proxyctl 0.5.9__tar.gz → 0.5.11__tar.gz

{proxyctl-0.5.9 → proxyctl-0.5.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proxyctl
-Version: 0.5.9
+Version: 0.5.11
 Summary: Proxy configuration lifecycle management for macOS and Linux
 Project-URL: Homepage, https://github.com/crhan/proxyctl
 Project-URL: Issues, https://github.com/crhan/proxyctl/issues

{proxyctl-0.5.9 → proxyctl-0.5.11}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "proxyctl"
-version = "0.5.9"
+version = "0.5.11"
 description = "Proxy configuration lifecycle management for macOS and Linux"
 readme = "README.md"
 requires-python = ">=3.10"

{proxyctl-0.5.9 → proxyctl-0.5.11}/src/proxyctl/audit.py

@@ -180,8 +180,18 @@ def _is_covered(host: str, suffix_set: set) -> bool:
     return any(".".join(parts[i:]) in suffix_set for i in range(len(parts)))
 
 
+_AUDIT_DENY_OUTBOUNDS = {"block", "reject"}
+
+
 def _load_rules() -> tuple:
-    """从双 config 读取 direct/proxy 域名后缀规则集。"""
+    """从双 config 读取 direct/proxy 域名后缀规则集。
+
+    分类策略：``direct`` outbound 归 direct；``block`` / ``reject`` 忽略；
+    其它任意 outbound 名（用户的命名组如 ``proxy`` / ``residential-tw`` /
+    个人命名组等）一律视为"代理类"，归入 ``proxy_suffixes``。
+    这里**不 hardcode 任何具体的代理组名**——通用基线插件和 audit 都不
+    应假设用户配置里有某个特定名字的组。
+    """
     direct_suffixes: set = set()
     proxy_suffixes: set = set()
 
@@ -189,12 +199,15 @@ def _load_rules() -> tuple:
     try:
         cfg = json.load(open(SB_CONFIG))
         for rule in cfg.get("route", {}).get("rules", []):
-            ob = rule.get("outbound", "")
+            ob = (rule.get("outbound") or "").strip()
+            if not ob:
+                continue
+            ob_lc = ob.lower()
             for s in rule.get("domain_suffix", []):
                 s = s.lstrip(".")
-                if ob == "direct":
+                if ob_lc == "direct":
                     direct_suffixes.add(s)
-                elif ob in ("proxy", "claude"):
+                elif ob_lc not in _AUDIT_DENY_OUTBOUNDS:
                     proxy_suffixes.add(s)
     except Exception:
         pass
@@ -202,13 +215,17 @@ def _load_rules() -> tuple:
     # mihomo YAML (文本扫描，无需解析完整 YAML)
     try:
         for line in open(MH_CONFIG):
-            m = re.match(r'\s*-\s+DOMAIN-SUFFIX,([^,]+),(DIRECT|proxy|claude)', line, re.I)
-            if m:
-                dom, target = m.group(1), m.group(2)
-                if target.upper() == "DIRECT":
-                    direct_suffixes.add(dom)
-                else:
-                    proxy_suffixes.add(dom)
+            # group(2) 取第一个 outbound 段（到下一个逗号或空白），
+            # 避免把 "proxy,no-resolve" 整体当作 outbound 名。
+            m = re.match(r'\s*-\s+DOMAIN-SUFFIX,([^,]+),([^,\s]+)', line, re.I)
+            if not m:
+                continue
+            dom, target = m.group(1), m.group(2)
+            target_lc = target.lower()
+            if target_lc == "direct":
+                direct_suffixes.add(dom)
+            elif target_lc not in _AUDIT_DENY_OUTBOUNDS:
+                proxy_suffixes.add(dom)
     except Exception:
         pass
 

{proxyctl-0.5.9 → proxyctl-0.5.11}/src/proxyctl/builtin_plugins/connectivity_basic.py

@@ -3,12 +3,17 @@
 提供一组跨所有用户都通用的连通性测试点：
 - 海外（走代理）：google / github
 - 国内（直连）：baidu
-- AI 线路：openai / anthropic（anthropic 走 claude 规则组）
+- AI 线路：openai / anthropic
 
 本机特例（discord/telegram、企业内网等）请走用户插件。
 
 代理组：默认提供 "proxy"（绝大多数 mihomo/sing-box 配置都有这个组）。
-其他组（claude / residential-* 等）由用户插件提供。
+命名组（如 claude / residential-* 等）和针对它们的 expected_proxy 校验、
+出口探测都属本机特例，请放到 ~/.config/proxyctl/plugins/ 的用户插件里，
+不要 hardcode 进这个通用基线插件。
+
+出口探测：默认只提供 proxy（走主代理）/ direct（绕代理）两路对照，
+足够做分流校验；其它命名出口由用户插件按 name 追加或覆盖。
 """
 
 from proxyctl.core.plugin import CheckTarget, OutboundProbe, Plugin
@@ -30,14 +35,12 @@ class ConnectivityBasic(Plugin):
             CheckTarget(name="baidu",  url="https://www.baidu.com",  mode="direct"),
             CheckTarget(name="anthropic",
                         url="https://api.anthropic.com/v1/models",
-                        mode="proxy",
-                        expected_proxy="claude"),
+                        mode="proxy"),
         ]
 
     def check_outbound_probes(self, ctx: dict) -> list[OutboundProbe]:
         return [
             OutboundProbe(name="proxy", mode="proxy", url="https://api.ipify.org"),
-            OutboundProbe(name="claude", mode="proxy", url="https://ipinfo.io/ip"),
             OutboundProbe(name="direct",
                           mode="direct",
                           url="https://myip.ipip.net",

{proxyctl-0.5.9 → proxyctl-0.5.11}/src/proxyctl/check.py

@@ -35,6 +35,11 @@ def _strip_ansi(s: str) -> str:
     return _ANSI_RE.sub("", s).strip()
 
 
+def _visible_len(s: str) -> int:
+    """Return printable width for simple check output alignment."""
+    return len(_ANSI_RE.sub("", s))
+
+
 def _port_listening(port: int) -> bool:
     try:
         with socket.create_connection(("127.0.0.1", port), timeout=0.5):
@@ -162,11 +167,15 @@ def _target_uses_expected_proxy(api_base: str, api_secret: str, url: str,
 
 
 def _connectivity_line_value(mode: str) -> str:
-    """Return the default route-line label for one check target mode."""
+    """Return the default route-line label for one check target mode.
+
+    proxy 模式默认值是 em dash ("—") 而非问号——含义是"反查不到活动连接"，
+    比裸 "?" 信息密度更高、视觉更安静。真实反查命中时会被实际链路覆盖。
+    """
     if mode == "direct":
         return "direct"
     if mode == "proxy":
-        return "?"
+        return "—"
     return "-"
 
 
@@ -174,7 +183,8 @@ def _append_route_column(line: str, route_line: str,
                          route_chain: str = "") -> str:
     """Append the observed route in the same style as Mihomo chains."""
     value = route_chain or route_line or "-"
-    return f"{line}  {DIM}via{NC} {value:<32s}"
+    pad = max(2, 74 - _visible_len(line))
+    return f"{line}{' ' * pad}{DIM}via{NC} {value:<32s}"
 
 
 def _dedupe_check_targets(targets: list) -> list:
@@ -202,17 +212,23 @@ def _dedupe_check_targets(targets: list) -> list:
 
 
 def _dedupe_outbound_probes(probes: list) -> list:
-    """Drop exact duplicate outbound probes from multiple plugins."""
-    out = []
-    seen = set()
+    """Collapse outbound probes that share a (name, mode) identity.
+
+    A probe answers one question — "what IP does this egress show?" — so two
+    probes with the same ``name`` and ``mode`` are the same egress row even if
+    they hit different URLs (e.g. a builtin ``https://myip.ipip.net`` vs a user
+    plugin's ``http://`` variant). User plugins load after builtins, so the
+    later probe wins on conflict (本机特例覆盖通用基线), while the original
+    display position is preserved so row order stays stable across runs.
+    """
+    out: list = []
+    index: dict = {}  # (name, mode) -> position in out
     for probe in probes:
-        key = (getattr(probe, "name", ""),
-               getattr(probe, "mode", ""),
-               getattr(probe, "url", ""),
-               getattr(probe, "extract_re", ""))
-        if key in seen:
+        key = (getattr(probe, "name", ""), getattr(probe, "mode", ""))
+        if key in index:
+            out[index[key]] = probe  # later (user) probe overrides earlier
             continue
-        seen.add(key)
+        index[key] = len(out)
         out.append(probe)
     return out
 
@@ -1192,14 +1208,49 @@ def cmd_check(engine, api: str, api_secret: str,
                 parts = target.url.removeprefix("tcp:").rsplit(":", 1)
                 ok, line = _test_tcp(parts[0], int(parts[1]), target.name)
             else:
+                # proxy 模式：在 curl 测试**进行中**并发轮询 mihomo 的
+                # /connections，趁连接还活着抓到自己请求走的链路。
+                # curl 短连接测完即从 mihomo 连接表移除，如果等 curl 结束
+                # 后再查（旧实现），几乎抓不到自己刚发的请求 —— 这是
+                # google/github/openai 的 via 列长期显示 "?" 的根因。
+                host = urllib.parse.urlparse(target.url).hostname or ""
+                captured: dict = {}
+                stop_evt = threading.Event()
+                poller = None
+                if target.mode == "proxy" and host:
+                    def _poll():
+                        # Event.wait(timeout) 在 set 时立即返回 True，
+                        # 不会被 sleep 拖住停止响应。
+                        while not stop_evt.is_set():
+                            r = _route_from_connections(
+                                _api_connections(api, api_secret), host)
+                            if r.get("found"):
+                                captured.update(r)
+                                return
+                            stop_evt.wait(0.08)
+                    poller = threading.Thread(target=_poll, daemon=True)
+                    poller.start()
+
                 ok, line = _test_url(target.url, target.name,
                                      target.mode, target.timeout,
                                      proxy_port=proxy_port)
+
+                if poller is not None:
+                    stop_evt.set()
+                    poller.join(timeout=0.5)
+
                 expected = getattr(target, "expected_proxy", "")
                 if target.mode == "proxy" and ok:
-                    route = _target_route(api, api_secret, target.url)
-                    route_line = str(route.get("line") or "?")
-                    route_chain = str(route.get("chain") or "")
+                    # 优先取 curl 期间并发抓到的；抓不到时回退 _target_route，
+                    # 它可能从外部进程的活动长连接里命中（如用户的浏览器/
+                    # Claude Code 正在访问同一 host）。两者都没找到时
+                    # route_line 保留默认的 "—" 占位（_connectivity_line_value
+                    # 提供的友好兜底），而不是裸 "?"。
+                    route = (captured if captured.get("found")
+                             else _target_route(api, api_secret, target.url))
+                    if route.get("found"):
+                        route_line = str(route.get("line") or route_line)
+                        route_chain = str(route.get("chain") or "")
                     if expected:
                         route_ok, route_msg = _route_matches_expected_proxy(
                             route, expected)

{proxyctl-0.5.9 → proxyctl-0.5.11}/src/proxyctl/trace.py

@@ -93,6 +93,52 @@ def _is_ip(s: str) -> bool:
         return False
 
 
+def _cidr_contains_any(cidr: str, ips: list) -> bool:
+    """resolved_ips 里是否有任一 IP 落在 cidr 网段内。"""
+    try:
+        net = ipaddress.ip_network(cidr, strict=False)
+    except ValueError:
+        return False
+    for ip in ips:
+        try:
+            if ipaddress.ip_address(ip) in net:
+                return True
+        except ValueError:
+            pass
+    return False
+
+
+def _load_noresolve_payloads(config_path: str = None) -> set:
+    """读取 mihomo 配置 rules 段，返回带 no-resolve 的 IP 规则 payload 集合。
+
+    Clash /rules API 不暴露 no-resolve 标志，预测器只能从配置文件解析。
+    这些规则在域名连接（HTTP 代理 / fake-ip）下引擎不会解析域名，故不命中——
+    预测器必须据此跳过，否则会误报命中（典型：100.64.0.0/10,DIRECT,no-resolve）。
+    """
+    import os
+    if config_path is None:
+        config_path = os.path.expanduser("~/.config/mihomo/config.yaml")
+    payloads: set = set()
+    try:
+        text = open(config_path).read()
+    except OSError:
+        return payloads
+    in_rules = False
+    for line in text.splitlines():
+        if re.match(r'^rules:\s*$', line):
+            in_rules = True
+            continue
+        if not in_rules:
+            continue
+        # rules 段结束：遇到顶格的新顶层键（非缩进、非列表项）
+        if line and not line[0].isspace() and not line.lstrip().startswith('-'):
+            break
+        m = re.match(r'\s*-\s*(?:IP-CIDR6?|IP-SUFFIX),([^,]+),[^,]+,\s*no-resolve\b', line)
+        if m:
+            payloads.add(m.group(1).strip())
+    return payloads
+
+
 def _section_dns(domain: str, api: str, secret: str,
                  fakeip_active: bool = False, corp_dns: dict = None) -> list:
     """
@@ -208,9 +254,16 @@ def _section_dns(domain: str, api: str, secret: str,
     return resolved_ips
 
 
-def _section_rules(domain: str, resolved_ips: list, api: str, secret: str) -> tuple:
+def _section_rules(domain: str, resolved_ips: list, api: str, secret: str,
+                   noresolve_can_match: bool = True,
+                   noresolve_payloads: set = None) -> tuple:
     """
     [2/4] 规则匹配 — 按引擎规则顺序逐条预测。
+
+    Args:
+        noresolve_can_match: 当前连接是否带真实目的 IP。域名经 HTTP 代理 / fake-ip
+            进来时为 False——此时引擎走到 no-resolve 的 IP 规则尚未解析，会跳过它们。
+        noresolve_payloads: 配置里带 no-resolve 的 IP 规则 payload 集合（_load_noresolve_payloads）。
     返回 (predicted_rule, predicted_proxy)。
     """
     print(f"\n{BOLD}[2/4] 规则匹配{NC}")
@@ -219,6 +272,9 @@ def _section_rules(domain: str, resolved_ips: list, api: str, secret: str) -> tu
         print(f"  {RED}无法获取规则列表{NC}")
         return None, None
 
+    noresolve_payloads = noresolve_payloads or set()
+    skipped_noresolve: list = []   # 因 no-resolve 被跳过、但本可命中的规则（用于提示）
+
     predicted_rule = predicted_proxy = None
     for rule in rules_data.get("rules", []):
         rtype   = rule.get("type", "")
@@ -241,6 +297,14 @@ def _section_rules(domain: str, resolved_ips: list, api: str, secret: str) -> tu
                 matched = True
                 detail  = f"精确域名 {payload}"
         elif rtype == "IPCIDR" and resolved_ips:
+            # no-resolve 的 IP 规则只在连接本身带真实目的 IP 时才会被引擎匹配。
+            # 域名经 HTTP 代理 / fake-ip 进来时，引擎走到这条还没解析 → 跳过，
+            # 否则误报命中（典型坑：100.64.0.0/10,DIRECT,no-resolve 被预测成 DIRECT，
+            # 实际却落兜底走 proxy）。
+            if (not noresolve_can_match) and payload in noresolve_payloads:
+                if _cidr_contains_any(payload, resolved_ips):
+                    skipped_noresolve.append((rtype, payload, proxy))
+                continue
             try:
                 net = ipaddress.ip_network(payload, strict=False)
                 for ip in resolved_ips:
@@ -276,6 +340,13 @@ def _section_rules(domain: str, resolved_ips: list, api: str, secret: str) -> tu
                 )
                 print(f"  {DIM}注: 跳过了 {len(uncertain)} 条 GeoSite/GeoIP 规则 "
                       f"(无法客户端匹配): {types_str}{NC}")
+
+            if skipped_noresolve:
+                nr_str = ", ".join(
+                    f"{t}({p})→{pr}" for t, p, pr in skipped_noresolve[-3:]
+                )
+                print(f"  {YELLOW}注: 跳过了 {len(skipped_noresolve)} 条 no-resolve IP 规则 "
+                      f"(域名连接下引擎不解析，本应命中却不命中): {nr_str}{NC}")
             break
 
     if not predicted_rule:
@@ -568,7 +639,17 @@ def cmd_trace(raw_input: str, api: str, secret: str, config: dict = None):
         resolved_ips = _section_dns(domain, api, secret, fakeip_active, corp_dns)
         collector["stages"]["dns"] = {"resolved": list(resolved_ips), "skipped": False}
 
-    predicted_rule, predicted_proxy = _section_rules(domain, resolved_ips, api, secret)
+    # no-resolve 的 IP 规则只在连接带真实目的 IP 时才会被引擎匹配：
+    #   - 目标输入就是 IP
+    #   - redir-host + TUN on（内核按真实 IP 路由）
+    # 域名经 HTTP 代理 / fake-ip 进来时尚未解析 → 这些规则被引擎跳过
+    noresolve_can_match = _is_ip(domain) or (
+        mode["enhanced_mode"] != "fake-ip" and mode["tun_enabled"]
+    )
+    predicted_rule, predicted_proxy = _section_rules(
+        domain, resolved_ips, api, secret,
+        noresolve_can_match, _load_noresolve_payloads(),
+    )
     collector["stages"]["rules"] = {
         "predicted_rule": predicted_rule,
         "predicted_proxy": predicted_proxy,