my-singbox 2.0.0 → 3.0.0

package/dist/index.js

@@ -48,10 +48,10 @@ var require_identity = __commonJS({
     var NODE_TYPE = /* @__PURE__ */ Symbol.for("yaml.node.type");
     var isAlias = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === ALIAS;
     var isDocument = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === DOC;
-    var isMap3 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
+    var isMap2 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
     var isPair = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === PAIR;
-    var isScalar3 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
-    var isSeq3 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
+    var isScalar2 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
+    var isSeq2 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
     function isCollection(node) {
       if (node && typeof node === "object")
         switch (node[NODE_TYPE]) {
@@ -72,7 +72,7 @@ var require_identity = __commonJS({
         }
       return false;
     }
-    var hasAnchor = (node) => (isScalar3(node) || isCollection(node)) && !!node.anchor;
+    var hasAnchor = (node) => (isScalar2(node) || isCollection(node)) && !!node.anchor;
     exports.ALIAS = ALIAS;
     exports.DOC = DOC;
     exports.MAP = MAP;
@@ -84,11 +84,11 @@ var require_identity = __commonJS({
     exports.isAlias = isAlias;
     exports.isCollection = isCollection;
     exports.isDocument = isDocument;
-    exports.isMap = isMap3;
+    exports.isMap = isMap2;
     exports.isNode = isNode;
     exports.isPair = isPair;
-    exports.isScalar = isScalar3;
-    exports.isSeq = isSeq3;
+    exports.isScalar = isScalar2;
+    exports.isSeq = isSeq2;
   }
 });
 
@@ -100,7 +100,7 @@ var require_visit = __commonJS({
     var BREAK = /* @__PURE__ */ Symbol("break visit");
     var SKIP = /* @__PURE__ */ Symbol("skip children");
     var REMOVE = /* @__PURE__ */ Symbol("remove node");
-    function visit3(node, visitor) {
+    function visit2(node, visitor) {
       const visitor_ = initVisitor(visitor);
       if (identity.isDocument(node)) {
         const cd = visit_(null, node.contents, visitor_, Object.freeze([node]));
@@ -109,9 +109,9 @@ var require_visit = __commonJS({
       } else
         visit_(null, node, visitor_, Object.freeze([]));
     }
-    visit3.BREAK = BREAK;
-    visit3.SKIP = SKIP;
-    visit3.REMOVE = REMOVE;
+    visit2.BREAK = BREAK;
+    visit2.SKIP = SKIP;
+    visit2.REMOVE = REMOVE;
     function visit_(key, node, visitor, path) {
       const ctrl = callVisitor(key, node, visitor, path);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
@@ -245,7 +245,7 @@ var require_visit = __commonJS({
         throw new Error(`Cannot replace node with ${pt} parent`);
       }
     }
-    exports.visit = visit3;
+    exports.visit = visit2;
     exports.visitAsync = visitAsync;
   }
 });
@@ -255,7 +255,7 @@ var require_directives = __commonJS({
   "node_modules/yaml/dist/doc/directives.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var visit3 = require_visit();
+    var visit2 = require_visit();
     var escapeChars = {
       "!": "%21",
       ",": "%2C",
@@ -399,7 +399,7 @@ var require_directives = __commonJS({
         let tagNames;
         if (doc && tagEntries.length > 0 && identity.isNode(doc.contents)) {
           const tags = {};
-          visit3.visit(doc.contents, (_key, node) => {
+          visit2.visit(doc.contents, (_key, node) => {
             if (identity.isNode(node) && node.tag)
               tags[node.tag] = true;
           });
@@ -426,7 +426,7 @@ var require_anchors = __commonJS({
   "node_modules/yaml/dist/doc/anchors.js"(exports) {
     "use strict";
     var identity = require_identity();
-    var visit3 = require_visit();
+    var visit2 = require_visit();
     function anchorIsValid(anchor) {
       if (/[\x00-\x19\s,[\]{}]/.test(anchor)) {
         const sa = JSON.stringify(anchor);
@@ -437,7 +437,7 @@ var require_anchors = __commonJS({
     }
     function anchorNames(root) {
       const anchors = /* @__PURE__ */ new Set();
-      visit3.visit(root, {
+      visit2.visit(root, {
         Value(_key, node) {
           if (node.anchor)
             anchors.add(node.anchor);
@@ -617,7 +617,7 @@ var require_Alias = __commonJS({
   "node_modules/yaml/dist/nodes/Alias.js"(exports) {
     "use strict";
     var anchors = require_anchors();
-    var visit3 = require_visit();
+    var visit2 = require_visit();
     var identity = require_identity();
     var Node = require_Node();
     var toJS = require_toJS();
@@ -643,7 +643,7 @@ var require_Alias = __commonJS({
           nodes = ctx.aliasResolveCache;
         } else {
           nodes = [];
-          visit3.visit(doc, {
+          visit2.visit(doc, {
             Node: (_key, node) => {
               if (identity.isAlias(node) || identity.hasAnchor(node))
                 nodes.push(node);
@@ -4196,9 +4196,9 @@ var require_resolve_flow_collection = __commonJS({
     var blockMsg = "Block collections are not allowed within flow collections";
     var isBlock = (token) => token && (token.type === "block-map" || token.type === "block-seq");
     function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onError, tag) {
-      const isMap3 = fc.start.source === "{";
-      const fcName = isMap3 ? "flow map" : "flow sequence";
-      const NodeClass = tag?.nodeClass ?? (isMap3 ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
+      const isMap2 = fc.start.source === "{";
+      const fcName = isMap2 ? "flow map" : "flow sequence";
+      const NodeClass = tag?.nodeClass ?? (isMap2 ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
       const coll = new NodeClass(ctx.schema);
       coll.flow = true;
       const atRoot = ctx.atRoot;
@@ -4234,7 +4234,7 @@ var require_resolve_flow_collection = __commonJS({
             offset = props.end;
             continue;
           }
-          if (!isMap3 && ctx.options.strict && utilContainsNewline.containsNewline(key))
+          if (!isMap2 && ctx.options.strict && utilContainsNewline.containsNewline(key))
             onError(
               key,
               // checked by containsNewline()
@@ -4274,7 +4274,7 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap3 && !sep && !props.found) {
+        if (!isMap2 && !sep && !props.found) {
           const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
@@ -4297,7 +4297,7 @@ var require_resolve_flow_collection = __commonJS({
             startOnNewline: false
           });
           if (valueProps.found) {
-            if (!isMap3 && !props.found && ctx.options.strict) {
+            if (!isMap2 && !props.found && ctx.options.strict) {
               if (sep)
                 for (const st of sep) {
                   if (st === valueProps.found)
@@ -4329,7 +4329,7 @@ var require_resolve_flow_collection = __commonJS({
           const pair = new Pair.Pair(keyNode, valueNode);
           if (ctx.options.keepSourceTokens)
             pair.srcToken = collItem;
-          if (isMap3) {
+          if (isMap2) {
             const map = coll;
             if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
               onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
@@ -4345,7 +4345,7 @@ var require_resolve_flow_collection = __commonJS({
           offset = valueNode ? valueNode.range[2] : valueProps.end;
         }
       }
-      const expectedEnd = isMap3 ? "}" : "]";
+      const expectedEnd = isMap2 ? "}" : "]";
       const [ce, ...ee] = fc.end;
       let cePos = offset;
       if (ce?.source === expectedEnd)
@@ -5565,15 +5565,15 @@ var require_cst_visit = __commonJS({
     var BREAK = /* @__PURE__ */ Symbol("break visit");
     var SKIP = /* @__PURE__ */ Symbol("skip children");
     var REMOVE = /* @__PURE__ */ Symbol("remove item");
-    function visit3(cst, visitor) {
+    function visit2(cst, visitor) {
       if ("type" in cst && cst.type === "document")
         cst = { start: cst.start, value: cst.value };
       _visit(Object.freeze([]), cst, visitor);
     }
-    visit3.BREAK = BREAK;
-    visit3.SKIP = SKIP;
-    visit3.REMOVE = REMOVE;
-    visit3.itemAtPath = (cst, path) => {
+    visit2.BREAK = BREAK;
+    visit2.SKIP = SKIP;
+    visit2.REMOVE = REMOVE;
+    visit2.itemAtPath = (cst, path) => {
       let item = cst;
       for (const [field, index] of path) {
         const tok = item?.[field];
@@ -5584,8 +5584,8 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit3.parentCollection = (cst, path) => {
-      const parent = visit3.itemAtPath(cst, path.slice(0, -1));
+    visit2.parentCollection = (cst, path) => {
+      const parent = visit2.itemAtPath(cst, path.slice(0, -1));
       const field = path[path.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
@@ -5616,7 +5616,7 @@ var require_cst_visit = __commonJS({
       }
       return typeof ctrl === "function" ? ctrl(item, path) : ctrl;
     }
-    exports.visit = visit3;
+    exports.visit = visit2;
   }
 });
 
@@ -5632,7 +5632,7 @@ var require_cst = __commonJS({
     var FLOW_END = "";
     var SCALAR = "";
     var isCollection = (token) => !!token && "items" in token;
-    var isScalar3 = (token) => !!token && (token.type === "scalar" || token.type === "single-quoted-scalar" || token.type === "double-quoted-scalar" || token.type === "block-scalar");
+    var isScalar2 = (token) => !!token && (token.type === "scalar" || token.type === "single-quoted-scalar" || token.type === "double-quoted-scalar" || token.type === "block-scalar");
     function prettyToken(token) {
       switch (token) {
         case BOM:
@@ -5716,7 +5716,7 @@ var require_cst = __commonJS({
     exports.FLOW_END = FLOW_END;
     exports.SCALAR = SCALAR;
     exports.isCollection = isCollection;
-    exports.isScalar = isScalar3;
+    exports.isScalar = isScalar2;
     exports.prettyToken = prettyToken;
     exports.tokenType = tokenType;
   }
@@ -7246,7 +7246,7 @@ var require_public_api = __commonJS({
         return docs;
       return Object.assign([], { empty: true }, composer$1.streamInfo());
     }
-    function parseDocument3(source, options = {}) {
+    function parseDocument2(source, options = {}) {
       const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
       const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
       const composer$1 = new composer.Composer(options);
@@ -7272,7 +7272,7 @@ var require_public_api = __commonJS({
       } else if (options === void 0 && reviver && typeof reviver === "object") {
         options = reviver;
       }
-      const doc = parseDocument3(src, options);
+      const doc = parseDocument2(src, options);
       if (!doc)
         return null;
       doc.warnings.forEach((warning) => log.warn(doc.options.logLevel, warning));
@@ -7308,7 +7308,7 @@ var require_public_api = __commonJS({
     }
     exports.parse = parse;
     exports.parseAllDocuments = parseAllDocuments;
-    exports.parseDocument = parseDocument3;
+    exports.parseDocument = parseDocument2;
     exports.stringify = stringify;
   }
 });
@@ -7332,7 +7332,7 @@ var require_dist = __commonJS({
     var lineCounter = require_line_counter();
     var parser = require_parser();
     var publicApi = require_public_api();
-    var visit3 = require_visit();
+    var visit2 = require_visit();
     exports.Composer = composer.Composer;
     exports.Document = Document.Document;
     exports.Schema = Schema.Schema;
@@ -7360,8 +7360,8 @@ var require_dist = __commonJS({
     exports.parseAllDocuments = publicApi.parseAllDocuments;
     exports.parseDocument = publicApi.parseDocument;
     exports.stringify = publicApi.stringify;
-    exports.visit = visit3.visit;
-    exports.visitAsync = visit3.visitAsync;
+    exports.visit = visit2.visit;
+    exports.visitAsync = visit2.visitAsync;
   }
 });
 
@@ -7433,7 +7433,7 @@ async function dockerAccessGuidance(s) {
   const already = groups.trim().split(/\s+/).includes("docker");
   return [
     "This tool never uses sudo and never escalates privileges itself.",
-    "Open firewall / cloud security group ports: 8388/tcp, 8388/udp, 8443/tcp; only for optional ISP outbound: 13839/tcp, 13839/udp, 18444/tcp.",
+    "Open firewall / cloud security group ports: 8388/tcp, 8388/udp, 8443/tcp. ISP routing uses the same listening ports.",
     ...already ? [
       "The Docker daemon may not be running, or your session predates the group change. Log out and back in (or run `newgrp docker`)."
     ] : [
@@ -7838,20 +7838,20 @@ function buildModel(env, opts = {}) {
     publicKey,
     shortId: v.REALITY_SHORT_ID
   };
-  const node = (name, protocol, tag, port, egress) => ({
+  const node = (name, protocol, tag, port) => ({
     name,
     protocol,
     inbound: { tag, port },
-    egress,
     creds: protocol === "shadowsocks" ? ss : reality
   });
   const model = {
     server,
     nodes: [
-      node(NODE_SS, "shadowsocks", SS_TAG, SS_PORT, "direct"),
-      node(NODE_VLESS, "vless-reality", VLESS_TAG, VLESS_PORT, "direct")
+      node(NODE_SS, "shadowsocks", SS_TAG, SS_PORT),
+      node(NODE_VLESS, "vless-reality", VLESS_TAG, VLESS_PORT)
     ]
   };
+  if (target === "client") return model;
   const {
     ISP_SOCKS_ADDR: rawAddr = "",
     ISP_SOCKS_USER: rawUser = "",
@@ -7874,16 +7874,6 @@ function buildModel(env, opts = {}) {
     pass,
     ...ip ? { egressIp: ip } : {}
   };
-  model.nodes.push(
-    node(NODE_SS_ISP, "shadowsocks", SS_ISP_TAG, SS_ISP_PORT, "isp-socks"),
-    node(
-      NODE_VLESS_ISP,
-      "vless-reality",
-      VLESS_ISP_TAG,
-      VLESS_ISP_PORT,
-      "isp-socks"
-    )
-  );
   return model;
 }
 
@@ -7916,6 +7906,64 @@ function readTemplate(name, projectDir) {
   return readFileSync2(findTemplate(name, projectDir), "utf8");
 }
 
+// src/core/routing.ts
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isIspRule(value) {
+  return isRecord(value) && value.outbound === OUT_TAG;
+}
+function isLegacyIspRule(value) {
+  if (!isIspRule(value)) return false;
+  const inbound = typeof value.inbound === "string" ? [value.inbound] : value.inbound;
+  return Array.isArray(inbound) && inbound.length > 0 && inbound.every((tag) => tag === SS_ISP_TAG || tag === VLESS_ISP_TAG) && (value.action === void 0 || value.action === "route") && Object.keys(value).every((key) => ["inbound", "outbound", "action"].includes(key));
+}
+function checkNoIspReferences(config) {
+  const referenceKeys = /* @__PURE__ */ new Set(["outbound", "outbounds", "detour", "final", "default"]);
+  const walk = (value, path, key = "") => {
+    if (value === OUT_TAG && referenceKeys.has(key))
+      throw new Error(`Unsupported ISP reference at ${path}. Remove this reference before disabling ISP.`);
+    if (Array.isArray(value))
+      value.forEach((item, i) => walk(item, `${path}[${i}]`, key));
+    else if (isRecord(value))
+      for (const [name, item] of Object.entries(value)) walk(item, `${path}.${name}`, name);
+  };
+  walk(config, "config");
+}
+function upsertIspOutbound(config, isp) {
+  const outbounds = config.outbounds ??= [];
+  const matches = outbounds.filter((o) => o.tag === OUT_TAG);
+  if (matches.length > 1) throw new Error(`Duplicate outbound tag: ${OUT_TAG}.`);
+  const fields = {
+    type: "socks",
+    tag: OUT_TAG,
+    server: isp.host,
+    server_port: isp.port,
+    version: "5",
+    username: isp.user,
+    password: isp.pass
+  };
+  if (matches[0]) {
+    if (matches[0].type !== "socks")
+      throw new Error(`Outbound ${OUT_TAG} must have type socks.`);
+    Object.assign(matches[0], fields);
+  } else outbounds.push(fields);
+}
+function omitIsp(config) {
+  if (config.outbounds) config.outbounds = config.outbounds.filter((o) => o.tag !== OUT_TAG);
+  if (config.route?.rules) config.route.rules = config.route.rules.filter((r) => !isIspRule(r));
+  checkNoIspReferences(config);
+}
+function ensureRoute(config, defaults) {
+  const route = config.route ??= {};
+  const rules = route.rules ??= [];
+  if (!rules.some((r) => isRecord(r) && r.action === "sniff"))
+    rules.unshift({ action: "sniff" });
+  if (!rules.some(isIspRule) && defaults?.rules)
+    rules.push(...structuredClone(defaults.rules.filter(isIspRule)));
+  route.final ??= "direct";
+}
+
 // src/core/render-config.ts
 function renderSingbox(model, template) {
   const ss = model.nodes.find((n) => n.protocol === "shadowsocks").creds;
@@ -7933,7 +7981,7 @@ function renderSingbox(model, template) {
   const prototypes = /* @__PURE__ */ new Map();
   for (const protocol of ["shadowsocks", "vless-reality"]) {
     const base = model.nodes.find(
-      (n) => n.protocol === protocol && n.egress === "direct"
+      (n) => n.protocol === protocol
     );
     const proto = config.inbounds.find(
       (i) => i.type === (protocol === "shadowsocks" ? "shadowsocks" : "vless")
@@ -7947,27 +7995,9 @@ function renderSingbox(model, template) {
     tag: n.inbound.tag,
     listen_port: n.inbound.port
   }));
-  const ispNodes = model.nodes.filter((n) => n.egress === "isp-socks");
-  if (ispNodes.length) {
-    const isp = model.isp;
-    config.outbounds = [
-      ...config.outbounds ?? [],
-      {
-        type: "socks",
-        tag: OUT_TAG,
-        server: isp.host,
-        server_port: isp.port,
-        version: "5",
-        username: isp.user,
-        password: isp.pass
-      }
-    ];
-    config.route ??= {};
-    config.route.rules = [
-      ...config.route.rules ?? [],
-      { inbound: ispNodes.map((n) => n.inbound.tag), outbound: OUT_TAG }
-    ];
-  }
+  ensureRoute(config);
+  if (model.isp) upsertIspOutbound(config, model.isp);
+  else omitIsp(config);
   if (JSON.stringify(config).includes("${"))
     throw new Error("Unresolved placeholder left in config.json.");
   return config;
@@ -8015,11 +8045,9 @@ function renderClash(model, templateText) {
   }
   proxies.items = model.nodes.map((n) => {
     const proto = prototypes.get(n.protocol);
-    if (n.egress === "direct") return proto;
-    const clone = proto.clone();
-    clone.set("name", n.name);
-    clone.set("port", n.inbound.port);
-    return clone;
+    proto.set("name", n.name);
+    proto.set("port", n.inbound.port);
+    return proto;
   });
   const group = groups.items.find((g) => (0, import_yaml.isMap)(g) && g.get("name") === "Proxy");
   const list = (0, import_yaml.isMap)(group) ? group.get("proxies", true) : null;
@@ -8038,19 +8066,154 @@ function renderClash(model, templateText) {
 // src/core/isp-service.ts
 import { spawn } from "node:child_process";
 import { createConnection } from "node:net";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { join as join5 } from "node:path";
+
+// src/core/start.ts
+import { execFile as execFile2 } from "node:child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { connect } from "node:net";
+import { join as join3 } from "node:path";
+function parseListenPorts(configText) {
+  const ports = /* @__PURE__ */ new Set();
+  for (const m of configText.matchAll(/"listen_port"\s*:\s*([0-9]+)/g)) {
+    const port = Number(m[1]);
+    if (port < 1 || port > 65535)
+      throw new Error(`Invalid listen_port in config.json: ${m[1]}`);
+    ports.add(port);
+  }
+  if (!ports.size) throw new Error("config.json has no listen_port.");
+  return [...ports];
+}
+function secretValues(envText) {
+  return [...envText.matchAll(/^(?:REALITY_PRIVATE_KEY|SS_PASSWORD|VLESS_UUID|ISP_SOCKS_USER|ISP_SOCKS_PASS)=([^\r\n]*)\r?$/gm)].map((m) => envUnquote(m[1])).filter((value) => value !== null && value !== "");
+}
+function redact(text, secrets) {
+  for (const secret of [...secrets].sort((a, b) => b.length - a.length))
+    text = text.replaceAll(secret, "***");
+  return text;
+}
+function composeImageTag(text) {
+  const m = /^\s*image:\s*ghcr\.io\/sagernet\/sing-box:([^\s#]+)/m.exec(text);
+  if (!m) throw new Error("sing-box image tag not found in compose.yaml.");
+  return m[1];
+}
+function firewallPorts(configText) {
+  const config = JSON.parse(configText);
+  return config.inbounds.flatMap(
+    (i) => i.type === "shadowsocks" ? [`${i.listen_port}/tcp`, `${i.listen_port}/udp`] : [`${i.listen_port}/tcp`]
+  );
+}
+function realStartDeps() {
+  return {
+    run: (file, args) => new Promise((resolve) => {
+      execFile2(file, args, (error, stdout, stderr) => {
+        const code = error ? typeof error.code === "number" ? error.code : error.code === "ENOENT" ? 127 : 1 : 0;
+        resolve({ code, stdout, stderr });
+      });
+    }),
+    tcpOpen: (port) => new Promise((resolve) => {
+      const socket = connect(port, "127.0.0.1");
+      const finish = (open) => {
+        socket.destroy();
+        resolve(open);
+      };
+      socket.setTimeout(500, () => finish(false));
+      socket.once("connect", () => finish(true));
+      socket.once("error", () => finish(false));
+    }),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+  };
+}
+async function startNode(opts) {
+  const { project, deps } = opts;
+  if (!existsSync2(join3(project, "compose.yaml")))
+    throw new Error("compose.yaml does not exist.");
+  if (!existsSync2(join3(project, "config.json")))
+    throw new Error("config.json does not exist. Run my-singbox gen-config first.");
+  const ports = parseListenPorts(readFileSync3(join3(project, "config.json"), "utf8"));
+  if (!await opts.dockerAvailable()) throw new Error("docker is not installed.");
+  if ((await deps.run("docker", ["compose", "version"])).code)
+    throw new Error("docker compose is not available.");
+  if (!await opts.dockerDaemonUp()) throw new Error("Docker daemon is not running.");
+  const envPath = join3(project, ".env");
+  const secrets = secretValues(existsSync2(envPath) ? readFileSync3(envPath, "utf8") : "");
+  const compose = (...args) => deps.run("docker", ["compose", "--project-directory", project, ...args]);
+  const forward = (output) => {
+    opts.stdout(redact(output.stdout, secrets));
+    opts.stderr(redact(output.stderr, secrets));
+  };
+  const fail = async (message) => {
+    const logs = await compose("logs", "--tail", "50", "sing-box");
+    opts.stderr(redact(logs.stdout, secrets));
+    opts.stderr(redact(logs.stderr, secrets));
+    throw new Error(redact(message, secrets));
+  };
+  const status = async () => {
+    const output = await deps.run("docker", ["inspect", "-f", "{{.State.Status}}", "sing-box"]);
+    return output.code ? "missing" : output.stdout.trim();
+  };
+  opts.stdout("Starting sing-box...\n");
+  const up = await compose("up", "-d");
+  forward(up);
+  if (up.code) throw new Error("docker compose up failed.");
+  let state = "missing";
+  for (let i = 0; i < 15; i++) {
+    state = await status();
+    if (state === "running") break;
+    await deps.sleep(1e3);
+  }
+  if (state !== "running") await fail(`sing-box did not stay running (status: ${state}).`);
+  const check = await compose("exec", "-T", "sing-box", "sing-box", "check", "-c", "/etc/sing-box/config.json");
+  forward(check);
+  if (check.code) await fail("sing-box config check failed.");
+  for (const port of ports) {
+    let open = false;
+    for (let i = 0; i < 10; i++) {
+      open = await deps.tcpOpen(port);
+      if (open) break;
+      await deps.sleep(1e3);
+    }
+    if (!open) await fail(`Port ${port} is not accepting connections.`);
+  }
+  if (ports.includes(8388)) {
+    let listening = false;
+    for (let i = 0; i < 10; i++) {
+      const udp = await deps.run("ss", ["-uln"]);
+      if (udp.code === 127) {
+        opts.stderr("Warning: ss is not installed. Skipping UDP listener check for port 8388.\n");
+        listening = true;
+        break;
+      }
+      if (udp.code === 0 && /:8388\s/.test(udp.stdout)) {
+        const owners = await deps.run("ss", ["-ulnp"]);
+        const lines = owners.stdout.split("\n").filter((l) => /:8388\s/.test(l)).join("\n");
+        if (lines.includes("users:") && !lines.includes("sing-box"))
+          await fail("UDP port 8388 is not owned by sing-box.");
+        listening = true;
+        break;
+      }
+      await deps.sleep(1e3);
+    }
+    if (!listening) await fail("UDP port 8388 is not listening.");
+  }
+  state = await status();
+  if (state !== "running") await fail(`sing-box did not stay running (status: ${state}).`);
+  opts.stdout(`Self-check passed. Ports: ${ports.join(" ")}
+`);
+}
 
 // src/core/isp.ts
-var import_yaml2 = __toESM(require_dist(), 1);
 import {
   chmodSync,
   chownSync,
   closeSync as closeSync2,
   copyFileSync,
-  existsSync as existsSync2,
+  existsSync as existsSync3,
   fchmodSync as fchmodSync2,
   mkdirSync,
   openSync as openSync2,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   readdirSync,
   renameSync as renameSync2,
   rmSync as rmSync2,
@@ -8058,14 +8221,13 @@ import {
   utimesSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { isDeepStrictEqual } from "node:util";
 var ISP_BACKUP_DIR = ".isp-backup";
 var ISP_LOCK_FILE = ".isp.lock";
 var ISP_TMP_PREFIX = ".isp-tmp.";
 var GROUP_MAIN = "Proxy";
-var MANAGED_FILES = ["config.json", "clash.yaml", ".env"];
+var MANAGED_FILES = ["config.json", ".env"];
 var IspError = class extends Error {
   name = "IspError";
 };
@@ -8078,116 +8240,63 @@ function envHasIsp(text) {
     return /^ISP_SOCKS_[^=]*=/.test(line) || line === ENV_HEADER || line === ENV_HEADER_NOEOL;
   });
 }
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function checkIspConfig(config) {
   if (!isRecord(config)) throw new IspError("config.json is not valid JSON.");
   const inbounds = config.inbounds;
-  if (!Array.isArray(inbounds) || ![SS_TAG, VLESS_TAG].every((tag) => inbounds.some((i) => isRecord(i) && i.tag === tag)))
+  if (!Array.isArray(inbounds) || !inbounds.every(isRecord) || ![SS_TAG, VLESS_TAG].every((tag) => inbounds.some((i) => i.tag === tag)))
     throw new IspError("config.json has no inbounds tagged ss-in and vless-reality-in.");
-  if (inbounds.some((i) => isRecord(i) && i.tag !== SS_ISP_TAG && i.tag !== VLESS_ISP_TAG && (i.listen_port === SS_ISP_PORT || i.listen_port === VLESS_ISP_PORT)))
-    throw new IspError(`Another inbound in config.json already uses port ${SS_ISP_PORT} or ${VLESS_ISP_PORT}.`);
+  if (config.outbounds !== void 0 && (!Array.isArray(config.outbounds) || !config.outbounds.every(isRecord))) throw new IspError("config.json has invalid outbounds.");
+  if (config.route !== void 0 && (!isRecord(config.route) || config.route.rules !== void 0 && !Array.isArray(config.route.rules)))
+    throw new IspError("config.json has invalid route rules.");
 }
 function configHasIsp(config) {
   return [...config.inbounds ?? [], ...config.outbounds ?? []].some(
     (i) => isRecord(i) && [SS_ISP_TAG, VLESS_ISP_TAG, OUT_TAG].includes(i.tag)
-  );
+  ) || (config.route?.rules ?? []).some((r) => isRecord(r) && r.outbound === OUT_TAG);
 }
-function addIspToConfig(config, isp) {
-  checkIspConfig(config);
+function withoutLegacyListeners(config) {
   const next = structuredClone(config);
-  for (const [base, tag, port] of [
-    [SS_TAG, SS_ISP_TAG, SS_ISP_PORT],
-    [VLESS_TAG, VLESS_ISP_TAG, VLESS_ISP_PORT]
-  ]) {
-    const existing = next.inbounds.find((i) => i.tag === tag);
-    if (existing) existing.listen_port = port;
-    else next.inbounds.push({
-      ...structuredClone(next.inbounds.find((i) => i.tag === base)),
-      tag,
-      listen_port: port
-    });
-  }
-  const outbounds = next.outbounds ??= [];
-  const outbound = outbounds.find((o) => o.tag === OUT_TAG);
-  const fields = {
-    type: "socks",
-    tag: OUT_TAG,
-    server: isp.host,
-    server_port: isp.port,
-    version: "5",
-    username: isp.user,
-    password: isp.pass
+  const tags = /* @__PURE__ */ new Set([SS_ISP_TAG, VLESS_ISP_TAG]);
+  next.inbounds = next.inbounds.filter((inbound) => {
+    if (!tags.has(inbound.tag)) return true;
+    const ss = inbound.tag === SS_ISP_TAG;
+    if (inbound.type !== (ss ? "shadowsocks" : "vless") || inbound.listen_port !== (ss ? SS_ISP_PORT : VLESS_ISP_PORT))
+      throw new IspError("Legacy ISP inbound was customized. Migrate its tag and references manually first.");
+    return false;
+  });
+  if (next.route?.rules) next.route.rules = next.route.rules.flatMap((rule) => {
+    if (!isRecord(rule)) return [rule];
+    const inbound = typeof rule.inbound === "string" ? [rule.inbound] : rule.inbound;
+    if (!Array.isArray(inbound) || !inbound.some((tag) => tags.has(tag))) return [rule];
+    const remaining = inbound.filter((tag) => !tags.has(tag));
+    if (remaining.length) return [{ ...rule, inbound: remaining }];
+    if (isLegacyIspRule(rule)) return [];
+    throw new IspError("A custom route depends on legacy ISP inbounds. Migrate it manually first.");
+  });
+  const check = (value, key = "") => {
+    if (typeof value === "string" && tags.has(value) && ["inbound", "detour"].includes(key))
+      throw new IspError("A custom reference depends on legacy ISP inbounds. Migrate it manually first.");
+    if (Array.isArray(value)) value.forEach((item) => check(item, key));
+    else if (isRecord(value)) Object.entries(value).forEach(([name, item]) => check(item, name));
   };
-  if (outbound) Object.assign(outbound, fields);
-  else outbounds.push(fields);
-  const rules = (next.route ??= {}).rules ??= [];
-  const rule = rules.find((r) => isRecord(r) && r.outbound === OUT_TAG);
-  const inbound = [SS_ISP_TAG, VLESS_ISP_TAG];
-  if (isRecord(rule)) {
-    if (!isDeepStrictEqual(rule.inbound, inbound)) rule.inbound = inbound;
-  } else rules.push({ inbound, outbound: OUT_TAG });
+  check(next);
   return next;
 }
-function clashHasIsp(text) {
-  if (/^\s*#.*\bmy-singbox-isp\b/m.test(text)) return true;
-  const doc = (0, import_yaml2.parseDocument)(text);
-  const proxies = doc.get("proxies", true);
-  return (0, import_yaml2.isSeq)(proxies) && proxies.items.some((p) => (0, import_yaml2.isMap)(p) && [NODE_SS_ISP, NODE_VLESS_ISP].includes(p.get("name")));
+function addIspToConfig(config, isp, routeDefaults) {
+  checkIspConfig(config);
+  const next = withoutLegacyListeners(config);
+  upsertIspOutbound(next, isp);
+  ensureRoute(next, routeDefaults);
+  return next;
 }
-function addIspToClash(text, realityPrivateKey) {
-  const doc = (0, import_yaml2.parseDocument)(text);
-  if (doc.errors.length) throw new IspError("clash.yaml is not valid YAML.");
-  const proxies = doc.get("proxies", true);
-  const missing = `clash.yaml has no usable node named "${NODE_SS}" and "${NODE_VLESS}". It was probably generated by an older version (My-sing-box / My-VLESS-Reality). Delete clash.yaml, run my-singbox conf-clash to regenerate it, re-import it in your clients, then re-run my-singbox isp-outbound --add.`;
-  if (!(0, import_yaml2.isSeq)(proxies)) throw new IspError(missing);
-  let changed = false;
-  for (const [base, name, basePort, port] of [
-    [NODE_SS, NODE_SS_ISP, SS_PORT, SS_ISP_PORT],
-    [NODE_VLESS, NODE_VLESS_ISP, VLESS_PORT, VLESS_ISP_PORT]
-  ]) {
-    const proto = proxies.items.find((p) => (0, import_yaml2.isMap)(p) && p.get("name") === base);
-    if (!(0, import_yaml2.isMap)(proto) || proto.get("port") !== basePort) throw new IspError(missing);
-    const existing = proxies.items.find((p) => (0, import_yaml2.isMap)(p) && p.get("name") === name);
-    if ((0, import_yaml2.isMap)(existing)) {
-      if (existing.get("port") !== port) {
-        existing.set("port", port);
-        changed = true;
-      }
-    } else {
-      const clone = proto.clone();
-      (0, import_yaml2.visit)(clone, (_key, node) => {
-        if ((0, import_yaml2.isMap)(node) || (0, import_yaml2.isSeq)(node) || (0, import_yaml2.isScalar)(node)) {
-          delete node.comment;
-          delete node.commentBefore;
-          delete node.spaceBefore;
-        }
-      });
-      clone.set("name", name);
-      clone.set("port", port);
-      proxies.add(clone);
-      changed = true;
-    }
-  }
-  const groups = doc.get("proxy-groups", true);
-  const group = (0, import_yaml2.isSeq)(groups) ? groups.items.find((g) => (0, import_yaml2.isMap)(g) && g.get("name") === GROUP_MAIN) : void 0;
-  const list = (0, import_yaml2.isMap)(group) ? group.get("proxies", true) : void 0;
-  if (!(0, import_yaml2.isSeq)(list))
-    throw new IspError(`clash.yaml has no '${GROUP_MAIN}' proxy group with a 'proxies:' list in the expected format (generated by my-singbox conf-clash). Regenerate clash.yaml, re-import it in your clients, then re-run my-singbox isp-outbound --add.`);
-  for (const name of [NODE_SS_ISP, NODE_VLESS_ISP]) {
-    if (!list.items.some((item) => (0, import_yaml2.isScalar)(item) && item.value === name)) {
-      list.add(name);
-      changed = true;
-    }
-  }
-  const result2 = changed ? doc.toString({ lineWidth: 0 }) : text;
-  if (result2.includes("REALITY_PRIVATE_KEY") || realityPrivateKey && result2.includes(realityPrivateKey))
-    throw new IspError("Refusing to write REALITY_PRIVATE_KEY into clash.yaml.");
-  return result2;
+function removeIspFromConfig(config) {
+  checkIspConfig(config);
+  const next = withoutLegacyListeners(config);
+  omitIsp(next);
+  return next;
 }
 function makeTmpPath(projectDir) {
-  return join3(projectDir, ISP_TMP_PREFIX + randomBytes3(16).toString("hex"));
+  return join4(projectDir, ISP_TMP_PREFIX + randomBytes3(16).toString("hex"));
 }
 function installFile(dest, data, projectDir) {
   const tmp = makeTmpPath(projectDir);
@@ -8199,7 +8308,7 @@ function installFile(dest, data, projectDir) {
     } finally {
       closeSync2(fd);
     }
-    if (process.getuid?.() === 0 && existsSync2(dest)) {
+    if (process.getuid?.() === 0 && existsSync3(dest)) {
       const { uid, gid } = statSync(dest);
       chownSync(tmp, uid, gid);
     }
@@ -8216,59 +8325,43 @@ function copyPreserved(src, dest) {
   utimesSync(dest, info.atimeMs / 1e3, info.mtimeMs / 1e3);
 }
 function backupDirs(projectDir) {
-  const root = join3(projectDir, ISP_BACKUP_DIR);
-  return existsSync2(root) ? readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join3(root, entry.name)).sort() : [];
+  const root = join4(projectDir, ISP_BACKUP_DIR);
+  return existsSync3(root) ? readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => join4(root, entry.name)).sort() : [];
 }
 var lastStamp = 0n;
-function makeBackup(projectDir) {
+function makeBackup(projectDir, files = MANAGED_FILES) {
   const now = BigInt(Date.now()) * 1000000n;
   lastStamp = now > lastStamp ? now : lastStamp + 1n;
   const d = new Date(Number(lastStamp / 1000000n));
   const p2 = (n) => String(n).padStart(2, "0");
   const stamp = `${d.getFullYear()}${p2(d.getMonth() + 1)}${p2(d.getDate())}-${p2(d.getHours())}${p2(d.getMinutes())}${p2(d.getSeconds())}-${(lastStamp % 1000000000n).toString().padStart(9, "0")}-${process.pid}`;
-  const root = join3(projectDir, ISP_BACKUP_DIR), dir = join3(root, stamp);
+  const root = join4(projectDir, ISP_BACKUP_DIR), dir = join4(root, stamp);
   mkdirSync(root, { recursive: true, mode: 448 });
-  mkdirSync(dir, { mode: 448 });
   chmodSync(root, 448);
-  chmodSync(dir, 448);
-  for (const file of MANAGED_FILES) {
-    const src = join3(projectDir, file);
-    if (existsSync2(src) && statSync(src).isFile()) copyPreserved(src, join3(dir, file));
+  mkdirSync(dir, { mode: 448 });
+  for (const file of files) {
+    const src = join4(projectDir, file);
+    if (existsSync3(src) && statSync(src).isFile()) copyPreserved(src, join4(dir, file));
   }
   const all = backupDirs(projectDir);
-  for (const old of all.slice(1, Math.max(1, all.length - 4)))
-    rmSync2(old, { recursive: true });
+  for (const old of all.slice(1, Math.max(1, all.length - 4))) rmSync2(old, { recursive: true });
   return dir;
 }
-function findCleanBackup(projectDir) {
-  return backupDirs(projectDir).reverse().find((dir) => MANAGED_FILES.every((file) => {
-    const path = join3(dir, file);
-    if (!existsSync2(path)) return true;
-    const text = readFileSync3(path, "utf8");
-    if (file === ".env") return !envHasIsp(text);
-    if (file === "clash.yaml") return !clashHasIsp(text);
-    try {
-      return !configHasIsp(JSON.parse(text));
-    } catch {
-      return false;
-    }
-  }));
-}
-function restoreBackup(projectDir, backupDir) {
-  for (const file of MANAGED_FILES) {
-    const src = join3(backupDir, file);
-    if (existsSync2(src) && statSync(src).isFile()) copyPreserved(src, join3(projectDir, file));
+function restoreBackup(projectDir, backupDir, files = MANAGED_FILES) {
+  for (const file of files) {
+    const src = join4(backupDir, file), dest = join4(projectDir, file);
+    if (existsSync3(src) && statSync(src).isFile()) copyPreserved(src, dest);
   }
 }
 function sweepStaleTmp(projectDir) {
   for (const entry of readdirSync(projectDir, { withFileTypes: true }))
     if (entry.name.startsWith(ISP_TMP_PREFIX) && entry.isFile())
-      rmSync2(join3(projectDir, entry.name));
+      rmSync2(join4(projectDir, entry.name));
 }
 function lockState(path) {
   let pid;
   try {
-    pid = Number(readFileSync3(path, "utf8").trim());
+    pid = Number(readFileSync4(path, "utf8").trim());
   } catch (error) {
     if (error.code === "ENOENT") return "absent";
     throw error;
@@ -8302,7 +8395,7 @@ function claimLock(path) {
   }
 }
 async function withLock(projectDir, fn) {
-  const path = join3(projectDir, ISP_LOCK_FILE);
+  const path = join4(projectDir, ISP_LOCK_FILE);
   claimLock(path);
   try {
     sweepStaleTmp(projectDir);
@@ -8456,22 +8549,7 @@ var IspService = class {
     }
     return false;
   }
-  async portsFree() {
-    const probe = await this.command("ss", ["-H", "-ltn"]);
-    if (probe.missing) {
-      this.warn(`ss is not installed. Skipping the check that ports ${SS_ISP_PORT} and ${VLESS_ISP_PORT} are free.`);
-      return;
-    }
-    for (const [proto, port] of [
-      ["tcp", SS_ISP_PORT],
-      ["udp", SS_ISP_PORT],
-      ["tcp", VLESS_ISP_PORT]
-    ]) {
-      if (await this.portListening(proto, port))
-        throw new IspError(`Port ${port}/${proto} is already in use by another process.`);
-    }
-  }
-  async verifyService(expectIsp) {
+  async verifyService() {
     let status = "missing";
     for (let i = 0; i < 15; i++) {
       status = await this.containerStatus();
@@ -8486,16 +8564,15 @@ var IspService = class {
       this.warn("sing-box config check failed inside the container.");
       return false;
     }
-    for (const port of [SS_PORT, VLESS_PORT, ...expectIsp ? [SS_ISP_PORT, VLESS_ISP_PORT] : []]) {
-      if (!await this.waitListening("tcp", port)) {
-        this.warn(`Port ${port}/tcp is not accepting connections.`);
+    const listeners = firewallPorts(readFileSync5(join5(this.io.projectDir, "config.json"), "utf8"));
+    for (const listener of new Set(listeners)) {
+      const [number, proto] = listener.split("/");
+      const port = Number(number);
+      if (!await this.waitListening(proto, port)) {
+        this.warn(`Port ${port}/${proto} is not listening.`);
         return false;
       }
     }
-    if (expectIsp && !await this.waitListening("udp", SS_ISP_PORT)) {
-      this.warn(`Port ${SS_ISP_PORT}/udp is not listening.`);
-      return false;
-    }
     return true;
   }
   async socksEgressIp(isp) {
@@ -8525,140 +8602,6 @@ max-time = 15
     return void 0;
   }
 };
-
-// src/core/start.ts
-import { execFile as execFile2 } from "node:child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
-import { connect } from "node:net";
-import { join as join4 } from "node:path";
-function parseListenPorts(configText) {
-  const ports = /* @__PURE__ */ new Set();
-  for (const m of configText.matchAll(/"listen_port"\s*:\s*([0-9]+)/g)) {
-    const port = Number(m[1]);
-    if (port < 1 || port > 65535)
-      throw new Error(`Invalid listen_port in config.json: ${m[1]}`);
-    ports.add(port);
-  }
-  if (!ports.size) throw new Error("config.json has no listen_port.");
-  return [...ports];
-}
-function secretValues(envText) {
-  return [...envText.matchAll(/^(?:REALITY_PRIVATE_KEY|SS_PASSWORD|VLESS_UUID|ISP_SOCKS_USER|ISP_SOCKS_PASS)=([^\r\n]*)\r?$/gm)].map((m) => envUnquote(m[1])).filter((value) => value !== null && value !== "");
-}
-function redact(text, secrets) {
-  for (const secret of [...secrets].sort((a, b) => b.length - a.length))
-    text = text.replaceAll(secret, "***");
-  return text;
-}
-function composeImageTag(text) {
-  const m = /^\s*image:\s*ghcr\.io\/sagernet\/sing-box:([^\s#]+)/m.exec(text);
-  if (!m) throw new Error("sing-box image tag not found in compose.yaml.");
-  return m[1];
-}
-function firewallPorts(configText) {
-  const config = JSON.parse(configText);
-  return config.inbounds.flatMap(
-    (i) => i.type === "shadowsocks" ? [`${i.listen_port}/tcp`, `${i.listen_port}/udp`] : [`${i.listen_port}/tcp`]
-  );
-}
-function realStartDeps() {
-  return {
-    run: (file, args) => new Promise((resolve) => {
-      execFile2(file, args, (error, stdout, stderr) => {
-        const code = error ? typeof error.code === "number" ? error.code : error.code === "ENOENT" ? 127 : 1 : 0;
-        resolve({ code, stdout, stderr });
-      });
-    }),
-    tcpOpen: (port) => new Promise((resolve) => {
-      const socket = connect(port, "127.0.0.1");
-      const finish = (open) => {
-        socket.destroy();
-        resolve(open);
-      };
-      socket.setTimeout(500, () => finish(false));
-      socket.once("connect", () => finish(true));
-      socket.once("error", () => finish(false));
-    }),
-    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
-  };
-}
-async function startNode(opts) {
-  const { project, deps } = opts;
-  if (!existsSync3(join4(project, "compose.yaml")))
-    throw new Error("compose.yaml does not exist.");
-  if (!existsSync3(join4(project, "config.json")))
-    throw new Error("config.json does not exist. Run my-singbox gen-config first.");
-  const ports = parseListenPorts(readFileSync4(join4(project, "config.json"), "utf8"));
-  if (!await opts.dockerAvailable()) throw new Error("docker is not installed.");
-  if ((await deps.run("docker", ["compose", "version"])).code)
-    throw new Error("docker compose is not available.");
-  if (!await opts.dockerDaemonUp()) throw new Error("Docker daemon is not running.");
-  const envPath = join4(project, ".env");
-  const secrets = secretValues(existsSync3(envPath) ? readFileSync4(envPath, "utf8") : "");
-  const compose = (...args) => deps.run("docker", ["compose", "--project-directory", project, ...args]);
-  const forward = (output) => {
-    opts.stdout(redact(output.stdout, secrets));
-    opts.stderr(redact(output.stderr, secrets));
-  };
-  const fail = async (message) => {
-    const logs = await compose("logs", "--tail", "50", "sing-box");
-    opts.stderr(redact(logs.stdout, secrets));
-    opts.stderr(redact(logs.stderr, secrets));
-    throw new Error(redact(message, secrets));
-  };
-  const status = async () => {
-    const output = await deps.run("docker", ["inspect", "-f", "{{.State.Status}}", "sing-box"]);
-    return output.code ? "missing" : output.stdout.trim();
-  };
-  opts.stdout("Starting sing-box...\n");
-  const up = await compose("up", "-d");
-  forward(up);
-  if (up.code) throw new Error("docker compose up failed.");
-  let state = "missing";
-  for (let i = 0; i < 15; i++) {
-    state = await status();
-    if (state === "running") break;
-    await deps.sleep(1e3);
-  }
-  if (state !== "running") await fail(`sing-box did not stay running (status: ${state}).`);
-  const check = await compose("exec", "-T", "sing-box", "sing-box", "check", "-c", "/etc/sing-box/config.json");
-  forward(check);
-  if (check.code) await fail("sing-box config check failed.");
-  for (const port of ports) {
-    let open = false;
-    for (let i = 0; i < 10; i++) {
-      open = await deps.tcpOpen(port);
-      if (open) break;
-      await deps.sleep(1e3);
-    }
-    if (!open) await fail(`Port ${port} is not accepting connections.`);
-  }
-  if (ports.includes(8388)) {
-    let listening = false;
-    for (let i = 0; i < 10; i++) {
-      const udp = await deps.run("ss", ["-uln"]);
-      if (udp.code === 127) {
-        opts.stderr("Warning: ss is not installed. Skipping UDP listener check for port 8388.\n");
-        listening = true;
-        break;
-      }
-      if (udp.code === 0 && /:8388\s/.test(udp.stdout)) {
-        const owners = await deps.run("ss", ["-ulnp"]);
-        const lines = owners.stdout.split("\n").filter((l) => /:8388\s/.test(l)).join("\n");
-        if (lines.includes("users:") && !lines.includes("sing-box"))
-          await fail("UDP port 8388 is not owned by sing-box.");
-        listening = true;
-        break;
-      }
-      await deps.sleep(1e3);
-    }
-    if (!listening) await fail("UDP port 8388 is not listening.");
-  }
-  state = await status();
-  if (state !== "running") await fail(`sing-box did not stay running (status: ${state}).`);
-  opts.stdout(`Self-check passed. Ports: ${ports.join(" ")}
-`);
-}
 export {
   ENV_HEADER,
   ENV_HEADER_NOEOL,
@@ -8691,7 +8634,6 @@ export {
   VLESS_ISP_TAG,
   VLESS_PORT,
   VLESS_TAG,
-  addIspToClash,
   addIspToConfig,
   buildModel,
   checkArch,
@@ -8700,7 +8642,6 @@ export {
   checkNode,
   checkPlatform,
   checkSocket,
-  clashHasIsp,
   composeImageTag,
   configHasIsp,
   defaultKeyDeps,
@@ -8714,7 +8655,6 @@ export {
   envUnquote,
   envWithIsp,
   envWithoutIsp,
-  findCleanBackup,
   findPackageFile,
   findTemplate,
   firewallPorts,
@@ -8736,6 +8676,7 @@ export {
   readTemplate,
   realStartDeps,
   redact,
+  removeIspFromConfig,
   renderClash,
   renderGeneratedEnv,
   renderSingbox,