devconfig-gen-singbox 2.1.2__tar.gz → 2.1.4__tar.gz

{devconfig_gen_singbox-2.1.2/src/devconfig_gen_singbox.egg-info → devconfig_gen_singbox-2.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devconfig_gen_singbox
-Version: 2.1.2
+Version: 2.1.4
 Summary: Provider-based developer configuration generation engine and CLI
 Author-email: henryliu443 <henryliu443@gmail.com>
 License-Expression: Apache-2.0
@@ -28,7 +28,7 @@ Dynamic: license-file
 > **A sing-box domain implementation built on top of DevConfig-Gen.**
 > **构建在 `DevConfig-Gen` 之上的 sing-box 领域实现（child / fork）。**
 
-[![Version](https://img.shields.io/badge/version-2.1.2-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.1.4-blue.svg)](CHANGELOG.md)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 ![Python 3.8+](https://img.shields.io/badge/python-3.8%2B-blue.svg)
 ![Tests](https://img.shields.io/badge/tests-136%20passing-brightgreen.svg)

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/README.md

@@ -3,7 +3,7 @@
 > **A sing-box domain implementation built on top of DevConfig-Gen.**
 > **构建在 `DevConfig-Gen` 之上的 sing-box 领域实现（child / fork）。**
 
-[![Version](https://img.shields.io/badge/version-2.1.2-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.1.4-blue.svg)](CHANGELOG.md)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 ![Python 3.8+](https://img.shields.io/badge/python-3.8%2B-blue.svg)
 ![Tests](https://img.shields.io/badge/tests-136%20passing-brightgreen.svg)

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "devconfig_gen_singbox"
-version = "2.1.2"
+version = "2.1.4"
 authors = [
   { name = "henryliu443", email = "henryliu443@gmail.com" },
 ]

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/src/devconfig_gen/__init__.py

@@ -66,4 +66,4 @@ __all__ = [
     "loads",
     "validate_request",
 ]
-__version__ = "2.1.2"
+__version__ = "2.1.4"

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4/src/devconfig_gen_singbox.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devconfig_gen_singbox
-Version: 2.1.2
+Version: 2.1.4
 Summary: Provider-based developer configuration generation engine and CLI
 Author-email: henryliu443 <henryliu443@gmail.com>
 License-Expression: Apache-2.0
@@ -28,7 +28,7 @@ Dynamic: license-file
 > **A sing-box domain implementation built on top of DevConfig-Gen.**
 > **构建在 `DevConfig-Gen` 之上的 sing-box 领域实现（child / fork）。**
 
-[![Version](https://img.shields.io/badge/version-2.1.2-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-2.1.4-blue.svg)](CHANGELOG.md)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 ![Python 3.8+](https://img.shields.io/badge/python-3.8%2B-blue.svg)
 ![Tests](https://img.shields.io/badge/tests-136%20passing-brightgreen.svg)

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/src/devconfig_gen_singbox.egg-info/SOURCES.txt

@@ -40,12 +40,14 @@ src/singbox_ops/adapters/base.py
 src/singbox_ops/adapters/acme/__init__.py
 src/singbox_ops/adapters/acme/base.py
 src/singbox_ops/adapters/acme/cloudflare_dns01.py
+src/singbox_ops/adapters/acme/prune.py
 src/singbox_ops/adapters/dns/__init__.py
 src/singbox_ops/adapters/dns/base.py
 src/singbox_ops/adapters/dns/cloudflare.py
 src/singbox_ops/adapters/export/__init__.py
 src/singbox_ops/adapters/export/local_files.py
 src/singbox_ops/adapters/runtime/__init__.py
+src/singbox_ops/adapters/runtime/auto_update.py
 src/singbox_ops/adapters/runtime/nftables.py
 src/singbox_ops/adapters/runtime/packages.py
 src/singbox_ops/adapters/runtime/systemd.py

devconfig_gen_singbox-2.1.4/src/singbox_ops/adapters/acme/__init__.py

@@ -0,0 +1,8 @@
+"""ACME certificate adapters."""
+
+from __future__ import annotations
+
+from .cloudflare_dns01 import CloudflareDNS01ACME
+from .prune import DEFAULT_ACME_HOME, plan_prune, prune_certs
+
+__all__ = ["CloudflareDNS01ACME", "DEFAULT_ACME_HOME", "plan_prune", "prune_certs"]

devconfig_gen_singbox-2.1.4/src/singbox_ops/adapters/acme/prune.py

@@ -0,0 +1,56 @@
+"""Prune stale acme.sh certificate directories.
+
+Only ``<acme_home>/<host>_ecc`` directories are ever considered. Anything whose
+host is not in the keep set is removed. The operation refuses to run with an
+empty keep set, and defaults to a dry run, so a slip can never wipe every
+certificate (the failure mode of hand-rolled shell).
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Mapping, Sequence
+
+from ...core.command import CommandRunner, LocalCommandRunner
+from ...core.exceptions import AdapterError
+
+DEFAULT_ACME_HOME = "/root/.acme.sh"
+SUFFIX = "_ecc"
+
+
+def plan_prune(
+    runner: CommandRunner,
+    acme_home: str,
+    keep_hosts: Sequence[str],
+) -> "tuple[list, list]":
+    keep_set = {str(item).strip() for item in keep_hosts if str(item).strip()}
+    if not keep_set:
+        raise AdapterError("refusing to prune: no hosts to keep")
+    try:
+        entries = runner.listdir(acme_home)
+    except OSError as exc:
+        raise AdapterError(f"cannot list {acme_home}: {exc}") from exc
+
+    keep: list = []
+    remove: list = []
+    for entry in entries:
+        if not entry.endswith(SUFFIX):
+            continue
+        domain = entry[: -len(SUFFIX)]
+        (keep if domain in keep_set else remove).append(entry)
+    return keep, remove
+
+
+def prune_certs(
+    runner: CommandRunner,
+    acme_home: str = DEFAULT_ACME_HOME,
+    keep_hosts: Sequence[str] = (),
+    dry_run: bool = True,
+) -> Mapping[str, object]:
+    keep, remove = plan_prune(runner, acme_home, keep_hosts)
+    result = {"acme_home": acme_home, "keep": sorted(keep), "remove": sorted(remove), "dry_run": dry_run}
+    if dry_run:
+        return result
+    for entry in remove:
+        runner.run(["rm", "-rf", os.path.join(acme_home, entry)], check=False)
+    return result

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/src/singbox_ops/adapters/export/local_files.py

@@ -56,6 +56,12 @@ class LocalFilesExport:
             destination = outputs.get(key)
             if not destination:
                 continue
+            # Single-file model: never write *through* a legacy symlink (for
+            # example config.json -> profiles/config.direct.json). Replace the
+            # link with a real file so the old profile-switching scheme cannot
+            # silently redirect our write.
+            if not dry_run and self.runner.islink(destination):
+                self.runner.unlink(destination)
             text = serialize_artifact(artifact)
             self.runner.write_text(destination, text, mode=0o600)
             written[key] = destination

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/src/singbox_ops/adapters/runtime/__init__.py

@@ -2,16 +2,19 @@
 
 from __future__ import annotations
 
+from .auto_update import AutoUpdateRuntime, build_auto_update_script
 from .nftables import NftablesFirewall, build_nftables_conf, detect_ssh_port
 from .packages import DebianPackagesRuntime
 from .systemd import SystemdRuntime
 from .warp_watchdog import WarpWatchdogRuntime
 
 __all__ = [
+    "AutoUpdateRuntime",
     "DebianPackagesRuntime",
     "NftablesFirewall",
     "SystemdRuntime",
     "WarpWatchdogRuntime",
+    "build_auto_update_script",
     "build_nftables_conf",
     "detect_ssh_port",
 ]

devconfig_gen_singbox-2.1.4/src/singbox_ops/adapters/runtime/auto_update.py

@@ -0,0 +1,47 @@
+"""Daily sing-box auto-update job (copied verbatim from the legacy deployment).
+
+The script is shipped as a template and installed as-is, then scheduled through
+``/etc/cron.d`` so no interactive crontab editing is needed.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Mapping, Optional
+
+from ...core.command import CommandRunner, LocalCommandRunner
+
+SCRIPT_PATH = "/usr/local/bin/singbox_auto_update.py"
+CRON_PATH = "/etc/cron.d/singbox-auto-update"
+LOG_PATH = "/var/log/singbox-auto-update.log"
+CRON_SCHEDULE = "17 4 * * *"
+
+_TEMPLATE = Path(__file__).resolve().parents[2] / "templates" / "singbox_auto_update.py.template"
+
+
+def build_auto_update_script() -> str:
+    return _TEMPLATE.read_text(encoding="utf-8")
+
+
+def build_cron_entry(script_path: str = SCRIPT_PATH, log_path: str = LOG_PATH) -> str:
+    return f"{CRON_SCHEDULE} root /usr/bin/env python3 {script_path} >> {log_path} 2>&1\n"
+
+
+class AutoUpdateRuntime:
+    def __init__(
+        self,
+        runner: Optional[CommandRunner] = None,
+        script_path: str = SCRIPT_PATH,
+        cron_path: str = CRON_PATH,
+    ):
+        self.runner = runner or LocalCommandRunner()
+        self.script_path = script_path
+        self.cron_path = cron_path
+
+    def apply(self, plan, hosts: Mapping[str, str], *, dry_run: bool = False) -> None:
+        self.runner.write_text(self.script_path, build_auto_update_script(), mode=0o755)
+        self.runner.write_text(self.cron_path, build_cron_entry(self.script_path), mode=0o644)
+
+    def destroy(self, plan, hosts: Mapping[str, str], *, dry_run: bool = False) -> None:
+        self.runner.unlink(self.cron_path, missing_ok=True)
+        self.runner.unlink(self.script_path, missing_ok=True)

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/src/singbox_ops/adapters/runtime/nftables.py

@@ -90,6 +90,10 @@ class NftablesFirewall:
         ports = protocol_ports(plan.protocols)
         ssh_port = detect_ssh_port(self.runner)
         conf = build_nftables_conf(ports["tcp"], ports["udp"], ssh_port)
+        # Takeover: drop any previous table (legacy included) before applying
+        # ours, so chains never stack up and ``destroy`` cannot half-remove a
+        # foreign ruleset.
+        self.runner.run(["nft", "delete", "table", "inet", "singbox_guard"], check=False)
         self.runner.mkdir("/etc/nftables.d", mode=0o755)
         self.runner.write_text(self.conf_path, conf, mode=0o644)
         self.runner.run(["nft", "-f", self.conf_path], check=True)

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/src/singbox_ops/adapters/runtime/warp_watchdog.py

@@ -62,11 +62,18 @@ class WarpWatchdogRuntime:
         self.cron_path = cron_path
 
     def apply(self, plan, hosts: Mapping[str, str], *, dry_run: bool = False) -> None:
-        if plan.tunnel_mode not in ("proxy", "tun"):
+        if plan.tunnel_mode in ("proxy", "tun"):
+            script = build_watchdog_script(plan.tunnel_mode)
+            self.runner.write_text(self.script_path, script, mode=0o755)
+            self.runner.write_text(self.cron_path, build_cron_entry(self.script_path), mode=0o644)
             return
-        script = build_watchdog_script(plan.tunnel_mode)
-        self.runner.write_text(self.script_path, script, mode=0o755)
-        self.runner.write_text(self.cron_path, build_cron_entry(self.script_path), mode=0o644)
+
+        # ``direct`` / ``none``: the server does not use WARP, so cancel the
+        # watchdog and stop the WARP daemon instead of babysitting it forever.
+        self.runner.unlink(self.cron_path, missing_ok=True)
+        self.runner.unlink(self.script_path, missing_ok=True)
+        self.runner.run(["pkill", "-9", "-x", "warp-svc"], check=False)
+        self.runner.run(["systemctl", "disable", "warp-svc"], check=False)
 
     def destroy(self, plan, hosts: Mapping[str, str], *, dry_run: bool = False) -> None:
         self.runner.unlink(self.cron_path, missing_ok=True)

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/src/singbox_ops/cli.py

@@ -33,6 +33,7 @@ SUBCOMMANDS = (
     ("deploy", "Deploy sing-box (interactive wizard when --plan is omitted)"),
     ("redeploy", "Regenerate credentials and redeploy"),
     ("destroy", "Tear down what a previous deploy created"),
+    ("certs", "Prune stale acme.sh certificate dirs (dry-run unless --apply)"),
 )
 
 
@@ -46,6 +47,14 @@ def add_subparsers(sub) -> None:
         command.add_argument("--protocols", help="Comma-separated protocols (skips that prompt)")
         if name == "plan":
             command.add_argument("--output", default="plan.yaml", help="Where to write the plan")
+        if name == "certs":
+            command.add_argument("--keep", required=True, help="Comma-separated hosts to keep")
+            command.add_argument("--acme-home", default="/root/.acme.sh", help="acme.sh home dir")
+            command.add_argument(
+                "--apply",
+                action="store_true",
+                help="Actually delete (default is a dry run)",
+            )
         if name == "context":
             command.add_argument("--format", choices=("json", "yaml"), help="Output format")
         if name in ("deploy", "redeploy", "destroy"):
@@ -120,6 +129,7 @@ def interactive_plan(domain=None, protocols=None, reader=None, writer=None) -> d
                 "systemd": "systemd" if use_runtime else None,
                 "firewall": "nftables-basic" if use_runtime else None,
                 "watchdog": "warp" if use_runtime else None,
+                "auto_update": "auto-update" if use_runtime else None,
             },
         },
         "outputs": {
@@ -141,6 +151,22 @@ def _detect_or_placeholder(plan) -> str:
 
 def _run(args) -> int:
     try:
+        if getattr(args, "command", None) == "certs":
+            from .adapters.acme.prune import DEFAULT_ACME_HOME, prune_certs
+            from .core.command import LocalCommandRunner, RecordingRunner
+
+            keep = [item for item in (getattr(args, "keep", "") or "").split(",") if item.strip()]
+            dry_run = not bool(getattr(args, "apply", False))
+            runner = RecordingRunner() if dry_run else LocalCommandRunner()
+            result = prune_certs(
+                runner,
+                acme_home=getattr(args, "acme_home", DEFAULT_ACME_HOME),
+                keep_hosts=keep,
+                dry_run=dry_run,
+            )
+            print(json.dumps(result, indent=2, ensure_ascii=False))
+            return 0
+
         if getattr(args, "plan", None):
             plan = load_plan(args.plan)
         elif args.command == "destroy":

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/src/singbox_ops/core/command.py

@@ -55,6 +55,9 @@ class CommandRunner:
     def islink(self, path) -> bool:
         raise NotImplementedError
 
+    def listdir(self, path) -> List[str]:
+        raise NotImplementedError
+
     def mkdir(self, path, *, mode: Optional[int] = None) -> None:
         raise NotImplementedError
 
@@ -113,6 +116,9 @@ class LocalCommandRunner(CommandRunner):
     def islink(self, path) -> bool:
         return Path(path).is_symlink()
 
+    def listdir(self, path) -> List[str]:
+        return sorted(os.listdir(str(path)))
+
     def mkdir(self, path, *, mode: Optional[int] = None) -> None:
         target = Path(path)
         target.mkdir(parents=True, exist_ok=True)
@@ -149,6 +155,7 @@ class RecordingRunner(CommandRunner):
         self.links: List[Tuple[str, str]] = []
         self._existing = set(str(item) for item in (existing or ()))
         self._files = {}
+        self._dirs = {}
 
     def run(self, args: Sequence[str], *, check: bool = True, env=None) -> CommandResult:
         self.commands.append(("run", tuple(str(item) for item in args), dict(env or {})))
@@ -173,9 +180,13 @@ class RecordingRunner(CommandRunner):
     def islink(self, path) -> bool:
         return False
 
+    def listdir(self, path) -> List[str]:
+        return sorted(self._dirs.get(str(path), set()))
+
     def mkdir(self, path, *, mode: Optional[int] = None) -> None:
         self.directories.append((str(path), mode))
         self._existing.add(str(path))
+        self._dirs.setdefault(str(path), set())
 
     def unlink(self, path, *, missing_ok: bool = True) -> None:
         self.removed.append(str(path))

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/src/singbox_ops/core/orchestrator.py

@@ -15,6 +15,7 @@ from devconfig_gen import formats
 from ..adapters.acme.cloudflare_dns01 import CloudflareDNS01ACME
 from ..adapters.dns.cloudflare import CloudflareDNS
 from ..adapters.export.local_files import LocalFilesExport
+from ..adapters.runtime.auto_update import AutoUpdateRuntime
 from ..adapters.runtime.nftables import NftablesFirewall
 from ..adapters.runtime.packages import DebianPackagesRuntime
 from ..adapters.runtime.systemd import SystemdRuntime
@@ -44,6 +45,7 @@ RUNTIME_FACTORIES = {
     "systemd": SystemdRuntime,
     "nftables-basic": NftablesFirewall,
     "warp": WarpWatchdogRuntime,
+    "auto-update": AutoUpdateRuntime,
 }
 STATE_FACTORIES = {"local-json": LocalJsonState}
 
@@ -59,6 +61,7 @@ class AdapterSuite:
     systemd: Optional[Any] = None
     firewall: Optional[Any] = None
     watchdog: Optional[Any] = None
+    auto_update: Optional[Any] = None
 
 
 @dataclass
@@ -126,6 +129,7 @@ def build_suite(plan: DeployPlan, runner: CommandRunner) -> AdapterSuite:
     systemd = _runtime(plan, "systemd", runtime_kwargs)
     firewall = _runtime(plan, "firewall", runtime_kwargs)
     watchdog = _runtime(plan, "watchdog", runtime_kwargs)
+    auto_update = _runtime(plan, "auto_update", runtime_kwargs)
 
     return AdapterSuite(
         secrets=secrets,
@@ -137,6 +141,7 @@ def build_suite(plan: DeployPlan, runner: CommandRunner) -> AdapterSuite:
         systemd=systemd,
         firewall=firewall,
         watchdog=watchdog,
+        auto_update=auto_update,
     )
 
 
@@ -204,6 +209,7 @@ def deploy(
         ("systemd", suite.systemd),
         ("firewall", suite.firewall),
         ("watchdog", suite.watchdog),
+        ("auto_update", suite.auto_update),
     ):
         if adapter is None:
             continue
@@ -257,6 +263,7 @@ def destroy(
 
     for key, adapter in (
         ("watchdog", suite.watchdog),
+        ("auto_update", suite.auto_update),
         ("firewall", suite.firewall),
         ("systemd", suite.systemd),
         ("packages", suite.packages),

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/src/singbox_ops/core/plan.py

@@ -40,6 +40,7 @@ DEFAULT_ADAPTERS: Mapping[str, Any] = {
         "systemd": "systemd",
         "firewall": "nftables-basic",
         "watchdog": "warp",
+        "auto_update": "auto-update",
     },
 }
 

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/tests/test_singbox_ops_acme.py

@@ -1,7 +1,9 @@
 import unittest
 
 from singbox_ops.adapters.acme.cloudflare_dns01 import CloudflareDNS01ACME
+from singbox_ops.adapters.acme.prune import plan_prune, prune_certs
 from singbox_ops.core.command import CommandResult
+from singbox_ops.core.exceptions import AdapterError
 from tests._ops_support import FakeRunner
 
 HOSTS = {"tuic": "c3d4.example.com", "hysteria2": "e5f6.example.com"}
@@ -62,5 +64,33 @@ class ACMETests(unittest.TestCase):
         self.assertEqual(runner.commands, [])
 
 
+class PruneTests(unittest.TestCase):
+    def _runner(self, entries):
+        return FakeRunner(dirs={"/root/.acme.sh": entries})
+
+    def test_plan_keep_and_remove(self):
+        runner = self._runner(["a.example.com_ecc", "b.example.com_ecc", "ca", "account.conf"])
+        keep, remove = plan_prune(runner, "/root/.acme.sh", ["a.example.com"])
+        self.assertEqual(keep, ["a.example.com_ecc"])
+        self.assertEqual(remove, ["b.example.com_ecc"])
+
+    def test_refuses_empty_keep(self):
+        runner = self._runner(["a.example.com_ecc"])
+        with self.assertRaises(AdapterError):
+            plan_prune(runner, "/root/.acme.sh", [])
+
+    def test_dry_run_does_not_delete(self):
+        runner = self._runner(["a.example.com_ecc", "b.example.com_ecc"])
+        result = prune_certs(runner, "/root/.acme.sh", ["a.example.com"], dry_run=True)
+        self.assertEqual(result["remove"], ["b.example.com_ecc"])
+        self.assertEqual(runner.commands, [])
+
+    def test_apply_deletes_only_stale(self):
+        runner = self._runner(["a.example.com_ecc", "b.example.com_ecc"])
+        prune_certs(runner, "/root/.acme.sh", ["a.example.com"], dry_run=False)
+        runs = [cmd[1] for cmd in runner.commands if cmd[0] == "run"]
+        self.assertEqual(runs, [("rm", "-rf", "/root/.acme.sh/b.example.com_ecc")])
+
+
 if __name__ == "__main__":
     unittest.main()

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/tests/test_singbox_ops_cli.py

@@ -14,7 +14,7 @@ class SingleCliNameTests(unittest.TestCase):
         result = run_cli("--help")
         self.assertEqual(result.returncode, 0, result.stderr)
         self.assertIn("devconfig_gen_singbox", result.stdout)
-        for name in ("generate", "init", "ui", "context", "plan", "deploy", "redeploy", "destroy"):
+        for name in ("generate", "init", "ui", "context", "plan", "deploy", "redeploy", "destroy", "certs"):
             self.assertIn(name, result.stdout)
         self.assertNotIn("singbox-ops", result.stdout)
 

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/tests/test_singbox_ops_runtime.py

@@ -1,5 +1,6 @@
 import unittest
 
+from singbox_ops.adapters.runtime.auto_update import AutoUpdateRuntime
 from singbox_ops.adapters.runtime.nftables import (
     NftablesFirewall,
     build_nftables_conf,
@@ -44,10 +45,12 @@ class NftablesTests(unittest.TestCase):
     def test_detect_ssh_port_default(self):
         self.assertEqual(detect_ssh_port(FakeRunner()), 22)
 
-    def test_apply_writes_and_loads(self):
+    def test_apply_deletes_legacy_table_then_loads(self):
         runner = FakeRunner()
         NftablesFirewall(runner=runner).apply(plan_for(), {})
-        self.assertTrue(any(cmd[0] == "run" and cmd[1][0] == "nft" for cmd in runner.commands))
+        runs = [cmd[1] for cmd in runner.commands if cmd[0] == "run"]
+        self.assertIn(("nft", "delete", "table", "inet", "singbox_guard"), runs)
+        self.assertTrue(any(item[0] == "nft" and item[1] == "-f" for item in runs))
         self.assertTrue(runner.writes)
 
 
@@ -80,10 +83,33 @@ class WatchdogTests(unittest.TestCase):
         self.assertIn("/root/warp_lazy_watchdog.sh", paths)
         self.assertIn("/etc/cron.d/singbox-warp-watchdog", paths)
 
-    def test_skips_for_none_mode(self):
+    def test_direct_mode_cancels_watchdog_and_kills_warp(self):
         runner = FakeRunner()
         WarpWatchdogRuntime(runner=runner).apply(plan_for("none"), {})
         self.assertEqual(runner.writes, [])
+        self.assertIn("/etc/cron.d/singbox-warp-watchdog", runner.removed)
+        self.assertIn("/root/warp_lazy_watchdog.sh", runner.removed)
+        runs = [cmd[1] for cmd in runner.commands if cmd[0] == "run"]
+        self.assertIn(("pkill", "-9", "-x", "warp-svc"), runs)
+
+
+class AutoUpdateTests(unittest.TestCase):
+    def test_apply_writes_script_and_cron(self):
+        runner = FakeRunner()
+        AutoUpdateRuntime(runner=runner).apply(plan_for("none"), {})
+        paths = [path for path, _, _ in runner.writes]
+        self.assertIn("/usr/local/bin/singbox_auto_update.py", paths)
+        self.assertIn("/etc/cron.d/singbox-auto-update", paths)
+        cron = next(text for path, text, _ in runner.writes if path.endswith("singbox-auto-update"))
+        self.assertIn("17 4 * * *", cron)
+        script = next(text for path, text, _ in runner.writes if path.endswith("singbox_auto_update.py"))
+        self.assertIn("SagerNet/sing-box", script)
+
+    def test_destroy_removes_both(self):
+        runner = FakeRunner()
+        AutoUpdateRuntime(runner=runner).destroy(plan_for("none"), {})
+        self.assertIn("/etc/cron.d/singbox-auto-update", runner.removed)
+        self.assertIn("/usr/local/bin/singbox_auto_update.py", runner.removed)
 
 
 class PackagesTests(unittest.TestCase):

{devconfig_gen_singbox-2.1.2 → devconfig_gen_singbox-2.1.4}/tests/test_singbox_ops_state_export.py

@@ -42,6 +42,16 @@ class ExportTests(unittest.TestCase):
         self.assertEqual(match_output_key("sing-box-links.txt"), "links")
         self.assertIsNone(match_output_key("unknown.txt"))
 
+    def test_replaces_symlink_destination(self):
+        runner = FakeRunner(links=["/etc/sing-box/config.json"])
+        artifacts = [
+            GeneratedArtifact("sing-box.server.json", {"a": 1}, "application/json"),
+        ]
+        LocalFilesExport(runner=runner).write(artifacts, {"server_config": "/etc/sing-box/config.json"})
+        # the legacy symlink is removed, then a real file is written
+        self.assertIn("/etc/sing-box/config.json", runner.removed)
+        self.assertTrue(any(path == "/etc/sing-box/config.json" for path, _, _ in runner.writes))
+
     def test_writes_artifacts(self):
         runner = FakeRunner()
         artifacts = [

devconfig_gen_singbox-2.1.2/src/singbox_ops/adapters/acme/__init__.py

@@ -1,7 +0,0 @@
-"""ACME certificate adapters."""
-
-from __future__ import annotations
-
-from .cloudflare_dns01 import CloudflareDNS01ACME
-
-__all__ = ["CloudflareDNS01ACME"]