -= 1;
     }
-    for (const { cidr, count } of plans) {
+    for (const { cidr, count } of usablePlans) {
+      if (count <= 0) continue;
       if (count >= Number(cidr.size)) {
         for (let i = 0n; i < cidr.size; i++) {
           const value = cidr.base + i;
@@ -300,69 +406,6 @@ function readIpFile(text) {
   return out;
 }
 
-// src/candidates.ts
-var DEFAULT_CANDIDATE_SAMPLE = 2e4;
-var DEFAULT_CANDIDATE_SEED = 24301;
-var DEFAULT_BRIDGE_SAMPLE = 300;
-function normalizeCidrInput(cidr) {
-  if (cidr === void 0) return [];
-  const list = Array.isArray(cidr) ? cidr : [cidr];
-  const out = [];
-  for (const item of list) {
-    if (typeof item !== "string") continue;
-    for (const part of item.split(/[\n,]+/)) {
-      const value = part.trim();
-      if (value) out.push(value);
-    }
-  }
-  return out;
-}
-function isIpv6Cidr(cidr) {
-  return cidr.includes(":");
-}
-function filterByFamily(cidrs, family) {
-  if (family === "both") return cidrs;
-  const wantIpv6 = family === "v6";
-  return cidrs.filter((cidr) => isIpv6Cidr(cidr) === wantIpv6);
-}
-async function loadCloudflareCidrs(family) {
-  let ipv4 = BUILTIN_IPV4_CIDRS;
-  let ipv6 = BUILTIN_IPV6_CIDRS;
-  try {
-    const ranges = await fetchCloudflareCidrs();
-    if (ranges.ipv4.length > 0) ipv4 = ranges.ipv4;
-    if (ranges.ipv6.length > 0) ipv6 = ranges.ipv6;
-  } catch {
-  }
-  if (family === "v4") return [...ipv4];
-  if (family === "v6") return [...ipv6];
-  return [...ipv4, ...ipv6];
-}
-async function resolveCandidates(opts = {}) {
-  const sample = opts.sample ?? DEFAULT_CANDIDATE_SAMPLE;
-  const seed = opts.seed ?? DEFAULT_CANDIDATE_SEED;
-  const family = opts.family ?? "both";
-  const customCidrs = normalizeCidrInput(opts.cidr);
-  if (customCidrs.length > 0) {
-    return expandCidrs(filterByFamily(customCidrs, family), { sample, seed });
-  }
-  const cidrs = await loadCloudflareCidrs(family);
-  return expandCidrs(cidrs, { sample, seed });
-}
-function normalizeCandidateList(input) {
-  if (!Array.isArray(input) || input.length === 0) return [];
-  const lines = input.filter((item) => typeof item === "string");
-  if (lines.length === 0) return [];
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const ip of readIpFile(lines.join("\n"))) {
-    if (seen.has(ip)) continue;
-    seen.add(ip);
-    out.push(ip);
-  }
-  return out;
-}
-
 // src/net-env.ts
 import * as net from "node:net";
 import { execFile } from "node:child_process";
@@ -426,6 +469,44 @@ function isFakeIp(ip) {
   const [a, b] = parts;
   return a === 198 && (b === 18 || b === 19);
 }
+function isPublicAddress(ip) {
+  const value = ip.trim();
+  if (!value) return false;
+  if (!value.includes(":")) {
+    const parts = value.split(".");
+    if (parts.length !== 4) return false;
+    const nums = [];
+    for (const p of parts) {
+      if (!/^\d{1,3}$/.test(p)) return false;
+      const n = Number(p);
+      if (n > 255) return false;
+      nums.push(n);
+    }
+    const [a, b] = nums;
+    if (a === 0) return false;
+    if (a === 10) return false;
+    if (a === 127) return false;
+    if (a >= 224) return false;
+    if (a === 169 && b === 254) return false;
+    if (a === 172 && b >= 16 && b <= 31) return false;
+    if (a === 192 && b === 168) return false;
+    if (a === 100 && b >= 64 && b <= 127) return false;
+    if (a === 198 && (b === 18 || b === 19)) return false;
+    return true;
+  }
+  const lower = value.toLowerCase();
+  if (lower.startsWith("::ffff:") && lower.includes(".")) {
+    return isPublicAddress(lower.slice(7));
+  }
+  const groups = lower.split(":");
+  if (groups.length < 3) return false;
+  const first = groups[0];
+  if (!/^[0-9a-f]{1,4}$/.test(first)) return false;
+  const firstByte = Number.parseInt(first.slice(0, 2).padEnd(2, "0"), 16);
+  if (firstByte < 32 || firstByte > 63) return false;
+  if (lower.startsWith("2001:db8:")) return false;
+  return true;
+}
 async function detectProxyInterference(host) {
   const findings = [];
   const listening = [];
@@ -468,6 +549,74 @@ function isMsysPollutedPath(value) {
   return looksWindows || hasMsysHint;
 }
 
+// src/candidates.ts
+var DEFAULT_CANDIDATE_SAMPLE = 2e4;
+var DEFAULT_CANDIDATE_SEED = 24301;
+var DEFAULT_BRIDGE_SAMPLE = 6556;
+function normalizeCidrInput(cidr) {
+  if (cidr === void 0) return [];
+  const list = Array.isArray(cidr) ? cidr : [cidr];
+  const out = [];
+  for (const item of list) {
+    if (typeof item !== "string") continue;
+    for (const part of item.split(/[\n,]+/)) {
+      const value = part.trim();
+      if (value) out.push(value);
+    }
+  }
+  return out;
+}
+function isIpv6Cidr(cidr) {
+  return cidr.includes(":");
+}
+function filterByFamily(cidrs, family) {
+  if (family === "both") return cidrs;
+  const wantIpv6 = family === "v6";
+  return cidrs.filter((cidr) => isIpv6Cidr(cidr) === wantIpv6);
+}
+async function loadCloudflareCidrs(family) {
+  let ipv4 = BUILTIN_IPV4_CIDRS;
+  let ipv6 = BUILTIN_IPV6_CIDRS;
+  try {
+    const ranges = await fetchCloudflareCidrs();
+    if (ranges.ipv4.length > 0) ipv4 = ranges.ipv4;
+    if (ranges.ipv6.length > 0) ipv6 = ranges.ipv6;
+  } catch {
+  }
+  if (family === "v4") return [...ipv4];
+  if (family === "v6") return [...ipv6];
+  return [...ipv4, ...ipv6];
+}
+async function resolveCandidates(opts = {}) {
+  const sample = opts.sample ?? DEFAULT_CANDIDATE_SAMPLE;
+  const seed = opts.seed ?? DEFAULT_CANDIDATE_SEED;
+  const family = opts.family ?? "both";
+  const customCidrs = normalizeCidrInput(opts.cidr);
+  if (customCidrs.length > 0) {
+    return expandCidrs(filterByFamily(customCidrs, family), { sample, seed });
+  }
+  const cidrs = await loadCloudflareCidrs(family);
+  return expandCidrs(cidrs, { sample, seed });
+}
+function normalizeCandidateList(input) {
+  if (!Array.isArray(input) || input.length === 0) return [];
+  const lines = input.filter((item) => typeof item === "string");
+  if (lines.length === 0) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const ip of readIpFile(lines.join("\n"))) {
+    if (seen.has(ip)) continue;
+    seen.add(ip);
+    const isIpv4Literal = /^\d{1,3}(\.\d{1,3}){3}$/.test(ip);
+    const isIpv6Literal = ip.includes(":");
+    if (isIpv4Literal || isIpv6Literal) {
+      if (!isPublicAddress(ip)) continue;
+    }
+    out.push(ip);
+  }
+  return out;
+}
+
 // src/speed-url.ts
 import * as tls from "node:tls";
 var SPEED_URL_PRESETS = [
@@ -670,6 +819,216 @@ function probeWs101(ip, port, host, timeoutMs = 3e3, path = "/__edge_probe") {
     });
   });
 }
+function encodeWsFrame(payload, opcode = 2) {
+  const mask = crypto.randomBytes(4);
+  const masked = Buffer.alloc(payload.length);
+  for (let i = 0; i < payload.length; i++) {
+    masked[i] = payload[i] ^ mask[i % 4];
+  }
+  let header;
+  if (payload.length < 126) {
+    header = Buffer.from([128 | opcode, 128 | payload.length]);
+  } else if (payload.length < 65536) {
+    header = Buffer.alloc(4);
+    header[0] = 128 | opcode;
+    header[1] = 254;
+    header.writeUInt16BE(payload.length, 2);
+  } else {
+    header = Buffer.alloc(10);
+    header[0] = 128 | opcode;
+    header[1] = 255;
+    header.writeBigUInt64BE(BigInt(payload.length), 2);
+  }
+  return Buffer.concat([header, mask, masked]);
+}
+function decodeWsFrame(buf) {
+  if (buf.length < 2) return null;
+  const opcode = buf[0] & 15;
+  const len7 = buf[1] & 127;
+  let offset;
+  let payloadLen;
+  if (len7 < 126) {
+    offset = 2;
+    payloadLen = len7;
+  } else if (len7 === 126) {
+    if (buf.length < 4) return null;
+    offset = 4;
+    payloadLen = buf.readUInt16BE(2);
+  } else {
+    if (buf.length < 10) return null;
+    offset = 10;
+    payloadLen = Number(buf.readBigUInt64BE(2));
+  }
+  if (buf.length < offset + payloadLen) return null;
+  const frame = {
+    opcode,
+    payload: Buffer.from(buf.subarray(offset, offset + payloadLen))
+  };
+  const rest = Buffer.from(buf.subarray(offset + payloadLen));
+  return { frame, rest };
+}
+function probeWsPing(ip, port, host, timeoutMs = 5e3, path = "/__edge_probe") {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    const key = crypto.randomBytes(16).toString("base64");
+    let settled = false;
+    let handshakeDone = false;
+    let buf = Buffer.alloc(0);
+    let receivedText = "";
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socket.destroy();
+      } catch {
+      }
+      resolve({ ...result, latencyMs: Date.now() - started });
+    };
+    const request = [
+      `GET ${path} HTTP/1.1`,
+      `Host: ${host}`,
+      `Upgrade: websocket`,
+      `Connection: Upgrade`,
+      `Sec-WebSocket-Key: ${key}`,
+      `Sec-WebSocket-Version: 13`,
+      `User-Agent: ${USER_AGENT}`,
+      "",
+      ""
+    ].join("\r\n");
+    const socket = tls2.connect(
+      {
+        host: ip,
+        port,
+        servername: host,
+        rejectUnauthorized: false,
+        ALPNProtocols: ["http/1.1"]
+      },
+      () => {
+        socket.write(request);
+      }
+    );
+    const timer = setTimeout(() => {
+      finish({
+        ok: false,
+        colo: "",
+        status: 0,
+        error: handshakeDone ? "PING \u8D85\u65F6\uFF08\u6570\u636E\u9762\u672A\u54CD\u5E94\uFF09" : "\u63E1\u624B\u8D85\u65F6",
+        pongVerified: handshakeDone ? false : void 0
+      });
+    }, timeoutMs);
+    socket.setTimeout(timeoutMs, () => {
+      finish({
+        ok: false,
+        colo: "",
+        status: 0,
+        error: handshakeDone ? "PING \u8D85\u65F6\uFF08\u6570\u636E\u9762\u672A\u54CD\u5E94\uFF09" : "\u8FDE\u63A5\u8D85\u65F6",
+        pongVerified: handshakeDone ? false : void 0
+      });
+    });
+    socket.on("error", (err) => {
+      finish({
+        ok: false,
+        colo: "",
+        status: 0,
+        error: err.message,
+        pongVerified: handshakeDone ? false : void 0
+      });
+    });
+    socket.on("data", (chunk) => {
+      buf = Buffer.concat([buf, chunk]);
+      if (!handshakeDone) {
+        const lineEnd = buf.indexOf("\r\n\r\n");
+        if (lineEnd < 0) {
+          if (buf.length > 8192) finish({ ok: false, colo: "", status: 0, error: "\u54CD\u5E94\u5934\u5F02\u5E38" });
+          return;
+        }
+        const head = buf.slice(0, lineEnd).toString("latin1");
+        const statusLine = head.split("\r\n")[0] ?? "";
+        const statusMatch = /^HTTP\/1\.[01]\s+(\d{3})/.exec(statusLine);
+        const status = statusMatch ? Number(statusMatch[1]) : 0;
+        const colo = extractColo(head);
+        buf = buf.subarray(lineEnd + 4);
+        if (status !== 101) {
+          finish({ ok: false, colo, status, error: `HTTP ${status}` });
+          return;
+        }
+        handshakeDone = true;
+        socket.write(encodeWsFrame(new TextEncoder().encode("PING"), 1));
+      }
+      for (; ; ) {
+        const decoded = decodeWsFrame(buf);
+        if (!decoded) break;
+        buf = decoded.rest;
+        const { opcode, payload } = decoded.frame;
+        if (opcode === 8) {
+          const code = payload.length >= 2 ? payload.readUInt16BE(0) : 1005;
+          finish({
+            ok: false,
+            colo: "",
+            status: 101,
+            error: `WS \u5173\u95ED\uFF08code ${code}\uFF09`,
+            pongVerified: false
+          });
+          return;
+        }
+        if (opcode === 1 || opcode === 2) {
+          receivedText += payload.toString("utf8");
+          try {
+            const parsed = JSON.parse(receivedText);
+            if (parsed.pong === true) {
+              finish({
+                ok: true,
+                colo: typeof parsed.colo === "string" ? parsed.colo.toUpperCase() : "",
+                status: 101,
+                pongVerified: true,
+                probeColo: typeof parsed.colo === "string" ? parsed.colo.toUpperCase() : void 0
+              });
+              return;
+            }
+          } catch {
+          }
+        }
+      }
+    });
+  });
+}
+function probeTlsHandshake(ip, port, host, timeoutMs = 4e3) {
+  return new Promise((resolve) => {
+    const started = Date.now();
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socket.destroy();
+      } catch {
+      }
+      resolve({ ip, tlsMs: result.tlsMs ?? Date.now() - started, ...result });
+    };
+    const socket = tls2.connect(
+      {
+        host: ip,
+        port,
+        servername: host,
+        rejectUnauthorized: false,
+        ALPNProtocols: ["http/1.1"]
+      },
+      () => {
+        const alpn = socket.alpnProtocol;
+        if (alpn && alpn !== "http/1.1") {
+          finish({ error: `ALPN=${alpn}` });
+          return;
+        }
+        finish({ tlsMs: Date.now() - started, alpn: alpn || void 0 });
+      }
+    );
+    const timer = setTimeout(() => finish({ error: "TLS \u63E1\u624B\u8D85\u65F6" }), timeoutMs);
+    socket.setTimeout(timeoutMs, () => finish({ error: "TLS \u8FDE\u63A5\u8D85\u65F6" }));
+    socket.on("error", (err) => finish({ error: err.message }));
+  });
+}
 function measureDownload(ip, port, host, bytes, timeoutMs = 12e3, path = "/__edge_probe") {
   return new Promise((resolve) => {
     const started = Date.now();
@@ -991,10 +1350,22 @@ async function pool(items, concurrency, worker) {
   await Promise.all(runners);
   return out;
 }
+async function withRetry(attempts, fn, isOk = (r) => r.ok === true) {
+  const total = Math.max(1, Math.floor(attempts));
+  let last;
+  for (let i = 0; i < total; i++) {
+    last = await fn();
+    if (isOk(last)) return last;
+  }
+  return last;
+}
 async function runScan(options) {
   const started = Date.now();
   const concurrency = options.concurrency ?? 300;
   const tcpTimeoutMs = options.tcpTimeoutMs ?? 1200;
+  const retries = options.retries ?? 2;
+  const tlsConcurrency = options.tlsConcurrency ?? 64;
+  const tlsTimeoutMs = options.tlsTimeoutMs ?? 4e3;
   const maxLatencyMs = options.maxLatencyMs ?? 0;
   const probeLimit = options.probeLimit ?? 120;
   const probeConcurrency = options.probeConcurrency ?? 24;
@@ -1010,7 +1381,7 @@ async function runScan(options) {
   report({ type: "stage", stage: 1, name: "TCP \u63E1\u624B\u521D\u7B5B", total: candidates.length });
   let done = 0;
   const tcpResults = await pool(candidates, concurrency, async (ip) => {
-    const result = await tcpPing(ip, options.port, tcpTimeoutMs);
+    const result = await withRetry(retries, () => tcpPing(ip, options.port, tcpTimeoutMs));
     done++;
     if (done % 500 === 0 || done === candidates.length) {
       report({
@@ -1025,22 +1396,57 @@ async function runScan(options) {
   });
   const tcpOk = tcpResults.filter((r) => r.ok);
   const filtered = maxLatencyMs > 0 ? tcpOk.filter((r) => r.latency <= maxLatencyMs) : tcpOk;
-  const stage1 = filtered.sort((a, b) => a.latency - b.latency).slice(0, probeLimit);
-  report({ type: "stage", stage: 2, name: "WebSocket 101 \u771F\u8FDE\u63A5\u6821\u9A8C", total: stage1.length });
+  report({ type: "stage", stage: 1, name: "TLS \u63E1\u624B\u7B5B\u9009", total: filtered.length });
+  let tlsDone = 0;
+  const tlsResults = await pool(filtered, tlsConcurrency, async (item) => {
+    const probe = await withRetry(
+      retries,
+      () => probeTlsHandshake(item.ip, options.port, options.host, tlsTimeoutMs),
+      (r) => r.tlsMs > 0
+    );
+    tlsDone++;
+    if (tlsDone % 200 === 0 || tlsDone === filtered.length) {
+      report({
+        type: "progress",
+        stage: 1,
+        done: tlsDone,
+        total: filtered.length,
+        message: `TLS \u63E1\u624B ${tlsDone}/${filtered.length}${probe.tlsMs > 0 ? ` ${probe.tlsMs}ms` : " \u2717"}`
+      });
+    }
+    return { ...item, tls: probe };
+  });
+  const tlsOk = tlsResults.filter((r) => r.tls.tlsMs > 0);
+  const stage1 = tlsOk.sort((a, b) => a.tls.tlsMs - b.tls.tlsMs || a.latency - b.latency).slice(0, probeLimit);
+  const strictProbe = options.verifyPayload !== false;
+  const strictProbePath = "/__edge_probe";
+  report({
+    type: "stage",
+    stage: 2,
+    name: strictProbe ? "WS 101 + \u54CD\u5E94\u4F53\u6821\u9A8C\uFF08\u63A2\u9488\u7AEF\u70B9\uFF09" : "WebSocket 101 \u6821\u9A8C",
+    total: stage1.length
+  });
   let probeDone = 0;
+  let verifiedCount = 0;
   const probeResults = await pool(stage1, probeConcurrency, async (item) => {
-    const result = await probeWs101(item.ip, options.port, options.host, probeTimeoutMs, options.wsPath ?? "/__edge_probe");
+    const probeFn = strictProbe ? probeWsPing : probeWs101;
+    const probePath = strictProbe ? strictProbePath : options.wsPath ?? "/__edge_probe";
+    const result = await withRetry(
+      retries,
+      () => probeFn(item.ip, options.port, options.host, probeTimeoutMs, probePath)
+    );
     probeDone++;
+    if (result.pongVerified) verifiedCount++;
     report({
       type: "progress",
       stage: 2,
       done: probeDone,
       total: stage1.length,
-      message: `101 \u6821\u9A8C ${probeDone}/${stage1.length}${result.ok ? ` \u2713 ${result.colo}` : ""}`
+      message: strictProbe ? `101+PING \u6821\u9A8C ${probeDone}/${stage1.length}${result.ok ? ` \u2713 ${result.colo}` : result.pongVerified === false ? " \u2717 \u65E0\u54CD\u5E94" : ""}` : `101 \u6821\u9A8C ${probeDone}/${stage1.length}${result.ok ? ` \u2713 ${result.colo}` : ""}`
     });
     return { ...item, probe: result };
   });
-  const wsOk = probeResults.filter((r) => r.probe.ok);
+  const wsOk = strictProbe ? probeResults.filter((r) => r.probe.ok && r.probe.pongVerified === true) : probeResults.filter((r) => r.probe.ok);
   const countryFilter = normalizeCountryFilter(options.countries ?? []);
   let wsFiltered = wsOk;
   let appliedCountries = [];
@@ -1066,7 +1472,7 @@ async function runScan(options) {
       });
     }
   }
-  const stage2 = wsFiltered.sort((a, b) => a.latency - b.latency).slice(0, speedLimit);
+  const stage2 = wsFiltered.sort((a, b) => a.tls.tlsMs - b.tls.tlsMs || a.latency - b.latency).slice(0, speedLimit);
   let speedResults;
   const speedMode = options.speedMode ?? "probe";
   if (options.skipSpeed) {
@@ -1126,8 +1532,11 @@ async function runScan(options) {
     port: options.port,
     colo: r.probe.colo || "UNK",
     latency: r.latency,
+    tlsMs: r.tls.tlsMs,
     speed: r.speed ? Number(r.speed.toFixed(2)) : 0
-  })).sort((a, b) => options.skipSpeed ? a.latency - b.latency : b.speed - a.speed || a.latency - b.latency).slice(0, top);
+  })).sort(
+    (a, b) => options.skipSpeed ? a.tlsMs - b.tlsMs || a.latency - b.latency : b.speed - a.speed || a.tlsMs - b.tlsMs || a.latency - b.latency
+  ).slice(0, top);
   for (const entry of entries) {
     report({ type: "result", entry });
   }
@@ -1136,7 +1545,9 @@ async function runScan(options) {
     stats: {
       candidates: candidates.length,
       tcpOk: tcpOk.length,
+      tlsOk: tlsOk.length,
       wsOk: wsOk.length,
+      verified: verifiedCount,
       speedOk: entries.length,
       elapsedMs: Date.now() - started,
       countries: appliedCountries,
@@ -1447,7 +1858,7 @@ async function handleRequest(req, res) {
 }
 
 // src/version.ts
-var VERSION = "0.2.0";
+var VERSION = "0.4.1";
 var NAME = "cfpilot-scanner";
 
 // src/cli.ts
@@ -1481,15 +1892,25 @@ scan \u9009\u9879:
   --speed-conns <n>      \u6D4B\u901F\u5E76\u53D1\u8FDE\u63A5\u6570\uFF0C\u9ED8\u8BA4 3
                          \u5355\u6761 TCP \u8FDE\u63A5\u53D7\u62E5\u585E\u7A97\u53E3\u9650\u5236\uFF0C\u591A\u8FDE\u63A5\u66F4\u63A5\u8FD1\u771F\u5B9E\u5E26\u5BBD
   --speed-duration <ms>  \u6D4B\u901F\u65F6\u957F\uFF0C\u9ED8\u8BA4 6000
+  --retries <n>           \u6BCF\u4E2A\u63A2\u6D4B\u7684\u5C1D\u8BD5\u6B21\u6570\uFF08\u542B\u9996\u6B21\uFF09\uFF0C\u9ED8\u8BA4 2
+                          \u771F\u673A\u5076\u53D1\u5931\u8D25\u7387 3~5%\uFF0C\u91CD\u8BD5\u53D6\u7B2C\u4E00\u6B21\u6210\u529F\u7684\u7ED3\u679C
+  --no-verify            \u9636\u6BB5\u4E8C\u53EA\u505A 101 \u63E1\u624B\uFF0C\u8DF3\u8FC7\u54CD\u5E94\u4F53\u6821\u9A8C
+                          \uFF08\u9ED8\u8BA4\u6821\u9A8C\uFF1A\u53D1 PING \u5E76\u9A8C\u8BC1\u6570\u636E\u9762\u56DE {"pong":true}\uFF09
   --no-speed             \u8DF3\u8FC7\u6D4B\u901F\uFF0C\u53EA\u6309\u5EF6\u8FDF\u6392\u5E8F
   --top <n>              \u8FD4\u56DE\u6761\u6570\uFF0C\u9ED8\u8BA4 15
-  --concurrency <n>      \u9636\u6BB5\u4E00\u5E76\u53D1\uFF0C\u9ED8\u8BA4 300
+  --concurrency <n>      \u9636\u6BB5\u4E00 TCP \u5E76\u53D1\uFF0C\u9ED8\u8BA4 300
+  --tls-concurrency <n>  \u9636\u6BB5\u4E00 TLS \u63E1\u624B\u5E76\u53D1\uFF0C\u9ED8\u8BA4 64
+                          TLS \u63E1\u624B\u662F CPU \u5BC6\u96C6\u578B\u64CD\u4F5C\uFF0C\u8FC7\u9AD8\u4F1A\u8BA9\u672C\u673A\u6210\u4E3A\u74F6\u9888
   --sample <n>           \u5019\u9009 IP \u91C7\u6837\u6570\uFF0C\u9ED8\u8BA4 20000
+                          \u5EFA\u8BAE 6556 \u8D77\uFF1A\u9636\u6BB5\u4E00\u6309 TLS \u63E1\u624B\u8017\u65F6\u7B5B\u9009\uFF0C\u800C\u63E1\u624B\u5FEB\u6162
+                          \u4E0E TCP \u5EF6\u8FDF\u51E0\u4E4E\u65E0\u5173\uFF08\u5B9E\u6D4B TCP 9ms \u7684 IP \u53EF\u80FD\u8981 3.5 \u79D2\uFF09\uFF0C
+                          \u91C7\u6837\u5C0F\u4E86\u6839\u672C\u78B0\u4E0D\u5230\u63E1\u624B\u5FEB\u7684 IP
   --countries <a,b>      \u56FD\u5BB6 / \u5730\u533A\u8FC7\u6EE4\uFF08\u53EF\u591A\u9009\uFF0C\u9017\u53F7\u5206\u9694\uFF0C\u5982 HK,JP,SG\uFF09
                          \u4E0D\u9009 = \u5168\u91CF\u3002\u673A\u623F\u6765\u81EA 101 \u63E1\u624B\u54CD\u5E94\uFF1B\u7B5B\u5B8C\u4E3A\u7A7A\u4F1A\u81EA\u52A8\u5FFD\u7565
   --cidr <a,b>           \u81EA\u5B9A\u4E49\u7F51\u6BB5\uFF08\u53EF\u91CD\u590D\uFF0C\u7528\u9017\u53F7\u5206\u9694\uFF09
   --ip-file <path>       \u4F7F\u7528\u672C\u5730 IP \u5217\u8868\u6587\u4EF6
-  --max-latency <ms>     \u9636\u6BB5\u4E00\u5EF6\u8FDF\u4E0A\u9650\uFF0C\u9ED8\u8BA4 0\uFF08\u4E0D\u9650\uFF09
+  --max-latency <ms>     \u9636\u6BB5\u4E00 TCP \u5EF6\u8FDF\u4E0A\u9650\uFF0C\u9ED8\u8BA4 0\uFF08\u4E0D\u9650\uFF09
+  --tls-timeout <ms>     \u9636\u6BB5\u4E00 TLS \u63E1\u624B\u8D85\u65F6\uFF0C\u9ED8\u8BA4 4000
   --probe-limit <n>      \u8FDB\u5165 101 \u6821\u9A8C\u7684\u5019\u9009\u6570\uFF0C\u9ED8\u8BA4 120
   --speed-limit <n>      \u8FDB\u5165\u6D4B\u901F\u7684\u5019\u9009\u6570\uFF0C\u9ED8\u8BA4 30
   --speed-bytes <n>      \u6D4B\u901F\u5B57\u8282\u6570\uFF0C\u9ED8\u8BA4 5242880
@@ -1630,15 +2051,16 @@ function printTable(entries) {
     process.stdout.write("\n\u6CA1\u6709\u901A\u8FC7\u5168\u90E8\u6821\u9A8C\u7684\u8282\u70B9\u3002\n");
     return;
   }
-  process.stdout.write("\n\u6392\u540D  \u5730\u5740                     \u673A\u623F   \u5EF6\u8FDF(ms)  \u4E0B\u884C(MB/s)\n");
-  process.stdout.write("\u2500".repeat(58) + "\n");
+  process.stdout.write("\n\u6392\u540D  \u5730\u5740                     \u673A\u623F   TLS(ms)  TCP(ms)  \u4E0B\u884C(MB/s)\n");
+  process.stdout.write("\u2500".repeat(66) + "\n");
   entries.forEach((entry, index) => {
     const rank = String(index + 1).padStart(2, " ");
     const address = `${entry.ip}:${entry.port}`.padEnd(24, " ");
     const colo = (entry.colo || "UNK").padEnd(6, " ");
+    const tls3 = String(entry.tlsMs).padStart(7, " ");
     const latency = String(entry.latency).padStart(7, " ");
     const speed = entry.speed.toFixed(1).padStart(9, " ");
-    process.stdout.write(`${rank}   ${address} ${colo} ${latency}  ${speed}
+    process.stdout.write(`${rank}   ${address} ${colo} ${tls3} ${latency}  ${speed}
 `);
   });
 }
@@ -1663,6 +2085,7 @@ async function commandScan(args) {
   const wsPath = normalizeWsPath(flagString(args, "path"), "/__edge_probe");
   const probePath = normalizeWsPath(flagString(args, "probe-path"), "/__edge_probe");
   const noSpeed = flagBool(args, "no-speed");
+  const verifyPayload = !flagBool(args, "no-verify");
   const countries = normalizeCountryFilter(flagList(args, "countries"));
   const callback = noCallback ? "" : flagString(args, "callback", token ? `https://${host}/api/v1/preferred-ips` : "");
   if (!quiet) {
@@ -1752,8 +2175,12 @@ ${NAME} v${VERSION}
     wsPath,
     probePath,
     skipSpeed,
+    verifyPayload,
     concurrency: flagNumber(args, "concurrency", 300),
+    retries: flagNumber(args, "retries", 2),
     tcpTimeoutMs: flagNumber(args, "timeout", 1200),
+    tlsConcurrency: flagNumber(args, "tls-concurrency", 64),
+    tlsTimeoutMs: flagNumber(args, "tls-timeout", 4e3),
     maxLatencyMs: flagNumber(args, "max-latency", 0),
     probeLimit: flagNumber(args, "probe-limit", 120),
     probeTimeoutMs: flagNumber(args, "probe-timeout", 3e3),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cfpilot-scanner",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "CFPilot 优选器：用你自己的域名做 WebSocket 101 真连接校验，只保留真正可用的 Cloudflare IP；兼容任意 VLESS-WS 项目",
   "license": "MIT",
   "author": "CFPilot Contributors",
@@ -31,7 +31,7 @@
   "scripts": {
     "build": "node scripts/build.mjs",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "node ../../scripts/sync-version.mjs packages/scanner-cli && npm run build"
   },
   "devDependencies": {
     "@types/node": "^26.6.5",