my-singbox 2.0.0 → 3.0.0

package/dist/cli.js

@@ -49,10 +49,10 @@ var require_identity = __commonJS({
     var NODE_TYPE = /* @__PURE__ */ Symbol.for("yaml.node.type");
     var isAlias = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === ALIAS;
     var isDocument = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === DOC;
-    var isMap3 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
+    var isMap2 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
     var isPair = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === PAIR;
-    var isScalar3 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
-    var isSeq3 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
+    var isScalar2 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
+    var isSeq2 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
     function isCollection(node) {
       if (node && typeof node === "object")
         switch (node[NODE_TYPE]) {
@@ -73,7 +73,7 @@ var require_identity = __commonJS({
         }
       return false;
     }
-    var hasAnchor = (node) => (isScalar3(node) || isCollection(node)) && !!node.anchor;
+    var hasAnchor = (node) => (isScalar2(node) || isCollection(node)) && !!node.anchor;
     exports.ALIAS = ALIAS;
     exports.DOC = DOC;
     exports.MAP = MAP;
@@ -85,11 +85,11 @@ var require_identity = __commonJS({
     exports.isAlias = isAlias;
     exports.isCollection = isCollection;
     exports.isDocument = isDocument;
-    exports.isMap = isMap3;
+    exports.isMap = isMap2;
     exports.isNode = isNode;
     exports.isPair = isPair;
-    exports.isScalar = isScalar3;
-    exports.isSeq = isSeq3;
+    exports.isScalar = isScalar2;
+    exports.isSeq = isSeq2;
   }
 });
 
@@ -101,7 +101,7 @@ var require_visit = __commonJS({
     var BREAK = /* @__PURE__ */ Symbol("break visit");
     var SKIP = /* @__PURE__ */ Symbol("skip children");
     var REMOVE = /* @__PURE__ */ Symbol("remove node");
-    function visit3(node, visitor) {
+    function visit2(node, visitor) {
       const visitor_ = initVisitor(visitor);
       if (identity.isDocument(node)) {
         const cd = visit_(null, node.contents, visitor_, Object.freeze([node]));
@@ -110,9 +110,9 @@ var require_visit = __commonJS({
       } else
         visit_(null, node, visitor_, Object.freeze([]));
     }
-    visit3.BREAK = BREAK;
-    visit3.SKIP = SKIP;
-    visit3.REMOVE = REMOVE;
+    visit2.BREAK = BREAK;
+    visit2.SKIP = SKIP;
+    visit2.REMOVE = REMOVE;
     function visit_(key, node, visitor, path) {
       const ctrl = callVisitor(key, node, visitor, path);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
@@ -246,7 +246,7 @@ var require_visit = __commonJS({
         throw new Error(`Cannot replace node with ${pt} parent`);
       }
     }
-    exports.visit = visit3;
+    exports.visit = visit2;
     exports.visitAsync = visitAsync;
   }
 });
@@ -256,7 +256,7 @@ var require_directives = __commonJS({
   "node_modules/yaml/dist/doc/directives.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var visit3 = require_visit();
+    var visit2 = require_visit();
     var escapeChars = {
       "!": "%21",
       ",": "%2C",
@@ -400,7 +400,7 @@ var require_directives = __commonJS({
         let tagNames;
         if (doc && tagEntries.length > 0 && identity.isNode(doc.contents)) {
           const tags = {};
-          visit3.visit(doc.contents, (_key, node) => {
+          visit2.visit(doc.contents, (_key, node) => {
             if (identity.isNode(node) && node.tag)
               tags[node.tag] = true;
           });
@@ -427,7 +427,7 @@ var require_anchors = __commonJS({
   "node_modules/yaml/dist/doc/anchors.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var visit3 = require_visit();
+    var visit2 = require_visit();
     function anchorIsValid(anchor) {
       if (/[\x00-\x19\s,[\]{}]/.test(anchor)) {
         const sa = JSON.stringify(anchor);
@@ -438,7 +438,7 @@ var require_anchors = __commonJS({
     }
     function anchorNames(root) {
       const anchors = /* @__PURE__ */ new Set();
-      visit3.visit(root, {
+      visit2.visit(root, {
         Value(_key, node) {
           if (node.anchor)
             anchors.add(node.anchor);
@@ -618,7 +618,7 @@ var require_Alias = __commonJS({
   "node_modules/yaml/dist/nodes/Alias.js"(exports) {
     "use strict";
     var anchors = require_anchors();
-    var visit3 = require_visit();
+    var visit2 = require_visit();
     var identity = require_identity();
     var Node = require_Node();
     var toJS = require_toJS();
@@ -644,7 +644,7 @@ var require_Alias = __commonJS({
           nodes = ctx.aliasResolveCache;
         } else {
           nodes = [];
-          visit3.visit(doc, {
+          visit2.visit(doc, {
             Node: (_key, node) => {
               if (identity.isAlias(node) || identity.hasAnchor(node))
                 nodes.push(node);
@@ -4197,9 +4197,9 @@ var require_resolve_flow_collection = __commonJS({
     var blockMsg = "Block collections are not allowed within flow collections";
     var isBlock = (token) => token && (token.type === "block-map" || token.type === "block-seq");
     function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onError, tag) {
-      const isMap3 = fc.start.source === "{";
-      const fcName = isMap3 ? "flow map" : "flow sequence";
-      const NodeClass = tag?.nodeClass ?? (isMap3 ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
+      const isMap2 = fc.start.source === "{";
+      const fcName = isMap2 ? "flow map" : "flow sequence";
+      const NodeClass = tag?.nodeClass ?? (isMap2 ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
       const coll = new NodeClass(ctx.schema);
       coll.flow = true;
       const atRoot = ctx.atRoot;
@@ -4235,7 +4235,7 @@ var require_resolve_flow_collection = __commonJS({
             offset = props.end;
             continue;
           }
-          if (!isMap3 && ctx.options.strict && utilContainsNewline.containsNewline(key))
+          if (!isMap2 && ctx.options.strict && utilContainsNewline.containsNewline(key))
             onError(
               key,
               // checked by containsNewline()
@@ -4275,7 +4275,7 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap3 && !sep && !props.found) {
+        if (!isMap2 && !sep && !props.found) {
           const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
@@ -4298,7 +4298,7 @@ var require_resolve_flow_collection = __commonJS({
             startOnNewline: false
           });
           if (valueProps.found) {
-            if (!isMap3 && !props.found && ctx.options.strict) {
+            if (!isMap2 && !props.found && ctx.options.strict) {
               if (sep)
                 for (const st of sep) {
                   if (st === valueProps.found)
@@ -4330,7 +4330,7 @@ var require_resolve_flow_collection = __commonJS({
           const pair = new Pair.Pair(keyNode, valueNode);
           if (ctx.options.keepSourceTokens)
             pair.srcToken = collItem;
-          if (isMap3) {
+          if (isMap2) {
             const map = coll;
             if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
               onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
@@ -4346,7 +4346,7 @@ var require_resolve_flow_collection = __commonJS({
           offset = valueNode ? valueNode.range[2] : valueProps.end;
         }
       }
-      const expectedEnd = isMap3 ? "}" : "]";
+      const expectedEnd = isMap2 ? "}" : "]";
       const [ce, ...ee] = fc.end;
       let cePos = offset;
       if (ce?.source === expectedEnd)
@@ -5566,15 +5566,15 @@ var require_cst_visit = __commonJS({
     var BREAK = /* @__PURE__ */ Symbol("break visit");
     var SKIP = /* @__PURE__ */ Symbol("skip children");
     var REMOVE = /* @__PURE__ */ Symbol("remove item");
-    function visit3(cst, visitor) {
+    function visit2(cst, visitor) {
       if ("type" in cst && cst.type === "document")
         cst = { start: cst.start, value: cst.value };
       _visit(Object.freeze([]), cst, visitor);
     }
-    visit3.BREAK = BREAK;
-    visit3.SKIP = SKIP;
-    visit3.REMOVE = REMOVE;
-    visit3.itemAtPath = (cst, path) => {
+    visit2.BREAK = BREAK;
+    visit2.SKIP = SKIP;
+    visit2.REMOVE = REMOVE;
+    visit2.itemAtPath = (cst, path) => {
       let item = cst;
       for (const [field, index] of path) {
         const tok = item?.[field];
@@ -5585,8 +5585,8 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit3.parentCollection = (cst, path) => {
-      const parent = visit3.itemAtPath(cst, path.slice(0, -1));
+    visit2.parentCollection = (cst, path) => {
+      const parent = visit2.itemAtPath(cst, path.slice(0, -1));
       const field = path[path.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
@@ -5617,7 +5617,7 @@ var require_cst_visit = __commonJS({
       }
       return typeof ctrl === "function" ? ctrl(item, path) : ctrl;
     }
-    exports.visit = visit3;
+    exports.visit = visit2;
   }
 });
 
@@ -5633,7 +5633,7 @@ var require_cst = __commonJS({
     var FLOW_END = "";
     var SCALAR = "";
     var isCollection = (token) => !!token && "items" in token;
-    var isScalar3 = (token) => !!token && (token.type === "scalar" || token.type === "single-quoted-scalar" || token.type === "double-quoted-scalar" || token.type === "block-scalar");
+    var isScalar2 = (token) => !!token && (token.type === "scalar" || token.type === "single-quoted-scalar" || token.type === "double-quoted-scalar" || token.type === "block-scalar");
     function prettyToken(token) {
       switch (token) {
         case BOM:
@@ -5717,7 +5717,7 @@ var require_cst = __commonJS({
     exports.FLOW_END = FLOW_END;
     exports.SCALAR = SCALAR;
     exports.isCollection = isCollection;
-    exports.isScalar = isScalar3;
+    exports.isScalar = isScalar2;
     exports.prettyToken = prettyToken;
     exports.tokenType = tokenType;
   }
@@ -7247,7 +7247,7 @@ var require_public_api = __commonJS({
         return docs;
       return Object.assign([], { empty: true }, composer$1.streamInfo());
     }
-    function parseDocument3(source, options = {}) {
+    function parseDocument2(source, options = {}) {
       const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
       const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
       const composer$1 = new composer.Composer(options);
@@ -7273,7 +7273,7 @@ var require_public_api = __commonJS({
       } else if (options === void 0 && reviver && typeof reviver === "object") {
         options = reviver;
       }
-      const doc = parseDocument3(src, options);
+      const doc = parseDocument2(src, options);
       if (!doc)
         return null;
       doc.warnings.forEach((warning) => log.warn(doc.options.logLevel, warning));
@@ -7309,7 +7309,7 @@ var require_public_api = __commonJS({
     }
     exports.parse = parse;
     exports.parseAllDocuments = parseAllDocuments;
-    exports.parseDocument = parseDocument3;
+    exports.parseDocument = parseDocument2;
     exports.stringify = stringify;
   }
 });
@@ -7333,7 +7333,7 @@ var require_dist = __commonJS({
     var lineCounter = require_line_counter();
     var parser = require_parser();
     var publicApi = require_public_api();
-    var visit3 = require_visit();
+    var visit2 = require_visit();
     exports.Composer = composer.Composer;
     exports.Document = Document.Document;
     exports.Schema = Schema.Schema;
@@ -7361,8 +7361,8 @@ var require_dist = __commonJS({
     exports.parseAllDocuments = publicApi.parseAllDocuments;
     exports.parseDocument = publicApi.parseDocument;
     exports.stringify = publicApi.stringify;
-    exports.visit = visit3.visit;
-    exports.visitAsync = visit3.visitAsync;
+    exports.visit = visit2.visit;
+    exports.visitAsync = visit2.visitAsync;
   }
 });
 
@@ -7434,7 +7434,7 @@ async function dockerAccessGuidance(s) {
   const already = groups.trim().split(/\s+/).includes("docker");
   return [
     "This tool never uses sudo and never escalates privileges itself.",
-    "Open firewall / cloud security group ports: 8388/tcp, 8388/udp, 8443/tcp; only for optional ISP outbound: 13839/tcp, 13839/udp, 18444/tcp.",
+    "Open firewall / cloud security group ports: 8388/tcp, 8388/udp, 8443/tcp. ISP routing uses the same listening ports.",
     ...already ? [
       "The Docker daemon may not be running, or your session predates the group change. Log out and back in (or run `newgrp docker`)."
     ] : [
@@ -7717,6 +7717,9 @@ function stripIsp(text) {
     noeol
   };
 }
+function envWithoutIsp(text) {
+  return stripIsp(text).text;
+}
 function envWithIsp(text, isp) {
   const base = stripIsp(text);
   return base.text + (base.noeol ? "\n" : "") + "\n" + (base.noeol ? ENV_HEADER_NOEOL : ENV_HEADER) + `
@@ -7855,6 +7858,9 @@ function findUp(name, message) {
   }
   throw new Error(message);
 }
+function readTemplate(name, projectDir) {
+  return readFileSync2(findTemplate(name, projectDir), "utf8");
+}
 
 // src/model.ts
 var SS_PORT = 8388;
@@ -7868,8 +7874,6 @@ var VLESS_ISP_TAG = "vless-reality-isp-in";
 var OUT_TAG = "isp-socks";
 var NODE_SS = "shadowsocks";
 var NODE_VLESS = "vless-reality";
-var NODE_SS_ISP = "shadowsocks-isp";
-var NODE_VLESS_ISP = "vless-reality-isp";
 var ModelError = class extends Error {
   name = "ModelError";
 };
@@ -7922,20 +7926,20 @@ function buildModel(env, opts = {}) {
     publicKey,
     shortId: v.REALITY_SHORT_ID
   };
-  const node = (name, protocol, tag, port, egress) => ({
+  const node = (name, protocol, tag, port) => ({
     name,
     protocol,
     inbound: { tag, port },
-    egress,
     creds: protocol === "shadowsocks" ? ss : reality
   });
   const model = {
     server,
     nodes: [
-      node(NODE_SS, "shadowsocks", SS_TAG, SS_PORT, "direct"),
-      node(NODE_VLESS, "vless-reality", VLESS_TAG, VLESS_PORT, "direct")
+      node(NODE_SS, "shadowsocks", SS_TAG, SS_PORT),
+      node(NODE_VLESS, "vless-reality", VLESS_TAG, VLESS_PORT)
     ]
   };
+  if (target === "client") return model;
   const {
     ISP_SOCKS_ADDR: rawAddr = "",
     ISP_SOCKS_USER: rawUser = "",
@@ -7958,19 +7962,67 @@ function buildModel(env, opts = {}) {
     pass,
     ...ip ? { egressIp: ip } : {}
   };
-  model.nodes.push(
-    node(NODE_SS_ISP, "shadowsocks", SS_ISP_TAG, SS_ISP_PORT, "isp-socks"),
-    node(
-      NODE_VLESS_ISP,
-      "vless-reality",
-      VLESS_ISP_TAG,
-      VLESS_ISP_PORT,
-      "isp-socks"
-    )
-  );
   return model;
 }
 
+// src/core/routing.ts
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isIspRule(value) {
+  return isRecord(value) && value.outbound === OUT_TAG;
+}
+function isLegacyIspRule(value) {
+  if (!isIspRule(value)) return false;
+  const inbound = typeof value.inbound === "string" ? [value.inbound] : value.inbound;
+  return Array.isArray(inbound) && inbound.length > 0 && inbound.every((tag) => tag === SS_ISP_TAG || tag === VLESS_ISP_TAG) && (value.action === void 0 || value.action === "route") && Object.keys(value).every((key) => ["inbound", "outbound", "action"].includes(key));
+}
+function checkNoIspReferences(config) {
+  const referenceKeys = /* @__PURE__ */ new Set(["outbound", "outbounds", "detour", "final", "default"]);
+  const walk = (value, path, key = "") => {
+    if (value === OUT_TAG && referenceKeys.has(key))
+      throw new Error(`Unsupported ISP reference at ${path}. Remove this reference before disabling ISP.`);
+    if (Array.isArray(value))
+      value.forEach((item, i) => walk(item, `${path}[${i}]`, key));
+    else if (isRecord(value))
+      for (const [name, item] of Object.entries(value)) walk(item, `${path}.${name}`, name);
+  };
+  walk(config, "config");
+}
+function upsertIspOutbound(config, isp) {
+  const outbounds = config.outbounds ??= [];
+  const matches = outbounds.filter((o) => o.tag === OUT_TAG);
+  if (matches.length > 1) throw new Error(`Duplicate outbound tag: ${OUT_TAG}.`);
+  const fields = {
+    type: "socks",
+    tag: OUT_TAG,
+    server: isp.host,
+    server_port: isp.port,
+    version: "5",
+    username: isp.user,
+    password: isp.pass
+  };
+  if (matches[0]) {
+    if (matches[0].type !== "socks")
+      throw new Error(`Outbound ${OUT_TAG} must have type socks.`);
+    Object.assign(matches[0], fields);
+  } else outbounds.push(fields);
+}
+function omitIsp(config) {
+  if (config.outbounds) config.outbounds = config.outbounds.filter((o) => o.tag !== OUT_TAG);
+  if (config.route?.rules) config.route.rules = config.route.rules.filter((r) => !isIspRule(r));
+  checkNoIspReferences(config);
+}
+function ensureRoute(config, defaults) {
+  const route = config.route ??= {};
+  const rules = route.rules ??= [];
+  if (!rules.some((r) => isRecord(r) && r.action === "sniff"))
+    rules.unshift({ action: "sniff" });
+  if (!rules.some(isIspRule) && defaults?.rules)
+    rules.push(...structuredClone(defaults.rules.filter(isIspRule)));
+  route.final ??= "direct";
+}
+
 // src/core/render-config.ts
 function renderSingbox(model, template) {
   const ss = model.nodes.find((n) => n.protocol === "shadowsocks").creds;
@@ -7988,7 +8040,7 @@ function renderSingbox(model, template) {
   const prototypes = /* @__PURE__ */ new Map();
   for (const protocol of ["shadowsocks", "vless-reality"]) {
     const base = model.nodes.find(
-      (n) => n.protocol === protocol && n.egress === "direct"
+      (n) => n.protocol === protocol
     );
     const proto = config.inbounds.find(
       (i) => i.type === (protocol === "shadowsocks" ? "shadowsocks" : "vless")
@@ -8002,27 +8054,9 @@ function renderSingbox(model, template) {
     tag: n.inbound.tag,
     listen_port: n.inbound.port
   }));
-  const ispNodes = model.nodes.filter((n) => n.egress === "isp-socks");
-  if (ispNodes.length) {
-    const isp = model.isp;
-    config.outbounds = [
-      ...config.outbounds ?? [],
-      {
-        type: "socks",
-        tag: OUT_TAG,
-        server: isp.host,
-        server_port: isp.port,
-        version: "5",
-        username: isp.user,
-        password: isp.pass
-      }
-    ];
-    config.route ??= {};
-    config.route.rules = [
-      ...config.route.rules ?? [],
-      { inbound: ispNodes.map((n) => n.inbound.tag), outbound: OUT_TAG }
-    ];
-  }
+  ensureRoute(config);
+  if (model.isp) upsertIspOutbound(config, model.isp);
+  else omitIsp(config);
   if (JSON.stringify(config).includes("${"))
     throw new Error("Unresolved placeholder left in config.json.");
   return config;
@@ -8030,6 +8064,9 @@ function renderSingbox(model, template) {
 function serializeSingbox(config) {
   return JSON.stringify(config, null, 2) + "\n";
 }
+function loadSingboxTemplate(projectDir) {
+  return JSON.parse(readTemplate("config.json.template", projectDir));
+}
 
 // src/cli/gen-config.ts
 async function genConfig(io) {
@@ -8090,11 +8127,9 @@ function renderClash(model, templateText) {
   }
   proxies.items = model.nodes.map((n) => {
     const proto = prototypes.get(n.protocol);
-    if (n.egress === "direct") return proto;
-    const clone = proto.clone();
-    clone.set("name", n.name);
-    clone.set("port", n.inbound.port);
-    return clone;
+    proto.set("name", n.name);
+    proto.set("port", n.inbound.port);
+    return proto;
   });
   const group = groups.items.find((g) => (0, import_yaml.isMap)(g) && g.get("name") === "Proxy");
   const list = (0, import_yaml.isMap)(group) ? group.get("proxies", true) : null;
@@ -8143,21 +8178,11 @@ Saved to: ${path}
 }
 
 // src/cli/isp-outbound.ts
-import {
-  accessSync,
-  constants,
-  existsSync as existsSync6,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync6,
-  rmSync as rmSync3,
-  statSync as statSync2,
-  writeFileSync as writeFileSync3
-} from "node:fs";
-import { join as join4, resolve as resolve4 } from "node:path";
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
+import { accessSync, constants, existsSync as existsSync7, readFileSync as readFileSync8, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join6, resolve as resolve4 } from "node:path";
+import { isDeepStrictEqual } from "node:util";
 
 // src/core/isp.ts
-var import_yaml2 = __toESM(require_dist(), 1);
 import {
   chmodSync,
   chownSync,
@@ -8177,131 +8202,65 @@ import {
 } from "node:fs";
 import { join as join3 } from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { isDeepStrictEqual } from "node:util";
 var ISP_BACKUP_DIR = ".isp-backup";
 var ISP_LOCK_FILE = ".isp.lock";
 var ISP_TMP_PREFIX = ".isp-tmp.";
-var GROUP_MAIN = "Proxy";
-var MANAGED_FILES = ["config.json", "clash.yaml", ".env"];
+var MANAGED_FILES = ["config.json", ".env"];
 var IspError = class extends Error {
   name = "IspError";
 };
 function envGet(text, key) {
   return text.split("\n").find((line) => line.startsWith(`${key}=`))?.slice(key.length + 1).replace(/\r$/, "");
 }
-function envHasIsp(text) {
-  return text.split("\n").some((raw) => {
-    const line = raw.replace(/\r$/, "");
-    return /^ISP_SOCKS_[^=]*=/.test(line) || line === ENV_HEADER || line === ENV_HEADER_NOEOL;
-  });
-}
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function checkIspConfig(config) {
   if (!isRecord(config)) throw new IspError("config.json is not valid JSON.");
   const inbounds = config.inbounds;
-  if (!Array.isArray(inbounds) || ![SS_TAG, VLESS_TAG].every((tag) => inbounds.some((i) => isRecord(i) && i.tag === tag)))
+  if (!Array.isArray(inbounds) || !inbounds.every(isRecord) || ![SS_TAG, VLESS_TAG].every((tag) => inbounds.some((i) => i.tag === tag)))
     throw new IspError("config.json has no inbounds tagged ss-in and vless-reality-in.");
-  if (inbounds.some((i) => isRecord(i) && i.tag !== SS_ISP_TAG && i.tag !== VLESS_ISP_TAG && (i.listen_port === SS_ISP_PORT || i.listen_port === VLESS_ISP_PORT)))
-    throw new IspError(`Another inbound in config.json already uses port ${SS_ISP_PORT} or ${VLESS_ISP_PORT}.`);
-}
-function configHasIsp(config) {
-  return [...config.inbounds ?? [], ...config.outbounds ?? []].some(
-    (i) => isRecord(i) && [SS_ISP_TAG, VLESS_ISP_TAG, OUT_TAG].includes(i.tag)
-  );
+  if (config.outbounds !== void 0 && (!Array.isArray(config.outbounds) || !config.outbounds.every(isRecord))) throw new IspError("config.json has invalid outbounds.");
+  if (config.route !== void 0 && (!isRecord(config.route) || config.route.rules !== void 0 && !Array.isArray(config.route.rules)))
+    throw new IspError("config.json has invalid route rules.");
 }
-function addIspToConfig(config, isp) {
-  checkIspConfig(config);
+function withoutLegacyListeners(config) {
   const next = structuredClone(config);
-  for (const [base, tag, port] of [
-    [SS_TAG, SS_ISP_TAG, SS_ISP_PORT],
-    [VLESS_TAG, VLESS_ISP_TAG, VLESS_ISP_PORT]
-  ]) {
-    const existing = next.inbounds.find((i) => i.tag === tag);
-    if (existing) existing.listen_port = port;
-    else next.inbounds.push({
-      ...structuredClone(next.inbounds.find((i) => i.tag === base)),
-      tag,
-      listen_port: port
-    });
-  }
-  const outbounds = next.outbounds ??= [];
-  const outbound = outbounds.find((o) => o.tag === OUT_TAG);
-  const fields = {
-    type: "socks",
-    tag: OUT_TAG,
-    server: isp.host,
-    server_port: isp.port,
-    version: "5",
-    username: isp.user,
-    password: isp.pass
+  const tags = /* @__PURE__ */ new Set([SS_ISP_TAG, VLESS_ISP_TAG]);
+  next.inbounds = next.inbounds.filter((inbound) => {
+    if (!tags.has(inbound.tag)) return true;
+    const ss = inbound.tag === SS_ISP_TAG;
+    if (inbound.type !== (ss ? "shadowsocks" : "vless") || inbound.listen_port !== (ss ? SS_ISP_PORT : VLESS_ISP_PORT))
+      throw new IspError("Legacy ISP inbound was customized. Migrate its tag and references manually first.");
+    return false;
+  });
+  if (next.route?.rules) next.route.rules = next.route.rules.flatMap((rule) => {
+    if (!isRecord(rule)) return [rule];
+    const inbound = typeof rule.inbound === "string" ? [rule.inbound] : rule.inbound;
+    if (!Array.isArray(inbound) || !inbound.some((tag) => tags.has(tag))) return [rule];
+    const remaining = inbound.filter((tag) => !tags.has(tag));
+    if (remaining.length) return [{ ...rule, inbound: remaining }];
+    if (isLegacyIspRule(rule)) return [];
+    throw new IspError("A custom route depends on legacy ISP inbounds. Migrate it manually first.");
+  });
+  const check = (value, key = "") => {
+    if (typeof value === "string" && tags.has(value) && ["inbound", "detour"].includes(key))
+      throw new IspError("A custom reference depends on legacy ISP inbounds. Migrate it manually first.");
+    if (Array.isArray(value)) value.forEach((item) => check(item, key));
+    else if (isRecord(value)) Object.entries(value).forEach(([name, item]) => check(item, name));
   };
-  if (outbound) Object.assign(outbound, fields);
-  else outbounds.push(fields);
-  const rules = (next.route ??= {}).rules ??= [];
-  const rule = rules.find((r) => isRecord(r) && r.outbound === OUT_TAG);
-  const inbound = [SS_ISP_TAG, VLESS_ISP_TAG];
-  if (isRecord(rule)) {
-    if (!isDeepStrictEqual(rule.inbound, inbound)) rule.inbound = inbound;
-  } else rules.push({ inbound, outbound: OUT_TAG });
+  check(next);
   return next;
 }
-function clashHasIsp(text) {
-  if (/^\s*#.*\bmy-singbox-isp\b/m.test(text)) return true;
-  const doc = (0, import_yaml2.parseDocument)(text);
-  const proxies = doc.get("proxies", true);
-  return (0, import_yaml2.isSeq)(proxies) && proxies.items.some((p) => (0, import_yaml2.isMap)(p) && [NODE_SS_ISP, NODE_VLESS_ISP].includes(p.get("name")));
+function addIspToConfig(config, isp, routeDefaults) {
+  checkIspConfig(config);
+  const next = withoutLegacyListeners(config);
+  upsertIspOutbound(next, isp);
+  ensureRoute(next, routeDefaults);
+  return next;
 }
-function addIspToClash(text, realityPrivateKey) {
-  const doc = (0, import_yaml2.parseDocument)(text);
-  if (doc.errors.length) throw new IspError("clash.yaml is not valid YAML.");
-  const proxies = doc.get("proxies", true);
-  const missing = `clash.yaml has no usable node named "${NODE_SS}" and "${NODE_VLESS}". It was probably generated by an older version (My-sing-box / My-VLESS-Reality). Delete clash.yaml, run my-singbox conf-clash to regenerate it, re-import it in your clients, then re-run my-singbox isp-outbound --add.`;
-  if (!(0, import_yaml2.isSeq)(proxies)) throw new IspError(missing);
-  let changed = false;
-  for (const [base, name, basePort, port] of [
-    [NODE_SS, NODE_SS_ISP, SS_PORT, SS_ISP_PORT],
-    [NODE_VLESS, NODE_VLESS_ISP, VLESS_PORT, VLESS_ISP_PORT]
-  ]) {
-    const proto = proxies.items.find((p) => (0, import_yaml2.isMap)(p) && p.get("name") === base);
-    if (!(0, import_yaml2.isMap)(proto) || proto.get("port") !== basePort) throw new IspError(missing);
-    const existing = proxies.items.find((p) => (0, import_yaml2.isMap)(p) && p.get("name") === name);
-    if ((0, import_yaml2.isMap)(existing)) {
-      if (existing.get("port") !== port) {
-        existing.set("port", port);
-        changed = true;
-      }
-    } else {
-      const clone = proto.clone();
-      (0, import_yaml2.visit)(clone, (_key, node) => {
-        if ((0, import_yaml2.isMap)(node) || (0, import_yaml2.isSeq)(node) || (0, import_yaml2.isScalar)(node)) {
-          delete node.comment;
-          delete node.commentBefore;
-          delete node.spaceBefore;
-        }
-      });
-      clone.set("name", name);
-      clone.set("port", port);
-      proxies.add(clone);
-      changed = true;
-    }
-  }
-  const groups = doc.get("proxy-groups", true);
-  const group = (0, import_yaml2.isSeq)(groups) ? groups.items.find((g) => (0, import_yaml2.isMap)(g) && g.get("name") === GROUP_MAIN) : void 0;
-  const list = (0, import_yaml2.isMap)(group) ? group.get("proxies", true) : void 0;
-  if (!(0, import_yaml2.isSeq)(list))
-    throw new IspError(`clash.yaml has no '${GROUP_MAIN}' proxy group with a 'proxies:' list in the expected format (generated by my-singbox conf-clash). Regenerate clash.yaml, re-import it in your clients, then re-run my-singbox isp-outbound --add.`);
-  for (const name of [NODE_SS_ISP, NODE_VLESS_ISP]) {
-    if (!list.items.some((item) => (0, import_yaml2.isScalar)(item) && item.value === name)) {
-      list.add(name);
-      changed = true;
-    }
-  }
-  const result2 = changed ? doc.toString({ lineWidth: 0 }) : text;
-  if (result2.includes("REALITY_PRIVATE_KEY") || realityPrivateKey && result2.includes(realityPrivateKey))
-    throw new IspError("Refusing to write REALITY_PRIVATE_KEY into clash.yaml.");
-  return result2;
+function removeIspFromConfig(config) {
+  checkIspConfig(config);
+  const next = withoutLegacyListeners(config);
+  omitIsp(next);
+  return next;
 }
 function makeTmpPath(projectDir) {
   return join3(projectDir, ISP_TMP_PREFIX + randomBytes3(16).toString("hex"));
@@ -8337,7 +8296,7 @@ function backupDirs(projectDir) {
   return existsSync5(root) ? readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join3(root, entry.name)).sort() : [];
 }
 var lastStamp = 0n;
-function makeBackup(projectDir) {
+function makeBackup(projectDir, files = MANAGED_FILES) {
   const now = BigInt(Date.now()) * 1000000n;
   lastStamp = now > lastStamp ? now : lastStamp + 1n;
   const d = new Date(Number(lastStamp / 1000000n));
@@ -8345,36 +8304,20 @@ function makeBackup(projectDir) {
   const stamp = `${d.getFullYear()}${p2(d.getMonth() + 1)}${p2(d.getDate())}-${p2(d.getHours())}${p2(d.getMinutes())}${p2(d.getSeconds())}-${(lastStamp % 1000000000n).toString().padStart(9, "0")}-${process.pid}`;
   const root = join3(projectDir, ISP_BACKUP_DIR), dir = join3(root, stamp);
   mkdirSync(root, { recursive: true, mode: 448 });
-  mkdirSync(dir, { mode: 448 });
   chmodSync(root, 448);
-  chmodSync(dir, 448);
-  for (const file of MANAGED_FILES) {
+  mkdirSync(dir, { mode: 448 });
+  for (const file of files) {
     const src = join3(projectDir, file);
     if (existsSync5(src) && statSync(src).isFile()) copyPreserved(src, join3(dir, file));
   }
   const all = backupDirs(projectDir);
-  for (const old of all.slice(1, Math.max(1, all.length - 4)))
-    rmSync2(old, { recursive: true });
+  for (const old of all.slice(1, Math.max(1, all.length - 4))) rmSync2(old, { recursive: true });
   return dir;
 }
-function findCleanBackup(projectDir) {
-  return backupDirs(projectDir).reverse().find((dir) => MANAGED_FILES.every((file) => {
-    const path = join3(dir, file);
-    if (!existsSync5(path)) return true;
-    const text = readFileSync5(path, "utf8");
-    if (file === ".env") return !envHasIsp(text);
-    if (file === "clash.yaml") return !clashHasIsp(text);
-    try {
-      return !configHasIsp(JSON.parse(text));
-    } catch {
-      return false;
-    }
-  }));
-}
-function restoreBackup(projectDir, backupDir) {
-  for (const file of MANAGED_FILES) {
-    const src = join3(backupDir, file);
-    if (existsSync5(src) && statSync(src).isFile()) copyPreserved(src, join3(projectDir, file));
+function restoreBackup(projectDir, backupDir, files = MANAGED_FILES) {
+  for (const file of files) {
+    const src = join3(backupDir, file), dest = join3(projectDir, file);
+    if (existsSync5(src) && statSync(src).isFile()) copyPreserved(src, dest);
   }
 }
 function sweepStaleTmp(projectDir) {
@@ -8432,6 +8375,144 @@ async function withLock(projectDir, fn) {
 // src/core/isp-service.ts
 import { spawn } from "node:child_process";
 import { createConnection } from "node:net";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { join as join5 } from "node:path";
+
+// src/core/start.ts
+import { execFile as execFile2 } from "node:child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
+import { connect } from "node:net";
+import { join as join4 } from "node:path";
+function parseListenPorts(configText) {
+  const ports = /* @__PURE__ */ new Set();
+  for (const m of configText.matchAll(/"listen_port"\s*:\s*([0-9]+)/g)) {
+    const port = Number(m[1]);
+    if (port < 1 || port > 65535)
+      throw new Error(`Invalid listen_port in config.json: ${m[1]}`);
+    ports.add(port);
+  }
+  if (!ports.size) throw new Error("config.json has no listen_port.");
+  return [...ports];
+}
+function secretValues(envText) {
+  return [...envText.matchAll(/^(?:REALITY_PRIVATE_KEY|SS_PASSWORD|VLESS_UUID|ISP_SOCKS_USER|ISP_SOCKS_PASS)=([^\r\n]*)\r?$/gm)].map((m) => envUnquote(m[1])).filter((value) => value !== null && value !== "");
+}
+function redact(text, secrets) {
+  for (const secret of [...secrets].sort((a, b) => b.length - a.length))
+    text = text.replaceAll(secret, "***");
+  return text;
+}
+function composeImageTag(text) {
+  const m = /^\s*image:\s*ghcr\.io\/sagernet\/sing-box:([^\s#]+)/m.exec(text);
+  if (!m) throw new Error("sing-box image tag not found in compose.yaml.");
+  return m[1];
+}
+function firewallPorts(configText) {
+  const config = JSON.parse(configText);
+  return config.inbounds.flatMap(
+    (i) => i.type === "shadowsocks" ? [`${i.listen_port}/tcp`, `${i.listen_port}/udp`] : [`${i.listen_port}/tcp`]
+  );
+}
+function realStartDeps() {
+  return {
+    run: (file, args) => new Promise((resolve7) => {
+      execFile2(file, args, (error, stdout, stderr) => {
+        const code = error ? typeof error.code === "number" ? error.code : error.code === "ENOENT" ? 127 : 1 : 0;
+        resolve7({ code, stdout, stderr });
+      });
+    }),
+    tcpOpen: (port) => new Promise((resolve7) => {
+      const socket = connect(port, "127.0.0.1");
+      const finish = (open) => {
+        socket.destroy();
+        resolve7(open);
+      };
+      socket.setTimeout(500, () => finish(false));
+      socket.once("connect", () => finish(true));
+      socket.once("error", () => finish(false));
+    }),
+    sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
+  };
+}
+async function startNode(opts) {
+  const { project, deps } = opts;
+  if (!existsSync6(join4(project, "compose.yaml")))
+    throw new Error("compose.yaml does not exist.");
+  if (!existsSync6(join4(project, "config.json")))
+    throw new Error("config.json does not exist. Run my-singbox gen-config first.");
+  const ports = parseListenPorts(readFileSync6(join4(project, "config.json"), "utf8"));
+  if (!await opts.dockerAvailable()) throw new Error("docker is not installed.");
+  if ((await deps.run("docker", ["compose", "version"])).code)
+    throw new Error("docker compose is not available.");
+  if (!await opts.dockerDaemonUp()) throw new Error("Docker daemon is not running.");
+  const envPath = join4(project, ".env");
+  const secrets = secretValues(existsSync6(envPath) ? readFileSync6(envPath, "utf8") : "");
+  const compose = (...args) => deps.run("docker", ["compose", "--project-directory", project, ...args]);
+  const forward = (output) => {
+    opts.stdout(redact(output.stdout, secrets));
+    opts.stderr(redact(output.stderr, secrets));
+  };
+  const fail = async (message) => {
+    const logs = await compose("logs", "--tail", "50", "sing-box");
+    opts.stderr(redact(logs.stdout, secrets));
+    opts.stderr(redact(logs.stderr, secrets));
+    throw new Error(redact(message, secrets));
+  };
+  const status = async () => {
+    const output = await deps.run("docker", ["inspect", "-f", "{{.State.Status}}", "sing-box"]);
+    return output.code ? "missing" : output.stdout.trim();
+  };
+  opts.stdout("Starting sing-box...\n");
+  const up = await compose("up", "-d");
+  forward(up);
+  if (up.code) throw new Error("docker compose up failed.");
+  let state = "missing";
+  for (let i = 0; i < 15; i++) {
+    state = await status();
+    if (state === "running") break;
+    await deps.sleep(1e3);
+  }
+  if (state !== "running") await fail(`sing-box did not stay running (status: ${state}).`);
+  const check = await compose("exec", "-T", "sing-box", "sing-box", "check", "-c", "/etc/sing-box/config.json");
+  forward(check);
+  if (check.code) await fail("sing-box config check failed.");
+  for (const port of ports) {
+    let open = false;
+    for (let i = 0; i < 10; i++) {
+      open = await deps.tcpOpen(port);
+      if (open) break;
+      await deps.sleep(1e3);
+    }
+    if (!open) await fail(`Port ${port} is not accepting connections.`);
+  }
+  if (ports.includes(8388)) {
+    let listening = false;
+    for (let i = 0; i < 10; i++) {
+      const udp = await deps.run("ss", ["-uln"]);
+      if (udp.code === 127) {
+        opts.stderr("Warning: ss is not installed. Skipping UDP listener check for port 8388.\n");
+        listening = true;
+        break;
+      }
+      if (udp.code === 0 && /:8388\s/.test(udp.stdout)) {
+        const owners = await deps.run("ss", ["-ulnp"]);
+        const lines2 = owners.stdout.split("\n").filter((l) => /:8388\s/.test(l)).join("\n");
+        if (lines2.includes("users:") && !lines2.includes("sing-box"))
+          await fail("UDP port 8388 is not owned by sing-box.");
+        listening = true;
+        break;
+      }
+      await deps.sleep(1e3);
+    }
+    if (!listening) await fail("UDP port 8388 is not listening.");
+  }
+  state = await status();
+  if (state !== "running") await fail(`sing-box did not stay running (status: ${state}).`);
+  opts.stdout(`Self-check passed. Ports: ${ports.join(" ")}
+`);
+}
+
+// src/core/isp-service.ts
 var container = "sing-box";
 var containerConfig = "/etc/sing-box/config.json";
 var IspService = class {
@@ -8575,22 +8656,7 @@ var IspService = class {
     }
     return false;
   }
-  async portsFree() {
-    const probe = await this.command("ss", ["-H", "-ltn"]);
-    if (probe.missing) {
-      this.warn(`ss is not installed. Skipping the check that ports ${SS_ISP_PORT} and ${VLESS_ISP_PORT} are free.`);
-      return;
-    }
-    for (const [proto, port] of [
-      ["tcp", SS_ISP_PORT],
-      ["udp", SS_ISP_PORT],
-      ["tcp", VLESS_ISP_PORT]
-    ]) {
-      if (await this.portListening(proto, port))
-        throw new IspError(`Port ${port}/${proto} is already in use by another process.`);
-    }
-  }
-  async verifyService(expectIsp) {
+  async verifyService() {
     let status = "missing";
     for (let i = 0; i < 15; i++) {
       status = await this.containerStatus();
@@ -8605,16 +8671,15 @@ var IspService = class {
       this.warn("sing-box config check failed inside the container.");
       return false;
     }
-    for (const port of [SS_PORT, VLESS_PORT, ...expectIsp ? [SS_ISP_PORT, VLESS_ISP_PORT] : []]) {
-      if (!await this.waitListening("tcp", port)) {
-        this.warn(`Port ${port}/tcp is not accepting connections.`);
+    const listeners = firewallPorts(readFileSync7(join5(this.io.projectDir, "config.json"), "utf8"));
+    for (const listener of new Set(listeners)) {
+      const [number, proto] = listener.split("/");
+      const port = Number(number);
+      if (!await this.waitListening(proto, port)) {
+        this.warn(`Port ${port}/${proto} is not listening.`);
         return false;
       }
     }
-    if (expectIsp && !await this.waitListening("udp", SS_ISP_PORT)) {
-      this.warn(`Port ${SS_ISP_PORT}/udp is not listening.`);
-      return false;
-    }
     return true;
   }
   async socksEgressIp(isp) {
@@ -8667,11 +8732,11 @@ async function ispOutbound(io, opts) {
   const warn = (message) => io.stderr(`Warning: ${message}
 `);
   const info = (message) => io.stdout(message + "\n");
-  const path = (name) => join4(projectDir, name);
-  const isFile = (file) => existsSync6(file) && statSync2(file).isFile();
+  const path = (name) => join6(projectDir, name);
+  const isFile = (file) => existsSync7(file) && statSync2(file).isFile();
   const tempFiles = [];
   let backupDir;
-  let rollbackArmed = false;
+  let rollbackArmed = false, rollbackNeedsRestart = false;
   let action = opts.action;
   const handlers = ["SIGINT", "SIGTERM", "SIGHUP"].map((signal, i) => {
     const handler = () => {
@@ -8704,7 +8769,7 @@ async function ispOutbound(io, opts) {
   };
   const confirmRestart = async () => {
     if (opts.yes) return;
-    info("This restarts sing-box. Connections on 8388 and 8443 drop for a few seconds.");
+    info("This restarts sing-box. Connections on its configured ports drop for a few seconds.");
     if (!["y", "Y"].includes(await ask("Continue? [y/N] ")))
       throw new IspError("Aborted. Nothing was changed.");
   };
@@ -8722,7 +8787,7 @@ async function ispOutbound(io, opts) {
   const preflightConfig = () => {
     if (!isFile(path("config.json")))
       throw new IspError("config.json does not exist. Run my-singbox gen-config first.");
-    const text = readFileSync6(path("config.json"), "utf8");
+    const text = readFileSync8(path("config.json"), "utf8");
     let config;
     try {
       config = JSON.parse(text);
@@ -8732,31 +8797,59 @@ async function ispOutbound(io, opts) {
     checkIspConfig(config);
     return { text, config };
   };
-  const saveBackup = () => {
-    backupDir = makeBackup(projectDir);
-    info(`Backup saved in ${backupDir}`);
-  };
   const rollback = async () => {
     rollbackArmed = false;
     warn("Rolling back to the previous configuration...");
-    restoreBackup(projectDir, backupDir);
-    const previous = new IspService(serviceIO);
-    if (!await previous.recreate()) {
-      await previous.showLogs();
-      throw new IspError(`Rollback failed to restart sing-box. Previous files are restored from ${backupDir}; run: docker compose up -d --force-recreate`);
+    restoreBackup(projectDir, backupDir, MANAGED_FILES);
+    if (rollbackNeedsRestart) {
+      const previous = new IspService(serviceIO);
+      if (!await previous.recreate()) {
+        await previous.showLogs();
+        throw new IspError(`Rollback failed to restart sing-box. Previous files are restored from ${backupDir}; run: docker compose up -d --force-recreate`);
+      }
+      if (!await previous.verifyService()) {
+        await previous.showLogs();
+        throw new IspError("Rollback restored the files, but sing-box is not healthy. Check: docker compose logs sing-box");
+      }
+    }
+    io.stderr("Rollback complete. Previous server files are restored.\n");
+  };
+  const apply = async (image, original, config, envText, envCandidate) => {
+    const changed = !isDeepStrictEqual(config, original.config);
+    const envChanged = envCandidate !== envText;
+    const configText = changed ? JSON.stringify(config, null, 2) + "\n" : original.text;
+    if (changed) {
+      await validateCandidate(image, candidate(configText));
+      await confirmRestart();
     }
-    if (!await previous.verifyService(false)) {
-      await previous.showLogs();
-      throw new IspError("Rollback restored the files, but sing-box is not healthy. Check: docker compose logs sing-box");
+    if (!changed && !envChanged) return false;
+    backupDir = makeBackup(projectDir, MANAGED_FILES);
+    info(`Backup saved in ${backupDir}`);
+    rollbackArmed = true;
+    controller.signal.throwIfAborted();
+    if (changed) {
+      rollbackNeedsRestart = true;
+      installFile(path("config.json"), configText, projectDir);
     }
-    io.stderr("Rollback complete. sing-box is running the previous configuration.\n");
+    if (envChanged) installFile(path(".env"), envCandidate, projectDir);
+    controller.signal.throwIfAborted();
+    if (changed && !await service.recreate() || !await service.verifyService()) {
+      await service.showLogs();
+      throw new IspError("sing-box did not come up after the ISP change.");
+    }
+    controller.signal.throwIfAborted();
+    rollbackArmed = false;
+    const remainingTags = new Set(config.inbounds.map((inbound) => inbound.tag));
+    const retiredPorts = original.config.inbounds.filter((inbound) => !remainingTags.has(inbound.tag)).map((inbound) => inbound.listen_port);
+    if (retiredPorts.length)
+      info(`Regenerate the client clash.yaml; legacy ISP ports ${retiredPorts.join("/")} can now be closed.`);
+    return true;
   };
   const add = async (image) => {
     const original = preflightConfig();
     if (!isFile(path(".env")))
       throw new IspError(".env does not exist. Run my-singbox gen-keys first.");
-    if (!configHasIsp(original.config)) await service.portsFree();
-    const envText = readFileSync6(path(".env"), "utf8");
+    const envText = readFileSync8(path(".env"), "utf8");
     const isp = await collectInputs(envText, ask);
     info("Checking the SOCKS5 proxy (TCP) and its egress IP...");
     const got = await service.socksEgressIp(isp);
@@ -8766,103 +8859,38 @@ async function ispOutbound(io, opts) {
     if (got.toLowerCase() !== expected.toLowerCase())
       throw new IspError(`Egress IP through the proxy is ${got}, expected ${expected}. If the ISP's egress differs from its entry IP, enter the egress IP when asked. Nothing was changed.`);
     info(`Egress IP through the SOCKS5 proxy: ${got} (matches).`);
-    const envCandidate = envWithIsp(envText, { ...isp, egressIp: isp.egressIp ?? "" });
-    candidate(envCandidate);
-    const config = addIspToConfig(original.config, isp);
-    const configText = isDeepStrictEqual2(config, original.config) ? original.text : JSON.stringify(config, null, 2) + "\n";
-    const cfgCandidate = candidate(configText);
-    await validateCandidate(image, cfgCandidate);
-    let clashText, clashCandidate;
-    let clashState;
-    if (isFile(path("clash.yaml"))) {
-      clashText = readFileSync6(path("clash.yaml"), "utf8");
-      clashCandidate = addIspToClash(clashText, envGet(envText, "REALITY_PRIVATE_KEY"));
-      candidate(clashCandidate);
-      clashState = `clash.yaml updated (nodes ${NODE_SS_ISP} and ${NODE_VLESS_ISP} added and listed in the ${GROUP_MAIN} group).`;
-    } else {
-      warn("clash.yaml does not exist, so only the server config is changed. After running my-singbox conf-clash, re-run my-singbox isp-outbound --add to add the client nodes.");
-      clashState = "clash.yaml not found (skipped).";
-    }
-    const changed = configText !== original.text;
-    const envChanged = envCandidate !== envText;
-    const clashChanged = clashCandidate !== clashText;
-    if (changed) await confirmRestart();
-    if (changed || envChanged || clashChanged) saveBackup();
-    if (changed) {
-      rollbackArmed = true;
-      installFile(path("config.json"), configText, projectDir);
-      if (!await service.recreate() || !await service.verifyService(true)) {
-        await service.showLogs();
-        await rollback();
-        throw new IspError("The ISP outbound did not come up. The previous configuration was restored.");
-      }
-      rollbackArmed = false;
-    } else {
+    const hasIspPolicy = original.config.route?.final === OUT_TAG || original.config.route?.rules?.some((rule) => isIspRule(rule) && !isLegacyIspRule(rule));
+    const routeDefaults = hasIspPolicy ? void 0 : loadSingboxTemplate(projectDir).route;
+    const config = addIspToConfig(original.config, isp, routeDefaults);
+    const changed = await apply(
+      image,
+      original,
+      config,
+      envText,
+      envWithIsp(envText, { ...isp, egressIp: isp.egressIp ?? "" })
+    );
+    if (!changed) {
       info("config.json already has this ISP outbound.");
-      if (!await service.verifyService(true)) {
-        warn("sing-box is not running the ISP configuration. Restarting it once...");
+      if (!await service.verifyService()) {
+        warn("sing-box is not healthy. Restarting it once...");
         await confirmRestart();
-        if (!await service.recreate() || !await service.verifyService(true)) {
+        if (!await service.recreate() || !await service.verifyService()) {
           await service.showLogs();
-          throw new IspError("sing-box still does not run the ISP outbound after a restart. config.json, .env and clash.yaml were not changed. Check: docker compose logs sing-box");
+          throw new IspError("sing-box is still not healthy after a restart. Server files were not changed.");
         }
       }
     }
-    if (envChanged) installFile(path(".env"), envCandidate, projectDir);
-    if (clashChanged) installFile(path("clash.yaml"), clashCandidate, projectDir);
-    info(`
-ISP outbound is active.
-  shadowsocks-isp    port ${SS_ISP_PORT} (tcp+udp), tag ${SS_ISP_TAG}
-  vless-reality-isp  port ${VLESS_ISP_PORT} (tcp),    tag ${VLESS_ISP_TAG}
-  ${clashState}
-  Ports ${SS_PORT} and ${VLESS_PORT} are unchanged and still go out directly.
-Notes:
-  - Only TCP was tested. UDP through the ISP (Shadowsocks UDP) works only if the proxy supports SOCKS5 UDP ASSOCIATE.
-  - If the ISP proxy stops working, the ISP nodes fail. They never fall back to a direct connection.
-  - Re-import clash.yaml in your clients to see the new ${NODE_SS_ISP} and ${NODE_VLESS_ISP} nodes in the ${GROUP_MAIN} group.`);
-    portNotice(io, "add");
+    info("\nISP outbound is configured. config.json route rules decide which traffic uses isp-socks.");
+    info(`Server route.final: ${config.route?.final ?? "direct"}. Existing rule order is preserved; check for earlier matching rules when customizing routing.`);
+    info("Only TCP through the SOCKS5 proxy was tested; actual domain routing and UDP require separate verification.");
   };
   const remove = async (image) => {
     const original = preflightConfig();
-    const envText = isFile(path(".env")) ? readFileSync6(path(".env"), "utf8") : "";
-    const clashText = isFile(path("clash.yaml")) ? readFileSync6(path("clash.yaml"), "utf8") : "";
-    if (!configHasIsp(original.config) && !envHasIsp(envText) && !clashHasIsp(clashText)) {
-      info("\nNo ISP outbound was configured. Nothing to remove.");
-      portNotice(io, "remove");
-      return;
-    }
-    const cleanBackup = findCleanBackup(projectDir);
-    if (!cleanBackup)
-      throw new IspError("No backup from before the ISP outbound was added was found in .isp-backup. Nothing was changed.");
-    const staged = makeTmpPath(projectDir);
-    tempFiles.push(staged);
-    mkdirSync2(staged, { mode: 448 });
-    restoreBackup(staged, cleanBackup);
-    const changed = (name) => isFile(join4(staged, name)) && (!isFile(path(name)) || !readFileSync6(join4(staged, name)).equals(readFileSync6(path(name))));
-    const cfgChanged = changed("config.json");
-    const envChanged = changed(".env");
-    const clashChanged = changed("clash.yaml");
-    if (cfgChanged) {
-      await validateCandidate(image, candidate(readFileSync6(join4(staged, "config.json"))));
-      await confirmRestart();
-    }
-    if (cfgChanged || envChanged || clashChanged) {
-      saveBackup();
-      rollbackArmed = true;
-      restoreBackup(projectDir, staged);
-      if (cfgChanged && (!await service.recreate() || !await service.verifyService(false))) {
-        await service.showLogs();
-        await rollback();
-        throw new IspError("sing-box did not come up after removing the ISP outbound. The previous configuration was restored.");
-      }
-      rollbackArmed = false;
-    }
-    info("\nISP outbound removed.");
-    info(`  Restored files from ${cleanBackup}`);
-    if (cfgChanged) info("  config.json: ISP inbounds, outbound and route rule removed; sing-box restarted.");
-    if (envChanged) info("  .env: ISP_SOCKS_* keys removed.");
-    if (clashChanged) info(`  clash.yaml: ISP nodes removed from the nodes list and the ${GROUP_MAIN} group. Re-import it in your clients.`);
-    portNotice(io, "remove");
+    const envText = isFile(path(".env")) ? readFileSync8(path(".env"), "utf8") : "";
+    const config = removeIspFromConfig(original.config);
+    const changed = await apply(image, original, config, envText, envWithoutIsp(envText));
+    info(changed ? `
+ISP outbound and its targeted rules removed. Other server settings are preserved; route.final: ${config.route?.final ?? "direct"}.` : "\nNo ISP outbound was configured. Nothing to remove.");
   };
   try {
     if (!await service.composeAvailable()) throw new IspError("docker compose is not available.");
@@ -8884,7 +8912,7 @@ Do one of these, then re-run:
     }
     for (const name of MANAGED_FILES) {
       const file = path(name);
-      if (!existsSync6(file)) continue;
+      if (!existsSync7(file)) continue;
       try {
         accessSync(file, constants.R_OK | constants.W_OK);
       } catch {
@@ -8923,8 +8951,7 @@ Do one of these, then re-run:
       }
     });
   } catch (error) {
-    if (controller.signal.aborted)
-      return controller.signal.reason.code;
+    if (controller.signal.aborted) return controller.signal.reason.code;
     throw error;
   } finally {
     for (const { signal, handler } of handlers) process.removeListener(signal, handler);
@@ -8948,205 +8975,14 @@ async function collectInputs(text, ask) {
   if (!validCred(pass)) throw new IspError("Invalid password: it must be 1-255 bytes with no control characters, and valid UTF-8.");
   let egressIp = (await ask(currentEgress ? `Expected egress IP, if it differs from the entry IP [${currentEgress}; '-' resets to ${address.host}]: ` : `Expected egress IP, if it differs from the entry IP (Enter = the entry IP ${address.host}): `)).trim();
   if (currentEgress) egressIp = egressIp === "-" ? "" : egressIp || currentEgress;
-  if (egressIp && !isIpv4(egressIp) && !isIpv6Strict(egressIp))
-    throw new IspError("Invalid expected egress IP.");
+  if (egressIp && !isIpv4(egressIp) && !isIpv6Strict(egressIp)) throw new IspError("Invalid expected egress IP.");
   return { ...address, user, pass, egressIp };
 }
-function portNotice(io, action) {
-  io.stdout("\n" + (action === "add" ? ADD_PORT_NOTICE : REMOVE_PORT_NOTICE));
-}
-var ADD_PORT_NOTICE = `ACTION REQUIRED: allow these ports yourself. This script does not open any port.
-  ${SS_ISP_PORT}/tcp  (${SS_ISP_TAG}, Shadowsocks)
-  ${SS_ISP_PORT}/udp  (${SS_ISP_TAG}, Shadowsocks)
-  ${VLESS_ISP_PORT}/tcp  (${VLESS_ISP_TAG}, VLESS Reality)
-Allow them in BOTH places, otherwise the new ports are not reachable from outside:
-  1. the local firewall on this server, if you run one (ufw, firewalld or iptables);
-  2. your cloud provider's security group (or network ACL) for this server.
-Ports ${SS_PORT} and ${VLESS_PORT} are not affected.
-
-Example commands for reference (run as root, use the one for your firewall):
-  ufw (rules are persistent already):
-    ufw allow ${SS_ISP_PORT}/tcp
-    ufw allow ${SS_ISP_PORT}/udp
-    ufw allow ${VLESS_ISP_PORT}/tcp
-  firewalld (use --permanent, then --reload):
-    firewall-cmd --permanent --add-port=${SS_ISP_PORT}/tcp
-    firewall-cmd --permanent --add-port=${SS_ISP_PORT}/udp
-    firewall-cmd --permanent --add-port=${VLESS_ISP_PORT}/tcp
-    firewall-cmd --reload
-  iptables (lost on reboot unless saved; repeat with ip6tables if you filter IPv6):
-    iptables -I INPUT -p tcp --dport ${SS_ISP_PORT} -j ACCEPT
-    iptables -I INPUT -p udp --dport ${SS_ISP_PORT} -j ACCEPT
-    iptables -I INPUT -p tcp --dport ${VLESS_ISP_PORT} -j ACCEPT
-    then save them: netfilter-persistent save
-    or: iptables-save > /etc/iptables/rules.v4
-    (install iptables-persistent first if it is missing: apt-get install -y iptables-persistent;
-     both ways save the whole current iptables ruleset, not only these rules)
-`;
-var REMOVE_PORT_NOTICE = `NOTE: the ISP ports are no longer used, so you can now close them yourself. This script does not close any port.
-  ${SS_ISP_PORT}/tcp
-  ${SS_ISP_PORT}/udp
-  ${VLESS_ISP_PORT}/tcp
-Close them in BOTH places if you opened them:
-  1. the local firewall on this server;
-  2. your cloud provider's security group (or network ACL).
-Closing a rule by port also removes a rule you added yourself for the same port, so check first.
-
-Example commands for reference (run as root, use the one for your firewall):
-  ufw:
-    ufw delete allow ${SS_ISP_PORT}/tcp
-    ufw delete allow ${SS_ISP_PORT}/udp
-    ufw delete allow ${VLESS_ISP_PORT}/tcp
-  firewalld (use --permanent, then --reload):
-    firewall-cmd --permanent --remove-port=${SS_ISP_PORT}/tcp
-    firewall-cmd --permanent --remove-port=${SS_ISP_PORT}/udp
-    firewall-cmd --permanent --remove-port=${VLESS_ISP_PORT}/tcp
-    firewall-cmd --reload
-  iptables (then save the ruleset, as above):
-    iptables -D INPUT -p tcp --dport ${SS_ISP_PORT} -j ACCEPT
-    iptables -D INPUT -p udp --dport ${SS_ISP_PORT} -j ACCEPT
-    iptables -D INPUT -p tcp --dport ${VLESS_ISP_PORT} -j ACCEPT
-    then: netfilter-persistent save   (or: iptables-save > /etc/iptables/rules.v4)
-`;
 
 // src/cli/init.ts
-import { constants as constants2, copyFileSync as copyFileSync2, existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
+import { constants as constants2, copyFileSync as copyFileSync2, existsSync as existsSync8, readFileSync as readFileSync9 } from "node:fs";
 import { resolve as resolve6 } from "node:path";
 
-// src/core/start.ts
-import { execFile as execFile2 } from "node:child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
-import { connect } from "node:net";
-import { join as join5 } from "node:path";
-function parseListenPorts(configText) {
-  const ports = /* @__PURE__ */ new Set();
-  for (const m of configText.matchAll(/"listen_port"\s*:\s*([0-9]+)/g)) {
-    const port = Number(m[1]);
-    if (port < 1 || port > 65535)
-      throw new Error(`Invalid listen_port in config.json: ${m[1]}`);
-    ports.add(port);
-  }
-  if (!ports.size) throw new Error("config.json has no listen_port.");
-  return [...ports];
-}
-function secretValues(envText) {
-  return [...envText.matchAll(/^(?:REALITY_PRIVATE_KEY|SS_PASSWORD|VLESS_UUID|ISP_SOCKS_USER|ISP_SOCKS_PASS)=([^\r\n]*)\r?$/gm)].map((m) => envUnquote(m[1])).filter((value) => value !== null && value !== "");
-}
-function redact(text, secrets) {
-  for (const secret of [...secrets].sort((a, b) => b.length - a.length))
-    text = text.replaceAll(secret, "***");
-  return text;
-}
-function composeImageTag(text) {
-  const m = /^\s*image:\s*ghcr\.io\/sagernet\/sing-box:([^\s#]+)/m.exec(text);
-  if (!m) throw new Error("sing-box image tag not found in compose.yaml.");
-  return m[1];
-}
-function firewallPorts(configText) {
-  const config = JSON.parse(configText);
-  return config.inbounds.flatMap(
-    (i) => i.type === "shadowsocks" ? [`${i.listen_port}/tcp`, `${i.listen_port}/udp`] : [`${i.listen_port}/tcp`]
-  );
-}
-function realStartDeps() {
-  return {
-    run: (file, args) => new Promise((resolve7) => {
-      execFile2(file, args, (error, stdout, stderr) => {
-        const code = error ? typeof error.code === "number" ? error.code : error.code === "ENOENT" ? 127 : 1 : 0;
-        resolve7({ code, stdout, stderr });
-      });
-    }),
-    tcpOpen: (port) => new Promise((resolve7) => {
-      const socket = connect(port, "127.0.0.1");
-      const finish = (open) => {
-        socket.destroy();
-        resolve7(open);
-      };
-      socket.setTimeout(500, () => finish(false));
-      socket.once("connect", () => finish(true));
-      socket.once("error", () => finish(false));
-    }),
-    sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
-  };
-}
-async function startNode(opts) {
-  const { project, deps } = opts;
-  if (!existsSync7(join5(project, "compose.yaml")))
-    throw new Error("compose.yaml does not exist.");
-  if (!existsSync7(join5(project, "config.json")))
-    throw new Error("config.json does not exist. Run my-singbox gen-config first.");
-  const ports = parseListenPorts(readFileSync7(join5(project, "config.json"), "utf8"));
-  if (!await opts.dockerAvailable()) throw new Error("docker is not installed.");
-  if ((await deps.run("docker", ["compose", "version"])).code)
-    throw new Error("docker compose is not available.");
-  if (!await opts.dockerDaemonUp()) throw new Error("Docker daemon is not running.");
-  const envPath = join5(project, ".env");
-  const secrets = secretValues(existsSync7(envPath) ? readFileSync7(envPath, "utf8") : "");
-  const compose = (...args) => deps.run("docker", ["compose", "--project-directory", project, ...args]);
-  const forward = (output) => {
-    opts.stdout(redact(output.stdout, secrets));
-    opts.stderr(redact(output.stderr, secrets));
-  };
-  const fail = async (message) => {
-    const logs = await compose("logs", "--tail", "50", "sing-box");
-    opts.stderr(redact(logs.stdout, secrets));
-    opts.stderr(redact(logs.stderr, secrets));
-    throw new Error(redact(message, secrets));
-  };
-  const status = async () => {
-    const output = await deps.run("docker", ["inspect", "-f", "{{.State.Status}}", "sing-box"]);
-    return output.code ? "missing" : output.stdout.trim();
-  };
-  opts.stdout("Starting sing-box...\n");
-  const up = await compose("up", "-d");
-  forward(up);
-  if (up.code) throw new Error("docker compose up failed.");
-  let state = "missing";
-  for (let i = 0; i < 15; i++) {
-    state = await status();
-    if (state === "running") break;
-    await deps.sleep(1e3);
-  }
-  if (state !== "running") await fail(`sing-box did not stay running (status: ${state}).`);
-  const check = await compose("exec", "-T", "sing-box", "sing-box", "check", "-c", "/etc/sing-box/config.json");
-  forward(check);
-  if (check.code) await fail("sing-box config check failed.");
-  for (const port of ports) {
-    let open = false;
-    for (let i = 0; i < 10; i++) {
-      open = await deps.tcpOpen(port);
-      if (open) break;
-      await deps.sleep(1e3);
-    }
-    if (!open) await fail(`Port ${port} is not accepting connections.`);
-  }
-  if (ports.includes(8388)) {
-    let listening = false;
-    for (let i = 0; i < 10; i++) {
-      const udp = await deps.run("ss", ["-uln"]);
-      if (udp.code === 127) {
-        opts.stderr("Warning: ss is not installed. Skipping UDP listener check for port 8388.\n");
-        listening = true;
-        break;
-      }
-      if (udp.code === 0 && /:8388\s/.test(udp.stdout)) {
-        const owners = await deps.run("ss", ["-ulnp"]);
-        const lines2 = owners.stdout.split("\n").filter((l) => /:8388\s/.test(l)).join("\n");
-        if (lines2.includes("users:") && !lines2.includes("sing-box"))
-          await fail("UDP port 8388 is not owned by sing-box.");
-        listening = true;
-        break;
-      }
-      await deps.sleep(1e3);
-    }
-    if (!listening) await fail("UDP port 8388 is not listening.");
-  }
-  state = await status();
-  if (state !== "running") await fail(`sing-box did not stay running (status: ${state}).`);
-  opts.stdout(`Self-check passed. Ports: ${ports.join(" ")}
-`);
-}
-
 // src/cli/start.ts
 import { resolve as resolve5 } from "node:path";
 async function start(io) {
@@ -9173,7 +9009,7 @@ async function init(io) {
   const compose = resolve6(project, "compose.yaml");
   const source = existsSync8(compose) ? compose : findPackageFile("compose.yaml");
   const env = io.env ?? process.env;
-  const version = env.SING_BOX_VERSION || composeImageTag(readFileSync8(source, "utf8"));
+  const version = env.SING_BOX_VERSION || composeImageTag(readFileSync9(source, "utf8"));
   if (!existsSync8(compose)) {
     copyFileSync2(source, compose, constants2.COPYFILE_EXCL);
     io.stdout("Wrote compose.yaml\n");
@@ -9194,7 +9030,7 @@ async function init(io) {
   }
   const code = await start(io);
   if (code) return code;
-  const ports = firewallPorts(readFileSync8(resolve6(project, "config.json"), "utf8"));
+  const ports = firewallPorts(readFileSync9(resolve6(project, "config.json"), "utf8"));
   io.stdout(`Open these ports in the server firewall and the cloud security group (this tool never changes them):
 ${ports.map((p) => `  ${p}
 `).join("")}`);
@@ -9220,8 +9056,8 @@ Options: --help, -h
 `;
 var ispUsage = `Usage: my-singbox isp-outbound [--add | --remove] [--yes]
 
-  --add      add or update the ISP outbound (ports 13839 and 18444)
-  --remove   remove the ISP outbound and everything it added
+  --add      add or update the server ISP outbound and route policy
+  --remove   remove the ISP outbound and its targeted server rules
   --yes, -y  do not ask before restarting sing-box
   --help     show this help