sing-box-cli 0.1.4__tar.gz → 0.1.6__tar.gz

{sing_box_cli-0.1.4 → sing_box_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sing-box-cli
-Version: 0.1.4
+Version: 0.1.6
 Summary: cross-platform sing-box manager.
 Project-URL: Homepage, https://github.com/aittcuszz/sing-box-service
 Project-URL: Issues, https://github.com/atticuszz/sing-box-service/issues
@@ -160,6 +160,33 @@ Linux
 sudo sbc --help
 ```
 
+## Configuration
+
+Preview an update before applying it:
+
+```bash
+sbc config update https://sub.example.com/alice.json --dry-run
+sbc config update https://sub.example.com/alice.json --restart
+```
+
+`--dry-run` downloads and validates the configuration, then shows its diff without
+saving configuration, subscription URL or token. It does not create local config
+files or change their ownership. If combined with `--restart`, the service is left
+running without a restart.
+
+Subscription downloads retry once over IPv4 if the default connection fails or
+times out. Configured environment proxies are preserved: this direct IPv4 retry
+is skipped when a proxy is configured. HTTP errors such as 401/403 are not retried.
+
+Use one command to choose what to print:
+
+```bash
+sbc config get                 # configuration JSON
+sbc config get --subscription  # subscription URL
+```
+
+`config show` and `config show-sub` remain available as hidden compatibility aliases.
+
 ## Serve private GitHub configurations
 
 Set `GH_TOKEN` (or `GITHUB_TOKEN`) with **Contents: read** access to your private
@@ -168,6 +195,7 @@ repository, then run as your normal user:
 ```bash
 sbc config serve add https://github.com/owner/private-configs --domain sub.example.com
 sbc config serve list
+sbc token -c alice.json
 sbc config serve start
 sbc config serve stop
 ```
@@ -176,11 +204,20 @@ sbc config serve stop
 through its API without cloning; `start` runs in the background at `127.0.0.1:8080`
 by default. Use `--host` and `--port` for another listening address.
 
+Subscription downloads require a separate token. `sbc token -c FILE.json` prints its secret
+and a URL containing `?token=...` once; only its hash is stored on the server.
+Use `sbc token -l` to list tokens, `sbc token -r TOKEN` to revoke one, or
+`sbc token -r FILE.json` to revoke all tokens for a file. Creation infers a single
+registered domain; use `-d DOMAIN` when there are multiple domains. Each token is
+limited to its domain and file. The GitHub PAT stays on the server.
+
 Point Traefik at the server using [this example](docs/traefik-config-serve.yml).
 Clients continue to use the existing update command:
 
 ```bash
-sbc config update https://sub.example.com/alice.json --restart
+sbc config update https://sub.example.com/alice.json -t '<subscription-token>' --restart
+# Apps without header options can use the token URL printed by token -c.
+sbc config update 'https://sub.example.com/alice.json?token=<subscription-token>' --dry-run
 ```
 
 See [configuration server details](docs/config-serve.md) for settings, logs and limits.

{sing_box_cli-0.1.4 → sing_box_cli-0.1.6}/README.md

@@ -111,6 +111,33 @@ Linux
 sudo sbc --help
 ```
 
+## Configuration
+
+Preview an update before applying it:
+
+```bash
+sbc config update https://sub.example.com/alice.json --dry-run
+sbc config update https://sub.example.com/alice.json --restart
+```
+
+`--dry-run` downloads and validates the configuration, then shows its diff without
+saving configuration, subscription URL or token. It does not create local config
+files or change their ownership. If combined with `--restart`, the service is left
+running without a restart.
+
+Subscription downloads retry once over IPv4 if the default connection fails or
+times out. Configured environment proxies are preserved: this direct IPv4 retry
+is skipped when a proxy is configured. HTTP errors such as 401/403 are not retried.
+
+Use one command to choose what to print:
+
+```bash
+sbc config get                 # configuration JSON
+sbc config get --subscription  # subscription URL
+```
+
+`config show` and `config show-sub` remain available as hidden compatibility aliases.
+
 ## Serve private GitHub configurations
 
 Set `GH_TOKEN` (or `GITHUB_TOKEN`) with **Contents: read** access to your private
@@ -119,6 +146,7 @@ repository, then run as your normal user:
 ```bash
 sbc config serve add https://github.com/owner/private-configs --domain sub.example.com
 sbc config serve list
+sbc token -c alice.json
 sbc config serve start
 sbc config serve stop
 ```
@@ -127,11 +155,20 @@ sbc config serve stop
 through its API without cloning; `start` runs in the background at `127.0.0.1:8080`
 by default. Use `--host` and `--port` for another listening address.
 
+Subscription downloads require a separate token. `sbc token -c FILE.json` prints its secret
+and a URL containing `?token=...` once; only its hash is stored on the server.
+Use `sbc token -l` to list tokens, `sbc token -r TOKEN` to revoke one, or
+`sbc token -r FILE.json` to revoke all tokens for a file. Creation infers a single
+registered domain; use `-d DOMAIN` when there are multiple domains. Each token is
+limited to its domain and file. The GitHub PAT stays on the server.
+
 Point Traefik at the server using [this example](docs/traefik-config-serve.yml).
 Clients continue to use the existing update command:
 
 ```bash
-sbc config update https://sub.example.com/alice.json --restart
+sbc config update https://sub.example.com/alice.json -t '<subscription-token>' --restart
+# Apps without header options can use the token URL printed by token -c.
+sbc config update 'https://sub.example.com/alice.json?token=<subscription-token>' --dry-run
 ```
 
 See [configuration server details](docs/config-serve.md) for settings, logs and limits.

sing_box_cli-0.1.6/docs/config-serve.md

@@ -0,0 +1,108 @@
+# Configuration server
+
+The server maps one domain to one private GitHub repository. Multiple domains can
+share a server. Set `GH_TOKEN` or `GITHUB_TOKEN` to a fine-grained token with
+**Contents: read** access to all registered repositories.
+
+`config serve add` checks GitHub access and saves the binding; registering the same
+binding again is safe. `config serve list` validates root `.json` files with the
+sing-box core bundled with this package, prints valid URLs, and reports invalid
+configurations on stderr. Those URLs require a separate subscription token;
+the GitHub PAT stays on the server and is never used as a client credential.
+
+## Subscription tokens
+
+Use the short top-level command to manage subscription tokens:
+
+```bash
+sbc token -c client-linux.json             # create a token
+sbc token -l                              # list token names and scopes
+sbc token -r '<subscription-token>'        # revoke this exact token
+sbc token -r client-linux.json             # revoke all tokens for this file
+```
+
+`-c FILE` prints the secret and a ready-to-use URL once. Store the secret when it is
+shown; the server keeps only its SHA-256 hash in `tokens.json`. `-l` prints names,
+domains, filenames and creation times without revealing secrets. Names are generated
+automatically; optionally use `-n NAME` for a meaningful label. When multiple domains
+are registered, add `-d DOMAIN` on creation. If a filename has tokens on multiple
+domains, revoking by file also requires `-d DOMAIN` to choose one domain.
+
+`-r TOKEN` matches the actual secret against the stored hash. `-r FILE.json` revokes
+every token for that file without affecting other files. Multiple tokens may
+authorize the same file, so rotation can create a replacement before revoking the
+old token. Revocation never prints the secret.
+
+The longer `config serve token -l/-c/-r` forms remain supported. The previous
+`config serve token create/list/revoke` subcommands remain hidden compatibility
+aliases; the legacy `revoke NAME` form still accepts a token name.
+
+Clients can send the token as a Bearer header using `-t` / `--token`, or use the
+printed URL with `?token=...` in applications that cannot set headers:
+
+```bash
+sbc config update https://sub.example.com/client-linux.json -t '<subscription-token>' --dry-run
+sbc config update 'https://sub.example.com/client-linux.json?token=<subscription-token>' --dry-run
+```
+
+The CLI extracts URL tokens before printing or saving the URL, sends them as Bearer
+credentials, and saves the clean URL and token separately on a normal update. URL
+tokens take precedence over a previously saved token. Conflicting URL and explicit
+`--token` credentials are rejected. `--dry-run` saves neither form.
+
+The server accepts either form directly. Missing, incorrect, revoked or out-of-scope
+credentials return **401** before any GitHub read. If both forms are supplied, they
+must match. No token settings means all downloads are denied; unreadable or corrupt
+settings also deny access. Token creation and revocation take effect on the next
+request without restarting. A token cannot read another domain or filename.
+
+Use HTTPS for public subscriptions. The service does not log request URLs or tokens;
+keep token query strings out of reverse-proxy access logs as well.
+
+## Background process
+
+`config serve start` waits until the socket is listening, then prints the PID,
+address and log path. Closing the terminal leaves the server running. Repeated
+starts use the existing process, and repeated stops are safe. Run `stop` as the
+same user with the same state directory. Restart after changing the GitHub token
+or upgrading the package. Existing deployments must upgrade and restart to enable
+subscription authentication; anonymous URLs then require a newly generated token.
+Boot-time startup is managed separately by deployment.
+
+Settings, process identity and `serve.log` are stored in the platform's
+`sing-box-cli/serve` application directory (`~/.config/sing-box-cli/serve` on Linux).
+Set `SBC_SERVE_DIR` to use another directory for all commands. Subscription token
+hashes are stored there; GitHub PATs, subscription secrets and client configuration
+are not. New registrations take effect while running.
+
+## GitHub reads and validation
+
+Requests read the repository's default branch through the GitHub Contents API.
+No Git installation, clone/pull, background synchronization or persistent config
+cache is needed. File updates and deletions take effect on subsequent requests.
+
+Each response is validated and preserves the original content. Missing files,
+invalid configurations and GitHub errors return HTTP errors. Configurations are
+limited to 5 MiB and must be compatible with the bundled core. Referenced sibling
+files are not downloaded. Existing client `--token` options and saved settings remain
+supported; use an independent subscription token for this server's URLs.
+
+Android's `route.override_android_vpn: true` is disabled only in the temporary
+core-check copy, so a Linux or Windows server can distribute Android configurations.
+Responses retain the original bytes, including the Android setting. Invalid
+option types, unknown fields and other core errors are still rejected; this does
+not verify the target device's runtime environment.
+
+## Traefik
+
+Merge [the example router and service](traefik-config-serve.yml) into the existing
+`http.routers` and `http.services` sections. Traefik must preserve the `Host` header.
+The example uses `websecure` and the host gateway from `digitalocean-public`'s
+`~/devspace/traefik.yml`. Bind to that gateway for this deployment:
+
+```bash
+sbc config serve start --host 172.18.0.1 --port 8080
+```
+
+Replace `sub.example.com` with your domain and configure DNS and the TLS
+certificate through your deployment. `--domain` only registers the binding.

{sing_box_cli-0.1.4 → sing_box_cli-0.1.6}/pyproject.toml

@@ -215,7 +215,7 @@ topo_order = false
 sort_commits = "oldest"
 
 [tool.bumpversion]
-current_version        = "0.1.4"
+current_version        = "0.1.6"
 parse                  = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize              = ["{major}.{minor}.{patch}"]
 search                 = "{current_version}"

{sing_box_cli-0.1.4 → sing_box_cli-0.1.6}/src/sing_box_cli/__init__.py

@@ -2,4 +2,4 @@ from .main import main
 
 __all__ = ["main"]
 
-__version__ = "0.1.4"
+__version__ = "0.1.6"

sing_box_cli-0.1.6/src/sing_box_cli/config/__init__.py

@@ -0,0 +1,97 @@
+from typing import Annotated
+
+import typer
+from rich import print
+
+from ..common import StrOrNone, ensure_root
+from ..service import SharedContext, get_context_obj
+from ..service.manager import create_service
+from .config import get_config
+from .serve import serve
+
+__all__ = ["config"]
+
+SubUrlArg = Annotated[str, typer.Argument(help="Subscription URL")]
+TokenOption = Annotated[
+    StrOrNone,
+    typer.Option(
+        "--token", "-t", help="Subscription access token (not the server's GitHub PAT)."
+    ),
+]
+RestartServiceOption = Annotated[
+    bool, typer.Option("--restart", "-r", help="Restart service after update.")
+]
+DryRunOption = Annotated[
+    bool,
+    typer.Option(
+        "--dry-run", help="Show configuration diff without saving or restarting."
+    ),
+]
+config = typer.Typer(help="Configuration management commands")
+config.add_typer(serve, name="serve")
+
+
+@config.callback()
+def config_callback(ctx: typer.Context) -> None:
+    if ctx.invoked_subcommand not in ("serve", "update"):
+        cfg = get_config(initialize=ctx.invoked_subcommand == "clear_cache")
+        ctx.obj = SharedContext(config=cfg, service=create_service(cfg))
+
+
+@config.command("update")
+def config_update(
+    url: SubUrlArg,
+    token: TokenOption = None,
+    restart: RestartServiceOption = False,
+    dry_run: DryRunOption = False,
+) -> None:
+    """Download configuration or preview its diff with --dry-run."""
+    cfg = get_config(initialize=not dry_run)
+    if not cfg.update_config(url, token, dry_run=dry_run):
+        print("❌ Failed to update configuration.")
+        raise typer.Exit(1)
+    if restart and not dry_run:
+        ensure_root()
+        service = create_service(cfg)
+        # init service
+        if not service.check_service():
+            service.create_service()
+            print("⌛ Service created successfully.")
+        service.restart()
+
+
+@config.command("get")
+def config_get(
+    ctx: typer.Context,
+    subscription: Annotated[
+        bool, typer.Option("--subscription", help="Print the subscription URL.")
+    ] = False,
+) -> None:
+    """Print configuration, or select the subscription URL with --subscription."""
+    cfg = get_context_obj(ctx).config
+    if subscription:
+        if cfg.sub_url:
+            print(f"🔗 Current subscription URL: {cfg.sub_url}")
+        else:
+            print("❌ No subscription URL found.")
+    else:
+        print(cfg.config_file_content)
+
+
+@config.command("show-sub", hidden=True)
+def config_show_sub(ctx: typer.Context) -> None:
+    """Compatibility alias for config get --subscription."""
+    config_get(ctx, subscription=True)
+
+
+@config.command("show", hidden=True)
+def config_show(ctx: typer.Context) -> None:
+    """Compatibility alias for config get."""
+    config_get(ctx)
+
+
+@config.command("clear_cache")
+def config_clear_cache(ctx: typer.Context) -> None:
+    """Clean cache database"""
+    ctx_obj = get_context_obj(ctx)
+    ctx_obj.config.clear_cache()

{sing_box_cli-0.1.4 → sing_box_cli-0.1.6}/src/sing_box_cli/config/config.py

@@ -11,7 +11,7 @@ from rich import print
 from sing_box_bin import get_bin_path
 
 from ..common import StrOrNone
-from .utils import request_get, show_diff_config
+from .utils import request_get, show_diff_config, subscription_credentials
 
 
 class ClashApiConfig(BaseModel):
@@ -239,8 +239,14 @@ class ConfigHandler:
         self._app_config.save(self._app_config_file)
         print("🔑 Token added successfully.")
 
-    def update_config(self, sub_url: StrOrNone = None, token: StrOrNone = None) -> bool:
-        """Download configuration from subscription URL and show differences."""
+    def update_config(
+        self,
+        sub_url: StrOrNone = None,
+        token: StrOrNone = None,
+        *,
+        dry_run: bool = False,
+    ) -> bool:
+        """Download and diff configuration, optionally without saving changes."""
         try:
             if sub_url is None:
                 # load from file
@@ -248,10 +254,12 @@ class ConfigHandler:
                     print("❌ No subscription URL found.")
                     return False
                 sub_url = self.sub_url
+            sub_url, token = subscription_credentials(sub_url, token)
             if token is None:
                 # load from file
                 token = self.token_content
-            print(f"⌛ Updating configuration from {sub_url}")
+            action = "Previewing" if dry_run else "Updating"
+            print(f"⌛ {action} configuration from {sub_url}")
             response = request_get(sub_url, token)
             if response is None:
                 print("❌ Failed to get configuration.")
@@ -259,9 +267,6 @@ class ConfigHandler:
 
             new_config = response.text
 
-            if not self.is_windows:
-                shutil.chown(self._config_file, user=self.user, group=self.user)
-
             # make sure same order of keys to avoid showing wrong diff
             new_config = self._sing_box_config.model_validate_json(
                 new_config
@@ -269,8 +274,17 @@ class ConfigHandler:
             if self.config_file_content == new_config:
                 print("📄 Configuration is up to date.")
             else:
-                # update and show differences
+                # show differences before saving
                 show_diff_config(self.config_file_content, new_config)
+
+            if dry_run:
+                print("📄 Dry run: no configuration or subscription changes saved.")
+                return True
+
+            if not self.is_windows:
+                shutil.chown(self._config_file, user=self.user, group=self.user)
+
+            if self.config_file_content != new_config:
                 self.config_file_content = new_config
 
             # Update subscription url file
@@ -307,10 +321,10 @@ class ConfigHandler:
         return info
 
 
-def get_config() -> ConfigHandler:
-    """Get a cached ConfigHandler instance."""
+def get_config(*, initialize: bool = True) -> ConfigHandler:
+    """Load configuration, optionally initializing local directories and files."""
     config = ConfigHandler()
-    if not config.init_directories():
+    if initialize and not config.init_directories():
         raise FileNotFoundError("❌ Failed to initialize directories")
     return config
 

{sing_box_cli-0.1.4 → sing_box_cli-0.1.6}/src/sing_box_cli/config/serve.py

@@ -25,9 +25,17 @@ from .serve_backend import (
     state_directory,
     validate_config,
 )
+from .serve_tokens import (
+    create_token,
+    load_tokens,
+    revoke_subscription_tokens,
+    revoke_token,
+)
 
 WORKER_MODULE = "sing_box_cli.config._serve_worker"
 serve = typer.Typer(help="Serve private GitHub configurations through your own domain.")
+tokens = typer.Typer(help="Create, list and revoke independent subscription tokens.")
+serve.add_typer(tokens, name="token")
 
 
 class ProcessState(BaseModel):
@@ -270,6 +278,132 @@ def start(
         print(f"Log: {directory / 'serve.log'}")
 
 
+@tokens.callback(invoke_without_command=True)
+def token_options(
+    ctx: typer.Context,
+    list_: Annotated[
+        bool, typer.Option("--list", "-l", help="List token names and file scopes.")
+    ] = False,
+    create: Annotated[
+        str | None,
+        typer.Option(
+            "--create", "-c", help="Create a token for this configuration filename."
+        ),
+    ] = None,
+    revoke: Annotated[
+        str | None,
+        typer.Option(
+            "--revoke",
+            "-r",
+            help="Revoke this token, or all tokens for this .json filename.",
+        ),
+    ] = None,
+    domain: Annotated[
+        str | None,
+        typer.Option(
+            "--domain",
+            "-d",
+            help="Domain; inferred when there is only one registered domain.",
+        ),
+    ] = None,
+    name: Annotated[
+        str | None, typer.Option("--name", "-n", help="Optional name for a new token.")
+    ] = None,
+) -> None:
+    """Manage subscription tokens with -l, -c FILE or -r TOKEN_OR_FILE."""
+    actions = int(list_) + int(create is not None) + int(revoke is not None)
+    if ctx.invoked_subcommand is not None:
+        if actions or domain is not None or name is not None:
+            raise typer.BadParameter("Use options or a legacy subcommand, not both.")
+        return
+    if actions == 0 and domain is None and name is None:
+        print(ctx.get_help())
+        return
+    if actions != 1:
+        raise typer.BadParameter(
+            "Choose exactly one of -l, -c FILE or -r TOKEN_OR_FILE."
+        )
+    if name is not None and create is None:
+        raise typer.BadParameter("--name is only used with --create.")
+    if list_:
+        if domain is not None:
+            raise typer.BadParameter("--domain is only used with --create or --revoke.")
+        token_list()
+    elif create is not None:
+        with command_errors():
+            if domain is None:
+                sources = load_sources(state_directory())
+                if len(sources) != 1:
+                    raise ServeError(
+                        "Specify --domain, or register a single domain first.", 400
+                    )
+                domain = sources[0].domain
+        token_create(name or f"token-{uuid.uuid4().hex[:12]}", domain, create)
+    else:
+        assert revoke is not None
+        with command_errors():
+            directory = state_directory()
+            with control_lock(directory):
+                count = revoke_subscription_tokens(directory, revoke, domain)
+            print(f"Revoked {count} subscription token(s).")
+
+
+@tokens.command("create", hidden=True)
+def token_create(
+    name: Annotated[
+        str, typer.Argument(help="Unique name for this subscription token.")
+    ],
+    domain: Annotated[
+        str, typer.Option("--domain", help="Registered subscription domain.")
+    ],
+    filename: Annotated[
+        str, typer.Option("--file", help="Root configuration filename.")
+    ],
+) -> None:
+    """Generate a file-scoped token and print its secret and URL once."""
+    with command_errors():
+        domain = normalize_domain(domain)
+        directory = state_directory()
+        with control_lock(directory):
+            source = next(
+                (item for item in load_sources(directory) if item.domain == domain),
+                None,
+            )
+            if source is None:
+                raise ServeError(
+                    "Register this domain with config serve add first.", 400
+                )
+            secret = create_token(directory, name, domain, filename)
+        print(f"Token: {secret}")
+        print(f"URL: {source.url(filename)}?token={secret}")
+        print("Save the token now; only its hash is stored on the server.")
+
+
+@tokens.command("list", hidden=True)
+def token_list() -> None:
+    """List token names and scopes without displaying their secrets."""
+    with command_errors():
+        entries = load_tokens(state_directory())
+        if not entries:
+            print("No subscription tokens.")
+        for item in entries:
+            print(f"{item.name}\t{item.domain}\t{item.filename}\t{item.created_at}")
+
+
+@tokens.command("revoke", hidden=True)
+def token_revoke(
+    name: Annotated[
+        str, typer.Argument(help="Name of the subscription token to revoke.")
+    ],
+) -> None:
+    """Revoke a token; the next request is denied without a service restart."""
+    with command_errors():
+        directory = state_directory()
+        with control_lock(directory):
+            revoke_token(directory, name)
+        print(f"Revoked subscription token: {name}")
+
+
 @serve.command("stop")
 def stop() -> None:
     """Stop this user's background configuration service."""

{sing_box_cli-0.1.4 → sing_box_cli-0.1.6}/src/sing_box_cli/config/serve_backend.py

@@ -309,8 +309,19 @@ class ConfigRequestHandler(BaseHTTPRequestHandler):
     server: ConfigHTTPServer
 
     def do_GET(self) -> None:
+        from .serve_tokens import authorize_subscription
+
         try:
             domain = normalize_domain(self.headers.get("Host", ""))
+            parsed = urlsplit(self.path)
+            filename = unquote(parsed.path.removeprefix("/"))
+            authorize_subscription(
+                self.server.directory,
+                domain,
+                filename,
+                self.headers.get_all("Authorization", []),
+                parsed.query,
+            )
             source = next(
                 (
                     item
@@ -319,7 +330,6 @@ class ConfigRequestHandler(BaseHTTPRequestHandler):
                 ),
                 None,
             )
-            filename = unquote(urlsplit(self.path).path.removeprefix("/"))
             if source is None or not valid_filename(filename):
                 raise ServeError("Configuration not found.", 404)
             content = self.server.github.config(source, filename)
@@ -336,6 +346,9 @@ class ConfigRequestHandler(BaseHTTPRequestHandler):
         self.send_header("Content-Type", "application/json; charset=utf-8")
         self.send_header("Content-Length", str(len(content)))
         self.send_header("Cache-Control", "no-store")
+        self.send_header("Referrer-Policy", "no-referrer")
+        if status == 401:
+            self.send_header("WWW-Authenticate", 'Bearer realm="subscription"')
         self.end_headers()
         try:
             self.wfile.write(content)

sing_box_cli-0.1.6/src/sing_box_cli/config/serve_tokens.py

@@ -0,0 +1,151 @@
+"""Named, file-scoped subscription credentials; GitHub credentials stay separate."""
+
+import hashlib
+import json
+import re
+import secrets
+from dataclasses import asdict, dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from urllib.parse import parse_qs
+
+from .serve_backend import ServeError, normalize_domain, valid_filename, write_json
+
+
+@dataclass(frozen=True)
+class SubscriptionToken:
+    name: str
+    domain: str
+    filename: str
+    digest: str
+    created_at: str
+
+
+def load_tokens(directory: Path) -> list[SubscriptionToken]:
+    path = directory / "tokens.json"
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+        tokens = [SubscriptionToken(**item) for item in data["tokens"]]
+        if len({item.name for item in tokens}) != len(tokens):
+            raise ValueError
+        for item in tokens:
+            if (
+                not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_.-]{0,63}", item.name)
+                or normalize_domain(item.domain) != item.domain
+                or not valid_filename(item.filename)
+                or not re.fullmatch(r"[0-9a-f]{64}", item.digest)
+                or not isinstance(item.created_at, str)
+            ):
+                raise ValueError
+        return tokens
+    except FileNotFoundError:
+        return []
+    except (OSError, ValueError, TypeError, KeyError, AttributeError, ServeError):
+        raise ServeError("Cannot read subscription token settings.", 503)
+
+
+def create_token(directory: Path, name: str, domain: str, filename: str) -> str:
+    """Return a new secret once and persist only its SHA-256 digest."""
+    if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_.-]{0,63}", name):
+        raise ServeError(
+            "Use a token name with 1-64 letters, digits, dots, _ or -.", 400
+        )
+    domain = normalize_domain(domain)
+    if not valid_filename(filename):
+        raise ServeError("Use a root configuration filename ending in .json.", 400)
+    tokens = load_tokens(directory)
+    if any(item.name == name for item in tokens):
+        raise ServeError(
+            "Token name already exists; revoke it before reusing the name.", 409
+        )
+    secret = secrets.token_urlsafe(32)
+    tokens.append(
+        SubscriptionToken(
+            name=name,
+            domain=domain,
+            filename=filename,
+            digest=hashlib.sha256(secret.encode()).hexdigest(),
+            created_at=datetime.now(timezone.utc).isoformat(),
+        )
+    )
+    write_json(directory / "tokens.json", {"tokens": [asdict(item) for item in tokens]})
+    return secret
+
+
+def revoke_token(directory: Path, name: str) -> None:
+    tokens = load_tokens(directory)
+    remaining = [item for item in tokens if item.name != name]
+    if len(remaining) == len(tokens):
+        raise ServeError("Subscription token not found.", 404)
+    write_json(
+        directory / "tokens.json", {"tokens": [asdict(item) for item in remaining]}
+    )
+
+
+def revoke_subscription_tokens(
+    directory: Path, target: str, domain: str | None = None
+) -> int:
+    """Revoke an exact secret, or every token for a configuration filename."""
+    entries = load_tokens(directory)
+    if domain is not None:
+        domain = normalize_domain(domain)
+    if valid_filename(target):
+        matches = [
+            item
+            for item in entries
+            if item.filename == target and (domain is None or item.domain == domain)
+        ]
+        if len({item.domain for item in matches}) > 1:
+            raise ServeError(
+                "This file has tokens on multiple domains; specify --domain.", 400
+            )
+    else:
+        digest = hashlib.sha256(target.encode()).hexdigest()
+        matches = [
+            item
+            for item in entries
+            if secrets.compare_digest(item.digest, digest)
+            and (domain is None or item.domain == domain)
+        ]
+    if not matches:
+        raise ServeError("No matching subscription tokens found.", 404)
+    remaining = [item for item in entries if item not in matches]
+    write_json(
+        directory / "tokens.json", {"tokens": [asdict(item) for item in remaining]}
+    )
+    return len(matches)
+
+
+def authorize_subscription(
+    directory: Path, domain: str, filename: str, authorization: list[str], query: str
+) -> None:
+    """Reject absent, conflicting, revoked or out-of-scope credentials."""
+    denied = ServeError("A valid subscription token is required.", 401)
+    try:
+        query_tokens = parse_qs(query, keep_blank_values=True, max_num_fields=32).get(
+            "token", []
+        )
+    except ValueError:
+        raise denied
+    if len(query_tokens) > 1 or len(authorization) > 1:
+        raise denied
+    bearer = None
+    if authorization:
+        parts = authorization[0].split()
+        if len(parts) != 2 or parts[0].lower() != "bearer":
+            raise denied
+        bearer = parts[1]
+    query_token = query_tokens[0] if query_tokens else None
+    if bearer is not None and query_token is not None and bearer != query_token:
+        raise denied
+    secret = bearer if bearer is not None else query_token
+    if not secret or len(secret) > 512 or any(char.isspace() for char in secret):
+        raise denied
+    digest = hashlib.sha256(secret.encode()).hexdigest()
+    if not any(
+        item.domain == domain
+        and item.filename == filename
+        and secrets.compare_digest(item.digest, digest)
+        for item in load_tokens(directory)
+    ):
+        raise denied

sing_box_cli-0.1.6/src/sing_box_cli/config/utils.py

@@ -0,0 +1,92 @@
+import json
+from difflib import unified_diff
+from pathlib import Path
+from typing import Any
+from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
+from urllib.request import getproxies
+
+import httpx
+from rich import print
+
+
+def show_diff_config(current_config: str, new_config: str) -> None:
+    print("📄 Configuration differences:")
+
+    diff = list(
+        unified_diff(
+            current_config.splitlines(),
+            new_config.splitlines(),
+            fromfile="old",
+            tofile="new",
+            lineterm="",
+        )
+    )
+
+    for line in diff:
+        if line.startswith("+"):
+            print(f"[green]{line}[/green]")
+        elif line.startswith("-"):
+            print(f"[red]{line}[/red]")
+        elif line.startswith("@@"):
+            print(f"[blue]{line}[/blue]")
+        else:
+            print(f"[white]{line}[/white]")
+
+
+def load_json_asdict(config_file: Path) -> dict[str, Any]:
+    try:
+        return dict(json.loads(config_file.read_text(encoding="utf-8")))
+    except Exception as e:
+        print(f"❌ Failed to load configuration: {e}")
+        return {}
+
+
+def subscription_credentials(
+    url: str, token: str | None = None
+) -> tuple[str, str | None]:
+    """Move a URL's subscription token out of the URL before logging or saving it."""
+    parsed = urlsplit(url)
+    pairs = parse_qsl(parsed.query, keep_blank_values=True, max_num_fields=32)
+    query_tokens = [value for key, value in pairs if key == "token"]
+    if not query_tokens:
+        return url, token
+    if (
+        len(query_tokens) != 1
+        or not query_tokens[0]
+        or len(query_tokens[0]) > 512
+        or any(char.isspace() for char in query_tokens[0])
+    ):
+        raise ValueError("Use exactly one non-empty subscription token in the URL.")
+    url_token = query_tokens[0]
+    if token is not None and token != url_token:
+        raise ValueError("The URL token and --token differ; supply only one token.")
+    query = urlencode([(key, value) for key, value in pairs if key != "token"])
+    return urlunsplit(parsed._replace(query=query)), url_token
+
+
+def request_get(url: str, token: str) -> httpx.Response | None:
+    # Strip credentials before any error can include the request URL.
+    safe_url = "subscription URL"
+    try:
+        url, resolved_token = subscription_credentials(url, token or None)
+        safe_url = url
+        headers = {"Content-Type": "application/json"}
+        if resolved_token:
+            headers["Authorization"] = f"Bearer {resolved_token}"
+        try:
+            response = httpx.get(url, headers=headers)
+        except (httpx.ConnectError, httpx.ConnectTimeout):
+            # A custom transport disables HTTPX's environment proxy detection.
+            # Never bypass a configured proxy when retrying a failed connection.
+            proxies = getproxies()
+            if any(proxies.get(scheme) for scheme in ("http", "https", "all")):
+                raise
+            print("⚠️ Connection failed; retrying over IPv4.")
+            transport = httpx.HTTPTransport(local_address="0.0.0.0")
+            with httpx.Client(transport=transport) as client:
+                response = client.get(url, headers=headers)
+        response.raise_for_status()
+        return response
+    except Exception as e:
+        print(f"❌ Failed to get from {safe_url}: {e}")
+        return None

{sing_box_cli-0.1.4 → sing_box_cli-0.1.6}/src/sing_box_cli/main.py

@@ -9,6 +9,7 @@ from sing_box_cli.api import api as api_app
 from sing_box_cli.common import ClearCacheOption, UpdateConfigOption, ensure_root
 from sing_box_cli.config import config as config_app
 from sing_box_cli.config.config import get_config, run_args
+from sing_box_cli.config.serve import tokens as token_app
 from sing_box_cli.installation import install_launchers
 from sing_box_cli.service import SharedContext, get_context_obj, service as service_app
 from sing_box_cli.service.manager import create_service
@@ -17,11 +18,12 @@ app = typer.Typer(help="sing-box manager.")
 app.add_typer(api_app)
 app.add_typer(service_app, name="service")
 app.add_typer(config_app, name="config")
+app.add_typer(token_app, name="token")
 
 
 @app.callback(invoke_without_command=False)
 def callback(ctx: typer.Context) -> None:
-    if ctx.invoked_subcommand in ("install", "config"):
+    if ctx.invoked_subcommand in ("install", "config", "token"):
         return
     cfg = get_config()
     service = create_service(cfg)

sing_box_cli-0.1.4/docs/config-serve.md

@@ -1,55 +0,0 @@
-# Configuration server
-
-The server maps one domain to one private GitHub repository. Multiple domains can
-share a server. Set `GH_TOKEN` or `GITHUB_TOKEN` to a fine-grained token with
-**Contents: read** access to all registered repositories.
-
-`config serve add` checks GitHub access and saves the binding; registering the same
-binding again is safe. `config serve list` validates root `.json` files with the
-sing-box core bundled with this package, prints valid URLs, and reports invalid
-configurations on stderr.
-
-## Background process
-
-`config serve start` waits until the socket is listening, then prints the PID,
-address and log path. Closing the terminal leaves the server running. Repeated
-starts use the existing process, and repeated stops are safe. Run `stop` as the
-same user with the same state directory. Restart after changing the GitHub token
-or upgrading the package. Boot-time startup is managed separately by deployment.
-
-Settings, process identity and `serve.log` are stored in the platform's
-`sing-box-cli/serve` application directory (`~/.config/sing-box-cli/serve` on Linux).
-Set `SBC_SERVE_DIR` to use another directory for all commands. Tokens and client
-configuration are not stored there. New registrations take effect while running.
-
-## GitHub reads and validation
-
-Requests read the repository's default branch through the GitHub Contents API.
-No Git installation, clone/pull, background synchronization or persistent config
-cache is needed. File updates and deletions take effect on subsequent requests.
-
-Each response is validated and preserves the original content. Missing files,
-invalid configurations and GitHub errors return HTTP errors. Configurations are
-limited to 5 MiB and must be compatible with the bundled core. Referenced sibling
-files are not downloaded. Existing client `--token` subscriptions and saved
-settings remain supported; server URLs need no client token.
-
-Android's `route.override_android_vpn: true` is disabled only in the temporary
-core-check copy, so a Linux or Windows server can distribute Android configurations.
-Responses retain the original bytes, including the Android setting. Invalid
-option types, unknown fields and other core errors are still rejected; this does
-not verify the target device's runtime environment.
-
-## Traefik
-
-Merge [the example router and service](traefik-config-serve.yml) into the existing
-`http.routers` and `http.services` sections. Traefik must preserve the `Host` header.
-The example uses `websecure` and the host gateway from `digitalocean-public`'s
-`~/devspace/traefik.yml`. Bind to that gateway for this deployment:
-
-```bash
-sbc config serve start --host 172.18.0.1 --port 8080
-```
-
-Replace `sub.example.com` with your domain and configure DNS and the TLS
-certificate through your deployment. `--domain` only registers the binding.

sing_box_cli-0.1.4/src/sing_box_cli/config/__init__.py

@@ -1,78 +0,0 @@
-from typing import Annotated
-
-import typer
-from rich import print
-
-from ..common import StrOrNone, ensure_root
-from ..service import SharedContext, get_context_obj
-from ..service.manager import create_service
-from .config import get_config
-from .serve import serve
-
-__all__ = ["config"]
-
-SubUrlArg = Annotated[str, typer.Argument(help="Subscription URL")]
-TokenOption = Annotated[
-    StrOrNone,
-    typer.Option("--token", "-t", help="Authentication token for the subscription URL"),
-]
-RestartServiceOption = Annotated[
-    bool, typer.Option("--restart", "-r", help="Restart service after update.")
-]
-config = typer.Typer(help="Configuration management commands")
-config.add_typer(serve, name="serve")
-
-
-@config.callback()
-def config_callback(ctx: typer.Context) -> None:
-    if ctx.invoked_subcommand != "serve":
-        cfg = get_config()
-        ctx.obj = SharedContext(config=cfg, service=create_service(cfg))
-
-
-@config.command("update")
-def config_update(
-    ctx: typer.Context,
-    url: SubUrlArg,
-    token: TokenOption = None,
-    restart: RestartServiceOption = False,
-) -> None:
-    """download configuration, save subscription url and restart service if needed"""
-    ctx_obj = get_context_obj(ctx)
-    if ctx_obj.config.update_config(url, token):
-        pass
-    else:
-        print("❌ Failed to update configuration.")
-        raise typer.Exit(1)
-    if restart:
-        ensure_root()
-        # init service
-        if not ctx_obj.service.check_service():
-            ctx_obj.service.create_service()
-            print("⌛ Service created successfully.")
-        ctx_obj.service.restart()
-
-
-@config.command("show-sub")
-def config_show_sub(ctx: typer.Context) -> None:
-    """Show subscription URL"""
-    ctx_obj = get_context_obj(ctx)
-    sub_url = ctx_obj.config.sub_url
-    if sub_url:
-        print(f"🔗 Current subscription URL: {sub_url}")
-    else:
-        print("❌ No subscription URL found.")
-
-
-@config.command("show")
-def config_show(ctx: typer.Context) -> None:
-    """Show configuration file"""
-    ctx_obj = get_context_obj(ctx)
-    print(ctx_obj.config.config_file_content)
-
-
-@config.command("clear_cache")
-def config_clear_cache(ctx: typer.Context) -> None:
-    """Clean cache database"""
-    ctx_obj = get_context_obj(ctx)
-    ctx_obj.config.clear_cache()

sing_box_cli-0.1.4/src/sing_box_cli/config/utils.py

@@ -1,52 +0,0 @@
-import json
-from difflib import unified_diff
-from pathlib import Path
-from typing import Any
-
-import httpx
-from rich import print
-
-
-def show_diff_config(current_config: str, new_config: str) -> None:
-    print("📄 Configuration differences:")
-
-    diff = list(
-        unified_diff(
-            current_config.splitlines(),
-            new_config.splitlines(),
-            fromfile="old",
-            tofile="new",
-            lineterm="",
-        )
-    )
-
-    for line in diff:
-        if line.startswith("+"):
-            print(f"[green]{line}[/green]")
-        elif line.startswith("-"):
-            print(f"[red]{line}[/red]")
-        elif line.startswith("@@"):
-            print(f"[blue]{line}[/blue]")
-        else:
-            print(f"[white]{line}[/white]")
-
-
-def load_json_asdict(config_file: Path) -> dict[str, Any]:
-    try:
-        return dict(json.loads(config_file.read_text(encoding="utf-8")))
-    except Exception as e:
-        print(f"❌ Failed to load configuration: {e}")
-        return {}
-
-
-def request_get(url: str, token: str) -> httpx.Response | None:
-    headers = {"Content-Type": "application/json"}
-    if token:
-        headers["Authorization"] = f"Bearer {token}"
-    try:
-        response = httpx.get(url, headers=headers)
-        response.raise_for_status()
-        return response
-    except Exception as e:
-        print(f"❌ Failed to get from {url}: {e}")
-        return None