mslxdff 0.1.245 → 0.1.246

package/src/multi-ip-pool/selftest.js

@@ -1,168 +0,0 @@
-// multi-ip-pool · 出口额度对照测试：回答「这台机器的直连出口撞 429 时，换成 VPNGate 出口还有没有额度」。
-//
-// 这才是多出口池的**唯一价值判据**（opencode 免费层按**出口 IP** 计额，见 docs/domain-notes.md §5）：
-//   基线（直连）429 而某个 VPN 出口 200 ⇒ 池有用；VPN 出口也全 429 ⇒ 换 IP 抬不动（上游按别的东西计额）。
-// 对照纪律：**除"从哪里出网"外一切相同** —— 同 URL / 同 UA / 同身份四件套 header / 同模型 /
-//   同 `stream:true` + 五核心工具名；整轮共用同一个 session（免费层按出口 IP 计额，共用 session 才测得干净）。
-// 请求形状**直接复用** `v6pool/selftest.js`（同一份免费层契约，绝不在两处各写一遍）。
-import { getUndici } from "../compat.js";
-import { genId } from "../opencode-identity.js";
-import { DEFAULT_PROBE_MODEL, probeUpstreamFrom } from "../v6pool/selftest.js";
-import { classifyWarpSignal } from "../warp-pool/verdict.js";
-import { resolveMultiIpConfig, resolveRole } from "./config.js";
-import { candidateNodes, loadNodeCache, materializeNode, writeAuthFile } from "./nodes.js";
-import { fetchNodes, probeExitIp } from "./nodes-fetch.js";
-import { bringUpTunnel, checkOpenvpn, isRoot, isSupportedPlatform, tearDownTunnel } from "./tunnel.js";
-import { fmtExitIp, fmtNodePick, fmtNodes, fmtProbe } from "./report.js";
-import { loadGroupsJoined } from "../state.js";
-
-/** 采样上限：VPNGate 免费节点起隧道是秒级操作，别把测试拖成十几分钟。 */
-export const MITEST_MAX = 8;
-export const MITEST_DEFAULT = 3;
-
-/**
- * 跑一次出口对照测试（本模块不打印，结构化返回给 CLI 渲染）。
- *
- * @param {{ env?: object, count?: number, model?: string, baseUrl?: string,
- *           onProgress?: (ev: object) => void,
- *           deps?: { joined?, platform?, supported?, isRoot?, checkOpenvpn?, loadNodeCache?, fetchNodes?,
- *                    materializeNode?, bringUpTunnel?, tearDownTunnel?, agentFactory?, probeExitIp?,
- *                    probeUpstream?, fetchImpl?, session?, log? }, slots?: object[] }} opts
- */
-export async function runMultiIpCompare({ env = process.env, count = MITEST_DEFAULT, model = DEFAULT_PROBE_MODEL, baseUrl = "https://opencode.ai", onProgress, deps = {}, slots = null } = {}) {
-  const cfg = resolveMultiIpConfig(env);
-  const tick = (ev) => { try { onProgress?.(ev); } catch { /* 渲染出错不打断测试 */ } };
-  const log = deps.log || (() => {});
-
-  if (!cfg.enabled) return { status: "skip", reason: "多出口池已关闭（MSLXDFF_MULTI_IP_POOL=0）", hint: "去掉该 env 或设为 1 再跑" };
-  const role = resolveRole({ mode: cfg.mode, joined: deps.joined ?? loadGroupsJoined() });
-  if (!role.active) return { status: "skip", reason: `本节点角色是 ${role.role}（${role.why}）`, hint: "本功能只给组长做取证；组员请用组长那条出口" };
-  const platform = deps.platform || process.platform;
-  if (!(deps.supported ?? isSupportedPlatform(platform))) {
-    return { status: "skip", reason: `本功能需要 Linux 的 tun 设备与策略路由（当前平台 ${platform}）`, hint: "在 Linux VPS 上跑；其它平台用 mslxdff -v6-pool 或 WARP 池" };
-  }
-  if (!(deps.isRoot ?? isRoot)()) {
-    return { status: "skip", reason: "需要 root（建 tun 设备 + 装策略路由 + 写 rp_filter）", hint: "sudo mslxdff -multi-ip-pool test" };
-  }
-  const openvpn = await (deps.checkOpenvpn || checkOpenvpn)(cfg.openvpnBin);
-  if (!openvpn.ok) return { status: "skip", reason: `${cfg.openvpnBin} 不可用（${openvpn.why}）`, hint: "apt install openvpn" };
-
-  const { Agent } = getUndici();
-  const agentFactory = deps.agentFactory || ((addr) => new Agent({ connect: { localAddress: addr }, connections: 1, keepAliveTimeout: 5_000 }));
-  const probe = deps.probeUpstream || probeUpstreamFrom;
-  const session = deps.session || genId("ses_");
-  const materialize = deps.materializeNode || materializeNode;
-  const startSlot = deps.bringUpTunnel || bringUpTunnel;
-  const stopSlot = deps.tearDownTunnel || tearDownTunnel;
-  const exitProbe = deps.probeExitIp || probeExitIp;
-
-  // 节点表：优先用缓存（不重复打 VPNGate），取不到再拉。
-  const cache = (deps.loadNodeCache || loadNodeCache)({ dir: cfg.dir, ttlMs: cfg.nodesTtlMs });
-  let rows = cache?.rows || [];
-  let source = cache?.source || "(本地缓存)";
-  if (!rows.length) {
-    try {
-      const got = await (deps.fetchNodes || fetchNodes)({ sources: cfg.sources, dir: cfg.dir, timeoutMs: cfg.probeTimeoutMs, maxAgeMs: cfg.maxTableAgeMs, log });
-      rows = got.rows;
-      source = got.source;
-    } catch (e) {
-      return { status: "skip", reason: `节点表取不到：${String(e?.message || e)}`, hint: "在能连的机器上跑 `mslxdff -multi-ip-pool fetch` 抓一份表带过来，或设 MSLXDFF_MULTI_IP_NODES_FILE / _SOURCES" };
-    }
-  }
-  tick({ phase: "nodes", source, total: rows.length });
-  log(fmtNodes({ source, total: rows.length, countries: cfg.countries, minScore: cfg.minScore }));
-
-  // ① 基线：直连（系统默认出口）打一条免费层请求
-  tick({ phase: "baseline-start", model });
-  const baseline = await probe({ addr: "", model, baseUrl, agentFactory, fetchImpl: deps.fetchImpl, session });
-  tick({ phase: "baseline-done", ...baseline });
-  // 候选：调用方给了 `slots` 就用它——CLI 侧已经「按簇取样 + TCP 预检」过，拨的必须就是探通的那些；
-  // 没给才自己按 Score 取（单测与旧路径）。两边各挑一次会让「探的」与「拨的」不是同一批，预检就白做了。
-
-  const picked = (Array.isArray(slots) && slots.length) ? slots.slice(0, MITEST_MAX) : candidateNodes({ rows, countries: cfg.countries, minScore: cfg.minScore, scan: Math.max(1, Math.min(MITEST_MAX, Number(count) || MITEST_DEFAULT)) });
-  if (!picked.length) return { status: "skip", reason: "没有满足条件的候选节点（国家/Score 过滤后为空）", hint: "放宽 MSLXDFF_MULTI_IP_MIN_SCORE 或去掉 MSLXDFF_MULTI_IP_COUNTRY" };
-  // auth 文件必须先落到磁盘再把路径交给 openvpn。取证路径以前把 `deps.authFile`（undefined）直接传下去
-  // ⇒ `--auth-user-pass` 拿到空参数 ⇒ openvpn 判「选项缺参数」，只留一句「Use --help」——2026-10-25 真机三条槽全挂在这。
-  const authFile = deps.authFile || (deps.writeAuthFile || writeAuthFile)({ dir: cfg.dir, user: cfg.authUser, pass: cfg.authPass });
-
-  const exits = [];
-  try {
-    for (let i = 0; i < picked.length; i++) {
-      const row = picked[i];
-      const dev = `${cfg.devPrefix}${i}`;
-      tick({ phase: "exit-start", i: i + 1, n: picked.length, row });
-      log(fmtNodePick({ i: i + 1, n: picked.length, row, dev }));
-      let slot = null;
-      try {
-        const node = materialize({ dir: cfg.dir, row });
-        if (!node) throw new Error("节点配置解不开（base64 或 remote 缺失）");
-        slot = await startSlot({ cfg, slotIndex: i, node, deps: { authFile, runCmdFn: deps.runCmdFn, spawnFn: deps.spawnFn, wait: deps.wait, log } });
-        const exit = await exitProbe({ agent: agentFactory(slot.tunIp), timeoutMs: cfg.probeTimeoutMs });
-        if (exit.ok) log(fmtExitIp({ dev: slot.dev, ip: exit.ip, ms: exit.ms }));
-        // 从这条隧道的出口打**同一条**免费层请求
-        const r = await probe({ addr: slot.tunIp, model, baseUrl, agentFactory, fetchImpl: deps.fetchImpl, session });
-        log(fmtProbe({ dev: slot.dev, url: `${baseUrl.replace(/\/+$/, "")}/zen/v1/chat/completions`, ok: r.ok, status: r.status, error: r.error, ms: r.ms }));
-        const entry = { ...r, hostName: row.hostName, country: row.countryShort, dev: slot.dev, exitIp: exit.ip || "" };
-        exits.push(entry);
-        tick({ phase: "exit-done", i: i + 1, n: picked.length, ...entry });
-      } catch (e) {
-        const entry = { hostName: row.hostName, country: row.countryShort, dev, ok: false, status: 0, kind: "network", ms: 0, exitIp: "", error: String(e?.message || e) };
-        exits.push(entry);
-        tick({ phase: "exit-done", i: i + 1, n: picked.length, ...entry });
-      } finally {
-        if (slot) await stopSlot({ slot, runCmdFn: deps.runCmdFn, log }).catch(() => {});
-      }
-    }
-  } catch (e) {
-    return { status: "skip", reason: `测试中断：${String(e?.message || e)}`, hint: "看 daemon.log 里的 [multi-ip-pool] 行" };
-  }
-
-  // ③ 判语：对照基线（受限 = 有 HTTP 响应但拿不到额度；只有 status=0 才算"够不着"）
-  const baseLimited = baseline.status === 429 || ["free-quota", "free-tier", "ip-limit"].includes(baseline.kind);
-  const ok = exits.filter((r) => r.ok);
-  const limited = exits.filter((r) => !r.ok && r.status);
-  const net = exits.filter((r) => !r.status);
-  let verdict;
-  if (ok.length && ok.length === exits.length) verdict = "multi-ip-works";
-  else if (limited.length === exits.length) verdict = "multi-ip-also-limited";
-  else if (net.length === exits.length) verdict = "multi-ip-unreachable";
-  else verdict = "mixed";
-
-  return {
-    status: "ok",
-    source, model, baseUrl, session,
-    baseLimited,
-    baseline,
-    exits,
-    requested: picked.length,
-    okCount: ok.length,
-    limitedCount: limited.length,
-    netCount: net.length,
-    verdict,
-  };
-}
-
-/** 判语 → 人话（CLI 与测试共用一份，避免两处口径漂移）。 */
-export const VERDICT_ZH = {
-  "multi-ip-works": {
-    text: "VPN 出口**能换到新额度**",
-    next: "结论：多出口池对这台机器**有用**——直连出口耗尽时换隧道就能续。daemon 侧缺省已开。",
-  },
-  "multi-ip-also-limited": {
-    text: "VPN 出口**也全受限**（换 IP 没换来新额度）",
-    next: "结论：换出口治不了（要么上游不按出口 IP 计额，要么节点出口本身已被大量共用到撞额）。建议 MSLXDFF_MULTI_IP_POOL=0。",
-  },
-  "multi-ip-unreachable": {
-    text: "VPN 出口**全都够不着上游**（隧道没转起来）",
-    next: "结论：这些节点起不通或上游被墙。查 rp_filter / 节点可用性，或换 MSLXDFF_MULTI_IP_SOURCES / 加国家白名单。",
-  },
-  mixed: {
-    text: "部分可用（有的出口有额度、有的没有）",
-    next: "结论：池**部分可用**（免费节点质量参差，属正常）。够用即可开着。",
-  },
-};
-
-/** 判语里的免费层分类（与生产判决同源：warp-pool/verdict.js）。 */
-export function classifyOf(status, text = "") {
-  return classifyWarpSignal({ status, text });
-}

package/src/multi-ip-pool/standby.js

@@ -1,157 +0,0 @@
-// multi-ip-pool · 备选出口池：**定时预拨** 不多于 N 条已验通的隧道，429 一到立刻有干净 IP 可上。
-//
-// 用户 2026-10-25 的裁决（本模块存在的唯一理由）：
-//   「启用时定时准备不多于 5 个备选 IP（例如每小时找 5 个备用），一旦组长触发 429，
-//    可以**立即**启用其中的备用 IP；启用备用 IP 时要打一个 hi 到 opencode.ai，要它 200。」
-// ⇒ 换出口那一刻绝不能再现场拨号（openvpn 握手秒级 + 候选可能全不通，429 现场等 = 用户在等），
-//   而是**平时就把备用隧道起好、并逐条用 hi 验过有 200**，429 时只做"取一条"。
-//
-// 备用条目两条铁律：
-//   ① 只有 hi 回 200 的才算"备用"（有额度的 IP），429/403 的当场拆掉重拨下一条；
-//   ② 交付前**再验一次** hi——免费节点的出口 IP 是别人在用的，一小时里可能已经被别人吃光额度。
-//      验不过就丢掉取下一条（宁可少一条出口，也不把一个没额度的 IP 交给请求路径）。
-import { fmtStandbyAdd, fmtStandbyDrop, fmtStandbyRefill, fmtStandbySkip, fmtStandbyUse } from "./report.js";
-
-/** 备用槽的索引偏移：设备名/表号与正式槽彻底错开（正式槽 mltun0..、备用 mltun100..、表 baseTable+100..）。 */
-export const STANDBY_INDEX_BASE = 100;
-/** 备用槽索引循环上限（设备名 ≤15 字符：mltun + 3 位）。 */
-export const STANDBY_INDEX_SPAN = 100;
-/** 一轮补位最多拨多少次（防候选全不通时把 VPNGate 与本机刷成灾）。 */
-export const REFILL_DIAL_CAP = 12;
-
-/**
- * @param {{ cfg: object, log?: Function, dialer: object,
- *           schedule?: (fn: Function, ms: number) => any, cancel?: (h: any) => void, now?: () => number }} opts
- *   dialer 需要提供：openSlot(index) / ensureCandidates({force}) / hiProbe(entry) / drop(entry) / tunnels(Set)
- */
-export function createStandby({ cfg, log = () => {}, dialer, schedule = (fn, ms) => setInterval(fn, ms), cancel = (h) => clearInterval(h), now = Date.now } = {}) {
-  /** @type {object[]} 已验通的备用出口（FIFO，最旧的先交出去） */
-  const ready = [];
-  let timer = null;
-  let busy = null;
-  let counter = 0;
-
-  function want() {
-    return Math.max(0, Math.min(5, Number(cfg.standby) || 0)); // 用户定的硬上限：不多于 5
-  }
-
-  function stats() {
-    return {
-      want: want(),
-      have: ready.length,
-      everyMs: Number(cfg.standbyEveryMs) || 0,
-      exits: ready.map((e) => ({ dev: e.dev, node: e.node?.hostName || "", tunIp: e.tunIp, exitIp: e.exitIp || "", verifiedAt: e.verifiedAt || 0 })),
-    };
-  }
-
-  /** 拨一条新备用隧道并验它（不 200 就地拆掉，调用方继续下一条）。 */
-  async function dialOne() {
-    const index = STANDBY_INDEX_BASE + (counter++ % STANDBY_INDEX_SPAN);
-    const e = await dialer.openSlot(index, { dev: "" });
-    if (!e) return null;
-    e.verifiedAt = now();
-    ready.push(e);
-    log(fmtStandbyAdd({ dev: e.dev, node: e.node?.hostName || "", exitIp: e.exitIp || "", tunIp: e.tunIp, have: ready.length, want: want() }));
-    return e;
-  }
-
-  /**
-   * 补到 want() 条。同一时刻只跑一轮（定时器与 429 后的补位会撞车）；每轮开头强制重取节点表——
-   * 免费节点掉得快，一小时前的候选表多半已经拨不通了。
-   * @returns {Promise<{added: number, have: number, want: number}>}
-   */
-  function refill({ force = false } = {}) {
-    if (!want()) return Promise.resolve({ added: 0, have: 0, want: 0 });
-    if (busy) return busy;
-    const run = async () => {
-      if (force || ready.length < want()) {
-        try {
-          await dialer.ensureCandidates({ force: force || ready.length === 0 });
-        } catch (e) {
-          log(fmtStandbySkip({ why: `取节点表失败：${String(e?.message || e)}` }));
-        }
-      }
-      let dialed = 0;
-      const before = ready.length;
-      while (ready.length < want() && dialed < REFILL_DIAL_CAP) {
-        dialed++;
-        try {
-          const got = await dialOne();
-          if (!got) break; // 候选用尽（openSlot 内部已换过一轮）
-        } catch (e) {
-          log(fmtStandbySkip({ why: `拨备用隧道出错：${String(e?.message || e)}` }));
-        }
-      }
-      log(fmtStandbyRefill({ added: ready.length - before, have: ready.length, want: want(), dialed }));
-      return { added: ready.length - before, have: ready.length, want: want() };
-    };
-    busy = run().finally(() => {
-      busy = null;
-    });
-    return busy;
-  }
-
-  /** 复验一条备用出口：交出去之前必须**这一秒**还是 200。 */
-  async function verify(entry) {
-    const p = await dialer.hiProbe(entry);
-    if (p.status === 200) {
-      entry.exitIp = p.ip || entry.exitIp || "";
-      entry.verifiedAt = now();
-      return entry;
-    }
-    log(fmtStandbyDrop({ dev: entry.dev, node: entry.node?.hostName || "", status: p.status, kind: p.kind, error: p.error || "" }));
-    await dialer.drop(entry, "备用出口复验未过 200");
-    return null;
-  }
-
-  /**
-   * 取一条备用出口（429 路径调这个）：逐条复验、验不过就丢；池空了先补一轮再取。
-   * @returns {Promise<null | object>} 验通的出口条目（可直接当新槽用）
-   */
-  async function take() {
-    for (let guard = 0; guard < 2 && !ready.length; guard++) await refill();
-    while (ready.length) {
-      const e = ready.shift();
-      const okEntry = await verify(e);
-      if (okEntry) {
-        log(fmtStandbyUse({ dev: okEntry.dev, tunIp: okEntry.tunIp, exitIp: okEntry.exitIp || "", node: okEntry.node?.hostName || "", left: ready.length }));
-        void refill().catch(() => {}); // 用完立刻补位，下一发 429 还得有备胎
-        return okEntry;
-      }
-    }
-    return null;
-  }
-
-  /** 起定时器（每小时刷新）。`MSLXDFF_MULTI_IP_STANDBY=0` ⇒ 完全不起。 */
-  function start() {
-    const w = want();
-    const every = Number(cfg.standbyEveryMs) || 0;
-    if (!w || !every || timer) return;
-    timer = schedule(() => {
-      void refreshAll().catch((e) => log(fmtStandbySkip({ why: `定时刷新失败：${String(e?.message || e)}` })));
-    }, every);
-  }
-
-  /** 周期到点：把旧的备用全部拆掉重拨一批（出口 IP 换新，才叫"每小时找 5 个备用"）。 */
-  async function refreshAll() {
-    const stale = ready.splice(0, ready.length);
-    for (const e of stale) await dialer.drop(e, "备选池整批刷新");
-    return refill({ force: true });
-  }
-
-  /** 收摊：停定时器 + 拆掉所有备用隧道（一条都不许留给下次启动当残留）。 */
-  async function stop() {
-    if (timer) {
-      try {
-        cancel(timer);
-      } catch {
-        /* 忽略 */
-      }
-      timer = null;
-    }
-    const all = ready.splice(0, ready.length);
-    for (const e of all) await dialer.drop(e, "收摊");
-  }
-
-  return { refill, take, start, stop, refreshAll, stats, get size() { return ready.length; } };
-}

package/src/multi-ip-pool/tunnel.js

@@ -1,291 +0,0 @@
-// multi-ip-pool · 一槽一条 openvpn 子进程 + 一条独立策略路由表。
-//
-// 为什么这么装（照参照实现 aimili-vpngate 的必要动作，但这里每槽各一套）：
-//   openvpn 起来后内核多一个 tunX 设备，VPNGate 推给它的内网地址就是**本槽的源地址**；
-//   把「源地址 = <tunX 地址> 的包」整表引到「默认路由 = tunX」的策略表里，
-//   该槽的出站（含 undici 的 connect.localAddress 绑定）就只会从这条隧道出去。
-//   ⇒ 一块网卡上 N 条隧道、N 个真实出口，互不干扰（参照实现一次只挂 1 条）。
-//
-// 平台纪律：只有 Linux 能干（tun + `ip rule`）；其它平台由调用方**诚实跳过一行**，不做半吊子。
-import { spawn } from "node:child_process";
-import { devNameFor, tableFor } from "./config.js";
-import { fmtArgv, fmtExit, fmtRpf, fmtRuleFail, fmtSpawn, fmtTunAddrFail } from "./report.js";
-import { openvpnErrorLine, openvpnErrorBrief } from "./diagnose.js";
-
-/** openvpn 就绪标志（配置文件里可能出现别的 "Sequence"，必须整串匹配）。 */
-export const READY_PATTERN = /Initialization Sequence Completed/;
-
-/** 策略路由表号 → 规则优先级：落在 main(32766) 之前，且多槽之间固定可复现。 */
-export const RULE_PRIORITY_BASE = 20_000;
-
-export function rulePriorityFor(i) {
-  return RULE_PRIORITY_BASE + i;
-}
-
-/** 只有 Linux 支持：tun 设备 + `ip rule`/`ip route`。 */
-export function isSupportedPlatform(platform = process.platform) {
-  return platform === "linux";
-}
-
-export function isRoot(getuid = process.getuid?.bind(process)) {
-  try {
-    return typeof getuid === "function" ? getuid() === 0 : true; // 取不到 uid 的平台上由平台门先拦
-  } catch {
-    return true;
-  }
-}
-
-/**
- * openvpn 命令行。**dev 与路由一律走命令行覆盖**（命令行优先于 config 文件）：
- * `--route-nopull` + `--pull-filter ignore redirect-gateway` 保证它绝不碰主路由表——
- * 主路由表被改 = 整台机器的流量（含 daemon 自己打上游）都被拽进隧道，那是灾难。
- * `--dev-type tun` 不可省：槽设备名（`mltun1`…）**不以 tun/tap 开头**，openvpn 从名字推不出类型
- * （其 usage 原文：dev-type「仅当 --dev 的设备名不以 tun 或 tap 开头时使用」）；实测 97 个 VPNGate 节点全是 `dev tun`。
- * 三个必填项缺一即抛：空串传下去会被 openvpn 判成「选项缺参数」，只留下一句没头没尾的 usage 错误（2026-10-25 真机踩过）。
- */
-export function buildOpenvpnArgs({ conf, dev, authFile, logFile = "", verb = 3 }) {
-  for (const [name, v] of [["conf", conf], ["dev", dev], ["authFile", authFile]]) {
-    if (!v) throw new Error(`buildOpenvpnArgs 缺 ${name}：拒绝起隧道（空参数会让 openvpn 只报一句 usage 错误，看不出病因）`);
-  }
-  return [
-    "--config", conf,
-    "--dev", dev,
-    "--dev-type", "tun",
-    "--auth-user-pass", authFile,
-    "--route-nopull",
-    "--pull-filter", "ignore", "redirect-gateway",
-    "--verb", String(verb),
-    ...(logFile ? ["--log", logFile] : []),
-  ];
-}
-
-
-/** 从 `ip -4 addr show dev <dev>` 输出里取 tun 地址（VPNGate 推的是 10.x 内网地址）。 */
-export function parseTunAddr(text) {
-  const m = /inet\s+(\d+\.\d+\.\d+\.\d+)/.exec(String(text || ""));
-  return m ? m[1] : "";
-}
-
-/** 该槽要装的策略路由（纯函数）：源地址定表 → 表里默认走隧道。 */
-export function tunnelUpCommands({ tunIp, table, dev, priority }) {
-  return [
-    ["ip", "rule", "add", "from", `${tunIp}/32`, "lookup", String(table), "priority", String(priority)],
-    ["ip", "route", "replace", "default", "dev", dev, "table", String(table)],
-  ];
-}
-
-/** 拆槽时按相反顺序撤（先撤表、再撤规则）。 */
-export function tunnelDownCommands({ tunIp, table }) {
-  return [
-    ["ip", "route", "flush", "table", String(table)],
-    ["ip", "rule", "del", "from", `${tunIp}/32`, "lookup", String(table)],
-  ];
-}
-
-/** `ip rule` 的优先级和表号都可能是别人先占的——失败要能一眼看出「占了什么」。 */
-export function rpFilterPaths() {
-  return [
-    "/proc/sys/net/ipv4/conf/all/rp_filter",
-    "/proc/sys/net/ipv4/conf/default/rp_filter",
-  ];
-}
-
-/** 逐行跑命令；超时 SIGKILL（绝不让一个卡住的 ip 调用把启动挂死）。 */
-export function runCmd(cmd, args = [], { timeoutMs = 10_000, spawnFn = spawn } = {}) {
-  return new Promise((resolve) => {
-    let out = "";
-    let err = "";
-    let child;
-    try {
-      child = spawnFn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
-    } catch (e) {
-      resolve({ code: -1, stdout: "", stderr: String(e?.message || e) });
-      return;
-    }
-    const timer = setTimeout(() => {
-      try {
-        child.kill("SIGKILL");
-      } catch {
-        /* 已经退了 */
-      }
-    }, timeoutMs);
-    child.stdout?.on("data", (b) => { out += String(b); });
-    child.stderr?.on("data", (b) => { err += String(b); });
-    child.once("error", (e) => { clearTimeout(timer); resolve({ code: -1, stdout: out, stderr: `${err}${e.message}` }); });
-    child.once("exit", (code) => { clearTimeout(timer); resolve({ code: code ?? -1, stdout: out, stderr: err }); });
-  });
-}
-
-/** 本机到底有没有 openvpn（没有就别装了，诚实跳过）。 */
-export async function checkOpenvpn(bin, { runCmdFn = runCmd } = {}) {
-  const r = await runCmdFn(bin, ["--version"], { timeoutMs: 8_000 });
-  const text = `${r.stdout}${r.stderr}`;
-  if (r.code === 0 && /openvpn/i.test(text)) return { ok: true, version: (text.split(/\r?\n/)[0] || "").trim() };
-  return { ok: false, why: r.stderr.trim() || `退出码 ${r.code}` };
-}
-
-/**
- * 起一条隧道并等它就绪。返回句柄；`ready` reject 表示这槽本轮不可用（调用方换下一个节点）。
- * tail 保留末 20 行：真机排障时"openvpn 为什么退"全在这几行里。
- */
-export function startTunnel({ bin, args, timeoutMs = 25_000, spawnFn = spawn, log = () => {}, onExit = null, dev = "" } = {}) {
-  // 「我到底跑了什么」必须是第一条信息：openvpn 的 argv 报错只有对着命令行原文才看得懂
-  log(fmtArgv({ bin, args }));
-  let child;
-  try {
-    child = spawnFn(bin, args, { stdio: ["ignore", "pipe", "pipe"] });
-  } catch (e) {
-    return { pid: 0, ready: Promise.reject(new Error(`拉不起 ${bin}：${String(e?.message || e)}`)), tail: () => "", stop: () => {} };
-  }
-  const tail = [];
-  const t0 = Date.now();
-  let settled = false;
-  let stopping = false;
-  const push = (buf) => {
-    for (const line of String(buf).split(/\r?\n/)) {
-      const s = line.trim();
-      if (!s) continue;
-      tail.push(s);
-      if (tail.length > 20) tail.shift();
-    }
-  };
-  const lastTail = () => openvpnErrorLine(tail.join("\n"));
-  const briefTail = () => openvpnErrorBrief(tail.join("\n"));
-  const ready = new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      if (settled) return;
-      settled = true;
-      try { child.kill("SIGTERM"); } catch { /* 已退 */ }
-      reject(new Error(`等 ${Math.round(timeoutMs / 1000)}s 没等到「Initialization Sequence Completed」（隧道没起来）：${briefTail()}`));
-    }, timeoutMs);
-    const onChunk = (buf) => {
-      push(buf);
-      if (settled || !READY_PATTERN.test(tail.join("\n"))) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve({ pid: child.pid });
-    };
-    child.stdout?.on("data", onChunk);
-    child.stderr?.on("data", onChunk);
-    child.once("exit", (code, signal) => {
-      const aliveMs = Date.now() - t0;
-      if (!settled) {
-        settled = true;
-        clearTimeout(timer);
-        reject(new Error(`openvpn 提前退出（code=${code} signal=${signal}）：${briefTail()}`));
-      }
-      // 主动关掉的隧道不算"意外退出"：收摊日志只该出现在真出事时（否则每次换槽都刷一行假警报）
-      if (!stopping) log(fmtExit({ dev, code, signal, pid: child.pid, aliveMs, tail: lastTail() }));
-      if (onExit) { try { onExit({ code, signal, tail: lastTail() }); } catch { /* 回调失败不影响退出 */ } }
-    });
-    child.once("error", (err) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      reject(new Error(`拉不起 ${bin}：${String(err?.message || err)}`));
-    });
-  });
-  return { child, pid: child.pid, ready, tail: lastTail, stop: () => { stopping = true; try { child.kill("SIGTERM"); } catch { /* 已退 */ } } };
-}
-
-/** 等 tun 地址出现（VPNGate 的 ifconfig 是随隧道建立推送的，通常一两百毫秒内就位）。 */
-export async function waitTunAddr({ dev, runCmdFn = runCmd, wait = (ms) => new Promise((r) => setTimeout(r, ms)), tries = 10, gapMs = 300 } = {}) {
-  let last = "";
-  for (let i = 0; i < tries; i++) {
-    const r = await runCmdFn("ip", ["-4", "addr", "show", "dev", dev], { timeoutMs: 5_000 });
-    last = `${r.stdout}${r.stderr}`.trim();
-    const ip = parseTunAddr(r.stdout);
-    if (ip) return { ip, out: last };
-    if (i < tries - 1) await wait(gapMs);
-  }
-  return { ip: "", out: last };
-}
-
-/**
- * 放宽 rp_filter（严格反向路径过滤会丢「从 tun 出去、从 eth 回来」的不对称包 ⇒ 隧道看起来活着但请求全挂住）。
- * 默认开；MSLXDFF_MULTI_IP_SYSCTL=0 关。改的是内核参数，日志必须写清楚改了什么、怎么还原。
- */
-export async function relaxRpf({ enabled = true, readFile, writeFile, log = () => {} } = {}) {
-  if (!enabled) {
-    log(fmtRpf({ skipped: true }));
-    return { ok: true, changed: [] };
-  }
-  const paths = rpFilterPaths();
-  const changed = [];
-  try {
-    const fs = await import("node:fs");
-    const read = readFile || fs.readFileSync;
-    const write = writeFile || fs.writeFileSync;
-    for (const p of paths) {
-      const before = String(read(p, "utf8")).trim();
-      if (before === "2") continue;
-      write(p, "2");
-      changed.push({ path: p, from: before, to: "2" });
-    }
-    log(fmtRpf({ ok: true, changed }));
-    return { ok: true, changed };
-  } catch (e) {
-    log(fmtRpf({ ok: false, error: String(e?.message || e), changed }));
-    return { ok: false, changed, error: String(e?.message || e) };
-  }
-}
-
-/**
- * 起槽全流程：spawn openvpn → 等就绪 → 读 tun 地址 → 放宽 rp_filter → 装策略路由。
- * @returns {Promise<{dev, table, priority, tunIp, pid, stop, tail}>}
- */
-export async function bringUpTunnel({ cfg, slotIndex, node, deps = {} } = {}) {
-  const dev = devNameFor(cfg.devPrefix, slotIndex);
-  const table = tableFor(cfg.baseTable, slotIndex);
-  const priority = rulePriorityFor(slotIndex);
-  const runCmdFn = deps.runCmdFn || runCmd;
-  const wait = deps.wait || ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const log = deps.log || (() => {});
-  const t = startTunnel({
-    bin: cfg.openvpnBin,
-    args: buildOpenvpnArgs({ conf: node.conf, dev, authFile: deps.authFile, logFile: deps.openvpnLog || "" }),
-    timeoutMs: cfg.connectTimeoutMs,
-    spawnFn: deps.spawnFn,
-    log,
-    dev,
-    onExit: deps.onExit,
-  });
-  try {
-    await t.ready;
-  } catch (e) {
-    t.stop();
-    throw e;
-  }
-  log(fmtSpawn({ dev, pid: t.pid, host: node.host, port: node.port, country: node.countryShort || "", table }));
-  const addr = await waitTunAddr({ dev, runCmdFn, wait, tries: deps.addrTries ?? 10 });
-  if (!addr.ip) {
-    t.stop();
-    throw new Error(fmtTunAddrFail({ dev, out: addr.out }));
-  }
-  await relaxRpf({ enabled: cfg.sysctl !== false, log, readFile: deps.readFile, writeFile: deps.writeFile });
-  for (const cmd of tunnelUpCommands({ tunIp: addr.ip, table, dev, priority })) {
-    const r = await runCmdFn(cmd[0], cmd.slice(1), { timeoutMs: 8_000 });
-    if (r.code !== 0) {
-      t.stop();
-      throw new Error(fmtRuleFail({ dev, cmd: cmd.join(" "), error: `${r.stderr || r.stdout}`.trim() }));
-    }
-  }
-  return { dev, table, priority, tunIp: addr.ip, pid: t.pid, stop: t.stop, tail: t.tail };
-}
-
-/** 拆槽：先撤策略路由（否则表里留着已消失设备的默认路由），再关子进程。 */
-export async function tearDownTunnel({ slot, runCmdFn = runCmd, log = () => {} } = {}) {
-  if (!slot) return;
-  for (const cmd of tunnelDownCommands(slot)) {
-    try {
-      await runCmdFn(cmd[0], cmd.slice(1), { timeoutMs: 5_000 });
-    } catch (e) {
-      log(`[multi-ip-pool] 撤策略路由失败（${cmd.join(" ")}）：${String(e?.message || e)}`);
-    }
-  }
-  try {
-    slot.stop?.();
-  } catch {
-    /* 已经退了 */
-  }
-}