mihomo-cli 2.2.1 → 2.2.3

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [2.2.3] - 2026-05-01
+
+### 修复
+
+- **非 TUN 模式误触 sudo**：修复 `start` 命令在 mixed 模式下停止旧进程时强制使用 sudo 的问题，改为自动检测是否存在 root 进程再决定是否提权
+
+---
+
+## [2.2.2] - 2026-05-01
+
+### 修复
+
+- **文件描述符泄漏**：修复 `startMixedMode` 中 spawn 后未关闭 fd 的问题
+- **forceSudo 参数失效**：修复 `cleanupAll` 忽略调用方传入的强制 sudo 参数
+- **formatBytes 溢出**：修复超大字节值（>1PB）导致显示 `undefined` 单位
+- **YAML 解析类型检查**：`parseYamlOrJson` 现在拒绝非对象类型的 YAML 内容
+- **spawn 错误处理**：`openUrl` 添加 error 事件处理，防止未捕获异常
+- **UserInfo 类型转换**：移除 `parseUserInfo` 中多余的 `as unknown` 双重转换
+
+### 安全
+
+- **订阅名称校验**：新增文件名安全校验，防止路径穿越等不安全名称
+
+---
+
 ## [2.2.1] - 2026-05-01
 
 ### 修复

package/dist/index.js

@@ -2808,7 +2808,14 @@ function getSubscriptionsWithCache() {
     ...cache[s.name] || {}
   }));
 }
+var SAFE_NAME_RE = /^[\w\-\p{Unified_Ideograph}]{1,64}$/u;
+function validateSubscriptionName(name) {
+  if (!name || !SAFE_NAME_RE.test(name)) {
+    throw new Error(`\u8BA2\u9605\u540D\u79F0\u65E0\u6548: "${name}"\uFF0C\u53EA\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u3001\u77ED\u6A2A\u7EBF\u548C\u4E2D\u6587\uFF08\u6700\u957F 64 \u5B57\u7B26\uFF09`);
+  }
+}
 function addSubscription(url, name = "default") {
+  validateSubscriptionName(name);
   const settings = readSettings();
   const subs = settings.subscriptions || [];
   const existingIndex = subs.findIndex((s) => s.name === name);
@@ -3006,7 +3013,7 @@ function parseYamlOrJson(content, errorMsg) {
   }
   try {
     const result = jsYaml.load(content);
-    if (result !== void 0) return result;
+    if (result != null && typeof result === "object" && !Array.isArray(result)) return result;
   } catch {
   }
   try {
@@ -3160,7 +3167,7 @@ function formatBytes(bytes) {
   if (num === 0) return "0 B";
   const k = 1024;
   const sizes = ["B", "KB", "MB", "GB", "TB"];
-  const i = Math.floor(Math.log(num) / Math.log(k));
+  const i = Math.min(Math.floor(Math.log(num) / Math.log(k)), sizes.length - 1);
   return `${parseFloat((num / k ** i).toFixed(2))} ${sizes[i]}`;
 }
 function formatTimestamp(ts) {
@@ -3405,14 +3412,14 @@ function killAllMihomo(forceSudo = false) {
     }
   }
 }
-function cleanupAll(_forceSudo = false) {
+function cleanupAll(forceSudo = false) {
   const pids = getAllMihomoPids();
   if (pids.length === 0) {
     clearPid();
     return { killed: 0, failed: 0, remaining: [] };
   }
   const hasRootProcess = pids.some((p) => isProcessRoot(p));
-  const needsSudo = hasRootProcess;
+  const needsSudo = forceSudo || hasRootProcess;
   let killedCount = 0;
   const failedPids = [];
   if (needsSudo) {
@@ -3560,12 +3567,12 @@ async function startMixedMode(staleState) {
   const configFile = PATHS.configFile;
   const logFile = PATHS.logFile;
   const args = ["-d", DIRS.data, "-f", configFile];
-  const out = fs5.openSync(logFile, "a");
-  const err = fs5.openSync(logFile, "a");
+  const logFd = fs5.openSync(logFile, "a");
   const child = spawn(PATHS.mihomoBinary, args, {
     detached: true,
-    stdio: ["ignore", out, err]
+    stdio: ["ignore", logFd, logFd]
   });
+  fs5.closeSync(logFd);
   child.unref();
   const pid = child.pid;
   savePid(pid);
@@ -3735,7 +3742,10 @@ function getLogPathByName(name) {
 }
 function openUrl(url) {
   try {
-    spawn("open", [url], { stdio: "ignore", detached: true });
+    const child = spawn("open", [url], { stdio: "ignore", detached: true });
+    child.unref();
+    child.on("error", () => {
+    });
     return true;
   } catch {
     return false;
@@ -4983,7 +4993,7 @@ async function cmdStart(args) {
     const count = status.allProcesses.length > 0 ? status.allProcesses.length : 1;
     console.log(`\u505C\u6B62 ${count} \u4E2A\u8FDB\u7A0B...`);
   }
-  handleStopResult(stop(true));
+  handleStopResult(stop());
   if (hasProcess) {
     console.log(`${colors.green("\u5DF2\u505C\u6B62\u8FDB\u7A0B")}
 `);
@@ -5018,7 +5028,7 @@ async function cmdStart(args) {
       console.log(`${colors.green("\u5DF2\u6E05\u7406")}: ${formatCleanSummary(cleanResult)}`);
       console.log("");
       console.log("\u91CD\u65B0\u52A0\u8F7D\u914D\u7F6E...");
-      handleStopResult(stop(true));
+      handleStopResult(stop());
       try {
         configInfo = prepareConfigForStart(targetMode, sub.name);
         const result = await start(targetMode);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mihomo-cli",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "type": "module",
   "description": "A terminal-based mihomo (Clash.Meta) client for macOS",
   "bin": {