my-singbox 0.0.0-stage → 2.0.0

package/dist/model.d.ts

@@ -0,0 +1,43 @@
+import { type Env } from './core/env.js';
+export type Protocol = 'shadowsocks' | 'vless-reality';
+export interface SsCreds {
+    password: string;
+}
+export interface RealityCreds {
+    uuid: string;
+    privateKey: string;
+    publicKey: string;
+    shortId: string;
+}
+export interface Node {
+    name: string;
+    protocol: Protocol;
+    inbound: {
+        tag: string;
+        port: number;
+    };
+    egress: 'direct' | 'isp-socks';
+    creds: SsCreds | RealityCreds;
+}
+export interface IspSocks {
+    host: string;
+    port: number;
+    addr: string;
+    user: string;
+    pass: string;
+    egressIp?: string;
+}
+export interface Model {
+    server: string;
+    nodes: Node[];
+    isp?: IspSocks;
+}
+export declare const SS_PORT = 8388, VLESS_PORT = 8443, SS_ISP_PORT = 13839, VLESS_ISP_PORT = 18444;
+export declare const SS_TAG = "ss-in", VLESS_TAG = "vless-reality-in", SS_ISP_TAG = "ss-isp-in", VLESS_ISP_TAG = "vless-reality-isp-in", OUT_TAG = "isp-socks";
+export declare const NODE_SS = "shadowsocks", NODE_VLESS = "vless-reality", NODE_SS_ISP = "shadowsocks-isp", NODE_VLESS_ISP = "vless-reality-isp";
+export declare class ModelError extends Error {
+    name: string;
+}
+export declare function buildModel(env: Env, opts?: {
+    target?: 'all' | 'server' | 'client';
+}): Model;

package/install.sh

@@ -0,0 +1,202 @@
+#!/usr/bin/env bash
+# Bootstrap Node without sudo. Overrides: MY_SINGBOX_NODE_DIR (default
+# $HOME/.local/node), MY_SINGBOX_NODE_VERSION (v22.23.4),
+# MY_SINGBOX_NODE_MIRROR (download base), MY_SINGBOX_FORCE_NODE_INSTALL=1.
+# MY_SINGBOX_NODE_SHASUMS_BASE: test hook overriding the official checksum trust
+# anchor (default https://nodejs.org/dist); never point it at a mirror.
+legacy='https://github.com/zht7063/my-singbox/releases/tag/v1.1.0'
+if [ -z "${BASH_VERSION+x}" ]; then
+  if command -v bash >/dev/null 2>&1; then
+    if [ -f "$0" ] && [ -r "$0" ]; then
+      exec bash "$0" "$@"
+    fi
+    echo 'ERROR: run this installer from a saved file: sh install.sh' >&2
+  else
+    echo "ERROR: bash not found; musl/Alpine is unsupported by official Node/this tool; use shell v1.1.0: $legacy" >&2
+  fi
+  exit 1
+fi
+set -euo pipefail
+
+unsupported() {
+  echo "ERROR: $*; use shell v1.1.0: $legacy" >&2
+  exit 1
+}
+
+[[ $(uname -s) == Linux ]] || unsupported 'only Linux servers are supported'
+case $(uname -m) in
+  x86_64|amd64)
+    arch=x64
+    ;;
+  aarch64|arm64)
+    arch=arm64
+    ;;
+  *)
+    unsupported 'unsupported architecture'
+    ;;
+esac
+
+# Check libc before looking for Node: official binaries do not support musl or old glibc.
+libc=$(ldd --version 2>&1 || true)
+[[ $libc != *musl* ]] || unsupported 'musl/Alpine is unsupported by official Node/this tool'
+first_line=${libc%%$'\n'*}
+libc_version=${first_line##* }
+[[ $first_line == *GLIBC* || $first_line == *'GNU libc'* ||
+  $first_line == *'GNU C Library'* ]] || unsupported 'cannot determine libc'
+[[ $libc_version =~ ^([0-9]+)\.([0-9]+)(\.[0-9]+)?$ ]] ||
+  unsupported 'cannot determine glibc version'
+major=${BASH_REMATCH[1]}
+minor=${BASH_REMATCH[2]}
+((10#$major > 2 || (10#$major == 2 && 10#$minor >= 28))) ||
+  unsupported "glibc $libc_version is unsupported by official Node/this tool (requires >=2.28)"
+
+if ((EUID == 0)); then
+  echo 'Note: root is not needed; this installer never uses sudo.'
+fi
+node_dir=${MY_SINGBOX_NODE_DIR:-$HOME/.local/node}
+
+hints() {
+  printf 'PATH hint: export PATH="%s/bin:$PATH"\n' "$node_dir"
+  echo 'Next: npm i -g my-singbox && my-singbox doctor (or: npx my-singbox doctor).'
+}
+
+usable_node() {
+  local detected
+  detected=$("$1" -v 2>/dev/null) || return 1
+  [[ $detected =~ ^v([0-9]+)\. ]] && ((10#${BASH_REMATCH[1]} >= 22))
+}
+
+if [[ ${MY_SINGBOX_FORCE_NODE_INSTALL:-0} != 1 ]]; then
+  if command -v node >/dev/null 2>&1 && usable_node node; then
+    echo "Using Node already on PATH: $(command -v node)"
+    echo 'Next: npm i -g my-singbox && my-singbox doctor (or: npx my-singbox doctor).'
+    exit 0
+  fi
+  if [[ -x $node_dir/bin/node ]] && usable_node "$node_dir/bin/node"; then
+    echo "Using Node at $node_dir/bin/node."
+    hints
+    exit 0
+  fi
+fi
+
+command -v curl >/dev/null 2>&1 || {
+  echo 'ERROR: curl is required' >&2
+  exit 1
+}
+if command -v sha256sum >/dev/null 2>&1; then
+  hash_tool=sha256sum
+elif command -v shasum >/dev/null 2>&1; then
+  hash_tool=shasum
+else
+  echo 'ERROR: sha256sum or shasum is required' >&2
+  exit 1
+fi
+
+version=${MY_SINGBOX_NODE_VERSION:-v22.23.4}
+version=v${version#v}
+[[ $version =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
+  echo 'ERROR: invalid Node version' >&2
+  exit 1
+}
+requested_major=${version#v}
+requested_major=${requested_major%%.*}
+((10#$requested_major >= 22)) || {
+  echo 'ERROR: Node >=22 is required' >&2
+  exit 1
+}
+ext=gz
+if command -v xz >/dev/null 2>&1; then
+  ext=xz
+fi
+file="node-$version-linux-$arch.tar.$ext"
+
+if [[ -n ${MY_SINGBOX_NODE_MIRROR:-} ]]; then
+  base=${MY_SINGBOX_NODE_MIRROR%/}
+elif curl --max-time 5 -fsI https://nodejs.org/dist >/dev/null 2>&1; then
+  base=https://nodejs.org/dist
+else
+  base=https://npmmirror.com/mirrors/node
+fi
+if [[ $version == v22.23.4 ]]; then
+  checksum_source="built-in pin for $version"
+else
+  checksum_source='official nodejs.org SHASUMS256.txt'
+fi
+echo "Using Node source: $base (tarball; checksum: $checksum_source)"
+
+work=$(mktemp -d)
+stage=''
+cleanup() {
+  rm -rf -- "$work"
+  if [[ -n $stage ]]; then
+    rm -rf -- "$stage"
+  fi
+}
+trap cleanup EXIT
+
+expected=''
+if [[ $version == v22.23.4 ]]; then
+  case $file in
+    node-v22.23.4-linux-arm64.tar.gz)
+      expected=f7a1e486dbc8b286847815b477d4fb5e9fb963ed4489c3e1588853d685f589f9
+      ;;
+    node-v22.23.4-linux-arm64.tar.xz)
+      expected=6287aa46b6c375d816e63ae66d024fbbfd70404825aabdfdf898a970871d2f4b
+      ;;
+    node-v22.23.4-linux-x64.tar.gz)
+      expected=b8492284c76a54baf58d61668dd0e41ee0fc98adabf9503d30f05d08f55b4406
+      ;;
+    node-v22.23.4-linux-x64.tar.xz)
+      expected=1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce
+      ;;
+  esac
+else
+  shasums_base=${MY_SINGBOX_NODE_SHASUMS_BASE:-https://nodejs.org/dist}
+  shasums_base=${shasums_base%/}
+  if ! curl -fsSL --retry 3 "$shasums_base/$version/SHASUMS256.txt" \
+    -o "$work/SHASUMS256.txt"; then
+    echo "ERROR: cannot fetch the official SHASUMS256.txt from $shasums_base/$version/" \
+      '(needed to verify a non-default Node version); refusing to use mirror checksums.' \
+      'Use the default version or retry when nodejs.org is reachable.' >&2
+    exit 1
+  fi
+  expected=$(awk -v file="$file" '$2 == file {print $1}' "$work/SHASUMS256.txt")
+fi
+[[ $expected =~ ^[[:xdigit:]]{64}$ ]] || {
+  echo "ERROR: missing or invalid checksum entry for $file" >&2
+  exit 1
+}
+curl -fsSL --retry 3 "$base/$version/$file" -o "$work/$file"
+if [[ $hash_tool == sha256sum ]]; then
+  actual=$(sha256sum "$work/$file")
+else
+  actual=$(shasum -a 256 "$work/$file")
+fi
+actual=${actual%% *}
+if [[ ${actual,,} != "${expected,,}" ]]; then
+  echo "ERROR: checksum mismatch for $file (expected $expected, actual $actual)" >&2
+  exit 1
+fi
+
+# Only verified archives reach extraction; the existing target stays intact until then.
+parent=$(dirname -- "$node_dir")
+mkdir -p -- "$parent"
+stage=$(mktemp -d "$parent/.my-singbox-node.XXXXXX")
+tar -xf "$work/$file" -C "$stage" --strip-components=1
+[[ $("$stage/bin/node" --version) == "$version" ]] || {
+  echo 'ERROR: extracted Node version mismatch' >&2
+  exit 1
+}
+if [[ -e $node_dir || -L $node_dir ]]; then
+  backup="$node_dir.old-$(date +%Y%m%d%H%M%S)-$$"
+  [[ ! -e $backup ]] || {
+    echo 'ERROR: backup path exists' >&2
+    exit 1
+  }
+  mv -- "$node_dir" "$backup"
+  echo "Previous installation preserved at $backup"
+fi
+mv -- "$stage" "$node_dir"
+stage=''
+echo "Installed Node $version at $node_dir"
+hints

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "my-singbox",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2.0.0",
+  "type": "module",
+  "license": "MIT",
+  "engines": {
+    "node": ">=22"
+  },
+  "bin": {
+    "my-singbox": "dist/cli.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/zht7063/my-singbox"
+  },
+  "homepage": "https://github.com/zht7063/my-singbox",
+  "bugs": {
+    "url": "https://github.com/zht7063/my-singbox/issues"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/",
+    "templates/config.json.template",
+    "templates/clash.yaml.template",
+    "compose.yaml",
+    "install.sh",
+    "LICENSE",
+    "THIRD-PARTY-NOTICES.md",
+    "README.md",
+    "README_CN.md"
+  ],
+  "scripts": {
+    "build": "node tools/build.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "license-scan": "node tools/license-scan.mjs",
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "prepack": "npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "esbuild": "^0.28.2",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.5",
+    "yaml": "2.9.1"
+  }
+}

package/templates/clash.yaml.template

@@ -0,0 +1,123 @@
+proxies:
+  - name: "shadowsocks"
+    type: ss
+    server: "${SERVER_ADDRESS}"
+    port: 8388
+    cipher: 2022-blake3-aes-128-gcm
+    password: "${SS_PASSWORD}"
+    udp: true
+  - name: vless-reality
+    type: vless
+    server: "${SERVER_ADDRESS}"
+    port: 8443
+    uuid: "${VLESS_UUID}"
+    network: tcp
+    tls: true
+    udp: true
+    packet-encoding: xudp
+    servername: www.microsoft.com
+    client-fingerprint: chrome
+    flow: xtls-rprx-vision
+    reality-opts:
+      public-key: "${REALITY_PUBLIC_KEY}"
+      short-id: "${REALITY_SHORT_ID}"
+
+proxy-groups:
+  - name: Proxy
+    type: select
+    proxies:
+      - shadowsocks
+      - vless-reality
+      - DIRECT
+
+# 分流规则，自上而下匹配
+rules:
+  # 私有网络，直连
+  - RULE-SET,meta-private,DIRECT
+  - RULE-SET,meta-private-ip,DIRECT,no-resolve
+
+  # AI 服务，强制代理
+  - DOMAIN-SUFFIX,openai.com,Proxy
+  - DOMAIN-SUFFIX,chatgpt.com,Proxy
+  - DOMAIN-SUFFIX,oaistatic.com,Proxy
+  - DOMAIN-SUFFIX,oaiusercontent.com,Proxy
+  - DOMAIN-SUFFIX,anthropic.com,Proxy
+  - DOMAIN-SUFFIX,claude.ai,Proxy
+  - DOMAIN-SUFFIX,claude.com,Proxy
+  - DOMAIN-SUFFIX,claudeusercontent.com,Proxy
+
+  # 常规分流
+  - RULE-SET,meta-proxy,Proxy
+  - RULE-SET,meta-cn,DIRECT
+  - RULE-SET,meta-cn-ip,DIRECT
+  - MATCH,Proxy
+
+# 远程规则集
+rule-providers:
+  # 私有域名，直连
+  meta-private:
+    type: http
+    behavior: domain
+    format: mrs
+    url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geosite/private.mrs
+    path: ./ruleset/meta-private.mrs
+    interval: 86400
+
+  # 私有 IP 段，直连
+  meta-private-ip:
+    type: http
+    behavior: ipcidr
+    format: mrs
+    url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geoip/private.mrs
+    path: ./ruleset/meta-private-ip.mrs
+    interval: 86400
+
+  # 非中国大陆域名，走代理
+  meta-proxy:
+    type: http
+    behavior: domain
+    format: mrs
+    url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geosite/geolocation-!cn.mrs
+    path: ./ruleset/meta-proxy.mrs
+    interval: 86400
+
+  # 中国大陆域名，直连
+  meta-cn:
+    type: http
+    behavior: domain
+    format: mrs
+    url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geosite/cn.mrs
+    path: ./ruleset/meta-cn.mrs
+    interval: 86400
+
+  # 中国大陆 IP，直连
+  meta-cn-ip:
+    type: http
+    behavior: ipcidr
+    format: mrs
+    url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geoip/cn.mrs
+    path: ./ruleset/meta-cn-ip.mrs
+    interval: 86400
+
+# DNS 解析
+dns:
+  enable: true
+  ipv6: false
+  listen: 127.0.0.1:1053
+  enhanced-mode: fake-ip
+  fake-ip-range: 198.18.0.1/16
+  fake-ip-filter:
+    - "*.lan"
+    - "*.local"
+  default-nameserver:
+    - 223.5.5.5
+  proxy-server-nameserver:
+    - "https://223.5.5.5/dns-query#DIRECT"
+  nameserver:
+    - "https://1.1.1.1/dns-query#Proxy"
+    - "https://8.8.8.8/dns-query#Proxy"
+  nameserver-policy:
+    "rule-set:meta-private":
+      - system
+    "rule-set:meta-cn":
+      - "https://223.5.5.5/dns-query#DIRECT"

package/templates/config.json.template

@@ -0,0 +1,50 @@
+{
+  "log": {
+    "level": "warn",
+    "timestamp": true
+  },
+  "inbounds": [
+    {
+      "type": "shadowsocks",
+      "tag": "ss-in",
+      "listen": "0.0.0.0",
+      "listen_port": 8388,
+      "method": "2022-blake3-aes-128-gcm",
+      "password": "${SS_PASSWORD}"
+    },
+    {
+      "type": "vless",
+      "tag": "vless-reality-in",
+      "listen": "0.0.0.0",
+      "listen_port": 8443,
+      "users": [
+        {
+          "name": "client-1",
+          "uuid": "${VLESS_UUID}",
+          "flow": "xtls-rprx-vision"
+        }
+      ],
+      "tls": {
+        "enabled": true,
+        "server_name": "www.microsoft.com",
+        "reality": {
+          "enabled": true,
+          "handshake": {
+            "server": "www.microsoft.com",
+            "server_port": 443
+          },
+          "private_key": "${REALITY_PRIVATE_KEY}",
+          "short_id": [
+            "${REALITY_SHORT_ID}"
+          ]
+        }
+      }
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "direct",
+      "tag": "direct"
+    }
+  ]
+}