proxyctl 0.5.10__tar.gz → 0.5.12__tar.gz

{proxyctl-0.5.10 → proxyctl-0.5.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proxyctl
-Version: 0.5.10
+Version: 0.5.12
 Summary: Proxy configuration lifecycle management for macOS and Linux
 Project-URL: Homepage, https://github.com/crhan/proxyctl
 Project-URL: Issues, https://github.com/crhan/proxyctl/issues

{proxyctl-0.5.10 → proxyctl-0.5.12}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "proxyctl"
-version = "0.5.10"
+version = "0.5.12"
 description = "Proxy configuration lifecycle management for macOS and Linux"
 readme = "README.md"
 requires-python = ">=3.10"

{proxyctl-0.5.10 → proxyctl-0.5.12}/src/proxyctl/cli.py

@@ -7,6 +7,7 @@
 """
 
 import functools
+import ipaddress
 import json
 import os
 import platform
@@ -1327,6 +1328,30 @@ def cmd_dns_unlock(config: dict):
 
 # ── 命令：env ────────────────────────────────────────────────────────────────
 
+def _normalize_no_proxy_extra(extra) -> list[str]:
+    """Return NO_PROXY extras compatible with Python/httpx environment parsing."""
+    if not extra:
+        return []
+    if isinstance(extra, str):
+        items = [s.strip() for s in extra.split(",")]
+    else:
+        items = [str(s).strip() for s in extra]
+
+    out: list[str] = []
+    for item in items:
+        if not item:
+            continue
+        try:
+            network = ipaddress.ip_network(item, strict=False)
+        except ValueError:
+            out.append(item)
+            continue
+        if network.version == 6 and "/" in item:
+            continue
+        out.append(item)
+    return out
+
+
 def cmd_env(config: dict, unset: bool = False):
     """输出设置/清除代理环境变量的 shell 语句。
 
@@ -1350,9 +1375,7 @@ def cmd_env(config: dict, unset: bool = False):
     proxy_socks = f"socks5://127.0.0.1:{port}"
     no_proxy = "localhost,127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
     # 用户附加的 NO_PROXY 项（个人域名等）；接受 list[str] 或逗号分隔 str
-    extra = config.get("no_proxy_extra") or []
-    if isinstance(extra, str):
-        extra = [s.strip() for s in extra.split(",") if s.strip()]
+    extra = _normalize_no_proxy_extra(config.get("no_proxy_extra"))
     if extra:
         no_proxy = no_proxy + "," + ",".join(extra)
 

{proxyctl-0.5.10 → proxyctl-0.5.12}/src/proxyctl/explain.py

@@ -217,7 +217,10 @@ def _t_env(backend, config) -> TopicCard:
             f"`proxyctl env` 输出 export 行，可 eval 进当前 shell（端口 {port}）。"
         ),
         "file": _io_proxyctl_config_path() + "  [no_proxy_extra: 字段]",
-        "edit": "  # no_proxy_extra: 追加内网域名 / Tailscale 段 / 企业 host",
+        "edit": (
+            "  # no_proxy_extra: 追加内网域名 / IPv4 CIDR / 企业 host\n"
+            "  # 裸 IPv6 CIDR 会被跳过，避免 Python/httpx 误解析 NO_PROXY"
+        ),
         "verify": "eval \"$(proxyctl env)\" && env | grep -i proxy",
         "next_commands": ["env", "env --unset"],
     }

{proxyctl-0.5.10 → proxyctl-0.5.12}/src/proxyctl/trace.py

@@ -93,6 +93,52 @@ def _is_ip(s: str) -> bool:
         return False
 
 
+def _cidr_contains_any(cidr: str, ips: list) -> bool:
+    """resolved_ips 里是否有任一 IP 落在 cidr 网段内。"""
+    try:
+        net = ipaddress.ip_network(cidr, strict=False)
+    except ValueError:
+        return False
+    for ip in ips:
+        try:
+            if ipaddress.ip_address(ip) in net:
+                return True
+        except ValueError:
+            pass
+    return False
+
+
+def _load_noresolve_payloads(config_path: str = None) -> set:
+    """读取 mihomo 配置 rules 段，返回带 no-resolve 的 IP 规则 payload 集合。
+
+    Clash /rules API 不暴露 no-resolve 标志，预测器只能从配置文件解析。
+    这些规则在域名连接（HTTP 代理 / fake-ip）下引擎不会解析域名，故不命中——
+    预测器必须据此跳过，否则会误报命中（典型：100.64.0.0/10,DIRECT,no-resolve）。
+    """
+    import os
+    if config_path is None:
+        config_path = os.path.expanduser("~/.config/mihomo/config.yaml")
+    payloads: set = set()
+    try:
+        text = open(config_path).read()
+    except OSError:
+        return payloads
+    in_rules = False
+    for line in text.splitlines():
+        if re.match(r'^rules:\s*$', line):
+            in_rules = True
+            continue
+        if not in_rules:
+            continue
+        # rules 段结束：遇到顶格的新顶层键（非缩进、非列表项）
+        if line and not line[0].isspace() and not line.lstrip().startswith('-'):
+            break
+        m = re.match(r'\s*-\s*(?:IP-CIDR6?|IP-SUFFIX),([^,]+),[^,]+,\s*no-resolve\b', line)
+        if m:
+            payloads.add(m.group(1).strip())
+    return payloads
+
+
 def _section_dns(domain: str, api: str, secret: str,
                  fakeip_active: bool = False, corp_dns: dict = None) -> list:
     """
@@ -208,9 +254,16 @@ def _section_dns(domain: str, api: str, secret: str,
     return resolved_ips
 
 
-def _section_rules(domain: str, resolved_ips: list, api: str, secret: str) -> tuple:
+def _section_rules(domain: str, resolved_ips: list, api: str, secret: str,
+                   noresolve_can_match: bool = True,
+                   noresolve_payloads: set = None) -> tuple:
     """
     [2/4] 规则匹配 — 按引擎规则顺序逐条预测。
+
+    Args:
+        noresolve_can_match: 当前连接是否带真实目的 IP。域名经 HTTP 代理 / fake-ip
+            进来时为 False——此时引擎走到 no-resolve 的 IP 规则尚未解析，会跳过它们。
+        noresolve_payloads: 配置里带 no-resolve 的 IP 规则 payload 集合（_load_noresolve_payloads）。
     返回 (predicted_rule, predicted_proxy)。
     """
     print(f"\n{BOLD}[2/4] 规则匹配{NC}")
@@ -219,6 +272,9 @@ def _section_rules(domain: str, resolved_ips: list, api: str, secret: str) -> tu
         print(f"  {RED}无法获取规则列表{NC}")
         return None, None
 
+    noresolve_payloads = noresolve_payloads or set()
+    skipped_noresolve: list = []   # 因 no-resolve 被跳过、但本可命中的规则（用于提示）
+
     predicted_rule = predicted_proxy = None
     for rule in rules_data.get("rules", []):
         rtype   = rule.get("type", "")
@@ -241,6 +297,14 @@ def _section_rules(domain: str, resolved_ips: list, api: str, secret: str) -> tu
                 matched = True
                 detail  = f"精确域名 {payload}"
         elif rtype == "IPCIDR" and resolved_ips:
+            # no-resolve 的 IP 规则只在连接本身带真实目的 IP 时才会被引擎匹配。
+            # 域名经 HTTP 代理 / fake-ip 进来时，引擎走到这条还没解析 → 跳过，
+            # 否则误报命中（典型坑：100.64.0.0/10,DIRECT,no-resolve 被预测成 DIRECT，
+            # 实际却落兜底走 proxy）。
+            if (not noresolve_can_match) and payload in noresolve_payloads:
+                if _cidr_contains_any(payload, resolved_ips):
+                    skipped_noresolve.append((rtype, payload, proxy))
+                continue
             try:
                 net = ipaddress.ip_network(payload, strict=False)
                 for ip in resolved_ips:
@@ -276,6 +340,13 @@ def _section_rules(domain: str, resolved_ips: list, api: str, secret: str) -> tu
                 )
                 print(f"  {DIM}注: 跳过了 {len(uncertain)} 条 GeoSite/GeoIP 规则 "
                       f"(无法客户端匹配): {types_str}{NC}")
+
+            if skipped_noresolve:
+                nr_str = ", ".join(
+                    f"{t}({p})→{pr}" for t, p, pr in skipped_noresolve[-3:]
+                )
+                print(f"  {YELLOW}注: 跳过了 {len(skipped_noresolve)} 条 no-resolve IP 规则 "
+                      f"(域名连接下引擎不解析，本应命中却不命中): {nr_str}{NC}")
             break
 
     if not predicted_rule:
@@ -435,20 +506,30 @@ def _section_connections(domain: str, resolved_ips: list,
     """[4/4] 实际连接验证 — 从 Clash API 活跃连接 + 日志历史中取路由信息。"""
     print(f"\n{BOLD}[4/4] 实际连接{NC}")
 
-    domain_conns = []
+    host_conns = []
+    ip_conns = []
     for _ in range(3):
         data = _api_get(api, "/connections", secret)
         if data and isinstance(data, dict):
             for c in (data.get("connections") or []):
                 m  = c.get("metadata", {})
-                h  = m.get("host", "")
                 di = m.get("destinationIP", "")
-                if (h == domain or h.endswith("." + domain)
-                        or (di and di in resolved_ips)):
-                    domain_conns.append(c)
-        if domain_conns:
+                # sniffer/TUN 模式下 host 可能是目的 IP 或为空，真实域名落在
+                # sniffHost（嗅探到的 SNI / HTTP Host）。两字段独立判断、不互相
+                # 遮蔽：任一匹配即纳入；只有两者都缺失（纯 IP）才按目的 IP 回退
+                hosts = [x for x in (m.get("host", ""), m.get("sniffHost", "")) if x]
+                if any(x == domain or x.endswith("." + domain) for x in hosts):
+                    host_conns.append(c)
+                elif not hosts and di and di in resolved_ips:
+                    # host/sniffHost 都没有的纯 IP 连接才回退；任一字段非空但
+                    # 指向别的域名的连接，即使同 IP 也不算进来——否则共享 IP 下
+                    # 会把同 IP 别站的活跃连接误算成本域名
+                    ip_conns.append(c)
+        if host_conns or ip_conns:
             break
         time.sleep(0.3)
+    # host 精确匹配优先；只有全是无 host 的连接时才回退到按 IP 匹配的那批
+    domain_conns = host_conns if host_conns else ip_conns
 
     if not domain_conns:
         # 没有活跃连接，从引擎日志中捞历史记录
@@ -465,54 +546,64 @@ def _section_connections(domain: str, resolved_ips: list,
                 print(f"  {DIM}基于规则预测，该域名应走: {BOLD}{predicted_proxy}{NC}")
         return
 
-    # 去重：按 rule+chains
-    seen: set = set()
-    deduped = []
+    def fmt_bytes(b: int) -> str:
+        if b < 1024:        return f"{b}B"
+        if b < 1024 * 1024: return f"{b/1024:.1f}K"
+        return f"{b/1024/1024:.1f}M"
+
+    # 按完整链路聚合：相同链路的连接合并计数、流量累加，不再逐条平铺
+    groups: dict = {}
     for c in domain_conns:
-        rule   = c.get("rule", "?")
-        rp     = c.get("rulePayload", "")
         chains = c.get("chains", [])
-        key    = f"{rule}|{rp}|{','.join(chains)}"
-        if key not in seen:
-            seen.add(key)
-            deduped.append(c)
-
-    for c in deduped:
-        rule       = c.get("rule", "?")
-        rp         = c.get("rulePayload", "")
-        chains     = c.get("chains", [])
-        chain_str  = " → ".join(reversed(chains)) if chains else "?"
-        rp_str     = f"({rp})" if rp else ""
-        print(f"  规则: {CYAN}{rule}{rp_str}{NC}")
-        print(f"  链路: {chain_str}")
-
-    # 与预测对比
+        chain_str = " → ".join(reversed(chains)) if chains else "?"
+        g = groups.setdefault(chain_str, {"chains": chains, "count": 0,
+                                          "up": 0, "down": 0})
+        g["count"] += 1
+        g["up"]   += c.get("upload", 0)
+        g["down"] += c.get("download", 0)
+
+    # 是否符合预测：预测的组名出现在链路任意一跳即算命中。
+    #   proxy 链 chains=[节点, proxy-tuic, proxy] → 含 'proxy' → 符合
+    #   DIRECT 链 chains=['DIRECT']              → 不含       → 不符合
+    # （不再纠结 chains[0] 是末端节点还是 chains[-1] 是入口组——用集合判定消除歧义）
+    def _matches(chains: list):
+        if not predicted_proxy:
+            return None
+        return any(ch.lower() == predicted_proxy.lower() for ch in chains)
+
+    total = len(domain_conns)
+    print(f"  {DIM}(mihomo 当前活跃连接 {total} 条){NC}")
     if predicted_proxy:
-        actual_chains  = domain_conns[0].get("chains", [])
-        actual_outbound = actual_chains[-1] if actual_chains else "?"
-        if actual_outbound.lower() != predicted_proxy.lower():
-            print(f"  {YELLOW}⚠ 预测出口 {predicted_proxy}，实际出口 {actual_outbound}{NC}")
+        print(f"  应走(规则预测): {BOLD}{predicted_proxy}{NC}")
+    print("  实走:")
+
+    items = [(_matches(g["chains"]), s, g) for s, g in groups.items()]
+    items.sort(key=lambda x: (x[0] is not True, -x[2]["count"]))  # 符合在前，多的在前
+
+    match_n = mismatch_n = 0
+    for ok, chain_str, g in items:
+        if ok is True:
+            mark = f"{GREEN}✓{NC}"; match_n += g["count"]
+        elif ok is False:
+            mark = f"{YELLOW}✗{NC}"; mismatch_n += g["count"]
         else:
-            print(f"  {GREEN}✓ 与规则预测一致{NC}")
-
-    # 连接详情
-    print(f"  {DIM}---{NC}")
-    domain_conns.sort(key=lambda x: x.get("start", ""), reverse=True)
-    for c in domain_conns[:5]:
-        m      = c.get("metadata", {})
-        host   = m.get("host", "?")
-        dport  = m.get("destinationPort", "?")
-        up     = c.get("upload", 0)
-        down   = c.get("download", 0)
-        chains = c.get("chains", [])
-        outbound = chains[0] if chains else "?"
+            mark = " "
+        flow = f"↑{fmt_bytes(g['up'])} ↓{fmt_bytes(g['down'])}"
+        print(f"    {mark} {chain_str}  {DIM}·{NC}  {g['count']} 条  {DIM}{flow}{NC}")
 
-        def fmt_bytes(b: int) -> str:
-            if b < 1024:         return f"{b}B"
-            if b < 1024 * 1024:  return f"{b/1024:.1f}K"
-            return f"{b/1024/1024:.1f}M"
-
-        print(f"  {host}:{dport}  {outbound}  ↑{fmt_bytes(up)} ↓{fmt_bytes(down)}")
+    if not predicted_proxy:
+        return
+    if mismatch_n == 0:
+        print(f"  {GREEN}✓ 结论: 全部 {total} 条都走 {predicted_proxy}，与规则一致{NC}")
+    elif match_n == 0:
+        print(f"  {YELLOW}✗ 结论: {total} 条都没走 {predicted_proxy}；"
+              f"规则可能未生效，或被前置规则截胡{NC}")
+    else:
+        print(f"  {YELLOW}⚠ 结论: {match_n} 条新连接已走 {predicted_proxy}，"
+              f"另 {mismatch_n} 条仍走旧链路{NC}")
+        print(f"  {DIM}     旧链路是改规则前建立的连接（建连时已定死，不随规则切换），"
+              f"会随超时自然断开；{NC}")
+        print(f"  {DIM}     刷新页面后即全部走 {predicted_proxy}。{NC}")
 
 
 def cmd_trace(raw_input: str, api: str, secret: str, config: dict = None):
@@ -568,7 +659,17 @@ def cmd_trace(raw_input: str, api: str, secret: str, config: dict = None):
         resolved_ips = _section_dns(domain, api, secret, fakeip_active, corp_dns)
         collector["stages"]["dns"] = {"resolved": list(resolved_ips), "skipped": False}
 
-    predicted_rule, predicted_proxy = _section_rules(domain, resolved_ips, api, secret)
+    # no-resolve 的 IP 规则只在连接带真实目的 IP 时才会被引擎匹配：
+    #   - 目标输入就是 IP
+    #   - redir-host + TUN on（内核按真实 IP 路由）
+    # 域名经 HTTP 代理 / fake-ip 进来时尚未解析 → 这些规则被引擎跳过
+    noresolve_can_match = _is_ip(domain) or (
+        mode["enhanced_mode"] != "fake-ip" and mode["tun_enabled"]
+    )
+    predicted_rule, predicted_proxy = _section_rules(
+        domain, resolved_ips, api, secret,
+        noresolve_can_match, _load_noresolve_payloads(),
+    )
     collector["stages"]["rules"] = {
         "predicted_rule": predicted_rule,
         "predicted_proxy": predicted_proxy,